Attachment_30_-_Information_Technology_Solutions_Life_Cycle_Methodology_Framework.pdf

Review & Update

Iteratively

Reviews ( ) / Gates ( )

Preliminary (P) / Update (U) / Finalize (F)

Roles Deliverables [D] IT Standards (S)

Execute annual maintenance/steady state tasks

Perform project monitoring and reporting ( i.e. provide updates to IT

Program Plan)

Update Deployment and Disposition Plan

Business Needs Analysis (S)

Update/Build IT Program Plan with IPgT:

o Identify IPgT and define Roles and Responsibilities oPerform Business Needs Analysis (BNA), Business Process

Assessment, and identify business and IT gaps, including system replacements oDetermine strategic alignment (e.g. Legislative, Audit, Strategic Plan, etc.)

oConduct Alternatives Analysis and Cost Benefit Analysis

(including Information Security considerations) o Develop IGCE, including impacts to other programs oDevelop Acquisition Strategy oDevelop Risk, Issue, Quality, Configuration, Communication Plans and Matrices oDefine program reporting/oversight oPrioritize program requirements and program schedule with IPgT stakeholders (Business, EA, IT Security, and

Infrastructure, etc. )

Finalize IT Program Plan

Reflect IGCE in departmental budget formulation/request

BUSINESS PROGRAM MANAGER

IT PROGRAM MANAGER

INTEGRATED PROGRAM TEAM (IPgT)

CHIEF ARCHITECT

RELEASE MANAGER

CONTRACTING OFFICER

INFORMATION SYSTEM SECURITY OFFICER

BUSINESS OWNER/SPONSOR

STEERING/OVERSIGHT COMMITTEE

Need/Concept Planning Solution Implementation (Development, Modernization, Enhancement)

Operations & Maintenance (Steady State & Managed Services)

Disposition

Requirements (Technology

Solution Review)

P h as e s

Execute Deployment and Disposition Plan

Perform monitoring and reporting (i.e.

provide updates to IT Program Plan)

Conduct solution disposition reviews

System Security Plan (F) [D]

Security Risk Assessment (F) [D]

MOUs, SLAs, and/or Intra-agency Agreements [D]

Disposition Review

CAB

(Production/COOP

Deployment Review)

Update IT Program Plan with authority to close out program and/or dispose of IT solution

Update Deployment and Disposition Plan

Close out program

Execute according to the IT Program Plan

Maintain IT Program Plan

Note: Information in IT Program Plan will be used for Semi-Annual Program Review oPerform program monitoring and reporting o For Major: Monthly steering committee reporting (cost and schedule performance using EV), recurring o For Non-Major: Monthly steering committee reporting of cost and schedule

Select development approach

Develop Cost Loaded Project Schedule

Conduct Product and Technology Selection

Develop high level design from high level requirements, including integration with other systems, and submit for CAB review

Refine IGCE

Develop Business Implementation Strategy

Document (Large Projects)

PMO

(Schedule/

Cost Review)

Requirements Document (S)

Design and COTS Configuration Document (S)

System Development (S)

Enterprise Data (S)

TRB

(Design Review)

Contact PMO with business need

PMO facilitates analysis of business needs within the program solutions

PMO facilitates analysis of business needs across enterprise program solutions o EXISTING: Obtain access to existing solution (STOP)* o ENHANCE EXISTING: Inform ITPRB, and submit to Program CCB* oNEW: Finalize sponsorship and IT

Program Plan (Section A - Charter), and submit for ITPRB Review

Reference TRM/ETA for current, planned, and approved technologies/systems

TRB

(Product

Selection Review)

Enterprise Cybersecurity (S) * Enterprise Cybersecurity (S) *

Execute selected Development Approach

Establish Program CCB

Update IT Program Plan with results of product selection and refined IGCE

Software Services (S)

Implementation & Training Plan (S)

Lessons Learned Document (S)

CAB

(Infrastructure

Resources Review)

Stabilize the solution

Grant access to users

Set up service desk support

Transition to O&M

Execute Implementation Strategy and

Training Plan

Document Lessons Learned and

Project Closeout

Change Management Configuration Management

Configuration Management

Configuration Management

Configuration Management

Business Needs Analysis IT Service/Incident/Problem Management IT Service/Incident/Problem

Management

Budget Formulation & Execution

IT Risk Management

Perform Security Registration Process

Begin Security Assessment & Authorization

(SA&A)

Conduct Security Impact Analysis

Complete Security Assessment & Authorization (SA&A)

Develop MOUs, SLAs, and Intra-agency Agreements, as needed

Continuous Monitoring

ATO

(Go Live)

Analyze and document detailed requirements (functional, technical, etc.)

Develop design specifications

Develop/configure solution

Conduct testing tasks (functional, system, performance)

Document operations and maintenance needs

Deploy solution to production/COOP

IT Risk Management

IT Risk Management

IT Risk Management IT Risk Management

Obtain Authority to Operate

*Please contact your ISSO for complete list of Enterprise Cybersecurity Standards.

Enterprise Cybersecurity (S) *

Change Management Change Management

Release and Deployment Management

ITPRB

(Quarterly Project

Review)

Requirements Document [D]

Design and COTS Configuration Document [D]

Lessons Learned Document [D]

Acquisition Acquisition

Acquisition

IT Program Plan (Section A - Charter)

(U) [D]

IT Portfolio Registration Checklist [D]

Security Registration Document [D]

Security Risk Assessment (P) [D]

System Security Plan (P) [D]

Production Readiness Validation

Design (Technology

Solution Review)

Acquisition

IT Program Plan (Sections B-F ; H) (U) [D]

Business Need Analysis Document (e.g. Segment Architecture or Architectural Analysis) [D]*

IT Program Plan (Section C) (U) [D]

Program Performance Reports [D]

IT Program Plan (Sections C and G) (U) [D] Deployment and Disposition Plan (F) [D]

IT Program Plan (Section C) (U) [D]

Deployment and Disposition Plan (U) [D] Deployment and Disposition Plan (P) [D]

Cost Loaded Project Schedule [D]

Business Implementation Strategy

Document [D]

Security Authorization Package [D]

P ro gr am

M an ag e m e n t

P ro je ct

T e ch n o lo gy

M an ag e m e n t

C yb e r

Se cu ri ty

INFORMATION SYSTEM OWNER/INFORMATION

OWNER

INFORMATION SYSTEM SECURITY OFFICER

AUTHORIZING OFFICIAL

BUSINESS PROJECT MANAGER

IT PROJECT MANAGER

INTEGRATED PROJECT TEAM (IPT)

CONTRACTING OFFICER’S REPRESENTATIVE

ENTERPRISE ARCHITECT REPRESENTATIVE

IMPACTED PROJECT MANAGERS

RELEASE MANAGER

INFORMATION SYSTEM SECURITY OFFICER

Product and Technology (S)

Deployment and Disposition Plan (S)

Business Implementation Strategy (S)

Enterprise Cybersecurity (S) *

User Manual [D]

Implementation & Training Plan [D]

Deployment and Disposition Plan (U) [D]

Execute according to the IT Program Plan and corrective actions (manage scope, cost, schedule, and risk using EVM)

Perform project monitoring and reporting (i.e. provide updates to IT Program Plan)

Develop Implementation Strategy and Training Plan in coordination

Obtain approvals from Reviews and Gates

Release and Deployment Management Ex te rn al

P ro ce ss e s

Update & Maintain

Iteratively

ITPRB

(PIR & Annual OA)

ITPRB

(IT Portfolio

Registration Review)

IT Program (Authorization)

ITPRB

(Disposition Review)

ITPRB

(Semi-Annual Program Review)

ITPRB

(Prioritize Review)

Roles

ITSLCM Framework V2.0 – Updated April 7, 2015

Perform program monitoring and reporting o For Major & Non-Major: Monthly steering committee reporting of cost and schedule, ITPRB reporting

Conduct Operational Analysis (OA) o Perform Post Implementation Review (PIR) o Perform Annual Operational Analysis Review oUpdate IT Program Plan with annual maintenance/steady state tasks including results of

Operational Analysis

Note: Info in IT Program Plan will be used for PIR, OA, and

OMB Reporting

Le ge n d

Review & Update

Iteratively