IT950_TN04 Public Website and Web Based Application Developments.pdf

Office of the Chief Information Officer Technical Note: IT-950-TN04 Effective: 4/21/08 Issuing Office: OCIO

PUBLIC WEBSITE & WEB-BASED APPLICATION DEVELOPMENTS

1. Purpose

This technical note describes the procedures Smithsonian units should follow to ensure that the web architecture of their public websites, web-based applications and/or databases conform to Smithsonian standards; and that the Institution’s public web servers are prepared to accept the website or web-based application and its load without adversely impacting existing websites in the shared production environment.

When planning a public website, web-based application or database, units should refer to Smithsonian Directive 950, Web Management for additional considerations not within the scope of this technical note; and to IT-940-01, Technical Reference Model for a list of preferred hardware and software products.

2. Scope and Applicability

This technical note applies to all units, staff, contractors and consultants who are developing or re-developing public Smithsonian websites, web-based applications and/or databases.

To ensure that OCIO can support and host all Smithsonian websites, web-based applications and databases, all development efforts undertaken after this document’s issue date shall comply with the standards and procedures as defined in this technical note. In addition, units migrating existing websites to OCIO servers must provide adequate documentation, configuration information, source files, etc., such that OCIO can support and/or host their website, web-based application or database.

If a website will be hosted outside Smithsonian servers and future support from OCIO is not anticipated, units may request a waiver to the requirements in this technical note.

This technical note does not address requests for support from OCIO to develop websites, web applications, and/or databases. Please contact the OCIO Help Desk for assistance from OCIO’s development resources.

Related technical notes:

IT-920-TN01, Tailoring of LCM Deliverables, Reviews & Events IT-950-TN01, Web Copyright & Privacy Notices IT-950-TN02, Internet Domain Names IT-950-TN05, Web Content Management System Requests IT-960-TN01, Change Management

Public Website & Web-Based Application Developments

3. Responsibilities

A. Change Control Board (CCB). Reviews and approves changes to SInet infrastructure to support Smithsonian websites when the change does not require Technical Review Board approval. See IT-960-TN01, Change Management for more detail about CCB reviews.

B. Information Technology Security Staff (ITSS). Determines the criteria for systems that require a Privacy Impact Assessment (PIA) statement, and reviews the PIA for completeness. Performs website security testing and de-militarized zone (DMZ) vulnerability scanning.

C. OCIO Web Services Division (WSD). Consults on the appropriate web architecture (e.g., software and hardware) for use in the development and operation of websites at the Institution. WSD’s main focus is ensuring OCIO’s ability to prepare and provide the required operational support within resource constraints.

D. System Architecture & Product Assurance Staff (SAPA). Develops and maintains the Smithsonian’s Technology Reference Model (TRM);

recommends waivers to the TRM; ensures that Institutional policy is followed when developing or replacing websites, web-based applications and databases; coordinates the inclusion of other units within OCIO in planning activities; assists with project scoping, LCM tailoring, and required approvals.

E. Smithsonian Unit Staff, Webmasters, Consultants & Contractors. Abide by institutional policy, procedures, and guidelines in the development and support of Smithsonian websites.

F. Technical Review Board (TRB). Reviews and approves public website development projects when the scope of the project warrants TRB review.

The TRB also reviews requests to waive any requirement defined in this technical note. See SAPA’s Product Assurance page for details on TRB approvals.

4. Procedure—New or Redeveloped

Note: A website, web-based application or database is considered to be new when its technology and content are in the requirements definition stage. A redeveloped website, web-based application or database is one which has been previously developed, but different technologies for content delivery and/or server-side technology are being considered (e.g., changing from static HTML pages to dynamic content (ASP, Cold Fusion, PERL or Flash-driven), changing from one platform to another, or developing a new look and feel for content using tools not specified in the

TRM.)

http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-960-TN01.pdf http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-960-TN01.pdf http://prism.si.edu/ocio/sapa/pa/index.html

A. Project Planning, Tailoring and Requirements Definition. Once the decision is made to create or re-develop a website, web-based application or database:

1) The unit sponsoring the project will contact SAPA. SAPA will work with unit representatives and WSD to develop the site’s planning process and define project scope and requirements, according to Technical Standard & Guideline IT-920-01, Life Cycle Management Manual.

2) SAPA works with the unit and WSD to tailor the project life cycle by completing the Lifecycle Management (LCM) Tailoring Agreement Checklist, as required by IT-920-TN01, Tailoring of LCM Deliverables, Reviews & Events. During tailoring, SAPA and unit representatives specify:

Level of documentation required, given the project scope (including PIA statement, if needed).

Whether the project requires TRB and/or CCB approval, based on project scope and whether the unit has requested waivers to any of the requirements in this technical note. For details on approvals which may be required as a result of tailoring, see IT-920-TN01, Tailoring of LCM Deliverables, Reviews & Events.

Note: Additional guidelines, templates and samples for use during project scoping and requirements definition are provided under “Web Project Statements of Work,” on SAPA’s Product Assurance page.

3) The unit will provide an initial schedule for the entire development process, from requirements definition through contractor selection, design, development, testing and deployment to production. The unit will also submit any waiver requests at this time.

4) SAPA and WSD will work with the unit to identify the type(s) of software and hardware necessary to operate the website, or web-based application or database, in compliance with Smithsonian standards (e.g., TRM).

5) SAPA and WSD will work with the unit to identify any additional requirements which must be satisfied during development to ensure the deployment of the system into production, including:

Smithsonian structural guidelines

Copyright and privacy notices in accordance with technical note IT- 950-TN01, Web Copyright & Privacy Notices

Compliance with Smithsonian Directive 950, Web Management

6) WSD will work with the unit to identify any infrastructure issues and costs for the hosting of the website or web-based application, including identifying which costs OCIO will bear and which costs the unit will bear.

http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-920-01.pdf http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-920-TN01-Checklist.doc http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-920-TN01-Checklist.doc http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-920-TN01.pdf http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-920-TN01.pdf http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-920-TN01.pdf http://prism.si.edu/ocio/sapa/pa/index.html http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-950-TN01.pdf

B. Develop/Maintain Documentation. The unit webmasters will draft and maintain documentation as defined during project planning in its completed LCM Tailoring Agreement Checklist (some or all of the following, depending upon project scope: system requirements, detailed design document, technical and configuration specifications, master test plan, test scripts, operational support plan, user guide, backup plan, and/or Privacy Impact Assessment (PIA) statement). Soft copies will be provided in a timely manner to SAPA and WSD. The PIA, if applicable, will also be provided to ITSS.

C. Approval. Generally, the deployment of a new website or web-based application—including any significant redevelopments—will require either Technical Review Board (TRB) or Change Control Board (CCB) approval, as determined during project planning/tailoring and specified in the LCM Tailoring Agreement Checklist.

If TRB submittal was specified during project planning, units will contact SAPA to initiate the TRB review process, and for an explanation of the procedures to follow in submitting material to the TRB.

If any of the software components require CCB approval, the unit either creates a change ticket or contacts the OCIO Help Desk to have them create a change ticket in order to obtain CCB approval, per technical note IT-960-TN01, Change Management.

D. Domain Name Registration. WSD will coordinate the registration of any domain names that may be needed for the website. The unit will fund any required registration fees for the domain names—including periods of dormancy—per technical note IT-950-TN02, Internet Domain Names.

E. De-Militarized Zone (DMZ). All public websites, web-based applications and databases will be housed in the “public zone” (DMZ) of the Smithsonian Data Center in Herndon, unless either a waiver is approved by the TRB or the unit maintains its own DMZ (e.g., STRI). None will be allowed within the Smithsonian Institution’s internal production network. A DMZ is defined as a small network inserted as a "neutral zone" between the Smithsonian’s private network and the outside public network. It prevents outside users from getting direct access to a server that has private data. Smithsonian’s DMZ is located in the Smithsonian Data Center.

F. Pre-Production Testing. Units shall set up a test environment in which to test their websites, web applications and databases and execute detailed step-by-step test scripts as required by the completed LCM Tailoring Agreement Checklist. Results shall be recorded in a test matrix and presented as a result in the master test plan. For examples of these documents, see Master Test Plan and Test Scripts for an Example Website on WSD’s Prism site.

It is highly recommended that units conduct preliminary pre-production testing in their test environment as early as possible (e.g., once executable code is developed) to identify any potential problems arising between differences in the development and production environments.

http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-960-TN01.pdf http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-950-TN02.pdf http://prism.si.edu/TeamSiteUsers/docs/procedures/SystDocEx/SI_ERP_MasterTestPlan.pdf http://prism.si.edu/TeamSiteUsers/docs/procedures/SystDocEx/SI_ERP_MasterTestPlan.pdf http://prism.si.edu/TeamSiteUsers/docs/procedures/SystDocEx/SI_ERP_TEST_SCRIPT.pdf

After testing has been completed within the unit’s test environment, OCIO will conduct final testing within the test environment at Smithsonian Data Center to ensure that it complies with security and performance standards as determined by WSD and ITSS. ITSS may repeat security testing after the unit corrects any errors found during initial scans.

G. Pre-Production Deployment Review. Units shall request a pre-production deployment review with WSD well in advance of the projected production deployment date. This will allow adequate time for:

WSD to assist the unit in the review of all new and redeployed websites, web-based applications and databases for compliance with the LCM Tailoring Agreement Checklist and project requirements as agreed to between SAPA, WSD, and the unit during the project planning and requirements definition phase.

WSD to provide requested corrective actions in writing that must be resolved prior to moving the website, web-based application or database into production.

Units to correct any deficiencies identified during the review.

H. Post-Production Deployment Support. It is important that units have proper LCM documentation in order for OCIO to assist in troubleshooting any problems that may occur after a website, web-based application or database is deployed into the production environment. This is especially critical for websites, web-based applications and databases created by contractors and consultants with whom the Institution no longer has a contractual relationship.

All LCM documentation MUST be stored in a project directory called _sitedocs, independent of whether a website uses the web content management system (WCM). The “_sitedocs” directory resides alongside the other web content in the work area, but the directory is filtered during deployment and will NOT be deployed to the public servers.

Without access to the required documentation, OCIO will be severely limited in the support it can offer in troubleshooting the source of the problem.

Problems determined to be caused by the implementation of the website, web-based application or database—which are not as a result of the web infrastructure—are the responsibility of the unit to resolve. While OCIO may offer assistance with their resolution, this assistance will be a level of effort based on staff availability.

In summary, proper documentation is extremely important to OCIO’s ability to support units’ web sites in the future. The requirements for documentation include:

A detailed Deployment guide and User Guide MUST BE PROVIDED.

The User Guide MUST provide a detailed step-by-step description of each process including: files generated, files updated, mail automatically sent, deployment scripts executed automatically, or any other information running when information is processed.

The User Guide must be approved and signed by final users.

Failure to provide and validate a User Guide will impact negatively in the quality of support that Web Services Division may provide.

Units are responsible for verifying and testing that the system is functioning as required and described in the User Guide. In particular, detailed step-by-step test scripts and a completed test matrix will be needed, as they provide evidence that the site originally functioned properly. Test scripts also provide the necessary step-by-step directions useful in working to isolate the source of any problems.

Units must store all documentation, including the User’s Guide, in a directory called “_sitedocs”.

Units are responsible for keeping their staff fully informed and trained on how the whole system works, including but not limited to templates, workflows, open deploy scripts, functionality of the website and its interoperability with other SI resources (e.g., search engines).

Web Services Division will do their best to give support when a major failure occurs; however, units will need to fund any support or improvements for a specific application.

5. Procedure—Ongoing Surveillance of Existing Web Content

A. If a Smithsonian website, web-based application or database deployed into production is found later to exceed the previous hardware or storage requirements agreed to between WSD and the unit, WSD will work with the unit to identify any infrastructure issues and recommend corrective actions.

Costs for corrective infrastructure actions will be negotiated to determine which costs OCIO will bear and which costs the unit will bear.

If an agreement cannot be reached, the unit will be required to scale back the website, web-based application or database to fit within the initial infrastructure requirements previously negotiated with OCIO. Units are encouraged to contact WSD to negotiate any infrastructure improvements in advance of actions that may increase the site’s infrastructure needs.

B. If a Smithsonian website, web-based application or database deployed into production fails after being moved into production, WSD may assist in determining corrective actions and any required maintenance. However, the costs of the maintenance or corrective actions, if determined to result from the website, web-based application or database, are the responsibility of the unit to bear.

C. The unit webmasters must maintain the documentation specified for the site per its completed LCM Tailoring Agreement Checklist. Updated soft copies will be provided in a timely manner to SAPA; the most current version will be provided on request to WSD or stored in a directory located in an area accessible by WSD (e.g., the “_sitedocs” directory for WCM sites, network share drive, or any other previously defined). Updated PIAs, if required, will also be provided to ITSS.

D. Units will continue to fund domain name registrations after the expiration of the initial registration period, as applicable, per technical note IT-950-TN02, Internet Domain Names.

Ann Speyer Chief Information Officer http://prism2.si.edu/SIOrganization/OCIO/IT%20Policies_1/IT-950-TN02.pdf