SLM Gate Review Document Delivery Expectations.pdf

Version 2.2 August, 2008

ICE Architecture Division System Lifecycle Management Gate Review Document Delivery Expectations

ICE OCIO Architecture Division

REVISION HISTORY I

REVSION HISTORY

Section Date Summary of Changes November 2007

Global • Replaced “Technical Reviews” with “Gate Reviews”

2.0 • Added “(previously referred to as technical review)”

• Changed “Project Management (PM) Analyst” to Quality Assurance (QA) Analyst”

• Changed “SLM PM Analyst” to “SLM QA Analyst”

Exhibit 1 • Added “Categorization determination needed to run the Risk Management System (RMS) tool” to “FIPS 199”

• Made “e-Authentication Assessment” 10 and Not needed

• Made “Privacy Threshold Analysis” 10” and Not needed

• Made “Project Management Plan” 7 for Minor Releases

• Added “RMS/ICE prescribed template” to “Risk Assessment”

• Added “RMS/ICE prescribed template” to “System Security Plan”

• Made “Training Strategies Worksheet” 7 for New Systems

• Made “Project Change Control Board Charter” 10 and 5

Exhibit 2 • Made “System Requirements Document” 7 for Minor Releases

• Made “Requirements Traceability Matrix” 7 for Minor Releases

• Made “Data Management Plan” 7 for Minor Releases

• Made “System Workload Analysis Document” 7 and 5

• Added “and describes training of individuals to execute the plan” to “Contingency Plan”

• Added “RMS/ICE prescribed template” to “Contingency Plan”

• Added “The PIA should be documented and approved and a System of Records Notice (SORN) created before system operational deployment” to “Privacy Impact Assessment”

• Added row for “Security Requirements Traceability Matrix”

• Made “Update if needed” 7 and 5

• Added “Revision history required on all changed/updated documents” to comments for “Update if needed”

August 2008 ICE Architecture Division SLM Gate Review Document Delivery Expectations

REVISION HISTORY II

Exhibit 3 • Made “Advanced Acquisition Plan” 10 and 7

• Deleted “(Procurement Plan)”

• Made “Design Document” 7 for Minor Releases

• Made “Information Technology Change Request(s)” 10 and 7

• Made “Service Level Agreements” 7 for Minor Releases

• Added “Should be noted in System Security Plan” to “Service Level Agreements”

• Added “Documented in DHS4300A Appendix N format” to “Interconnection Security Agreement”

• Added “Should be noted in System Security Plan” to “Interconnection Security Agreement”

• Made “Development Test Plan” 10 and 5

• Added “Documents the plan to assess compliance to NIST 800-53 A Controls that include applicable IT Security technical, operational, and management controls employed to mitigate risks and DHS Hardening Guidance compliance” to “Development Security Test and Evaluation (ST&E) Plan”

• Added “and the vulnerability assessment tools used for testing” to “Development Security Test and Evaluation (ST&E) Plan”

• Added days to all “Update if needed”

• Added “Security Requirements Traceability Matrix” to “Update if needed”

• Added “Revision history required on all changed/updated documents” to comments for “Update if needed”

Exhibit 4 • Made “Update if needed” 7 for all Minor Releases

• Added “Security Requirements Traceability Matrix” to “Update if needed”

• Added “Revision history required on all changed/updated documents” to comments for “Update if needed”

Exhibit 5 • Made “Version Description Document” 7 and 5

• Made “Development Test Analysis Report” 7 and 5

• Made “Update if needed” 10 and 7

• Added “Security Requirements Traceability Matrix” to “Update if needed”

• Added “Revision history required on all changed/updated documents” to comments for “Update if needed”

Exhibit 6 • Moved “Certification and Accreditation” down

• Changed “Produced by the Designated Accrediting Authority” to “Signed by the ICE Program Area Designated Accrediting Authority”

• Changed “Independent Test Reports” to “Draft Independent Test Reports”

• Made “Draft Independent Test Reports” 2 and 2

• Added “including application vulnerability scans and independent security control testing” to “Draft Independent Test Reports”

• Made “Authority to Operate” 1 and 1

REVISION HISTORY III

• Made “Final updates to previously submitted” 7 and 5

• Added “Revision history required on all changed/updated documents” to comments for Final updates to previously submitted

• Added “and identifies any Residual Risk and Waiver/exceptions going forward to DHS CISO” to “Certification and Accreditation”

• Added new row for “Certification and Accreditation (C&A) Artifacts for upload into TAF tool”

3.4 • Changed “SLM PM Analyst” to “SLM QA Analyst”

3.5 • Added “It is also required that all changed or updated documents include a Revision History in the beginning of the document. This is essential to minimizing the time that Subject Matter Experts (SME) spend reviewing old information and maximizing the time spent reviewing new information.”

December 2007

Cover • Named document “Version 2.1” to reflect document history and latest release

Exhibit 1 • Changed “FIPS 199” to 10 for Minor Releases

• Changed “Project Tailoring Plan” to 7 for Minor Releases

• Deleted “Incorporates the Procurement Plan which specifies how the system is to be acquired” from Project Management Plan

• Changed “Training Strategies Worksheet” to 5 for Minor Releases

• Changed “Risk Assessment” to 7 for Minor Releases

• Changed “System Security Plan” to 7 for Minor Releases

• Changed “Project Change Control Board Charter” to 7 for Minor Releases

Exhibit 2 • Changed “System Workload Analysis Document” to 10 and 7

• Changed “Contingency Plan” to 7 for Minor Releases

• Changed “Update if needed” to 7 for Minor Releases

Exhibit 3 • Changed “Data Conversion Plan” to 7 for Minor Releases

• Changed “Service Level Agreements” to 5 and 5

• Changed “Interconnection Security Agreement” to 7 for Minor Releases

• Changed “Development Test Plan” to 7 for Minor Releases

• Changed “Development Security Test and Evaluation (ST&E) Plan” to 7 for Minor Releases

• Added row for “Training Plan”

• Changed “Update if needed” to 7 and 7

Exhibit 4 • Changed “Update if needed” to 7 for Major Releases

Exhibit 5 • Changed “Development Test Analysis Report” to 10 for Major Releases and 7 for Minor Releases

• Changed “User Guide” to 7 for Minor Releases

Exhibit 6 • Changed “Authority to Operate” to 3 and 3

REVISION HISTORY IV

• Changed “Final updates” to 7 for Minor Releases

• Added ” System Requirements Document”, “Design Document”, and “Data Management Plan” to “Final updates”

Global • Reformatted document to align with SLM Handbook style

August 2008

Cover • Named document “Version 2.2” and changed date to reflect document history and latest release

2.0 • Minor text changes

Exhibit 1 • Changed Minor Releases to “Not needed” for PTP

• Added “System Concept of Operations (ConOps)”

• Added “Project Schedule”

• Moved first three documents to after the “Training Strategies Worksheet”

Exhibit 2 • Removed ConOps text from “SRD” Comments

Exhibit 3 • Changed “Data Conversion Plan” to “Data Migration Plan”

Exhibit 4 • Changed “Data Conversion Plan” to “Data Migration Plan”

Exhibit 5 • Changed “Expected Delivery” times for VDD from 7 and 5 to 5 and 2

• Changed “Expected Delivery” times for DTAR from 10 and 7 to 5 and 2

• Changed “Data Conversion Plan” to “Data Migration Plan”

Exhibit 6 • Changed “Expected Delivery” times for ATO Letter/Accreditation from 3 and 2 to 1 and 1

• Moved “New” C&A Artifacts ahead of the “Updated” documents

• Changed “Expected Delivery” times for Updated SLM documents from 7 and 7 to 5 and 5

• Changed “Expected Delivery” times for Updated VDD from 7 and 7 to 2 and 2

• Deleted “Draft Independent Test Reports”

3.2 • Minor text change

CONTENTS I

CONTENTS

1.0 INTRODUCTION

2.0 SLM GATE REVIEW DOCUMENT DELIVERY

EXPECTATIONS

2.1 Planning Review Document Delivery Expectations

2.2 Requirements Review Document Delivery Expectations

2.3 Preliminary Architecture and Design Review Document

Delivery Expectations

2.4 Final Architecture and Design Review Document Delivery

Expectations

2.5 Test Readiness Review Document Delivery Expectations

2.6 Release Readiness Review Document Delivery Expectations 17

3.0 GENERAL DOCUMENT DELIVERY INFORMATION

3.1 Library Submission Standards

3.2 Document Templates

3.3 Tailoring

3.4 Unchanged Documents

3.5 Change Pages versus Complete Document

EXHIBITS

Exhibit 1: Planning Review Document Delivery Expectations

Exhibit 2: Requirements Review Document Delivery Expectations

Exhibit 3: Preliminary Architecture and Design Review Document Delivery Expectations

Exhibit 4: Final Architecture and Design Review Document Delivery Expectations

Exhibit 5: Test Readiness Review Document Delivery Expectations

Exhibit 6: Release Readiness Review Document Delivery Expectations .. 17

Task Order No: ITESS-0056-A: Architecture

ITESS-0056-A-JS-00809

Prepared by: SAIC/Contract No.: COW-5D-C-0056

INTRODUCTION 1

1.0 INTRODUCTION

The Immigration and Customs Enforcement (ICE) System Lifecycle Management (SLM) Handbook, Version 1.2 specifies that projects will submit deliverables to ICE Architecture Assurance and allow sufficient time for the review to take place. This document delineates the expected document delivery schedule that projects will adhere to for each deliverable that may be required during the SLM process.

DELIVERY EXPECTATIONS 2

2.0 SLM GATE REVIEW DOCUMENT DELIVERY EXPECTATIONS

In order for ICE Architecture Assurance to effectively assist project teams through the SLM process with minimal disruption, the appropriate documentation should be submitted as far in advance of the SLM gate review as possible (previously referred to as technical review). This allows the assessors time to review and comment on the documents and allows the project teams time to correct any issues identified, thereby increasing the likelihood for a smooth progression through the SLM process.

The time necessary for document assessments varies based on a number of factors including:

New system versus a system in Operations and Maintenance (O&M)

Major release versus a minor release

Quality of previous documentation submitted and the severity and number of issues identified in prior documentation assessments

Alignment with ICE-provided templates

The number of document assessments being conducted concurrently

ICE Architecture Assurance assesses and brokers the assessment of system document artifacts among the various Program component areas. The System Lifecycle Management (SLM) Quality Assurance (QA) Analyst, in coordination with other teams, provides the recommendation to the ICE Architecture Assurance Manager on whether modifications to the delivery timetables should be considered based on the factors listed above.

ICE Architecture Assurance supports and monitors an ever increasing number of projects (currently totaling more than 120). During periods of high volume, when many documents are submitted at or near the same time, the review period may be extended due to capacity constraints within the team. The SLM QA Analyst assigned to the project will notify the IT Project Manager of any anticipated delays as a result of these constraints.

The following terms are used to describe the expected state of a document:

New—the base document is created, possibly with only limited information available at this stage. (The appropriate level of detail should be provided commensurate with the complexity of the project and the information available.)

Updated—the document is an update to a previously submitted document, either as an update to a drafted document or an update to a finalized document.

The following subsections provide the general expectations for delivery of SLM document artifacts, including the number of days prior to review and the expected state of the document. The number of days listed refers to

DELIVERY EXPECTATIONS 3

business days; for example, 10 days equals two work weeks and one day is equivalent to one business day. Failure to provide documentation in a timely manner prior to an SLM gate review could cause the cancellation or delay of the meeting.

2.1 Planning Review Document Delivery Expectations

Exhibit 1 identifies the typical SLM document artifacts of the Planning Review and the number of days prior to the Planning Review that these documents should be submitted to the ICE Electronic Library.

Exhibit 1: Planning Review Document Delivery Expectations

Planning Review Document Delivery Expectations

Expected Delivery (Business Days Prior to Review)

Document Artifact New Systems and Major

Releases Minor

Releases

Expected Document

State

Comments

Project Tailoring Plan (PTP)

10 Not needed

New Assesses the applicability of each of the following to the technology project:

documents and activities, gate reviews, and applicability of the types of independent testing desired Identifies opportunities to consolidate multiple documents into a single document deliverable Identifies any non-relevant content areas within the documents

System Concept of Operations (ConOps)

10 7 New Describes the business process to be supported Identifies the deficiencies in the current system or situation that are driving development Describes the benefits of the proposed system Illustrates the workflow processes to be automated or supported, depicts how users will interact with the system, and delineates how the proposed system will interact with its external interfaces Defines user profiles and assesses operational, organizational, and development impacts Forms a basis for the System Requirements Document (SRD)

DELIVERY EXPECTATIONS 4

Planning Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days Prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Project Management Plan (PMP)

10 7 New Documents project scope, tasks, allocated resources, and interrelationships with other projects Provides details on the involved Agency units and required job tasks Incorporates the Infrastructure Plan which defines the architecture, communications, hardware and other infrastructure support project needs Incorporates the Risk Management Plan which identifies, assesses, and ranks potential risks to the system development project, develops plans to mitigate these risks, and provides a control mechanism to monitor, report, and direct all risk mitigation activities

Project Schedule 10 7 New Documents the project schedule Provides details on the milestone and review scheduling

Training Strategies Worksheet

7 5 New Details the training approach and points of contact for training

FIPS 199 Security Categorization Worksheet

10 10 New Used by the Information Assurance Division (IAD) team to determine the sensitivity level of the system and security controls that may be required Documents security categorization of the system according to FIPS 199 standards Documents types and impact level of information stored and processed by the system Provides analysis of assessed impact levels to determine the overall Security Categorization Categorization determination needed to run the Risk Management System (RMS) tool e-Authentication Assessment

10 Not Needed

New Provides an assessment of the potential impact of authentication errors Determines if e-Authentication requirements are necessary for the system

Privacy Threshold Analysis (Reviewed by Privacy Office and Incorporated in Certification and Accreditation process)

10 Not Needed

New Specifies time period of system build Identifies if the system collects, maintains and/or shares personally identifiable information Enables Privacy Office determination if a full Privacy Impact Assessment (PIA) is required (See Freedom of Information Act/Privacy Act [FOIA/PA] Documents table for more information on the Privacy Threshold Analysis)

ICE Architecture Division SLM

DELIVERY EXPECTATIONS 5

Planning Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days Prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Risk Assessment / SSAA, Para 2.3, Threat Description

10 7 New Determines the extent of the potential threat and the risk associated with an IT system throughout its lifecycle Identifies risks and threats to the system and system vulnerabilities Provides analysis of risks identified Documents system security requirements and identifies the technical, operational, and management security controls employed of planned for meeting those requirements Documents countermeasures for mitigating the system risks RMS/ICE prescribed template

System Security Plan (SSP) / System Security Authorization Agreement

10 7 New Documents system security requirements Identifies the security controls and countermeasures employed Defines responsibilities and expected behavior of all individuals who access the system RMS/ICE prescribed template

Project Change Control Board (PCCB) Charter

10 7 New Establishes the role and authority of the Change Control Board (CCB) and Customer Review Board (CRB) in terms of their change control capacity

DELIVERY EXPECTATIONS 6

2.2 Requirements Review Document Delivery Expectations

Exhibit 2 identifies the typical SLM document artifacts of the Requirements Review and the number of days prior to the Requirements Review that these documents should be submitted to the ICE Electronic Library.

Exhibit 2: Requirements Review Document Delivery Expectations

Requirements Review Document Delivery Expectations Expected Delivery

(Business Days Prior to Review)

Document Artifact New Systems and Major

Releases Minor

Releases

Expected Document

State

Comments

System Requirements Document (SRD)

10 7 New Reflects the functional, performance, and operational requirements of the system Identifies system inputs and outputs Specifies business processes and data, user and system interfaces, operational and system performance, system capacity, and security requirements Provides a business process model that contains the process requirements and consists of data flow diagrams and associated reports Provides high-level use cases

Requirements Traceability Matrix

(RTM)

10 7 New Demonstrates requirements and design traceability Uniquely identifies each requirement with the identification number specified in the

SRD

Traces requirements to their sources and demonstrates how these are fulfilled in the developed system Contains current version of each requirement and related traceability to preceding and concurrent lifecycle elements

DELIVERY EXPECTATIONS 7

Requirements Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days Prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Data Management Plan (DMP)

10 7 New Includes the application logical data model, which contains the data requirements of a system. (This includes an entity relationship diagram [ERD] and it’s supporting entity, attribute, relationship, and unique identifier reports.)

Includes the application physical data model, which contains the database design of a system. (This includes the data schema diagram [DSD] and it’s supporting table, column, foreign key, and primary key reports.)

The logical data model should be finalized during Requirements Definition and the physical data model is incorporated during Design

System Workload Analysis Document

(SWAD)

10 7 New Projects the system capacity and transaction volume to ensure that sufficient system resources and infrastructure are available before the system is deployed

Contingency Plan 10 7 New Provides procedures for continuation of critical missions and business functions in the event of system disruptions Identifies a plan for mitigating the damaging consequences of unexpected and undesirable events of any magnitude and describes training of individuals to execute the plan RMS/ICE prescribed template

Security Requirements Traceability Matrix

(RTM)

10 Not Needed

New Generated from DHS RMS tool based upon FIPS 199 Categorization Maps DHS IT Security Requirements to the NIST 800-53 A Controls

Privacy Impact Assessment (PIA)

10 Not Needed

New Identifies all personally identifiable information collected and stored in the system Describes all uses of and retention period for the information Identifies which organizations will share the information Describes how notice will be provided to individuals prior to the collection of their information and how individuals can access and/or correct their information The PIA should be documented and approved and a System of Records Notice (SORN) created before system operational deployment

DELIVERY EXPECTATIONS 8

Requirements Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days Prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Update if needed:

• Project Management Plan

(PMP)

• Privacy Threshold Analysis

• Risk Assessment / SSAA, Para 2.3, Threat Description

• System Security Plan (SSP) / System Security Authorization Agreement

• Training Strategies Worksheet

7 7 Update as required

Revision history required on all changed/updated documents

DELIVERY EXPECTATIONS 9

2.3 Preliminary Architecture and Design Review Document

Delivery Expectations

Exhibit 3 identifies the typical SLM document artifacts of the Preliminary Architecture and Design Review and the number of days prior to the Preliminary Architecture and Design Review that these documents should be submitted to the ICE Electronic Library.

Exhibit 3: Preliminary Architecture and Design Review Document Delivery Expectations

Preliminary Architecture and Design Review Document Delivery Expectations

Expected Delivery (Business Days prior to Review)

Document Artifact New Systems and Major

Releases Minor

Releases

Expected Document

State

Comments

Advanced Acquisition Plan

10 7 New Specifies how all Government human resources, hardware, software, telecommunications capabilities, and contractor support services are acquired during the life of the project Ensures that needed resources can be obtained and are available when needed (Previously referred to as the Procurement Plan)

Design Document 10 7 New Documents detailed interface design and implementation Identifies the type of transactions Provides detailed user interface specification, the processing schedule, data file specification, communication methods, capacity specification, throughput specifications, security specifications, and data integrity specifications

Data Migration Plan (formerly Data Conversion Plan)

10 7 New Describes the data migration effort Specifies the data that must be available for conversion and the requirements for preparing the data for conversion Establishes data quality assurance controls for before and after the data conversion Describes the tasks, procedures, and necessary support for carrying out the conversion effort Establishes a data migration schedule Addresses security issues related to the conversion effort

DELIVERY EXPECTATIONS 10

Preliminary Architecture and Design Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Information Technology Change Request(s) (ITCR)

10 7 New Requests that a new ICE IT product or performance standard be adopted that is not listed in the ICE Standards Profile Requests that an existing standard be waived

Service Level Agreements (SLA)

5 5 New Specifies the level of support provided for the system Establishes service level agreements Should be noted in System Security Plan

(SSP)

Interface Control Agreement (ICA)

10 7 New Describes interfaces between a system and other external systems Documents detailed interface requirements, design, and implementation

Interconnection Security Agreement

(ISA)

10 7 New Establishes a memorandum of understanding that documents the technical requirements of the interconnection Defines the rules of behavior and controls that must be maintained for the system interconnection Documented in DHS4300A Appendix N format Should be noted in System Security Plan

(SSP)

Development Test Plan (DTP)

10 7 New Documents the testing scope and environment Describes test performed, including test controls, inputs and outputs (Development testing may include unit, integration, functional, performance, or interoperability testing. The testing may be conducted by different testing organizations depending on the required type and scope of testing specified in the approved project work pattern.)

Includes test procedures as an attachment Provides traceability to the requirements validated by development testing

DELIVERY EXPECTATIONS 11

August 2008

Expected Delivery (Business Days prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Development Security Test and Evaluation (ST&E) Plan / SSAA Appendix H- Security Test and Evaluation Plan and Procedures

10 7 New Documents the plan to assess compliance to NIST 800-53 A Controls that include applicable IT Security technical, operational, and management controls employed to mitigate risks and DHS Hardening Guidance compliance Provides an overview of the functions of the system and its overall security posture as verified and described in the security test procedures and results Identifies security tests that will be conducted in order to validate security controls in place on the system and the vulnerability assessment tools used for testing

Training Plan 10 7 New Identifies the audience to be trained Identifies the training needs Defines the training objectives Specifies the organization that will develop and deliver the training Describes the training methods to be used in delivering the training Identifies required training resources, including facilities, equipment, and materials Establishes the training schedule Identifies the training sites Presents the training curriculum

DELIVERY EXPECTATIONS 12

August 2008

Expected Delivery (Business Days prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Update if needed:

• System Requirements Document (SRD)

• Requirements Traceability Matrix

(RTM)

• Data Management Plan (DMP)

• System Workload Analysis (SWAD)

• Project Management Plan

(PMP)

• Security Requirements Traceability Matrix

(RTM)

• Privacy Impact Assessment (PIA)

• Privacy Threshold Analysis (Reviewed by Privacy Office and Incorporated in Certification and Accreditation process)

• Risk Assessment / SSAA, Para 2.3, Threat Description

• System Security Plan (SSP) / System Security Authorization Agreement

• Contingency Plan

• Training Plan

Update as required:

Revision history required on all changed/updated documents

DELIVERY EXPECTATIONS 13

2.4 Final Architecture and Design Review Document Delivery

Expectations

Exhibit 4 identifies the typical SLM document artifacts of the Final Architecture and Design Review and the number of days prior to the Final Architecture and Design Review that these documents should be submitted to the ICE Electronic Library.

Exhibit 4: Final Architecture and Design Review Document Delivery Expectations

Final Architecture and Design Review Document Delivery Expectations Expected Delivery

(Business Days Prior to Review)

Document Artifact New Systems and Major

Releases Minor

Releases

Expected Document

State

Comments

Update as needed:

• Advanced Acquisition Plan

• Design Document

• Data Migration Plan

• Information Technology Change Request(s)

(ITCR)

• Service Level Agreements (SLA)

• Interface Control Agreement (ICA)

• Interconnection Security Agreement (ISA)

• Development Test Plan

(DTP)

• Development Security Test and Evaluation (ST&E) Plan

• System Requirements Document (SRD)

• Requirements Traceability Matrix

(RTM)

• Data Management Plan

(DMP)

• System Workload Analysis Document

(SWAD)

• Project Management Plan (PMP)

• Security Requirements Traceability Matrix

(RTM)

7 7 Update as required

Revision history required on all changed/updated documents

DELIVERY EXPECTATIONS 14

Final Architecture and Design Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days Prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

• Privacy Threshold Analysis

• Privacy Impact Assessment (PIA)

• Risk Assessment

• System Security Plan

(SSP)

• Contingency Plan

• Training Plan

DELIVERY EXPECTATIONS 15

2.5 Test Readiness Review Document Delivery Expectations

Exhibit 5 identifies the typical SLM document artifacts of the Test Readiness Review and the number of days prior to the Test Readiness Review that these documents should be submitted to the ICE Electronic Library.

Exhibit 5: Test Readiness Review Document Delivery Expectations

Test Readiness Review Document Delivery Expectations Expected Delivery

(Business Days prior to Review)

Document Artifact New Systems and Major

Releases Minor

Releases

Expected Document

State

Comments

Version Description Document (VDD)

5 2 New Describes the version released; issued for each application release Specifies equipment configurations and dependencies Inventories materials released, including software contents, software installation files and software source files Presents instructions for installing software Identifies the changes to the previous baseline and the components of the new production baseline for IT applications

Deployment Plan 10 10 New Describes how the information system will be installed and transitioned to an operational system Contains an overview of the system, a brief description of the major tasks involved in the deployment effort (e.g., hardware, software, facilities, materials, personnel), and any site-specific deployment requirements

Development Test Analysis Report

(DTAR)

5 2 New Describes the system units and functions tested Evaluates the performance of the tested units and functions Analyzes the system capabilities demonstrated during development testing Identifies system deficiencies and any indicated improvements in the system design or operation based on the results of the development testing Presents a determination concerning the readiness of the system to be turned over for independent testing

DELIVERY EXPECTATIONS 16

Test Readiness Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days prior to Review)

Document Artifact New Systems and Major

Releases

Comments

Expected Document Minor

State Releases

Development Security Test and Evaluation (ST&E) Report

10 5 New Provides an overview of the functions of the system and its overall security posture Explains how security control validation testing was completed Documents the test results Documents analysis of security findings Provides recommendations to mitigate identified security findings

User Guide 10 7 New Contains all essential information for the user to make full use of the information system Includes a description of the system functions and capabilities, contingencies and alternate modes of operation, and systematic procedures for system access and use

Update as needed:

• Training Plan

• Development Test Plan (DTP)

• Requirements Traceability Matrix

(RTM)

• Data Migration Plan

• Service Level Agreements (SLA)

• System Workload Analysis Document

(SWAD)

• System Requirements Document (SRD)

• Design Document

• Data Management Plan (DMP)

• Project Management Plan (PMP)

• Security Requirements Traceability Matrix

(RTM)

• Contingency Plan

• Risk Assessment

• System Security Plan (SSP)

10 7 Update as required

Revision history required on all changed/updated documents

DELIVERY EXPECTATIONS 17

2.6 Release Readiness Review Document Delivery Expectations

Exhibit 6 identifies the typical SLM document artifacts of the Release Readiness Review and the number of days prior to the Release Readiness Review that these documents should be submitted to the ICE Electronic Library.

Exhibit 6: Release Readiness Review Document Delivery Expectations

Release Readiness Review Document Delivery Expectations Expected Delivery

(Business Days prior to Review)

Document Artifact New Systems and Major Releases

Minor Releases

Expected Document

State

Comments

Authority to Operate Letter / Accreditation

1 1 New Signed by the ICE Program Area Designated Accrediting Authority (DAA)

Certification and Accreditation (C&A) Artifacts:

Security Assessment Report / SSAA Appendix P

– Security Test and Evaluation Report

*Amendment Letter for Minor Releases may be needed

10 10* New Produced by IAD: Provides a summary of the Certification and Accreditation (C&A) activities conducted for the system and documents the Certifying Official’s recommendation; contains a sampling of the most pertinent data called out by the System Security Plan (SSP), Contingency Plan, Risk Assessment, and independent Security Test and Evaluation (ST&E) results; includes the Plan of Action and Milestones (POA&M) to correct any deficiencies and to remediate, reduce, or eliminate known vulnerabilities and identifies any Residual Risk and Waiver/exceptions going forward to DHS

CISO

DELIVERY EXPECTATIONS 18

Release Readiness Review Document Delivery Expectations

August 2008

Expected Delivery (Business Days prior to Review) Document Artifact New

Systems and Major Releases

Comments Expected Document Minor

State Releases

Final updates to previously submitted SLM documents, including:

• Training Plan

• Deployment Plan

• Service Level Agreements

(SLA)

• Systems Administration and Operations Manual

• User Guide

• Data Migration Plan

• Requirements Traceability Matrix (RTM)

• System Requirements Document (SRD)

• Design Document

• Data Management Plan (DMP)

• Project Management Plan

(PMP)

• System Workload Analysis Document

(SWAD)

• Version Description Document (VDD)

Updated Deficiencies are identified for resolution prior to Release Readiness Review (RRR)

Revision history required on all changed/updated documents

Certification and Accreditation (C&A) Artifacts for upload into TAF tool

• Contingency Plan

• Security Risk Assessment

• System Security Plan (SSP)

10 5 Updated Project must work with IAD to update and finalize these documents for the Certification and Accreditation (C&A) Package so that the appropriate security tests may be executed, Security Evaluation Report (SER) written, and an Interim Authority to Operate (IATO) granted (if appropriate) during Test and Deployment

DELIVERY INFORMATION 19

3.0 GENERAL DOCUMENT DELIVERY INFORMATION

The following items provide supplemental information regarding document delivery expectations.

3.1 Library Submission Standards

SA Communiqué – Issue #3 (ICE Electronic Library) delineates submission standards. This document is available in the ICE Electronic Library under “Governance Documents.”

3.2 Document Templates

SLM document templates are available in the ICE Electronic Library under “Governance Documents/Templates.” Project teams should employ these templates when constructing documents. ICE Architecture Assurance provides these templates so that project teams can provide consistent content and formatting across projects. While ICE does not mandate the use of these templates, projects deviating from the templates must provide a section-by-section mapping of the project-provided document to the ICE-standard template. Review periods are typically longer when a non-standard template is used.

3.3 Tailoring

In instances where a document artifact is not required due to approved tailoring, the document delivery expectations for that document artifact do not apply.

3.4 Unchanged Documents

There are instances where a particular document artifact may not need to be updated. In these cases, the document does not need to be resubmitted for review and assessment. However, the project must inform the SLM QA Analyst so that the document artifact can be recorded and the appropriate parties can be informed that no changes to the document were necessary.

3.5 Change Pages versus Complete Document

It is ICE Architecture Assurance standard practice to require complete documents to be submitted rather than “change pages.” It is also required that all changed or updated documents include a Revision History in the beginning of the document. This is essential to minimizing the time that Subject Matter Experts (SME) spend reviewing old information and maximizing the time spent reviewing new information.