![](media/image1.wmf){width="3.5in" height="2.672222222222222in"}

**Chief Information Officer**

### Office Work Instruction {#office-work-instruction .unnumbered}

**Information Technology Policy Formulation Process**

Approved by: \_[Original Signed by Lee B. Holcomb on December 7,
1999]{.underline}\_\_

Lee B. Holcomb

Chief Information Officer

**DOCUMENT HISTORY LOG**

+---------+--------+-------------+------------------------------------+
| Status  | Do     | Effective   | Description                        |
|         | cument |             |                                    |
| (Ba     |        | Date        |                                    |
| seline/ | Re     |             |                                    |
|         | vision |             |                                    |
| Re      |        |             |                                    |
| vision/ |        |             |                                    |
|         |        |             |                                    |
| Ca      |        |             |                                    |
| nceled) |        |             |                                    |
+---------+--------+-------------+------------------------------------+
| B       |        | December 7, |                                    |
| aseline |        | 1999        |                                    |
+---------+--------+-------------+------------------------------------+
|         |        |             |                                    |
+---------+--------+-------------+------------------------------------+
|         |        |             |                                    |
+---------+--------+-------------+------------------------------------+
|         |        |             |                                    |
+---------+--------+-------------+------------------------------------+
|         |        |             |                                    |
+---------+--------+-------------+------------------------------------+
|         |        |             |                                    |
+---------+--------+-------------+------------------------------------+

# Purpose

The purpose of this OWI is to document the procedure for managing IT
policy formulation from determination of the need for IT policy through
availability of the signed and approved policy in the NODIS system and
the CIO web site.

# Scope and Applicability

## 2.1 Scope {#scope .unnumbered}

This work instruction describes procedures for the NASA Chief
Information Officer (CIO) Code AO Information Technology Policy
Formulation Process. This process involves determining the need for IT
policy consistent with NHB 1101 *NASA Organization Handbook* and NPD
1000.1 *NASA Strategic Plan*. It incorporates subsequent policy
formulation, concurrence, and approval with input from Enterprise and
Center representatives, and manages comment and concurrence resolution
throughout the policy development process, culminating in approval as
per the NASA Directives System policy, NPD 1400.1F, and posting of the
approved policy.

## 2.2 Applicability {#applicability .unnumbered}

This work instruction for IT Policy Formulation Process applies to NASA
Chief Information Officer (Code AO) office. The CIO is responsible for
maintaining this document. The controlled version of this OWI is
available on the NASA Intranet via the HQ ISO 9000 Document Library at
[http://hqiso9000.hq.nasa.gov](http://hqiso9000.hq.nasa.gov/). Any
printed version of this OWI is uncontrolled (reference: HCP 1400.1,
*Document and Data Control*).

# Definitions

  ------------- ---------------------------------------------------------
  3.1           [CIO]{.underline} Chief Information Officer

  3.2           [IT]{.underline} Information Technology

  3.3           [NODIS]{.underline} NASA Online Directives System

  3.4           [URL]{.underline} Uniform Resource Locator

  3.5           [Code CIC]{.underline} Administrator's Correspondence
                Office

  3.6           [Code JM]{.underline} Directives Management System

  3.7           [CIO Board]{.underline} Comprised of the CIO, the
                Enterprise CIOs and the Center CIOs

  3.8           [Policy Lead]{.underline} Developer of IT Policy
  ------------- ---------------------------------------------------------

# References

  ------------- --------------- ------------------------------------------
  4.1           NPD 1000.1A     NASA Strategic Plan

  4.2           NHB 1101.3      The NASA Organization

  4.3           NPD 2800        Managing Information Technology

  4.4           NPG 2800        Managing Information Technology

  4.5           NPD 1400.1F     NASA Directives System

  4.6           NPG 1400.1      NASA Directives System Procedures and
                                Guidelines

  4.7           NHQ Form 184    Directive Request Summary

  4.6           NPG 1400.1      NASA Directives System Procedures and
                                Guidelines
  ------------- --------------- ------------------------------------------

#   {#section .unnumbered}

# Flowchart

The following flowchart depicts the procedure described in Section 6.
Quality records are listed in Section 7.

![](media/image4.wmf)

# Procedure

  -----------------------------------------------------------------------------------------------------------
  [Step]{.underline}   [Actionee]{.underline}   [Action]{.underline}
  -------------------- ------------------------ -------------------------------------------------------------
  6.1                  CIO                      *Determine lead to write/revise IT Policy*. CIO determines
                                                lead to revise existing IT Policy or write new IT Policy
                                                based on subject matter.

  6.2                  NASA CIO Secretary       *Enter actions and assignees into CIO Registry for action
                                                tracking.* The CIO Action Registry is used to track the
                                                development, commenting, dispositioning of comments, and CIO
                                                Board voting. Dates and action assignees are named and a
                                                Registry Action is assigned.

  6.3                  CIO                      *Monitor* *policy* *lead activities*. The progress of the
                                                Policy Lead is monitored through the weekly teleconferences
                                                of the CIO Representatives as well as at the Face to Face
                                                meetings.

  6.4                  CIO                      *Is Code AO Lead?* If yes, proceed to Step 6.5. If no, the
                                                Policy Lead performs out-of-scope activities to parallel
                                                steps 6.5 through 6.12.

  6.5                  Policy Lead              I*s there an existing Policy?* If yes, proceed to Step 6.7.
                                                If no, proceed to Step 6.6.

  6.6                  Policy Lead              *Draft IT Policy.* The IT Policy document is developed in
                                                draft form based on existing guidelines and technology
                                                trends. The Policy Lead ensures that the policy developed is
                                                aligned with the CIO's IT architecture and standards.

  6.7                  Policy Lead              *Review existing IT Policy for requirements traceability and
                                                relevance.* Using the existing IT Policy, the Policy Lead
                                                reviews the existing IT Policy to analyze differences between
                                                new or revised requirements, which may be of a regulatory or
                                                technology nature.

  6.8                  CIO                      *Analyze policy to align policy with strategic and
                                                organizational goals.* The existing policy is analyzed to
                                                ensure the policy is correctly strategically and
                                                organizationally aligned with the Office of the CIO goals and
                                                missions.

  6.9                  Policy Lead              *Revise IT Policy.* Using the existing IT Policy, the Policy
                                                Lead incorporates changes/additions based upon the analysis
                                                performed in Step 6.7 -- the reasons for new/modified
                                                requirements may be of a regulatory or technology nature.

  6.10                 Policy Lead              *Post draft to website for CIOs' review and comment.* The
                                                Policy Lead posts the Draft IT Policy to their established
                                                website to facilitate the review of the Draft IT Policy by
                                                the CIO Board. A URL pointing to this document will be made
                                                available to the CIO Board by a link from the CIO Action
                                                Registry.

  6.11                 Policy Lead              *Disposition comments and post to website.* The Policy Lead
                                                dispositions the CIOs' comments that are directly e-mailed to
                                                the Policy Lead. As necessary, the Policy Lead contacts the
                                                commentor directly to resolve issues. Changes are accepted,
                                                rejected or modified.

  6.12                 Policy Lead              *Revise draft IT policy to reflect comments and post to
                                                website.* The Policy Lead revises the Draft IT Policy based
                                                upon the dispositioning activity described in Step 6.11 and
                                                posts the latest version to the Policy Lead's website (see
                                                Step 6.11).

  6.13                 NASA CIO Secretary       *Capture and tally CIO Board votes on revised draft IT
                                                Policy.* As scheduled on the CIO Action Registry, after the
                                                CIOs' comments have been dispositioned and the revised Draft
                                                IT Policy has been reviewed, the CIO Board votes on the Draft
                                                IT Policy. When concurrence is reached, the Draft IT Policy
                                                will then go forward to be entered into the NODIS process.

  6.14                 CIO                      *Concurrence by CIO community?* If yes, proceed to Step 6.15.
                                                If no, return to Step 6.12.

  6.15                 NASA CIO Secretary       *Delete Policy Formulation action from CIO* *Action*
                                                *Registry.* The action to vote on the Draft IT Policy is
                                                deleted from the CIO Action Registry and the file capturing
                                                the Action and the date is updated.

  6.16                 NASA CIO Secretary       *Enter action to track Draft IT Policy through signature into
                                                CIO Action Registry.* An action, which tracks the Draft IT
                                                Policy through the NODIS System to signature, is added to the
                                                CIO Action Registry.

  6.17                 Code AO Directives &     *Determine reviewing offices and enter NODIS process.* Based
                       Standards Manager        upon the subject matter, the reviewing offices are determined
                                                and the list of reviewing offices given to the NODIS Manager.
                                                In an out-of-scope process, detailed in NPD 1400.1F, Form 184
                                                is electronically completed, approved, and submitted (by Code
                                                CIC, acting as the Code AO Directives Manager) to the NODIS
                                                Manager (Code J). The out-of-scope process continues with a
                                                number for the Draft IT Policy being assigned and formally
                                                entered into the NODIS concurrence process.

  6.18                 Code AO Directives &     *Coordinate draft IT policy throughout NODIS process.* The
                       Standards Manager        Draft IT Policy enters the formal NODIS process to be
                                                reviewed by the selected Headquarters reviewing offices.

  6.19                 Policy Lead              *Concurrence from reviewing offices?* If yes, with comment,
                                                proceed to Step 6.20. If yes without comment, proceed to Step
                                                6.24. If no, proceed to Step 6.23.

  6.20                 Policy Lead              *Review and disposition comments and notify reviewing
                                                office.* The Policy Lead reviews the comments received, works
                                                with the commenting office to resolve any issues regarding
                                                the comments, and dispositions the comments. The reviewing
                                                office is notified, through the means provided by the NODIS
                                                system, that their comments have been dispositioned.

  6.21                 Policy Lead              *Document revision required?* The Policy Lead determines from
                                                an analysis of the comments whether or not the Draft IT
                                                Policy needs to be revised. If yes, proceed to Step 6.22. If
                                                no, proceed to Step 6.24.

  6.22                 Policy Lead              *Revise document to incorporate dispositioned comments.* The
                                                Policy Lead revises the Draft IT Policy as necessary to
                                                incorporate the reviewing offices' comments while ensuring
                                                consistency with overall document purpose and CIO IT
                                                architecture and standards.

  6.23                 Code AO Directives &     *Contact non-responsive offices.* After the due date for
                       Standards Manager        comments, which is established by the NODIS process,
                                                non-responsive offices are contacted to see whether or not
                                                they will have comments or intend to concur without comment.

  6.24                 Code AO Directives &     *Monitor status of outstanding responses.* The Code AO
                       Standards Manager        Directives & Standards Manager continues to check to see
                                                whether or not all reviewing offices have reviewed and
                                                concurred on the Draft IT Policy by the due date established
                                                by the NODIS System process

  6.25                 Code AO Directives &     *All responses received?* If yes, proceed to Step 6.26. If
                       Standards Manager        no, return to Step 6.23.

  6.26                 Code AO Directives &     *Prepare Draft Approval Package and submit to Code JM.* The
                       Standards Manager        Code AO Directives & Standards Manager prepares the Draft
                                                Approval Package, as prescribed by the NODIS process, and
                                                submits it to Code JM, the NODIS System Manager, for
                                                processing through Code CIC and then final signature.

  6.27                 Code AO Directives &     *Review and incorporate Code CIC changes as appropriate.* The
                       Standards Manager        Code AO Directives & Standards Manager reviews each suggested
                                                change to ensure technical accuracy and incorporates the
                                                changes as determined. Coordination is closely maintained
                                                with Code CIC until Code CIC determines that the document is
                                                ready to go forward for signature.

  6.28                 Code AO Directives &     *Is signed policy available in NODIS?* If yes, proceed to
                       Standards Manager        Step 6.30. If no, proceed to Step 6.29.

  6.29                 Code AO Directives &     *Continue to check for document upload.* The Code AO
                       Standards Manager        Directives & Standards Manager monitors NODIS to determine
                                                whether or not the Document has been signed and has been
                                                uploaded by the NODIS Manager to the NODIS system and whether
                                                the approved IT Policy is available electronically through
                                                the NODIS library.

  6.30                 Code AO Directives &     *Update CIO Internal IT Policy web page with link to NODIS
                       Standards Manager        version of approved IT Policy.* After the approved IT Policy
                                                is available electronically through the NODIS library, the
                                                Code AO Directives & Standards Manager updates the internal
                                                CIO's NASA IT Technical Standards and IT Policy/Procedural
                                                Directives webpage
                                                (<http://www.hq.nasa.gov/office/codea/codeao/xnotice.html>)
                                                with the link to the approved IT Policy URL.

  6.31                 NASA CIO Secretary       *Remove Action from CIO Action Registry*. The action tracking
                                                the Draft IT Policy through the NODIS system to signature is
                                                deleted after the IT Policy has been signed.

  6.32                 CIO                      *Approved policy implemented.* At the following weekly
                                                teleconference, the CIO informs the CIO Board that the IT
                                                Policy has been approved and is effective.
  -----------------------------------------------------------------------------------------------------------

# Quality Records

# 

+-------------+-------+---------+---------+------------+--------------+
| Record ID   | Owner | L       | Record  | NPG 1441.1 | Retention    |
|             |       | ocation | Media   | Schedule   | /Disposition |
|             |       |         |         | and Item   |              |
|             |       |         |         | Number     |              |
+-------------+-------+---------+---------+------------+--------------+
| CIO Action  | Code  | Headq   | Ele     | Schedule   | (Per NARA)   |
| Registry    | AO    | uarters | ctronic | 1, Item    |              |
|             |       | server  |         | 78C        | \- Before    |
|             |       |         | (h      |            | 12/98:       |
|             |       |         | ttp://w |            | Destroy when |
|             |       |         | ww.hq.n |            | no longer    |
|             |       |         | asa.gov |            | needed;      |
|             |       |         | /office |            |              |
|             |       |         | /codea/ |            | \- Since     |
|             |       |         | codeao/ |            | 12/98:       |
|             |       |         | registr |            | Destroy when |
|             |       |         | y.html) |            | 2 years old  |
+-------------+-------+---------+---------+------------+--------------+
| DRAFT (new  | P     | Headq   | Ele     | Schedule   | Destroy      |
| or revised) | olicy | uarters | ctronic | 1, Item    | copies of    |
| IT Policy   | Lead  | server  |         | 72D        | record       |
|             |       |         |         |            | material     |
|             |       |         |         |            | when no      |
|             |       |         |         |            | longer       |
|             |       |         |         |            | needed       |
+-------------+-------+---------+---------+------------+--------------+
| Posted      | P     | Headq   | Ele     | \-         | \- Destroy   |
| Dis         | olicy | uarters | ctronic | E          | copies of    |
| positioning | Lead  | server  | until   | lectronic: | record       |
|             |       | and     | all     | Schedule   | material     |
|             |       | Code JM | c       | 1, Item    | when no      |
|             |       |         | omments | 72D        | longer       |
|             |       |         | dispos  |            | needed       |
|             |       |         | itioned | \-         |              |
|             |       |         | then    | Hardcopy:  | \- Transfer  |
|             |       |         | H       | Schedule   | Background   |
|             |       |         | ardcopy | 1, Item    | and related  |
|             |       |         |         | 72C        | material to  |
|             |       |         |         |            | Agency level |
|             |       |         |         |            | issuance     |
+-------------+-------+---------+---------+------------+--------------+
| Retained    | Code  | Headqu  | H       | Schedule   | (Per NARA)   |
| printout of | AO    | arters, | ardcopy | 1, Item    |              |
| CIO Action  |       | Code AO |         | 78C        | \- Before    |
| Registry    |       |         |         |            | 12/98:       |
| sHQOWIng    |       |         |         |            | Destroy when |
| vote w/     |       |         |         |            | no longer    |
| date        |       |         |         |            | needed;      |
|             |       |         |         |            |              |
|             |       |         |         |            | \- Since     |
|             |       |         |         |            | 12/98:       |
|             |       |         |         |            | Destroy or   |
|             |       |         |         |            | delete when  |
|             |       |         |         |            | 2 years old, |
|             |       |         |         |            | or 2 years   |
|             |       |         |         |            | after the    |
|             |       |         |         |            | date of the  |
|             |       |         |         |            | latest       |
|             |       |         |         |            | entry,       |
|             |       |         |         |            | whichever is |
|             |       |         |         |            | applicable.  |
+-------------+-------+---------+---------+------------+--------------+
| NHQ Form    | Code  | Headqu  | H       | Schedule   | Transfer     |
| 184         | JM    | arters, | ardcopy | 1, Item    | Background   |
|             |       | Code JM |         | 72C        | and related  |
|             |       |         |         |            | material to  |
|             |       |         |         |            | Agency level |
|             |       |         |         |            | issuance     |
|             |       |         |         |            | office (Code |
|             |       |         |         |            | J)           |
+-------------+-------+---------+---------+------------+--------------+
| Approval    | Code  | Headqu  | H       | Schedule   | Transfer     |
| Package     | JM    | arters, | ardcopy | 1, Item    | Background   |
|             |       | Code JM |         | 72C        | and related  |
|             |       |         |         |            | material to  |
|             |       |         |         |            | Agency level |
|             |       |         |         |            | issuance     |
|             |       |         |         |            | office (Code |
|             |       |         |         |            | J)           |
+-------------+-------+---------+---------+------------+--------------+
| Retained    | Code  | Headqu  | H       | Schedule   | (Per NARA)   |
| Printout of | AO    | arters, | ardcopy | 1, Item    |              |
| CIO Action  |       | Code AO |         | 78C        | \- Before    |
| Registry    |       |         |         |            | 12/98:       |
| SHQOWIng    |       |         |         |            | Destroy when |
| Action of   |       |         |         |            | no longer    |
| Approval    |       |         |         |            | needed;      |
| and         |       |         |         |            |              |
| Signature   |       |         |         |            | **-** Since  |
|             |       |         |         |            | 12/98:       |
|             |       |         |         |            | Destroy or   |
|             |       |         |         |            | delete when  |
|             |       |         |         |            | 2 years old, |
|             |       |         |         |            | or 2 years   |
|             |       |         |         |            | after the    |
|             |       |         |         |            | date of the  |
|             |       |         |         |            | latest       |
|             |       |         |         |            | entry,       |
|             |       |         |         |            | whichever is |
|             |       |         |         |            | applicable.  |
+-------------+-------+---------+---------+------------+--------------+