NRC ITISS SOW Appendix G - Consolidated IT Roadmap - Draft.pdf

U.S. Nuclear Regulatory Commission

2009 The NRC IT Roadmap

Version: 1.0

2009 The NRC IT Roadmap Version 1.0

Revision History

Date Author Version Description December 17, 2009 OIS 1.0 2009 NRC IT Roadmap (5 IT Themes)

Table of Contents

1. Executive Summary

2. Introduction

2.1 Purpose and Goal

2.2 Background

2.3 Organization of the Document

2.4 How to Use the IT Roadmap

3. IT Themes

3.1 Theme—“Working from Anywhere”

3.1.1 Business Needs

3.1.2 Strategies and Solution Sets

3.1.3 Business Value Propositions

3.2 Theme—“Working with Anyone”

3.2.1 Business Needs

3.2.2 Strategies and Solution Sets

3.2.3 Business Value Propositions

3.3 Theme—“Universal Access”

3.3.1 Business Needs

3.3.2 Strategies and Solution Sets

3.3.3 Business Value Propositions

3.4 Theme—“Easy Information Retrieval”

3.4.1 Business Needs

3.4.2 Strategies and Solution Sets

3.4.3 Business Value Propositions

3.5 Theme – “Business Enablers”

3.5.1 Business Needs

3.5.2 Strategies and Solution Sets

3.5.3 Business Value Propositions

4. Information Sources Appendix: Acronyms

Figures

Figure 1: IT Investment Pyramid Figure 2: Working with Anyone Relationships Figure 3: Segment Mapping to Business Enabling Applications

Tables

Table 1: IT Roadmap Themes and Associated Strategies and Solution Sets Table 2: IT Investment Pyramid / IT Roadmap Sub-Section Alignment Table 3: IT Roadmap Themes and Considerations Table 4: NRC Mobile User Types Table 5: Working from Anywhere Strategies and Solution Sets Table 6: Working from Anywhere Capability Timeline Table 7: Working with Anyone Relationship Types Table 8: Working with Anyone Strategies and Solution Sets Table 9: Working with Anyone Capability Timeline Table 10: Universal Access Strategies and Solution Sets Table 11: Universal Access Capability Timeline Table 12: Easy Information Retrieval Strategies and Solution Sets Table 13: Easy Information Retrieval Capability Timeline Table 14: Business Enablers Strategies and Solution Sets Table 15: Enterprise Architecture Segments Aligned to Business Enablers Table 16: Business Enablers Capability Timeline Table 17: IT Roadmap Information Sources Table 18: IT Roadmap Acronyms

1. Executive Summary The IT Roadmap provides a vision and summary-level plan for establishing the information technology (IT) tools and systems to meet the needs of the NRC staff and external stakeholders over the next three plus years. In alignment with agency strategic plans, the IT Roadmap provides information to agency offices and IT staff regarding current and planned capabilities related to the business needs most important to the agency, and how these needs are or will be met through current and planned enhancements to productivity tools, applications, and the underlying NRC IT infrastructure.

This revision of the IT Roadmap was developed with an emphasis on the five major IT Themes from the 2008 IPT Report and 2009 IT Summit, and incorporates the contributions of cross-agency working groups with representatives from the various NRC Offices and Regions. As summarized in Table 1 below, for each theme the IT Roadmap outlines the business challenges, business needs, strategies and solution sets to meet those needs, and the value the NRC might achieve through addressing the business challenges and needs.

IT Roadmap Themes Strategies and Solution Sets Working from

Anywhere NRC employees will increasingly perform work remotely such as at home, inspection sites, or different NRC buildings, and while on travel.

Laptop Program

Remote Access

BlackBerrys

Behind the

Scenes Improvements

Working with Anyone With a dispersed and mobile workforce, newer strategies are needed to bring employees together to collaborate and share ideas.

Virtual Meeting

Tools

Collaboration

Communication

Status and Availability

(Presence and Chat)

Improvements

Universal Access Users can securely gain access to the IT systems and information they need through a single or minimal points of entry.

Reduced

Sign-On (RSO) Efforts

Self-Service Password

Logical

Credentials

(HSPD-12)

Improvements

Easy Information Retrieval

Once connected to the NRC network, employees should easily find the information they need to do their jobs effectively.

Better

Taxonomy & Organization

Enterprise

Content Management

Improved Search

Improvements

Business Enablers Redesigned processes and IT tools help the agency more effectively accomplish its mission.

Business- Specific

Applications

Workflow

Capabilities

Services

Improvements

Table 1: IT Roadmap Themes and Associated Strategies and Solution Sets

2. Introduction

2.1 Purpose and Goal

The IT Roadmap provides a vision and summary-level plan for establishing the information technology (IT) tools and systems to meet the needs of the NRC staff and external stakeholders over the next three plus years. This document supports the overall strategic direction described in the NRC Strategic Plan and IT / Information Management (IT / IM) Strategic Plan, and is designed to help guide IT planning activities across the agency. The IT Roadmap provides information to agency offices and IT staff regarding current and planned capabilities related to the business needs important to the agency, and how these needs are or will be met through current and planned enhancements to productivity tools, applications, and the underlying NRC IT infrastructure. The goal of the IT Roadmap is to enable greater levels of business efficiency and use of common IT solutions, support collaboration and information transparency, and promote more effective use of agency IT assets, resources, and investments.

2.2 Background

In the spring of 2008, the Executive Director of Operations (EDO) led a group of senior managers in a team assessment of whether the NRC’s support infrastructure was sufficiently flexible and adaptable to meet future program requirements. Many IT improvements were recommended to the EDO in the resulting Infrastructure Planning Team (IPT) Report (ML081090327). These recommendations were organized into five business-oriented IT themes, which reflect the capabilities and technology areas most important to the agency:

• Working from Anywhere

• Working with Anyone

• Universal Access

• Easy Information Retrieval

• Business Enablers

Following this effort, the Office of Information Systems (OIS) built on the IPT’s work by refining the associated business needs and identifying the most important initiatives that would directly support the NRC’s mission. In 2009, OIS hosted a day-long IT Summit to engage in discussions with offices and regions to foster a better understanding of the agency’s IT program and to increase awareness of the crucial planning activities needed to properly execute IT projects. During the summit, the five business-oriented IT themes were discussed and prioritized by the offices. Based on the prioritized IT themes, OIS developed an action plan to address feedback gathered and engaged program and regional offices to define and validate the NRC’s technology-related business needs, strategies and solution sets, as well as target timeframes for implementation. The IT Roadmap summarizes the results of these agency-wide planning activities and serves as the primary means for communicating the vision and IT direction of the NRC.

2.3 Organization of the Document

This revision of the IT Roadmap was developed with emphasis on the five major IT Themes from the IPT Report and IT Summit, and incorporates the contributions of cross-agency working groups with representatives from the various NRC Offices and Regions. The document is organized by themes to help focus and align planning efforts, improve IT communication, and more effectively address common business needs within the NRC.

As illustrated in Figure 1, the IT Investment Pyramid shows how this planning translates business challenges into business needs, strategies and solution sets to meet those needs, as well as the value the NRC might achieve through addressing the business challenges and needs. The IT Investment Pyramid represents the organization of information documented in the IT Roadmap, which can then further support additional planning efforts that drive project investments, scheduling, contracts, and other details, as maintained separately by the relevant project teams. Section 3 within this document details each IT Theme and is aligned to the layers within the IT Investment Pyramid as follows:

Figure 1: IT Investment Pyramid

IT Investment Pyramid Layers (IT Roadmap Focus Areas)

IT Roadmap Sub-Sections (for each IT Theme)

Business Needs 3.x.1

Strategies and Solution Sets 3.x.2

Business Value Propositions 3.x.3

Table 2: IT Investment Pyramid / IT Roadmap Sub-Section Alignment

2.4 How to Use the IT Roadmap

The IT Roadmap, in conjunction with Enterprise Architecture (EA) guidance, standards, and frameworks for IT investments, should be used by office and regional stakeholders for IT investment planning to help align technology investments and decisions to the strategic agency IT themes. As a communication and planning tool, the IT Roadmap provides information about common technology solutions, describes a standard set of considerations for IT investment owners to follow, and outlines dependencies and planned implementation sequencing between technology initiatives.

Business Needs

Strategies and Solution Sets

Business Value Propositions

Budgetary Information

Project Schedules/Contracts/Details

IT Roadmap Focus Areas

(IT Roadmap Themes)

Lower Level Details

Offices that conform with the NRC’s EA guidance and the strategies and plans outlined in the IT Roadmap can take advantage of agency-wide IT efforts and shorten business case preparation and approval for IT investments, as well as reduce solution delivery timeframes. Using proven and established IT capabilities and standards will help offices to streamline the process for acquiring and building IT systems and applications to meet their business needs and support efforts for consolidation and modernization of IT systems. It will also enable using newer and more flexible technology capabilities, such as applications that can be accessed from mobile devices.

The following table reflects how the IT Roadmap can help office staff when considering new IT investments. These questions are examples of considerations based on the strategic needs identified in each of the IT Themes.

IT Theme Considerations

Working from Anywhere

• Will my application need to be accessible from a mobile device (e.g., Blackberry)?

• Will my application need to be accessible remotely using a secure network connection? Is there standard guidance to help me incorporate this capability?

Working with Anyone

• Should my initiative take advantage of collaboration tools?

• Do I need to integrate collaboration capabilities into my application?

• Do I need to share information or conduct working sessions with a distributed work group or external participants?

• Should my initiative or communication effort be facilitated using virtual meetings?

Universal Access

• How should I manage user access to my new application to increase security and reduce duplicate passwords?

• What shared security capabilities or services should I plan to use?

Easy Information

Retrieval

• Will my new system need to interface with an existing information or content repository?

• How will users easily find and access the information in my application?

• What tools will I be able to take advantage of to more easily find information I need?

Business Enablers

• Since I am automating a business process, what tools and services can help?

• What technology transition or process improvement efforts are currently planned or underway that I could take advantage of for my business needs?

• Are common infrastructure services available or planned that I should consider using?

• If my application is critical, how can I ensure that it will be available and accessible when it is needed?

Table 3: IT Roadmap Themes and Considerations

3. IT Themes This section of the document details each of the five IT Themes which support the NRC’s business needs over a multi-year timeframe. They have been organized and documented to include the business needs, strategies and solution sets, implementation timeframes, and business value propositions for each IT Theme.

3.1 Theme—“Working from Anywhere”

The NRC workforce has become more dispersed and mobile. As a result, employees require flexible ways to connect to the information and systems needed to complete their work, regardless of where they are working. To meet these changing needs, the agency is expanding current mobile access capabilities and using new technology solutions to satisfy business needs. The goal of the NRC’s IT theme of “Working from Anywhere” is to give individuals secure access and use of the systems and information resources they need to do their work, at the same level of productivity, regardless of their physical location. The concept of a “virtual workplace” capability for a single user is central to this vision.

3.1.1 Business Needs

Although the NRC currently has some capabilities to support remote access, there are additional capabilities required to achieve the business goal desired for working from anywhere.

These capabilities include the following:

• Distributed Working Locations—NRC staff needs to work remotely, when they are located in different buildings and geographic locations.

• Mobility—Using mobile devices and secure network access is essential for a highly mobile staff, such as resident inspectors who travel routinely.

• Disaster Management and Continuity of Operations—Being able to work from anywhere is necessary to support Disaster Recovery (DR), Continuity of Operations (COOP), and pandemic scenarios when offices may be closed or access may be limited

• Employee Retention / Work-Life Balance—Support for telecommuting and work-life balance initiatives is needed to help attract and retain a highly qualified workforce.

• Accelerated Implementation of Information Technologies—Accelerate the adoption of newer technologies (e.g., virtual private network (VPN) / laptops) that allow for greater levels of connectivity and access to applications and files, both inside and outside the NRC network.

• Managing Software Licensing and Version Control—Establish and control investments in desktop software to create a standard workstation configuration (software and product versions) that supports remote access to the NRC’s applications and resources, and also makes it possible to automate remote installation of software updates for laptops and workstations.

• Improving Communication—Increase user awareness of existing work from anywhere tools and technology transition plans.

• Establishing and Communicating IT Policy—Establish, review and communicate the NRC policy early to increase user awareness and ensure an appropriate balance of business needs to managing security risks (e.g., use of secure wireless technology to connect to home networks).

• Enhancing the NRC’s IT Infrastructure—Provide secure and enhanced IT infrastructure to increase flexibility and improve system and information reliability and security, as well as communication capabilities at the NRC.

The following table describes the types of mobile users at the NRC. Users may fall into one or more of these types depending on their role and work needs. For instance, a user could be both an Intra-NRC Traveler and a Domestic Traveler. Using these types, we can group and evaluate the mobile capabilities needed by the NRC workforce more effectively.

User Type Description

Intra-NRC Traveler User who accesses the NRC network while attending meetings or training at other NRC buildings or facilities.

Domestic Traveler

User who regularly works and accesses the NRC network from public and semipublic locations within the United States, such as airports, hotels, external training sites, conferences, contractor sites, and licensee sites.

Routine / Permanent Telecommuter

User who routinely works from home and is comfortable using remote access technologies such as Citrix.

Ad Hoc Telecommuter

User who works from home occasionally, such as during weather emergencies, pandemic events, of for special project requirements.

International Traveler

User who travels and works at locations outside of the United States.

This includes individuals who frequently travel to work with the International Atomic Energy Agency (IAEA) or Nuclear Energy Agency

(NEA).

Responders / IT Admin

User who accesses or manages the NRC systems and resources during a disaster or emergency event. This includes incident responders, facilities coordinators, key personnel involved in a COOP scenario, and IT system administrators.

Table 4: NRC Mobile User Types

3.1.2 Strategies and Solution Sets

The following strategies and solution sets have been identified to address the business needs associated with working from anywhere. These have been characterized at a high-level to describe the phased delivery of new capabilities within this IT Theme. Over time, these will evolve as the needs of the NRC workforce change.

Working from Anywhere Strategies and Solution Sets Description

Laptop Program

The laptop program focuses on large-scale improvements to deliver secure, standard laptops to meet the needs of the NRC’s remote workers. This program will include:

• Increasing security controls (such as encryption, firewalls, intrusion detection and remote patching) for the standard laptop

Working from Anywhere Strategies and Solution Sets Description configurations.

• Gradual replacement of existing workstations with laptops for designated staff so that mobile workers will have all of their data and applications no matter where they go.

Remote Access

Currently, access to the NRC environment from a non-NRC computer is via a remote “virtual desktop” technology (e.g., Citrix).

While this results in a secure connection to the NRC, only a select set of common applications are available on Citrix and access is limited to files on shared drives. Some of the additional capabilities planned to enhance remote access include:

• Making additional commonly used productivity tools, such as

Adobe, Microsoft Visio, and Microsoft Project available through Citrix.

• Evaluating centralized software licensing to support commonly used tools.

BlackBerrys

The NRC has issued mobile devices such as Blackberrys for users to access their e-mail and schedule remotely, and thumb drives to work with their files. The strategy for improving these services includes:

• Reviewing Blackberry policies to allow use of currently disabled features (e.g., Global Positioning System (GPS)).

• Exploring the use of simplified web sites to help users find information "on the go" (e.g., internal “mobi” page for Blackberry users).

• Procuring additional NRC-provided removable thumb drives to transfer files securely between workstations including home computers.

Improvements

Some behind the scenes IT infrastructure improvements include:

• Expanding storage space for network shared drives to allow

1 gigabyte (GB) per user.

• Upgrading and standardizing Microsoft Office versions to better integrate with Outlook 2007.

• Implementing new secure network connection capability to allow users with NRC issued laptops to access the NRC network from public locations such as hotels, home networks, etc. and have the same access to applications, tools and information as they do while in the office.

• Supporting additional wireless capabilities such as using home wireless networks.

Table 5: Working from Anywhere Strategies and Solution Sets

The table below describes the capabilities that are planned to fulfil the requirements and business needs of working from anywhere. These capabilities are described as they exist today, and are also described as they will be implemented and matured in the future. The planning horizon of FY11 and beyond is predicated on availability of funding and adequate resources. Changes in the later timeframes may also be influenced by emergent business requirements.

Capability Available Now FY 2010 FY 2011 and Beyond

[Laptop Program]

■ Loaner laptops are available with limited features, applications, and support.

■ Security patch levels and configurations exist for agency laptops, but are inconsistent.

■ Provide initial set of “dockable” laptops with standard NRC workstation images and additional security features.

■ Provide a limited number of laptops with access to the NRC Intranet and external Web via Virtual Private Networks (VPN) when working remotely.

■ Provide some laptops as optional desktop replacements.

■ Continue to provide laptops with VPN access as optional desktop replacements for mobile workers.

Connect to the NRC network from a remote location and use the NRC’s applications when working remotely

[Remote Access]

■ Remote access exists, but only to certain applications such as MS Office, ADAMS (Agency-wide Documents Access and Management System), RIMS (Regional Input-Output Modelling System), and HRMS (Human Resources Management System) through Citrix.

■ Outlook Web Access (OWA) is available to access NRC emails from anywhere via a web browser. Agency policy has prohibited saving or forwarding attachments.

■ Evaluate additional tools / applications to be added to Citrix.

■ Enable forwarding and downloading email attachments using Outlook Webmail during disaster events (e.g., Pandemic).

■ Begin study to enable e-mail archive access remotely.

■ Use wireless internet to connect to Webmail or Citrix on a non-NRC computer from home.

■ Plan for Information Security requirements associated with MD 12.5.

■ Review of existing e-mail archive solution to a centralized online email archiving solution to make archives available everywhere.

[Behind the Scenes]

■ Wide-area network (WAN) encryption implementation completed.

■ Access to network ports or Internet from the NRC conference rooms is available but requires special permission and pre-configuration.

■ Define strategy and architecture standards for making IT investments (applications) easily accessible from mobile devices.

■ Develop and implement enterprise “data at rest” encryption solution.

■ Plan the NRC Data Loss Prevention program strategy.

■ Replace PatchLink with Microsoft System Center Configuration Manager.

■ Complete Novell decommissioning.

■ Implement Network Access Control to increase security controls and support internet access from conference rooms.

■ Implement VPN capabilities to support laptop program.

■ Begin to offer Internet access in conference rooms.

■ Upgrade SecureZip.

Know when changes are coming to laptop and desktop computers and the NRC systems

■ Communication to user communities about upcoming changes in the areas of the NRC's IT is available, but currently insufficient.

■ Provide IT Customer Service Catalog from NRC@Work and publish the IT Roadmap to describe current services and planned changes.

■ Publish IT / IM resources notifications in advance.

■ Develop an OIS Communications plan and initiate and evaluate communication approaches.

■ Provide updates to IT Customer Service Catalog and IT Roadmap to describe current services and planned changes.

Send and receive forms for approval electronically

■ Some use of forms exists, but users are unable to approve most forms electronically, such as timesheets.

■ Evaluate systems and workflow processes for forms, including Informs, portable document format (PDF), and InfoPath.

■ Modernize HRMS to include electronic approval of time related forms.

■ Conduct business process analysis to identify opportunities to reduce manual approval processes and use electronic approvals instead.

Use the NRC's printer, scanner, fax, etc., when working remotely

■ Users can only access locally connected peripherals.

■ Evaluate alternatives for providing access to local peripherals such as while accessing the NRC remotely (e-fax capability).

■ Research integrated network communication services for facsimile, phone, and e-mail.

Working from Anywhere Capability Available Now FY 2010 FY 2011 and Beyond

Have more up to-date operating system and office software

■ A mixed environment of Microsoft Office 2003 and Outlook 2007 that cannot fully use all new tool features.

■ Many legacy applications exist, and can only work with Windows XP or unsupported operating systems.

■ Upgrade to IE 8 (required for implementing HRMS and other modernization upgrades).

■ Implement Microsoft Office 2007.

■ Implement standard configuration for the NRC workstations.

■ Work with Offices that need to modernize legacy systems on outdated or unsupported technology.

■ Evaluate / investigate laptop images for enhanced security.

■ Evaluate MS Office 2010 for NRC-wide usage.

■ Improve setup and maintenance processes for software deployment to desktops, laptops, and mobile devices.

■ Implement standard laptop configuration based on enhanced security for next generation of the NRC laptop hardware platforms.

Have adequate storage space

[Remote Access]

■ The agency standard network storage space allocation is 300 MB for each user. That space is allocated as a sum across all drives that the user has access to on the network.

■ Each NRC e-mail user has 1 GB of Outlook 2007 mailbox storage.

■ Evaluate alternatives for increasing storage space for email archiving and network shared drives (up to 1GB).

Working from Anywhere Capability Available Now FY 2010 FY 2011 and Beyond

Have more effective mobile devices

[BlackBerrys]

■ Blackberrys are available, but with limited functionality (e.g., email, calendar).

■ Support for 1,000 users.

■ User access via dial-in and broadband service (e.g., Digital Subscriber Line (DSL), cable modem) and wireless cellular data network (e.g., T-Mobile, Verizon).

■ User must request BlackBerry operating system upgrade vs.

having regular upgrade schedules.

■ Purchase order is in place to acquire 2,500 MXI thumb drives.

■ Deployment of total 1,000 BlackBerry devices.

■ Evaluate upgrading the BlackBerry devices to the latest operating system (RIM 5.0).

■ Begin to research BlackBerry tethering and evaluate wireless access policy (802.11) to allow other features.

■ Start the transition of other cellular telephones to BlackBerry devices.

■ Implement additional Blackberry functions such as mobile-friendly web pages and bookmarks for easy information access.

■ Evaluate mobile browser alternatives to improve browsing experience from hand held devices.

■ Define and assess new mobile device capabilities (e.g., Docs to Go).

■ Purchase order for additional MXI drives.

■ Research and develop mobile architecture for new mobile device capabilities.

■ Analyze additional applications and services to make accessible through hand held devices (e.g., SharePoint applications and documents).

■ Evaluate Windows mobile devices for use at the NRC.

■ Expand of voice and data communication capabilities, as well as Internet access using hand-held devices while traveling outside the United States.

■ Implement BlackBerry operating system upgrade

(RIM 5.0).

Access specialized software and get support when needed

■ Some specialized software, but no ability to translate other languages to English, and no rights to install or access specialized software (e.g., antivirus programs).

■ Enhance IT Customer Service Catalog to provide information about protection, and when special software may be needed for the home computer, laptop, or other NRC PC not connected to the NRC Local Area Network

(LAN).

■ Begin considering support for international users.

Table 6: Working from Anywhere Capability Timeline

3.1.3 Business Value Propositions

Investing in secure solutions that support a workforce that can work from anywhere and providing timely access to information and data sources will result in improved business efficiencies at the NRC. Business improvements that will be realized through working from anywhere include:

• Increased staff efficiency and productivity by enabling them to work from any location at any time and connect to the NRC resources they need to perform their jobs.

• Increased staff responsiveness and ability to contribute to work items such as emails, data calls, and other work products when away from their normal office.

• Better management of crisis and disaster scenarios by enabling mobile access during DR, COOP, and emergency response exercises.

• Increased staff satisfaction and performance through support for flexible work / life balance alternatives.

• Improved technology implementation timeframes, quality of services, and security by using standard solution sets.

• Better management and control of support and maintenance costs.

• Solutions that support a “Green” work environment.

3.2 Theme—“Working with Anyone”

The 2009 IT summit and cross-agency quick strike working groups revealed that the NRC staff faces significant challenges in effectively connecting and collaborating with other staff and external stakeholders across ever-increasing geographically dispersed offices and work sites.

This includes collaboration with staff located within the NRC’s offices, as well as with individuals in other Federal agencies, academia, industry, and the general public. The subject of these collaborative efforts ranges from publicly available information to sensitive material that must be controlled. The goal is to identify and implement appropriate collaboration and communication technology to improve the staff's productivity and effectiveness. This technology also supports business needs for increasing communication and transparency with external stakeholders such as licensees, the public and prospective employees who may use different collaboration and communication capabilities (e.g., various social networking tools).

3.2.1 Business Needs

The following diagram and table describes the types of relationships existing among different groups, both internal and external to the NRC, which are the foundation for supporting greater collaborative capabilities for these interactions. Relationships describe those we work or communicate with and the type of interactions conducted with that group.

What relationships are supported in “Working with Anyone?”

Figure 2: Working with Anyone Relationships

Foreign Entities

The Public

Industry

Academia

Other Government

Entities

Other NRC Workers

NRC Worker

Types of Relationship Description defined by “Working with Anyone”

Intra-Office Includes collaborative work groups formed within the NRC Headquarters (HQ) and regional offices. These groups can be either project based or operationally oriented.

Intra-Agency

Includes collaborative work groups formed across HQ and regional offices within the NRC. These groups are usually formed between two to three offices and can be project based, operationally oriented, or forum structured (e.g., the NRC Information System Security Officer (ISSO) forum).

The NRC- Academia

Includes collaborative groups formed between the NRC personnel and officials from educational institutions for purposes such as conducting research and recruiting future hires.

The NRC- Government

Includes project-based, operationally oriented, and forum-structured collaborative work groups formed between the NRC and other Federal, State, Local, and Tribal governments.

The NRC- Industry

Includes project-based, operationally oriented, or forum-structured collaborative work groups formed between the NRC and industries subject to regulation of nuclear materials for inspections or information exchange.

The NRC-Public Includes collaborative interactions between the NRC personnel and members of the public, through formal and informal communications and outreach (e.g., public meetings and comment).

The NRC-Foreign Entities

Includes interactions and collaborative workgroup activity with foreign entities ranging from private individuals to governments.

Table 7: Working with Anyone Relationship Types

Major business needs identified for working with anyone include the following:

• New Capabilities o Allowing the use of new collaboration capabilities (e.g., social networking) to increase outreach and communication alternatives to reach broader audiences.

o Better management and support for centralizing and enhancing commonly used information for effective communication and collaboration (e.g., integrated staff directory, staff locator information).

o Increasing availability and ease of use for video conferencing and virtual meetings (capability, process, and facility).

• Supporting Technology Adoption o Adequate support of technology transition and effective use by staff.

o Better integration of technology solutions to improve usability of toolsets, increase access to required information, and more effective management of information.

o Fostering cultural acceptance of these tools and practices through consistent messages from management on their most effective use.

• Policies, Standards, and Standard Operating Procedures (SOPs) o Considering and encouraging different styles of communication and appropriate use of available technology capabilities.

o Integrating tools to automate policies and standards, making compliance easier.

o Proper handling of intellectual property / sensitive information / Personally

Identifiable Information (PII).

• Scheduling o Improving awareness of staff work schedule and availability for meetings.

o Making it easier to schedule meetings across time zones and geographic locations.

o Coordinating schedules for meetings and activities with external work groups (e.g., academic institutions).

• Communication and Interaction o Offering user feedback, survey, and communication conduits to assess the effectiveness of the NRC’s programs and activities (e.g., outreach to academic institutions, funding of grants) and the benefits these have for the NRC.

o Developing and maintaining long-term relationships with external academic institutions and students to market the NRC to the next generation of prospective employees.

• Leverage Lower Cost Technology and Maximize Use of Resources o Taking greater advantage of sharing existing resources, as well as using programs within the Federal government (e.g., GSA SmartBuy, eGov Initiatives) when acquiring new software tools that can help deliver solution sets to meet business needs, while providing the benefit of cost savings to the agency.

o Integrating technology solutions to improve information sharing and user capabilities by making various tools work together more seamlessly.

3.2.2 Strategies and Solution Sets

associated with working with anyone. These have been characterized at a high-level to describe the phased delivery of new capabilities within this IT Theme. Over time, these needs and capabilities will evolve as the demands of the NRC workforce changes.

Working with Anyone

Virtual Meeting

Two pilots are currently underway using externally hosted services to provide virtual meeting capabilities. Additionally, the NRC is implementing capabilities to do the following:

• Host on demand internal web meetings and presentations from staff workstations with both HQ and Regional staff.

• Enhance media streaming capabilities.

• Record virtual or web streaming meetings and events.

Working with Anyone

Collaboration

Existing collaboration capabilities will continue to be enhanced over time and new capabilities will be added to do the following:

• Integrate SharePoint and Tomoye to make it easier to find, share, and collaborate on information and work products across communities of practice.

• Access new collaboration and communication tools such as YouTube and Web 2.0 technologies.

• Integrate additional resources (e.g., conference rooms, conference lines, etc.) into Outlook Calendar for ease of scheduling.

Communication

Status and Availability

(Presence and Chat)

Capabilities to contact, communicate, and be aware of the availability of other NRC staff (i.e. “presence and chat”) will be substantially improved with the introduction of a new Microsoft solution that provides:

• A presence capability to let users know when others are on the NRC network and available.

• Instant messaging (chat) capabilities.

Improvements

Many foundational requirement initiatives are underway to improve collaboration and working together more effectively including:

• Modernizing the voicemail infrastructure.

• Upgrading productivity tools such as Microsoft Office to newer versions.

• Upgrading and refreshing the facilities for conducting Virtual

Teleconference (VTC).

• Integrating VTC scheduling into the MS Outlook calendar as a resource for easier scheduling.

• Evaluating Voice over Internet Protocol (VoIP) technologies for new features such as review of voicemail using your email box.

Table 8: Working with Anyone Strategies and Solution Sets

There are additional considerations for implementing these capabilities at the NRC to help ensure these tools can be used effectively to help realize the established goals for working with anyone. These considerations include the following:

• Establishing governance for the new solutions and toolsets, with particular emphasis on standards and usability.

• Training staff and external parties to use new solutions and toolsets effectively for collaboration and communication.

• Ensuring that the infrastructure and implementation of these capabilities includes the security controls required to ensure appropriate information access.

• Ensuring network capacity and performance is adequate to support existing and future collaboration and communication requirements.

The table below describes the capabilities that are planned for delivery to fulfil the requirements and business needs of working with anyone. These capabilities are described in terms of what is currently available and what will be further implemented and matured over a 3+ year timeframe. The planning horizon of FY11 and beyond is predicated on availability of funding and adequate resources to conduct the associated work. Changes in the later timeframes may also be influenced by emergent business requirements.

[Virtual Meeting Tools]

■ Two pilot virtual meeting services are underway to evaluate Citrix GotoMeeting and Microsoft LiveMeeting.

■ Web streaming services for public meetings that meet specified requirements (up to 100 meetings per year supported).

■ VTC capability available for internal meetings between the NRC’s locations.

■ Voice conferencing capabilities using standard conference call capabilities.

■ Select long-term hosted web conferencing solution for conducting large virtual meetings (over 250 participants) and meetings with non-NRC participants (e.g., public). This will replace pilot services.

■ Implement Microsoft OCS for internal virtual meetings or events to support up to 250 NRC staff participants.

■ Assess extension of virtual meeting capabilities to mobile devices.

■ Consider expansion of VTC and Web streaming capabilities to support a wider participant mix and increased availability of service.

■ Ability to host and attend remote meetings, as well as secure and unsecured VTC using devices and VTC facilities.

Hold virtual meetings, video conferences, and teleconferences more easily and effectively

■ VTC architecture refreshed to switched circuit Integrated Services Digital Network technology.

Also added to Outlook resources for ease of scheduling.

■ Evaluate unified communication plan and prepare for future desktop VTC feasibility.

[Collaboration Tools]

■ Microsoft SharePoint, Tomoye, e-mail for communication and collaboration with limited integration between the tools.

■ Calendars and flexible work schedules are used, but with variations, making it difficult to determine availability of resources.

■ No access to most common social networking sites.

■ Evaluate integration alternatives to improve usability between different toolsets used for supporting virtual team workspaces, and simplify compliance with policies and standards.

■ Evaluate and make available new collaborative social networking tools like YouTube.

■ Existing Outlook features are used by the NRC’s staff to consistently reflect their day-to-day work schedules.

■ Evaluate additional collaboration and social networking capabilities and tools such as blogs, wiki, Twitter, and discussion boards.

Collaborate with others more easily

■ Evaluation and expansion of features provided in the Microsoft Outlook 2007, Outlook Web Access, and integration of the Exchange 2007 for both internal and external users.

■ Some SharePoint governance structure, management, and support, but it is limited.

■ Separately managed governance and support for Tomoye.

■ Improve standard management, governance, and support structure for SharePoint as an enterprise platform.

■ ADAMS new user interface adds workflow and collaboration functionality.

■ Upgrade to MS Office 2007 and Internet Explorer 8 to improve user experience and support improved capabilities.

■ Assess and evaluate upgrade path for next version of SharePoint along with deployed applications and add-ons.

■ Assess and evaluate next version of Outlook and Office 2010.

■ Standardize and expand use of calendar features and scheduling processes between the NRC’s employees.

Find people, determine availability, chat, talk, and coordinate

[Communication Status and Availability -- Presence and Chat]

■ Multiple and static phonebooks spread across many databases, with each containing a portion or different version of the contact information.

■ Provide Instant messaging capability for the NRC’s staff.

■ Provide ability to determine staff availability based on their presence on the NRC network.

■ Centralize contact information for the NRC’s staff, regardless of location.

■ Ability to access contact / distribution list and directory via mobile devices.

■ Consider expanding capabilities based on business needs.

■ Planning Microsoft Office Communications Server (OCS) implementation as the internal solution for determining availability based on network presence and instant messaging.

■ Implement OCS for the NRC’s staff providing instant message capability and to determine staff availability.

■ Integrate instant messaging with applications to allow internal users to chat.

■ Modernize headquarters voice mail system.

■ Remote central phone number to forward calls to the current location of the recipient / user.

■ Evaluate Voice over Internet Protocol (VoIP) technologies for better unified (integrated) communication in the future.

Receive feedback for continuous improvement

■ Use of periodic NRC survey for user feedback.

■ Separate methods used for collecting feedback from external and internal stakeholders.

■ Evaluate survey results to establish baselines for performance and continuous improvement.

■ Assess alternatives to enable and use “e-suggestion” boxes for selected efforts to enable idea collection and review.

■ Evaluate more automated and streamlined solutions for collecting and using feedback for improvement.

Securely share information

■ All internal emails are encrypted in transit at all times. Once they leave the NRC environment, they are not encrypted unless the sender manually encrypts the message before it is sent.

■ Use of encrypted and approved devices (e.g., MXI thumb drives) allow sharing information that complies with security policies.

■ Use of secure portals or applications for uploading information to be shared.

■ Evaluate Gartner’s data leak assessment report to address data encryption capabilities.

■ Upgrade to SecureZip for use with certain applications.

■ Increase availability of mechanisms for securely sharing sensitive information and intellectual property across teams and groups.

Table 9: Working with Anyone Capability Timeline

3.2.3 Business Value Propositions

Investments in secure collaboration and communication technologies will support the work requirements for a geographically dispersed workforce. The NRC’s staff must be able to work effectively together regardless of the location of their office or worksite. In addition, the NRC’s staff must be able to work and communicate effectively with various external stakeholder groups. Investments in technology to support this capability will improve business efficiencies, foster effective communications, enhance transparency, and result in cost efficiencies.

Specifically, the business value that will be realized through this IT theme includes:

• Increased staff efficiency and productivity through the ability to work more collaboratively with others in different geographic locations and physical work sites.

• More effective collaboration and communication between staff using flexible work alternatives and work schedules.

• Staff can work effectively together, regardless of work schedules, by providing tools that increase awareness of staff availability and work hours.

• Reduced travel costs and increased productivity and transparency using VTC, Web streaming, and virtual web conferencing capabilities for meetings with different stakeholder groups.

• Effective communication and work collaboration during disaster scenarios such as DR, COOP, and pandemic scenarios by enabling staff to work together more easily.

• Increased productivity, effectiveness and responsiveness of the NRC workforce by enabling them to work together.

• Facilitated information sharing, communication and collaboration with external stakeholders (e.g., public meetings, academic institutions, other government agencies, licensees, etc.).

3.3 Theme—“Universal Access”

Currently, the NRC’s users must remember multiple login IDs and passwords, which sometime follow separate rules for different systems and applications. Each system or application follows its own method of controlling user access and verifying permissions. A user whose daily activities involve access to multiple application systems often needs to spend extra time managing login ID and password information (called credentials), by changing passwords based on unique schedules and rules, or calling the help desk to reset forgotten passwords. The common solution of writing down the login information poses security risks to the NRC and is not allowed. It is critical that the NRC use a common set of services and infrastructure for managing user access to applications and information resources. The goal is to provide ease of use to the staff while properly protecting applications and data.

Key business drivers for enabling universal access include the following:

• User demand for simplified access, such as reducing the number of separate login actions to the systems that support their daily activities.

• Reducing the number of passwords that users must remember and separately manage by reusing the standard network ID and password.

• Making it easier for system owners and the IT security team to comply with Federal, OMB, and the NRC’s policies, regulations, and mandates requiring secure access controls. These include Homeland Security Presidential Directive (HSPD)-12, the newly published Federal Identity, Credential, and Access Management (ICAM) roadmap, and other Certification & Accreditation (C&A) requirements.

• Centralizing access management controls and management of user access.

3.3.1 Business Needs

System users, system owners, and those responsible for IT security often have unique concerns and, sometimes, conflicting business needs. Users currently need help in remembering and managing multiple login names and passwords, as well as following the different rules each system requires for password creation and renewal. Users need fewer logins, more consistent password rules, and the ability to reset their passwords easily themselves. System owners want simpler ways to manage their user accounts, allowing them to easily add and remove users, or to set and change user permissions. System owners also need to ensure adequate access controls to protect their data are not overly burdensome. Staff at the Office of Information Systems (OIS) and the Computer Security Office (CSO) is responsible for overseeing that systems comply with regulations for IT security and access to IT systems and information. This includes coordinating and implementing a strategic NRC solution in response to government-wide initiatives, such as the use of Personal Identity Verification (PIV) cards.

The following business and technical needs have been identified for universal access to support greater efficiency and security management of access to the NRC’s resources:

• User Access— o Providing self-service capabilities for routine security functions (e.g., reset password and removing user lockouts), making it easier for users to do this anytime, from any location.

o Leveraging the standard network identification and password for system access.

• Use of Common Solutions— o Providing a standard infrastructure set of tools and services to make it easy for system owners to access their applications by using the standard network id and password o Providing common solutions that make it easier for system owners to comply with

Federal security requirements (e.g., HSPD-12) and to ensure a strong security posture for systems.

• Management of User Access— o Providing the ability to more easily add, manage, and remove users' access to multiple systems (also called provisioning).

o Making it easier to ensure user access to systems and information is at the required level.

• Audit and Compliance—Providing easier tracking and review of user access to systems and classified information across IT systems.

3.3.2 Strategies and Solution Sets

associated with universal access. These have been characterized at a high-level to describe the phased delivery of new capabilities within this IT Theme. Over time, these will needs and capabilities will evolve as the demands of the NRC workforce and standard security requirements change.

Universal Access

Reduced Sign-

On (RSO) Efforts

The primary goal of the RSO efforts is to standardize sign-on methods for agency systems and applications to the extent possible, to reducing the user burden of remembering and maintaining multiple username-password combinations. This must be accomplished without compromising system-specific authentication requirements and while preserving appropriate unique access controls and security requirements of system owners.