Sec_Army_Directive_2016-38_Migration_of_Army_Systems_and_Applications_to....pdf

MEMORANDUM FOR SEE DISTRIBUTION

SUBJECT: Army Directive 2016-38 (Migration of Army Systems and Applications to Approved Hosting Environments and Consolidation of Data Centers)

1. References. A complete list of references is at enclosure 1.

2. This directive establishes an implementation plan (enclosure 2) for a range of actions necessary for the Army to rationalize and modernize information technology (IT) systems and applications, migrate them to approved hosting environments (enclosure 3), and close or consolidate data centers (enclosure 4).

3. The Chief Information Officer (CIO)/G-6 governs implementation of this plan through the Army Enterprise Network Council (AENC) using the Migration Implementation and Review Council as its advisory body (defined in enclosure 2). AENC will provide quarterly updates to the Senior Review Group beginning no later than 120 days after the date of this directive.

4. This directive applies to all Army systems and applications currently in use or under development and to all future developments except those specifically excluded in enclosure 5. Reference a is hereby rescinded.

5. During fiscal year 2015 (FY 15), the Army spent $8.3 billion on a wide range of IT products and services, including IT systems, applications, manpower, and host facilities.

Many of these systems and applications are necessary for efficient operations; many are not. In addition, our systems and networks are under constant threat of compromise and disruption. Every IT system and application presents a potential attack surface to those wishing to affect our readiness to respond when required. We can no longer afford the luxury of unconstrained IT expenses nor accept the risk to the Army and the Nation posed by cyber threats directed against Army capabilities.

6. On 9 June 2014, the Under Secretary of the Army issued guidance to establish the Army Application Migration Business Office and outlined a process for migrating enterprise systems to core data centers (reference a). In the interim, the Department of Defense (DoD) CIO and the Army CIO/G-6 issued additional clarifying guidance (references b–d). However, progress in system and application virtualization and rationalization has been slow, and our data center closure and consolidation efforts have come to a virtual standstill. Additionally, in February 2016, the Deputy Secretary of Defense directed DoD to complete a rapid deployment and transition to Microsoft Windows 10 because of the need to strengthen our cybersecurity posture while

S E C R E T A R Y O F T H E A R M Y W A S H I N G T O N concurrently streamlining the IT operating environment (reference x). I therefore direct the following:

a. Implementation of the enclosed revised plan for migrating systems and applications and consolidating data centers.

b. Closure of installation processing nodes identified in enclosure 4, table 2, as well as the closure of any additional nodes, as required, not identified (including data centers under Army proponency).

c. Assessment of the feasibility, suitability, and acceptability for closing special purpose processing nodes identified in enclosure 4, table 2 through a collaborative effort between affected Army Commands and the Migration Implementation and Review Council, to include identifying special purpose processing nodes requiring exemption from closure.

d. Army Commands will complete the transition to Microsoft Windows 10 no later than 31 January 2017. Organizations unable to meet that suspense date may request a waiver through the appropriate process the Army CIO/G-6 and DoD have established.

7. Your direct leadership is required to ensure that implementation of this plan produces the desired strategic effects of streamlining our IT portfolios, saving corresponding resources that can be applied toward Army requirements, shrinking our data center footprint, and reducing cyber threats to our networks.

8. This directive will remain in effect until it is rescinded.

Encls Eric K. Fanning

DISTRIBUTION:

Principal Officials of Headquarters, Department of the Army Commander

U.S. Army Forces Command U.S. Army Training and Doctrine Command U.S. Army Materiel Command U.S. Army Pacific U.S. Army Europe U.S. Army Central U.S. Army North

(CONT)

DISTRIBUTION: (CONT)

U.S. Army South U.S. Army Africa/Southern European Task Force U.S. Army Special Operations Command Military Surface Deployment and Distribution Command U.S. Army Space and Missile Defense Command/Army Strategic Command U.S. Army Cyber Command U.S. Army Medical Command U.S. Army Intelligence and Security Command U.S. Army Criminal Investigation Command U.S. Army Corps of Engineers U.S. Army Military District of Washington U.S. Army Test and Evaluation Command U.S. Army Installation Management Command Second Army

Superintendent, United States Military Academy Director, U.S. Army Acquisition Support Center Executive Director, Arlington National Cemetery Commandant, U.S. Army War College Commander, U.S. Army Accessions Support Brigade

CF:

Director, Army National Guard Director of Business Transformation Commander, Eighth Army

Army Directive 2016-38 Enclosure 1

REFERENCES

a. Memorandum, Under Secretary of the Army, 9 June 2014, subject: Migration of Army Enterprise Systems/Applications to Core Data Centers (hereby rescinded).

b. Memorandum, Department of Defense (DoD) Chief Information Officer (CIO), Oct 23, 2014, subject: Use of Enterprise Information Technology Standard Business Case Analysis.

c. Memorandum, DoD CIO, Dec 15, 2014, subject: Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services.

d. Memorandum, SAIS-AOC, 23 July 2015, subject: Guidance for Migration to, and Use, of Commercial Cloud Services Providers (CSPs).

e. Memorandum, DoD CIO, Jul 11 2013, subject: Department of Defense Joint Information Environment: Continental United States Core Data Centers and Application and System Migration.

f. Deputy Assistant Secretary of the Army for Cost and Economics Cost-Benefit Analysis (CBA) Guide, 3rd Edition (v3.10), 24 April, 2013.

g. Army Cloud Computing Strategy, Version 1.0, 26 March 2015.

h. DoD Cloud Computing Security Requirements Guide, Version 1, Release 2, 18 March 2016.

i. Department of the Army Pamphlet 25-1-1 (Army Information Technology Implementation Instructions), 26 September 2014.

j. Memorandum, SAIS-CBA, 27 Apr 2012, subject: Disposal of Excess Information Technology Equipment - Leased IT Equipment.

k. Memorandum, SAIS-PRI, 14 Aug 2013, subject: Approvals/Waivers for Obligation of Funds for Data Servers and Centers Information Technology (IT) Spending.

l. Memorandum, Deputy Chief of Staff, G-2, 10 Jun 2013, subject: Army Request for Information Technology-Military Intelligence (ARFIT-MI) Implementation Plan.

m. National Institute of Standards and Technology (NIST) Special Publication 800-82 (Guide to Industrial Controls Systems Security), June 2011.

n. Memorandum, SAIS-CB, 12 Feb 2015, subject: Department of the Army Strategy for the Implementation of the Risk Management Framework (RMF) for Department of Defense Information Technology (IT).

Army Directive 2016-38 2 Enclosure 1 References

o. DoD Instruction 8320.02 (Sharing Data, Information, and Information Technology (IT) Services in the Department of Defense), August 5, 2013.

p. Army Regulation (AR) 25-1 (Army Information Technology), 25 June 2013.

q. AR 25-400-2 (The Army Records Information Management System) (ARIMS), 2 October 2007.

r. Memorandum, Under Secretary of the Army, 3 Dec 2013, subject: The Army Business Management Strategy.

s. All Army Activities (ALARACT) 045/2015 - MOD 2 to HQDA Execute Order 209-11, Army Data Center Consolidation Plan, 05 March 2013.

t. NIST Special Publication 800-145 (The NIST Definition of Cloud Computing), September 2011.

u. Army Doctrine Publication 6-0 (Mission Command), 17 May 2012.

v. NIST Special Publication 800-146 (Cloud Computing Synopsis and Recommendations), May 2011.

w. Federal Acquisition Regulation Supplement, Volume 1, Part 2 (Definition of Words and Terms), Subpart 2.101 (Definitions), Revised 2 March 2015.

x. Memorandum, Deputy Secretary of Defense, Feb 26, 2016, subject: Implementation of Microsoft Windows 10 Secure Host Baseline.

y. Instruction, Committee on National Security Systems (CNSS), 6 April 2015, subject:

Glossary.

z. Title 22, United States Code, Chapter 39, Sub Chapter II – Foreign Military Sales, Section 2761, 18 December 2014.

Army Directive 2016-38 Enclosure 2

IMPLEMENTATION PLAN FOR SYSTEM AND APPLICATION

RATIONALIZATION AND MIGRATION

1. References. A complete list of references is in enclosure 1.

2. Purpose. This implementation plan establishes and directs a range of actions necessary for the Army to rationalize and modernize information technology (IT) systems and applications and migrate them to approved hosting environments.

3. Scope. This plan is applicable to all Army IT systems and applications regardless of command or proponent (hereafter referred to as Army commands), domain, or mission area, except those specifically exempted in enclosure 5.

4. Intent of the Secretary of the Army and Chief of Staff, Army. Our IT system and application rationalization and migration effort aims to accomplish three major objectives:

a. Reduce the number of Army IT systems and applications and optimize those remaining to operate in modern, cloud-enabled computing environments. We can no longer afford unconstrained IT spending nor embrace local IT hosting solutions apart from our desired enterprise approach.

b. Realize that cyber-related threats to our systems, applications, and networks pose significant risks to our ability to generate and sustain ready forces; protect the unit and personal information of our formations, Soldiers, and Family members; and secure our installations and activities. We can no longer underwrite these risks or tolerate antiquated IT software, hardware, and policies that present potential attack surfaces for exploitation.

c. Reduce our IT hosting-related costs by establishing and adhering to authorized network and hosting capabilities at each Army installation and command and by hosting every enterprise-level system and application in facilities capable of providing first-class service while reducing vulnerabilities and potentially saving resources.

5. Application Migration and Data Center Consolidation Strategy. To achieve these three major objectives, the Chief Information Officer (CIO)/G-6 published a comprehensive set of strategies and policies that provide the requisite foundation for action. Army commands and activities will aggressively execute those strategies and adhere to those policies within available resources.

a. Objective End State. The end state includes all enterprise systems and applications being approved, planned, resourced, and migrated to enterprise hosting environments no later than 30 September 2018, contingent upon the availability of enterprise hosting environments. Army enterprise resource planning (ERP) systems, if not already migrated, are scheduled for migration to a Defense Information Systems

Army Directive 2016-38 2 Enclosure 2 Implementation Plan

Agency (DISA) Defense Enterprise Computing Center (DECC) as part of the Army ERP enclave. The suspense for ERP migration, subject to availability of funds, is 30 September 2018. The Army is reducing its data center inventory to one installation processing node (IPN) for each post, camp, or station as part of the larger Department of Defense (DoD) goal to reduce data center infrastructure by at least 60 percent from the current baseline. Reducing the Army’s data center inventory will enable the Army to make the follow-on transition to its long-term end state of four continental United States (CONUS) Army Enterprise Data Centers (AEDCs) and six outside the continental United States (OCONUS) AEDCs. This facilitates implementation of the Army Private Cloud - Enterprise (APC-E) in the 2025 timeframe and is consistent with the Army’s Cloud Computing Strategy (reference g), which leverages approved DoD, Federal, and commercial cloud service providers (CSPs). (A complete glossary of terms is in enclosure 6.)

b. Measures of Success

(1) No later than 180 days from the date of this directive, achieve complete application rationalization and disposition decision through the mission area level (modernize, sustain, or terminate) of all applicable IT systems and applications, regardless of mission area.

(2) No later than 30 September 2018, only legacy systems and applications with scheduled terminations by 30 September 2020 and with approved waivers and a supporting plan of action and milestones (POA&Ms) will remain on Army networks.

Waivers are contingent upon these systems and applications continuing to meet the requirements for operating on an Army network.

(3) No later than 30 September 2018, migrate all Army ERP systems to DISA DECC environments and fully establish the ERP enclave.

(4) No later than 30 September 2025, ensure that all Army commands and installations are compliant with the data center target detailed in this plan and management oversight is in place to monitor new entries to the Army data center inventory.

c. Incentives

(1) The modernization and migration of applications to virtualized environments is proven to reduce application support costs. Army commands develop business cases that create real savings through a combination of application rationalization (including elimination), modernization, and migration to approved virtualized data center environments. Army commands may use the savings they achieve to address command shortfalls during year of execution. Policy requires Army commands to reduce requirements consistent with savings they achieve in the Future Years Defense Plan.

Army Directive 2016-38 3 Enclosure 2

(2) Army commands should close data centers ahead of the schedule in enclosure 4, table 2 and leverage any efficiencies earned through the closures to reinvest in other IT mission needs (such as Windows 10 migration).

(3) Organizations that accelerate migrations and data center closures that create tangible real savings are the primary beneficiaries of those savings in the year of execution contingent upon and consistent with Department of the Army budget execution guidance the Assistant Secretary of the Army (Financial Management and Comptroller) publishes. Organizations that experience savings can keep those savings in their accounts (for example, Army commands for direct applications costs).

6. Definitions. For the purposes of this plan, the following definitions are in place.

a. Rationalization. Portfolio rationalization, or portfolio management, is the systematic management of IT investments within a portfolio, which includes identifying, prioritizing, authorizing, managing, and controlling applications. The focus of the rationalization effort is to identify value-added applications capable of serving a broader Army enterprise audience and garnering efficiencies through the elimination of outdated, legacy, and duplicative applications.

b. Modernization. Applications that have been upgraded or enhanced and brought into compliance with Army Common Operating Environment standards in accordance with the modernization checklist provided by the Army Application Management Business Office (AAMBO). The ALTESS Data Center (RFAA_VA_ALT_01) is designated as a modernization hub for Army commands and is available to facilitate Army application modernization support.

c. Virtualization. The act of creating a virtual (rather than actual) instance of an object, including but not limited to, creating a virtual computer hardware platform, operating system, storage device, or computer network resource.

d. Application Rationalization Methodology. Army commands select the application rationalization methodology or tool that best fits their needs for conducting a holistic review of the application portfolio. An available Army Portfolio Rationalization Guide describes an IT asset value assessment methodology that allows Army commands to better visualize and analyze the IT assets within their portfolio, including system and application dependencies, while enabling a quicker and more comprehensive portfolio management decision process. Army commands complete rationalization at the command, domain, and mission area levels and certify rationalizations by submitting a memorandum signed by the first general officer/member of the Senior Executive Service within the chain of command.

e. Hosting Solutions at Data Centers and Processing Nodes

(1) Army Enterprise Data Center. An AEDC is a fixed Army data center that provides high-capacity network infrastructure, security, technology, and operations.

Army Directive 2016-38 4 Enclosure 2

AEDCs are a unique category of IPNs because they can host both local and enterprise applications. The Army intends to establish 10 AEDCs: 4 in CONUS located at Fort Bragg, NC (FBRG_NC_NEC_04); Fort Carson, CO (FCRS_CO_NEC_01); Fort Knox, KY (FKNX_KY_HG1_01); and Redstone Arsenal, AL (RDST_AL_NEC_01); and 6 OCONUS locations to be determined. AEDCs either collocate with or connect to a joint regional security stack as they come online, in accordance with Joint Information Environment (JIE) requirements. In the interim, top-level architecture stacks will continue to provide network security. To ensure consistency in operations and maintenance, service provisioning and costing, ownership and operation of each IPN designated as an AEDC will be transitioned to Second Army. Transition of the AEDCs at the Headquarters, Department of the Army (HQDA) Deputy Chief of Staff, G-1 (U.S. Army Human Resources Command (HRC)) IPN at Fort Knox and the U.S. Army Forces Command (FORSCOM)/U.S. Army Reserve Command (USARC) IPNs at Fort Bragg to Second Army will take place based on the outcome of an event-driven cost-benefit analysis (CBA).

(2) Tactical Processing Node. Tactical/mobile processing nodes provide networked services to the tactical or deployed environment and are excluded from this policy.

(3) Installation Service Node (ISN). A facility containing the localized equipment necessary to provide the minimum basic functionality to an installation should it become disconnected from the Department of Defense Information Network (DoDIN). An ISN does not host applications or process data. Potential services include read-only Active Directory servers, Domain Name System servers, Assured Compliance Assessment Solution servers, Host-Based Security System servers, and print servers. In addition, ISNs may host unified capabilities that must remain on the installation to enable emergency services when the connection to the DoDIN is interrupted. As part of the Army’s data center end state, most posts, camps, and stations will retain only an ISN.

(4) Installation Processing Node. IPNs are a fixed DoD data center providing local services to a single DoD installation and local area (installations physically or logically behind the network boundary). An IPN has all of the capabilities of an ISN plus the ability to process and store local applications (that is, applications that do not cross two or more installations).

(5) Special Purpose Processing Node. SPPNs are a fixed data center, or data servers in a fixed facility, supporting special purpose functions that cannot or should not be supported by IPNs because of their association with mission-specific infrastructure or equipment. Examples are meteorology; medical; modeling and simulation; test ranges;

classrooms; and research, development, test, and evaluation.

7. Plan Overview. The implementation plan consists of six steps divided into two mission-focused phases. The phased approach for migration focuses organizational efforts and aligns with the Application Migration Process Flow (enclosure 3).

Army Directive 2016-38 5 Enclosure 2

These phases may run sequentially or concurrently based on the progress of individual organizational efforts.

a. Phase 1: Mission Planning

(1) Step 1: Discovery and Portfolio Analysis. This step begins with the system or application owner executing a complete system and application discovery, binning (assigning the system or application to a corresponding domain and mission area), rationalization, and disposition decision (kill, modernize, or sustain). Step 1 ends when the command provides the domain and mission area the portfolio rationalization results and disposition decisions. The mission area provides the approved-for-migration system and applications list to the Army CIO/G-6 and the command prepares to begin migration readiness assessments. Tasks completed during this step include IT portfolio documentation in the Army Portfolio Management Solution (APMS), IT portfolios properly binned to appropriate mission areas and domains, IT portfolios rationalized and disposition decisions rendered, waivers submitted, rationalized application portfolio finalized, the endorsed application list submitted by the mission area governance forum to the CIO/G-6, and the CIO/G-6 providing a reviewed and approved list to the AAMBO.

(2) Step 2: Migration Readiness Assessment. This step is initiated when AAMBO acknowledges receipt of the Army organization’s endorsed application migration list from the Army CIO/G-6. This step ends with AAMBO providing a migration readiness assessment report (including engineering change proposal) that supports the system and application owner’s completion of a total cost of ownership and a cost evaluation of the “as is” and “to be” environments. Tasks completed during this phase include verification of system and application registration in APMS, system engineering analysis, all modernization activities on the AAMBO-approved modernization checklist, recommendation of the target enterprise hosting environment, rough order of magnitude cost estimate for target hosting environments, and total cost of ownership and migration cost assessments (performed by system/application owner).

(3) Step 3: Cost-Benefit Analysis. A CBA is initiated when the Army organization finishes prioritizing its migrating systems and applications, and has received the Migration Assessment Report from AAMBO. This phase ends when the Deputy Assistant Secretary of the Army (Cost and Economics) (DASA-CE), in coordination with the Army CIO/G-6, approves the CBA. Tasks completed during this step include the organization completing and submitting the CBA on the DASA-CE portal to trigger an automatic workflow notification to the domain, mission area, and Army CIO/G-6; the domain reviews the CBA and provides recommendations to the mission area; the mission area reviews and endorses the CBA; the Army CIO/G-6 reviews and provides the final endorsement of the CBA; and the DASA-CE (in coordination with the Army CIO/G-6), approves or disapproves the CBA.

(4) Step 4: Migration Planning. This step begins with the CBA approval and ends with initiation of target environment support services. Tasks completed during this phase include implementation of the migration plan, completion of the authorization

Army Directive 2016-38 6 Enclosure 2 process for the risk management framework (RMF), as defined in reference n, and training (as required), completion of the statement of objective/statement of work, initiation of contracting activities, coordination of service level agreement (SLA) coordination, initiation of CSP hosting option service, and transfer of funds or execution of military interdepartmental purchase request.

b. Phase 2: Mission Execution

(1) Step 5: Migration Execution. This step begins with initiation of the RMF authorization process and, in parallel, application owner migration execution activities.

This step ends after completion of migration and RMF core activities and establishment of continuous monitoring. Tasks completed during this phase include completion of RMF core activities, analysis and testing of candidate platforms, migration rollout, and cutover/go live.

(2) Step 6: Quality Assurance and Steady State. This step begins with preparation for acceptance and ends with decommissioning original equipment (in accordance with reference g) and closing the original hosting data center, if applicable.

Tasks completed during this phase include quality assurance, synchronization of SLAs, client acceptance, contract acceptance, and publication of lessons learned.

c. Future State. IPNs will continue to collapse into AEDCs as the Army completes the migration of applications to enterprise hosting environments. The Army will reduce its IPN inventory to 10 AEDCs by 2025, allowing for the development and maturation of the APC-E. The APC-E will be an on-premises, commercial cloud instantiation that is contractor-owned and contractor-operated. Installations that lose IPN capabilities will retain an ISN. Army commands retain the SPPNs necessary to meet mission requirements.

d. Governance Framework. The Secretary of the Army establishes the Migration Implementation and Review Council (MIRC) chaired by the Deputy CIO/G-6 and the Deputy Chief Management Officer. The MIRC reports to the Chair, AENC.

Membership includes selected representation from Army staff and commands as well as mission areas. The MIRC has the following objectives:

(1) Synchronize the implementation plan across the Army;

(2) Adjudicate and elevate requests to deviate from the implementation plan, as required;

(3) Advise and recommend changes to the implementation plan;

(4) Validate the implementation plan’s data center closure list (enclosure 4, table 2) and assess the operational effects of the closures on Army commands, including consideration of CBA for alternative application hosting environments; and

Army Directive 2016-38 7 Enclosure 2

(5) Report Army compliance with the implementation plan to the AENC.

Quarterly, the Chair, AENC reports implementation progress to the Senior Review Group. The CIO/G-6 Army Data Center Consolidation Plan team serves as the Secretariat and analyzes, tracks, and coordinates actions for the MIRC.

8. Tasks

a. Assistant Secretary of the Army (Acquisition, Logistics, and Technology) (ASA (ALT)) will:

(1) complete rationalization and a disposition decision of the acquisition domain IT portfolio no later than 120 days from the date of this directive. Ensure update of the resultant target environment and Systems View-8 (SV-8) and annotation of decisions in the fiscal year 2017 (FY 17) request for funds certification.

(2) manage AAMBO within the Program Executive Office Enterprise Information Systems (PEO EIS) to serve as the Army’s central coordinating office for migration-related planning, preparation, and execution. Ensure that AAMBO has software engineering expertise to advise system and application owners on hosting requirements and on the best, most cost-effective migration and hosting solutions.

(3) ensure that AAMBO recommends the most cost-effective hosting and support strategies, provides the Army application migration contract vehicle (and Army-approved contracting language for other approved cloud contract vehicles), and supports system and application owners throughout the migration process.

(4) provide software engineering advice to application and system owners concerning the feasibility of hosting non-ERP systems in the DISA-DECC hosting environment.

(5) establish and monitor application migration support standards that enable organizations to perform AAMBO-like functions. These functions include providing technical assessments of systems and applications (reengineering, right-sizing, modernization, and virtualization requirements); supplying technical assessments of appropriate systems and applications enterprise hosting environments; delivering the Migration Assessment Report, which includes the rough order of magnitude costs needed to support CBA development; and facilitating the systems and applications migration process.

(6) identify, in coordination with the Army CIO/G-6 and in concert with the data center end state specified in enclosure 4, technical standards that synchronize the end state with the data center/cloud/generating force computing environment as part of the Army’s Common Operating Environment.

Army Directive 2016-38 8 Enclosure 2

(7) coordinate with the Army CIO/G-6 and AAMBO to complete an assessment to determine if all approved enterprise hosting environments are compliant with the data center/cloud/generating force computing environment.

(8) coordinate with the Army CIO/G-6 to develop and publish checklists and other guidance to support Armywide application migration efforts, including application modernization activities that support maturation of the data center/cloud/generating force computing environment.

b. Assistant Secretary of the Army (Financial Management and Comptroller). The Assistant Secretary will:

(1) complete rationalization of the Financial Management Domain IT portfolio no later than 120 days from the date of this directive. Make sure the resultant target environment and SV-8 are updated and decisions are annotated in the FY 17 funds certification request.

(2) migrate, in coordination with the PEO EIS and within available resources, the General Fund Enterprise Business System (GFEBS) and GFEBS-Sensitive Activities ERPs to the approved DISA-DECC ERP enclave environment no later than 30 September 2018.

c. Assistant Secretary of the Army (Installations, Energy and Environment). The Assistant Secretary will:

(1) complete rationalization of the Installations, Energy, and Environment Domain IT portfolio in coordination with the Assistant Chief of Staff for Installation Management and no later than 120 days from the date of this directive.

(2) ensure the update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

d. Assistant Secretary of the Army (Manpower and Reserve Affairs). The Assistant Secretary will:

(1) complete rationalization of the Human Resources Domain IT portfolio in coordination with the Deputy Chief of Staff (DCS), G-1 no later than 120 days from the date of this directive.

(2) ensure update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

e. General Counsel. The General Counsel will ensure the provision of appropriate legal support in conjunction with The Judge Advocate General.

Army Directive 2016-38 9 Enclosure 2

f. Chief Information Officer/G-6. The CIO/G-6 will:

(1) begin the MIRC and perform Secretariat functions in support of the MIRC no later than 90 days from the date of this directive.

(2) ensure that the Office of the CIO/G-6 Enterprise License Division develops, staffs, and publishes a policy and associated procedures for centrally managing and tracking equipment and software licenses that have migrated to approved enterprise hosting environments no later than 90 days from the date of this directive. The division collaborates with DISA and Second Army, in coordination with U.S. Army Cyber Command (ARCYBER), to ensure documentation of IT hardware, software, and licenses that have been transferred to DISA or other approved enterprise hosting environments. The division ensures the appropriate transfer of ownership and responsibility for maintenance agreements, which will be included in the SLA between the Army, DISA, or other enterprise hosting organization, as appropriate. Software licenses transferred to DISA will be removed from the Army inventory, as applicable.

(3) develop performance assessment plan to assess progress toward this plan’s measures of success. Brief assessments monthly through the MIRC to the AENC and quarterly to the Senior Review Group, beginning no later than 120 days from the date of this directive.

(4) fund AAMBO and establish priorities, as required, for application migration to enterprise hosting environments.

(5) develop and implement a rationalization and migration plan for all systems and applications within the Enterprise Information Environment Mission Area and complete rationalization no later than 180 days from the date of this directive.

Coordinate with the Office of Business Transformation on best practices rationalization methodologies to assist with this task.

(6) integrate the tracking tool data for the Army Data Center Consolidation Plan into the APMS warehouse to create the foundation for an authoritative database to track and monitor application migration and data center closures no later than 30 June 2017.

(7) review and approve requests from organizations to perform AAMBO-like functions in lieu of AAMBO, contingent upon the organization validating that it can meet the AAMBO standards the ASA (ALT) established.

g. The Auditor General. The Auditor General will develop an audit plan for Secretary of the Army approval to measure compliance with this plan beginning in

FY 17.

h. Chief, National Guard Bureau. The Chief will support mission area and respective domain leads in rationalization and migration actions involving Army National Guard (ARNG) systems and applications.

Army Directive 2016-38 10 Enclosure 2

i. Deputy Chief of Staff, G-1. The DCS, G-1 will:

(1) complete rationalization of the Human Resources Domain IT portfolio in coordination with the Assistant Secretary of the Army (Manpower and Reserve Affairs) no later than 120 days from the date of this directive.

(2) ensure the update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

(3) coordinate with the PEO EIS to remove the Integrated Personnel and Pay System-Army (IPPS-A) production environment from AEDC, Fort Knox no later than 60 days after the successful fielding of IPPS-A increment 2.

(4) ensure that HRC completes an event-driven CBA, including developing courses of action (COAs), to determine Second Army’s ability to deliver IT capabilities to HRC’s customer base at or above existing service levels and at or below existing costs.

HRC should complete the CBA, in concert with Second Army, no later than 120 days from the date of this directive.

j. Deputy Chief of Staff, G-2. No later than 120 days from the date of this directive, the DCS, G-2 will plan for migration to Intelligence Community and Army Data Centers and continued enduring military intelligence SPPNs in support of intelligence missions.

k. Deputy Chief of Staff, G-3/5/7. The DCS, G-3/5/7 will:

(1) complete rationalization of the Training and Readiness Domain IT portfolios within the Business Mission Area (BMA) no later than 120 days from the date of this directive.

(2) ensure the update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

(3) review other domain portfolios within the Warfighting Mission Area for conformity to this plan’s directions.

(4) complete rationalization of and migration planning for systems and applications within the Warfighting Mission Area and migrate within existing resources no later than 180 days from the date of this directive.

l. Deputy Chief of Staff, G-4. The DCS, G-4 will:

(1) complete rationalization of the Logistics Domain IT portfolio no later than 120 days from the date of this directive.

(2) ensure the update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

Army Directive 2016-38 11 Enclosure 2

(3) ensure, in coordination with the PEO EIS, the migration of the Global Combat Support System-Army ERP to the approved DISA DECC ERP enclave environment no later than 30 September 2018.

m. Deputy Chief of Staff, G-8. The DCS, G-8 will provide programming support as required to realize the provisions of this plan during the building of Program Objective Memorandum (POM) 19–23.

n. Chief, Army Reserve. The Chief, Army Reserve will support mission area and respective domain leads in rationalization and migration actions involving U.S. Army Reserve systems and applications.

o. Assistant Chief of Staff for Installation Management. The Assistant Chief of Staff for Installation Management will:

(1) coordinate with the Assistant Secretary of the Army (Installations, Energy and Environment) to complete rationalization of the Installations, Energy and Environment Domain IT portfolio no later than 120 days from the date of this directive.

(2) ensure the update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

(3) analyze whether Headquarters Army Environmental System should be hosted in the DISA DECC ERP hosting environment. Provide a recommendation to the Under Secretary of the Army through the MIRC.

p. Commander, U.S. Army Materiel Command (AMC). The Commander, AMC will:

(1) support the DCS, G-4 in completing the rationalization of the Logistics Domain IT portfolio no later than 120 days from the date of this directive.

(2) ensure the update of the resultant target environment and SV-8 and annotation of decisions in the FY 17 funds certification request.

(3) migrate, in coordination with the PEO EIS and within existing resources, the Logistics Modernization Program ERP and Logistics Information Warehouse to the approved DISA DECC ERP enclave environment no later than 30 September 2018.

q. Director of Business Transformation. The Director will:

(1) lead BMA efforts to rationalize the Army BMA portfolio no later than 180 days from the date of this directive.

(2) coordinate and lead system analysis for potential inclusion of non-ERP systems in the DISA DECC ERP hosting environment to maximize the potential of an engineered solution to BMA system hosting.

Army Directive 2016-38 12 Enclosure 2

(3) review BMA system and application migration efforts quarterly within the Army Business Council starting no later than 90 days from the date of this directive.

(4) assist Army commands, HQDA staff principals, and the CIO/G-6 with system analysis for migration efforts.

(5) facilitate Army commands’ access to training on best practices for application rationalization methodologies.

r. Army Deputy Chief Management Officer. The Deputy Chief Management Office will cochair the Special Data Center and migration-focused MIRC with the Deputy

CIO/G-6.

s. Commander, Second Army. In coordination with ARCYBER, the commander will:

(1) no later than 90 days from the date of this directive and in coordination with AAMBO, provide the CIO/G-6 with a POA&M to facilitate the migration of all public-facing Web sites to an approved demilitarized zone extension or enterprise-hosting environment. Additional details are in reference s.

(2) no later than 90 days from the date of this directive, provide the requirements for the computer network defense service provider (CNDSP), commensurate with effect levels, to AAMBO for inclusion in standard contracting language that supports application migration security requirements. AAMBO will include these requirements in the Army commercial cloud contract vehicle, SLAs, and any other Army-approved contract vehicles.

(3) no later than 90 days from the date of this directive, develop and publish the concept of operations for management of applications migrated to enterprise environments. This concept will incorporate operation and maintenance strategies for all approved enterprise hosting options, including the commercial cloud, AEDCs, and DISA enterprise hosting options (DISA DECC, milCloud, and milCloud Plus).

(4) no later than 120 days from the date of this directive, conduct an event-driven CBA, including development of COAs, to determine Second Army’s ability to deliver IT capabilities to the HRC (Fort Knox), FORSCOM (Fort Bragg), and USARC (Fort Bragg) customer bases at or above existing service levels and at or below existing costs.

Pending the successful outcome of the CBA for Second Army assuming ownership of the AEDCs at HRC (Fort Knox), FORSCOM (Fort Bragg), and USARC (Fort Bragg):

(a) develop a POA&M for standardizing the infrastructure, operation, and maintenance of identified AEDCs.

(b) develop and implement AEDC application onboarding processes, including standardization of SLAs.

Army Directive 2016-38 13 Enclosure 2

(c) develop and implement a standardized methodology for onboarding applications into AEDCs, prioritizing applications for onboarding and distributing them among the AEDCs.

(5) no later than 180 days from the date of this directive and in coordination with AAMBO, outline required CNDSP roles and responsibilities incumbent upon enterprise hosting environments, including commercial CSPs, from which Army commands operate for ARCYBER to execute its CNDSP role for the Army, including navigating within the commercial CPS environment when required.

(6) no later than 180 days from the date of this directive, develop a POA&M and cost estimate for consolidating multiple data processing facilities and data centers at Army posts, camps, and stations in accordance with DoD FY 18 requirements for data center consolidation. Use the cost estimate to inform POM 19–23.

(7) no later than 180 days from the date of this directive and in coordination with AAMBO, develop and publish common services standards for commercial service provider hosting solutions based on current Army policy governing commercial hosting.

(8) pending the successful outcome of the CBA for Second Army assuming ownership of the AEDCs at HRC (Fort Knox), FORSCOM (Fort Bragg), and USARC (Fort Bragg), accept the transition of any AEDC Second Army does not currently own or operate and facilitate the standardization of infrastructure, service provisioning, costing, and operations and maintenance.

(9) plan, prepare, and execute, within existing resources, the Army Private Cloud Pilot at Redstone Arsenal to provide recommendations on the utility and cost-effectiveness of an on-premises Army Private Cloud as a viable migration planning and enterprise hosting option.

t. Forces Command. No later than 120 days from the date of this directive, in concert with Second Army, the Commander, FORSCOM will conduct an event-driven CBA, including the development of COAs, to determine Second Army’s ability to deliver IT capabilities to FORSCOM’s customer-base at or above existing service levels and at or below existing costs.

u. Reserve Command. No later than 120 days from the date of this directive, in concert with Second Army, the Commander, USARC will conduct an event-driven CBA, including the development of COAs, to determine Second Army’s ability to deliver IT capabilities to USARC’s customer-base at or above existing service levels and at or below existing costs.

9. Coordinating Instructions

a. This plan is effective upon receipt for planning. Execution occurs in accordance with the timelines in the following table. All references are available at the Army

Army Directive 2016-38 14 Enclosure 2

CIO/G-6 portal, which requires a common access card:

https://army.deps.mil/army/cmds/hqda_ciog6_Project/ADCCP/CloudDocRepository/defa ult.aspx.

Date Action Office of Primary

Responsibility

NLT 5th working day of each month

Report application migration status to AAMBO to ensure the Army has a centralized, accurate database for application migrations.

Organizations not using AAMBO

NLT 90 days after directive signed

Begin MIRC. CIO/G-6, Deputy Chief Management Officer

NLT 90 days after directive signed

Complete an application rationalization analysis and disposition decision of all systems and applications within the command’s portfolio, including certification by general officer/member of Senior Executive Service.

Army Commands, Proponents

NLT 90 days after directive signed

Finalize migration planning for the next POM cycle. Mission Area Leads

NLT 120 days after directive signed

Begin reporting Army application migration progress to Senor Review Group quarterly.

AENC Chair

NLT 120 days after directive signed

Complete an application rationalization and disposition decision for all systems and applications within the domain.

All Domain Leads

NLT 120 days after directive signed

Complete an event-driven CBA, including development of COAs, to determine Second Army’s ability to deliver IT capabilities to the HRC (Fort Knox) and FORSCOM and USARC (Fort Bragg) customer bases at or above existing service levels and at or below existing costs.

Second Army

NLT 120 days after directive signed

Complete, in concert with Second Army, an event-driven CBA, including the development of COAs, to determine Second Army’s ability to deliver IT capabilities to the FORSCOM and USARC customer bases, respectively, at or above existing service levels and at or below existing costs.

DCS, G-1 (HRC),

FORSCOM, USARC

NLT 180 days after directive signed

Complete an application rationalization, analysis, and disposition decision for all systems and application within the BMA portfolio and record the results.

Results inform the submission of the FY 17 organizational execution plan and FY 17 BMA portfolio reviews. Provide Army CIO/G-6 (Personnel and Readiness) with the mission area-endorsed application migration list.

Office of Business Transformation, BMA https://army.deps.mil/army/cmds/hqda_ciog6_Project/ADCCP/CloudDocRepository/default.aspx https://army.deps.mil/army/cmds/hqda_ciog6_Project/ADCCP/CloudDocRepository/default.aspx

Army Directive 2016-38 15 Enclosure 2

Date Action Office of Primary

Responsibility

NLT 180 days after directive signed

Complete an application rationalization, analysis, and disposition decision for all the systems and applications within the Enterprise Information Environment, Intelligence, and Warfighting Mission Areas. Provide Army CIO/G-6 Personnel and Readiness with the mission area-endorsed application migration list.

CIO/G-6; DCS, G-2;

DCS, G-3/5/7; Mission Area Leads

NLT 180 days after directive signed

Complete BMA FY 16 portfolio reviews and lock BMA target environment. Update Enterprise Knowledge Repository.

BMA Domains

NLT 180 days after directive signed

Complete migration analysis of BMA portfolio with specific emphasis on non-ERP systems capable of being hosted within the ERP DISA DECC hosting environment.

Office of Business Transformation, BMA Domains

NLT 180 days after directive signed

Complete ERP migration to DISA DECC ERP hosting environment.

ERP System Owners

NLT 60 days after IPPS-A Increment 2 fielding

Coordinate with PEO EIS to remove IPPS-A Increment 1 from AEDC at HRC (Fort Knox).

DCS, G-1 (HRC)

NLT 31 January 2017 All Army commands complete transition to Microsoft Windows 10 NLT 31 January 2017. Organizations unable to meet the suspense may request a waiver through the appropriate process the Army CIO/G-6 and DoD established.

All Army commands

NLT 31 June 2017 Complete integration of ADCCP tracking tool into

APMS.

CIO/G-6

Pending successful outcome of an event-driven CBA at HRC (Fort Knox)

Transition the DCS, G-1 (HRC) Fort Knox Data Center (FKNX_KY_HG1_01) to Second Army in coordination with ARCYBER.

DCS, G-1 (HRC)

Pending successful outcome of an event-driven CBA at FORSCOM (Fort Bragg)

Transition the FORSCOM Fort Bragg Data Center (FBRG_NC_FOR_01) to Second Army in coordination with ARCYBER.

FORSCOM

Pending successful outcome of an event-driven CBA at USARC (Fort Bragg)

Transition the USARC Fort Bragg Data Center (FBRG_NC_ARC_01) to Second Army in coordination with ARCYBER.

USARC

Pending successful outcome of an event-driven CBA at HRC (Fort Knox), FORSCOM (Fort Bragg), and USARC (Fort Bragg)

Accept the transition of the DCS, G-1 (HRC) Fort Knox Data Center (FKNX_KY_HG1_01), and Fort Bragg FORSCOM (FBRG_NC_FOR_01) and USARC (FBRG_NC_ARC 01) Data Centers to Second Army in coordination with ARCYBER.

Second Army in coordination with

ARCYBER

Army Directive 2016-38 16 Enclosure 2

b. The MIRC governance forum is the office of primary responsibility for monitoring the status of the implementation tasks and ensuring compliance with the directive.

c. No later than 90 days from the date of the directive, all Army commands must complete their application rationalization. No later than 120 days from the date of the directive, all domains must complete their application rationalization. No later than 180 days from the date of the directive, all mission areas must complete their rationalization.

d. No later than the end of the fourth quarter FY 18, Army commands will virtualize and Web-enable all enterprise systems and complete migration to an approved enterprise hosting environment, contingent upon the availability of enterprise hosting environments. All non-enterprise systems (systems that provide services and data to users within host installation boundaries) operating from local IPN hosting facilities consolidate to the approved IPN on the post, camp, or station from which it is operating, in accordance with the defined IPN list in enclosure 4. Army commands approved to operate SPPNs will continue to operate the SPPNs at approved locations. For ERP systems, the priority for migration remains DISA DECC ERP enclaves. For enterprise systems and applications, the priority for migration remains the commercial cloud and AEDCs. Only those systems and applications approved for participation in the APC-E (pilot) at Redstone Arsenal are authorized to us the APC-E as their enterprise hosting option at this time.

e. Army commands contracting for commercial cloud services are only authorized to use CSPs that host data in clouds that are within the United States or its outlying areas, as defined in the Federal Acquisition Regulation 2.101 (reference w), or in OCONUS locations that are within U.S. control and not subject to host-nation or regional laws through treaty or other circumstance.

f. No later than 31 December 2017, Army commands will, within existing resources, migrate all enterprise systems with low security impact levels (data impact levels 1 and 2) in reference h and public-facing Web sites to an approved demilitarized zone extension or enterprise hosting environment.

g. No later than 30 September 2018, Army commands will, within existing resources, migrate enterprise systems with higher security impact levels (data impact levels 4 and 5) to approved enterprise hosting options, including DISA DECCs,…