<table>
<colgroup>
<col style="width: 3%" />
<col style="width: 1%" />
<col style="width: 45%" />
<col style="width: 1%" />
<col style="width: 6%" />
<col style="width: 15%" />
<col style="width: 20%" />
<col style="width: 1%" />
<col style="width: 0%" />
<col style="width: 1%" />
<col style="width: 1%" />
<col style="width: 1%" />
</colgroup>
<tbody>
<tr class="odd">
<td></td>
<td colspan="4"></td>
<td colspan="3"></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="4"></td>
<td colspan="3"><img src="media/image1.png"
style="width:1.44861in;height:1.42778in" /></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="4"></td>
<td colspan="3"></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="6"><p><strong>Office of the Chief Information
Officer</strong></p>
<p><strong>Office of the Assistant Secretary for Budget, Technology and
Finance</strong></p>
<p><strong>Department of Health and Human Services</strong></p></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="6"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="6"><strong>HHS Policy for Information Technology (IT)
Capital Planning and Investment Control (CPIC)</strong></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="6"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="6"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="7"><strong>December 30, 2005</strong></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="5"></td>
<td colspan="2"></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="5"></td>
<td colspan="2"></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="5"></td>
<td colspan="2"></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="2"><strong>Project:</strong></td>
<td colspan="5">HHS-OCIO IT CPIC Policy</td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td colspan="2"><strong>Document Number:</strong></td>
<td colspan="5">HHS-OCIO-2005-0005.001</td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="odd">
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="4"></td>
<td colspan="2"></td>
<td colspan="2"></td>
</tr>
</tbody>
</table>

**Table of Contents**

[1. Purpose 4](#purpose)

[2. Background 4](#background)

[3. Scope 4](#scope)

[4. Policy 5](#policy)

[4.1 General Policy 5](#general-policy)

[[4.2 CPIC]{.smallcaps} Process 7](#cpic-process)

[4.3 Enterprise Architecture 15](#enterprise-architecture)

[4.4 Privacy and Security 16](#privacy-and-security)

[4.5 IT Strategic Planning 16](#it-strategic-planning)

[4.6 IT Investment Planning 16](#it-investment-planning)

[4.7 IT Investment Funding 18](#it-investment-funding)

[5. Roles and Responsibilities 19](#roles-and-responsibilities)

[5.2 HHS OPDIV Chief Information Officers (CIOs)
20](#hhs-opdiv-chief-information-officers-cios)

[5.3 Deputy Assistant Secretary (DAS) for Finance
20](#deputy-assistant-secretary-das-for-finance)

[5.4 Deputy Assistant Secretary (DAS) for Budget
21](#deputy-assistant-secretary-das-for-budget)

[5.5 Deputy Assistant Secretary (DAS) for Human Resources (HR)
21](#deputy-assistant-secretary-das-for-human-resources-hr)

[5.6 Deputy Assistant Secretary for Acquisition Management and Policy
(DAS AMP)
21](#deputy-assistant-secretary-for-acquisition-management-and-policy-das-amp)

[5.7 Office of National Coordinator for Health Information Technology
(ONC)
22](#office-of-national-coordinator-for-health-information-technology-onc)

[5.8 HHS Chief Enterprise Architect (CEA)
22](#hhs-chief-enterprise-architect-cea)

[5.9 HHS Chief Information Security Officer (CISO)
22](#hhs-chief-information-security-officer-ciso)

[5.10 HHS Capital Planning and Investment Control Officer
22](#hhs-capital-planning-and-investment-control-officer)

[5.11 HHS Chief Technology Officer (CTO)
23](#hhs-chief-technology-officer-cto)

[5.12 HHS/OPDIV Business Sponsor or Functional Manager
23](#hhsopdiv-business-sponsor-or-functional-manager)

[5.13 OPDIV CPIC Managers 23](#opdiv-cpic-managers)

[5.14 HHS/OPDIV IT Investment Managers
23](#hhsopdiv-it-investment-managers)

[5.15 The IT Governance Organization
24](#the-it-governance-organization)

[6. Applicable Policies and Guidance
27](#applicable-policies-and-guidance)

[6.1 Laws 27](#laws)

[6.2 Regulations and Guidance 28](#regulations-and-guidance)

[7. Information and Assistance 30](#information-and-assistance)

[8. Effective Date/Implementation 30](#effective-dateimplementation)

[9. Approved 30](#approved)

#   {#section .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

# 1. Purpose {#purpose .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

This document supersedes "HHS IRM Policy for Capital Planning and
Investment Control," IRM -- 2000-0001, dated January 8, 2001 and its
companion document, "HHS IRM Guide for Capital Planning and Investment
Control," IRM-2000-001-GD, dated January 8, 2001. A complete revision to
the policy, guidance, and responsibilities for performing Information
Technology (IT) Capital Planning and Investment Control (CPIC)
throughout the Department of Health and Human Services (HHS) is provided
herein.

The policies prescribed in this document are consistent with the
statutory and regulatory requirements, executive guidance, and best
practices listed in **Section 6**, **Applicable Policies and Guidance.**
HHS shall comply with the CPIC and IT management policies and guidelines
listed herein.

# 2. Background {#background .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

Investments in IT can dramatically enhance organizational performance.
When carefully managed, IT becomes a critical enabler to improve
business processes, makes information widely available, and reduces the
cost of providing essential Government services. As IT rapidly evolves,
the challenge of realizing its potential benefits also becomes much
greater.

Congress and OMB have clearly stated that each executive agency must
actively manage its IT program to provide assurances that technology
expenditures are necessary and shall result in demonstrated improvements
in mission effectiveness and customer service. The Clinger-Cohen Act
(CCA) of 1996, Public Law 104 -- 106, legislatively mandates that IT
investments be prudently managed.

One key CCA goal is for agencies to develop policies and processes that
implement systems at acceptable costs, within reasonable and expected
time frames, and that contribute to tangible, observable improvements in
mission performance. Therefore, CPIC processes shall be
institutionalized throughout HHS, shall ensure compliance with the HHS
Enterprise Architecture, and shall be used for all IT-related decisions.

# 3. Scope {#scope .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

This policy applies to the Office of the Secretary of Health and Human
Services (OS), including all Staff Divisions (STAFFDIVs), the Office of
the Inspector General, and the Operating Divisions (OPDIVs) (hereinafter
referred to collectively as "HHS OPDIVs"). This policy also applies to
all HHS IT investments throughout their entire investment lifecycle,
regardless of funding source, whether owned and operated by HHS, or
operated on behalf of HHS. This Policy shall be applied in conjunction
with the HHS Enterprise Architecture Policy, HHS Earned Value Management
(EVM) Policy and Procedures, and the HHS CPIC Procedures.

OPDIVs shall use this Policy or may create a more restrictive
OPDIV-specific policy, but not one that is less restrictive or less
comprehensive. The HHS OPDIVs are responsible for preparing implementing
documentation within 120 days of the effective date of this policy and
providing a copy to the HHS Chief Information Officer.

# 4. Policy {#policy .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

The CPIC process is an integrated, structured methodology to managing IT
investments, which ensures that IT investments align with HHS' mission
and support business needs while minimizing risks and maximizing returns
throughout the investment's lifecycle. CPIC uses a systematic selection,
control, and continual evaluation process to ensure that an investment
supports HHS' mission and business needs. This section addresses HHS':

-   General Policy

-   CPIC Process

-   Enterprise Architecture

-   Privacy and Security

-   IT Strategic Planning

-   IT Investment Planning

-   IT Investment Funding

-   IT Acquisition

# 4.1 General Policy {#general-policy .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The HHS CIO has established the following HHS CPIC Policy:

> 4.1.1 HHS IT investments directly support and align with the HHS
> mission and strategic goals and are citizen centered.
>
> 4.1.2 Business processes are reengineered before investing in IT to
> support those processes.
>
> 4.1.3 Priority consideration is given to those IT investments that
> share use of IT across multiple entities within HHS and across other
> agencies. Redundant IT investments within HHS and across other
> agencies shall be minimized.
>
> 4.1.4 In order for an IT investment to be selected for funding in any
> fiscal year, it shall demonstrate a strong business case documenting
> the financial, technical and strategic merits justifying the
> investment. Investments shall:

-   Align with the HHS Enterprise Architecture.

-   Fill a performance gap in HHS ability to meet strategic goals and
    objectives at the lowest life cycle cost among viable alternatives.

-   Have an acceptable business case demonstrating strong project
    management capabilities as well as sound investment planning.

-   Achieve a positive return on investment that is equal to or greater
    than that achievable through alternative use of resources.

-   Provide risk-adjusted cost and schedule goals, and measurable and
    achievable performance goals.

-   Provide a comprehensive risk mitigation and management plan.

-   Ensure security of data and systems.

> 4.1.5 IT investments that meet one or more of the criteria as shown in
> **Figure 1** shall be designated for Department-level review.  All
> other IT investments shall be designated for HHS OPDIV-level review. 
> HHS OPDIVs shall comply with the requirements of this policy for those
> IT investments they review and manage.  The HHS CIO shall review and
> approve HHS OPDIV CPIC processes, as appropriate, to ensure compliance
> with this policy.
>
> **Figure 1: HHS CPIC Review Thresholds**

+------------------+---------------------------------------------------+
| Criteria         | Threshold for Department-Level CPIC Review        |
+------------------+---------------------------------------------------+
| **In             | IT investments that impact more than one HHS      |
| teroperability** | OPDIV through the sharing of data or facilities,  |
|                  | or that impact other systems through outputs and  |
|                  | inputs.                                           |
+------------------+---------------------------------------------------+
| #####            | IT investments for which a single Department-wide |
| ## Cross-cutting | solution may be possible, or for which a          |
|                  | Department-wide team has been established or      |
|                  | planned, or that impacts more than one HHS OPDIV. |
+------------------+---------------------------------------------------+
| **New            | Technology that sets a new technological          |
| Technology**     | direction impacting the "to be" target enterprise |
|                  | architecture for one or more HHS OPDIVs or        |
|                  | Department-wide.                                  |
+------------------+---------------------------------------------------+
| **HHS CIO        | Any IT investment or investment portfolio that    |
| Interest**       | the HHS CIO requests to have reviewed at the      |
|                  | Department-level. Examples are highly visible or  |
|                  | sensitive investments.                            |
+------------------+---------------------------------------------------+
| **Annual costs** | Annual costs, including development,              |
|                  | implementation, operations and maintenance,       |
|                  | independent verification & validation (IV&V),     |
|                  | consulting services, etc. of \$10 million or      |
|                  | more.                                             |
+------------------+---------------------------------------------------+
| **Life cycle     | Full life cycle costs, including development,     |
| costs**          | implementation, operations and maintenance,       |
|                  | independent, verification and validation (IV&V),  |
|                  | consulting services, etc. of \$50 million or      |
|                  | more.                                             |
+------------------+---------------------------------------------------+
| **10% Cost,      | Any IT investment that exceeds its approved cost, |
| Schedule, or     | schedule or performance baselines by more than    |
| Performance      | plus or minus 10% for two consecutive quarters or |
| variance**       | more.                                             |
+------------------+---------------------------------------------------+

4.1.6 All IT investments with development, modernization and enhancement
(DME) activities shall demonstrate satisfactory progress toward
achieving approved cost, schedule and performance goals. All IT
investments with DME activities must apply earned value management (EVM)
policies and procedures, establishing approved baselines and controlling
these baselines such that cost and schedule deviations do not exceed
plus or minus10%. Refer to the HHS EVMS Policy and Procedures for
further details.

> 4.1.7 Each IT investment with steady state activities (includes mixed
> life-cycle investments) shall demonstrate, through operational
> analysis, how close it is to meeting original and current cost,
> schedule and performance goals, whether it continues to meet HHS and
> user requirements, and that the total investment costs for an IT
> investment covers the life cycle and includes all budgetary resources.

4.1.8 HHS shall coordinate its internal IT management, strategic
planning, budgeting, acquisition and human resource functions to meet
the requirements of OMB Circular A-130 and the Clinger-Cohen Act of
1996.

# 4.2 CPIC Process  {#cpic-process .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> This section addresses HHS'

-   CPIC Governance

```{=html}
<!-- -->
```
-   CPIC Process

-   CPIC Phases

> 4.2.1 An IT Governance Structure is established to implement the CPIC
> process and provide review and approval for HHS IT investments. The
> HHS OPDIVs establish and maintain IT Governance Structures to exercise
> IT management authority delegated to them by the HHS CIO. Operational
> Level IT Governance structures shall be consistent with those
> established at the Department Level. **Figures 2** shows an Operating
> Division governance and execution structure that supports the
> Department level organizations. **Figure 3** represents a suggested
> model for working with a large scale and complex portfolio of HHS-wide
> IT investments.
>
> **Figure 2: HHS Governance Structure**
>
> ![](media/image2.wmf){width="4.740972222222222in"
> height="3.551388888888889in"}
>
> **\*Note: The HHS CPIC Team will review investments meeting
> Department-level CPIC review thresholds.**
>
> **Figure 3: Suggested Major Investment Oversight and Governance for
> Large-Scale and Highly Integrated Subportfolios of IT Investments**
> ![](media/image3.wmf){width="4.750694444444444in" height="3.5625in"}
>
> The Department-level IT governance structure consists of:

-   The **HHS Information Technology Investment Review Board (ITIRB)**,
    a cross-functional executive review committee responsible for
    overseeing the management of the HHS IT portfolio, approving and
    prioritizing IT investments to best achieve HHS strategic goals and
    objectives, and leveraging opportunities for collaboration across
    HHS OPDIVs on IT investments that support common lines of business.
    The HHS ITIRB shall ensure that the HHS IT investment portfolio is
    of the highest quality and meets the business needs of the
    Department in the most effective and efficient manner.

```{=html}
<!-- -->
```
-   The **HHS CIO Council,** a cross-OPDIV review committee, comprised
    of the OPDIV CIOs and chaired by the HHS CIO, responsible for
    reviewing the technical and managerial soundness of IT investments
    and providing technical recommendations to the ITIRB.

-   The **HHS CPIC Advisory Board (CPIC-AB)** serves, through the HHS
    Chief Enterprise Architect, as the primary advisory board to the HHS
    CIO and the HHS CIO Council on CPIC policy, procedures, data
    standards, and tool configuration. The CPIC-AB shall be chaired by
    the HHS Capital Planning and Investment Control Officer with
    membership comprised of the HHS Portfolio Management Tool Program
    Manager, a representative from each HHS OPDIV, HHS Critical
    Partners, and a technical representative from the IT Service Center.

-   **HHS CPIC Team,** within the OCIO**,** provides subject matter
    expertise to HHS OPDIVs on IT CPIC and investment portfolio
    management to ensure consistency in meeting the intent of Federal
    and Departmental CPIC policy. The team manages the CPIC process to
    ensure consistency across the Department, and to provide clear
    understanding of process roles, responsibilities, and timing among
    all accountable parties. The HHS CPIC Team also manages, measures
    and improves the CPIC policy, procedures, and tools to promote
    continuous improvement of the CPIC process and its outcomes. The HHS
    CPIC Team coordinates the review and articulation of issues coming
    before the HHS IT Governance Boards; provides guidance to HHS OPDIVs
    on Board-established reporting and presentation requirements for
    Board reviews; and advises the HHS CIO.

-   **HHS CPIC Critical Partners** are responsible for providing input
    to ensure that IT investments comply with HHS policy in the
    respective critical partner functional areas and to advise the HHS
    IT Governance Boards and individual IT investment managers regarding
    functional issues in their areas of expertise. (Refer to Section
    **5. Roles and Responsibilities** for a list of the Critical Partner
    functional areas and representatives.)

-   **Business Steering Committee**, whether at the HHS or OPDIV level,
    reviews and recommends IT investments in its particular business
    area to ensure integration and alignment with HHS business goals and
    objectives, and to ensure that the proposed portfolio of systems in
    that particular business area meets HHS business requirements.  A
    Business Steering Committee looks across the organization and its
    key business functions to determine impacts on other systems,
    business operations, etc.  A Business Steering Committee interfaces
    with business sponsors and investment managers and provides
    recommendations to respective ITIRBs regarding business issues. 
    Members of a Business Steering Committee include key business
    managers from the organization.

> The specific roles and responsibilities of the **Planning and
> Development Committee (PDC)** will be determined at the time the
> Business Steering Committee establishes a PDC. See **Figure 3**
> (above)**.**

-   **Business Sponsor or Functional Manage**r is an HHS business
    official responsible for the strategic business processes under
    development or enhancement and for ensuring their integrity; and
    also serves as the primary user interface to the CIO and ITIRB.

-   A qualified **Investment Manager** shall head an **Integrated
    Project Team (IPT).** The IPT is established by the manager of each
    IT investment with technical and critical partner expertise
    appropriate to the size, complexity and operational requirements of
    the investment. An IPT typically shall consist of representatives
    from the business office, including any applicable subject matter
    experts, technical IT staff, budget, acquisition, security, and EA.
    The Investment Manager shall develop the investment business case in
    conjunction with the Business Sponsor to clearly define and capture
    business need requirements, conduct investment planning to
    adequately define and execute the tasks required to meet approved
    cost, schedule and performance baselines and conform to HHS policies
    that apply to IT investments. Investment Managers shall be
    responsible for timely reporting of significant variances from
    approved baselines and providing corrective action plans or
    rebaselining proposals as appropriate.

> For more details regarding the CPIC governance structure, IT
> Governance Board charters, and specific responsibilities of each
> organization refer to Section **5. Roles and Responsibilities**.
>
> The HHS CIO has established CPIC Policy that:

2.  The CPIC process links mission needs, information, and IT in an
    effective and efficient manner. It includes all stages of capital
    programming, including planning, budgeting, procurement, management,
    and assessment. The CPIC process provides results-oriented IT budget
    justification for IT operational and improvement initiatives in the
    context of HHS missions and operations and integrates, in
    conjunction with the Deputy Assistant Secretary for Budget, the IT
    CPIC process with the overall HHS budget formulation process as
    reflected in **Figure 4** below.

> **Figure 4 -- IT Management and Budget Formulation Calendar**
>
> ![](media/image4.wmf){width="5.75in" height="4.272222222222222in"}
>
> 4.2.3 The CPIC process consists of **three phases** designated by OMB
> as illustrated in **Figure 5.**
>
> **Figure 5: CPIC Phases**
>
> ![](media/image5.png){width="5.375in" height="2.5631944444444446in"}

The **Select phase** lays a solid foundation for success in the
subsequent Control and Evaluate phases. This phase begins with an IT
investment concept and moves through the development of the business
case by the Business Sponsor/Investment Manager, the HHS CIO Council/HHS
ITIRB approval process, and IT investment initiation. All information
required for the HHS CPIC process shall be entered into the HHS IT
Portfolio Management Tool.

During the CPIC **Select phase** each investment's risks and returns are
identified and analyzed before committing funds. IT investments are
selected that best support HHS core mission functions, are consistent
with the HHS Strategic Plan, and comply with the enterprise
architecture. This process is repeated each time funds are allocated to
IT investments, for both new investments at the beginning of their
life-cycle and approved ongoing investments, which shall be subject to
review each year as part of the annual budget process.

During the **Select phase**, the Business Sponsor and the Investment
Manager prepare a Prospectus Summary form in the HHS IT Portfolio
Management Tool, which provides the necessary information to build
support and make funding decisions for an IT investment. The Business
Sponsor and the Investment Manager identify alternative solutions and
develop an order of magnitude estimate of costs and benefits that may be
realized by the investment. Estimated milestones, with associated
schedules and costs, are established. The HHS CIO Council shall
initially screen the IT investment seeking approval using a uniform set
of evaluation criteria and thresholds. The IT investment's business
alignment, benefits, costs, performance, risks, and interoperability
with IT systems, are to be systematically evaluated and prioritized
amongst other investments in the IT portfolio. If the IT investment
meets minimum requirements, the HHS CIO Council shall refer the IT
investment to the HHS ITIRB, advising the HHS ITIRB on the IT
investment's technical soundness and recommending a priority relative to
the remainder of the portfolio.

The HHS ITIRB shall make the final determination regarding which IT
investments will be included in the IT portfolio and either funded or
submitted as a budget request. IT investments not included in the HHS IT
Portfolio remain in the HHS IT Portfolio Management Tool as unfunded
unapproved IT investments available for future consideration by the HHS
CIO Council and HHS ITIRB.

During the **Control phase**, an IT investment moves from requirements
definition to implementation. All IT investments in the investment
portfolio shall be consistently controlled (monitored and managed) by
the Investment Manager to maximize value, mitigate risks, ensure
successful results, and to take corrective action when necessary.

During the **Control phase**, the Investment Manager follows established
milestones and reviews schedules, as well as utilizes an oversight
mechanism to systematically evaluate and ensure the continuing security,
interoperability and availability of the investment's system and data.
The Investment Manager participates in two types of reviews:

1.  Periodic control reviews assess the IT investment's progress against
    approved baselines, typically on a quarterly basis. The review's
    purpose is to ensure that on-going IT investment status, progress,
    and outlook are satisfactory and consistent with approved investment
    baselines; identify deficiencies in investment management and
    monitor corrective actions; provide recommendations to the HHS CIO
    Council and HHS ITIRB to support their decision to continue, reduce,
    terminate, or defer IT investments; review investment status,
    control, performance, risk and outlook for approved and funded IT
    investments; and establish and execute the necessary project
    controls to manage requirements, risk, cost, and schedule baselines,
    and performance outcomes.

2.  Milestone reviews typically take place near the end of each System
    Development Life Cycle phase or when changes to approved investment
    baselines are anticipated. Milestone reviews confirm the IT
    investment's strategic alignment; the appropriateness of current
    cost, schedule, and performance baselines; and the readiness of the
    investment to proceed to the next phase based on meeting established
    baselines and exit criteria for the current phase. The review may
    re-evaluate the investment's business case. The HHS ITIRB will
    determine whether to continue an IT investment with the current
    baselines (with corrective action plans, if necessary), approve
    re-baselining, or terminate the IT investment.

These reviews ensure that an adequate risk management strategy has been
developed and followed, financial management systems conform to Circular
A-127 and ensure continued compliance with the HHS Enterprise
Architecture.

The CPIC **Control phase** uses performance measures and management
processes to monitor actual versus expected results of each IT
investment. An EVM system measures progress against milestones on an
independently verifiable basis

For IT investments that meet the Department threshold for review,
Investment Managers shall submit the EVM Performance Measurement
Baseline (PMB) and any changes to the PMB to the HHS ITIRB for review
and approval. For investments that do not meet the Departmental
threshold for review, Investment Managers shall submit the EVM PMB and
any changes to the PMB to the OPDIV ITIRB for review and approval.
Submissions shall address the rationale and driving factors leading to
the new investment EVM PMB or any changed PMB. Any new investment EVM
PMB or PMB changes approved by the HHS ITIRB will be forwarded to OMB
for final approval. Any new investment EVM PMB or PMB changes approved
by the OPDIV ITIRB will be forwarded to the Department, as part of the
CPIC process, for final approval.

> For more details regarding the CPIC governance structure, IT
> Governance Board charters, and specific responsibilities of each
> individual and organization refer to Section **5. Roles and
> Responsibilities**.
>
> The CPIC **Evaluate phase** begins once system implementation, or a
> significant portion of the system when conducting a phased
> implementation, has been completed and the system becomes operational
> or goes into production.

The CPIC **Evaluate phase** consists of two activities:

1.  The Investment Manager shall conduct a Post Implementation Review
    (PIR) following each IT investment or useful segment's
    implementation. The Investment Manager shall evaluate actual
    investment cost, schedule and performance against original and
    latest baselines and level of stakeholder and customer satisfaction.
    A PIR determines the system's efficiency and effectiveness in
    meeting performance and financial objectives. It documents lessons
    learned from the PIR and updates CPIC and enterprise architecture
    processes as needed.

> The Investment Manager shall conduct a PIR for any IT investment
> cancelled before going into operation. During this review, results
> from the PIR are fed back to the Select and Control phases as lessons
> learned and actual versus expected results are compared. This is done
> to (1) assess the IT investment's impact on mission performance, (2)
> identify any changes or modifications to the IT investment that may be
> needed, and (3) revise the investment management process based on
> lessons learned.

2.  The Investment Manager shall conduct an operational analysis
    annually for each steady state IT investment. The operational
    analysis shall formally assess how well an investment is meeting
    program objectives, customer needs, and is performing within
    baseline cost, schedule, and performance goals. The results may
    signal to management the need to continue, enhance, or terminate the
    investment.

# 4.3 Enterprise Architecture {#enterprise-architecture .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The HHS CIO has established the policy that:

> Alignment with the HHS Enterprise Architecture (EA) is a critical step
> in the review and evaluation of investments through the HHS CPIC
> process. The HHS Chief Enterprise Architect, through the EA Critical
> Partner Role, will ensure that the HHS Enterprise Architecture Program
> supports, augments, and reinforces the HHS CPIC process to ensure
> achievement of the mission, strategic and operational business needs
> of HHS. Refer to the HHS Enterprise Architecture Policy for a
> description of the HHS Enterprise Architecture Program.
>
> Based on the Federal Enterprise Architecture (FEA), HHS has developed
> an architecture framework as a logical structure for organizing
> complex information about an enterprise. This information includes the
> enterprise's business processes, participants, the hardware and
> software systems that support those processes and partici­pants, and
> the rules and constraints under which the enterprise operates. The HHS
> Enterprise Architecture framework helps HHS organize and present
> aspects of its architecture in a way that is understandable by all
> participants in the enterprise and by those outside the enterprise
> with which they must interact.
>
> The HHS Enterprise Architecture (EA) enables HHS to:

-   Analyze business processes to take advantage of standardization
    based on common functions to customers.

-   Ensure that automated systems optimally support the business
    processes and minimize the data collection burden.

-   Acquire new systems and coordinate technology investments with the
    Federal business systems and architecture.

-   Facilitate IT Capital Planning and Investment Control and coordinate
    information technology investments.

The HHS EA supports the HHS CPIC process by defining a target direction
for future IT investments, as well as facilitating IT investment
decision-making. The HHS EA process provides checkpoints during the life
cycle of the IT investment and manages the technical standards
comprising the target technical architecture. The goal is to ensure that
an IT investment provides demonstrable alignment with the HHS business
processes and technological architecture.

As the HHS EA matures, the two functions, EA and CPIC, continue to
interact. The HHS EA development function creates enterprise
architecture and the processes guiding the CPIC functions. The CPIC
function, in turn, yields information that guides changes to the HHS EA.
The architecture alignment and assessment process provide the mechanism
to integrate the functions.

# 4.4 Privacy and Security {#privacy-and-security .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> Privacy and security of data are important elements of planning,
> acquisition, and management of Federal information technology systems.
> The E-Government Act of 2002 and the Federal Information Security
> Management Act (FISMA) assign significant privacy and security
> responsibilities to Federal information technology system operators.
> The E-Government Act establishes requirements for conducting Privacy
> Impact Assessments (PIAs) before developing or procuring IT systems or
> IT investments. FISMA requires integration of IT security into the
> capital planning and enterprise architecture processes, annual IT
> security reviews of all programs and systems, and reporting the
> results of those reviews to OMB.
>
> IT privacy and security is an explicit part of the CPIC process. All
> IT investments must demonstrate that costs for appropriate IT privacy
> and security controls are explicitly incorporated into the life cycle
> planning of all systems. Cost effective security of HHS information
> systems must be an integral component of business operations.
>
> IT security is part of the business case criteria for the review and
> evaluation of investments through the CPIC process. Each business case
> shall include costs associated with all aspects of security program
> expenses that would normally occur. For example: ongoing cyclical
> Certification and Accreditation (C&A), risk identification &
> mitigation activities, and day-to-day investment level security
> operations activities.
>
> Investment managers need to address IT security threats and
> vulnerabilities early in the life cycle when the cost of implementing
> security controls and practices are relatively low and convenient to
> budget and schedule. Moreover, adherence to security-based software
> development practices will prevent deficiencies, rather than implement
> them after the fact. The cost to remediate a security weakness
> increases exponentially as an investment moves through the life cycle.

# 4.5 IT Strategic Planning {#it-strategic-planning .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The HHS CIO has established the policy that:

-   HHS IT investments shall align with the HHS and HHS IT Strategic
    Plans and their respective mission and goals. This alignment shall
    be articulated by all new and ongoing IT investments within their
    business case documentation. Refer to the HHS and HHS IT Strategic
    Plans for specifics. (Located on the HHS Intranet website:
    [www.hhs.gov](http://www.hhs.gov/))

# 4.6 IT Investment Planning {#it-investment-planning .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The HHS CIO has established the policy that:
>
> IT investments shall address a specific performance gap or business
> need and link to and support the President's Management Agenda, the
> HHS Strategic Plan and the HHS IT Strategic Plan. IT investment
> planning shall be conducted as an integral element of managing the IT
> investment throughout its life cycle. IT investments are categorized
> as Major, Tactical, or Supporting based on the criteria shown in
> **Figure 6**. Each IT investment shall prepare a business case, and
> perform planning activities and develop documentation and management
> requirements, as appropriate for the investment's category, size and
> complexity.
>
> **Figure 6: IT Investment Categories**

+---------------+-----------------+------------------+-----------------+
| **IT          | **Budget Year   | **Life-cycle     | **Other         |
| Investment    | Cost**          | Cost** (See Note | Factors**       |
| Type**        |                 | 4)               |                 |
+---------------+-----------------+------------------+-----------------+
| **Major**     | [\>]{.          | [\>]{            | Designated by   |
|               | underline}\$10M | .underline}\$50M | the HHS CIO as  |
| See Note 1    |                 |                  | critical.       |
|               | Is for          |                  |                 |
|               | Financial       |                  |                 |
|               | Management and  |                  |                 |
|               | obligates       |                  |                 |
|               | [               |                  |                 |
|               | \>]{.underline} |                  |                 |
|               | \$500K annually |                  |                 |
+---------------+-----------------+------------------+-----------------+
| **Tactical**  | [\>]{           | N/A              | Designated by   |
|               | .underline}\$3M |                  | the HHS CIO as  |
| See Note 2    | and \<\$10M     |                  | significant.    |
+---------------+-----------------+------------------+-----------------+
| *             | \<\$3M          |                  | Designated by   |
| *Supporting** |                 |                  | the HHS CIO as  |
|               |                 | N/A              | supporting IT   |
| See Note 3    |                 |                  | investments.    |
|               |                 |                  |                 |
+---------------+-----------------+------------------+-----------------+

> Notes:
>
> 1\. Major IT investments are defined as those HHS IT investments that:

-   Have total planned outlays (i.e., DME and Steady State) of \$10
    million or more in the budget year.

-   Are for financial management and obligate more than \$500,000
    annually.

-   Are otherwise designated by the HHS CIO as critical to the HHS
    mission or to the administration of HHS programs, finances, property
    or other resources.

-   Have life-cycle costs exceeding \$50 million.

> 2\. Tactical IT investments are defined as those IT investments that
> have not been designated as major IT investments and:

-   Have planned total outlays (i.e., DME and Steady State) of \$3
    million or more in the budget year.

-   Are otherwise designated by the HHS CIO as significant to the HHS
    mission or to the administration of HHS programs, finances, property
    or other resources.

> 3\. Supporting IT investments are those IT investments not otherwise
> designated as major or tactical that:

-   Have planned total outlays (i.e., DME and Steady State) of less than
    \$3 million in the budget year.

-   Have been designated by the HHS CIO as supporting IT investments.

> 4\. Life cycle cost is defined as all costs relating to an investment
> from initial planning to projected operational costs in the out-years
> throughout the expected lifetime of the investment.

# 4.7 IT Investment Funding  {#it-investment-funding .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The HHS CIO has established the policy that:
>
> 4.7.1 HHS OPDIVs request appropriations for the full costs of IT
> investment acquisitions to ensure that all costs and benefits are
> fully considered when decisions are made. Each useful segment of
> approved IT investments shall be fully funded with either regular
> annual appropriations or advance appropriations. Full budgetary
> resources shall be requested for all ongoing and new proposals, or at
> least for each useful segment.
>
> 4.7.2 Acquisitions using Share-in-Savings authority of Section 210 of
> the E-Government Act of 2002 shall be funded from funds that would
> have been appropriated for legacy system operations and maintenance.

**4.8 IT Acquisition**

> The HHS CIO has established the policy that:
>
> 4.8.1 The primary purpose of IT investment acquisition-related
> activities is to support the execution of the investment decisions
> that are made by the ITIRB.
>
> 4.8.2 IT investment acquisitions use competition to the greatest
> practical extent to provide the best value to the Government and to
> properly allocate risk between the Government and the contractor. The
> availability and impact of alternative investment strategies and
> funding shall be thoroughly examined, to include the assurance that no
> existing private sector or government source is already capable of
> adequately meeting the need.
>
> 4.8.3 IT investment acquisitions will consider the value proposition
> provided through compliance with the enterprise architecture to
> maximize the value of previous acquisitions, minimize redundant
> acquisitions, eliminate unnecessary transition costs to non-compliant
> technologies, and leverage investments in training and staffing that
> have previously been made.
>
> 4.8.4 The IT investment shall structure the acquisition into useful
> segments and shall support simplified or otherwise redesigned work
> processes to minimize cost, improve effectiveness, and use commercial
> off-the-shelf (COTS) software unless custom software is cost-effective
> as documented through pilot projects or prototypes.
>
> 4.8.5 Acquisition plans shall be developed that reflect cost and
> schedule milestones and change as the baselines are adjusted, with
> inputs from all HHS plans, and that contain outputs that feed into the
> budget and CPIC processes. The plans shall also link resources to
> results through performance and earned value management, and build
> from the current enterprise architecture and transition to the target
> architecture.

4.8.6 The use of prototypes or pilots shall be considered for large
expensive IT investments where there is major uncertainty about proposed
processes, procedures, or supporting information. Where prototypes are
acquired as part of the planning process, prototypes must be reported as
full acquisitions.

> 4.8.7 Accessibility in accordance with the Workforce Investment Act of
> 1998, Section 508 shall be addressed.
>
> 4.8.8 IT investments under consideration shall maximize the
> usefulness, minimize the reporting burden and adequately protect the
> confidentiality of information.
>
> 4.8.9 The prerogatives of state, local and tribal governments shall
> not be unnecessarily restricted.

# 5. Roles and Responsibilities {#roles-and-responsibilities .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

5.1 HHS Chief Information Officer (CIO)

The **HHS Chief Information Officer (CIO)** is responsible for:

-   Establishing an effective Department CPIC program.

```{=html}
<!-- -->
```
-   Developing HHS policy and procedures for timely IT acquisition.

-   Ensuring that HHS:

    -   Cooperates with other agencies in the use of IT.

    -   Promotes coordinated government infrastructure supported by a
        diversity of private suppliers.

    -   Promotes effective and efficient IT capital planning in
        accordance with OMB Circular A-11.

    -   Provides IT budget data to OMB in accordance with OMB Circular
        A-11.

    -   Permits maximum use of HHS IT contracts by other agencies.

-   Being an active participant in all HHS strategic management
    activities, including HHS strategic and operational planning.

-   Advising the Assistant Secretary for Budget, Technology and Finance
    (ASBTF) on:

    -   The information technology implications of strategic planning
        decisions.

    -   Continuing, modernizing, or terminating IT investments.

    -   Budget implications of IT decisions.

-   Being an active participant throughout the HHS budget process in
    establishing HHS IT investment priorities.

-   Chairing the Department ITIRB and CIO Council.

-   Ensuring that the overall IT investment portfolio adheres to the
    mandates laid out in statutes and directives, including the
    Clinger-Cohen Act, OMB Circular A-11, and FISMA.

-   Providing oversight for all individual IT investments requiring
    Department-level CPIC review.

-   Working in conjunction with the Deputy Assistant Secretary for Human
    Resources and the Deputy Assistant Secretary for Acquisition
    Management and Policy, establishing criteria for the professional
    certification of IT Project Managers

-   Reviewing and approving HHS OPDIV CPIC processes to ensure
    compliance with Department CPIC policy and to identify investments
    requiring Departmental CPIC oversight.

# 5.2 HHS OPDIV Chief Information Officers (CIOs) {#hhs-opdiv-chief-information-officers-cios .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

Each **HHS OPDIV Chief Information Officer (CIO)** is responsible for:

-   Establishing and maintaining an effective OPDIV CPIC program.

-   Identifying HHS OPDIV IT investments that meet Departmental ITIRB
    review criteria.

-   Prioritizing the HHS OPDIV IT investment portfolio to maximize the
    return on the IT resource investment against HHS OPDIV mission and
    goals, and advising the HHS CIO regarding relative priorities among
    HHS OPDIV IT investments.

-   Providing oversight for all individual IT investments requiring HHS
    OPDIV-level CPIC review.

-   Reviewing and approving sub-HHS OPDIV CPIC processes to ensure
    compliance with Department and HHS OPDIV CPIC policy.

-   Serving as a member of the Department CIO Council and ITIRB.

# 5.3 Deputy Assistant Secretary (DAS) for Finance {#deputy-assistant-secretary-das-for-finance .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **Deputy Assistant Secretary (DAS) for Finance** is responsible for:

-   Serving as a member of the Department ITIRB.

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department ITIRB to ensure financial management
    implications are properly addressed.

-   Ensuring IT investments that have financial management components or
    interact with financial systems are in compliance with financial
    standards and regulations.

-   Assigning resources for CPIC critical partner support for Finance.

-   Providing guidance to IT investment managers regarding financial
    management policies and issues.

# 5.4 Deputy Assistant Secretary (DAS) for Budget  {#deputy-assistant-secretary-das-for-budget .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **Deputy Assistant Secretary (DAS) for Budget** is responsible for:

-   Serving as a member of the Department ITIRB.

-   Providing budget guidance to the HHS CIO suitable to guide CPIC
    activities in support of budget formulation.

-   Notifying the HHS CIO of all Department budget decisions affecting
    IT investments.

-   Providing OMB passback guidance, appeals and results to the HHS CIO.

-   Assigning resources for CPIC critical partner support for Budget.

-   Providing guidance to IT investment managers regarding budget policy
    and issues.

-   Considering prioritized IT investment portfolio information in
    making budget formulation decisions.

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department ITIRB to address budget-related issues.

# 5.5 Deputy Assistant Secretary (DAS) for Human Resources (HR) {#deputy-assistant-secretary-das-for-human-resources-hr .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **Deputy Assistant Secretary (DAS) for Human Resources (HR)** is
responsible for:

-   Serving as a member of the Department ITIRB.

-   Assigning resources for CPIC critical partner support for Human
    Resources.

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department ITIRB to address the human resource and union
    issues that may affect an investment's progress and implementation.

-   Providing guidance to IT investment managers regarding
    human-resource policy and issues.

# 5.6 Deputy Assistant Secretary for Acquisition Management and Policy (DAS AMP) {#deputy-assistant-secretary-for-acquisition-management-and-policy-das-amp .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The **Deputy Assistant Secretary (DAS) for Acquisition Management &
> Policy (AMP)** is responsible for:

-   Serving as a member of the Department ITIRB.

-   Assigning resources for CPIC critical partner support for
    Acquisition Management.

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department ITIRB for conformance with the Federal
    Acquisition Regulation, Department acquisition policies and
    procedures, and successful business practices.

-   Working closely with HHS OPDIV contracting and program offices to
    develop and implement effective acquisition strategies and policies
    for IT investments.

# 5.7 Office of National Coordinator for Health Information Technology (ONC) {#office-of-national-coordinator-for-health-information-technology-onc .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The **Office of National Coordinator for Health Information Technology
> (ONC)** is responsible for:

-   Developing and implementing a comprehensive HHS strategy for health
    care information technology standards.

-   Reviewing alignment of HHS IT investments to IT health care
    standards.

# 5.8 HHS Chief Enterprise Architect (CEA) {#hhs-chief-enterprise-architect-cea .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **HHS Chief Enterprise Architect (CEA)** is responsible for:

-   Assigning resources for CPIC critical partner support for Enterprise
    Architecture.

-   Providing guidance to IT investment managers regarding EA policy and
    issues.

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department IT governance boards for FEA alignment and
    conformance with Department architectural policy and standards
    (e.g., hardware, software, telecommunications and data).

# 5.9 HHS Chief Information Security Officer (CISO) {#hhs-chief-information-security-officer-ciso .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **HHS Chief Information Security Officer (CISO)** is responsible
for:

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department IT governance boards to ensure they are
    compliant with Department security and privacy policy and standards.

-   Providing guidance to IT investment managers regarding security and
    privacy policy and issues.

-   Assigning resources for CPIC critical partner support for
    Information Security and Privacy.

# 5.10 HHS Capital Planning and Investment Control Officer {#hhs-capital-planning-and-investment-control-officer .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The **HHS Capital Planning and Investment Control Officer** is
> responsible for:

-   Maintaining an effective Department CPIC program.

-   Chairing the HHS CPIC Advisory Board.

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department IT governance boards to ensure compliance with
    CPIC policies and procedures.

-   Coordinating the review by CPIC Critical Partners and Department CIO
    Council and ITIRB members of matters coming before the CIO Council
    and ITIRB.

-   Providing guidance to IT investment managers regarding CPIC policy
    and issues.

# 5.11 HHS Chief Technology Officer (CTO) {#hhs-chief-technology-officer-cto .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **HHS Chief Technology Officer (CTO)** is responsible for:

-   Reviewing IT investment business cases and CPIC reports coming
    before the Department governance boards to ensure that optimal
    technical solutions are pursued.

-   Providing guidance to IT investment managers regarding technical
    solutions and alternatives.

# 5.12 HHS/OPDIV Business Sponsor or Functional Manager {#hhsopdiv-business-sponsor-or-functional-manager .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **HHS/OPDIV Business Sponsor or Functional Manager** is responsible
for:

-   Ensuring the integrity of the strategic business processes under
    development or enhancement.

-   Serving as the primary user interface to the CIO and ITIRB.

# 5.13 OPDIV CPIC Managers {#opdiv-cpic-managers .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **OPDIV CPIC Managers** are responsible for:

-   Ensuring effective implementation of CPIC policy and procedures
    within the OPDIV

-   Serving as a member of the HHS CPIC Advisory Board.

-   Reviewing IT investment business cases and CPIC reports coming
    before the OPDIV IT governance boards to ensure compliance with CPIC
    policies and procedures.

-   Coordinating the review by OPDIV CPIC Critical Partners and OPDIV
    TRB and ITIRB members of matters coming before the HHS CIO Council
    and ITIRB.

```{=html}
<!-- -->
```
-   Providing guidance to OPDIV IT investment managers regarding CPIC
    policy and issues.

-   Obtain, document, and demonstrate the levels of experience and
    training appropriate for the type and size of investment being led.

# 5.14 HHS/OPDIV IT Investment Managers {#hhsopdiv-it-investment-managers .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The **HHS/OPDIV IT Investment Managers** shall:

-   Comply with the requirements of this policy for IT investment
    planning and management.

-   Provide investment data and reports as required by the HHS CPIC
    process.

-   Plan, organize, control, and lead an IT investment to successful
    completion by accomplishing approved cost, time, and performance
    baselines.

-   Develop and implement information systems security plans.

-   Coordinate and integrate IT investment activities.

-   Monitor IT investment activities to mitigate risk

-   Implement and maintain quality assurance processes appropriate to
    the size and complexity of the investment.

-   Participate in control (periodic and milestone) and evaluate phase
    IT investment reviews.

-   Report on a timely basis any significant anticipated baseline
    variation along with a Corrective Action Plan (CAP) or rebaselining
    proposal, as appropriate.

```{=html}
<!-- -->
```
-   Execute investments and make investment tradeoff decisions among
    critical constraints such as scope, cost, schedule and policy needs.

-   Ensure investment data is accurate and timely to enable effective
    portfolio decisions and tradeoffs to be made at the HHS OPDIV and
    Department levels.

-   Follow CPIC processes and timelines by executing the procedures in a
    timely manner to ensure that all CPIC process milestones are met.

-   Ensure that the appropriate EVM rigor, based on the EVM Tier
    categorization of the investment, is integrated into the management
    of the investment.

# 5.15 The IT Governance Organization {#the-it-governance-organization .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

> The **IT governance organization** described in this section refers to
> the HHS Departmental organization. Each HHS OPDIV shall establish and
> maintain IT governance structures consistent with those established at
> the Department level to exercise IT management authority delegated to
> them in accordance with HHS CIO policy.

5.15.1 The HHS **Information Technology Investment Review Board
(ITIRB)** shall:

-   Be chaired by the HHS CIO with membership comprised of the HHS
    Deputy Assistant Secretaries for Budget, Finance, Acquisition
    Management and Policy, and Human Resources and the HHS OPDIV CIOs.

-   Give business approval (including funding level and source) for IT
    investments for which the HHS ITIRB has CPIC review authority.

-   Approve cost, schedule and performance baselines for all HHS IT
    investments approved by the HHS ITIRB.

-   Ensure that the Department's IT investments individually and
    collectively maximize mission and financial returns.

-   Establish a prioritized HHS IT investment portfolio during each
    annual budget cycle to support HHS budget formulation.

-   Ensure that each IT investment requiring Department-level review
    complies with CPIC and other management policies (e.g., IT,
    financial, acquisition, enterprise architecture, and security).

-   Recommend changes to Department policies relevant to IT investment
    management.

-   Approve exceptions to established CPIC policy and procedure.

5.15.2 **Business Steering Committee** membership consists of key
business managers from HHS. Steering Committee shall:

-   Review and recommend IT investments that ensure integration and
    alignment with HHS business goals and objectives

-   Ensure that the proposed portfolio of systems in their particular
    business domain area meets HHS business requirements.

-   Look across the organization and its key business functions to
    determine impacts on other systems, business operations, etc.

-   Interface with business sponsors and investment managers

-   Provide recommendations to the ITIRB regarding business issues.

5.15.3 The **HHS CIO Council** shall advise the ITIRB regarding the
technical soundness of HHS IT investments requiring Departmental review.
The HHS CIO Council shall:

-   Be chaired by the HHS CIO with membership comprised of all HHS OPDIV
    CIOs.

-   Review the technical approach of individual IT investments coming
    before the ITIRB and make recommendations to the ITIRB regarding
    technical aspects of affordability, soundness of design, risk, and
    compliance with architectural and security standards.

-   Review the IT investment planning and/or status of each individual
    IT investment coming before the ITIRB to ensure that the
    investment's business case, IT investment plan, alternatives
    analysis and other IT investment documentation are complete,
    accurate and in compliance with Department policies and standards.
    Recommend approval or non-approval to the ITIRB with comments.

-   Recommend a prioritized portfolio to the ITIRB during the budget
    formulation cycle and upon request of the ITIRB.

5.15.4 The HHS CPIC **Advisory Board (CPIC-AB)** shall serve, through
the HHS Chief Enterprise Architect, as the primary advisory board to the
HHS Chief Information Officer (CIO) and the HHS CIO Council on CPIC
policy, procedures, data standards and tool configuration. The CPIC-AB
shall be chaired by the HHS IT Capital Planning and Investment Control
Officer with membership comprised of the PMT Program Manager, a
representative from each HHS OPDIV and a technical representative from
the IT Service Center. The CPIC-AB shall perform the following
functions:

-   Provide recommendations to ensure the continued viability,
    integration and maximum return on investment of all aspects of the
    HHS Enterprise-wide CPIC program and its supporting HHS Portfolio
    Management Tool.

-   Assess the viability and impact of all proposals, change requests
    and enhancements across HHS OPDIVs related to CPIC policy,
    procedures, and data standards.

-   Review and evaluate all proposals, change requests and enhancements
    related to the acquisition, implementation, operation, and data
    standards of the HHS Portfolio Management Tool.

-   Establish and monitor Memoranda of Understanding with any HHS OPDIVs
    that acquire or operate separate instances of portfolio or IT
    investment management applications, or otherwise interface with the
    HHS Portfolio Management Tool.

> 5.15.5 The HHS CPIC **Critical Partners** shall participate within the
> CPIC process to ensure that IT investments comply with HHS policy in
> the respective critical partner functional areas and to advise the HHS
> IT Governance Boards and individual IT investment managers regarding
> issues relating to their specific functional areas. Critical Partners
> are Subject Matter Experts from the following functional areas:

-   **Enterprise Architecture** ensures FEA alignment and conformance
    with Department architectural policy and standards (e.g., hardware,
    software, telecommunications and data).

-   **Security and Privacy** ensures full compliance with all HHS
    security and privacy policies and standards.

-   **Acquisition Management** ensures that IT investments conform to
    the Federal Acquisition Regulation (FAR), Department acquisition
    policies and procedures, successful business practices, and the
    development and implementation of effective acquisition strategies
    and policies for IT investments

-   **Finance** ensures financial management implications are properly
    addressed and IT investments that have financial management
    components or interact with financial systems are in compliance with
    financial standards and regulations.

-   **Budget** guides CPIC activities in support of budget formulation.
    It also considers prioritized IT investment portfolio information in
    making budget formulation decisions, as well as addresses
    budget-related issues and decisions affecting IT investments,
    including OMB passback guidance, appeals and results.

-   **Human Resources** addresses the human resource and union issues
    that may affect an investment's progress and implementation, and
    provides guidance to IT investment managers regarding human-resource
    policy and issues.

> These functional areas are represented, respectively, by the:

-   HHS Chief Enterprise Architect,

-   HHS Chief Security Officer,

-   Deputy Assistant Secretary for Acquisition Management & Policy,

-   Deputy Assistant Secretary for Finance,

-   Deputy Assistant Secretary for Budget,

-   Deputy Assistant Secretary for Human Resources,

# 6. Applicable Policies and Guidance {#applicable-policies-and-guidance .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

# 6.1 Laws  {#laws .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **Chief Financial Officers (CFO) Act of 1990** establishes a
leadership structure, provides for long-range planning, requires audited
financial statements, and strengthens accountability reporting.

The **Government Performance and Results Act of 1993 (GPRA - 1993)**
establishes the foundation for budget decision-making to achieve
strategic goals in order to meet agency mission objectives.

The **Federal Acquisition Streamlining Act of 1994, Title V (FASA V)
(1994)** requires agencies to establish cost, schedule, and measurable
performance goals for all major acquisition programs, and achieve on
average 90 percent of those goals. OMB policy for performance-based
management is also provided in this section. If an IT investment falls
out of tolerance (failure to meet 90 percent of cost, schedule, or
performance goals), FASA gives the Agency head the authority to review,
and if necessary, terminate the IT investment.

The **Paperwork Reduction Act of 1995 (PRA)** requires that agencies
perform their information resource management activities in an
efficient, effective, and economical manner.

The **Federal Financial Management Improvement Act (FFMIA) of 1996**
provides consistency of accounting by agencies from one fiscal year to
the next and establishes uniform accounting standards throughout the
Federal Government.

The **Clinger-Cohen Act of 1996 (CCA)** requires agencies to use a
disciplined capital planning and investment control (CPIC) process to
acquire, use, maintain, and dispose of information technology. OMB
policy for management of federal information resources is contained in
Circular A--130, Management of Federal Information Resources, and
section 53 of A-11. The purpose of the CCA is to improve the
productivity, efficiency, and effectiveness of federal programs though
improved acquisition, use, and disposal of IT resources.

The **Government Paperwork Elimination Act of 1998** develops procedures
for the use and acceptance of electronic signatures by executive
agencies.

The **Workforce Investment Act of 1998, Section 508** requires agencies
to give disabled employees and members of the public access to
information that is comparable to the access available to others.

The **Federal Information Security Management Act (FISMA - 2002)**
requires agencies to integrate IT security into their capital planning
and enterprise architecture processes at the agency, conduct annual IT
security reviews of all programs and systems, and report the results of
those reviews to OMB.

The **E-Government Act of 2002 (P.L. 107-347)** requires agencies to
develop performance measures for implementing E-Government. The Act also
requires agencies to support Government-wide E-Government initiatives
and to leverage cross-agency opportunities to further E-Government. In
addition, the Act requires agencies to conduct and submit to OMB,
Privacy Impact Assessments for all new IT investments administering
information in identifiable form collected from or about members of the
public.

# 6.2 Regulations and Guidance  {#regulations-and-guidance .Style-Heading-1-+-Times-New-Roman-Top:-(Single-solid-line-Auto--...}

The **President\'s Management Agenda** addresses Strategic Management of
Human Capital, Competitive Sourcing, Improved Financial Performance,
Expanded Electronic Government, Budget, and Performance Integration.

**Executive Order 13011 (1996)** highlights the need for executive
agencies to significantly improve the management of their information
systems.

**[\<\<]{.mark}NIST SP 800-12, An Introduction to Computer Security: The
NIST Handbook.**

**NIST SP 800-16, Information Technology Security Training Requirements:
A Role-and Performance-Based Model.**

**NIST SP 800-26 Revision 1, Security Self-Assessment Guide for
Information Technology Systems.**

**NIST SP 800-53, Recommended Security Controls for Federal Information
Systems.**

**NIST SP 800-64, Security Considerations in the Information System
Security Development Life Cycle**, guides the selection and acquisition
of cost-effective security controls during the appropriate phases of the
SDLC.

**OMB Circular A-11, Preparing and Submitting Budget Estimates**,
instructs agencies on the preparation of budget submissions.

**OMB Circular A-11, Part 7 - Capital Planning Budget Reporting,
Exhibits 52, 5 and 300B,** provides guidance on the principles and
techniques for effective capital programming. The Capital Programming
Guide integrates the various Administration and statutory asset
management initiatives (including GPRA, Clinger/Cohen Act, FASA, and
others) into a single, integrated capital programming process to ensure
that capital assets contribute to the achievement of agency strategic
goals and objectives.

**OMB Circular A-76, Performance of Commercial Activities,** requires
that activities performed by the Federal government that are identified
as commercial in nature will be subject to competition.

**OMB Circular A-94, Guidelines and Discount Rates for Benefit-Cost
Analysis of Federal Programs**, provides general guidance for conducting
benefit-cost and cost effectiveness analyses and specific guidance on
the discount rates to be used in evaluating Federal programs whose
benefits and costs are distributed over time.

**OMB Circular A-109, Major Systems Acquisitions**, establishes policies
for acquiring major systems. Major systems are defined as those programs
that are critical to fulfilling an Agency mission, entail the allocation
of relatively large resources, and warrant special management attention.

**OMB Circular A-123, Management Accountability and Control**, provides
guidance to Federal managers on improving the accountability and
effectiveness of Federal programs and operations by establishing,
assessing, correcting, and reporting on management controls.

**OMB Circular A-127, Financial Management Systems**, prescribes
policies and standards for executive departments and agencies to follow
in developing, operating, evaluating, and reporting on financial
management systems.

**Circular A-130, Management of Federal Information Resources**,
establishes policies for the management of federal information resources
to include procedural and analytical guidelines for implementing
specific aspects of the circular.

**OMB Circular A--130, Section 8b**, establishes additional requirements
for enterprise architectures, planning and control of information
systems and technology investments and performance management. Agencies
must develop, implement, and use a capital programming process to
develop their capital asset portfolio.

**OMB Memorandum M-97-02, Funding Information Systems Investments**,
dated October 25, 1996, establishes the decision criteria with respect
to the evaluation of major information system investments.

**OMB Memorandum M-00-07, Incorporating and Funding Security in
Information Systems Investments**, dated February 28, 2000, reminds
agencies of OMB's principles for incorporating and funding security as
part of agency information technology systems and architectures and of
the decision criteria that will be used to evaluate security for
information systems investments.

**OMB Memorandum, M-03-22, OMB Guidance for Implementing the Privacy
Provisions of the E-Government Act of 2002**, dated September 30, 2003,
provides guidance on implementing the privacy provisions of the
E-Government Act of 2002.

**OMB Memorandum M-04-19, Information Technology (IT) Project Management
(PM) Qualification Guidance**, dated July 21, 2004, identifies IT
investment systems requiring qualified Project Managers and requirements
for certification of Project Managers.

**OMB Memorandum, M-04-24, Expanded Electronic Government (E-Gov)
President's Management Agenda (PMA) Scorecard Cost, Schedule and
Performance Standard for Success,** dated August 23, 2004, provides
additional information on the President's Management Agenda (PMA)
Expanded Electronic Government (E-Gov) initiative and the standard for
success concerning cost.

**OMB Memorandum M-04-25, FY 2004 Reporting Instructions for the Federal
Information Security Management Act**, dated August 23, 2004, describes
the integration of security and capital planning through the plan of
action and milestone (POA&M) weakness mitigation process.

**OMB Memorandum, M-05-23, Improving Information Technology (IT) Project
Planning and Execution**, dated August 4, 2005, identifies steps
agencies must take for all new major IT investments, on-going major IT
developmental investments, and high-risk IT investments to better ensure
improved execution and performance as well as to promote more effective
oversight.

# 7. Information and Assistance {#information-and-assistance .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

Direct questions, comments, suggestions, or requests for further
information to the Office of the Chief Information Officer, (202)
690-6162.

# 

# 8. Effective Date/Implementation {#effective-dateimplementation .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

The effective date of this policy is the date the policy is approved.

The HHS OPDIVs are responsible for preparing implementing documentation
within 120 days of the effective date of this policy and providing a
copy to the HHS CIO.

This policy will not be implemented in any recognized bargaining unit
until the union has been provided notice of the proposed changes and
given an opportunity to fully exercise its representational rights.

The HHS policies contained in this issuance shall be exercised in
accordance with Public Law 93-638, the Indian Self-Determination and
Education Assistance Act, as amended, and the Secretary\'s policy
statement dated August 7, 1997, as amended, titled \"Department Policy
on Consultation with American Indian/Alaska Native Tribes and Indian
Organizations.\" It is HHS\' policy to consult with Indian people to the
greatest practicable extent and to the extent permitted by law before
taking actions that affect these governments and people; to assess the
impact of the Department\'s plans, IT investments, programs and
activities on tribal and other available resources; and to remove any
procedural impediments to working directly with tribal governments or
Indian people.

# 9. Approved {#approved .Style-Heading-1-+-16-pt-Not-All-caps-Before:--18-pt-After:--12-p...}

[\_\_\_\_\_\_\_\_\_ /s/
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_]{.underline}
[12/30/2005]{.underline}

Charles Havekost

HHS Chief Information Officer Date