Appendix_D _Technical_Library.pdf

BY THE ORDER OF THE COMMANDER

NORTH AMERICAN AEROSPACE

DEFENSE COMMAND (NORAD) AND

UNITED STATES NORTHERN

COMMAND (USNORTHCOM)

NORAD AND USNORTHCOM

INSTRUCTION 33-195

30 SEPTEMBER 2013

Communications and Information

INFORMATION TECHNOLOGY SERVICE

MANAGEMENT – CHANGE MANAGEMENT

PROCESS

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: NORAD and USNORTHCOM publications and forms are available on the

Headquarters NORAD and USNORTHCOM portal page for downloading at https://portal.noradnorthcom.mil/library/Pubs/SitePages/Home.aspx All other publications and forms are available at the organizations website.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: N-NC/J66

Certified by: N-NC/J6 (RDML T H Bond Jr.)

Pages: 4

This instruction implements the Information Technology Service Management (ITSM), Change

Management Process. To the extent its directions are inconsistent with guidance issued by a higher-level unit, the higher-level publication takes precedence, in accordance with AFI 33-360, Publications and Forms Management. This instruction applies to NORAD and USNORTHCOM

(N-NC) Headquarters (HQ), Subordinates, Regions, Sectors, all assigned and attached military, civilian, and contract personnel, consultants, third-party service providers, and all other authorized users granted access to NORAD and USNORTHCOM Information Systems regardless of location.

This instruction does not apply to Air Force Reserve Command or Air National Guard Units. Send recommendations to change, add, or delete information in this instruction to the Office of Primary

Responsibility (OPR) using the AF Form 847, Recommendation for Change of Publication; route

AF Form 847 from the field through the appropriate functional area chain of command. This publication may not be supplemented. Maintain and dispose of records created as a result of prescribed processes in accordance with the Chairman Joint Chiefs of Staff Manual (CJCSM)

5760.01A, Joint Staff and Combatant Command Records Management Manual: Volume I

(Procedures) and Volume II (Disposition Schedule).

1. Scope. The Change Management process applies to all changes to configuration items (CIs) maintained in the Configuration Management Database (CMDB) and/or changes to the production

Non-Secure Internet Protocol Network (NIPRNet), Secret Internet Protocol Network (SIPRNet), the NORAD Enterprise Network (NEN) and any network attached to or utilizing the above mentioned for transport, as well as all ITSM processes, policies and procedures. Subordinates, Regions and Sectors shall follow this policy for all changes dependent upon or integrated with HQ

NORAD and USNORTHCOM Networks, Computer Network Defense Infrastructure, Domain/Directory Services, Messaging and Web environments. Changes to other non-technical CIs https://portal.noradnorthcom.mil/library/Pubs/SitePages/Home.aspx 1243937821C Typewritten Text

1243937821C Typewritten Text

1243937821C Typewritten Text

1243937821C Typewritten Text Appendix D, Technical Library

2 NNCI33-195 30 SEPTEMBER 2013

including the NORAD and USNORTHCOM software catalog will follow this policy. Program of

Record and/or Program Managed systems are exempt from this policy.

2. Overview.

2.1. The purpose of Change Management is to provide a deliberate response to change requests in a timely manner while managing the risks associated with necessary change. The

Change Management process provides the means to control the lifecycle of all normal, emergency, and standard changes. Change Management leverages repeatable procedures, change models, and cross-functional approaches to minimize negative impacts to IT services, systems, and networks, while enabling prompt and efficient response to operational requirements. All changes will be authorized, recorded, prioritized, planned, tested, implemented, assessed, documented and reviewed in a controlled manner.

2.2. The Government ITSM Division Chief (N-NC/J66) appoints the Change Management

Process Owner. ITSM process owners are responsible for the development and operation of the assigned process(s) to include all documentation and reporting.

2.3. The Government Engineering Branch Chief (N-NC/J667) appoints the Change Manager for IT Service Management. The Change Manager is the process implementer and sees that the

Process Owners process functions according to the process owner’s guidance; he/she also chairs the ITSM-Change Board (ITSM-CB) in order to process Requests for Change.

2.4. The Change Management process CONOPS is posted at the NORAD and

USNORTHCOM ITSM portal under Governance, Change Management.

2.5. The ITSM-CB meets weekly or as required, virtually or in person to review the forward schedule of change and advise the Change Manager on each change under consideration.

Unless a Standard Change has been approved, all changes to any service listed in the service catalog, changes to configurations including, but not limited to network, desktop, server, and storage and/or a change to any configuration item in the CMDB and/or the production environment will be approved through the ITSM-CB prior to implementation.

3. Policy.

3.1. NORAD and USNORTHCOM shall utilize one Change Management process, based on the Information Technology Infrastructure Library (ITIL) Service Transition, Edition 2011 throughout the organization.

3.2. All Requests for Change are initiated via a Service Request to the NORAD and

USNORTHCOM Headquarters Service Desk, using the established Service Desk process.

3.3. N-NC/J6 IT staff shall make all changes and releases to the enterprise operational

(production) environment through the Change Management process.

3.4. Region, Sector and Subordinate staff shall make all changes and releases in their operational (production) environment once approved through the Change Management process.

3.5. The N-NC/J6 Change Management Process Owner shall be accountable for the entire

Change Management process and shall have the responsibility to develop policies and procedures pertaining to the process which must be approved by N-NC/J66.

3.6. The Change Management Process owner shall establish and maintain set procedures (as part of the Change Management process) so that changes are released into the live environment in a disciplined, effective, and efficient manner.

NNCI33-195 30 SEPTEMBER 2013 3

3.7. The N-NC/J6 Change Management Process Owner shall document, as part of the Change

Management process, procedures to handle changes that have a wider impact over and above the NORAD and USNORTHCOM enterprise. (E.g., Program Offices, Mission Systems)

3.8. N-NC/J6 shall ensure adherence to all other policies, practice standards, procedures, and guidelines issued in support of these policy statements including all Department of Defense

(DOD) Issuances (Directives, Instructions, Publications, Administrative Instructions, and

Directive Type Memorandums (DTM)).

3.9. N-NC/J6 shall enforce a zero-tolerance policy for unauthorized changes to any NORAD and USNORTHCOM networks, ITSM processes, policies and procedures. Personnel who make unauthorized changes may have their network access/network permissions revoked at the discretions of the J6. This applies to all government, military, civilian and contractor personnel accessing NORAD and USNORTHCOM Networks.

3.10. N-NC/J6 shall establish, at a minimum, the following government roles and boards:

3.10.1 Change Manager chairs ITSM-CB - responsible for approving, rejecting, or referring each RFC and overseeing the overall Change Management process work flow.

3.10.2 Change Board (ITSM-CB) – A cross-functional group of ITSM operators, engineers and information assurance specialist established to evaluate change requests for mission need, priority, cost/benefit and potential impacts to other systems or process.

Typically, the ITSM-CB makes recommendations for implementation, further analysis, deferment or cancellation.

3.10.3 Emergency Change Board (ITSM-ECB) – Same function as ITSM-CB but procedures are expedited to prevent, mitigate or repair a service outage or degradation.

3.11. Change requestors may participate in the Change Board concerning their RFC by requesting participation in the Service Request or RFC. The requestor will be contacted by the

Change Manager to coordinate participation.

3.12. N-NC/J6 Change Management Process Owner and Change Manager(s) shall conduct reviews on a regular basis (at least annually). Reviews shall focus on process consistency and repeatability, Critical Success Factors, and Key Performance Indicators. Results are communicated with the Change Managers, ITSM service providers, ITSM-CB, members and management, as appropriate. Improvement actions identified from change management shall be recorded and input into a plan for improving the service through Continual Service

Improvement.

3.13. N-NC/J6 Change Manager shall authorize an ITSM-ECB structure. The ITSM-ECB shall approve emergency changes that must be completed outside of the normal RFC process due to critical business requirements or risk. The Change Manager shall establish and maintain operating procedures to control the authorization and implementation of emergency changes.

3.14. N-NC/J6 Change Manager shall ensure that a process is in place to create standard models for low risk, frequent changes.

3.15. The N-NC/J6 Change Manager shall ensure all service and infrastructure changes have a clearly defined and documented scope.

4 NNCI33-195 30 SEPTEMBER 2013

3.16. The Change Manager is the sole authority for closing change requests by approving or disapproving. All disapproved RFCs will be communicated back the user with the disapproval category or reason via the assigned technician within 14 business days of submission.

4. Exceptions. Any NORAD and USNORTHCOM personnel, including government, contractor, consultants, and any other authorized users granted access to NORAD and USNORTHCOM

Information Systems may request a change or exception to this policy. All requests should be made in writing to the ITSM Process Governance Council and submitted via NIPRNet email to

N-NCJ66EnterpriseOperationsSupport-OMB@northcom.mil. All decisions must be properly documented and approved in writing by the approving authority for this policy.

CHARLES D. LUCKEY, MG, USA

Chief of Staff mailto:N-NCJ67EnterpriseOperationsSupport-OMB@northcom.mil

BY THE ORDER OF THE COMMANDER

NORTH AMERICAN AEROSPACE

DEFENCE COMMAND (NORAD) AND

UNITED STATES NORTHERN COMMAND

(USNORTHCOM)

INSTRUCTION 33-199

7 MARCH 2014

Communications and Information

COMMAND, CONTROL,

COMMUNICATIONS AND COMPUTERS

(C4) INTEGRATION PROCESS (IP)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Command publications and forms are available on the Headquarters

NORAD and USNORTHCOM portal library for downloading:

https://portal.noradnorthcom.mil/library/Pubs/SitePages/Home.aspx

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: N-NC/J68

Certified by: N-NC/J6 (RDML Bond)

Pages: 53

This instruction implements Department of Defense Directive (DODD) 8115.01, Information

Technology Portfolio Management. It provides guidance for NORAD and USNORTHCOM policies and procedures related to identifying, selecting, approving, integrating, and providing oversight of Information System and Cyberspace capabilities into, and removing Information

System and Cyberspace capabilities from, the NORAD and USNORTHCOM Enterprise. The

NORAD and USNORTHCOM Enterprise is defined as a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures. The Roles and Responsibilities section of this document specifies expectations of involved participants. It establishes procedures to integrate net-centric, interoperable capabilities strategically aligned to NORAD and USNORTHCOM mission, vision, and goals, as well as supporting mutual collaboration and information sharing across the Global Information Grid. This instruction supports the NORAD and USNORTHCOM

Chief Information Officer who is responsible for ensuring effective Information Technology (IT) management and oversight as tasked by DOD, Chairman of the Joint Chiefs of Staff (CJCS), and command directives. The Command, Control, Communication, and Computer Integration

Process (C4IP) applies to capabilities in the NORAD and USNORTHCOM IT Service Catalog.

Exceptions to this are externally managed mission systems and programs of record (e.g., Integrated Tactical Warning/Attack Assessment (ITW/AA), Battlefield Command Suite – Fixed

(BCS-F), Global Command and Control System (GCCS), Theater Battle Management and

Control System (TBMCS), and Ballistic Missile Defense System (BMDS)) as well as NORAD and USNORTHCOM intelligence systems capabilities. Externally managed mission system and programs of record IT requests are referred to the Special Project Office (SPO)/Program https://portal.noradnorthcom.mil/library/Pubs/SitePages/Home.aspx

2 NNCI33-199 7 MARCH 2014

Management Office (PMO) developed change control process and applicable NORAD and

USNORTHCOM Instruction, Policy, or Guidance. Intelligence systems related Service

Requests are referred to NORAD and USNORTHCOM Intelligence Directorate, N-NC/J2.

This instruction applies to personnel receiving Information System and Cyberspace capabilities or authorizations from NORAD and USNORTHCOM Headquarters to NORAD and/or

USNORTHCOM including subordinate units, and NORAD regions/sectors. This publication does not apply to Air National Guard or Air Force Reserve Command units. Send recommendations to change, add, or delete information in this instruction to the Office of Primary

Responsibility (OPR) using the AF Form 847, Recommendation for Change of Publication; route AF

Form 847s from the field through the appropriate functional’s chain of command. Maintain and dispose of records created as a result of prescribed processes in accordance with the Joint Staff

Disposition Schedule CJCSM 5760.01A, Joint Staff and Combatant Command Records Management

Manual: Vol I (Procedures) & Vol II (Disposition Schedule). The glossary of references and supporting information are found at Attachment 1.

1. Authorities

2. General

Figure 1. C4 Integration Process

3. Roles and Responsibilities

4. Procedures

Figure 2. Analysis Phase High Level Description

Figure 3. Selection Phase High-Level Description

Figure 4. Control Phase High-Level Description

Figure 5. Evaluation Phase High-Level Description

5. Guiding Principles and Concepts

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 25

Attachment 2—DETAILED PROCESS DIAGRAMS

1. Authorities:

1.1. The NORAD and USNORTHCOM Commander establishes the C4IP as an essential activity of both Commands. This process receives, analyzes, and approves new and modified

Information System and Cyberspace capabilities to support NORAD and USNORTHCOM missions, while recognizing and considering the integration and synchronization the two

Commands require.

1.2. As an extension of the NORAD and USNORTHCOM Corporate Deliberative Process, NNCI90-196, NORAD and USNORTHCOM Commander’s Decision Cycle Framework, NORAD and USNORTHCOM uses the C4IP to translate NORAD and USNORTHCOM

Strategic Guidance into recommendations and decisions resulting in balanced, executable

NNCI33-199 7 MARCH 2014 3

courses of action within acceptable levels of risk. The C4IP aligns with the best practices of the Information Technology Infrastructure Library (ITIL), Control Objectives for

Information and Related Technology (COBIT), PRojects IN Controlled Environments

(PRINCE2), Project Management Institute (PMI), and others as appropriate. The C4IP supports the N-NC/Chief of Staff (CS) Knowledge Management Board and N-NC/J6

Operational Architecture processes. The C4IP synchronizes with the DOD Planning, Programming, Budgeting and Execution (PPBE) System; Joint Capabilities Integration and

Development System (JCIDS) capability development process; the IT investment process as outlined in DOD Instruction (DODI) 8115.02, Information Technology Portfolio

Management Implementation; and was stated within the 2008 NORAD and USNORTHCOM

Information Technology Procurement Policy Letter, and the Clinger-Cohen Act of 1996.

The C4IP ensures all Information System and Cyberspace procurements are coordinated through N-NC/J6. The C4IP also aligns with the Commands’ requirements process described in N-NCI 90-144, Capabilities Requirements Process, as an avenue to pursue IT material solutions.

1.3. The Chief of Staff, NORAD and USNORTHCOM, has delegated authority for management of the C4IP to the Cyberspace Operations Directorate, N-NC/J6.

2. General:

2.1. This instruction defines the Chief of Staff approved process to manage IT investment by performing the following core functions to integrate Information Systems and Cyberspace capabilities into and remove Information Systems and Cyberspace capabilities from the

NORAD and USNORTHCOM Enterprise: Analysis, Selection, Control, and Evaluation (See

Figure 1). These four core functions implement policy established in DODD 8115.01, Information Technology Portfolio Management; consistent with the Commander’s vision, mission, and goals along with the NORAD and USNORTHCOM operational capabilities.

The intent of the C4IP is to maximize NORAD and USNORTHCOM operational capabilities through effective and efficient Information System and Cyberspace capabilities from prioritized investments. These capabilities are normally provided through Information

Technology (IT) services, systems, and equipment that are managed by N-NC/J6 using

Information Technology Service Management (ITSM) principles and concepts. The term IT services and capabilities used throughout this instruction is a general term that encompasses all Information Systems and Cyberspace capabilities defined in the NORAD and

USNORTHCOM IT Service Catalog.

Figure 1. C4 Integration Process.

Selection

Control

Evaluation

AnalysisService

Request

C4I Process

1. 2. 3. 4.

4 NNCI33-199 7 MARCH 2014

2.1.1. Analysis. Links IT portfolio objectives to NORAD and/or USNORTHCOM vision, mission, goals, objectives, and priorities; develops quantifiable outcome-based performance measures; identifies capability gaps, opportunities, and redundancies;

identifies risks.

2.1.2. Selection. Identifies and selects the best mix of Information Systems and

Cyberspace capability investments to strengthen and achieve goals and objectives for the portfolio and demonstrates the impact of alternative strategies and funding levels.

2.1.3. Control. Ensures management and monitoring of all projects initiated under the

IT portfolio using Project/Program Management best practices. The IT Portfolio is monitored and evaluated against portfolio performance measures to determine continue, modify, or terminate recommendations for individual project/program investments within the portfolio.

2.1.4. Evaluation. Measures actual contributions of the service, systems, and capabilities in the IT portfolio against documented customer requirements, service targets, and service level agreements. The evaluation will determine if the service, system, or capability should continue in its current state, be modified, or terminated.

2.2. To support Command-approved urgent, out of cycle needs, N-NC/J6 executes the

C4IP in an abbreviated and accelerated manner. This may result in changes to the existing

NORAD and USNORTHCOM Information System and Cyberspace project/program schedules.

3. Roles and Responsibilities:

3.1. NORAD and USNORTHCOM Chief of Staff (N-NC/CS). The N-NC/CS serves as the authority for the C4IP and approves this instruction.

3.2. NORAD and USNORTHCOM Directorates, Special Staff, Regions, Subordinate

Organizations shall:

3.2.1. Request new or modified Information System and Cyberspace capabilities to the

NORAD and USNORTHCOM networks. Requests can be made through the

Unclassified NORAD and USNORTHCOM Service Desk portal -https://portal.noradnorthcom.mil/functions/communications/ServiceDesk/SitePages/Hom e.aspx, phone (719.554.6358), or by walk-in or phone call to the Service Desk.

3.2.2. Designate a Resource Advisor to address resourcing requirements for new and modified IT capability requests.

3.2.3. Participate in the C4IP.

3.2.3.1. Designate, in writing, an individual to serve as the Customer

Representative from each Directorate. Customer Representatives will participate in monthly C4IP Working Group meetings.

3.2.3.2. Empower Customer Representatives to speak with authority for their organization on the analysis and approval of fully resourced new and modified

Information System and Cyberspace capabilities.

https://portal.noradnorthcom.mil/functions/communications/ServiceDesk/SitePages/Home.aspx https://portal.noradnorthcom.mil/functions/communications/ServiceDesk/SitePages/Home.aspx

NNCI33-199 7 MARCH 2014 5

3.2.3.3. Comply with the Customer Representative Concept of Operations

CONOPS) provided at the following link on the NORAD and USNORTHCOM portal:

https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Docume nt_Library/Forms/AllItems.aspx.

3.3. N-NC/J6 shall:

3.3.1. Manage and execute the C4IP on behalf of the Chief of Staff.

3.3.2. Use the NORAD and USNORTHCOM C4IP as a basis for new and modified

Information System and Cyberspace requirements review, analysis, validation, and project/program approval.

3.3.3. Designate the Chair of the C4IP Working Group, Service Portfolio Manager

(SPM), Business Relationship Manager (BRM), Supplier Manager, Service Owners, Project Management Office (PMO) Lead, and Electronic Information Systems (EIS)

Function Manager.

3.4. C4IP Working Group Chair shall:

3.4.1. Conduct monthly C4IP Working Group meetings to review, analyze, and approve fully resourced new or modified Information Systems and Cyberspace capabilities for execution.

3.4.2. Maintain, distribute, and execute the C4IP Working Group Charter for C4IP

Working Group meetings and activities.

3.5. Service Portfolio Manager (SPM) shall:

3.5.1. Manage the NORAD and USNORTHCOM IT Portfolio. The IT Portfolio consists of all planned capabilities, operational capabilities, and capabilities identified for retirement.

3.5.2. Prepare and present a quarterly SPM update to the Deputy Director’s Meeting

(DDM).

3.5.3. Serve as the Secretariat for the C4IP Working Group.

3.5.4. Maintain and execute the SPM CONOPS.

3.5.5. Maintain the Customer Representative CONOPS.

3.6. Project Management Office (PMO) Lead shall:

3.6.1. Monitor and manage the execution of all approved Information System and

Cyberspace Projects.

3.6.2. Maintain, distribute, and execute the PMO CONOPS.

3.7. Business Relationship Managers shall:

3.7.1. Act as principle liaison between Customer Representatives and the N-NC/J6 on new or modified Information Systems and Cyberspace capability requests.

3.7.2. Maintain, distribute, and execute the BRM CONOPS.

https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx

6 NNCI33-199 7 MARCH 2014

3.8. Supplier Manager shall:

3.8.1. Determine the required contract acquisition documents for the acquisition approach.

3.8.2. Provide advice and templates to the customer to prepare contract acquisition documentation that supports the acquisition approach.

3.8.3. Review and comment on customer prepared acquisition documentation required to support the acquisition strategy.

3.8.4. Perform activities to procure and contract services, labor, and equipment to satisfy approved IT projects.

3.9. Resource Advisor shall: Serve as resourcing specialist and liaison between parent organization and N-NC/J8 on budgetary issues.

3.10. EIS Functional Manager(s) shall:

3.10.1. Develop, review, and maintain inventories of EIS on the NORAD and

USNORTHCOM IT Service Catalog.

3.10.2. Work with Command Record Manager to determine whether the electronic system contains Federal records.

3.10.3. Ensure all EIS’s with Federal records comply with applicable Federal and DOD

Records Management Directives and Instructions.

3.11. Service Owner.

3.11.1. Provide expertise, oversight, management, and strategic direction on

Information Systems and Cyberspace capabilities in the NORAD and USNORTHCOM

IT Service Catalog.

3.11.2. Maintain awareness of joint-level initiatives and their impact on current and planned NORAD and USNORTHCOM Information Systems and Cyberspace capabilities.

3.11.3. Review technical documentation (e.g., Service Package, Service Design

Package, Release and Deployment Package, Early Life Support (ELS)) on new or modified Information Systems and Cyberspace capabilities processed through the C4IP to ensure integration and interoperability with current capabilities and compliance with planned changes/enhancements.

4. Procedures: Command Customer Representatives must sponsor and vet new or modified

Information Systems and Cyberspace capabilities to ensure they conform to the NORAD and

USNORTHCOM strategic vision and satisfy approved operational requirements. Analysis of requirements begins within N-NC/J6 and continues through the C4IP Working Group. The exception to this are Service Improvement Plans and Urgent/Out-of-Cycle requests – the Service

Owner and Chief of Staff respectively vet and validate these special requests. The C4IP

Working Group validates and approves fully resourced new or modified Information System and

Cyberspace capabilities for execution as a project/program. Information System and Cyberspace capabilities that do not receive unanimous approval by the C4IP Working Group are elevated to the DDM and/or Deputy Commander’s Synchronization Board (DSB) for review, approval, or

NNCI33-199 7 MARCH 2014 7

cancellation. C4IP Working Group membership is composed of representatives from NORAD and USNORTHCOM Headquarters, Regions, and Subordinates to ensure unity and economy of effort between NORAD and USNORTHCOM.

Incorporated into all the artifacts identified in this instruction is a robust review by all stakeholders. The stakeholder review ensures proposed solutions are technically feasible, financially affordable, and comply with cyberspace security requirements. The stakeholder reviews can change the approach and scope to any proposed solution, and potentially recommend cancelation of a request for technical, financial, or cyberspace security concerns.

The following provides a high-level description of the major processes, activities, and responsibilities under each of the four IT Portfolio Management phases (i.e., Analysis, Selection, Control, and Evaluation). A detailed “swim-lane” process diagram for each major process is located in Attachment 2. These detailed process diagrams show roles, responsibilities, hand-offs, and artifacts for all the processes.

4.1. Analysis: The Analysis phase of the C4IP addresses the critical front-end requirements for strategic planning, performance and results management. This phase evaluates potential new or modified Information System and Cyberspace capabilities in a number of key areas: satisfies documented gap or deficiency, eliminates unnecessary functions, improves service/process performance, enhances information sharing/collaboration, not duplicative to other operational services unless established as a suitable backup to a primary service, can be satisfied by Agency, Service, or Program capabilities, and/or bolsters systems security. The Analysis phase creates a directional foundation for the other activities.

8 NNCI33-199 7 MARCH 2014

Figure 2. Analysis Phase High Level Description.

St ar t

C4 I S co rin g/

Bi nn ing

SP

D ev elo pm en t

C4 I

Ap pr ov al

No n-se lec ted

1.

An aly sis

Se lec tio n

Co nd uc t T ria ge

Pr oc es s

No n-

St an da rd

Bi nn ing

Va lid ati on

P ro ce ss

Re so ur ce

De ter mi na tio n

Pr oc es s

No n-

St an

Se rvi

Re qu es t

Mi ss ion

Ca se

Ur ge nt/ O ut-of- Cy cle

Se

Pa ck ag e

Re so

Pl an

Se es t

1.1

1.2

1.3

1.4 . 1.5

2.

1.7

Se

Im pr ov em en t

Pl an

DD

M

Ap pr ov al

Ye s

No1.6

NNCI33-199 7 MARCH 2014 9

4.1.1. Conduct Triage Process (Figure 2, Process 1.1).

4.1.1.1. All requests for Information Services and Cyberspace Capabilities (e.g., services, systems, applications, and capabilities) start with a service request submitted through the NORAD and USNORTHCOM Service Desk, done via the portal, telephone, or walk-in.

4.1.1.2. The Service Desk receives all Service Requests and conducts an assessment to determine if they are a standard change, normal change, or non-standard. Standard requests are those requests that have been pre-approved by the government and are satisfied directly by the Service Desk. Normal requests are for services in the Service Catalog that cannot be immediately satisfied by the Service

Desk or other entity, without additional government input and approval – this includes missions systems, special program offices, and programs of record. While outside the scope of this document, it is important to note that standard and normal requests can result in the initiation of an IT project managed by the NORAD and

USNORTHCOM Project Management Office (PMO).

4.1.1.3. Non-standard changes encompass new Information Systems and

Cyberspace capabilities not in the IT Service Catalog, significant modification of existing services, and standard and normal requests that the government determine require additional analysis and review. The C4IP receives, analyzes, and approves non-standard service requests to ensure the requests meet the needs of NORAD and

USNORTHCOM and warrants the application of resources to satisfy. Non-standard service requests for Service Improvement Plans or Urgent/Out-of-Cycle will follow an abbreviated process through the C4IP, shown on the process diagrams within this document. The remaining requests will follow the complete C4IP steps.

4.1.1.4. The Service Desk will forward all non-standard service requests to the

Service Portfolio Management (SPM) Group. They will coordinate and collaborate with the appropriate Business Relationship Manager (BRM) and Customer

Representative for each non-standard service request to obtain any missing information on the request. The Customer Representative and BRM review will cover doctrine, organization, training, materiel, leadership and education, personnel and facilities (DOTMLPF) facets for the non-standard requests.

4.1.2. Non-Standard Binning & Validation Process (Figure 2, Process 1.2).

4.1.2.1. The SPM continues analysis of the non-standard service request in collaboration with the BRM and Customer Representative. From the analysis, the

SPM prepares a Non-Standard Analysis Report (NSAR). The NSAR provides an initial, rough assessment of the time, resources, impact, and risk to satisfy the request.

The BRM and Customer Representative provide information on the gap or deficiency the request addresses as well as whether an Agency, Service, Program’s capability can meet the request.

4.1.2.2. The BRM reviews the completed NSAR. The reviewed NSAR is forwarded to the SPM for approval. The SPM will review the NSAR and make a decision on whether the non-standard service request should go through the C4IP, or be satisfied through a non-C4IP route. The SPM uses the following criteria to

10 NNCI33-199 7 MARCH 2014

determine if the non-standard service request should follow the C4IP:

4.1.2.2.1. Implementation Costs are more than $25,000

4.1.2.2.2. Project completion time is more than 90 days

4.1.2.2.3. Customer Representative does not have resources available

4.1.2.2.4. Organizational impact and strategic alignment with N-NC/J6 IT strategy

4.1.2.3. Non-standard service requests the SPM determines do not need to go through the C4IP are processed through the non-C4IP processes. Paragraph 4.2.

below describes the non-C4IP processes.

4.1.2.4. When the SPM determines the non-standard service request must follow the C4IP, the SPM notifies the Customer Representative to prepare a Mission Case for all Non-standard service requests for approval. An example of the Mission Case is provided in the Customer Representative CONOPS located on the C4IP Working

Group portal page:

https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Docume nt_Library/Forms/AllItems.aspx. The Customer Representative prepares the Mission

Case in close collaboration with the BRM. The Mission Case provides the gap/deficiency and mission need for the request. The Customer Representative staffs the Mission Case through their respective organization for senior leader (e.g., Director, Deputy-Director) approval. The purpose of this step is to ensure senior leader awareness and support of the non-standard service request.

4.1.3. C4I Scoring/Binning (Figure 2, Process 1.3).

4.1.3.1. The SPM, on behalf of the C4IP Working Group Chair, prepares all

Mission Cases for presentation, review, and analysis at the monthly C4IP Working

Group meeting. The SPM coordinates with the Customer Representative to have the sponsor/advocate for each Mission Case prepare and present a briefing to the C4IP

Working Group, amplifying all the information in the Mission Case. This provides the forum for the C4IP Working Group membership to ask questions about the non-standard service request.

4.1.3.2. After presentation, the Customer Representatives will have three business days to score the Mission Case(s) in accordance with the documented procedures on the C4IP Working Group portal page:

https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Docume nt_Library/Forms/AllItems.aspx.

4.1.3.3. Each Customer Representative internally reviews all pending Mission

Cases within their Directorate, Special Staff, Region, and Subordinate Organization to develop their scoring. The Customer Representative coordinates the proposed scores through their organization’s Deputy Director for approval prior to updating the

C4IP Working Group Mission Case scoring spreadsheet.

https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx

NNCI33-199 7 MARCH 2014 11

4.1.4. C4I Approval (Figure 2, Process 1.4).

4.1.4.1. If the average score of the Mission Case(s) is equal to or above 40 (on a 90-point scale), the C4IP Working Group approves the development of a Service

Package for the non-standard service request. If the score is below 40, the C4IP

Working Group will discuss it at the next monthly C4IP Working Group meeting to determine if it should be re-scored. The SPM will maintain Mission Cases as an active request until scored above 40 or cancelled by the Customer Representative or

DDM.

4.1.4.2. The SPM assures Service Packages development for all Mission Cases scored 40 or higher.

4.1.5. Service Package Development (Figure 2, Process 1.5).

4.1.5.1. Develop Service Packages for all non-standard service requests whose

Mission Case scores 40 or more, as well as approved Service Improvement Plans

(SIPs) and Urgent/Out-of-Cycle Requests. The Service Package documents the customer’s Service Level Requirements (SLRs) and Service Acceptance Criteria

(SAC). It also provides information on the technical approach, budgetary cost estimates, as well as the projected time required to satisfy the request.

4.1.5.2. Develop the Service Package in collaboration with the appropriate Service

Owner for the service impacted, BRM, and Customer Representative.

4.1.5.3. SIPs and Urgent/Out-of-Cycle Requests proceed directly to the Service

Package development because they are vetted and analyzed prior to submission as a

Service Request and do not require additional analysis/review of the C4IP Working

Group. The SPM and Service Owner review and approve submission of a SIP as part of the Evaluation phase. Urgent/Out-of-Cycle Requests are approved by the

Commander, Deputy Commander, or Chief of Staff.

4.1.5.4. The SPM reviews the completed Service Package. The SPM staffs the

Service Package to all stakeholders for review and comment. The stakeholder review includes technical, financial, cyberspace security, and records management stakeholders. The review ensures the proposed solution is feasible, affordable, security compliant, and complies with records management directives. The SPM consolidates and adjudicates all recommended changes.

4.1.5.5. The SPM reviews and approves the adjudicated Service Package.

4.1.5.6. For Urgent/Out-of-Cycle non-standard requests, the SPM tasks the Lead

Engineer to develop the technical approach to satisfy the request. The ITSM Division

Chief (N-NC/J66) reviews and approves the request. The Lead Engineer forwards the approved technical approach to the SPM.

4.1.6. Deputy Director’s Meeting (DDM) Approval (Figure 2, Process 1.6).

4.1.6.1. The SPM, in coordination with the Customer Representative, presents all completed Service Packages and Urgent/Out-of-Cycle technical approaches to the next available DDM. The requesting organization advocates and answers questions concerning the mission need, technical approach, and cost for the request.

12 NNCI33-199 7 MARCH 2014

4.1.6.2. The DDM approves or cancels the Service Package. Upon approval it proceeds to develop the Resource Plan to identify how to resource the request.

4.1.7. Resource Determination Process (Figure 2, Process 1.7).

4.1.7.1. The SPM staffs the DDM approved Service Package or Urgent/Out-of-

Cycle technical approach to the BRM. The BRM contacts the Customer

Representative to develop a Resource Plan for the non-standard service request. The

Customer Representative works with their Resource Advisor to identify resources required to support the request. If funding is not readily available, the Resource

Advisor will work all activities (e.g., Unfunded Request (UFR) processing, N-NC/J8 advocacy, Program Objective Memorandum (POM) inputs) to obtain funding and inform the Customer Representative of the results.

4.1.7.2. The Customer Representative forwards the completed Resource Plan through the BRM to the SPM.

4.1.7.3. The SPM holds the Service Package and Resource Plan until notified by the Customer Representative all the required resources are secured.

4.1.7.4. Periodically, the C4IP Working Group will review and prioritize the queue of non-standard service requests pending resources. This will provide justification for funding decisions during the Program Objective Memorandum (POM) or, if applicable, during current year UFR decision cycles.

4.2. Non-C4IP Process.

4.2.1. As described in Figure 2, Process 1.2, when a non-standard service request meets the documented criteria in paragraph 4.1.2.2, the SPM can approve routing the non-standard service request through the non-C4IP processes. The purpose of the non-

C4IP option is to satisfy small-scale, low impact, funded requests quicker. Non-standard service requests that follow the non-C4IP route will initiate development of an

Investment Analysis Report (IAR). The IAR provides a more detailed technical approach and a budgetary estimate on the resources to satisfy the request. The SPM reviews and approves the completed IAR. This review will include technical, financial, and cyberspace security stakeholders. The review will ensure the proposed solution is feasible, affordable, and cyberspace security compliant. The SPM will staff the IAR to all stakeholders for review and comment.

4.2.2. Concurrently with the IAR review, the Customer Representative prepares a

Resource Plan to provide details on how the request will be funded and staffed.

Examples of the Resource Plan are in the Customer Representative CONOPS on the

C4IP Working Group portal page:

https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_

Library/Forms/AllItems.aspx. The Customer Representative forwards the completed

Resource Plan through the BRM to the SPM.

4.2.3. The SPM forwards the completed IAR and Resource Plan to the Supplier

Management group for contracting.

4.3. Selection: Selection identifies the best mix of investments within available resources to meet the Commands’ strategic goals. The C4IP selection of Information System and https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx https://portal.noradnorthcom.mil/functions/communications/C4IP/C4IPWG_Document_Library/Forms/AllItems.aspx

NNCI33-199 7 MARCH 2014 13

Cyberspace projects complies with and relies on the NORAD and USNORTHCOM

Corporate Deliberative Process (C4IP Working Group, DDM, and DSB). The high-level description is in Figure 3.

The selection of projects by the C4IP is dependent on NORAD and USNORTHCOM funding processes, policies, and procedures. Any non-standard service requests considered for approval as a project must be fully resourced across the Future Years Defense Program

(FYDP). Customers and users may submit non-standard service requests at any time for analysis; however, selection for implementation is delayed pending funding approval.

Directorates are required to incorporate records management and archival functions into the design, development, and implementation of electronic information systems (EIS).

Recordkeeping requirements and disposition procedures must be established before approving new EIS currently in a system life cycle stage earlier than steady-state or are developed after issuance of this Operating Instruction (OI). Directorates will work with the

Command Records Manager to evaluate and schedule these systems.

14 NNCI33-199 7 MARCH 2014

Figure 3. Selection Phase High-Level Description.

No

2.

Se lec tio n

An aly sis

Ap pr ov ed

No

Ye s

Co ntr ol

Pr ior ity Li st

Ch co mm en da tio n

DD

M

Pr oje ct

Re vie w

Ap pr ov al

DS

B

Pr oje ct

Re vie w

Ap pr ov al

Up da ted P rio riti ze d

Lis t w ith S

Ps

C4

IP

W G

Pr oje ct

Pr ior itiz ati on

Ap ov al

Ye s

Co S

Ap pr ov ed

Ag re em en t o n

Ap pr ov al?

Ag re em en t o n

Ap pr ov al?

No

Ca nc el

Ap pr ov ed

U rg en t

Te ch nic al

Ap pr oa ch

Se ag e

Re so

Re so

Ap pr ov ed ior itiz oje cts Li st

Ye s

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

1.

3.

NNCI33-199 7 MARCH 2014 15

4.3.1. C4IP Working Group Project Prioritization & Approval (Figure 3, Processes 2.1 &

2.2).

4.3.1.1. When notified by the Customer Representative the Resource Plan is fully resourced, the SPM will prepare the Service Package and Resource Plan for the next monthly C4IP Working Group meeting.

4.3.1.2. The C4IP Working Group will review all documentation for the non-standard service request and vote on approval, recommendation to cancel to the

DDM, or deferment of the request as a project.

4.3.1.3. If the C4IP Working Group unanimously agrees to any course of action, it is approved for chartering, contracting, and execution.

4.3.1.4. The C4IP Working Group will prioritize all approved/chartered projects on the Priority Project List in the event circumstances cause delay or deferral of some approved projects. The C4IP Working Group prioritizes the projects using the

Mission Case score combined with discussions within the C4IP Working Group based on the details of the Service Package.

4.3.2. DDM Project Review and Approval (Figure 3, Processes 2.3 & 2.4).

4.3.2.1. If the C4IP Working Group does not reach unanimous agreement on the disposition of a non-standard service request, the C4IP Working Group Chair and the

SPM will raise the non-standard service request along with the Service Package and

Resource Plan to the next DDM.

4.3.2.2. The C4IP Working Group Chair will present the information to the DDM for their review and decision on the non-standard request. The DDM will approve/charter the request as a project, cancel the request, defer for more information, or forward the request to the DSB for review and decision.

4.3.3. DSB Project Review and Approval (Figure 3, Processes 2.5 & 2.6). As directed by the DDM, the C4IP Working Group Chair and SPM will raise the non-standard service request along with the Service Package and Resource Plan to the DSB for final decision. The DSB will approve/charter, request additional action/information, or cancel the request.

4.3.4. Priority Project List Change Recommendation and Approval (Figure 3, Process

2.7).

4.3.4.1. Upon receipt of an approved Urgent/Out-of-Cycle requirement, the SPM will prepare the Urgent/Out-of-Cycle technical approach and the existing project priority list and staff to the PMO for analysis of the impact of the Urgent/Out-of-

Cycle project on the existing approved projects. The PMO will collaborate with the

Customer Representative of the Urgent/Out-of-Cycle project and determine the priority of the Urgent/Out-of-Cycle project.

4.3.4.2. The PMO will staff the revised prioritized project list to the Chief of Staff for approval. This approval is required due to the impact of the Urgent/Out-of-Cycle projects on active projects.

16 NNCI33-199 7 MARCH 2014

4.3.4.3. The PMO will coordinate with the Customer Representatives, Service

Provider Project Managers, and the Project Lead to update schedules based on the new prioritized project list.

4.3.4.4. The SPM will notify the C4IP Working Group and DDM at the next regular meeting on the change to the prioritized project list.

4.4. Control. The Control Phase focuses on planning, acquiring, implementing, and integrating Information System and Cyberspace projects chartered during the Selection

Phase. The high-level description is in Figure 4.

Tasks associated with the Control Phase include determining and executing an acquisition strategy, comprehensive engineering and testing, monitored throughout the Control Phase by the PMO. This phase also includes all required Cyberspace Security/Information Assurance and Service Validation and Testing activities.

NNCI33-199 7 MARCH 2014 17

Figure 4. Control Phase High-Level Description.

Co ntr ol

De vel op Se rvic e

De sig n P ack ag e

(SD

P)

De vel op Re lea se an d D ep loy me nt

Pa cka ge (R

DP

Re lea se Mg r

Ac cep ts S vc?

Re lea se

De plo ym en tNo

Ea rly

Life

Su pp ort (E

LS

Se rvic e V alid atio n &

Te st u sin g S erv ice

Ac cep tan ce

Cri ter ia

Ev alu atio n

So urc ing

Im ple me nta tion

Str ate gy

Ye s

+SV

AT

PM

Pr oce ss

Cy be r S ecu rity

Inf orm atio n

As sur an ce

Pro ces s

Co ntr act tion

De vel op cep tan ce

Su sta inm en t P ack ag e

Co isit

Pro ces s

Co

Aw ard

Ap pro val

Ye s

Ap pro val

Ac qu isit

Str ate gy

Do cum en t

SD

P

RD

P

No No

Ye s Va lida ted

SA

C

DA

A

Ap pro val

Lis t o f

Ap pro ved

Pro jec ts

Th ird

-Pa rty rvic e

Pro vid er

Se rvic e

Ca talo g

3.1

3.2

3.3

3.4

3.5

3.6

3.7

3.8

3.9

3.1 0.

3.1 1.

3.1 2.

3.1 3.

3.1 4.

4.

3.1 5.

18 NNCI33-199 7 MARCH 2014

4.4.1. Sourcing /Implementation Strategy (Figure 4, Process 3.1).

4.4.1.1. Once approved as a project, the SPM forwards the documentation associated with the project to the Supplier Manager. The Supplier Manager works with the

Customer Representative, BRM, Service Owner, PMO, and the main IT Support

Contract Contracting Officer Representative (COR) in collaboration with the

Contracting Officer (CO) to develop the acquisition strategy to put the project on contract.

4.4.1.2. The Supplier Manager staffs the draft acquisition plan through the Deputy

Chief, ITSM Operations Division to the N-NC/J6 Financial Manager for approval of the acquisition strategy.

4.4.1.3. The Supplier Manager notifies the BRM of the signed acquisition strategy, who in turn contacts the Customer Representative to identify a COR/Point of Contact

(POC) from the requesting organization for the approved project.

4.4.2. Contract Acquisition Process (Figure 4, Process 3.2).

4.4.2.1. Using the signed acquisition strategy, the COR/POC will work with the

BRM, Supplier Manager, PMO, Service Owner, Financial Manager, Chief Architect, and the J6 Network COR to develop the required procurement documentation. The N-

NC/J6 Supplier Manager provides templates for the acquisition documentation. These documents could include but as not limited to items such as Performance Work

Statement (PWS)/Statement of Work (SOW), Independent Government Cost Estimate

(IGCE), Market Research, and any other documentation to support the acquisition.

4.4.2.2. The N-NC/J6 Supplier Manager will take the procurement documentation and work through the appropriate contracting organization to post the solicitation and oversee the acquisition to contract award. The N-NC/J6 Supplier Manager will work with the COR/POC, Service Owner, BRM, IT Support Contract COR, Financial

Manager, and N-NC/J44 as appropriate for subject matter expertise.

4.4.3. Develop Service Design Package and Approval (Figure 4, Processes 3.3 & 3.4).

4.4.3.1. The Service Provider, once on contract, will develop the detailed Service

Design Package for the project based on the Government provided requirements. This documentation includes details on technical aspects of the project to include Security, Continuity, Capacity, Availability, and Testing.

4.4.3.2. The Service Provider works with technical experts and Service Owner as required covering all aspects of the Service Design Plan.

4.4.3.3. The Service Provider submits the Service Design Package to the PMO for initial review. The PMO will submit the reviewed Service Design Package to the appropriate Service Owner, who sends the Service Design Plan out for review by all stakeholders. The Service Owner consolidates all comments and sends to the PMO who reviews and forwards to the Service Provider for adjudication.

4.4.3.4. The Service Owner staffs the adjudicated Service Design Package to the

Government Engineering Board (GEB) for approval. When approved, the GEB sends the Service Design Package to the N-NC/J6 Change Management Board (CMB) for approval to change the NORAD and USNORTHCOM IT Service Portfolio and

Architectural diagrams.

NNCI33-199 7 MARCH 2014 19

4.4.4. Develop Release and Deployment Package and Approval (Figure 4, Processes

3.5 & 3.6).

4.4.4.1. After the Engineering Review Board (ERB) approves the Service Design

Package the Service Provider develops the Release and Deployment Package. The

Release and Deployment Package describes the details involved in implementation the new capability on the NORAD and USNORTHCOM network(s). The Service

Provider works with the IT support organization and the Service Owner as…