(U) NGAI 8040.1_Configuration Mgmt_21NOV2018.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency

INSTRUCTION

NUMBER 8040.1

21 November 2018

CIO-T

SUBJECT: Configuration Management

References: See Enclosure 1.

1. PURPOSE. This NGA Instruction:

a. Establishes policy and assigns responsibilities for NGA Information Technology (IT) Configuration Management (CM) in accordance with (IAW) References (a) through (h).

b. Rescinds NGA Instruction 7400.1, “Configuration Management,” 09 June 2006.

2. APPLICABILITY. This Instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors, hereinafter referred to as personnel.

3. DEFINITIONS. See Glossary.

4. POLICY. It is NGA policy to:

a. Manage and control the development of emerging and existing information systems with processes specified in the NGA Configuration Management Plan (NCMP), Reference (g).

b. Identify and control configuration items (CIs) throughout a CI’s life cycle

(development through operations) until deactivation.

5. RESPONSIBILITIES. See Enclosure 2.

NGAI 8040.1

6. EFFECTIVE DATE. This Instruction is effective on the date of signature.

Enclosures

1. References

2. Responsibilities

Glossary

UNCLASSIFIED

TABLE OF CONTENTS

CHANGE LOG

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

Chief Information Officer

Co-Chairs, Configuration Control Board

Director, Architecture and Engineering Group

Director, Adopt and Deliver Group

Director, Secure Operations Group

Security Configuration Management Program Manager

Directorate Heads and Agency Element Leads

GLOSSARY

CHANGE LOG

Change Type

Change Date

Revised By

Pages Affected

Change Description

ENCLOSURE 1

REFERENCES

(a) DoD Directive 8000.01, “Management of Department of Defense Information Enterprise (DoD IE),” 17 March 2016

(b) National Institute of Standards and Technology (NIST) Special Publication (SP) 800- 128, “Guide for Security-Focused Configuration Management of Information Systems,” August 2011

(c) NIST SP 800-137, “Information System Continuous Monitoring (ISCM) for Federal Information Systems and Organizations,” September 2011

(d) NGA Directive (NGAD) 4160, “Logistics and Transportation,” 19 May 2015

(e) NGAD 8000, “Information Management and the Chief Information Officer,”

12 June 2013

(f) NGA Manual 4160.1, “Accountability and Management of Property, Plant, Equipment, and Other Accountable Property,” 16 May 2017

(g) NGA Configuration Management Plan (NCMP), Revision E, CN014, 11 January

2018 (U//FOUO) (https://ideonline/sites/seinportal/OASites/CMDoc/CM Library/Baseline Documents/e. Governance and Programmatic Documents/NCMP)

(h) NGA Enterprise Tier 2 Configuration Management (CM) Procedure, Revision A, 02 May 2018 (U//FOUO) (https://ideonline/sites/seinportal/OASites/CMDoc/CM Process Library/Process Documents) https://ideonline/sites/seinportal/OASites/CMDoc/CM%20Library/Baseline%20Documents/e.%20Governance%20and%20Programmatic%20Documents/NCMP https://ideonline/sites/seinportal/OASites/CMDoc/CM%20Library/Baseline%20Documents/e.%20Governance%20and%20Programmatic%20Documents/NCMP https://ideonline/sites/seinportal/OASites/CMDoc/CM%20Process%20Library/Process%20Documents https://ideonline/sites/seinportal/OASites/CMDoc/CM%20Process%20Library/Process%20Documents

ENCLOSURE 2

RESPONSIBILITIES

1. Chief Information Officer.

a. Manages NGA IT CM IAW Reference (e).

b. Establishes NGA IT CM guidance and procedures IAW References (d) through

(h).

c. Designates the Director, CIO and IT Services (CIO-T)/Architecture and

Engineering Group (D/TA), to oversee the NGA IT CM functions and administer changes to the functional and allocated baselines.

d. Designates D/TA and D/CIO-T/Adopt and Deliver Group (D/TI) as co-chairs of the Configuration Control Board (CCB).

e. Designates the Director, CIO and IT Services (CIO-T)/Secure Operations Group

(D/TO), to administer changes to the product/operational baseline.

f. Designates NGA Chief Information Security Officer as the Security Configuration Management (SecCM) Program Manager to establish and oversee the SecCM program.

2. Co-chairs, CCB.

a. Provide tasking and direction for request for change (RFC) development activities to ensure proposed functional changes are consistent with the National System for Geospatial Intelligence (NSG) and Allied System for Geospatial Intelligence (ASG) information technology investment plans and activities.

b. Review and evaluate all proposed changes to NGA baseline CIs, perform a cost-benefit assessment of proposed functional changes, assess operational impacts, and assess overall program and NSG/ASG investment plan impacts.

3. D/TA.

a. Co-chairs the CCB with D/TI.

b. Publishes the NCMP (Reference (g)) prescribing NGA procedures for IT CM methodology and change management.

c. Conducts CCB activities to resolve proposed changes consistent with established configuration baselines IAW References (g) and (h).

d. Oversees the CCB functions IAW Reference (g).

4. D/TI.

a. Co-chairs CCB with D/TA.

b. Reviews all proposed changes to configuration baselines.

c. Facilitates resolutions to issues with configuration baseline changes.

5. D/TO.

a. Reviews all proposed changes to configuration baselines.

b. Oversees product/operational baseline changes.

c. Assesses and manages impacts of changes to the operational baseline.

6. SecCM Program Manager.

a. Manages and administers the NGA SecCM Program.

b. Develops and implements SecCM policies and procedures IAW References (b) and (c) as an integral part of Reference (g).

c. Reviews and evaluates proposed changes to NGA product baseline with attention to security impacts and risk mitigation measures IAW Reference (e).

7. Directorate Heads and Agency Element (AE) Leads.

a. Oversee allocated and product baselines under their purview IAW Reference (g).

b. Implement and maintain Directorate or AE CM throughout the life cycle of all products and systems IAW References (d), (f), (g) and (h).

(1) Establish and chair engineering review boards to review and evaluate proposed changes to NGA baseline items with attention to operational and corporate impacts IAW Reference (d), (f) and (g).

(2) Establish and identify configuration baselines (functional, allocated, and product) IAW Reference (g).

c. Designate CM personnel to accomplish the responsibilities detailed in Reference (h).

GLOSSARY

Configuration Baseline

A set of specifications for a system, or Configuration Item within a system, that has been formally reviewed and agreed on at a given point in time, and which can only be changed through change control procedures. The baseline configuration is used as a basis for future builds, releases, and/or changes. (Reference (b))

NGA Baseline Configuration Item List comprises the following baselines for each item:

Functional Baseline: Defines overall system functional performance, interface, and verification requirements.

Allocated Baseline: Defines system design and implementation requirements.

Product Baseline: Defines the as-built system and user, operations, and support requirements after the system is transitioned to operational status following acceptance testing. (Reference (g))

Configuration Control Authority (CCA)

The individual or forum assigned or delegated the management of a configured item and approving/authorizing changes to the item. (Reference (g))

Control Board (CCB)

A configuration control forum, typically established by the CCA, to ensure cross-program coordination and impact analysis activities are accomplished to support change control decisions. The NGA CCB is an NGA cross- Directorate forum that has full responsibility for the approval of configuration baseline changes. (Reference (g))

Configuration Item

(CI)

A CI is an identifiable part of a system (e.g., hardware, software, firmware, documentation, or a combination thereof) that is a discrete target of confirmation control processes. (Reference (b))

Management (CM)

The management discipline of:

Identifying configuration items and establishing a configuration baseline.

Controlling changes to that baseline through a judicious process.

UNCLASSIFIED

Recording and reporting the status of proposed changes to established baselines from initiation through implementation.

Performing baseline reviews and audits to ensure that the as-built configuration item is consistent with documented requirements and specifications.

(Definition created by NGA for NGA purposes only)

Request for Change

(RFC)

The mechanism used to:

Modify configuration baselines to reflect changes (i.e., addition, deletion) to a CI.

Integrate new or improved capabilities in response to changes in system requirements.

Remove To Be Determined/To Be Resolved (TBD/TBR) items from configuration-controlled documentation.

Document/remove deviations and waivers for specified requirements.

Incorporate enhancements due to changes in technology and product improvements and other changes that result in improved operational efficiency.

Incorporate changes to correct problems resulting from the failure of hardware or software elements or deficiencies in operational processes and procedures.

Make documentation only changes to NGA baseline documentation.

Modify the NGA Schedule. (Reference (g))

Security

Management (SecCM)

The management and control of configurations for information systems to enable security and facilitate the management of information security risk.

(Reference (b))