Attachment_IDIQ01-FDA_CCB_Charter.pdf

Food and Drug Administration Office of Information Management and Technology

Office of Technology and Delivery Division of Delivery Management & Support

Process Management & Control Branch Change Control & Configuration Management Team

Change Control Board Charter

Version 3.0

April 2015

Change Control Board Charter Version 3.0 i April 2015

DOCUMENT CHANGE HISTORY

Version Number

Date Description

1.0 9/23/08 Initial Draft

2.0 6/23/10 Updates completed for current CCB polices, and ICT21 migration processing

2.1 10/15/12 Updated section one to remove the Division of CIO Support (DCIOS) and add the IT Project Management Office.

2.2 10/22/12 Added paragraph to clarify the integration between the Infrastructure

CCB and the Information Technology Investment Management (ITIM) Process (Section 1).

3.0 4/15/15 Process improvement initiative after the OIM reorganization and comments from DAS, ISS, and DBPS.

ii April 2015

Table of Contents

1. PURPOSE

2. VISION AND MISSION

3. SCOPE

4. RESPONSIBILITIES

5. MEMBERSHIP

6. MEETINGS

6.1 HOLIDAY AND ALTERNATE MEETING SCHEDULE

6.2 PRELIMINARY CHANGE CONTROL BOARDS

7. REPORTS

8. APPROVALS

List of Tables Table 1: Roles and Responsibilities Table 2: CCB Members Table 3: Preliminary CCBs

1 April 2015

1. PURPOSE

The purpose of the Change Control Board (CCB) is to ensure efficient handling and accurate accounting of all changes to the Food and Drug Administration (FDA) Information Technology (IT) Infrastructure. Formal change management is required under the Office of Management and Budget (OMB) Circular A-130 and Federal Information Security Management Act (FISMA) to ensure the organization:

1. authorizes and documents changes to information systems

2. retains and reviews records of configuration managed changes to the systems

3. audits activities associated with configuration managed changes to the systems

The CCB is established to serve the following purposes:

Provide a forum to propose, evaluate, prioritize and approve/reject changes Ensure all stakeholders are notified of changes that will affect their system availability Identify and assess impact of changes Manage the system of record for infrastructure changes Validate proposed changes were tested in a lower environment Facilitate release management process of approved changes in a timely manner for all FDA data centers.

2 April 2015

2. VISION AND MISSION

The vision of the CCB is ensuring a standard process to consider proposed changes to the IT infrastructure. Risk assessment is applied to proposed changes to mitigate potential issues to ensure continually improving operations. The CCB will review requests for change (RFC), evaluate the impact of the proposed changes, ensure approval requirements are met, and vote on whether or not to move forward with the changes.

The Configuration and Change Management (CCM) Team is responsible for managing the process of formally changing the FDA IT Infrastructure by facilitating the Change Control Board process, meetings, and managing the Configuration Items database.

As of February 24, 2015 (subject to change):

HP Service Manager (HPSM) will serve as the official repository for the agency, http://hpsm.fda.gov/SM. Requests for changes and configuration items (CI) will be stored and managed in the HPSM database. CCB documentation will be kept on the agency’s SharePoint site, http://sharepoint.fda.gov/orgs/DelMgmtSupport/CCM.

3 April 2015

3. SCOPE

The Change Control and Configuration Management (CCM) Team, under the Office of Technology and Delivery (OTD) Division of Delivery Management and Support (DDMS) Process Management and Control (PMC) Branch, is responsible for the administration and support of the CCB. This CCB Charter describes the governance structure for CCB management and control of its responsibilities. The scope of the CCB includes the FDA infrastructure such as networks, servers, desktops, hardware, software, and communication devices. The standard operating procedures will be managed in the IT procedures library. The guidelines and processes described in this CCB Charter are applicable to the entire agency in order to reduce risk for managing changes to the FDA IT Infrastructure.

4 April 2015

4. RESPONSIBILITIES

Table 1: Roles and Responsibilities Roles Responsibilities

CCB Chairperson / Facilitators Coordinates the CCB meetings and functions Reviews all RFCs for completeness Triages RFCs prior to the CCB meeting Ensures emergency RFCs are addressed in a timely manner Gathers approvals from predecessor CCBs (Firewall, Desktop, Active

Directory, Telephony and Extranet) Ensures Release Management and Coordination (RMAC) data is current and accurate Authors/Updates the Change Management process documentation Ensures each RFC has a recommendation for approval, disapproval or is placed on hold pending approval from other CCB’s or additional information from the submitter

Verifies Master Approved Technology (MAT) list approval is notated in the RFC, if needed

Division/Branch Representatives/Supporting CCBs

Reviews the RFCs and provides feedback at the CCB meeting or to the Chair, as needed.

Attends the CCB meeting to represent the interests and stakeholders from their respective area

Provides information and asks questions of the submitter to determine if the RFC is compliant and should be approved

RFC Submitter, Team Lead, Requestor or designated representative

Provides information on specifics to be changed, why change is needed, who will implement the change and the urgency or timeliness of the change

Ensures completeness of information provided to facilitate approval of the change, in the timelines needed for executing the change

Answers questions and provides additional information as requested by the CCB Members

Ensures collocated applications are informed and consulted on proposed changes, and analyzes the RMAC data for potential conflicts

Validates the deployed changes were completed in scope Closes the RFC upon completion of the work (successful or not successful)

5 April 2015

5. MEMBERSHIP

The CCB consists of management and technical staff from the Information Security Services Staff (ISS), Division of Infrastructure Operations (DIO), Division of Business Partnership and Support (DBPS), the Division of Application Services (DAS), Division of Delivery Management and Support (DDMS), Center IT Liaisons (CITL) and staff from the data centers and system integrators. Representatives from the CCM Team coordinate and provide administrative support for the CCB.

The following table identifies the voting representatives of the CCB. The voting representatives of the CCB must unanimously approve each RFC for it to proceed. RFCs are approved by default if members decline to vote or are not present. If unanimous agreement cannot be reached, the RFC is rejected and the submitter will work with the appropriate representatives to resolve the issue.

Table 2: CCB Members Role Division/Center Voting/Non-Voting

Chairperson/Facilitator Configuration & Change Management Team Non-Voting Office/Division Representatives

ISS

DIO

DBPS

DAS

Voting

Preliminary CCBs Telephony Firewall Desktop Active Directory (AD) Extranet

Voting

Center IT Liaisons CBER, CDER, CDRH, CFSAN, CTP, CVM, NCTR, ORA, OIM, OIP, OC

Voting

Delivery Managers CBER, CDER, CDRH, CFSAN, CTP, CVM, NCTR, ORA, OIM, OIP, OC

Non-Voting

RFC Submitter, Requested By, Team Lead, Designated representative

All Non-Voting

Data Center representatives

All Non-Voting

6 April 2015

6. MEETINGS

The CCB meeting is held on a weekly basis, normally on Tuesdays from 1:00 to 2:30 PM Eastern Time (ET). The CCB meeting invitation is sent to the RFC submitters, OIM-CCB-Members distribution list, Center IT Liaisons, data center personnel, division personnel, and other key leads/managers. The meeting invitation may be freely forwarded to other interested stakeholders may request to be added to the CCB meeting invitation by emailing oim-ccb-coordinator@fda.hhs.gov. The meeting agenda will be displayed via a web connection, with the link provided in the meeting invitation.

The CCB meeting invitation will be sent with two attachments, the Weekly Agenda and On- Going report.

1. Weekly Agenda (Excel format): A list of all RFCs to be reviewed during the CCB meeting. This includes all pending RFCs including ones that were previously approved, approved by preliminary CCBs, RFCs requiring preliminary review, and all RFCs approved during the previous week.

2. On-Going Approved Open Report (Excel format): RFCs that were approved and are in-progress or yet to be started with planned dates in the future.

After the meeting, the Updated Weekly Agenda will be posted on the CCM SharePoint site and will include meeting minutes for each RFC and color coding for approved and pending statuses.

6.1 HOLIDAY AND ALTERNATE MEETING SCHEDULE

In the observance of government holidays, an email is sent from the OIM-CCB-Coordinator giving specific timeline instructions on when an RFC must be submitted for review prior to the next CCB meeting. The following are the government holidays that are observed:

New Year’s Day Martin Luther King Jr. Day Inauguration Day (D.C. Metro area) Presidents Day Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day.

Similar guidance will be communicated for days the CCB meeting requires rescheduling.

7 April 2015

6.2 PRELIMINARY CHANGE CONTROL BOARDS

Certain RFCs may require preliminary review by one of the supporting CCBs. The following table describes the four Preliminary CCBs that review RFCs prior to the CCB.

Table 3: Preliminary CCBs Preliminary CCB Meeting Frequency Scope &

Email Distribution Firewall Weekly, Wednesday 10:00 AM ET New or updated firewall rules

FDA IT Firewall CCB Desktop Weekly, Thursday 1:00 PM ET Changes related to image/desktop configuration Active Directory As needed Reviews all GPO/Active Directory requests Telephony Biweekly, Thursday 2:00 PM ET All work related to HP Service Manager

(HPSM) and Automated Call Distribution (ACD) System

Firewall CCB Charter:

http://inside.fda.gov:9003/ProgramsInitiatives/CommitteesWorkgroups/FirewallChangeControl Board/default.htm

Desktop CCB Charter:

http://inside.fda.gov:9003/OC/OfficeofOperations/OfficeofInformationManagement/ucm164762.htm

Telephony CCB Charter:

http://inside.fda.gov:9003/it/Applications/FDA-WideApplications/ucm327082.htm

8 April 2015

7. REPORTS

CCB reports are posted on the Change Control and Configuration Management SharePoint site Shared Documents library which is available at http://sharepoint.fda.gov/orgs/DelMgmtSupport/CCM. CCB Reports include the weekly reports of pending and approved RFCs, monthly metrics reporting, and presentations.

CCB process documentation will be linked from the FDA Intranet, http://inside.fda.gov:9003/ProgramsInitiatives/CommitteesWorkgroups/ITChangeControlBoard

9 April 2015

8. APPROVALS

_________________/s/_______________________________ _ ___ Brad Wintermute Director, Office of Technology and Delivery

Date

_________________/s/_______________________________ _ _____________ Shawn Matheny Director, Division of Delivery Management and Support

_______________ /s/________________________________ ____________ _ Laurie Ansorge Branch Chief, Process Management and Control

4/17/2015

Laurie V. Ansorge -S Digitally signed by Laurie V. Ansorge -S DN: c=US, o=U.S. Government, ou=HHS, ou=FDA, ou=People, 0.9.2342.19200300.100.1.1=1300087415, cn=Laurie V. Ansorge -S Date: 2015.04.17 07:53:46 -04'00'

David S. Matheny -S Digitally signed by David S. Matheny -S DN: c=US, o=U.S. Government, ou=HHS, ou=FDA, ou=People, 0.9.2342.19200300.100.1.1=1300169046, cn=David S. Matheny -S Date: 2015.04.17 08:05:08 -04'00'

Bradford Wintermute -S Digitally signed by Bradford Wintermute -S DN: c=US, o=U.S. Government, ou=HHS, ou=FDA, ou=People, 0.9.2342.19200300.100.1.1=2000389106, cn=Bradford Wintermute -S Date: 2015.04.17 12:21:06 -04'00'