PL 011.pdf

For instructions on using this template, please see Notes to Author/Template Instructions on page iv.

Notes on accessibility: This template has been tested and is best accessible with JAWS 11.0 or higher.

For questions about using this template, please contact CMS IT Governance. To request changes to the template, please submit an XLC Process Change Request (CR).

Centers for Medicare & Medicaid Services CMS eXpedited Life Cycle (XLC)

<System Name / Acronym>

Operations & Maintenance (O&M) Manual

Version X.X

MM/DD/YYYY

Document Number: <document’s configuration item control number>

PL 011

mailto:IT_Governance@cms.hhs.gov https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/XLC/Downloads/XLCProcessChangeRequestCR.docx

CMS XLC XLC Template Revision History

Operations & Maintenance (O&M) Manual ii Error! Use the Home tab to apply Version Number to the text that you want to appear here. MM/DD/YYYY<Pub Date>MM/DD/YYYY

CMS eXpedited Life Cycle (XLC)

Contract Number: <current contract number of company maintaining document>

CMS XLC XLC Template Revision History

Operations & Maintenance (O&M) Manual Version X.X iii <System Name / Acronym>

XLC Template Revision History

The following table records information regarding changes made to the XLC template over time. This table is for use by the XLC Steering Committee only. To provide information about the controlling and tracking of the Operations & Maintenance (O&M) Manual artifact, please refer to page v (Record of Changes).

Table 1: XLC Template Revision History

Version

Number Date Author/Owner Description of Change

1.0 11/13/2007 J. Shadoan, OIS/DITPPA Baseline Version

2.0 9/23/2009 K. Maenner, OIS/DITPPA Changes based on ILC CR58 based on comments from Lockheed-Martin

2.1 10/19/2009 K. Maenner, OIS/DITPPA

1. Adjusted List of Tables

2. Added Disaster Recovery Appendix

3. Renamed Appendix E

4. Removed Release Management Section

2.2 3/09/2010 K. Maenner, OIS/DITPPA Changed format of table 3.2.2 per Lockheed-Martin

2.3 12/30/2010 C. Shaunessy, OIS/EASG/DITG

Changes based on ILC CR090 requested by LM on behalf of Roxanne Byczkowski:

1. Adjusted List of Tables

2. Added verbiage to the Disaster Recovery

Appendix

3.0 5/14/2014 C. Shaunessy, OIS/EASG/DITG Moved content to new XLC template format

3.1 8/7/2014 C. Shaunessy, OIS/EASG/DITG

1. Corrected heading labels on Roles/Responsibilities table in Section 4.

2. Adjusted table captions for 508 compliance

3. Added Section 5.3: Production Control

Procedures

4. Other minor formatting and content changes per

CR 14-012.

3.2 02/02/2015 Surya Potu, CMS/OEI/DPPIG

Updated CMS logo.

CMS XLC Notes to the Author / Template Instructions

Operations & Maintenance (O&M) Manual Version X.X iv <System Name / Acronym>

Notes to the Author / Template Instructions

This document is a template for creating an Operations & Maintenance Manual for a given investment or project. The final document should be delivered in an electronically searchable format. The Operations & Maintenance Manual should stand on its own with all elements explained and acronyms spelled out for reader/reviewers, including reviewers outside CMS who may not be familiar with CMS projects and investments.

This template includes instructions, boilerplate text, and fields. The developer should note that:

Each section provides instructions or describes the intent, assumptions, and context for content included in that section. Instructional text appears in blue italicized font throughout this template.

Instructional text in each section should be replaced with information specific to the particular investment.

Some text and tables are provided as boilerplate examples of wording and formats that may be used or modified as appropriate.

When using this template, follow these steps:

1. Table captions and descriptions are to be placed centered, above the table.

2. Modify any boilerplate text, as appropriate, to your specific investment.

3. Do not delete any headings. If the heading is not applicable to the investment, enter “Not Applicable” under the heading.

4. All documents must be compliant with Section 508 requirements.

5. Figure captions and descriptions are to be placed centered, below the figure. All figures must have an associated tag providing appropriate alternative text for Section 508 compliance.

6. Delete this “Notes to the Author / Template Instructions” page and all instructions to the author before finalizing the initial draft of the document.

CMS XLC Record of Changes

Operations & Maintenance (O&M) Manual Version X.X v <System Name / Acronym>

Record of Changes

Instructions: Use the table below to record information regarding changes made to the document over time.

Table 2: Record of Changes

Version

Number Date Author/Owner Description of Change

CMS XLC Table of Contents

Operations & Maintenance (O&M) Manual Version X.X vi <System Name / Acronym>

Table of Contents

1. Introduction

1.1 System Manual Identification

2. Referenced Documents

3. System Overview

3.1 Functional System Overview

3.1.1 Application/System Dependency

3.2 Physical System Overview

3.2.1 Physical Architecture

3.2.2 System Software to Hardware Specifications

3.2.2.1 Special Server Conditions (If Applicable)

3.2.3 System Firewall Specifications

3.3 System User Overview

3.3.1 Estimated Users

3.3.2 Peak Processing Time

3.3.3 Hours of Operation

3.3.4 User Impact for System Failure

3.4 Processing Overview

3.4.1 Data Flow Diagram

3.4.2 Data Sources

3.4.3 Data Refresh/System Updates

3.4.4 Reporting Requirements

3.4.5 Service Level Agreements (SLAs)

3.5 Security and Privacy Overview

4. O&M Roles and Responsibilities

5. Operation Procedures

5.1 Operations Sequence

5.2 Operations Procedures

5.3 Production Control Procedures

5.4 Input/Output Procedures

5.5 Diagnostic and Problem Handling Procedures

5.6 Backup Procedures

5.7 Restart/Recovery Procedures

5.8 Monitoring Procedures

5.9 Maintenance Procedures

6. Data and Database Administration

6.1 Data Administration Procedures

6.2 Database Administration Procedures

7. Configuration Management

Appendix 8-A: Software Licensing

CMS XLC List of Figures

Operations & Maintenance (O&M) Manual Version X.X vii <System Name / Acronym>

Appendix 8-B: Service Desk Scripts

Appendix 8-C: Service Desk FAQ

Appendix 8-D: Disaster Recovery Procedures

Appendix 8-E: Application Validation Procedures

Appendix 8-F: Server Start-up and Shutdown Procedures: Scripts

Appendix 8-G: Server Build Documentation

Appendix 8-H: Contact List

Appendix 8-I: Acronyms

Appendix 8-J: Glossary

Approvals

List of Figures

No table of figures entries found.

List of Tables

Table 1: XLC Template Revision History ........................................................................................... iii

Table 2: Record of Changes .............................................................................................................. v

Table 3: Referenced Documents

Table 4: Application/System Dependency

Table 5: Software to Hardware Matrix

Table 6: Application Special Server Table

Table 7: Firewall Information

Table 8: Data Sources

Table 9: Database Refresh Schedule

Table 10: Roles and Responsibilities

Table 11: Database Administration Team

Table 12: Embedded Software

CMS XLC List of Tables

Operations & Maintenance (O&M) Manual Version X.X viii <System Name / Acronym>

Table 13: Problem Solving Scenarios

Table 14: Application Support Contacts

Table 15: I.T. Support Responsibilities

Table 16: Contact List

Table 17: Acronyms

Table 18: Glossary

Table 19: Approvals

CMS XLC Introduction

Operations & Maintenance (O&M) Manual Version X.X 1 <System Name / Acronym>

1. Introduction

Instructions: Provide full identifying information for the automated system, application, or situation for which the O&M Manual applies, including as applicable, Also identify the type(s) of computer operation involved (e.g., desktop, mainframe, client/server, Web-based, online and/or batch transaction processing and/or decision support). Summarize the purpose of the document, the scope of activities that resulted in its development, its relationship to other relevant documents (e.g., the System Security Plan (SSP) and/or Information Security (IS) Risk Assessment (RA), System Design Document (SDD), Interface Control Document (ICD), Database Design Document, Data Conversion Plan, Release Plan, Version Description Document (VDD), Implementation Plan, Test Plan, User Manual, etc., if they exist), the intended audience for the document, and expected evolution of the document.

1.1 System Manual Identification

Instructions: Provide identifications number(s), title(s)/name(s), abbreviation(s)/acronym(s), version number(s), and release number(s).

2. Referenced Documents

Instructions: Provide identifying information for all documents used to arrive at and/or referenced within the O&M Manual (e.g., related and/or companion documents, prerequisite documents, relevant technical documentation, etc.). At a minimum, the current Version Description Document (VDD) should be identified as a referenced, companion document.

Table 3: Referenced Documents

Document Name Document Number and/or URL Issuance Date

3. System Overview

Instructions: Provide a description of the system, including its purpose and uses.

CMS XLC System Overview

Operations & Maintenance (O&M) Manual Version X.X 2 <System Name / Acronym>

Describe the relevant benefits, objectives and goals as precisely as possible. Include a high-level context diagram(s) for the system and subsystem. This section should also describe at a high-level overview of the business background, i.e., what the system is, why it is being created, for whom it is being created, and where it will exist.

3.1 Functional System Overview

Instructions: Briefly describe the high-level capabilities and operation of the system (i.e., what the system does (and doesn’t do, if necessary). Itemize each functional component with a description. Provide functional hierarchy diagram if applicable.] Describe the basic flow of the system and include a Dataflow and Logical architecture design. This should include a design of the architecture and how the data flows through the system.

3.1.1 Application/System Dependency

Instructions: Provide any dependencies of the application/system and the impact.

Table 4: Application/System Dependency

Dependent Application/System

Function Impact (If Application is Down)

3.2 Physical System Overview

Instructions: Provide a brief description of the system architecture and the major system components essential to the operation of the system in the production environment.

Provide identifying and descriptive information for all hardware and software components, including purpose/operation of each component and the amount of memory and auxiliary storage needed, as appropriate. For online transaction-based processing, provide an inventory of all software components that must be loaded for the software system to be operational. Identify software necessary to resume operation of the system in case of emergency. Identify all permanent files and databases that are referenced, created, or updated by the system, including retention schedule and disposition.

3.2.1 Physical Architecture

Instructions: Provide any charts, diagrams, and/or graphics as necessary to depict system organization and production operational interrelationships. All diagrams should include all server names (Physical/Virtual), IP addresses, Application Layers, Operating

Operations & Maintenance (O&M) Manual Version X.X 3 <System Name / Acronym>

Systems, Firewall/Ports]

Diagram should be labeled as items with corresponding descriptions given (i.e. item 1 of Figure X, Item 2 of Figure X etc.)

3.2.2 System Software to Hardware Specifications

Instructions: Provide table to identify ALL servers in the Physical Production Architecture. For each server identified, the Server Name, OS, Primary Function and whether the server is dedicated should be provided. Virtual Server information should also be provided if applicable. Please note if any servers are owned/operated by a different company, i.e. ATT, etc.

Table 5: Software to Hardware Matrix

Server Name/Type

Rack / Zone

IP Address

Infrastructure Zone

Primary Function

Dedicated

Software Type

Software Name/Version

Environment

Volume Manager (Local)

Volume Manager

(SAN)

RAID Level (Local)

CPU

Memory

Operations & Maintenance (O&M) Manual Version X.X 4 <System Name / Acronym>

Primary Hard Disk

O/S

System

3.2.2.1 Special Server Conditions (If Applicable)

Table 6: Application Special Server Table

Server Condition Server Name O/S Primary Function

Dedicated

3.2.3 System Firewall Specifications

Table 7: Firewall Information

Firewall Originating Server Destination Server Port

3.3 System User Overview

Instructions: Provide a number reference for the estimated/actual amount of users per application. Also provide the impact for users if the production environment is unavailable or in the event of processing malfunctions.

Operations & Maintenance (O&M) Manual Version X.X 5 <System Name / Acronym>

3.3.1 Estimated Users

3.3.2 Peak Processing Time

3.3.3 Hours of Operation

3.3.4 User Impact for System Failure

3.4 Processing Overview

Instructions: Provide information that is applicable to the processing of the system.

Identify the state(s) and mode(s) of operation. Identify the types of inputs/access that can be made to the software and the software’s response to each type. Provide a flow chart depicting how the information moves from the application to the database. If any portion of the system is run in batch mode, provide an inventory of all runs showing the software components, the job control batch file names, run jobs, and purpose of each run. If sets of runs are grouped by time periods or cycles, each set of required integrated operations should be described by frequency (i.e., daily, weekly, etc.). If runs may be grouped logically by organizational level, the groups of runs that can be performed by each organizational level (e.g., headquarters processing, field activity processing, etc.) should be described according to the logical groupings.

3.4.1 Data Flow Diagram

Instructions: Include Data Flow Diagram if applicable.

3.4.2 Data Sources

Instructions: Provide information that is applicable to the transfer of data. Describe if data is extracted from system files. Fill out the table below completely.

Table 8: Data Sources

System Name Full Name Function Input Source Environment

3.4.3 Data Refresh/System Updates

Instructions: Provide information that is applicable to how the application data is updated or “refreshed” to reflect the most recent data. Identify Data Structures / Specific areas to be refreshed. Indicate if updates are automated, if they provide alerts if not executed properly, and the schedule for the refreshes, if this applies to the system.

Fill out the table below. Provide information that is applicable to how the application

CMS XLC O&M Roles and Responsibilities

Operations & Maintenance (O&M) Manual Version X.X 6 <System Name / Acronym> data is updated or “refreshed” to reflect the most recent data. Identify Data Structures / Specific areas to be refreshed. Indicate if updates are automated, if they provide alerts if not executed properly, and the schedule for the refreshes, if this applies to the system.

Fill out the table below.

Table 9: Database Refresh Schedule

System (Platform)

Server/Address Schedule Specifications Update Mechanism

3.4.4 Reporting Requirements

Instructions: Provide information to identify any reports and other outputs that are generated by the software runs, including security and privacy considerations for each.

3.4.5 Service Level Agreements (SLAs)

Instructions: Provide information to identify any system restrictions, waivers of operational standards, service level agreements (SLAs), and information oriented toward specific support areas (e.g., interfaces with other systems).

3.5 Security and Privacy Overview

Instructions: Describe the security and privacy considerations associated with operation and maintenance of the system. Appropriate information may be obtained by including or referencing information provided in the System Security Plan (SSP) and/or Information Security (IS) Risk Assessment (RA).

4. O&M Roles and Responsibilities

Instructions: Identify the functions and owners for the roles identified in the table below.

Table 10: Roles and Responsibilities

Role Function Organization/ Functional Area

Application Software Installation(s)

Application(s) Administration

CMS XLC Operation Procedures

Operations & Maintenance (O&M) Manual Version X.X 7 <System Name / Acronym>

Role Function Organization/ Functional Area

Server Hardware/OS Maintenance Administration

Desktop/Client Administration

Backup & Recovery

Scripts (Scheduled execution)

Infrastructure Support

(LAN/WAN)

5. Operation Procedures

5.1 Operations Sequence

Instructions: Provide a schedule of acceptable phasing of the system software into a logical series of operations, including any data/database refreshes. A run may be phased to permit manual or semiautomatic checking of intermediate results, to provide the user with intermediate results for specific purposes, or to permit a logical break if higher priority jobs are submitted. An example of the minimum division for most systems would be edit, file update, and report preparation. If the system is a batch system, provide the execution schedule, which shows, at a minimum, the following:

Job dependencies (include resource and peripheral requirements)

Day of week/month/date for execution

Time of day or night (if significant)

Estimated run time in computer units and factors that may affect it

Required turnaround time

5.2 Operations Procedures

Instructions: Provide detailed instructions for each identified state and mode of operation. If applicable, provide detailed information needed to execute system runs or to perform manual operations. Address any associated security and privacy considerations, procedures for taking check points, and procedures for monitoring, deleting, and prioritizing print jobs. For each identified run, provide the information described in the following sub-paragraphs, as appropriate and applicable.

CMS XLC Operation Procedures

Operations & Maintenance (O&M) Manual Version X.X 8 <System Name / Acronym>

5.3 Production Control Procedures

Instructions: Provide detailed instructions for each identified state and mode of operation. If applicable, provide detailed information needed to execute system runs or to perform manual operations. Address any associated security and privacy considerations, procedures for taking check points, and procedures for monitoring, deleting, and prioritizing print jobs. For each identified run, provide the information described in the following sub-paragraphs, as appropriate and applicable.

5.4 Input/Output Procedures

Instructions: Describe the input and output media (e.g., form, magnetic disk) relevant to the identified modes of operation and provide procedures for reading and writing on these media. Briefly describe the operating system control language, and list procedures for interactive messages and replies. Describe all operator job control inputs (e.g., for initiating/starting the run, selecting run execution options, activating an online or transaction-based system, and running the system through remote devices, if appropriate). Identify the report names/identifiers, distribution requirements, and any identifying numbers expected to be output from the run. Describe reports to be produced from the system run by other than standard means.

5.5 Diagnostic and Problem Handling Procedures

Instructions: Describe the diagnostic or error-detection features of the system software, the purpose of the diagnostic features, and the setup and execution procedures for any software diagnostic procedures. Identify potential problems that may occur in any step of operation. Identify the error codes and messages or other indications that accompany those potential problems, and describe the automatic and manual procedures to be followed for each occurrence.

5.6 Backup Procedures

Instructions: Describe procedures for regularly scheduled backups of the entire network, including program and data storage. Describe procedures for creating, storing, maintaining, and securing backups and associated logs. Describe daily and weekly backup schedules and procedures, including cartridge labeling, tracking, and rotation instructions. Describe the location, schedule, and procedures for off-site storage.

5.7 Restart/Recovery Procedures

Instructions: Provide procedures for restart/recovery in the event of a system failure.

Describe any other applicable procedures or measures to ensure continuity of operations in the event of emergencies (e.g., procedures for switch over to a redundant computer system).

5.8 Monitoring Procedures

Instructions: Describe tools and procedures for monitoring system usage, performance, and activity during operations. Identify the hours of peak demand. Describe available

CMS XLC Data and Database Administration

Operations & Maintenance (O&M) Manual Version X.X 9 <System Name / Acronym> indicators, interpretation of those indicators, and routine and special monitoring procedures to be followed. Provide instructions for conducting and documenting troubleshooting activities. Include procedures for the setup and monitoring of the operating system and application audit trails. Describe any licensing agreements and procedures for ensuring that all licenses are current.

5.9 Maintenance Procedures

Instructions: Describe procedures for maintaining the file system. Provide system maintenance schedules, as appropriate. Describe procedures for installing and testing system updates and for moving /installing the system updates to the operational environment. Include procedures for creating and updating maintenance reports.

6. Data and Database Administration

6.1 Data Administration Procedures

Instructions: If data input is required at production time, identify who is responsible for the source data, the format of the data, data validation requirements, and disposition of input source and created data.

6.2 Database Administration Procedures

Instructions: Describe who provides database access and the procedures for granting access. Identify the person(s) responsible for making changes to the database, adding/deleting groups and users to the database, setting permissions for users of the database, re-indexing the database after changes have been made, packing/compressing the database, database reporting, and performing database backups/restores. Provide the procedures necessary for adding/deleting database groups and users; for setting permissions; for re-indexing the database after changes have been made; for packing/compressing the database; for data entry, modifying, and deleting information from the database, and for performing backups/restores of the database. Identify the database reports that are to be generated, including the timeframes, due dates, distribution, and storage of the reports.

Table 11: Database Administration Team

DBA Organization Primary Location

Office Phone Cell Phone Email

CMS XLC Configuration Management

Operations & Maintenance (O&M) Manual Version X.X 10 <System Name / Acronym>

7. Configuration Management

Instructions: Describe the configuration management procedures that will be followed and the interactions that will occur for configuration control, change control, and configuration status account reporting for maintaining the configuration information for the hardware and software actually installed. This information may be copied from the Implementation Plan and modified as necessary and appropriate to address configuration management during operations and maintenance support, if different from that followed during implementation. Describe procedures for maintaining a property inventory at the operational sites(s). Include procedures for maintaining floor plans showing the location of all installed equipment and instructions for how to add/delete/modify the plans.

CMS XLC Appendix 8-A: Software Licensing

Operations & Maintenance (O&M) Manual Version X.X 11 <System Name / Acronym>

Appendix 8-A: Software Licensing

Instructions: Describe any specific Software Licensing/Embedded Software for the application. Indicate the governance of the usage or redistribution of copyright protected software. Describe software license grants an end-user permission to use one or more copies of software in ways where such a use would otherwise constitute infringement of the software publisher's exclusive rights under copyright law.( i.e. COTS, Software metering, Copyright licenses, Open-source license, etc).

Table 12: Embedded Software

Software

Version

Type of License

Number of Licenses

Responsible Party

Proof of License

License Custodial Agent

Operational Support Responsibility

Contact Information and Credentials

CMS XLC Appendix 8-B: Service Desk Scripts

Operations & Maintenance (O&M) Manual Version X.X 12 <System Name / Acronym>

Appendix 8-B: Service Desk Scripts

Instructions: This section provides steps at a quick glance that the Service Desk is to follow whenever processing calls for this application. The top section is all of the information that should be obtained from the user. The table should contain the scenarios with corresponding steps. Contact information for the application is mandatory.

<Name of a Given Application> Quick Reference Guide

USER LOGS CALL WITH THE APPROPRIATE SERVICE DESK CMS IT SERVICE DESK

REPORTING A {APPLICATION NAME} PROBLEM

1) Service Desk opens a Remedy ticket and gathers the following information from Caller:

Caller Name?

Caller Phone Number?

Caller Organization?

Caller Email?

User ID?

Application Sub-system? (list possible subsystems, if applicable)

Extent of Problem? (Individual Desktop, Multiple Desktops at Site, Entire Site)

Problem Description?

Last screen/tab/navigation activity before problem occurred?

Table 13: Problem Solving Scenarios

If User Reports: Then…

Instructions: List potential problems user could experience in this column.

Instructions: In this column, List actions to be taken, either by Service Desk, or name of contact for referral.

Please provide a descriptive example of a problem a user might call to report

Please provide exact steps that the Service Desk must follow in order to process the call correctly (including, but not limited to: CTIs, group ticket should be assigned to, any troubleshooting steps to complete, etc.)

CMS XLC Appendix 8-B: Service Desk Scripts

Operations & Maintenance (O&M) Manual Version X.X 13 <System Name / Acronym>

Table 14: Application Support Contacts

Application Support Contacts List Timeframes for Support

System Emergency

Non-Emergency

Table 15: I.T. Support Responsibilities

Responsibilities Lead / 1st Contact Lead / 2nd Contact

Backup / 2nd Contact

Backup / 3rd Contact

CMS IT Service Desk

CMS_IT_Service_Desk@cms.hhs.gov or

410-786-2580 / 800-562-1963

N/A N/A

Tier 1

Tier 2

Tier 3

CMS XLC Appendix 8-C: Service Desk FAQ

Operations & Maintenance (O&M) Manual Version X.X 14 <System Name / Acronym>

Appendix 8-C: Service Desk FAQ

Instructions: This section is a placeholder reserved for creating and maintaining a self-serve FAQ effort related to different support topics. The self-serve FAQ area is where users can find answers to common topics that users can themselves troubleshoot and fix.

CMS XLC Appendix 8-D: Disaster Recovery Procedures

Operations & Maintenance (O&M) Manual Version X.X 15 <System Name / Acronym>

Appendix 8-D: Disaster Recovery Procedures

As promulgated under the legislative requirements set forth in the Federal Information Security Management Act (FISMA) of 2002 and the guidelines established by the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, titled "Contingency Planning Guide for Information Technology Systems" dated June 2002, the completion of a Centers for Medicare & Medicaid Services (CMS) Information Security (IS) Contingency Plan (CP) applies to all CMS applications except where an application is included as part of a General Support System (GSS) CP and/or GSS Disaster Recovery Plan (DRP). The Business Owner of every application within the CMS enterprise is required to ensure that an IS CP is implemented and maintained to reduce risks to reasonable and appropriate levels and to comply with business continuity priorities, applicable laws, regulations, and policies.

The CMS IS CP documents the strategies, personnel, procedures, and resources that the application/system Business Owner and System Developer/Maintainer uses to respond to any short or long term interruption to their supported application/system. The IS CP will aid the Business Owner and System Developer/Maintainer to quickly determine the appropriate actions to be taken due to an interruption or disaster. An interruption can include key parts of a system being unavailable (e.g., email notification or file transfer capability only) and/or the entire application/system being destroyed.

The recovery functions outlined in the IS CP should include temporary manual processing, recovery and operation on an alternate system, or relocation and recovery at an alternate site.

The Business Owner and/or System Developer/Maintainer are responsible for coordinating with the Infrastructure Support/Data Center personnel to ensure the recovery and restoration activities are performed in accordance with the requirements of the application. The IS CP should be referenced within the Operations & Maintenance Manual as a vital record (and vice versa) to aid in the recovery of the application/system.

1. Justification for recovery after a disaster

a. Justification should explain the cost(s), tangible and intangible, to the organization of not having the application

b. If the application is deemed mission critical, define the Recovery Time Objective (RTO) (how long can the application be offline before there’s a negative impact on the organization)

2. Disaster recovery steps

a. Is there any redundancy/resiliency built into the application? If so, what is it? If not, why?

b. What physical/logical resources are required for recovery?

c. What is the backup strategy (when are backups executed? Full/incremental? When should media be shipped to DR storage facility)?

3. Process for validating proper functionality of application and data integrity after recovery

4. Process for dealing with lost data (data lost between last backup and the time the event occurs)

5. Process for dealing with backlogged data (data that is received while application is being restored)

6. Technical resources responsible for executing the recovery

CMS XLC Appendix 8-D: Disaster Recovery Procedures

Operations & Maintenance (O&M) Manual Version X.X 16 <System Name / Acronym>

PROCEDURES FOR CONTINUED OPERATIONS IN THE EVENT OF AN EMERGENCY

1. Interim processing ( how will processing be conducted while application is being recovered)

CMS XLC Appendix 8-E: Application Validation Procedures

Operations & Maintenance (O&M) Manual Version X.X 17 <System Name / Acronym>

Appendix 8-E: Application Validation Procedures

Instructions: This section is a placeholder reserved for documenting procedures for the validation of an application.

CMS XLC Appendix 8-F: Server Start-up and Shutdown Procedures: Scripts

Operations & Maintenance (O&M) Manual Version X.X 18 <System Name / Acronym>

Appendix 8-F: Server Start-up and Shutdown Procedures:

Scripts

Instructions: This section is a placeholder reserved for documenting procedures for start-ups and shutdowns of servers.

CMS XLC Appendix 8-G: Server Build Documentation

Operations & Maintenance (O&M) Manual Version X.X 19 <System Name / Acronym>

Appendix 8-G: Server Build Documentation

Instructions: This section is a placeholder reserved for documenting procedures for server builds.

CMS XLC Appendix 8-H: Contact List

Operations & Maintenance (O&M) Manual Version X.X 20 <System Name / Acronym>

Appendix 8-H: Contact List

Table 16: Contact List

Contact Sequence

Contact Name

Organization Application Phone Cell/Pager Email

1st Level

CMS IT

Service Desk

CMS

CMS Help Desk

(410) 786-

443-248-

CMS_IT_SERVICE_DESK@CMS.HHS.GOV

2nd Level

3rd Level

CMS GTLs

CMS

Business Owners

Developers

CMS XLC Appendix 8-I: Acronyms

Operations & Maintenance (O&M) Manual Version X.X 21 <System Name / Acronym>

Appendix 8-I: Acronyms

Instructions: Provide a list of acronyms and associated literal translations used within the document. List the acronyms in alphabetical order using a tabular format as depicted below.

Table 17: Acronyms

Acronym Literal Translation

CMS XLC Appendix 8-J: Glossary

Operations & Maintenance (O&M) Manual Version X.X 22 <System Name / Acronym>

Appendix 8-J: Glossary

Instructions: Provide clear and concise definitions for terms used in this document that may be unfamiliar to readers of the document. Terms are to be listed in alphabetical order.

Table 18: Glossary

Term Definition

CMS XLC Approvals

Operations & Maintenance (O&M) Manual Version X.X 23 <System Name / Acronym>

Approvals

The undersigned acknowledge that they have reviewed the Operations & Maintenance Manual (OMM) and agree with the information presented within this document. Changes to this OMM will be coordinated with, and approved by, the undersigned, or their designated representatives.

Instructions: List the individuals whose signatures are desired. Examples of such individuals are the Infrastructure Contractor, Project Manager (if identified), and any appropriate stakeholders.

Add additional lines for signatures as necessary.

Table 19: Approvals

Signature:

Date:

Print Name:

Title:

Role: