Appendix_A_-_Overview_of_EPLC_PowerPoint.pdf

Overview of the Enterprise Performance Life Cycle (EPLC)

Enterprise Performance Life Cycle (EPLC)

What is EPLC?

The FDA Enterprise Performance Life Cycle (EPLC) is a framework to enhance Information Technology (IT) governance through rigorous application of sound investment and project management principles and industry’s best practices.

Why EPLC?

The EPLC provides the context for the IT governance and describes interdependencies between its project management, investment management, and capital planning components. The EPLC framework establishes an environment in which FDA IT investments and projects consistently achieve successful outcomes that align with department of Health and Human Services (HHS)/FDA goals and objectives.

EPLC Goals and Objectives Goal 1: Effective Project Management Methodology

Provide a coherent and effective project management methodology to guide IT project management at FDA

Consistently deliver IT capabilities that provide maximum support to FDA business needs within approved cost and schedule constraints

Goal 1: Supporting Objectives

Expand the role of Business Owners throughout the IT project life cycle to ensure that IT projects remain targeted on highest priority business needs and meet necessary schedule and cost constraints

Standardize IT project management within FDA based on best practices

Provide guidance to Project Managers regarding activities and deliverables required for project planning and execution throughout all stages of project management

Provide project templates and tools to help jump-start project activities

Improve project performance by applying repeatable processes and industry-leading best practices for project and earned value management

EPLC Goals and Objectives Goal 2: Better Integrated IT Investment Planning

Better integrated IT investment planning and execution with IT Governance

More effective multi-disciplinary reviews of IT investments by critical partners

Goal 2: Supporting Objectives

Facilitate alignment of IT projects with the FDA Strategic Plan

Provide a more effective process for integrating multi-disciplinary Critical Partner reviews into the IT Governance process

Establish clear, reasonable expectations and practical standards/guidelines

Ensure compliance with FDA Enterprise Architecture (EA) and prescribed design standards

Key Definitions

1 3 4

IT Project

A temporary planned endeavor funded by an approved information technology investment;

thus achieving a specific goal and creating a unique product, service, or result

IT Portfolio

The combination of all IT assets, resources, and investments owned or planned by an organization in order to achieve its strategic goals, objectives and mission

IT Investment

An organizational investment employing or producing IT or IT-related assets

A project has a defined start and end point with specific objectives that, when attained signify completion

The essential distinction between an IT project and other projects is that an IT project involves the delivery of an information technology product, service, or system

Each investment has or will incur costs for the investment, has expected or realized benefits arising from the invest-ment, has a schedule of project activities and deadlines, and has or will incur risks associated with engaging in the investment

IT Program

A group of related IT projects managed in a coordinated way to obtain benefits and control not available from managing them individually

A program may include elements of related work outside the scope of its discrete projects

A project may not be part of a program, but a program will always have projects

Project Stakeholders

IT Project Manager

Business Project Manager

Integrated Project Team (IPT)

Critical Partner Resource Managers

Critical Partners

Business Owner / Exec Sponsor CO and COTR Development Team Test and Evaluation Team Operations Data Administrator Information Systems Security Officer

(ISSO)

Program Analysts Configuration Control Board Network Analysts Technical and Vendor Support Training and Help Desk In-House Development and Operations Teams Contractors End Users Infrastructure Support Staff

Role of Business Owner / Executive Sponsor

Executive in charge of the organization owning the project

Primary customer and advocate for an IT project

Responsible for identifying the business needs and performance measures to be satisfied by an IT project

Provides funding for the IT project

Establishes and approves changes to cost, schedule, and performance goals

Validates that the IT project initially meets business requirements and continues to meet business requirements

Role of IT Project Manager (IT PM)

Responsible for project performance in relation to approved cost, schedule and performance baselines.

Maintains information project status, control, performance, risk, corrective action and outlook.

Accountable to the Business Owner for meeting business requirements and to IT governance for meeting IT project management requirements.

Accountable for the development of EPLC artifact where IT is indicated as the author.

Works with Business PMs to develop and manage to the Project Process Agreement, Project Management Plan, Project Schedule, Implementation Plan, and Contingency and Disaster Recovery Plan.

Develops an Integrated Project Team bringing in the appropriate IT resources at the appropriate times.

Leads EPLC Stage Gate Reviews and other project reviews defined in the project schedule.

Responsible for the management and mitigation of risks and issues.

Accountable for the execution and documentation of testing as defined in the Master Test Plan

Role of Business Project Manager (BPM)

Accountable for the development of the Boundary Document defining the scope of the project.

Collaborate with the IT PMs to the develop the Project Charter.

Accountable for the development, baselining, and prioritization of the business requirements (documented in the Business Requirements Document).

Work with IT PMs to develop and manage to the Project Process Agreement, Project Management Plan, Project Schedule, Implementation Plan, and Contingency and Disaster Recovery Plan.

BPMs, along the Business Owner / Executive Sponsor, manages scope changes that affect cost, schedule, and quality.

Represent Business at EPLC Stage Gate Reviews and other project reviews defined in the project schedule.

Accountable for the development of the Business processes involved in the project.

Responsible for the management of business related risks and issues.

Provides input to the Master Test Plan for the User Acceptance Test planning.

Collaborates with IT PM on developing a Training Plan, Training Materials and User Manual

Sets expectations and participates in the development and implementation of the User Acceptance Test.

On an annual basis, perform an Annual Operation Analysis to decide on new functional enhancements and/or modifications to the business product or the need to dispose of or replace the business product altogether.

Role of Integrated Project Team (IPT)

Chaired by the Project Manager

Subject Matter Experts and Business Owner representatives to assist the Project Manager with planning and execution of the project

ENTERPRISE ARCHITECTURE (EA)

BUDGET AND FINANCE

ACQUISITION

BUSINESS OWNER (PERFORMANCE)

CPIC

SECURITY

INFRASTRUCTURE

RECORDS MANAGEMENT

CONFIGURATION MANAGEMENT

DATA STANDARDS INTEGRATION TEAM (DSIT)

SECTION 508 TESTING AND INTEGRATION

Role of Critical Partners

Review the progress of the IT projects associated with IT Investments during EPLC Stage Gate Reviews to ensure compliance with HHS and FDA policies, applicable laws and guidance, and FDA and HHS-adopted government and industry best practices in their respective functional areas

Provide recommendations to the IT governance bodies, Business Owners, and IT Investment Managers on issues identified in those functional areas

EPLC Phase Objectives

Project proposal is worth pursuing?

Initiation

Project has been clearly defined and has the supporting organizational structure to proceed with full planning

Concept

Project has finalized project planning and defined initial baselines and requirements to permit outside validation

Planning

Project requirements have been defined sufficiently to be translated into the Business Product

Requirements Analysis

Design process will create a Business Product that meets the requirements within a specified project budget and schedule

Design

EPLC Phase Objectives (continued)

The code and/or other deliverables needed to build the Business Product have been completed within cost, schedule, and scope guidelines

Development

Test processes have been executed according to plan and tests verify that the implementation of the Business Product will be successful

Test

Verify the operational readiness of the Business Product for release into the production environment

Implementation

Verify that the Business Product is managed and supported in a robust production environment and to determine whether the Business Product is still cost-effective to operate or if it should be retired

Operations and Maintenance

Accomplish an orderly shutdown of the Business Product operation

Disposition

Preliminary

• Initial draft; updated to Final/Baseline in later EPLC phase(s)

Final

• Complete in the opinion of the Project Manager

Baseline

• Final for current phase; changes may be required in subsequent phases

Note

• Some deliverables (particularly baselines and project plans) undergo change control in which the IT Governance organization must approve initial documents and any subsequent changes

• Each year the Project Manager may provide updated deliverables associated with the project's Operations and Maintenance phase

EPLC Types of Deliverables

Security controls must be established and integrated into EPLC activities, phases, and reviews

EPLC references several Security artifacts

Project Security Categorization

Privacy Impact Assessment

System of Record Notice (SORN)

E-Authentication

System Security Plan

Security Control Assessment

Security Risk Assessment

Security Assessment Report (SAR)

Plan of Action and Milestones

Security Authorization Executive Summary (SAES)

Security Deliverables

Initiation Concept Planning Design Development Test Implementation Operations & Maintenance

Requirements Analysis Disposition

Initiation Stage Gate

Concept Stage Gate

Planning Stage Gate

Requirements Stage Gate

Design Stage Gate

Development Stage Gate

Test Stage Gate

Implementation Stage Gate

O&M Stage Gate

Disposition Stage Gate

Iterative Development (Optional)

EPLC Stages

STAGE GATE

REVIEWS

PROJECT

REVIEWS

Initiation Readiness

Review

Concept Readiness

Review

Planning Readiness

Review

Requirements Readiness

Review

Design Readiness

Review

Development Readiness

Review

Test Readiness

Review

Implementation Readiness

Review

Note: Readiness Reviews are intended to be internal reviews to ensure readiness for the next Stage Gate.

All projects require adequate documentation and deliverables to ensure that they are progressing appropriately to provide management with enough information for informed decision making

Lower risk projects do not need as much documentation to maintain appropriate oversight and control

Tailoring allows you to customize or waive application of particular elements of the EPLC framework like:

• Entire life cycle phases

• Specific activities

• Deliverables

• Project reviews

Not all projects should be tailored. Consider the risk and impact should the project fail to deliver.

Sometimes, one size does not fit all…

What is Tailoring?

Cost:

• For small projects, framework elements (i.e. deliverables) that increase overall project cost significantly may be candidates for tailoring as appropriate.

Risk:

• Framework elements that mitigate low-level risks are candidates for tailoring

Project Type:

• Software Development

• Maintenance or Migration (e.g. Internet Explorer upgrade)

Release Types:

• Software Development Projects (DOS and DBPS)

• Initial Release

• Major Release

• Minor or Operations and Maintenance (O&M) release

• Defect or Emergency release

• Software Installations, Maintenance or Migration Projects (DOT and DOI)

• Best practices under development

Tailoring Considerations

Tailoring Using the Project Process Agreement (PPA)

Created as a collaboration between the IT PM and Business PM

Drafted as early as the Initiation Phase, finalized for a release during the Planning Phase

Documents the reasons why specific phases, activities, deliverables or reviews are adjusted

Approved at the Planning Stage Gate Review

Any subsequent changes must be approved by the IT PM, the Business PM, and the Executive Sponsor.

Retrieve a PPA template from the PMO e-room

Create a Project Process Agreement (PPA)

Fill out this two columns for the release.

Add justification (column G not shown) if needed

- Obtain Signatures

- Load final document into e-room or Clarity

- Send copy to PMO (eplc@fda.hhs.gov)

Fill out these columns for the release.

Add justification if needed.

Create a Project Process Agreement (continued)

Retrieve MS Project schedule template from the e-room

Template for DME or Major Release

Tailor the schedule to your project

1. If you have an existing schedule, copy schedule template (starting at line 2) into existing schedule.

2. Replace x.xx with the 2.0 (release number)

3. Compare with PPA. Remove any artifacts and stage gates that have been waived.

4. Tailor template to project. Add project-specific subtasks under the appropriate Task headings.

5. Add timelines (dates).

IT PM determines which Critical Partner Areas apply to Stage Gate

Lists which Stage Gates each Critical Partner Area participates in and the Critical Partner Resource Managers to contact

IT PM Requests Critical Partners from Critical Partner Resource Managers

Critical Partner Resource Managers

GSD is preparing for the EPLC Requirements Analysis Stage Gate Review.

The EPLC Framework lists the following groups as Critical Partners for the Requirements Analysis Stage Gate Review:

Please assign a primary Critical Partner for your respective area or opt out of the review by providing a short justification. As a Critical Partner, he/she will be expected to do the following:

(1) Confirm Participation He/she will receive a spreadsheet on which they will do the following:

• Confirm that he/she is the primary Critical Partner. Additionally, provide the name of his/her backup who will serve as the Critical Partner in his/her absence.

• Indicate which of the EPLC Artifacts, applicable to your area, that he/she is committing to review.

• Return the spreadsheet to the IT Project Manager

(2) Perform the Review He/she will receive the artifacts for review at least <enter number> business days prior to the Initiation Stage Gate Review. During the review period, he/she will be expected to:

• Review artifacts / documentation relevant to your respective area for completeness, accuracy, adequacy.

• Evaluate the Mandatory Exit Criteria for the Stage Gate.

• Document any known issues and risks relevant to your respective area.

• Answer optional suggested questions.

• Provide a recommendation for Stage Gate Review outcome.

• Return the spreadsheet with his/her recorded results by the designated due date.

(3) Attend the Stage Gate Review

• Listen to IT Project Manager present a review of the State Gate Review Results Report including a discussion of known issues and risks.

• Validate and approve his/her recommendation

• Business

• Enterprise Architecture

• DSIT

• Testing

• Records Management

• 508

EA

Business

Records Mgmt Testing

DSITIT PM

Critical Partner Resource Managers Provide Names of Critical Partners

Critical Partner Resource Managers

IT PM

EA

Business

Records Mgmt Testing

DSIT

Danny Database will be the critical partner for DSIT

Willit Fit will be the critical partner for EA

Isit Traced will be the critical partner for Testing

Imona Mission will be the critical partner for Business

Rita Retention will be the critical partner for Records Mgmt

Doesit Comply will be the critical partner for Section 508

IT PM Prepares Stage Gate Checklists

Retrieve Checklist Template

- Customize List of Artifacts based on PPA.

- If Stage Gate is more than one stage combined, list Artifacts from each Stage

IT PM Communicates the Beginning of the Stage Gate Review Period

Critical Partners

INSERT A SHORT PROJECT DESCRIPTION HERE

The review period of the Clarity Implementation Stage Gate is from Monday, BEGIN DATE thru END DATE

Below are the links to the documentation for review. Please review and score only the documents that are applicable to your area, as you have indicated on the Implementation Stage Gate Spreadsheet (attached). Your responsibilities during the review using the review spreadsheet are:

• Review artifacts / documentation relevant to your respective area for completeness, accuracy, adequacy.

• Evaluate the Mandatory Exit Criteria for the Stage Gate.

• Document any known issues and risks relevant to your respective area.

• Answer optional suggested questions.

• Provide a recommendation for Stage Gate Review outcome.

• Return the spreadsheet with your recorded results to me by COB END DATE.

If you have any questions, please let me know.

IT PM

A

Critical Partners Perform Review

During the review period, Critical Partners are expected to:

A. Review artifacts / documentation relevant to their respective areas for completeness, accuracy, adequacy

B. Evaluate the Mandatory Exit Criteria for the Stage Gate

B

E

Critical Partners Perform Review (continued)

During the review period, Critical Partners are expected to:

C. Document any known issues and risks relevant to their respective areas

D. Answer optional suggested questions

E. Provide a recommendation for Stage Gate Review outcome

C

D

Overall Project Recommendation

Go - move to the next EPLC Stage

Go with Conditions - move to the next EPLC Stage, conditional on corrective action within two weeks

No Go – corrective action and repeat of Stage Gate required

Important: Impact must be considered

“Go/No Go” Guidelines

Average Artifact Score

< 6: No Go

6-8: Go with Conditions

> 8: Go

Mandatory Exit Criteria

> 2: No Go

1: Go with Conditions

0: Go

High Impact/High Probability Risks

> 2: No Go

1: Go with Conditions

0: Go

Critical Partners Return Checklist to IT PM

Danny Database will be the critical partner for DSIT

Danny Database will be the critical partner for DSIT

Danny Database will be the critical partner for DSIT

Danny Database will be the critical partner for DSIT

Danny Database will be the critical partner for DSIT

Danny Database will be the critical partner for DSIT

Critical Partners

IT PM Prepares Stage Gate Materials

Retrieve Results Report Template

Prepare Stage Gate

Report

Prepare Stage Gate Presentation

ENTERPRISE PERFORMANCE LIFECYCLE

GSD

RELEASE 2.0

PLANNING AND REQUIREMENTS

STAGE GATE REVIEW REPORT

IT PM Facilitates the Stage Gate Review

GSD Release 2.0 Planning and Requirements

Stage Gate Review

(1) IT PM presents a review of the State Gate Review Results Report including a discussion of known issues, risks, and lessons learned

(2) Critical Partners validate and approve their outcome recommendations

Stage Gate Outcomes

GO (to the next EPLC Stage)

NO GO

Conditional Go (two weeks to correct issues)

IT PM Communicates Stage Gate Results

IT PM

IT PM finalizes draft Stage Gate Report and sends final report to:

Project Team Critical Partners Enterprise Architecture Program Management Office

A Final Message about EPLC

EPLC

• Is required for all HHS and FDA IT investments, programs and projects

• Authority for the implementation of the EPLC is delegated to the FDA CIO

• Applies to IT projects of all sizes and complexities

• Processes and procedures for IT Projects can be tailored

OIM PMO is engaged in providing guidance and support to the FDA IT project managers:

• Contact eplc@fda.hhs.gov with any questions or suggestions regarding documents