SD940 Aquisition of Information Technology Products.pdf

SMITHSONIAN DIRECTIVE 940,

October 19, 2010

ACQUISITION OF INFORMATION TECHNOLOGY PRODUCTS

Introduction 1 Background 1 Acquisition of Preferred IT Products 2 Acquisition of Non-preferred IT Products 3 Responsibilities 4

Introduction

To guide modernization of information technology (IT) systems at the Smithsonian, the Office of the Chief Information Officer (OCIO) has developed and issued a Technical Reference Model (TRM) (IT-940-01) that defines preferred IT products for acquisition by the Smithsonian.

The TRM is a governance tool that documents a comprehensive set of IT standards, services, protocols, and products for use at the Smithsonian. These in turn define the target technical environment for potential acquisition, development, and support of application systems and the supporting IT infrastructure.

The TRM also is designed to educate IT users and practitioners about the inventory of shared hardware and software components, and to define a set of commercially prevalent technical standards and products for use.

Background

A preferred IT product — commercial IT hardware or software product designated as such in the TRM — is a formal, standard-based product or tool that must be used for IT projects or to support ongoing IT operations at the Smithsonian.

Smithsonian Directive 940, 10/19/10

Background (continued)

The establishment of preferred IT products is a major component of a managed IT infrastructure, which allows the Institution to: (1) respond to changing business needs more quickly; (2) improve customer service; (3) maintain current production operations in response to increasing workload demands; (4) leverage the infrastructure to serve all program areas; (5) achieve economies through product standardization, site software licenses and consolidated hardware maintenance contracts; (6) streamline information technology personnel training requirements; (7) reuse software components and designs; and (8) improve IT security and reliability.

Examples of preferred IT products include:

Commercial IT hardware products — such as servers, high-speed switches, routers, magnetic storage, and personal computers — that support application systems or the IT infrastructure

Commercial IT software products — such as database management systems, network management tools, application middleware, operating systems, and software development tools

— that support the IT infrastructure

Commercial IT software products — such as word processing, electronic mail, presentation graphics, and spreadsheet analysis — that support administrative functions

When selecting an IT product to meet a business need, preferred IT products must be used unless it can be demonstrated that use of another product is more cost effective and useful over the life of an application and complies with IT industry standards.

Acquisition of Preferred IT

Products

Using the TRM, identify the preferred IT hardware or software to be acquired. Purchase the IT product following the Smithsonian’s standard procurement procedures, including use of the Institution’s blanket purchase agreements (BPAs). Use of the BPAs

Acquisition of Preferred IT

Products (continued) announced by OCIO or the Office of Contracting and Personal Property Management can result in cost savings to the procuring unit.

Acquisition of Non-preferred IT Products

Units must obtain approval from OCIO before acquiring non-preferred IT products.

A unit seeking approval must prepare a technology waiver request and submit it to OCIO for review. The waiver must show that the non-preferred IT product:

a) Is cost effective over the life of an application and does not significantly adversely impact overall institutional costs

b) Is operationally supportable within the confines of current available/allocated IT funding and staffing requirements

c) Is consistent with existing IT architecture components or has no effect on them so that interoperability problems with enterprise services such as security are not created

d) Is free of IT security flaws and will not introduce an unacceptable risk to the IT computing infrastructure

The OCIO will obtain recommendations from appropriate sources and subject matter experts, if deemed necessary. A technology working group (TWG) may be formed to provide additional analysis, including evaluation of the non-preferred IT product and the IT product identified as the waiver candidate.

The OCIO approves or denies the request in writing. In rare cases an exemption or a temporary waiver may be granted for purposes such as testing.

If the waiver is approved, the unit may proceed with purchasing the non-preferred IT product.

An approved, non-preferred IT product will be included in the next version of the TRM as a product in

Acquisition of Non-preferred IT Products use, but not as a preferred IT product. The OCIO may designate a product in use as a preferred product when, upon review, it is found that there is a general demand for the product; i.e., the product is used across multiple units, is widely used within a unit, or belongs to a class of IT products not previously included in the TRM, e.g., emerging technologies.

Note: The OCIO’s approval to acquire a non-preferred IT product does not imply OCIO support for the product. Units that receive permission to acquire non-preferred IT products are responsible for maintaining the product; for example, addressing any cyber-security flaws that may be announced, and for obtaining product support. Units may meet these responsibilities by providing proof of adequate funding resources, as determined by OCIO, for OCIO staff to manage the non-preferred IT products.

Responsibilities

Directors of each museum, research center, and office must:

adhere to provisions of the TRM ensure there are adequate funding resources available to purchase, install, support, license, and maintain the approved and/or non-preferred IT products ensure there are adequate funding resources available to install, support, and maintain donated IT hardware, software, and licensing systems.

Unit IT managers assist their supported users in identifying appropriate TRM-approved IT products to use.

Procurement officers must verify that IT products conform to the TRM or that an OCIO waiver was obtained before ordering a non-preferred IT product.

The verification notes or OCIO waiver must be retained in the unit purchase order file for audit.

Responsibilities

The Office of the Chief Information Officer:

develops and maintains the TRM reviews and approves or disapproves requests for waivers/exceptions to procure and use non-preferred IT products

The Office of Contracting and Personal Property

Management requires each delegated procurement officer, pursuant to OCon 6, Restrictions on Purchasing List, to verify that IT products conform to the TRM or that a waiver is obtained from OCIO before ordering a non-preferred IT product.

CANCELLATION: SD 940, September 27, 2002

INQUIRIES: Office of the Chief Information Officer (OCIO)

RETENTION: Indefinite. Subject to review for currency 24 months from date of issue