![](media/image1.jpeg){width="0.9986111111111111in"
height="0.9986111111111111in"} ![](media/image2.png){width="0.96875in"
height="0.9986111111111111in"}

**U.S. Department of Transportation**

**Federal Aviation Administration**

GUIDE FOR PREPARING THE

FEDERAL AVIATION ADMINISTRATION PROGRAM BASELINE AND OMB

EXHIBIT 300 REPORTS

Version 2.5.4

April 2006

  ------------------ ------------------ ---------------------------------
  **Version Number** **Version Date**   **Changes**

  Version 1.0 Final  01/25/2005         Exhibit 300 guidance (FY2006).

  Version 2.2        11/04/2005         Initial draft with updates to
  Preliminary Draft                     Exhibit 300 guidance (FY2007).

  Version 2.3 Draft  11/09/2005         Complete draft with updates to
                                        Exhibit 300 guidance (FY2007).

  Version 2.4 Draft  11/09/2005         Completed draft with updates to
                                        Exhibit 300 guidance (FY2007) and
                                        highlighted comments

  Version 2.5.1      11/30/2005         FAA comments from 11/22/05
  Draft                                 meeting and inputs were
                                        incorporated.

  Version 2.5.2      12/5/2005          Added comments from K. Kepchar,
  Advanced Draft --                     T. Burke and Terminal.
  for ASAG meeting                      
  on 12/07/05                           

  Version 2.5.3      12/9/2005          Incorporated additional comments
  Draft for ASAG                        received after ASAG meeting on
  review                                12/7/05.

  Version 2.5.4      1/6/2006           Incorporates Additional comments
  Draft                                 from Brandi Ingargiola, Darren
                                        Ash and Dave Woodson and some
                                        editorial clarifications.

  Version 2.5.4      2/7/2006           Incorporates SoS revisions from
  Final Draft                           Sue Fedor and corrected URLs.

  Version 2.5.4      2/16/2006          Added new screening question
  Final Draft                           (User Type).
  ------------------ ------------------ ---------------------------------

***Note: This guide is a living document. Several sections of this guide
are subject to change prior to the end of the fiscal year to incorporate
changes due to Budget Year 2008 OMB and other government wide guidance
as well as any changes in FAA guidelines and processes.***

**Table of Contents**

[1. Exhibit 300 Preparation Overview
1-1](#exhibit-300-preparation-overview)

[1.1 Introduction 1-1](#introduction)

[1.2 Purpose 1-1](#purpose)

[1.3 Acquisition Management System 1-2](#acquisition-management-system)

[1.4 The Exhibit 300 Program Baseline vs. the OMB Exhibit 300 Report
1-2](#the-exhibit-300-program-baseline-vs.-the-omb-exhibit-300-report)

[*1.4.1 The Exhibit 300 Program Baseline (PB)*
1-3](#the-exhibit-300-program-baseline-pb)

[*1.4.2 OMB Exhibit 300 Report* 1-4](#omb-exhibit-300-report)

[*1.4.3 Differences between the Exhibit 300 PB and the OMB Exhibit 300
Report*
1-6](#differences-between-the-exhibit-300-pb-and-the-omb-exhibit-300-report)

[1.5 Organization of the Guide 1-6](#organization-of-the-guide)

[1.6 Scoring Criteria 1-7](#scoring-criteria)

[1.7 General Writing Rules 1-8](#general-writing-rules)

[1.8 Lifecycle and Useful Segment Terminology
1-10](#lifecycle-and-useful-segment-terminology)

[2. Screening Questions and Summary of Spending
2-1](#screening-questions-and-summary-of-spending)

[2.1 Introduction 2-1](#introduction-1)

[2.2 Scoring Criteria 2-1](#scoring-criteria-1)

[2.3 Part I: Screening Questions 2-1](#part-i-screening-questions)

[2.4 Part I: Summary of Spending Table
2-7](#part-i-summary-of-spending-table)

[*2.4.1 General Guidance for Completing the Summary of Spending Table*
2-7](#__RefHeading___Toc124583483)

[3. Sections I.A and I.B - PMA 3-1](#sections-i.a-and-i.b---pma)

[3.1 Introduction 3-1](#introduction-2)

[3.2 Scoring Criteria 3-1](#scoring-criteria-2)

[3.3 Section I.A -- Project Description Guidance
3-1](#section-i.a-project-description-guidance)

[3.4 Section I.B -- Justification Guidance
3-3](#section-i.b-justification-guidance)

[4. Section I.C -- Performance Goals
4-1](#section-i.c-performance-goals)

[4.1 Introduction 4-1](#introduction-3)

[4.2 Scoring Criteria 4-1](#scoring-criteria-3)

[4.3 FAA-Specific Guidance 4-2](#faa-specific-guidance)

[*4.3.1 Helpful Tips* 4-2](#helpful-tips)

[*4.3.2 Creating the "Line of Sight"* 4-3](#creating-the-line-of-sight)

[5. Section I.D - Program Management
5-1](#section-i.d---program-management)

[5.1 Introduction 5-1](#introduction-4)

[5.2 Scoring Criteria 5-1](#scoring-criteria-4)

[5.3 Guidance 5-1](#guidance)

[6. Section I.E - Alternative Analysis
6-1](#section-i.e---alternative-analysis)

[6.1 Introduction 6-1](#introduction-5)

[6.2 Scoring Criteria 6-1](#scoring-criteria-5)

[6.3 Guidance 6-1](#guidance-1)

[7. Section I.F - Risk Inventory and Assessment
7-1](#section-i.f---risk-inventory-and-assessment)

[7.1 Introduction 7-1](#introduction-6)

[7.2 Scoring Criteria 7-1](#scoring-criteria-6)

[7.3 Guidance 7-1](#guidance-2)

[8. Section I.G - Acquisition Strategy
8-1](#section-i.g---acquisition-strategy)

[8.1 Introduction 8-1](#introduction-7)

[8.2 Scoring Criteria 8-1](#scoring-criteria-7)

[8.3 Guidance 8-2](#guidance-3)

[9. Section I.H - Project and Funding Plan
9-1](#section-i.h---project-and-funding-plan)

[9.1 Introduction 9-1](#introduction-8)

[9.2 Scoring Criteria 9-2](#scoring-criteria-8)

[9.3 Guidance 9-3](#guidance-4)

[10. Section II.A -- Enterprise Architecture
10-1](#section-ii.a-enterprise-architecture)

[10.1 Introduction 10-1](#introduction-9)

[10.2 Scoring Criteria 10-1](#scoring-criteria-9)

[10.3 Guidance -- Part II.A.1: Business
10-2](#guidance-part-ii.a.1-business)

[10.4 Guidance -- Part II.A.3: Applications, Components and Technology
10-4](#guidance-part-ii.a.3-applications-components-and-technology)

[11. Section II.B - Security and Privacy
11-1](#section-ii.b---security-and-privacy)

[11.1 Introduction 11-1](#introduction-10)

[11.2 Scoring Criteria 11-2](#scoring-criteria-10)

[11.3 Guidance 11-2](#guidance-5)

[12. Abbreviated Exhibit 300 Program Baseline Overview
12-1](#abbreviated-exhibit-300-program-baseline-overview)

[12.1 Introduction 12-1](#introduction-11)

[12.2 Scoring 12-1](#scoring)

[12.3 Guidance 12-1](#guidance-6)

[APPENDIX A - CROSSWALK OF THE EXHIBIT 300 SECTIONS
A-1](#appendix-a---crosswalk-of-the-exhibit-300-sections)

[APPENDIX B -- USEFUL WEB LOCATIONS
B-1](#appendix-b-useful-web-locations)

[APPENDIX C - E-GOV STRATEGY REVIEW SAMPLE
C-1](#appendix-c---e-gov-strategy-review-sample)

[APPENDIX D -- FAA RISK MANAGEMENT GUIDANCE
D-1](#appendix-d-faa-risk-management-guidance)

[APPENDIX E -- ADDITIONAL 508 GUIDANCE
E-1](#appendix-e-additional-508-guidance)

[APPENDIX F -- GLOSSARY OF ESSENTIAL TERMS
F-1](#appendix-f-glossary-of-essential-terms)

# 1. Exhibit 300 Preparation Overview

***(NOTE: This section is under review and subject to change.)***

## 1.1 Introduction

As stated in OMB Circular A-11, Federal agencies must annually submit to
OMB and Congress the Exhibit 300 Report as an appendix to their budgets.
In order to receive Congressional program funding each year, the Federal
Aviation Administration (FAA) must show through the Exhibit 300's that
investments are managed using the best available practices. The FAA
Acquisition Management System (AMS) calls for the use of Exhibit 300
Program Baselines (PBs) as the JRC approval document for agency
investments. Each OMB Exhibit 300 Report that is submitted to OMB must
be consistent with, and show the baseline, that was most recently
approved by the JRC. Section 1.3 describes the relationship and
differences between the Exhibit 300 PB version and the OMB Exhibit 300
Report version that is submitted to OMB.

The Exhibit 300 also serves as FAA's opportunity to demonstrate to
budget decision makers why FAA's investments are critical to the Air
Traffic community. It is important to remember that the primary purpose
of the Exhibit 300 is to effectively convey accurate information about
the investment, including its impact on the business, its status, and
the management processes used to execute it and monitor its performance.
Understanding and complying with the information requirements of the
Exhibit 300 are key not only to ensuring that the correct information is
reported, but also to ensuring that lifecycle management and investment
selection, control and evaluation processes are performed correctly to
enable the best investment decisions.

Each year OMB raises the bar regarding the information presented in the
Exhibit 300 therefore it's important not to become complacent. It's the
responsibility of each program to ensure their business case
demonstrates continuous improvements and contains current information.

## 1.2 Purpose

The purpose of this guide is to provide guidance for preparing the
Exhibit 300 PB documents and the OMB Exhibit 300 reports. As the
cornerstone of key investment decisions, the Exhibit 300s must be filled
out completely, clearly, and concisely. In the past FAA has risked
reduced funding for major NAS F&E investments by as much as \$300
million because of poor or not so compelling business cases. In
referring to this, Administrator Marion Blakey stated in the BY2005
Exhibit 300 kickoff meeting, "the inability to tell the story of why
these investments are important cost us dearly.\"

Each year, OMB raises their expectations for the content of Exhibit
300's -- requiring the FAA to proactively improve its Exhibit 300
preparation process -- thus improving program management that produced
the required information. This guide addresses common issues that arise
during both the writing and scoring process of the Exhibit 300. In
addition to general guidance, detailed information is provided for each
section of the Exhibit 300. If additional information or clarification
is needed, the FAA Value Management Office (VMO) maintains an updated
list with contact information for the Subject Matter Experts (SMEs) and
other Exhibit 300 contacts that can provide additional assistance. The
list can be found in the Exhibit 300 portal:
[https://nase.amc.faa.gov](https://nase.amc.faa.gov/). Note: This URL
will not work from outside the FAA intranet without a valid FAA userid
and password. To obtain access to this URL contact Anona Day at
Anona.Day@faa.gov.

## 1.3 Acquisition Management System

The AMS establishes policy and guidance for all aspects of lifecycle
acquisition management for the FAA. It defines how the FAA manages its
resources - money / people / assets - to fulfill its mission. The
objectives of the policy are to increase the quality, reduce the time,
manage the risk, and minimize the cost of delivering safe and secure
services to the aviation community and flying public. Acquisition
management policy promotes these objectives through partnership among
service providers and customers to ensure FAA plans, programs, and
budgets address priority aviation needs.

The FAA AMS consists of numerous policies and guidelines that describe
investment management and lifecycle management requirements,
responsibilities, processes, and documentation, including those for
investment analysis and decisions. The AMS also includes criteria for
determining which investments must complete the different types of
Exhibits 300 and policies for which office(s) reviews each one.
Electronic copies of the AMS policies and guidelines are available on
[http://fast.faa.gov](http://fast.faa.gov/).

OMB uses the terms "Planning, Acquisition, and Maintenance" to define
life-cycle funding phases in the Summary of Spending (SoS) Table and
other sections of the Exhibit 300. The table below maps OMB CPIC and
Funding Phases to FAA AMS Lifecycle Phases.

+---------------------+-----------------------+------------------------+
| **OMB CPIC Phase**  | **Summary of Spending | **FAA AMS Lifecycle    |
|                     | Funding Phase**       | Phase**                |
+---------------------+-----------------------+------------------------+
| Select              | Planning              | Mission Analysis       |
|                     |                       |                        |
|                     |                       | Investment Analysis    |
+---------------------+-----------------------+------------------------+
| Control             | Acquisition (DME)     | Solution               |
|                     |                       | Implementation         |
+---------------------+-----------------------+------------------------+
| Evaluate            | Maintenance           | In-service             |
|                     | (Steady-state)        |                        |
+---------------------+-----------------------+------------------------+

Table 1: CPIC/AMS Mapping

All sections of the Exhibit 300 must be completed prior to submitting an
Exhibit 300 Report to OMB. The level of detail provided for investments
that are in the initial planning phases will be less than for
investments in later phases of the lifecycle. It is very important that
investments in the initial planning phases that have not completed an
initial investment analysis or obtained a final investment decision by
the Joint Resources Council (JRC) clearly state throughout the OMB
Exhibit 300 Report that the information is preliminary. For new
investments it's important that the funding for the phase or segment
that covers that budget year be approved by the JRC prior to the OMB
Exhibit 300 being submitted to OMB; otherwise, the funding may not be
approved.

## 1.4 The Exhibit 300 Program Baseline vs. the OMB Exhibit 300 Report

The format and types of information required for the Exhibit 300 Program
Baseline (PB) and the OMB Exhibit 300 Report are essentially the same
but there are differences in their purposes and timing. This section
outlines the major purposes, relationships, and differences pertaining
to these two documents. Subsequent sections of this guide will outline
any additional differences pertinent to that section.

### 1.4.1 The Exhibit 300 Program Baseline (PB)

The Exhibit 300 PB is prepared for JRC investment decision meetings. The
JRC is the FAA executive investment review board that makes all the
investment decisions for investments that are required to submit Exhibit
300s to OMB and for other investments designated for JRC review based on
agency specific criteria.

An Exhibit 300 PB becomes the official baseline document for an
investment once it is approved by the JRC. This baseline cannot be
changed without JRC approval. Prior to the AMS changes that established
the Exhibit 300 PB as the official JRC approved baseline, the FAA used
the Acquisition Program Baseline (APB) as the official baseline for an
investment. For those investments that do not have a more current JRC
approved baseline, use the APB in lieu of the Exhibit 300 PB as the
current official baseline.

The JRC has several investment review responsibilities, depending on the
lifecycle phase of the project. Figure 1 illustrates the investment
analysis phases and decision points which are conducted to ensure FAA\'s
critical needs, are satisfied by practical and affordable solutions.

Figure 1: JRC Decisions during the FAA Lifecycle Management Process

The AMS guidance found in the FAST web site provides detailed guidance
on investment analysis processes, decisions, and documentation. The AMS
also explains who is responsible for the different investment decisions.

The cover sheet that includes a list of required signatures for the
Exhibit 300 PB is included in Appendix B of the AMS policy which can be
found on the FAST web page at:
<http://fast.faa.gov/docs/exhibit300.doc>.

### 1.4.2 OMB Exhibit 300 Report

As part of the annual budget process FAA submits to OMB and Congress an
annual OMB Exhibit 300 report for each of its major investments. The
list of which specific FAA investments must submit an Exhibit 300 Report
is coordinated with and agreed to annually with OMB. As part of the
annual submission process FAA, in coordination with DOT, has implemented
a process to assist FAA investment programs in preparing Exhibit 300s
that provide comprehensive and up-to-date information about their
investments. The FAA Value Management Office (VMO) and Subject Matter
Experts (SMEs) are available to provide guidance in specific areas of
the Exhibit 300. The VMO maintains an updated list of Exhibit 300 SMEs
and other contacts on the FAA Exhibit 300 portal located at **-**
[https://nase.amc.faa.gov.]{.underline} The VMO also provides annual
training and internal independent scoring of the completed exhibits 300.
Prior to being submitted to OMB, Exhibit 300 reports are submitted for
internal FAA scoring, review, and approval. The cover sheet that
includes a list of required signatures for the OMB Exhibit 300 report
will be available on the FAA Exhibit 300 portal or by contacting the VMO
office. The table below depicts the annual sequence of events for the
Exhibit 300 preparation and submission for Budget Year (BY08).

+-----------------+----------------------------------------------------+
| **Month**       | **Exhibit 300 Activities**                         |
+-----------------+----------------------------------------------------+
| D               | -   Program areas start updating Exhibit 300s from |
| ecember-January |     previous year to incorporate OMB Passback,     |
|                 |     SME, and VMO guidance                          |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| February        | -   First Exhibit 300 training session             |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| March           | -   NASE Portal Training (This is the FAA portal   |
|                 |     where information and guidance related to the  |
|                 |     Exhibit 300 can be found)                      |
+-----------------+----------------------------------------------------+
|                 | -   Administrator Kick-off Ceremony                |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| April           | -   eCPIC Training (eCPIC is the tool that is used |
|                 |     to enter Exhibit 300 information)              |
+-----------------+----------------------------------------------------+
|                 | -   Second Exhibit 300 Training Session            |
+-----------------+----------------------------------------------------+
|                 | -   First drafts of OMB Exhibit 300 reports are    |
|                 |     due to the Value Management Office (VMO) for   |
|                 |     initial evaluation and scoring                 |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| May             | -   Revising and rescoring of business cases       |
|                 |     (Exhibit 300s)                                 |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| June            | -   Draft OMB Exhibit 300s are submitted to DOT    |
+-----------------+----------------------------------------------------+
|                 | -   DOT provides comments for remediation          |
|                 |                                                    |
|                 | -   Draft SoS table is entered in eCPIC            |
+-----------------+----------------------------------------------------+
|                 | -   Third Exhibit 300 Session                      |
+-----------------+----------------------------------------------------+
|                 | -   Briefings on changes to OMB Exhibit 300        |
|                 |     guidance and reporting requirements            |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| July            | -   Programs wishing to re-baseline before their   |
|                 |     Exhibit 300 is submitted to OMB must obtain    |
|                 |     JRC approval no later than July                |
+-----------------+----------------------------------------------------+
|                 | -   OMB Exhibit 300 reports are submitted to VMO   |
|                 |     for final scoring                              |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| August          | -   Summary of Spending table is entered in eCPIC  |
+-----------------+----------------------------------------------------+
|                 | -   Exhibit 300 information is entered in eCPIC    |
+-----------------+----------------------------------------------------+
|                 | -   Emergency rescoring of specific business cases |
|                 |     and areas                                      |
+-----------------+----------------------------------------------------+
|                 | -   OMB Exhibit 300 reports obtain required FAA    |
|                 |     PM, Director Level, and Executive approvals    |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| September       | -   OMB Exhibit 300 reports are submitted to DOT   |
+-----------------+----------------------------------------------------+
|                 | -   OMB Exhibit 300 reports are submitted to OMB   |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+
| November        | -   OMB issues Passback, including scores on OMB   |
|                 |     Exhibit 300 reports                            |
+-----------------+----------------------------------------------------+
|                 |                                                    |
+-----------------+----------------------------------------------------+

Table 2: Annual OMB Exhibit 300 Preparation Events

### 1.4.3 Differences between the Exhibit 300 PB and the OMB Exhibit 300 Report

The relationships and differences are summarized below:

-   The Exhibit 300 PB stands in force and cannot be changed without JRC
    approval. In contrast the OMB Exhibit 300 report must be updated at
    least annually to depict upcoming near term activities identified in
    the program baseline (Exhibit 300 PB) and report the status of these
    activities prior to submission of the Exhibit 300 report to OMB.
    However, in the OMB Exhibit 300 report, the current Program Baseline
    information must be consistent with and within the latest JRC
    approved baseline shown in the Exhibit 300 PB. Changes cannot be
    made to the OMB Exhibit 300 report baseline information without
    first having a revised Exhibit 300 PB whose baseline changes have
    been approved by the JRC.

-   The OMB Exhibit 300 report version would need to be updated to
    incorporate the results of any JRC decision that has taken place
    since the last annual or official submission to OMB.

-   Neither the Exhibit 300 PB nor the OMB Exhibit 300 report will be
    required to report any information in Section I.H.4 if the
    investment is new and no costs have been, or will be, incurred
    before the Exhibit 300s are submitted to the JRC or OMB. There may
    be instances however where a new investment will have incurred no
    expenses when it is submitted to the JRC for approval but will have
    incurred expenses by the time the OMB Exhibit 300 report is
    submitted to OMB. In such cases Section I.H.4 will not need to be
    completed for the Exhibit 300 PB but it will need to be completed in
    the OMB Exhibit 300 report. In cases where an Exhibit 300 is being
    completed for the first time for an ongoing investment that is
    already incurring costs, Section I.H.4 must be completed for both
    the Exhibit 300 PB and the OMB Exhibit 300 report.

-   The Exhibit 300 PB going to the JRC would need to document all
    performance goals (Section I.C) and milestones (Section I.H) that
    will cover the period that includes all the segments/phases being
    proposed to the JRC for funding approval. Normally OMB Exhibit 300
    report goals should cover the period of the current useful segments
    being reported in Section I.H or at least through the budget year
    and one year beyond.

-   The Summary of Spending in the OMB Exhibit 300 report may be updated
    to reflect the CIP and may not be consistent with the SOS in the
    Exhibit 300 PB if the CIP was updated after the Exhibit 300 PB was
    approved by the JRC.

Throughout this guide, when the term Exhibit 300 is used, both documents
have the same content. Any differences between the two documents are
discussed where applicable.

## 1.5 Organization of the Guide

The Exhibit 300 consists of some screening questions followed by ten
sections, each covering a different topic. The first section of this
guide provides overview information and general guidance related to the
Exhibit 300 and this document. Sections 2 through 11 of this guide cover
the topics of the Exhibit 300 in the same order as the Exhibit 300
sections. Section 12 addresses the Abbreviated Exhibit 300. The
appendices at the end of this guide include a table that summarizes the
relationships between the section and a list of useful web sites and
references as well as more detailed information and guidance on some
Exhibit 300 topics.

## 1.6 Scoring Criteria

The Exhibit 300 is scored on a 5-point rating, where 1 is the lowest
score and 5 is the highest score and a 3 is passing. OMB will only
recommend programs that score a 3 or above for ***each Exhibit 300
section*** to Congress for funding. However OMB may designate some
specific sections as requiring a 4 in order for the Exhibit 300 business
case to pass. For example, the security section requires a 4 and OMB may
designate additional sections as requiring a 4. As an agency, the FAA
has set a goal to achieve a score of 4 or 5 for each Exhibit 300
section.

An overall score of three, meaning that the Exhibit 300 scores for all
sections total to 30 or less, means an investment has ***not passed***
and therefore OMB will not approve funding. Consequently some
modifications will need to be made to the Exhibit 300 and a program may
need to take some additional corrective actions before OMB will approve
funding for the investment. Investments with a total score that does not
pass are placed on the OMB Management Watchlist. OMB, however, may place
an investment on the Management Watchlist even if it has a total passing
score (31 or higher) due to concerns OMB may have about the investment's
performance in a particular area(s) such as security scoring a 3, large
negative cost or schedule variances, or the failure to obtain JRC
approval to a baseline or baseline change before the Exhibit 300 was
submitted to OMB.

Scoring for the Exhibit 300 business case (BC) is as follows:

  ----------- ------------ ------------------------------------------------------
  **Score**   **Points**   **Description**

  5           41-50        Strong documented business cases (including all
                           sections as appropriate).

  4           31-40        Very few weak points within the BC but still needs
                           strengthening.

  3           21-30        Much work remains to solidify and quantify BC. BC has
                           the opportunity to either improve or degrade very
                           quickly.

  2           11-20        Significant gaps in the required categories of the BC.

  1           1-10         Inadequate in every category of the required BC.
  ----------- ------------ ------------------------------------------------------

It should be noted that the scoring is based on OMB's perception of the
strength of the IT project management, rather than simply the writing of
the Exhibit 300. The results of audits, reviews, and other evaluations
will therefore often contribute to an investment's score. Also, an
investment that is being submitted to OMB with an initial or revised
baseline is not likely to get a passing score in some scoring areas if
that baseline has not received official agency approval through the FAA
JRC.

Each year OMB raises the bar. It is therefore important not to get
complacent and to ensure Exhibits 300 demonstrate continuous
improvements and properly updated information.

There are ten scoring areas for each Exhibit 300, thus making the
business case worth a total of up to 50 points. Each scoring area is
associated with specific sections of the Exhibit 300. The following
table lists each of the 10 scoring areas with the associated Exhibit 300
sections.

  ------------------------------ ----------------------------------------
  **Scoring Area Title**         **Related Exhibit 300 Section**

  Supports the President\'s      Multiple sections -- including Part I,
  Management Agenda Items (AI)   Section I.A. and Section I.B.

  Performance Goals (PG)         Part I, Section I.C

  Project Investment Management  Part I, Sections I.D and I.H, and
  (PM)                           overall business case

  Alternative Analysis (AA)      Part I, Section I.E

  Risk Management (RM)           Part I, Section I.F

  Acquisition Strategy (AS)      Part I, Section I.G

  Performance Based Management   Part I, Section I.H
  Systems (PB)                   

  Enterprise Architecture (EA)   Part II, Section II.A

  Security and Privacy (SE)      Part II, Section II.B

  Life-Cycle Costs (LC)          Multiple Sections -- including Screening
  Formulation                    Questions, SoS Table, Section I.H
  ------------------------------ ----------------------------------------

## 1.7 General Writing Rules

The best investment may score lower if the reviewer cannot understand
the text in its Exhibit 300. The following are simple grammar and format
rules that need to be followed to produce an effective business case.

1.  **Remember Your Audience --** Each year the FAA may get a new
    Exhibit 300 OMB examiner who comes from outside the FAA (and
    possibly outside of DOT), so it is important to ensure that
    documents not filled with "FAA-ese." Here are some tips:

    a.  **Avoid FAA jargon and overly technical explanations-**
        Reviewers main focus is to determine how well projects are being
        managed. Limit the amount of technical explanations, and when
        you do need to go into further details -- try to translate
        functions into common, everyday language.

    b.  **Limit use of multiple abbreviations-** Reviewers will be
        familiar with common Federal abbreviations such as FAA, DOT,
        DoD, and OMB. For each sentence, use one or at most two common
        abbreviations -- the first referring to the major subject of the
        sentence and the second referring to a related program or
        sub-set of said major subject. For FAA internal abbreviations,
        write out the full term; if repeatedly referred to, a short-form
        or "nickname" can be used after it is first spelled out (example
        -- Joint Resources Council can be referred to as "the Council"
        and [not]{.underline} JRC). Remember to remain consistent with
        how you refer to each term.

2.  **Keep it simple --** Like any government document, the Exhibit 300
    must follow the rules of Plain Language. The goal of Plain Language
    is to make documents clear and concise. These guidelines include:

    a.  **Avoid repetition-** When repetition occurs, there is a good
        chance that the repeated piece of information may be used
        inappropriately in some places.

    b.  **Use active verbs-** Use no more, if not less, than 15% passive
        verbs.

    c.  **Keep sentences short-** Try to keep sentences to 20 words or
        less, but if a sentence needs to be longer, use no more than 40
        words. The longer a sentence, the more likely there will be a
        grammatical error. If needed, split up sentences into lists or
        bullets.

    d.  **Experiment with using bullets before submission-** The
        automated tool for submitting data to OMB**,** eCPIC, does not
        always reliably capture bullet formatting. Experiment with
        numbering and or tabs in a text editor like Notepad (not Word)
        to determine what works best visually. A common recommendation
        is skip a line between each bullet item.

> In order to make sure that Exhibit 300 has employed Plain Language,
> run the document through an editing program such as StyleWriter (a
> requirement this year).

3.  **Only answer the question asked-** When asked a question, directly
    and fully answer the question asked first before elaborating, and if
    elaborating, use only absolutely pertinent information. Before
    adding additional information, check to make sure it is not asked
    for in a later part of the Exhibit 300. For example, when asked "Is
    the project baselined?", the answer should "Yes" or "No" and then
    could be followed up with "It was baselined in 2001" but should not
    include what the baseline amount is, how long it took to baseline,
    or how the baseline was determined. It is highly probable that this
    extra information will be asked for later.

4.  **Ensure your Exhibit 300 is current-** Programs who have submitted
    the Exhibit 300 in the past often use the previous years version as
    a jumping off point. If this is done, double check each response to
    make sure you update all of it appropriately (i.e. use current year
    where appropriate). In some cases, questions have been broken into
    smaller parts -- so make sure your previous answer has been broken
    down appropriately.

5.  **Keep section answers consistent- Often** times the responses in
    one section will refer to responses in others. Make sure that these
    responses are consistent with one another. Appendix A includes a
    crosswalk that compares each question to one another and points out
    where these tie-ins exist. The answers in the Exhibit 300 must also
    be consistent with what is reported in the Agency's Exhibit 53, IT
    Portfolio.

6.  **Avoid using "Not Applicable", "Not Available", or leaving
    questions blank-** If a question cannot be answered because data is
    not available, explain why the question cannot be answered. If the
    data will be available in the future -- clearly state when the data
    will become available.

7.  **Do not "cut-and-paste" answers between different questions-**
    Although many questions are related to another, the same answer will
    not satisfy two different questions. Do not cut-and-paste examples
    from this guide.

## 1.8 Lifecycle and Useful Segment Terminology

It is very important to clearly identify the investment phase and useful
segments for which funding is being requested. In both Sections I.A.1
and I.H of the Exhibit 300, investments need to clearly identify the
phase, useful segment(s), duration and scope for which funding is being
requested.

**Lifecycle:** An investment's total lifecycle is the duration of the
investment encompassing the planning, acquisition, and maintenance
phases until the investment is discontinued, disposed of, and/or
replaced.

**Phase:** A part of the investment that usually reflects its current
lifecycle phase, such as planning,
acquisition/development/modernization/enhancement, maintenance, or mixed
lifecycle.

**Useful Segment:** A useful segment is an economically and
programmatically separate component of an investment, as narrow in scope
and brief in duration as practicable. It provides a measurable
performance outcome for which the benefits are derived independently and
separately of other useful segments. A phase can consist of just one
useful segment or can include several useful segments.

**Milestones:** Milestones are specific activities or tasks that have a
beginning and an end and are part of a useful segment.

Below is a depiction of the relationship between an investment total
lifecycle, its phases, useful segments, and milestones.

+----------------------+----------------------------+------------------+
| **Investment's       |                            |                  |
| Complete Lifecycle** |                            |                  |
+======================+============================+==================+
| Planning Phase       | Acquisition (DME) Phase    | Maintenance      |
|                      |                            | (Steady-State)   |
|                      |                            | Phase            |
+----------------------+----------------------------+------------------+
| Planning Useful      | Acquisition/Development    | Steady-state     |
| Segment #1A:         | Useful Segment #1B:        |                  |
| 1                    | 06/01/2005-09/30/2008      | Useful Segment   |
| 0/01/2004-05/30/2005 |                            | #1C:             |
|                      | -   Milestone 1            | 01/15            |
|                      |                            | /2007-09/30/2012 |
|                      | -   Milestone 2            |                  |
|                      |                            |                  |
|                      | -   Milestone 3            |                  |
|                      |                            |                  |
|                      | -   Milestone 4            |                  |
+----------------------+----------------------------+------------------+
| Planning Useful      | Acquisition/Development    | Steady-state     |
| Segment #2A:         | Useful Segment \# 2B:      | Useful Segment   |
| 0                    | 10/01/2005-05/30/2007      | #2C:             |
| 4/01/2004-09/30/2005 |                            |                  |
|                      | -   Milestone 1            | 06/01            |
|                      |                            | /2007-12/30/2010 |
|                      | -   Milestone 2            |                  |
+----------------------+----------------------------+------------------+
| Planning Useful      | Acquisition/Development    | Steady-state     |
| Segment #3A:         | Useful Segment #3B,        | Useful Segment   |
| 10/01/2005-          | 07/01/2006-09/30/2010      | #3C,             |
| 06/30/2006           |                            | 10/01            |
|                      | -   Milestone 1            | /2010-09/30/2012 |
|                      |                            |                  |
|                      | -   Milestone 2            |                  |
|                      |                            |                  |
|                      | -   Milestone 3            |                  |
+----------------------+----------------------------+------------------+

Table 3: Sample Life-Cycle Phase, Segment, and Phase Relationships

# 2. Screening Questions and Summary of Spending

## 2.1 Introduction

The numbering and organization of this section reflects the numbering
and organization of the screening questions and Summary of Spending
(SOS) table in the Exhibit 300. Guidance is provided for each question.

## 2.2 Scoring Criteria

The screening questions and SoS table are not scored.

## 2.3 Part I: Screening Questions

**Date of this Submission \[update each year\]:**

Enter the date submitted to DOT.

**Agency:**

Enter "Department of Transportation (DOT)"

**Bureau:**

Enter "Federal Aviation Administration (FAA)"

**Budget Account Number:**

Programs should use one of two account numbers: Operations account or
the Facilities and Equipment account. ECPIC lists the treasury code for
these numbers, starting with a "69" which represents the FAA; however,
for the purpose of the Exhibit 300, programs should use the OMB code.

  -------------------------------------- --------------------------------
  **OMB Budget Codes:**                  

  Operations                             021-12--1301--0--1--402

  Funding and Equipment                  021-12--8107--0--7--402
  -------------------------------------- --------------------------------

The first three digits of the code "021" stand for the DOT Agency and
the next two digits "12" are the FAA's Bureau code. For the operations
budget, "1301" means that this is a general fund, the transmittal code
"0" means this is part of the regular budget, and the "1" is the fund
code related to general funds. For the Funding and Equipment budget,
"8107" stands for Trust, non-revolving fund, the "0" once again refers
to being a part of the regular budget, and the "7" is a fund code
related to Trusts, non-revolving. The account name will be listed after
the account number.

**Account Name:**

Account number of any other budget accounts funding this investment.

**Program Name:**

This may sometimes be different from the "Name of Investment"

**Name of Investment:**

Use the full name of the investment followed by its acronym in
parentheses. Please note that if this investment was submitted as part
of the previous budget year's portfolio, the name of the investment
should NOT change, per OMB direction.

**Unique Project (Investment) Identifier (UPI):**

The instructions for completing the UPI can be found in OMB circular
A-11, Exhibit 53. The UPI depends on the investment's primary strategic
goal mapping, the type of IT investment (i.e., financial,
infrastructure, grants management, Enterprise Architecture, or other,
and the primary line of business and sub-function. As such, the code is
based on, and must be consistent with, your responses to several
specific Exhibit 300 sections. The Business Reference Model (BRM)
mapping in section II.A.1 determines the information to be placed in the
last six digits of the UPI. Contact the Value Management Office to have
a UPI code assigned to your project or to check the existing code.

The Department\'s eCPIC tool automatically generates the UPI code based
on responses to several of the screening questions as well as the
mapping of the investment to the Federal Enterprise Architecture
Business Reference Model (FEABRM) in Section II.A.1.

**Investment Initiation Date:**

Provide the month and year for the project's beginning.

**Investment Planned Completion Date:**

The completion date shown here should be consistent with the completion,
or end, of life date shown in the Alternatives Analysis (Section I.E)
and should represent the entire life of the investment until it is
discontinued or disposed of.

**This Investment is: Initial Concept, Planning, Full Acquisition,
Steady-State, Mixed Lifecycle**

Make sure your response is consistent with the budget resources
documented in the **budget year** column of the Summary of Spending
table. For example, if "Maintenance" has been selected OMB would not
expect to see any budget resources in the "Full Acquisition" category in
the Summary of Spending table. Investments showing maintenance costs as
well as planning and/or acquisition costs in the Summary of Spending
table would normally be categorized as "mixed."

Remember, this question should be answered for the **budget year** for
which you are requesting funding. The following is an explanation of the
terms.

-   **Initial Concept:** Early concept development and scoping,
    assessment of functional needs, etc.

-   **Planning:** Funds are being expended for preparing, developing or
    acquiring the information to design and evaluate the project (e.g.,
    market research, engineering or design studies, prototypes, full
    cost-benefit studies, accessibility studies, security studies).
    Planning can be a useful segment of a capital project. Depending on
    the nature of the project, one or more planning segments may be
    necessary.

-   **Full Acquisition:** Funds are being expended on assets and/or
    personnel for implementation.

-   **Steady-state:** Funds are being expended for the maintenance of an
    operational system or module (system has been through at least one
    full budget cycle).

-   **Mixed Lifecycle:** Mixed lifecycle investment means an investment
    that has development, modernization, and/or enhancement (DME)
    aspects as well as steady-state aspects. For example, a mixed
    lifecycle investment could include a prototype or module of a system
    that is operational with the remainder of the system in DME stages;
    or, a service contract for steady-state on the current system with a
    DME requirement for system upgrade or replacement. At a minimum, if
    25% or more of the budget you are requesting in the budget year will
    be spent on development, modernization, and/or enhancements, the
    investment is considered mixed.

    **Useful Segment is Funded: Incrementally or Fully**

    "Incremental Funding" means that a useful segment is not funded in
    its entirety, thus creating risk associated with uncertainty of
    future funding (loss of sunk costs, higher acquisition costs, etc.)
    This is not viewed positively by OMB and not a good way of funding
    investments. The preferred response is "Full Funding" which means
    the budget authority request covers the amount required to complete
    the current useful segment(s) described in Section I.H of the
    business case. Most or all of FAA projects are "Fully" funded.
    Please note that "Full Funding" does not refer to funding the entire
    life of the investment.

    The "Full Funding" policy requires that each useful segment (or
    module) of a capital project be fully funded with either regular
    annual appropriations or advance appropriations. Some further
    FAA-specific clarifications are:

```{=html}
<!-- -->
```
-   Full funding means the budget request in the budget year is
    sufficient to complete all of the useful segments identified in I.H.
    (Previous useful segments would be funded with authority from
    previous years. In the Facilities and Equipment (F&E) fund FAA has
    three-year authority to obligate/outlay money.

-   Full funding also means that your budget request should be
    sufficient to obligate for any and all contracts that cover your
    investment's current useful segment(s).

-   It is acceptable to define a useful segment in F&E with up to three
    years worth of activities, but then for that useful segment to be
    fully funded means that the budget year request covers the costs not
    just for the budget year but for the additional two years needed to
    complete the useful segment (s).

-   Full funding does NOT mean that a budget year request only covers
    the Section I.H milestones that take place during that budget year.

-   Development projects funded solely by Operational funds will have
    trouble fully funding useful segments that last longer than one year
    since the Ops fund only has a one year authority. These investments
    will therefore probably be categorized as incremental.

[]{.mark}

**Was this investment approved by OMB for Previous Year Budget Cycle?**

If an Exhibit 300 went to OMB and was approved for the previous budget
year, then the answer is "Yes." If this project did not submit an
Exhibit 300 to OMB last year, then the answer is "No."

*Note: New initiatives that are in the planning stages and have not
completed an initial investment analysis and JRC review would answer
"No" to this question.*

**Did the Executive/Investment Review Committee approve the funding for
this investment this year?**

The answer is "Yes" for all projects that have JRC or JRC subordinate
Board approval (if delegated by the JRC), and were given authorization
to proceed to the next phase.

**Did the CFO review the cost goal?**

By the time the Exhibit 300s are due to OMB in September the answer will
be yes, so enter "Yes."

**Did the Procurement Executive review the acquisition strategy?**

By the time the Exhibit 300s are due to OMB in September the answer will
be "yes," so enter "yes."

*Note: The FAA Procurement Executive is the FAA Acquisition Executive.*

**Did the Project (Investment) Manager identified in Section I.D. review
this exhibit?**

The Project Manager (PM) must review the Exhibit 300 business case, and
then respond "Yes." Project Managers are responsible for fully
understanding the content of the Exhibit 300 and the project itself. The
PM name and phone number must be included in the Exhibit 300, Section
I.D.

**Is this investment included in your Agency's annual performance plan
or multiple annual performance plans?**

The FAA Flight Plan and annual business plan should be reviewed in
relation to this question. Contact the Value Management Office regarding
questions.

**Does this investment support homeland security?**

Answer 'Yes' or 'No'. If yes, complete the next question.

**If this investment supports homeland security, indicate by
corresponding number which homeland security mission area(s) this
investment supports?**

Review the Department of Homeland Security (DHS) Strategic Plan at
[www.dhs.gov](http://www.dhs.gov/) to see if any homeland security
mission areas apply to your program. If one or more mission areas have
been selected, use Section I.A.3, Supporting Information, to elaborate.

**Is this investment information technology (IT)?**

Information Technology, as defined by the Clinger-Cohen Act of 1996,
Sections 5002, 5141, and 5142, means any equipment or interconnected
system or subsystem of equipment that is used in the automatic
acquisition, storage, manipulation, management, movement, control,
display, switching, interchange transmission, or reception of data or
information. For purposes of this definition, equipment is "used" by an
agency whether the agency uses the equipment directly or it is used by a
contractor under a contract with the agency that (1) requires the use of
such equipment or (2) requires the use, to a significant extent, of such
equipment in the performance of a service of the furnishing of a
product. Information Technology includes computers, ancillary equipment,
software, firmware and similar procedures, services (including support
services), and related resources. It does not include any equipment that
is acquired by a Federal contractor incidental to a Federal contract. An
FAA investment that is part of the NAS is usually considered IT. For
example, the En Route Automation Program (ERAM) is categorized as an IT
investment, whereas the Power Systems Sustained Support (PSSS) is not.

**User Type?**

All FAA investments are required to indicate whether they are NAS or
non-NAS.

**Is this Project a Financial Management System**?

Financial Management Systems are financial systems and the financial
portion of mixed systems that support the interrelationships and
interdependencies between budget, cost and management functions, and the
information associated with business activities. Financial systems are
comprised of one or more applications that are used for any of the
following:

-   Collecting, processing, maintaining, transmitting, and reporting
    data about financial events;

-   Supporting financial planning or budgeting activities;

-   Accumulating and reporting cost information; or

-   Supporting the preparation of financial statements.

    **If so, does this project address a FFMIA compliance area? If so,
    which compliance area**?

    The Federal Managers Financial Integrity Act of 1982, Chief
    Financial Officers Act of 1990 and Federal Financial Management
    Improvement Act of 1996 require accountability of financial and
    program managers for financial results of actions taken, control
    over the Federal government\'s financial resources, and protection
    of Federal assets. The Office of the CFO prepares the FFMIA
    compliance reporting for financial management systems. Contact the
    VMO regarding questions.

    **Was a privacy impact assessment performed for this project?**

The E-Government Act require agencies to conduct, and submit to OMB,
Privacy Impact Assessments (PIAs) for all new IT investments
administering information in identifiable form collected from, or about,
members of the public. This question should be reviewed each year.

More detailed guidance on PIAs is provided in this guide in the section
on the responses for Section II.B.4. The response to this question
should be consistent with the guidance and response for Section II.B.4.

**Federal Information Security Management Act (FISMA) questions:**

This question is updated each year. The answer should be \"Yes\" if your
project is required to undergo the security self-assessment process
managed by the Information Technology Security Staff. All major
investments (Agency general support systems and major applications) are
required to be assessed in accordance with FISMA. Weaknesses identified
as part of the security self-assessment process generate Plans of Action
and Milestones (POA&Ms) and are incorporated into the Agency\'s
comprehensive security action plan.

The response to this question should be consistent with the guidance and
responses for Section II.B.

**Critical Operation or Mission Critical:**

> **Has this investment been identified as a national critical operation
> or asset by a Project Matrix review or other agency determination?**
>
> **If no, is this an agency mission critical or essential service,
> system, operation, or asset (such as those documented in the agency's
> COOP Plan), other than those identified as above as national critical
> infrastructures?**

Refer to Value Management Office for further guidance on this question.

**PART Questions** *(These questions apply to all investments, IT and
non-IT)*:

On July 16, 2002, OMB issued a memo to the heads of federal department
and agencies describing a new approach being used by OMB to assess
program performance. OMB is now using a Program Assessment Rating Tool
(PART) to complete a formal evaluation of federal programs and plans to
apply this detailed analysis to a percentage of federal programs every
year. The OMB memo describes the purposes of the PART as: "The program
assessment effort presents an opportunity to inform and improve agency
GPRA plans and reports, and establish a meaningful systematic link
between GPRA and the budget process. The memo defines the PART approach
as follows, "The PART is a diagnostic tool that relies on objective data
to inform evidence-based judgments to assess and evaluate programs
across the wide range of issues related to performance."

If an investment was included in a PART review the response to both PART
screening questions f and f.2 should be "Yes". The name of the program
(not just the investment) that was reviewed should be provided in the
"PARTed Program" box

All investments included in PART reviews must demonstrate strong links
to the PART process and how the investment will improve the program's
rating, or how the investment affects or is affected by the PART rating
process. PART-related improvement goals would normally be discussed in
Sections I.B and I.C.

If the PART review did not result in any findings or action items that
apply specifically to the investment, then a brief explanation should be
included in Section I.A.2 (Assumptions) briefly naming the PART review
that included the investment within its scope, but explaining that there
were no findings or action items specific to the investment.

So far the OMB PART has covered four FAA program areas:

1\) The RED account -- in 2003

2\) The Airport Improvement Grants -- in 2002

3\) Air Traffic Services Operations (OPS funded only) -- in 2003

4\) Facilities and Equipment (F&E) -- in 2004.

The FAA portfolio is predominantly funded under F&E. Investments with
F&E funding therefore need to answer "YES" to (f).

OPS-funded investments in ATO should answer "YES" to this question.

If you are unsure whether your system/investment supports a program
reviewed under PART, contact the Value Management Office.

**Will you use a Share-In Savings contracts to support this
investment?** *(This question applies to all investments, IT and
non-IT)***:**

These are IT contracts in which the Government, under the authority of
Section 210 of the E-Government Act of 2002, awards a contract to
improve mission-related or administrative processes, or to accelerate
the achievement of its mission and share with the contractor in savings
achieved through contract performance. For help in determining whether a
share-in-savings project should be pursued go to
[www.gsa.gov/shareinsavings](http://www.gsa.gov/shareinsavings).
Acquisitions using the share-in-savings authority in Section 210 must be
funded from the funds that would have been appropriated for operations
and maintenance of the legacy system the new system is replacing.

**Is this investment for construction or retrofit of a federal building
or facility?** *(This question applies to non-IT investments)*:

The Energy Policy Act 1992, which establishes an energy management
requirement for Federal agencies that states not later than January 1,
2005, each agency shall, to the maximum extent practicable, install in
Federal buildings owned by the United States all energy and water
conservations measures with payback periods of less than 10 years. A
Utility energy efficiency service contract (UESC) means that a local
utility provides up-front project funding and Federal agencies pay for
the services over time, either on their utility bill, or through a
separate demand-side management agreement. See FAR Part 41 for more
information.

## 2.4 Part I: Summary of Spending Table

***(NOTE: This section is under review and subject to change.)***

[]{#__RefHeading___Toc124583483 .anchor}The SoS table represents all the
costs for the investment for the full estimated lifecycle of the
selected alternative, regardless of source of funding or budget account.

### 2.4.1 General Guidance for Number range CHAPTERCompleting the Summary of Spending Table

<table>
<colgroup>
<col style="width: 20%" />
<col style="width: 9%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
</colgroup>
<tbody>
<tr class="odd">
<td><em>Column 1</em></td>
<td><em>Col 2</em></td>
<td><em>Col 3</em></td>
<td><em>Col 4</em></td>
<td><em>Col 5</em></td>
<td><em>Col 6</em></td>
<td><em>Col 7</em></td>
<td><em>Col 8</em></td>
<td><em>Col 9</em></td>
<td><em>Col 10</em></td>
</tr>
<tr class="even">
<td>Life-Cycle Stage</td>
<td>PY-1 and Earlier</td>
<td><p>Prior Year (PY)</p>
<p><strong>20YX</strong>-2</p>
<p>(Op Plan)</p></td>
<td><p>Current Year (CY)</p>
<p><strong>20YX-1</strong></p>
<p>(Pres Bud)</p></td>
<td><p>Budget Year (BY)</p>
<p><strong>20YX</strong> OMB Sub</p></td>
<td><p>BY+1</p>
<p><strong>20YX+1</strong></p></td>
<td><p>BY+2</p>
<p><strong>20YX+2</strong></p></td>
<td><p>BY+3</p>
<p><strong>20YX+3</strong></p></td>
<td><p>BY+4 &amp;</p>
<p>Beyond</p></td>
<td>Total</td>
</tr>
<tr class="odd">
<td><strong>Planning:</strong></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>Budgetary Resources</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>Outlays</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td><p><strong>Full Acquisition/</strong></p>
<p><strong>Development:</strong></p></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>Budgetary Resources</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>Outlays</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td><p><strong>Total, sum of stages</strong></p>
<p><strong>(Planning + Full Acquisition):</strong></p></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>Budgetary Resources</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>Outlays</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td><strong>Maintenance Total (Steady-state):</strong></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>Budgetary Resources</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>Outlays</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td><strong>Total, All Stages:</strong></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>Budgetary Resources</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>Outlays</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td><strong>Government FTE Costs:</strong></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody>
</table>

Table 4: Example of FY07 Summary of Spending Table

**Budgetary Resources**

In the Summary of Spending table, \"Budgetary Resources\" means an
amount available to enter into new obligations and to liquidate them,
including direct spending and obligation limitations (see OMB A-11 or
contact Budget Office if the project line item is subject to statutory
limitations on obligations).

For the Past Year and Prior always refer to the *appropriated amounts*
received by the program. During the period the Exhibit 300 is being
developed for OMB, the Current Year will equal the *President\'s Budget
request* until an appropriations bill is enacted and signed by the
President. Past year F&E appropriation amounts by project can be found
in the Capital Investment Plan.

The Budget Year amount should be consistent with the budget request FAA
makes to the Department and OMB. ATO Finance develops the F&E budget
within the framework of the Capital Investment Plan. Project teams
should keep in touch with ATO Finance and the CFO Budget Office to
ensure they have the latest figures.

F&E resources beyond the Budget Year should be consistent with amounts
found in the Capital Investment Plan, which should adjust out year
amounts for current or past year resource changes in order to maintain
consistency with the JRC approved baseline.

The Operations budget is developed within each line of business.
Operations funding should be also be consistent with request levels to
OMB.

Any project collaborating with another agency or agencies (such as E-Gov
projects) should include the funding from those collaborators. See OMB
A-11 Section 300 for more guidance on collaborative projects.

**Outlays**

Outlays are payments to liquidate an obligation. Outlays generally are
equal to cash disbursements but also are recorded for cash-equivalent
transactions, such as Federal employee salaries. Outlays are the measure
of Government spending. Outlays should not be confused with obligations,
which binding agreements that result in future outlays.

Outlay information must be provided for past, current and future years.
Outlays for past years should be consistent with actual project
costs/expenditures. Current year outlays should reflect actual
expenditures to date plus estimated outlays for the remainder of the
fiscal year. Outlay amounts for future years should reflect the outlay
rates as agreed upon with the budget office and OMB. Outlays should
equal its counterpart in Table I.H.4, Actual Costs.

**Government FTE Costs:**

For the Government FTE Costs, use a cost-per-FTE commensurate with the
grade level of the government employee(s) performing the work. The
budget office has cost per FTE for each Line of Business organization
and other inflation rates for formulating payroll resources.
Multi-agency initiatives must include FTE costs for all partnering
agencies. Government FTE Costs in the Summary of Spending include:

-   All government personnel considered direct and indirect labor in
    support of the investment.

-   The investment management IPT (service team) and any other
    government effort (e.g., programming effort for part of the overall
    investment, development effort) that contributes to the success of
    the investment.

-   Salary costs plus the fringe benefit rate of 32.8%.

-   Costs of internal FTE supporting the IT investment, at a minimum
    including in FTE estimates the costs of anyone spending more than
    50% of their time supporting the investment. Persons working on more
    than one investment, whose contributions over all investments would
    exceed 50% of their overall time, should have their specific time
    allocated to each investment.

# Relationship to Costs in Table I.H.4

Outlays in the Summary of Spending should equal Actual Costs for the
activities listed in Table I.H.4 for any given budget year. As time goes
on, a project may not appropriated the entire amount planned for any
given year's activities. Project teams should discuss cost variances in
terms of schedule delays or performance shortfalls, if any result, in
Section I.H. 4 sections C and D.

**Life-Cycle Phase Costs:**

-   **Planning** costs include costs for mission analysis and investment
    analysis. At FAA, planning comprises all efforts leading up to the
    final investment decision by the JRC. It generally includes all
    activity that occurs prior to the contract award for development.

-   **Full Acquisition** **costs** include costs for solution
    implementation (development, testing and deployment).

-   **Maintenance costs** are steady-state costs, which include costs
    for routine maintenance and technology refresh.

-   **Mixed Lifecycle** projects have costs in multiple phases.

# 3. Sections I.A and I.B - PMA

## 3.1 Introduction

This section gives the OMB reviewers their first impression of the
program. The goal is to provide OMB with a management summary of the
program. Answers should be structured in the same order as the elements
in the question. Keep descriptions short and to the point.

## 3.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           This is a collaborative investment that includes industry,
              multiple agencies, State, local, or tribal governments, uses
              e-business technologies, and is governed by citizen needs. If
              the investment is a steady-state investment, then an E-Gov
              strategy review is underway and includes all of the necessary
              elements. If appropriate, this investment is fully aligned with
              one or more of the Presidential Initiatives.

  4           This is a collaborative investment that includes industry,
              multiple agencies, State, local, or tribal governments, uses
              e-business technologies though work remains to solidify these
              relationships. If investment is in steady-state, then an E-Gov
              strategy review is underway but needs work in order to
              strengthen the analysis. If appropriate, investment supports
              one or more of the Presidential Initiatives but is not yet
              fully aligned.

  3           This is not a collaborative investment though it could be and
              much work remains to strengthen the ties to the President\'s
              Management Agenda. If this is a steady-state investment and no
              E-Gov strategy is evident, this investment will have a
              difficult time securing continued or new funding from OMB. If
              appropriate, this investment supports one or more of the
              Presidential Initiatives but alignment is not demonstrated.

  2           This is not a collaborative investment and it is difficult to
              ascertain support for the AI. If this is a steady-state
              investment, then no E-Gov strategy was performed or is planned.

  1           There seems to be no link to the AI and E-Gov strategy.
  ----------- ---------------------------------------------------------------

## 3.3 Section I.A -- Project Description Guidance

**Question I.A.1: Provide a brief description of this investment and its
status through your capital planning and investment control (CPIC) or
capital programming "control" review for the current cycle.**

Start with a brief, concise description of the program and the
performance gap it addresses. Describe the useful segments including the
CPIC and lifecycle phase of each segment. Identify which useful segments
are covered by this year's funding request.

The response should include the following:

-   Briefly describe the investment scope and activities (planning,
    acquisition, development, and maintenance) that have occurred in the
    past, are occurring at the present time and are planned for the
    future. Particular emphasis should be placed on the activities that
    will occur during the time for which funding is being requested.

-   Briefly describe the performance gap the investment is addressing or
    will address and the related benefits. This information should be
    consistent with the answers provided in Sections I.B.1 and I.B.8,
    but not as detailed. When describing benefits to be, or being,
    realized as a result of this investment, clearly differentiate those
    benefits that will result from the phase for which funding is being
    requested from longer term benefits that are expected in the later
    years of the investment's life (and which may not be as easily
    quantifiable presently). Don't forget to include the impact on
    agency mission performance if the investment were not allowed to
    start or continue.

-   Cite any laws required for the investment as well as reasons why the
    investment may have been determined to be critical to the agency
    mission, to homeland security, or a national critical operation.

-   Include the CPIC phase(s) (Select, Control, and/or Evaluate)
    applicable to the investment during the budget year, and the related
    most recent JRC baseline funding approval decisions. This section
    should include a brief but complete description of the governance
    processes that are being followed, investment review boards that are
    involved, and decisions that have been, or will be, made regarding
    the investment's funding, schedule, risks, and performance.

-   If JRC decision dates are discussed, make sure that these dates
    remain consistent throughout the document. In the past, reviewers
    have been confused about whether a project has been re-baselined due
    to different JRC discussions scattered throughout the Exhibit with
    no clear linkage between them.

-   For fully operational projects in the maintenance phase state the
    number of years it has been in this phase.

*Note: For investments in the early planning phases that have not yet
completed a final investment JRC decision, the following text, tailored
appropriately for the investment, should be inserted at the beginning of
Section I.A.1.*

> *"This investment is in the planning phase of the FAA's Acquisition
> Management System (equivalent to the Select Phase of CPIC). The
> information contained in this Exhibit 300 is considered preliminary
> because this investment is undergoing internal capital investment
> reviews. The team will be performing further analysis and planning.
> The JRC is tentatively scheduled to review this investment on
> \<date\>, at which time the investment is expected to be baselined.
> Once the JRC baselines this investment, the Exhibit 300 will be
> updated to reflect the JRC decisions."*

**Question I.A.2: What assumptions are made about this investment and
why.**

Summarize the key business process, strategic, technical or other
assumptions related to the investment's purpose and direction. Do not
include statements such as "*the program assumes funding will be
approved for this investment*." Rather, the assumptions should be tied
to how the investment links to Agency or organizational strategies for
ensuring the investment's success and barriers that need to be overcome.
Assumptions that specifically affect the investment's cost/benefit
analysis or expected performance goals should be described here, such
as, number of air travelers, weather conditions, etc. Include any
technical assumptions that are critical to the success of the program.
When assumptions cite specific figures, these assumptions should be
accompanied by an official citation of where those figures can be found.

**Question I.A.3:** **Provide any other supporting information derived
from research, interviews, and other documentation.**

Summarize the background information gathering process and research that
occurred to determine this investment's necessity and feasibility. This
information is generally the baseline from which your organization
decided whether a new system or a re-engineering of the current system
is warranted. This section re-states the "problem" the agency is trying
to solve with the proposed investment and lists documentation and
studies that substantiate information on the performance gap and
benefits.

## 3.4 Section I.B -- Justification Guidance

To improve the score in this area, the Exhibit 300 responses need to
demonstrate collaboration with other Federal, State, Tribal, and local
governments, business/industry, and private-citizen organizations. There
is an expectation that investments will collaborate with other agencies
and/or industry and OMB expects this to be articulated in the Exhibit
300. A true multi-agency investment involves a partnering relationship
with another agency/organization outside of the Department of
Transportation. Partners are those agencies actively involved in the
development, operation and change management of the investment and
may/may not be providing part of its funding.

Collaboration with customers and stakeholders should also be discussed
to demonstrate customer/stakeholder-centered programs. One example of
collaboration might be to reference FAA participation and interaction
with the RTCA Inc. If program requirements were developed through work
with the RTCA this information can be included in question 1.B.7.
Additional references to the roles of the IPT (service team) or its
members in participating in RTCA committees in Section 1.D and reference
to RTCA documents/reports in Section I.A.3 would also help support the
business case.

Don't include benefits in Sections I.B and I.E for which there are no
associated performance goals and measures - or plans to include such
measures - in Section I.C. Include narrative in Section I.B.8 that
clearly maps the benefits described in I.B to the performance goals in
Section I.C. If there are plans to include additional performance goals
in the future because information is not available now, such plans
should be described in Section I.B.8 and the related goals would be
included in Section I.C, Table 2, and dates provided when the baseline
and expected improvement information will be provided. Include narrative
in Section 1.B.1 that describes the line of sight to demonstrate linkage
of technology, process, and customer-related improvement goals to
mission-outcome goals such as increased safety/reduced accidents, and
reduced delays when the portion of a specific investment's contribution
cannot be determined or measured. Include the name of the related DOT
and FAA strategic and performance goals in the Table 2 improvement
description to clarify the link between the investment's performance
goals and measures and the DOT and FAA (outcome) goals.

**Question I.B.1: How does this investment support your agency's mission
and strategic goals and objectives?**

In accordance with the latest DOT Strategic and FAA Flight Plan,
identify in detail, which strategic and performance goal(s),
objective(s) this investment supports. Specifically link the
relationship between this investment and furthering the goal(s) and
objective(s). Explain how the flight plan goal/objective won't be
achieved if the performance gap (or problem) is not closed. Information
in this section should be consistent with the goals and benefits
information provided in Section I.C of the business case. For most
programs, FAA's Operational Evolution Plan (OEP) and strategic mapping
process (SMP) details how the program works into the FAA Flight Plan,
including the metrics in some cases.

The Flight Plan is located at <http://www.faa.gov/about/plans_reports>,
DOT's strategic plan is at
<http://www.dot.gov/stratplan2008/strategic_plan.htm>, the OEP can be
found at

<http://www.faa.gov/programs/oep>

**Question I.B.2: How does it support the strategic goals from the
President's Management Agenda?**

The goal of the 2002 Presidential Management Agenda is to create a more
efficient government that better serves the citizens needs. The Agenda
established a set of 8 agency-specific goals and five government-wide
initiatives, which apply to FAA. These five government-wide initiatives
are as follows:

-   Strategic Management of Human Capital

-   Competitive Sourcing

-   Improved Financial Performance

-   Expanded E-Government

-   Budget and Performance Integration

    The response should demonstrate that the project is a collaborative
    project that includes multiple agencies, State, local, or Tribal
    governments, uses e-business technologies and/or the project is
    governed by citizen needs. If appropriate, demonstrate that this
    project is fully aligned with one or more of the President\'s e-Gov
    initiatives. Only map to those PMA goals that the investment clearly
    and directly supports. The President's Management Agenda is located
    at <http://www.whitehouse.gov/omb/budget/fy2002/mgmt.pdf>

    If the investment is steady-state, or has portions that are
    steady-state*,* demonstrate that an E-Gov Strategy Review was
    completed. In the FAA, briefings of post implementation reviews
    (PIRs) and operational assessment data included in semi annual
    service level reviews (SLRs) can be used to satisfy part of the
    E-Gov strategy review requirements as long as all the necessary
    E-Gov strategy review topics are addressed. The PIR guidance is at:

    <http://fast.faa.gov/post_implementation/index.htm>. SLR guidance is
    at:

    <http://fast.faa.gov/index.htm>

    The findings of the E-Gov Strategy Review and resulting planned
    activities or changes should then be discussed in the appropriate
    sections of the business case, to include Sections I.A and I.B (in
    relation to performance gap and expected benefits), I.C, I.E and
    II.A. Unfortunately, most FAA business cases either don't mention
    E-Gov Strategy Reviews or mention them very briefly. It's very
    important to develop and implement approaches for completing E-Gov
    Strategy Reviews and integrating this information into the business
    case development process. This would include integrating this
    process into the Alternatives Analyses, Operational
    Analysis/Assessments, and Post Implementation Review processes. An
    individual E-Gov Strategy Review is not required for each
    investment. It may be beneficial at times to conduct an E-Gov
    strategy review of several investments that support similar
    functions and have similar performance gaps. The SLR serves as the
    review for all the programs for which operational assessment and/or
    post implementation review data has been presented to the JRC.

    SLRs can be used as part of an investment's operational analysis or
    E-Gov strategy review process but they will normally not be
    sufficiently broad in scope or detailed to satisfy operational
    analysis or E-Gov Strategy review requirements in themselves.

An E-Gov Strategy Review is a comprehensive review and analysis that
determines whether the investment is continuing to meet agency needs in
a cost-effective manner or should be modernized and replaced.
Information from the investment's most current FAA semi-annual Service
Level Review can be used as input to this question. Appendix C provides
additional information on approaches for completing e-Gov strategy
reviews and the type of information that should be reported from these
reviews.

Please note that Non-IT investments are more supportive of the Human
Capital PMA goal by enabling greater efficiency of pilots and other
users/customers whose efficiency in performing their functions is
disrupted by power outages.

**Question I.B.3: Are there any alternative sources in the public or
private sectors that could perform this function?**

If there are alternative public or private sector sources that could
perform the same function as the investment, describe in detail the
analysis conducted and the results that indicated the investment was
still required. New initiatives in the planning stages and preparing for
an initial investment JRC decision may need to answer that this is being
researched and determined as part of the planning activities.

**Question I.B.4: If so, explain why your agency did not select one of
these alternatives.**

Use objective or quantifiable reasons when answering this question,
supported with documentation (e.g., studies, analyses, research, etc.).

**Question I.B.5: Who are the customers for this investment?**

Typically, customers are defined as people/groups who are direct users
of the system. The public, pilots and airlines can be defined as
customers of an investment if they are direct users of the system or its
data and/or there are goals in Section I.C, Table 2 (Customer Results)
that clearly relate to them. This is also true of infrastructure systems
that are internal to the agency and interface primarily with other
systems. 

For cases where the public, pilots and airlines are not direct users,
nor are there any Section I.C, Table 2 customer results goals
identifying them as customers, then they would be identified as
stakeholders and the following explanatory statement would be included:

> *"The flying public and pilots, and aviation companies/airlines, as
> indirect customers of Investment-X, are also stakeholders."*

This statement would be followed by a brief explanation of how the
investment indirectly affects/benefits these indirect customers (the
public, airlines, pilots). This approach would categorize pilots/the
public as stakeholders but also define them as indirect customers of the
particular investment.

**Question I.B.6: Who are the stakeholders of this investment?**

Identify all principle groups or individuals who are affected by the
investment's outcome (success or failure). Include those with business
processes that interact with the business process supported by this
investment. For investments where the flying public is not a direct user
and customer, the public would be a stakeholder.

**Question I.B.7: If this is a multi-agency initiative, identify the
agencies and organizations affected by this initiative.**

Collaborative and multi-agency are synonymous terms. To be considered
collaborative an investment will partner with other Federal agencies
(outside DOT), state governments, and/or private industry. This would
include sharing the funding and/or work associated with the planning,
development and deployment of the investment. Shared funding usually
means that other agencies participate in the funding of the investment
and the lead agency that completes the Exhibit 300 shows their
contributions in Section I.H. In the case of FAA, there are some
investments that are collaborative with DOD since DOD is currently
paying part of the costs. However DOD does its own separate reporting of
the funds it provides for certain investments. In such cases the
investment can be considered collaborative, but it is strongly
recommended that the program areas obtain the UPI from DOD (or other
partnering agencies) and provide that UPI in Section I.B.7 of the
business case. Investments should also provide an explanation that the
costs are reported separately and whether the DOD UPI includes other
investments as well.

OMB will expect to see team members from the other agencies included in
Section I.D as part of the investment Integrated Project Team (IPT).
Please note that in ATO and AMS policy, 'IPT' has been replaced with
'service team'.

**Question I.B.7a:** **If this is a multi-agency initiative, discuss the
partnering strategies you are implementing with the participating
agencies and organizations.**

Be very specific with examples of planning or implementing strategies
for this investment. For example, if there is a Memorandum of
Understanding (MOU) that documents the partnership, then reference it
and summarize its general partnering content. If members from partnering
agencies are included in the investment's IPT, clearly identify them in
Section I.D along with their roles and responsibilities.

OMB has issued additional instructions for the Presidential e-Gov
initiatives to providing additional guidance for the preparation of
Exhibit 300 and Exhibit 53. The following information is included in the
guidance.

In preparing an Exhibit 300 as a **Migrating Agency**:

-   Reflect all costs associated with the investment, including
    migration costs incurred by the Migrating Agency. This includes
    identifying and documenting the risks associated with the migration.

-   Identify and quantify any budgeted cost savings to be realized as a
    result of the migration including the performance improvements that
    will be realized.

-   Describe the migration schedule and associated major milestones
    included in that schedule.

-   Describe the interagency work group and associated management
    processes.

In preparing an Exhibit 300 for an e-Gov initiative, **Managing
Partners**:

-   Reflect all costs associated with the initiative, including but not
    limited to program management costs, migration costs, risk-adjusted
    costs, etc.

-   Identify Partner Agencies and describe the funding algorithm used to
    determine partner contributions.

-   Identify and quantify any budgeted cost savings realized as a result
    of the initiative.

-   Include the migration schedule for agencies, including which agency
    investments are migrating and when.

-   Identify the agencies that have signed, or are expected to sign,
    fee-for-service agreements, including the fees associated with those
    agreements (where applicable).

    **Question I.B.8: How will this investment reduce costs or improve
    efficiencies?**

    Describe how the investment will reduce costs and improve
    efficiencies. Include business process changes related to the
    investment that will make the outcome successful. Benefits
    identified in this section should be consistent with those
    identified in Sections I.B.1 and I.E and should be clearly linked to
    the performance improvement goals described in Section I.C. Avoid
    describing benefits that cannot be measured in Section I.C.

Please note that when describing benefits clearly differentiate those
benefits that will result from the phase for which funding is being
requested from longer-term benefits that are expected in the later years
of the investment's life. For future benefits for which there are no
performance goals in Section I.C, describe plans to determine baselines
and establish such goals in the future.

Describe efficiencies in relation to improving business functions and
processes more efficiently as opposed to eliminating FTEs.  The
Processes and Activities measurement area of the PRM specifically deals
with cost savings, cost avoidance, and productivity/efficiency. 

**Question I.B.9: List all other assets that interface with this asset.
Have these assets been re-engineered as part of this investment?
(Yes/No)**

Describe any systems that are interfacing, or will interface, with this
asset. State whether they have been re-engineered as part of this
project.

Respond with a "Yes" or "No" for each asset as the second part of the
question.

# 4. Section I.C -- Performance Goals

## 4.1 Introduction

In order to successfully address this area of the Exhibit 300,
performance goals must be provided for the investment and linked to the
Agency's annual performance plan and mission/strategic goals. These
goals need to map to the gap in the Agency\'s strategic goals and
objectives that this investment is designed to fill. They are the
internal and external performance benefits this project is expected to
deliver to the agency (e.g., improve efficiency by 60%, increase citizen
participation by 300% a year to achieve an overall citizen participation
rate of 75% by FY XXXX, etc.).

Goals must be clearly measurable project outcomes, and if applicable,
project outputs. They do not include the completion date of the module
or project, or general goals, such as, significant, better, improved
that do not have a quantitative or qualitative measure.

There are two tables in this section, Table 1 and Table 2. The guidance
for which table should be used is as follows:

-   **Existing investments that were initiated prior to FY 2005:** Table
    1 must be used to document goals prior to FY 2005 and may be used
    for goals covering FY2005 and later. Table 2 must be used for all
    DME activities starting FY 2005.

-   **Investments that started during FY 2005 or later**: Table 2 must
    be used.

-   **Non-IT investments**: Table 1 must be used.

## 4.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           Performance goals are provided for the agency and are linked to
              the annual performance plan. The investment discusses the
              agency's mission and strategic goals, and performance measures
              are provided.

  4           Performance goals are provided for the agency and are linked to
              the annual performance plan. The investment discusses the
              agency's mission and strategic goals, and performance measures
              are provided. Some work remains to strengthen the PG.

  3           Performance goals exist but the linkage to the agency's mission
              and strategic goals is weak.

  2           Performance goals are in their initial stages and are not
              appropriate for the type of investment. Much work remains to
              strengthen the PG.

  1           There is no evidence of PG for this investment.
  ----------- ---------------------------------------------------------------

## 4.3 FAA-Specific Guidance

FAA as a whole needs to improve its performance measurement indicators
and the linkage between IT investments and program's performance goals.
For future years, offices are encouraged to develop performance goals
and measures that demonstrate support for the Agency's mission and
particularly strategic outcomes. In cases where more than one investment
contributes to an outcome (such as increased safety or reduced delays),
it is important to attribute the appropriate portion of the outcome
improvement to each contributing investment.

[]{.mark}

The Exhibit 300 PB version of the business case should show performance
goals and measures for all the years covering the duration of the phase
that has been or will be approved by the JRC.

At a minimum, OMB Exhibit 300 reports should include goals and measures
up to and including one year beyond the budget year; they may provide
goals for the entire phase or useful segments for which JRC funding has
been approved.

In general, performance improvement goals previously reported to OMB
must be included in subsequent OMB Exhibit 300 submissions and not
eliminated or changed unless such changes are part of a JRC-approved
re-baseline. If they are approved as part of a re-baseline, the reasons
(such as risk adjustments) for the change and the fact that the change
is part of an approved re-baseline need to be clearly reported in
appropriate sections of the Exhibit 300, including Sections I.C, I.F,
and I.H.4. Goals from past years should not be deleted until the actual
performance results have been reported to OMB at least once in the OMB
Exhibit 300 Report submitted officially in September.

### 4.3.1 Helpful Tips

The **Baseline** indicates "where you are today" (for new investments)
or "where you were when you first began" (for steady-state investments).
This is the basis for determining increases or decreases in performance.
**Planned** is the targeted performance level expressed in a metric that
can be measured and compared to the actual performance. **Actual** is
tangible performance results that occurred as the system was used.

**Table 1**

-   **Column #1 Fiscal Year:** Develop and report performance goals
    through at least FY 2005. Performance goals should not be dropped
    from the table unless the actual performance has been reported to
    OMB at least once in a prior year's submission.

-   **Column #2 Strategic Goal(s) Supported:** Indicate which DOT
    Strategic Plan and FAA's Flight Plan goals the investment supports.
    Include a brief statement explaining [how]{.underline} this
    investment supports the strategic plan goal(s) and objective(s).

-   **Column #3 Existing Baseline:** Enter the baseline for each
    performance goal. This is the metric that will measure planned
    versus actual performance for each performance goal. To the maximum
    extent practicable, this should be a quantitative metric for the
    units that are being measured (for example: the number of delays per
    year, the number of accidents per year, the number of errors per
    year, customer complaints per year, hours required to complete an
    activity/task, or cost of something in dollars, etc).

-   **Column #4 Planned Performance Improvement Goal:** Enter the
    performance ***improvement*** goal(s) that were planned for the
    investment through 2005. Performance goals should be expressed in
    outcomes, using quantifiable metrics which will be used to measure
    the results. Improvement goals are usually expressed in terms of
    percentages (for example % reduction in delays, errors, or customer
    complaints)

-   **Column #5 Actual Performance Improvement Results:** Enter the
    actual result as compared to the planned goal. For the current year,
    state the mid-year progress (if available), progress projected to
    the end-of-year, or when performance will be measured. For future
    years, when the information is not known, provide an estimated date
    for when it will be available. Actual performance improvements are
    often expressed in terms of the % improvement actually achieved.
    Actual results are not required for the Exhibit 300 PB unless a
    previous phase or useful segment for the investment has been
    completed.

-   **Column #6 Planned Metric Performance:** Enter the quantitative
    performance *metric* that will use to measure progress (for example:
    number of errors per year, number of customer complaints per year,
    number of hours required for an activity, etc). This can be an
    output that is directly tied to achieving the strategic outcome.

-   **Column #7 Actual Performance Metric Results:** For the current
    year, state the mid-year progress (if available), progress projected
    to the end-of-year, or state when performance will be measured. For
    future years, when the information is not known, provide an
    estimated date for when it will be available.

    **Table 2**

All new IT investments that include DME activities for 2005 and beyond
must use Table 2 and are required to map to the Federal Enterprise
Architecture (FEA) Performance Reference Model (PRM). The PRM includes
detailed guidance about how to incorporate PRM Indicators into the
performance goals and measures table. Use the Table 2 and the PRM to
identify the performance information that pertains to the major IT
Investment. Ensure there is a complete tie-in to the strategic goals and
objectives described in Sections I.B.1 and I.B.8.

A key concept of the PRM is a term called "**operationalized
indicators**". Operationalized indicators explain how IT investments
support business functions of the Business Reference Model (BRM). These
business functions can be Services to Citizens or they can be functions
that Support Delivery of Services or improved Management of Government
Resources. In other words, the operationalized indicators are the actual
metrics that are used to measure progress towards achieving the goal.
For example, a generic indicator from the BRM would be "Air
Transportation." The operationalized indicator, or specific metric to be
used, could be "Hours of Passenger Delay."

### 4.3.2 Creating the "Line of Sight"

The line of sight referred to in the PRM is a logical set of
cause-and-effect relationships, laid out for each year that show how
Technology supports improved Processes or Activities to create program
outputs that in turn support Customer Results and Mission and Business
Results. In other words, for each year in Table 2, there is a line of
sight (a story line) that traces how improvements related to technology
improve business activities, which in turn improve customer satisfaction
and mission results. The line of sight is typically four lines in Table
2 for each year, each line containing an operationalized indicator, or
specific metric.

Start with the desired outcome at the "top" of the line of sight, then
trace back to the outputs and inputs. According to the PRM, the outcome
can be at any of the three levels of the BRM (Services for Citizens,
Support Delivery of Services, or Management of Government Resources), as
appropriate to the individual investment.

An example of a line of sight follows:

[]{.mark}

![](media/image3.wmf){width="6.5in" height="2.8006944444444444in"}

Figure 2: Line of Sight from Output to Outcome Goals

-   The line of sight should be based on the primary BRM mapping.

-   All major IT investments requesting new DME funding for FY 2005 and
    beyond must identify at least one indicator in each of the four
    Measurement Areas: Mission and Business Results, Customer Results,
    Processes and Activities, and Technology Measurement Areas.

-   For Table 2 identify at least one indicator for each of the
    measurement areas specified in the PRM. Use the same indicators each
    year to demonstrate the intended value of the investment over time.

-   Table 2 should include all goals beginning with FY 2005 that were
    reported in last year's submission, plus goals for future years up
    through one year beyond the budget year.

-   Mission goals listed in the DOT Strategic Plan and FAA flight plan
    are the ultimate strategic outcome that investments support, yet it
    may be appropriate to name some subsidiary or lesser mission
    objective or sub-objective that the investment supports. Build on
    what you have from last year and review the DOT Strategic Plan and
    FAA Flight Plan for the appropriate outcomes your investment
    supports.

-   Goals related to Support Delivery of Services or Management of
    Government Resources are also legitimate outcomes at the top of the
    line of sight. If your investment is an administrative or support
    system that is not directly tied to FAA mission and Flight Plan
    results, your line-of-sight outcome can support these other levels
    of the BRM (e.g., "reduce cost of grant processing," "provide more
    efficient legislative tracking"). Again, build on what you have from
    last year. *If you want to take a further step in the line of sight
    and link a support or administrative process to the DOT Strategic
    Goals and the FAA Flight Plan Goals, do so. This will allow you to
    ensure there is a complete tie-in to the Goals described in I.B.1
    and I.B.8.*

```{=html}
<!-- -->
```
-   Include the Generic Measurement Indicator Grouping as well as the
    operationalized indicator in the "Measurement Indicator" column. The
    operationalized indicator must be consistent with the selected
    Generic Measurement Indictor Grouping in FEA PRM.

-   In Table 2, "Baseline," "Planned Improvement to Baseline," and
    "Actual Results" should contain numerical data showing the status of
    the indicator at the beginning of the fiscal year, the desired
    target level, and the indicator at the end of the fiscal year,
    respectively.

-   In Table 2, if there is no data for the measurement, indicate in the
    data field why the data is not yet collected, explain how the data
    will be collected over the course of the upcoming fiscal year, and
    provide an estimated date by which the required data will be
    available.

-   It is expected that in many cases, benefits and their related
    performance goals will not be realized until an investment is at
    least partly operational.

Please note that new investments that have not yet completed a final JRC
investment decision need only provide estimated goals. In most cases it
will be difficult during the preliminary planning phases of these new
initiatives to quantify these goals. Therefore, Table 2 should show the
types of performance improvements that are expected and provide an
estimated date for when the information to quantify baselines and
performance improvements will become available.

To demonstrate linkage of specific performance improvement goals to the
DOT Strategic and FAA Flight Plan goals, the names of the appropriate
DOT/FAA goals that are supported by a performance improvement may be
included in the "Planned Improvement to the Baseline" Column.

# 5. Section I.D - Program Management

## 5.1 Introduction

The OMB Circular A-11, Part 7, Capital Programming Guide, and the OPM
Project Management Guidance "Interpretive Guidance for Project Manager
Positions," discuss project management structures, responsibilities, and
qualifications that contribute to successful achievement of cost,
schedule, and performance goals.

The score in this section is directly related to other sections of the
business case such as Performance Goals, Risk Management, Acquisition
Strategy, Alternatives Analysis, and Performance Based Management
(PBM)/EVM. The business case needs to ensure that the management
strategies described in these sections is consistent. Additionally,
manager and IPT roles in EVM, Operational Analysis and CPIC governance
processes should be included in question I.D.1.A. A more detailed
description of FAA IPTs based on FAA guidelines would also be helpful.

Please note that in ATO and AMS policy, 'IPT' has been replaced with
'service team'.

## 5.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           Project is very strong and has resources in place to manage it.

  4           Project has few weak points in the area of PM and agency is
              working to strengthen PM.

  3           Much work remains in order for PM to manage the risks of this
              project.

  2           There is some understanding of PM for this project but
              understanding is rudimentary.

  1           There is no evidence of PM.
  ----------- ---------------------------------------------------------------

## 5.3 Guidance

**Question I.D.1: Is there a project (investment) manager assigned to
the investment? (Yes/No) If so, what is his or her name?**

Each program must have a program manager and the program manager name
must be entered here. There can only be one government program manager
for each investment; however, there can be more than one contract
manager. In the case of multiple contract managers, they should be
listed under question I.D.1.A. Make sure the person listed in this
response has read and concurs with all information in the Exhibit 300.
Be sure to provide contact information (at least the telephone number)
for each of the managers listed below in Section I.D.1.A.

[]{.mark}

**Question I.D.1.A: Identify the members, roles, qualifications, and
contact information of the in-house and contract project (investment)
managers for this project.**

The response should be in alignment with the Capital Programming Guide
(A-11, Part 7). If there are qualification gaps, then state the gaps and
briefly describe the Corrective Action Plan (CAP) to eliminate them.

OMB published a policy (OMB Memorandum M-04-19, dated July 21, 2004)
regarding project managers. Paragraph 3 asks that Exhibit 300s explain
the following: (1) The required PM level for this investment; (2)
Whether the assigned PMs qualifications have been validated against
Federal CIO Council guidance; and (3) If applicable explain when the
validation will be completed. New PMs must be validated against the CIO
Council guidance within 180 days of appointment. Status of appointments
and validation should be coordinated with the AIO Value Management
Office.

The following statements should be included the opening paragraph in
Part 1.D.1.A, as appropriate:

1\. For projects that have a PMI PMP-certified PM and whose
qualifications have been validated against the CIOC guidance:

> *"According to the criteria provided in the Federal IT Project
> Management Matrix, the (project acronym) investment requires project
> management level ( 1 / 2 / 3 ) support. Mr./Ms. (Project Manager), the
> FAA's project manager for the (project acronym) project, is a Project
> Management Institute (PMI) certified Project Management Professional
> (PMP) and has been certified to this level. He/She has satisfied the
> IT project management competency requirements identified in the
> Federal CIOC Council guidance. Mr. / Ms. (Project Manager / Team
> Member) can be contacted at (phone number with area code)."*

2\. If the PM is supported by a team member such as an IT Lead who has
completed PMI PMP certification add:

> *"Mr./Ms. (Project Manager) is supported by an Mr. / Ms. (IT Lead) who
> has satisfied the required IT project management requirements."*

Following the initial statement of qualifications above, the PM and
project management team members individual qualifications and project
management roles should be described. Qualification statements should
include degrees and other relevant certifications held, years of project
management and acquisition experience with projects of similar size and
complexity, years experience with the investment that is the subject of
the OMB Exhibit 300 submission. In cases where the PM is certified by an
assessment process rather than a training program certification (e.g.
PMI PMP), include a summary of significant project management experience
and coursework such as Fundamentals of the AMS.

[]{.mark}

This section should also describe the project managers' roles in the
investment's governance, lifecycle management, and performance
monitoring processes, including participation in investment review
boards and coordination with the IPT.

The following information should be added to this question to reflect
the Agency\'s approach to risk management:

> \"*The service team\'s risk management strategy is based on FAA\'s
> Systems Engineering Manual, Section 4.10, Risk Management Guidance. It
> provides that all members and stakeholders supporting the \<insert
> program name\> meet periodically to report on and discuss status of
> identified medium or high program risks; and, present and or identify
> any potential new risks to the team for discussion, assignment of an
> owner, and mitigation. Evidence of the meeting dates can be seen in
> some of the listed risks below under \"Current Status.\" The FAA risk
> guidance was updated in April 2004, to address OMB\'s 19 categories as
> a standard activity in risk management planning and reporting.\"*

For new investments that have not yet completed a final JRC investment
decision, this section should provide available information and state
that additional management personnel may be identified as the project
completes its planning phase and provide an estimated date for when the
additional information will be available.

**Question I.D.2: Is there a contracting officer assigned to this
project (investment)? (Yes/No) If so, what is his/her name?**

Enter the name of the contracting officer. If there are multiple
contracting officers, enter the one who is responsible for the largest
contract.

**Question I.D.3: Is there an Integrated Project Team? (Yes, No)**

IPT means a multi-disciplinary team led by a program manager responsible
and accountable for planning, budgeting, procurement and lifecycle
management of the investment to achieve its cost, schedule and
performance goals. Team skills include: budget, financial, capital
planning, procurement, users, requirements analysis, quality assurance,
configuration management, earned value management, operational analysis,
security, Enterprise Architecture, testing and other staff as
appropriate.

For new initiatives/investments that have not yet completed an initial
JRC investment decision, this section should provide available
information and existing team membership. This section should state that
IPT membership and needed skills will be identified when the planning
phase is completed and provide an estimated date when that information
will be available.

**Question I.D.3.A: If so, list the skill set represented.**

Refer to the guidance in I.D.3 above. Mention any certifications (such
as project management, security, and technical) pertinent to the
investment that have been completed by managers and IPT members or that
are planned for completion (include the planned completion date). It is
very important to identify IPT members with Earned Value Management
(EVM) and operational analysis experience. Also, clearly identity IPT
members from partnering agencies and describe how they participate in
IPT activities.

**Question I.D.4: Is there a sponsor/owner for this investment?
(Yes/No)**

Choose the person with developmental and execution authority for an
investment/project who manages the funding for a project, once
allocated, as well as securing additional funding. The owner appoints
the project manager and manages the people supporting the project. This
individual is accountable for ensuring the project is developed on time,
within budget, and adheres to performance and security requirements. The
sponsor coordinates the System Development Lifecycle (SDLC) activities
with those of the FAA Investment Management process and Enterprise
Architecture effort. This is a long-term position that should ideally be
maintained by the same individual over the life of the investment.

The FAA executive responsible for the investment should be listed as the
sponsor. If the investment is in the steady-state mode, then the sponsor
should be the FAA executive responsible for its operation and
maintenance.

**Question I.D.4.A: If so, identify the sponsor/owner by name and title
and provide contact information.**

Refer to the guidance above.

# 6. Section I.E - Alternative Analysis

## 6.1 Introduction

In order to successfully address this area of the business case, the
program must include three viable alternatives that were compared
consistently. The Agency must identify all viable alternatives and then
select and report details on the top three alternatives. The Clinger
Cohen Act and OMB Circular A-94 include minimum criteria to be applied
in considering whether to undertake a particular investment, including
criteria related to the quantitatively expressed projected net,
risk-adjusted return on investment and specific quantitative and
qualitative criteria for comparing and prioritizing alternative
investments*.* For IT investments, agencies should use the Federal
Enterprise Architecture (FEA) to identify potential partnerships or
joint solutions that may be used to close the identified performance
gap. Appendix B includes the web location for the Federal Architecture
Management System (FEAMS), a web-based management system designed to
provide agencies with access to initiatives aligned to the FEA and the
associated reference models

Information in this section should be consistent with the Business Case
Analysis Report (BCAR). If the investment alternative analysis is more
than 5 years old it is considered outdated and must be updated. This
usually means that JRC approval will be needed for new phases of an
existing investment or for changes to previously approved program
baselines.

For investments that are past the original alternative analysis and/or
didn't have three viable alternatives, the program must schedule a new
alternatives analysis (which includes a Cost Benefit Analysis) and show
this as a milestone in Section I.H.

## 6.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           AA includes three viable alternatives, alternatives were
              compared consistently, and reasons and benefits were provided
              for the alternative chosen.

  4           AA includes three viable alternatives, however work needs to
              continue to show alternatives comparison, and support must be
              provided for the chosen alternative.

  3           AA includes fewer than three alternatives and overall analysis
              needs strengthening.

  2           AA includes weak AA information and significant weaknesses
              exist.

  1           There is no evidence that an AA was performed.
  ----------- ---------------------------------------------------------------

## 6.3 Guidance

**Question I.E.1: Describe the alternative solutions you considered for
accomplishing the agency strategic goals or for closing the performance
gap that this investment was expected to address. Describe the results
of the feasibility/performance/benefits analysis. Provide comparisons of
the returns (financial and other) for each alternative.**

Describe the research and methodology used to determine the need for
this investment. Describe the criteria used to choose this investment
versus other investments. Describe how closing any FAA performance gap
was part of the analysis and decision-making process. If this is a
steady-state investment, mention if this alternatives analysis is part
of, or a follow-on to, an E-Gov Strategy Review. Describe the results of
the E-Gov Strategy Review. See the guidance for Section I.B. for ore
information on E-Gov Strategy Reviews.

For new initiatives and/or when the AA cannot be completed before
submission of the business case, include a discussion of alternatives
that will be, or are being, considered and some rough order magnitude
(ROM) estimates of alternative costs, benefits, and net present value.
Include the planned completion date for the Alternative Analysis,
Cost-Benefit Analysis, etc. and include these as milestones in Section
I.H.

-   [Planning/Beginning of Full Acquisition]{.underline}: At this point
    in the lifecycle the program is describing the alternatives
    considered to meet a mission need or close a performance gap.

-   [Full Acquisition/Beginning of Maintenance]{.underline}: At this
    point in the lifecycle the program should be validating that the
    previously selected alternative is still the best alternative versus
    other possible alternatives, and continues to meet the specified
    cost, schedule, and performance goals.

-   [Steady-state]{.underline}**:** Once the investment has reached the
    maintenance and operations phase the program should periodically
    validate that it continues to meet the specified cost, schedule and
    performance goals, and that it's performing well. The alternative
    analysis should discuss the performance benefits versus other
    alternatives such as replacement or upgrade. If the investment is
    not meeting performance goals or needs, the alternatives analysis is
    looking at future alternatives for replacement or upgrade.

**Question I.E.1.A: Discuss the market research that was done to
identify innovative solutions for this project (e.g., used an RFI to
obtain 4 different solutions to evaluate, held open meetings with
contractors to discuss project scope, etc.). Also describe what data was
used to make estimates: past or current contract prices for similar
work, contractor provided estimates from RFIs or meetings, general
market publications, etc.**

  ----------------------- -----------------------------------------------
  **Alternative**         **Description**

  Alternative #1          Summary of findings:

  Alternative #2:         Summary of findings:

  Alternative #3          Summary of findings:
  ----------------------- -----------------------------------------------

Using the Alternatives Table make sure the alternatives are all
[viable]{.underline}. Do not list an alternative you examined if your
analysis showed it was not a feasible or viable alternative. List a very
short title of the alternative in the first column, and provide summary
information in the description column.

**Question I.E.2: Summarize the results of your life-cycle cost analysis
performed for each investment and the underlying assumptions.**

  --------------- ----------------- ------------------- -------------------
  **Cost          **Alternative 1** **Alternative 2**   **Alternative 3**
  Elements**                                            

  Element 1                                             

  Element 2                                             

  Element 3                                             

  Element 4                                             

  Element 5                                             

  Total                                                 
  --------------- ----------------- ------------------- -------------------

For each alternative, use the table in this section to list the cost
elements used for comparison purposes when conducting the analysis, and
summarize the associated resources and findings from your analysis. Make
sure the elements are consistently compared, per OMB scoring criteria.
New projects should include security costs and considerations with each
alternative. At a minimum the cost elements should include hardware,
software, contractor labor, and government labor (FTE) costs for each
project phase (planning, development/implementation, and maintenance.
State whether dollars are in thousands or millions. State whether costs
shown are in constant dollars of inflated dollars. (Constant dollars
should normally be used for the alternatives and cost benefit analysis).

Describe how the project risk-adjusted the benefits, milestone and
schedule costs or explain how the program plans to risk-adjust these
costs. Use Section I.E.3 to provide this information if the CPIC tool
does not allow narrative text in this section. This narrative should
include information on whether/how costs of mitigation strategies shown
in the risk table are included in the Section I.H costs.

The updated alternatives analysis should *not* include sunk costs in
questions I.E.2 or I.E.3. All alternatives should be based on the best
way of closing the performance gap from this point forward. However, if
the CBA was done within the last five years and is still valid
(assumptions still hold true and there are no major changes in the
program environment), then the cost estimates of the original or most
recent AA would continue to be reported and these would include the sunk
costs that have been incurred to date since the last AA update.

**Question I.E.3: Which alternative was chosen and why?**

Identify the alternative from the above analysis that was selected and
explain why. This section should include a summary comparison of the
total ROI and NPV of the alternatives and other considerations such as
differences in costs, benefits, and risks that explain why one
alternative is preferred over the others. If agency funding
decisions/constraints have resulted in the selection or implementation
of an alternative that was not the preferred one, this should be
explained in this section.

Explain how the program defined the ROI (is it measured by cost savings,
improved efficiency in specific processes, decreased error rates, etc.)
and what that return is expected to be for each of the three
alternatives. Describe how the estimated returns provided by each
alternative compare to one another. Also discuss the payback period and
the NPV *at investment completion/end* for all three alternatives.

It is important to have *consistency* between the lifecycle costs for
the selected alternative in this section, the SoS table and Section I.H.
There are reasons however why the costs shown in Section I.E will not
*match* the costs shown in the SoS table or Section I.H. Below are some
reasons why these costs may not match that can be included as
appropriate in this section:

-   The SoS table should show the investment's inflated costs and total
    lifecycle costs, from beginning until it is discontinued or
    replaced.

-   The AA table in I.E.2 showing the total costs of all three
    alternatives should be consistent with whether they used constant or
    inflated dollars in their analysis of costs and benefits and in the
    NPV table in I.E.3.B. Normally the analysis should be based on
    constant/real dollars instead of inflated. The cost table in I.E.2
    would normally not include sunk costs (i.e. it would include only
    those costs from the latest AA update and the costs would include
    only those years shown in the NPV table).

-   The AA NPV table in I.E.3.B would normally use non-inflated
    constant/real dollars. It would not include sunk costs prior to the
    latest update to the AA. The narrative in Section I.E.3 should
    include a brief explanation of the rates used, the reasons and if
    inflated dollars were used for their analysis, and an explanation of
    the reason.

-   The costs shown in Section I.E should include government labor (FTE)
    costs, however if FTE costs were not included in the planning,
    acquisition and maintenance rows of the SoS table, this should be
    explained in Section I.E.

-   The FAA CIP (approved budget) in the SoS table may not be the same
    as the total costs for the preferred alternative or the related
    approved program baseline.

**Question I.E.3.A: Are there any quantitative benefits that will be
achieved though this investment (e.g., systems savings, cost avoidance,
stakeholder benefits, etc.)? Define the Return on Investment (ROI)**.

Discuss the quantitative benefits used to make up the expected yearly
costs and benefits used in the NPV calculations.

The benefits described in this section should be consistent with those
described in Sections I.A and I.B.8 and should be measurable by the
performance goals and measures in Section I.C. Benefits that cannot be
measured now or in the future should not be included in this section.

Benefits to be considered should include increased safety, accuracy,
availability, and efficiency and related cost savings or avoidances.

**Question I.E.3.B: For the alternative selected, provide the financial
summary, including Net Present Value by Year and Payback Period
Calculations.**

  ------------- -------- -------- -------- -------- -------- -------- -------- -------- --------
  **Year =**    **FY**   **FY**   **FY**   **FY**   **FY**   **FY**   **FY**   **FY**   **FY**

  Annual Cost                                                                           

  Annual                                                                                
  Benefit                                                                               

  Discount                                                                              
  Factor                                                                                

  Discounted                                                                            
  Benefit                                                                               

  Net Present                                                                           
  Value (NPV)                                                                           

  Payback                                                                               
  Period                                                                                
  (Cumulative                                                                           
  NPV)                                                                                  
  ------------- -------- -------- -------- -------- -------- -------- -------- -------- --------

*Net Present Value by Year:* For the selected alternative, start with
the first fiscal year used in the analysis, and continue through the
last fiscal year used in the analysis.

Indicate whether constant or inflated dollars are being used. (Constant
dollars are usually used in a cost-benefit analysis). State the discount
rate that is being used (for example, 7%).

The number of years included on the NPV table should include all years
from the date of the last update to the analysis through the last year
of the estimated total life of the investment. The last year of the
expected investment life should be consistent with the date shown in
response to the "investment completion date" screening question.

To calculate the pay back period, add the individual yearly estimates
from the Expected Yearly Benefit row and compare it to the Expected
Yearly Costs total for that row. The year when the sum of your expected
yearly benefits exceeds your total costs is the beginning of the
investment pay back period.

When an analysis is updated, sunk costs should not be included in the
updated NPV table.

**Question I.E.4: What is the date of your cost-benefit analysis?**

Provide the month and year of the last time it was updated.

# 7. Section I.F - Risk Inventory and Assessment

## 7.1 Introduction

In order to successfully address this section of the Exhibit 300 the
program must have performed a Risk Assessment and developed a Risk
Management Plan at initial concept, addressed the mandatory risk
elements defined below and demonstrate active risk management throughout
the life-cycle of the investment. For all investments, both IT and
non-IT, the program must discuss risks in the pertinent risk areas
listed below and discuss plans to mitigate the risk. If there is no risk
to report for the investment achieving its goals from a risk category,
say this. Only a subset of a project's active risks are required --
sufficient to demonstrate that all 19 aspects have been considered. If
there are additional risks, current E-CPIC capabilities require
arrangements to be made to include these in a separate attachment.

Risk assessments for all investments must include reporting for: 1)
schedule, 2) initial costs, 3) life-cycle costs), 4) technical
obsolescence, 5) feasibility, 6) reliability of systems, 7) dependencies
and interoperability between this investment and others, 8) surety
(asset protection) considerations, 9) risk of creating a monopoly for
future procurements, 10) capability of agency to manage the investment,
and 11) overall risk of project failure.

In addition, for IT investments, risk must be discussed in the following
categories: 12) Organizational and Change Management, 13) Business, 14)
Data/Info, 15) Technology, 16) Strategic, 17) Security, 18) Privacy and
19) Project Resources. For all risks, identify under the probability of
occurrence column the level of risk as high, medium, or basic based on
the assessment criteria defined in the approved Risk Management Plan.
Note that OMB uses the term "basic" for "low" risks. For security risks,
what aspect of security determines the level of risk (i.e., the need for
confidentiality of information, availability of information or system,
reliability of the information or system)?

## 7.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           Risk assessment was performed for all mandatory elements and
              risk is managed throughout the investment.

  4           Risk assessment addresses some of the risk, but not all that
              should be addressed for this investment.

  3           Risk management is very weak and does not seem to address or
              manage most of the risk associated with the investment.

  2           Risk assessment was performed at the outset of the investment
              but does not seem to be part of the program management.

  1           There is no evidence of a risk assessment plan or strategy.
  ----------- ---------------------------------------------------------------

## 7.3 Guidance

The following table lists and defines the risk areas to report risks
against and which programs must address them:

  -------------------------------------------------------------------------------
  **Area of Risk**   **Risk Area Description**                        **Must be
                                                                      addressed
                                                                      by:**
  ------------------ ------------------------------------------------ -----------
  1 -- Schedule      The risk that the project will not be completed  All
                     within the schedule specified                    programs

  2 -- Initial Costs The risk of exceeding the initial cost estimate  All
                     figures                                          programs

  3 -- Life-cycle    The risk that the project will not be completed  All
  Costs              within the budget specified                      programs

  4 -- Technical     The ability to adequately maintain the system    All
  Obsolescence       after deployment                                 programs

  5 -- Feasibility   The risks associated with adequately developing, All
                     fielding, and maintaining the resulting systems  programs

  6 -- Reliability   The risk that the system availability/downtime   All
  of Systems         will have a negative effect on field operations. programs

  7 -- Dependencies  How well the system or program produced operates All
  and                with other internal or external organizations'   programs
  Interoperability   systems                                          
  Between This and                                                    
  Other Investments                                                   

  8 -- Surety (Asset The risk of an organization not to protect       All
  Protection)        fixed, intellectual, and human assets from harm  programs
  Considerations     -- related to Continuity of Operations Plans     

  9 - Risk of        The unavailability of several different sources  All
  Creating a         for procurement of goods and services            programs
  Monopoly for                                                        
  Future                                                              
  Procurements                                                        

  10 -- Capability   The risk to program success from the complexity  All
  of Agency to       of the project (e.g., number of subtasks and/or  programs
  Manage the         number of performing organizations). Risks       
  Investment         associated with obtaining and using applicable   
                     resources and activities, which may be outside   
                     the project's control but can affect the         
                     project's outcome                                

  11 -- Overall Risk The risks to the project from a holistic view    All
  of Investment      that considers project management, technology,   programs
  Failure            contract, cost, schedule, performance,           
                     requirements as well as the other risk           
                     categories                                       

  12 --              The risk associated with various stakeholders    IT programs
  Organizational and supporting the development, implementation, and  only
  Change Management  operation of the project, such as Congress,      
                     users, senior business executives, and business  
                     organizations                                    

  13 -- Business     The risk inherent in system operation, including IT programs
                     the probability of failure, external influences, only
                     organizational or management structure, change   
                     management, and availability of project          
                     resources (labor, materials, services)           

  14 -- Data/Info    The risk that input data and information is of   IT programs
                     substandard quality and integrity or the         only
                     possibility that data is managed or used         
                     incorrectly                                      

  15 -- Technology   The risk associated with (1) developing a new or IT programs
                     extending an existing technology to provide a    only
                     greater level of performance than previously     
                     demonstrated, (2) achieving an existing level of 
                     performance subject to new constraints, or (3)   
                     how well the system operates to design or safety 
                     specifications                                   

  16 -- Strategic    The negative effect of changes in the strategic  IT programs
                     goals of an organization on the project          only

  17 -- Security     The risk that IT and physical security is not    IT programs
                     sufficient to protect an organization's fixed,   only
                     intellectual, and human assets. Level of risk,   
                     determined primarily by confidentiality,         
                     availability, or reliability, is "basic"         

  18 -- Privacy      The risk that the privacy of the public or of    IT programs
                     the organization's workers is compromised        only

  19 -- Project      The risk of unavailability of funds, staff, and  IT programs
  Resources          contractual resources when they're needed and    only
                     confidence in management and Congress that these 
                     resources will continue to be provided           
  -------------------------------------------------------------------------------

Table 5: OMB Risk Reporting Categories

Indicate any mitigation risk or strategies whose costs have been
included in the Section I.H milestones, regardless of whether they are
shown as individual milestones or included as part of other milestones.
Clearly identify in the *Strategy for Mitigation* or in the *Current
Status* columns if the risks and/or mitigation strategy have been used
to adjust the cost and schedule goals shown in Section I.H, including
whether management reserve is included.

Please note that this section is to be updated at least once a year, or
as often as your Risk Management Plan is updated to reflect risk
management updates.

***Date Identified**:* Provide the date when the risk was first
identified. Every program must perform some kind of risk assessment
during the initial concept/planning stage, therefore at a minimum the
date of the initial risk assessment should be entered in this column.
However, risks are not static; therefore as risks are mitigated and
replaced by new ones, the "Date Identified" should change to reflect the
new risks. A risk assessment should normally be updated at least when an
investment enters a new lifecycle phase.

***Description of Risk**:* Briefly describe the ***specific*** risk that
was identified for each risk area. Also describe the seriousness and
level (low, medium, or high) of the impact an occurrence of this risk
would have on agency missions. The risk statement should be clearly
stated in the "if -- then" format to clearly explain the specific risk
and its consequences/impact. This column should also be used to indicate
the date when the risk information was last reviewed or updated. Do not
simply put N/A in a risk category. Instead use the risk description and
risk mitigation columns to describe why the risk is negligible. The risk
description and impact should be updated to reflect the current phase
and status of the investment.

***Probability of Occurrence**:* Using the criteria established in the
approved Risk Management Plan, develop a method for determining whether
the magnitude of the risk is rated as High, Medium, and Basic (low).
This field should reflect the current risk level based on the status of
mitigation actions.

***Strategy for Mitigation**:* Briefly describe the preventative methods
or plan for addressing the risk and discuss if mitigating this risk
resulted in adjusting your return on investment in question I.E.3.B.

***Current Status**:* Briefly describe the status of your mitigation
activities, to include identifying any mitigation actions that have been
completed and the status of ongoing ones. Provide specific milestones
and dates as appropriate, rather than stating that mitigation activities
are on-going. On-going projects should be sure to update any outstanding
status commitments from last year's Exhibit. If a specific risk
mitigation results is reflected in the (risk adjusted) cost or schedule
baseline(s), indicate so.

As a quality check on the entries made, read the entries for each
category to see if they're coherent. Does the risk statement describe
the risk, its root cause, and the impact to success of this investment?
Does the strategy actually address the risk described? Does the status
demonstrate how the strategy is being implemented and whether the risk
is being reduced as a result?

**Question I.F.1: What is the date of your risk management plan?
(MM/DD/YYYY)**

This response should reflect the date when the governing Risk Management
Plan was last approved. An Exhibit 300 cannot score a 5 if it does not
demonstrate in the Risk Management (RM) section that risk is being
managed consistently throughout a program's life. An indication that an
investment is effectively managing risk is to read the Exhibit 300 from
front to back. Are the risks discussed in the other sections of this
business case reflected in the risk section? If not, the Exhibit is NOT
presenting strong evidence that risks are being proactively managed.
Appendix D to this document contains additional guidance on consistency.

# 8. Section I.G - Acquisition Strategy

## 8.1 Introduction

In order to adequately address the questions in this section OMB wants
to see programs employ a strong acquisition strategy that mitigates risk
to the federal government, accommodates Section 508 as needed, and uses
performance based contracts. If an investment is not using performance
based contracts and Statements of Works (SOWs), the acquisition strategy
should clearly state the reasons that prompted use of other than
performance based contracts and SOWs and how the risk to the government
will be mitigated. Implementation of the acquisition strategy must also
be clearly defined.

Information in this section should be consistent with the Information
Strategy and Planning (ISP) document.

Finally, this section should map the contract CLINs to the useful
segments and milestones that are documented in Section I.H.

## 8.2 Scoring Criteria

+------+---------------------------------------------------------------+
| *    | **Description**                                               |
| *Sco |                                                               |
| re** |                                                               |
+------+---------------------------------------------------------------+
| 5    | Strong Acquisition Strategy that mitigates risk to the        |
|      | Federal Government, accommodates Section 508 as needed, and   |
|      | uses contracts and statements of work (SOWs) that are         |
|      | performance based.                                            |
|      |                                                               |
|      | Implementation of the Acquisition Strategy is clearly         |
|      | defined.                                                      |
+------+---------------------------------------------------------------+
| 4    | Strong Acquisition Strategy that mitigates risk to the        |
|      | Federal Government, accommodates Section 508 as needed, uses  |
|      | contracts and SOWs that are performance based. Acquisition    |
|      | strategy has very few weak points which agency is working to  |
|      | strengthen, and the implementation of AS is clearly defined.  |
+------+---------------------------------------------------------------+
| 3    | Acquisition strategy does not appear to successfully mitigate |
|      | risk to the Federal Government, accommodates Section 508 as   |
|      | needed, much work remains to solidify and quantify the AS,    |
|      | and contracts and SOWs do not appear to be performance based. |
+------+---------------------------------------------------------------+
| 2    | Acquisition strategy does not appear to successfully mitigate |
|      | risk to the Federal Government, does not accommodate Section  |
|      | 508, does not appear to use performance based contracts and   |
|      | SOWs, and there is no clear implementation of the acquisition |
|      | strategy.                                                     |
+------+---------------------------------------------------------------+
| 1    | There is no evidence of an AS.                                |
+------+---------------------------------------------------------------+

## 8.3 Guidance

**Question I.G.1: Will you use a single contract or several contracts to
accomplish this investment?**

Question I.G.1 is followed by two other questions that go into more
detail about single versus multiple contracts. When answering these
questions, keep in mind that FAA is moving towards Firm Fixed Price
(FFP), performance based contracts. These are contracts in which the
Government specifies the end requirement and allows the contractor to
provide the solution at a specific price.

In addition to listing each of the contracting vehicle(s) for the
investment and how they interrelate, please specify what agency "owns"
the contract. For example: GSA Schedule 70, Company ABC.

**Question I.G.1.A: What type of contract/task order if a single
contract is used?**

Specify the type of contract; Firm Fixed Price (FFP), Cost Plus Fixed
Fee (CPFF), Time and Materials (T&M), etc. Also specify if the contract
is a performance-based contract. All contracts or task orders must be
performance-based. Specify any plans to use FFP and performance based
contracts in the future if they are not currently being used.

If multiple contracts are being used then enter N/A and go to question
I.G.1.B

**Question I.G.1.B: If multiple contract/task orders will be used,
discuss the type, how they relate to each other to reach investment
outcomes, and how much each contributes to the achievement of the
project cost, schedule and performance goals. Also discuss the
contract/task order solicitation or contract provisions that allow the
contractor to provide innovative, transformational solutions.**

Specify the type of contract; FFP, CPFF, T&M, etc. Also specify if the
contract is a performance-based contract. All contracts or task orders
must be performance-based. Specify any plans to use FFP and performance
based contracts in the future if they are not currently being used.

In addition, describe any contract clauses that allow the contractor to
achieve performance of the contract in the manner it determines will
result in better, faster, cheaper results to the Government. OMB's
guidance is that programs should use FFP contracts for the DME phase of
an investment.

Additionally, map the various contracts to the Exhibit 300 PB and useful
segments in Section I.H. For example, contract A covers useful segments
A and B and includes the following CLINs. Contract B covers useful
segment C and includes the following CLINs.

**Question I.G.2: For other than firm-fixed price, performance-based
contracts, define the risk not sufficiently mitigated in the risk
mitigation plan, for that contract/task order, that requires Government
to assume the risk of contract achievement of cost, schedule and
performance goals. Explain the amount of the risk the government will
assume.**

FAA is working to move away from cost-reimbursement contracts in which
the Government assumes the risks associated with cost, schedule and
performance goals. Cost reimbursement contracts are those in which the
Government cannot fully define all its requirements at the beginning of
the contract. This opens the Government to greater risk in that the
contractor will get paid for good faith effort even though the
Government's requirements may not be fully realized

OMB's guidance is that FFP contracts should be used for the DME phase of
an investment. If a program has contracted services under a non-FFP
contract, the program should list them and explain the rationale for
using these types of contracts. Discuss what and how much risk to the
government exists due to the contract structure, what strategies and
actions that will or have been implemented to mitigate these risks, and
what risks remain. Information on risks and mitigation activities should
be consistent with and included in the information provided in Section
I.F Risk Management (RM). The program should also describe how
contractors will use Earned Value Management (EVM) to help identify,
manage, and mitigate project risks. If additional performance incentives
and other methods of reducing the government's risks have been added
into non-FFP contracts, mention them here but leave the details for
question I.G.3.

**Question I.G.3: Will you use financial incentives to motivate
contractor performance (e.g. incentive fee, award fee, etc.)?**

FAA is working to increase the use of contracts that reward contractors
for using innovative solutions to meeting the Government's requirements.
Describe any level of incentives (fees) instituted into contracts to
motivate the contractor.

An example of incentives is the Share-in-Savings contracts. These are IT
contracts in which the Government, under the authority of Section 210 of
the E-Government Act of 2002, awards a contract to improve mission
related or administrative processes, or to accelerate the achievement of
its mission and share with the contractor in savings achieved through
contract performance. Acquisitions using the share-in-savings authority
in section 210 must be funded from the funds that would have been
appropriated for operations and maintenance of the legacy system the new
system is replacing, and this must be reflected in lifecycle costs. If a
Share-in-Savings contact was used, the preparer must also answer "Yes"
to Screening Question g. More information on Share-in Savings contracts
can be found at
http://[www.gsa.gov/shareinsavings](http://www.gsa.gov/shareinsavings).

**Question I.G.4: Discuss the competition process used for each
contract/task order, including the use of RFP's, schedules or other
multiple agency contracts, etc.**

Programs should work with their contracting officer to determine how
competition was, or will be, obtained. Programs should discuss contracts
outside of FAA (such as the GSA Schedules Program or other
Government-Wide Acquisition Contracts \[GWACs\]), with their contact in
the sponsoring office. While these contracts have typically been subject
to competition prior to their award, this section is strongest when it
addresses any additional competition that was done for each individual
contract/task order. Information that should be included is primary
source selection factors, how vendors were/are compared, and how past
vendor performance and process improvements are factored in. If
procurements are software intensive, explain how the Capability Maturity
Model is used in contract determination.

The answer for this question should be consistent with the contents of
the "Procurement Strategy" section of the Implementation Strategy and
Planning (ISP) document that is completed when establishing baselines in
the investment analysis process. More information can be found at
[FAST](http://fasteditapp.faa.gov/ams/do_action?do_action=LinkSection&contentUID=4&sectionNumber=A.2#FAA_2872)
website

**Question I.G.5: Will you use commercially available commercial
off-the-shelf (COTS) products for this investment?**

For the first part of the question, list all commercial off-the-shelf
products that are being used for this program, including software and
hardware. The FAA is working to utilize COTS products as much as
possible. This allows for greater compatibility across offices and
agencies as well as reduces development costs. Highlight any agency wide
procurement contracts/ licensing agreements used to purchase COTS
products.

If no COTS products were used, the preparer should state as such and
then explain why in Question I.G.5.B.

**Question I.G.5.A: To what extent will these items be modified to meet
the unique requirements of this investment?**

Again, OMB is looking for all agencies to utilize COTS products as much
as possible. If an investment is using a COTS product that has to be
modified extensively, or the investment requires software development,
please explain in question I.G.5.A. The explanation should include what
changes are being done to the product and who is performing the changes
(is done by the product's manufacturer, an outside contractor, or in
house). Be sure to address how modifications impact cost, schedule, and
performance goals reflected Section I.H.

**Question I.G.5.B: What prevented the use of COTS without
modification?**

This section will need to provide a very persuasive argument as to why
an investment could not use a COTS product. If an investment was unable
to utilize COTS products, a detailed response will be required.
Cost/benefit information would be helpful here to show empirically why a
non-COTS solution was chosen.

**Question I.G.6: What is the date of your acquisition plan?**

For FAA, the Implementation Strategy and Planning (ISP) document, which
is required as part of the FAA AMS, is the acquisition plan. Even if a
project is using multiple contracts, as part of good project management
the ISP lays out the project's contracting needs, how they are being
met, the types of contracts being used, etc. The ISP should be used as a
reference point for all the questions in the Acquisition Strategy (AS)
section of the Exhibit 300. The date of a program's most recent ISP will
be the answer to this question.

If an acquisition plan is over 5 years old, it should be reviewed to
determine if it needs updating. If it will be or is being updated
provide a completion date for the update, in the narrative at the
beginning of Section I.G. If the plan is still relevant and needs no
update, explain this and the date of your review, in the narrative at
the beginning of Section I.G. When a new/updated plan has been approved,
the date of its approval should be provided in this section.

**Question I.G.7: How will you ensure Section 508 compliance?**

For each proposed investment, the response must include an explanation
as to how (i.e. what steps will be taken) the program will ensure this
compliance. A system must comply with the Section 508 standards if it is
classified as electronic information technology (EIT). All EIT procured,
developed, maintained or used by FAA lines of business must comply with
the Section 508 EIT accessibility standards. A list of standards and
additional Section 508 guidance is included in Appendix E.

If program requirements were contracted out or ordered under a task
order subsequent to 6/21/01, then insert one of the following responses
to respond to this question *(**choose one**).*

> **Response #1:**
>
> *"In accordance with FAA\'s Section 508 Procurement Standard Operating
> Procedures, (insert name of program) will determine which of the
> Section 508 standards apply to the program and comply with each
> applicable standard."*
>
> **Response #2:**
>
> *"In accordance with FAA\'s Section 508 Procurement Standard Operating
> Procedures, (insert name of program) has determined that the following
> Section 508 standards apply to the program and will comply with each
> applicable standard."*

Be sure to include standards as appropriate.

This section should also state whether 508 compliance is required in the
contract and how compliance is verified. For example, state whether
inspections or tests are conducted to help ensure compliance. Due to the
nature of some jobs in the FAA (e.g. Air Traffic Control Series 2152),
certain jobs cannot be fulfilled by people unless they meet strict
medical qualifications. For example, Air Traffic Controllers cannot be
blind or deaf. Therefore, many 508 compliance actions are superfluous to
the needs of EIT users and add unnecessary costs. ***If a program
manager believes this situation applies to their program, they should
arrange for Section 508 exemption with the FAA Section508 Coordinator
and SME***. The answer to question I.G.7 should state that exemption was
given and why. Additionally, the program will need to include the
Section 508 Exemption document with their submission.

**Section I.G.8: Acquisition Costs:**

Acquisition costs entail all the costs shown in the SoS, except for
government FTEs. For the budget year, if at all possible, use
information from DELPHI to formulate an estimate of how much will be
spent. The percentages shown in response to questions I.G.8.A, B, and C
should total 100%.

**Question I.G.8.A: For budget year, what percentage of the total
investment is for hardware acquisition?**

These costs include any hardware items such as servers or PCs dedicated
to the system/investment. These costs usually do not include contractor
labor.

**Question I.G.8.B: For budget year, what percentage of the total
investment is for software acquisition?**

Examples include purchasing COTS, or custom developed software. These
costs usually do not include contractor labor.

**Question I.G.8.C: For budget year, what percentage of the total
investment is for services acquisition?**

These costs include contractor labor.

# 9. Section I.H - Project and Funding Plan

***(NOTE: This section is under review and subject to change.)***

## 9.1 Introduction

OMB and AMS policies require development, modernization, and enhancement
(DME) programs to use Earned Value Management (EVM) based on the
guidelines in the American National Standard ANSI/EIA-748. FAA programs
are required to apply EVM methodologies to the total program effort,
including both government and contractor work, to better manage complex,
high-risk, high-cost, or high-visibility efforts. While DME programs
primarily occur during solution implementation, the work, as approved,
may start during final investment analysis and may continue during
in-service management.

Program managers responsible for FAA capital investment programs that
involve DME activities are required to develop and implement an EVM
system consistent with guidance in ANSI/EIA 748, FAA AMS Policy (Section
4.16) and the FAA EVM Guide. Capital investment programs required to use
an EVM system in accordance with AMS Section 4.16.1 must be certified as
meeting the guidelines of ANSI/EIA-748. The EVM Focal Point (ATO-A)
assesses and validates EVM implementation and monitors application to
ensure compliance. The AIO Value Management Office (AIO) certifies
program EVM systems.

In order to successfully complete this section of the Exhibit 300, the
program manager must describe how the program is integrating all related
management disciplines (e.g., systems engineering, cost estimating,
procurement, scheduling, and risk management) using earned value
management to effectively support program execution. Earned value
management provides the FAA with timely, accurate, and integrated cost,
schedule, and technical performance information for both the total
investment program and individual supporting contracts. It continuously
measures the quantity and value of completed work and enables the
program to forecast reliable estimates of future performance.

In this section the program manager is also required to show how well
the investment is meeting the approved cost, schedule and performance
goals for each DME activity. DME programs must apply EVM to the total
program effort, including both government and contractor work, according
to the following table.

![](media/image4.wmf)The VMO office and the EVM SME coordinates with OMB
and programs to determine which investments are categorized as "major",
"non-major", or "other".

For those projects in the Maintenance (Steady-State) phase the program
must perform an Operational Analysis (Operational Assessments for FAA)
as defined in the Capital Programming Guide to demonstrate that the
investment is continuing to close the performance gap and achieve the
expected performance goals.

Additional EVM guidance can be found in the EVM Guide on FAST. The EVM
Guide provides program managers, contracting officers, executives,
executive committees, and review boards with a further understanding of
the application of E VM concepts in support of program management
practices in FAA that will contribute to improved program performance.

Note: Contact the VMO office to obtain the correct language and current
status for agency-wide EVM efforts. Also, more detailed guidance on EVM
processes will be included in the training sessions.

## 9.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           Agency will use, or uses an Earned Value Management System
              (EVMS) that meets ANSI/EIA Standard 748 and investment is
              earning the value as planned for costs, schedule, and
              performance goals.

  4           Agency uses the required EVMS and is within the variance levels
              for two of the three criteria. Work is needed on the third
              issue.

  3           Agency uses the required EVMS but the process within the agency
              is either very new, not fully implemented, or there are
              weaknesses in this investment\'s EVMS information.

  2           Agency seems to re-baseline rather than report variances.

  1           There is no evidence of PB.
  ----------- ---------------------------------------------------------------

## 9.3 Guidance

**Question I.H.1: Description of performance-based management system
(PBMS):**

Start this section with a discussion of the methodology and relevant
agency-wide EVM policies and tools being used to manage the program.
Describe the process used to verify that the contractor\'s project
management system follows the ANSI/EIA Standard 748-A.

If the project is in the Maintenance (Steady-State) phase, define the
Operational Analysis system that will be used to evaluate that the
investment is continuing to close the performance gap and meet the
expected goals. If this is a mixed lifecycle project with both
Maintenance and DME activities earned value must be used on the DME
portions of the contract and Operational Analysis on the maintenance
portions.

An operational analysis "system" includes the processes, documentation,
and automated tools that are used to track and measure performance. An
Operational Analysis will focus on four key factors per the requirements
of the OMB Capital Planning Guide: Customer/User Satisfaction; Internal
Business; Strategic Impact; and Innovation.

-   Customer Satisfaction -- the investment continues to meet ongoing
    customer and stakeholder needs, particularly with respect to
    providing enterprise-wide tools and applications.

-   Internal Business -- the investment continues to evolve and grow.

-   Strategic Impact -- the investment continues to meet or exceed the
    majority of its performance goals and expectations as outlined in
    Tables I.C and I.H.

-   Innovation -- the investment continues to take a leading role among
    business and technical initiatives.

Within the above categories or in addition to them it is important to
track performance, obsolescence, and the trend of maintenance and
operating costs as well as any other indicators that are critical to the
investment's ability to support FAA missions and strategic goals as well
as its own performance improvement goals.

**If the investment/project is in planning, full acquisition, or mixed**
--

Briefly describe how the program:

-   Meets the management control system guidelines in ANSI/EIA-748;

-   Creates an integrated performance measurement baseline
    (resource-loaded schedule of work to be performed at the lowest
    level required for performance measurement);

-   Establishes a work authorization system that assigns responsibility
    for and controls changes to the performance measurement baseline;

-   Tracks earned value for planned budgets as work is completed;

-   Provides status against the baseline plan and identifies significant
    schedule and cost variances. If the program baseline in Table I.H.2
    has been modified or replaced explain what modifications were made,
    why, and when the new useful segment(s) start. Indicate if the
    project baseline, including all the milestones and costs shown in
    Table I.H.2, have been approved by the JRC. If not, indicate what
    portion or useful segment of the investment still needs to be
    approved and any planned dates for obtaining JRC or other approval.
    If the program needs to re-baseline, explain the reasons for
    re-baselining, whether the re-baseline has been approved by the JRC,
    and ensure the proposed new baseline is entered into Table I.H.3.
    Once OMB has reviewed and approved the new baseline it can be
    removed from Table I.H.3 and moved to Table I.H.4.

-   Analyzes variances for early warning signs and take corrective
    action as necessary;

-   Estimates final cost and schedule outcomes.

-   Reconciles the cost values represented in Section I.H to the cost
    values represented in the Summary of Spending (SoS) table in Section
    I.A.

-   Defines a useful segment(s). Describe how the useful segments map or
    are represented in the program WBS. References to lifecycle phase
    and duration should also be included.

```{=html}
<!-- -->
```
-   Makes risk adjustments to program schedule and costs. Describe the
    process and tools that were used and how mitigation costs in Section
    I.H milestones associated with risks outlined in Sections I.F and
    II.B are included in the cost and scheduled dates shown in Section
    I.H. Explain how unmitigated risks are reflected as part of the
    program's management reserve.

-   Decides what portion of the program's contracts use an EVMS. What is
    the contract percentage for each useful segment or phase shown in
    I.H? This should be consistent with the information in Section I.G,
    although it does not need to be as detailed.

```{=html}
<!-- -->
```
-   Verifies the contractor's EVMS system is compliant with ANSI-EIA
    standard 748-A. This would include Integrated Baseline Reviews
    (IBRs).

-   Uses management tools, processes, and disciplines to analyze the
    earned value performance data to track and manage the project's
    performance. Describe the processes the program uses to track and
    manage the project's performance. This would include regular
    periodic status meetings involving IPT members, status and other
    reports generated for and reviewed by whom, and governance processes
    such as periodic reviews by the capital planning/investment review
    boards/committees, EA committee, etc. This information should be
    consistent with the management processes described in Section I.D.

-   Plans to enhance program and contractor EVMS performance. Provide a
    timeline. For the portion of your contracts that *do not* use EVMS,
    what milestones do these contracts cover? This should be consistent
    with the information in Section I.G, although it does not need to be
    as detailed.

**For steady-state investments --**

These are projects that are operational and performing routine
operational maintenance/technology refresh.

-   Describe the Operational Analysis (Assessment) system and procedures
    that are being used to track project performance. Include
    information from the latest semi-annual SLR reports.

```{=html}
<!-- -->
```
-   Have Post-Implementation Reviews (PIRs) been conducted? If so, when
    and what was addressed by the reviews? If not, has a PIR been
    planned? Include the date of the planned PIR.

-   Have PIRs or other review processes addressed e-Gov strategy issues
    such as whether the project is still meeting performance goals, and
    is it meeting current agency strategic and performance goals? Is it
    aligned with the agency's EA? Is there a current Alternatives
    Analysis that can be cited as evidence that current alternatives
    were looked at and that the existing investment is still the best
    solution? Include results from the latest SLR.

**Applicability of Section I.H Tables**

If the investment is new and no costs have been or will be incurred
before the Exhibit 300s are submitted to the JRC or OMB, then only Table
I.H.2 needs to be completed. There may be instances however where a new
investment will have incurred no expenses when it is submitted to the
JRC for approval but will have incurred expenses by the time the Exhibit
300 is submitted to OMB. In such cases Section I.H.4 will not need to be
completed for the Exhibit 300 PB but it will need to be completed in the
OMB Exhibit 300 Report. In cases where an Exhibit 300 is being completed
for the first time for an ongoing investment that is already incurring
costs, Section I.H.4 must be completed for both the Exhibit 300 PB and
the OMB Exhibit 300 report

**Question I.H.2: Original baseline (OMB-approved at investment
outset):**

What are the cost and schedule goals for this phase or useful segment of
the investment? Also identify the funding agency for each useful segment
and milestone if this is a multi-agency investment. For projects, or
portions of projects, that have reached steady-state enter one line for
each fiscal year of this phase. If the project is mixed life-cycle there
will be two parts to the baseline; one for the O&M portion and one for
the DME portion using EVMS. Please note that this original baseline must
be included in all subsequent versions of the Exhibit 300, even when
there are OMB-approved baseline changes shown in Table I.H.3.

For on-going projects, this baseline is the original baseline first
submitted to OMB in an Exhibit 300; any proposed changes to the baseline
should be entered in Table I.H.3. If the existing JRC approved baseline
shown in the latest Exhibit 300 PB needs to be decomposed into more
detail but there are no changes to the total cost or planned completion
date of the original useful segment higher level milestone dates and
costs, then these changes do not constitute a re-baseline and there
would be no need to request a re-baseline in Table I.H.3.

For new projects Table I.H.2 will be the starting point for reporting
cost, schedule and performance goal information. The FAA considers the
useful segments and associated milestones presented in this section
preliminary at this point in time, as this investment has not yet been
baselined by the JRC. The Exhibit 300 PB must include at least annual
milestones for the entire useful segment or phase for which JRC funding
approval is being requested. Once this investment has been baselined by
the JRC, this section will be updated to reflect JRC baselining
decisions and will become the JRC approved baseline reflected in the
Exhibit 300 PB. Table I.H.2 will show the milestones and costs for all
the useful segments and phases that are part of the JRC approved
baseline.

If a new useful segment needs to be added to the Exhibit 300, but the
original I.H.2 baseline remains unchanged, then the new useful segment
would be added to Table I.H.2. Table I.H.3 would be completed showing
the previous segments plus the new segment that is being added. Table
I.H.3 would be completed even if no changes were being proposed to the
previously approved program baseline. In this way the new segment
baseline will remain identified as an original baseline in Table 1.H.2
but it will also be part of the overall revised baseline shown in Table
I.H.3. Clearly explain in Section I.H.1 and via headings on the tables
that this is a new segment that does not change the previous approved
baseline and clearly identify where you are inserting it in Table I.H.2
and I.H.3. Any addition of useful segments (which have not already been
approved for funding by the JRC) or changes to existing previously
approved baselines should be approved by the JRC prior to being
submitted to OMB.

If a project re-baselines in Table I.H.3, past milestones from the
beginning of the current phase and useful segment(s) would need to be
included in the re-baseline, and their actual performance would need to
be reported in Table I.H.4 to ensure that cumulative costs are tracked
for the entire useful segment.

For the OMB Exhibit 300 report, annual updates to Section I.H will be
required including entering updated actual cost and schedule performance
information in Table I.H.4. Internal FAA reprogramming of funds that
have not been approved by the JRC as a new baseline, will be reflected
in the actual cost and schedule performance status and variances
reported in I.H.4 and will not be shown as a proposed new baseline in
I.H.3.

For new projects in the upcoming budget process, be sure to include
security planning milestones and significant risk mitigation actions
with your overall project planning; security planning is a part of each
phase of the system's life-cycle.

Milestones for the DME phase of an investment should be detailed, with
each milestone lasting less than one year. The milestones should consist
of activities/tasks that are reflected in the WBS and where possible
should show detail to the fourth level of the WBS.

Include security milestones such as the completion of security plans,
risk assessments, and certification and accreditations (C&As) either
separately or as part of the other DME milestones (in which case, the
milestone description should clearly state that they are included as
part of that milestone).

Include all the types (planning, acquisition/DME, maintenance) of costs
reflected in the spending summary for the years covered by the current
useful segment/phase described in I.H

-   Include risk costs/adjustments both in terms of extra \$ to include
    risk mitigation actions and/or longer schedule (Milestone
    descriptions should show if they include risk mitigation
    activities).

-   Do not subtract the risk reserve either from section I.H or the
    spending summary.

-   Include estimate of FTE costs of government personnel. The preferred
    approach and long term goal is that the milestone costs in I.H
    should incorporate government labor (FTE) costs. Since at present it
    has been difficult to incorporate FTE costs at the milestone level,
    for now at FAA, at a minimum, FTE costs should be shown for each
    useful segment, and year of O&M.

    **Section I.H.3: Proposed baseline (applicable only if agency
    intends to propose a baseline modification):**

    Programs will enter a proposed change to the original or current
    baseline or an OMB-approved baseline change in Table I.H.3. What are
    the new cost and schedule goals for the project (e.g., what are the
    major project milestones or events; when will each occur; and what
    is the estimated cost to accomplish each one)? Also identify the
    funding agency for each milestone or event if this is a multi-agency
    project.

Milestones scheduled to begin or finish in the past cannot be changed
unless there is a JRC approved re-baseline in which case they would be
changed to reflect actual cost and schedule performance. Any changes to
previously JRC approved baselines must be approved by the JRC prior to
being submitted to OMB for approval. On the OMB Exhibit 300 report, JRC
approved revisions to the previously OMB approved baseline, will be
categorized as "proposed" until OMB approves them. Once OMB approves the
proposed baseline revision, subsequent updates to the OMB Exhibit 300
report will reflect the planned milestone dates and costs of the most
recent/current OMB approved baseline in Table I.H.4 and remove this
information from Table I.H.3.

**Section I.H.4: Actual performance and variance from OMB-approved
baseline (original or current):**

**Question I.H.4.A: This section is always filled in to reflect current
status of the project. It compares the OMB approved baseline and actual
results for this phase, segment, or module of the project. Show for each
major project milestones or events you planned (scheduled) to accomplish
and the cost and what work was actually done and the cost. If the
project is in the operational or steady-state phase complete one line on
the chart for each year. For these projects complete paragraphs C, D, F
and G as appropriate. If this is a new investment in the FY 2006 budget
year, this section will be blank for your initial submission. OMB may
ask for latest information during the budget review process.**

All investments (except new projects that have not previously submitted
an Exhibit 300 to OMB *and* have no ongoing or past costs) must complete
Table I.H.4, regardless of life-cycle phase. Table I.H.4 is updated each
year and projects in preliminary design, development or mixed life-cycle
phases should enter cumulative actual performance information for the
entire current useful segment(s). Projects in full maintenance with no
development dollars report annual actual performance against the annual
base lined maintenance cost goals.

This table should reflect the useful segments/milestone dates and
planned costs of the most recent JRC approved baseline that is part of
the current Exhibit 300 PB ***and*** that was approved by OMB. Proposed
baselines (that have not been approved by OMB) cannot be entered in
Table I.H.4. In some cases, Section I.H may have the original JRC and
OMB approved baseline in Table I.H.2, a new proposed baseline in Table
I.H.3, and the latest JRC and OMB approved baseline in Table I.H.4.

At FAA, for purposes of the variance calculations, the EVM system should
provide the actual costs incurred to date. Otherwise an approved invoice
is considered an actual expenditure (as opposed to waiting until the
contractor actually receives the payment). Any contractor hours must
have been billed and the invoice must have been approved before they can
be included in the actual costs.

EVM data, starting with question I.H.4.B below must be provided for all
projects with resources allocated to DME activities. EVM calculations
must include all the costs of the non-steady-state activities for a
useful segment, including FTE costs. EVM calculations must also include
the costs of the entire current non-steady-state useful segments, not
just those of the contracts using EVM

All projects must provide information starting with Question I.H.4.C and
continuing to the end of the section. If questions are not applicable to
an investment, state why the question is not applicable. Steady-state
projects are not required to complete the EVM calculations in I.H.4.B
nor respond to Section I.H.4.E. Also, the calculations in Sections
I.H.4.B and E should not include the costs for any steady-state portions
of the investment. However responses should be provided to all the other
questions in I.H.4 by including information about the actual performance
of the steady-state portion of the project and clearly identifying the
steady-state information to distinguish it from the planning or
development/acquisition aspects of the investment.

**B. Provide the following project summary information from your EVMS
data**

> **(as of date):** This section should not be completed for the
> steady-state/operational portion of projects.

**B.1. Show the budgeted (planned) cost of work scheduled (BCWS):**

**B.2. Show budgeted (planned) cost of work performed (BCWP):**

> **B.3. Show the actual cost of work performed (ACWP):**
>
> **B.4. Provide a cost curve graph plotting BCWS, BCWP and ACWP on a
> monthly basis from inception of this phase or segment/module through
> the latest report. In addition, plot the ACWP curve to the estimated
> cost at completion (EAC) value, and provide the following EVMS
> variance analysis.**

**C. If cost and/or schedule variance are a negative 10 percent or more
at the time of this report or EAC is projected to be 10 percent or more,
explain the reason(s) for the variance(s).**

If more than one useful segment in Table I.H.4 is shown with a 10%
slippage, it should be reported in this section. If this is due to
funding cuts, this should be clearly explained, including whether
additional funding will be provided in future years to eliminate or
minimize the schedule variance/slippage.

D.  **Provide performance variance. Explain whether, based on work
    accomplished to date, you still expect to achieve your performance
    goals. If not, explain the reasons for the variance. For
    steady-state projects, in addition to a discussion on whether or not
    the system is meeting the program objectives, discuss whether the
    needs of the owners and users are still being met.**

Explain whether IPT still expects to achieve performance goals in
Section I.C. If not, explain why. Also explain, if any slippages in
actual performance in relation to the Section I.C performance goals is
due to funding cuts, and if goals have been risk adjusted to address the
cuts and as part of a re-baseline.

For steady-state projects, in addition to a discussion on whether or not
the system is meeting the program objectives, discuss whether the needs
of the owners and users are still being met.

D.  **For investments using EVMS, discuss the contractor, government,
    and at least the two EAC index formulas in I.H.4.B, current
    estimates at completion. Explain the differences and the IPT's
    selected EAC for budgeting purposes. This paragraph is not
    applicable to operations/steady-state projects.**

> A response to I.H.4.E should only be provided for investments or parts
> of investments that are [not]{.underline} steady-state.

E.  **Discuss the corrective actions that will be taken to correct the
    variances, the risk associated with the actions, and how close the
    planned actions will bring the project to the original baseline.
    Define the baseline changes, if necessary.**

> Corrective actions resulting from IG audits and other reviews should
> be included as well as any corrective actions that have been included
> in corrective action plans sent to OMB. Discuss the following:

-   The risks associated with the actions

-   How close planned actions will bring the investment to the original
    baseline

-   Any proposed baseline changes

> Below is a sample list of corrective actions that should be considered
> and used (as appropriate) to answer I.H.4.F of the Exhibit 300:

-   Requiring additional EVM training/certifications for IPT members
    and/or PMs.

-   Implementing additional EVMS and other tools and processes to better
    monitor and manage project performance.

-   Short term or long term actions that can be taken to modify
    contracts or issue new contracts to convert to FFP and performance
    based management, specifically requiring the use of ANSI 748-A
    compliant EVMS, and/or add incentives or penalties.

-   Implementing more pro-active oversight using more frequent status
    reports and/or meetings to more quickly detect and respond to
    potential problems.

-   Redefining or more clearly defining a project into smaller more
    manageable useful segments, each of which will be managed
    individually and whose success does not depend on other segments.
    This information would need to be entered into Table I.H.3 as a
    proposed re-baseline.

-   Re-baseline by revising milestones to incorporate cost and schedule
    risk adjustments to minimize the need for future re-baselining. This
    information would need to be entered into Table I.H.3 as a proposed
    re-baseline.

-   Adding people to increase the speed with which tasks/milestones are
    completed. (This may not always work and is likely to result in cost
    overruns).

-   Establishing clear milestones for when to determine/check if
    corrective actions are succeeding in mitigating the cost and
    schedule variances

-   Identifying whether the risks/losses of not completing the project
    outweigh the delays and/or cost overruns.

-   Determining what viable alternate solutions are available at this
    point if the project has to come to a halt.

F.  **If the investment cost, schedule or performance variances are 10%
    or greater, has the Agency Head concurred in the need to continue
    the program at the new baseline?**

> Select "Yes" or "No" as appropriate.

# 10. Section II.A -- Enterprise Architecture

***(NOTE: This section is under review and subject to change.)***

## 10.1 Introduction

OMB requires that Exhibit 300s demonstrate conformance to business,
data, application, and technology layers of the Federal Enterprise
Architecture (FEA) and Agency EA. It requires federal agencies to map
the capital investments to the federal reference models to ensure that
the investments support the Federal Enterprise Architecture.

The FAA EA includes a National Airspace System (NAS) Operations section
as well as an administrative section. The NAS covers all of FAA's
operational systems whereas the administrative section covers financial,
human resources and other administrative systems. A matrix is available
from the FAA EA SMEs that maps the specific FAA operations systems to
the proper sections of the NAS.

## 10.2 Scoring Criteria

+------+---------------------------------------------------------------+
| *    | **Description**                                               |
| *Sco |                                                               |
| re** |                                                               |
+------+---------------------------------------------------------------+
| 5    | This investment is included in the Agency EA and CPIC         |
|      | process. Investment is mapped to and supports the FEA and is  |
|      | clearly linked to the following FEA reference models:         |
|      | Business Reference Model (BRM), Performance Reference Model   |
|      | (PRM), Service Component Reference                            |
|      |                                                               |
|      | Model (SRM), and Technical Reference Model (TRM). BC          |
|      | demonstrates the relationship of the investment to the        |
|      | business, data, application, and technology layers of the EA. |
+------+---------------------------------------------------------------+
| 4    | This investment is included in the agency's EA and CPIC       |
|      | process. Investment is mapped to and supports the FEA.        |
|      | Investment is clearly linked to the BRM but work is           |
|      | continuing to map the investment to the PRM, SRM, and TRM. BC |
|      | is weak in demonstrating the relationship of the              |
|      |                                                               |
|      | investment to the business, data, and application, and        |
|      | technology layers of the EA.                                  |
+------+---------------------------------------------------------------+
| 3    | This investment is not included in the agency's EA and CPIC   |
|      | process, was not approved by the agency EA committee, or does |
|      | not link to the FEA. BC demonstrates a lack of understanding  |
|      | on the layers of the EA (business, data, application, and     |
|      | technology).                                                  |
+------+---------------------------------------------------------------+
| 2    | While the agency has an EA framework, it is not implemented   |
|      | in the agency and does not include this investment.           |
+------+---------------------------------------------------------------+
| 1    | There is no evidence of a comprehensive EA in the agency.     |
+------+---------------------------------------------------------------+

## 10.3 Guidance -- Part II.A.1: Business

**Question A: Is this investment identified in your agency's enterprise
architecture? If not, why?**

Elaborate by stating how, and address the DOT as well as the FAA EA.
This answer should briefly explain the structure and relationship of the
DOT and FAA EA.

**Question A.1: Will this investment be consistent with your agency's
target architecture?**

One of the following responses should be selected as appropriate.

-   No. This investment is currently in the operations and maintenance
    phase and is not scheduled to be modernized before it is retired and
    replaced.

-   Yes. This investment is scheduled to be consistent with DOT and
    FAA's "to be" modernization blueprint by aligning itself with the
    appropriate principle components of FAA's Target Applications
    Architecture. Describe how the investment is to be consistent with
    the target components, and how it links to the Target Architecture
    as appropriate.

**Question B: Was this investment approved through the EA Review
committee at your agency?**

Answer "yes" or "no" as appropriate, and provide the date of the review.
If the investment has completed a NAS or Non-NAS architectural
assessment, the answer to this question should be yes. Also, if the
investment has received a final investment decision by the JRC, then the
answer would be 'Yes'. Also, if the investment has received a final
investment decision by the JRC, then the answer would be 'Yes'.

**Question C: What are the major process
simplification/reengineering/design projects that are required as part
of this IT investment?**

Number range CHAPTERIdentify any major business process simplifications,
business process reengineering efforts, or business design projects that
will be required to reach the full business functionality of the
investment. Consider all of the major process
simplifications/reengineering/ design projects that must take place in
order for the investment to be in compliance with FAA's target
architecture. The response to this question should show that the CPIC
process has not focused solely on a system engineering perspective, but
has taken non-IT elements of the investment into account. For example, a
current business process that the investment supports may be required to
change in order for the investment to function according to its
identified target. This would require the process to be reengineered or
simplified in order for the investment to function properly and
efficiently in the future.

**Question D: What are the major organization restructuring, training,
and change management projects that are required?**

Number range CHAPTERConsider all of the organization restructuring,
training, and change management projects that must take place for the
investment to comply with FAA's target enterprise architecture. Be
specific. Examples are:

-   Organization Restructuring -- The investment provides new
    efficiencies that allow existing human resources to be deployed
    elsewhere. Another example is, Process X has been reengineered for
    greater efficiency; Organization A is being reorganized accordingly,
    and this investment will support the new organizational functions.

-   Training -- The investment requires training because of the new
    business processes or new technology.

-   Change Management -- Deployment of the investment will require a
    planned change management process to ensure smooth implementation
    across the organization.

**Question E: Please list up to three non-primary Business Reference
Model (BRM) mappings to describe the functions that this IT investment
supports. A BRM mapping consists of a mapping to a Line of Business and
an associated Sub-Function from the FEA BRM. The primary BRM mapping for
this initiative should have been identified with the last six digits of
the unique project (investment) identifier in Section 300 Part 1 and in
Section 53.8, and it should not be reentered here. The BRM has been
updated since last year. For a list of the updated BRM Lines of Business
and Sub-Functions, go to [www.egov.com](http://www.egov.com/). (Note:
The Services for Citizens area and the Mode of Delivery area should be
thought of collectively. If you identified your primary Line of Business
and Sub-Function in Section 53.8 as a Service for Citizen, at a minimum
you should identify the corresponding Mode of Delivery that applies in
this section).**

Check the latest guidance to determine if there are additions and
deletions to the FEA BRM each year. Do not map to any deleted
sub-business functions.

-   Ensure that there is consistency between the LOBs shown in the BRM
    table and the Performance Reference Model (PRM) Mission and Business
    results Measurement Category and Measurement Grouping fields, shown
    in Section I.C, Table 2. This is especially important in relation to
    "transportation" versus "management of government resources" as it
    applies to infrastructure investments. It is not logical for an
    infrastructure investment to map only to the "Transportation" LOB in
    the BRM and then only map to the "Information and Technology
    Management" Mission and Business Results area of the PRM (Section
    I.C, Table 2).

```{=html}
<!-- -->
```
-   Agencies should map investments to the FEA BRM based on the function
    of the investment, ***not*** the function of the program or mission
    of the agency. *FAA investments that map to the NAS are in the
    "Services for Citizens" business area and would map to the
    "Transportation" LOB, and "Air Transportation sub-function" of the
    BRM **for their primary mapping.** However, FEA guidance no longer
    requires investments to identify the primary mapping in the BRM
    table because it is identified by the numbers in the unique project
    identifier (UPI) number that is shown at the beginning of the
    Exhibit 300. The UPI numbers that correspond to the Transportation
    LOB and Air Transportation sub-function are 118 and 060.
    Administrative investments are in the Management of Government
    Resources business are and would usually have a primary mapping to
    the "Human Resources Management" (#403) or "Financial Management"
    (#402) LOBs and the appropriate associated sub-functions.*

-   Mode of Delivery is ***no longer*** a primary business area in the
    FEA BRM. Map the primary relationship to Services for Citizens Area,
    Support Delivery of Services Area, or Management of Government
    Resources Area. No primary mapping is allowed to Mode of Delivery.

-   For a primary relationship mapped to Services for Citizens, a
    secondary mapping to Mode of Delivery is required. This means that
    the investments mapping to the "Transportation" LOB ***must*** map
    to at least one Mode of Delivery LOB and sub-function in the BRM
    table. FAA investments often map to the "Direct Services for
    Citizens" (#201) LOB and "Civilian Operations" (#068) sub-function.
    However some of the other LOBs such as "Knowledge Creation and
    Management" (#202") or "Regulatory Compliance" (#204) may be more
    appropriate for FAA investments that do not directly interface with
    the public as customers.

-   The Information and Technology Line of Business is limited to
    infrastructure-related investments only. Infrastructure
    investments/projects are those investments that provide
    communications, networking or other IT support internal to FAA and
    supporting other FAA systems that interface more directly with the
    customer. Infrastructure investments are included in the "Management
    of Government Resources" business area and would therefore map to
    the "Information Technology Management" (#404) LOB and appropriate
    sub-function(s). FAA infrastructure investments should include a
    mapping to the "Information and Technology Management" LOB to avoid
    being penalized in the scoring.

-   OMB allows a *maximum of three secondary (non-primary)* FEA BRM
    mappings. Do not map to more than three secondary BRM LOBs.

-   A primary LOB mapping must be identified for *all* investments --
    "100," "200," "300," and "400" ***will not*** be acceptable 3 digit
    codes or the 18^th^, 19^th^, and 20^th^ digits of the unique ID
    (UPI) number *unless* an agency receives prior OMB approval by their
    published deadline.

-   A primary Sub-function mapping must be identified for ALL
    investments therefore, "999" ***will not*** be an acceptable 3 digit
    code for the 21^st^, 22^nd^, and 23^rd^ digits of the unique ID
    number *unless* an agency receives prior OMB approval by their
    published deadline.

-   The primary LOB and sub function mapping should be included in the
    UPI that is provided in response to the screening questions and not
    re-entered in the BRM table of Section II.A.

## 10.4 Guidance -- Part II.A.3: Applications, Components and Technology

**Question A: To demonstrate how this investment aligns with the FEA
Service Reference Model (SRM), list the Service Domains, Types, and
Components supporting this IT investment. Include the component
description and indicate whether this is a new component (i.e. not
currently identified in the SRM). If this is a new Service component,
agencies should also leave the "Component " field blank and provide a
name and description in the "Relation to SRM" field. The SRM has been
updated since last year. For more information on the SRM go to
[www.egov.gov](http://www.egov.gov/).**

FAA investments that are part of the NAS map to the appropriate NAS
elements in the SRM table instead of to the FEA SRM. FAA administrative
or non-NAS systems must map to the FEA SRM.

The FAA Enterprise Architecture portal application shows the links
between FEA Reference Models and FAA processes, applications, data, and
technology for non-NAS investments. A matrix is also available from the
FAA EA SMEs that maps the NAS systems to the appropriate parts of the
NAS. Contact the FAA EA SME for access to the FAA EA portal or for
mapping guidance for a specific investment.

**Question C: To demonstrate how the investment aligns with the FEA
Technical Reference Model. (TRM), list the Service Areas, Categories,
and Standards supporting this IT investment. Also, the "Relation to TRM"
field should be the "Relation to SRM" field, and agencies should
indicate the SRM Service Component to which the TRM service standard is
linked. In additional, because the "Service Specification" layer was
removed from the TRM, agencies should not provide a Service
Specification mapping. Instead, agencies should provide information on
the [vendor and product]{.underline} mapped to the Service Standard in
the "Service Specification" field only for those products that have
already been acquired. For more information on the TRM, go to
[www.egov.gov](http://www.egov.gov/).**

If the eCPIC tool allows text in this section, elaborate on the response
by stating how the investment is included in FAA TRM. For example:

> "*Yes, all of the hardware, applications, components, and web
> technology requirements for this investment are covered in the
> Agency's Technical Reference Model. The above table identifies the
> relevant Service Domain, Service Type, and Service Components. The
> standards have been reviewed by the Agency's Chief Information Officer
> and Chief Architect. We have also collaborated with federal e-Gov
> initiative X and are adopting the use of standard based technology
> components."*

Use the TRM table to discuss the relationship of the investment to FEA
TRM. The first column, "Relation to SRM" should show which SRM
***component*** that is supported by the TRM item in each row of the TRM
table. It may be necessary to repeat a TRM component, if it supports
more than one SRM component. All SRM components should have a supporting
TRM component and vice versa. For those mapping to the NAS, it is
recommended this column of the TRM table map to the appropriate NAS
component shown on the SRM table rather than only showing "NAS" in this
column.

**Question D: Will the application leverage existing components and/or
applications across the Government (i.e., FirstGov, Pay.Gov etc.)? If
so, please describe.**

If yes, lNumber range CHAPTERist the current or future applications that
the investment will be leveraging and describe the process for doing so.
The functionality and information available from these application
catalogs can be found at [http://www.FirstGov.gov]{.underline},
[http://]{.underline}[www.Pay.gov](http://www.pay.gov/), and
[http://]{.underline}[*www.e-gov.gov*](http://www.e-gov.gov/). For a
list of the federal e-Gov initiatives, please visit this link:
[http://www.whitehouse.gov/omb/egov/downloads/e-Gov_Initiatives.pdf](http://www.whitehouse.gov/omb/egov/downloads/E-Gov_Initiatives.pdf).
If no, explain why.

**Question E: Financial Management Systems and Projects, as indicated in
Part One, must be mapped to the agency's financial management system
inventory provided annually to OMB. Please identify the system name(s)
and system acronym(s) as reported in the most recent systems inventory
required by Circular A-11 Section 52.4.**

Coordinate with the FAA Budget Subject Matter Expert and organization to
ensure consistency in which FAA investments are categorized as financial
in the Section 52.4 inventory and the Exhibit 300.

# 11. Section II.B - Security and Privacy

## 11.1 Introduction

Number range CHAPTERIn order to successfully address this area of the
Exhibit 300, each question below must be answered at the investment
(system/application) level, not at a program or agency level. Simply
referring to security plans or other documents is not an acceptable
response. For IT investments under development, security planning must
proceed in parallel with the development of the system to ensure that IT
security requirements and life-cycle costs for the investment are
identified and validated. All IT investments must have up-to-date
security plans and be fully certified and accredited prior to becoming
operational. Anything short of a full certification and accreditation
indicates that identified IT security weaknesses remain and need to be
remedied and is therefore not adequate to ensure funding for the
investment. Additionally, to ensure that requests for increased IT
security funding are appropriately addressed and prioritized, the agency
must identify: 1) current costs; 2) current IT security performance
gaps; and 3) how the funding request will close the performance gaps.
This information must be provided to OMB through the agencies' plan of
action and milestone developed for the system and tied to the IT Exhibit
300 through the unique project identifier.

Programs must ensure their FISMA review and POAM information and the
Exhibit 300 are consistent and state clearly that there is adequate
funding to implement corrective actions. C&As must be completed in a
timely manner and wherever possible identified in Section I.H as a
planned milestone.

New initiatives that have not receive a final investment decision by the
JRC should address each question by providing information about future
plans to complete security activities and documentation, which
regulations will be complied with, and which methodologies will be used
as appropriate. If exact dates for completion of security activities or
documentation cannot be provided, an estimated date for when the
information will be available should at a minimum be provided.

When planned completion dates for the activities and/or documentation
described in this section are known they should be provided in this
section as well as in Section I.H.

The FAA ISS Program policy is contained in FAA Order 1370.82
(intranet.faa.gov/aio), as amended. This order supersedes FAA Order
1600.54B (FAA Automated Information Systems Security Handbook). For some
of the questions in this section some "*Information Systems Security
(ISS) Common Language"* is provided. This is security language that is
common to all FAA and can be used to answer the questions in this
section. However, the responses should not be limited to the common
language, but rather they should be augmented and tailored with
information specific to the investment. The following clarifications are
provided in relation to the security section to help ensure some of the
information provided in the business cases is not interpreted as being
too generic, incomplete, or not addressing the correct time frame.

The emphasis of section II.B is on security processes and controls that
are specific to the investment/system discussed in the business case. It
is good to mention infrastructure controls/security processes (like
vulnerability scans) that are done at the network/ infrastructure level,
or agency-wide security controls such as annual security training.
However, the descriptions of security controls should make it clear what
security controls are in place that apply to the specific system. This
is true of any general discussion of how compliance is ensured as well
as the responses to specific questions about security training, incident
reporting, operational testing, and contractor controls.

The questions about specific security processes and controls do not just
request information about whether an activity has been completed but
also whether it will be completed/planned for the future, including the
budget year and/or on a periodic basis.

## 11.2 Scoring Criteria

  ----------- ---------------------------------------------------------------
  **Score**   **Description**

  5           Security and privacy issues for the investment are addressed,
              all questions are answered, and a privacy impact assessment is
              provided in appropriate circumstances. Security/privacy detail
              is provided about the individual investment throughout the
              life-cycle to include budgeting for SE.

  4           Security and privacy information for the investment is provided
              but there are weaknesses in the information that need to be
              addressed.

  3           Security and privacy information for the investment is provided
              but fails to address the minimum requirements.

  2           Security and privacy information points to an overall Agency
              Security Process with little or no detail at this investment
              level.

  1           There is no security or privacy information provided for the
              investment.
  ----------- ---------------------------------------------------------------

Since security is very important, and investments must receive a 4 in
this area, programs must ensure their FISMA review and POAM information
and the OMB Exhibit 300 Report information are consistent and that they
make it clear that they have adequate funding to implement corrective
actions and that their C&As are completed in a timely manner and
wherever possible future C&A activities are identified in I.H.

## 11.3 Guidance

**Question II.B.1: How is security provided and funded for this
investment (e.g., by the program office or by the CIO through the
general support system/network)?**

The answer to this question should focus on the organization structure
in place to support security and privacy protection for an investment.
The following should be considered when preparing an answer:

-   Which organization is responsible for providing security for this
    investment?

-   Who is the Designated Approving Authority?

-   Is there a system security officer assigned to this
    investment/project?

-   Who funds the security for this investment and how? (For example,
    are there any parts funded centrally?)

-   If any IT interacts with other program IT systems, how is security
    handled between them?

Security funding should include key security personnel that are included
in the IPT response in Section I.D.3. If any special skills applicable
to security and privacy were mentioned in Question I.D.3.A, describe how
they are being used here.

**Question II.B.1.A: What is the total dollar amount allocated to IT
security for this project in the budget year? Please indicate whether an
increase in IT security funding is requested to remediate IT security
weaknesses, specifying the amount and a general description of the
weaknesses.**

Identify the costs (in thousands) planned by your Office for the system.
This amount should represent the % security of your budget year total
identified on the cover sheet of this Exhibit, using the total dollar
amount identified in the budget year (BY) column of the SoS Table.

The total dollar amount allocated for IT Security should come from the
Department of Transportation IT Security Cost Estimation tool (CETIS).
The CETIS tool helps programs understand where IT security weaknesses
may be found, and based on industry best practices -- helps formulate a
cost estimate for remediation and maintenance. Any dollar amount
reported here should also be reflected in the Section I.H milestones and
costs. Programs send a copy of the final CETIS report to DOT, so it is
important that CETIS be the source of the total dollar amount. The CETIS
tool can be found in the KSN Exhibit 300 community under the Reference
tab.

Costs should be provided in the thousands of dollars (label it as such),
and will also be referenced in terms of total percent of a program's
budget on the cover page of the Exhibit 300.

IT security includes such costs as: security architecture development,
determination of sensitivity level of information; development of risk
assessments; revisions, review and testing of security plans; disaster
recovery plans, continuity of support plans, and contingency plans;
implementation of technical management and operational controls,
including security-related hardware and software; testing of
effectiveness of controls, including technical vulnerability assessments
and penetration testing; development of information, security policies,
security training; security program assessment; physical security if
specifically for IT assets; and background checks for Federal and
contract IT personnel.

For increased IT Security funding please give the dollar amount and
clearly mark it as "increased IT security funding". You must also
describe the weakness, using the same phraseology as the POA&Ms, that
the increased funding is slated to address and the corrective measures
for which the funding is being requested. It is a good idea in this
section to describe any additional security controls and studies that
are being funded. *If there are security weaknesses* - regardless of
whether additional funding is being requested -- a brief explanation
should be provided of how the weaknesses are being addressed and/or what
additional controls have been or are being implemented. This should be
consistent with responses in the risk assessment section (I.F) and the
FISMA screening question.

IT security costs will cover security architecture development,
determination of sensitivity level of information; development of risk
assessments; revisions, review and testing of security plans; disaster
recovery plans, continuity of support plans, and contingency plans;
implementation of technical management and operational controls,
including security-related hardware and software; testing of
effectiveness of controls, including technical vulnerability assessments
and penetration testing; development of information, security policies,
security training; security program assessment; physical security if
specifically for IT assets; and background checks for Federal and
contract IT personnel.

**Section II.B.2:** **Please describe how the investment
(system/application) meets the following security requirements of the
Federal Information Security Management Act, OMB policy, and NIST
guidance.**

There are several policies that outline what agencies' need to cover
when coming up with IT Security and Privacy strategies. These include
the Federal Information Security Management Act (2002), the E-Government
Act (2002), OMB Circular A-130 -- Appendix III, and various National
Institute of Standards and Technology policies (including NIST 800-65).
Links to these policies can be found at the KSN Exhibit 300 community
under the Reference tab.

The response to this question should address the following types of
questions: What are the major FAA and government-wide guidelines (NIST,
OMB, etc) that are being followed and what are the overall security
processes implemented/planned for accreditation and certification? What
are the significant security controls and processes that are implemented
and/or planned now and particularly in the budget year in relation to
these regulations.

[]{.mark}

**Question II.B.2A: Does the investment (system/application) have an
up-to-date security plan that meets the requirements of OMB policy and
NIST guidance? What is the date of that plan?**

FAA's Subject Matter Experts on IT Security and Privacy recommend that
programs use some "*Information Systems Security (ISS) Common Language"*
to form the backbone for this question. For this question, the ISS
Common Language would be:

> *"The Security Plan was developed in accordance with FAA Order
> 1370.82, Information Systems Security Program, and the FAA ISS
> Handbook, which are based on NIST 800-18, Guide for Developing
> Security Plans for Information Technology Systems."*
>
> Provide the date of the latest plan update. Following the Common
> Language, preparers should elaborate on how these guidelines are
> influencing security plans. What are the major FAA and government-wide
> guidelines (NIST, OMB, etc) that are being followed and what are the
> overall security processes implemented/planned for accreditation and
> certification?
>
> OMB, FISMA, and NIST Policy require investments to address the
> following security issues in Security plans:

-   Security Awareness Training

-   Periodic Security Review/Audit

-   Planning and Reporting on Remedial Action

-   Incident Detection

-   Configuration Management

-   Continuity of Operations and Contingency Plan and Procedures

-   Major System Inventories

-   Senior Security Officers

-   Rules of System

-   Official Authorization

> Parts B-F allow the preparer to elaborate on some of the topics
> addressed in the investment's overall security plan.

**Question II.B.2.B: Has the investment been certified and accredited
(C&A)? Note: Certification and accreditation refers to a full C&A and
does not mean interim authority to operate. Additionally, specify the
C&A methodology used (e.g., NIST guidelines) and the date of the last
review.**

According to NIST Pub 800-12, "Certification is a formal process for
testing components or systems against a specified set of security
requirements. Certification is normally performed by an independent
reviewer, rather than the system builder."

NIST Pub 800-12 states that "System security accreditation is the formal
authorization by the accrediting (management) official for system
operation and an explicit acceptance of risk."

If a C&A process were completed, the response should address the
following questions: For FAA a C&A consists of the Security
Certification and Accreditation Plan (SCAP) process. When was the latest
C&A/SCAP completed and when will the C&A/SCAP be updated next? With what
NIST/OMB or other guidance were these processes and documentation
compliant? What processes were/will be completed as part of the C&A/SCAP
(for example risk assessment, security plan update, security testing)?
Are/will the investment's security controls and processes implemented in
a manner consistent with their security plan and SCAP?

Any program that has completed a SCAP should answer this question using
the following format: (making the necessary investment-specific
adjustments, where applicable):

> *"Yes. The system was Certified and Authorized in accordance with FAA
> Order 1370.82, Information Systems Security Program, and the FAA ISS
> Handbook, which are based on OMB Policy and NIST guidance.*
>
> *Certification was completed on \<insert date\> and accreditation was
> completed on (insert date). FAA's Certification and Accreditation
> (C&A) process is based on a risk assessment and testing of controls
> commensurate with the importance and sensitivity of the system.
> Mitigation of weaknesses identified through the testing are centrally
> tracked through the Agency's POA&M system. The results of the risk
> assessment and testing, as well as risk management activities, are
> described in the system security plan. The system is certified by
> \<enter name\>). The accreditation is done by a management official
> who has the authority to accept the risks of the system and to
> authorize the system for operation. The signature of the DAA \<insert
> date\> constitute the authority to operate /accreditation."*

If a program is still in the planning phase, this section should
describe plans for completing a full C&A prior to becoming operational
and provide an approximate date for SCAP approval.

Completion of a SCAP or SCAP update should be included in the milestones
tables in the Section I.H tables.

**Question II.B.2.C: Have the management, operational, and technical
security controls been tested for effectiveness? When were the most
recent tests performed?**

If a formal risk assessment was performed on your application/system,
your answer to this question should be "yes" and the date on the final
assessment document should be cited. Describe any other types of testing
that has been or will be completed, including security tests and
evaluations, vulnerability scans, and penetration testing. Briefly sum
up the results of these tests. Indicate if there are any tests planned
for the near future and give the estimated date of completion.

**Question II.B.2.D: Have all system users been appropriately trained in
the past year, including rules of behavior and consequences for
violating the rules?**

The answer to this question should start with the ISS Common Language,
"*Yes,* *every employee undergoes mandatory security awareness training
annually as part of the agency security training and awareness
program,*" before moving onto program specific training. Give the
date(s) when user training was last provided. If the last training
session took place more than a year ago, then give the planned/scheduled
date(s) for upcoming training session(s). Should verification be needed,
be certain that training documentation includes: training dates, users'
names, organization, telephone numbers, etc. and a clear indication that
the rules of behavior and the consequences for violation were discussed.
Be sure to include give a brief overview on what was contained in the
training and how it addressed the rules of the system.

**Question II.B.2.E: How has incident handling capability been
incorporated into the system or investment, including intrusion
detection monitoring and audit log reviews? Are incidents reported to
DHS' FedCIRC?**

The answer should begin by describing how incident handling in general
is handled by the FAA, as specified by the ISS Common Language:

> *"All incidents are reported to the FAA Computer Security Incident
> Response Center (CSIRC), CSIRC in turn reports incidents to the
> Department of Transportation, Transportation Incident Response Center
> (TSIRC), TSIRC reports incidents to the Federal Computer Security
> Incident Center (FedCirc). This is in addition to the specific
> procedures followed by the system or program."*

A description of how incident handling for the specific program should
follow. If a program relies partially or totally on the central
infrastructure for incident handling, then describe how staff
interacts/responds when an incident occurs or how the system managers
are notified of an incident the system is involved in.

Questions that should be addressed in this section include:

-   To whom do the incidents/suspicious activities get reported
    initially and to whom do these individuals report?

-   Are these procedures documented in the security plan or elsewhere?

-   Are there plans to develop incident reporting procedures in the
    future that are specific to the investment?

-   Are intrusion detection systems and audit trails used to protect the
    investment or are there plans to use them. Are audit trails
    reviewed?

-   If these controls do not exist are there plans to implement them in
    the future -- when?

**Question II.B.2.F: Is the system operated by contractors either
on-site or at a contractor facility? If yes, does any such contract
include specific security requirements required by law and policy? How
are contractor security procedures monitored, verified, and validated by
the agency?**

If you respond "Yes" to this question, then you should refer to the
specific contract clause(s) that clearly show all of the security
requirements specified by law and policy are covered.

Things to consider when answering this question are:

-   Are contractor facilities inspected periodically?

-   When was the last inspection?

-   Are security requirements for contractors, including background
    investigations, security training participation, and protection of
    sensitive government information included in SOWs and contracts?

ISS Common Language:

> "*All personnel must undergo the appropriate background investigation,
> as specified in FAA Order 1600.1D, Personnel Security Program, prior
> to being granted access to the program or system."*

If this language is in the contract, please specify that it is in the
contract.

In addition to the Common Language, the preparer should refer to any
specific contract clause(s) that clearly show all of the security
requirements specified by law and policy are covered. The contract
clauses that contain requirements for contractor security procedures are
as follows:

1.  Security Requirements -- Classified Contracts (Jul 2002)

3.14-1/alt 1 Security Requirements -- Classified Contracts Alternate I
(Jul 2002)

3.14-1/alt 2 Security Requirements -- Classified Contracts Alternate II
(Jul 2002)

3.14-2 Contractor Personnel Suitability Requirements (Apr 2004)

3.14-3 Foreign Nationals as Contractor Employees (Jul 2002)

3.14-4 Government-Issued Keys, Identification Badges, and Vehicle Decals
(Jul 2002)

3.14-5 Sensitive Unclassified Information (SUI) (Apr 2003)

Describe how the program monitors, verifies, and validates the
contractor security procedures (i.e., periodic reviews, independent
third party assessments, scheduled and unscheduled site visits, etc.)

**Question** Number range CHAPTER**II.B.3:** **How does the Agency
ensure the effective use of security controls and authentication tools
to protect privacy for those systems that promote public access?**

Address the policies and controls that are in place at FAA and
specifically for your investment, if your investment is accessible to
the public. Identify security policies and procedures and technical
security access and authentication controls used to ensure sensitive
data is protected from unauthorized access. Another thing that can be
discussed here are general user rules. If a program is not accessible to
the general public, state as such. Additional information on protecting
sensitive data is found in Orders 1600.75, Protecting Sensitive
Unclassified Information (SUI) and 1600.2D, Safeguarding Controls and
Procedures for Classified National Security Information and Sensitive
Unclassified Information. If you have questions on these orders, contact
your security servicing organization.

**Question II.B.4: How does the agency ensure that the handling of
personal information is consistent with relevant government-wide and
agency policies?**

If the investment processes/accesses privacy data, start the response to
this question by describing DOT and FAA Privacy policies and system
specific controls implemented for your investment. For a listing of
government policies applicable to safe handling of personal information,
see Order 1600.75, Appendices B, C and F. For clarification on DOT or
FAA security policy, contact your security servicing organization.

Also, the E-Government Act require agencies to conduct, and submit to
OMB, privacy impact assessments (PIAs) for all new IT investments
administering information in identifiable form collected from, or about,
*[members of the public.]{.underline}* PIA's should be updated on a
regular basis and the date of the latest PIA should be included.

***Do not send any PIAs directly to OMB.***

The Security and Privacy SME's have developed five different ways to
discuss privacy using ISS Common Security Language. Choose the
appropriate statement from the five listed below.

Example 1

> *The \<insert name of Operating Administration (OA)\> Privacy Officer
> and \<insert system name\> subject matter experts completed an initial
> privacy identification, assessing whether \<insert system name\>
> requires a PIA. As an existing system with no changes that affect
> privacy, \<insert system name\> does not require a PIA.*

Example 2

> *The \<insert name of OA\> Privacy Officer and \<insert system name\>
> subject matter experts completed an initial privacy identification,
> assessing whether \<insert system name\> requires a PIA. As a new
> system that contains public Personal Identifiable Information (PII),
> \<insert system name\> does require a PIA. OMB will receive a PIA for
> this system on or before the \<insert year\> deadline.*

Example 3

> *The \<insert name of OA\> Privacy Officer and \<insert system name\>
> subject matter experts completed an initial privacy identification,
> assessing whether \<insert system name\> requires a PIA. As a new
> system that does not contain PII of the public, \<insert system name\>
> does not require a PIA.*

Example 4

> The \<insert name of OA\> Privacy Officer and \<insert system name\>
> subject matter experts completed an initial privacy identification,
> assessing whether \<insert system name\> requires a PIA. As an
> existing system that does not contain public PII, \<insert system
> name\> does not require a PIA.

Example 5

> The \<insert name of OA\> Privacy Officer and \<insert system name\>
> subject matter experts completed an initial privacy identification,
> assessing whether \<insert system name\> requires a PIA. As an
> existing system that contains PII of the public, \<insert system
> name\> does require a PIA. OMB will receive a PIA for this system on
> or before the \<insert year\> deadline.

To help you determine if your investment requires a PIA or if there are
any questions on the sample text above, contact the VMO to obtain the
name of the PIA subject matter expert (SME).

# 12. Abbreviated Exhibit 300 Program Baseline Overview

(**Note for reviewers:** The Abbreviated Exhibit 300 Program Baseline is
intended to provide a consistent format for presenting the minimum
information needed to make and investment baseline decision, regardless
of the FAA organization to which the decision has been delegated by the
JRC. Having a standard format that is a subset of the Exhibit 300 will
facilitate the investment analysis process and preparation of a full
Exhibit 300 in those cases where the JRC and/or OMB may require a full
Exhibit 300 for an investment that was not previously required to
complete one.

The abbreviated Exhibit 300 information requirements can be tailored to
address the specific needs of each investment decision organization by
adding information where desired. Please comment on any further
streamlining you think is necessary or possible.

## 12.1 Introduction

For investments that are delegated by the JRC to a JRC subordinate board
for approval and are not required to submit an Exhibit 300 to OMB, an
abbreviated version of the baseline document is required for internal
use at FAA. The Abbreviated Exhibit 300 Program Baseline (PB) is more
thorough than the Resource Planning Document (RPD). The Abbreviated
Exhibit 300 PB is a streamlined version of the Exhibit 300 that provides
essential FAA investment analysis information but does not include all
the information or sections required for the Full Exhibit 300. This
section outlines the differences. Except for those areas where
differences are identified, the guidance and instructions found in the
previous sections will apply, although the responses may not need to
contain as much detail. All references to the Joint Resources Council
(JRC) in the previous sections of the guide would be replaced by the
appropriate JRC subordinate board for the investment completing the
abbreviated Exhibit 300.

It should be noted that program should be ready to switch over to a full
Exhibit 300 if so required by OMB for a specific investment.

## 12.2 Scoring

Abbreviated Exhibits 300 Program Baselines (PB) do not require scoring.

## 12.3 Guidance

The information provided in this section outlines the major differences
between which sections are needed to complete the Full vs. the
Abbreviated Exhibit 300. Also remember that less detail will normally be
expected for an investment completing an Abbreviated Exhibit 300. This
is especially true for investments in the planning phases. Less detailed
information will be expected for those investments that are in the
planning phase and have not completed all the investment analyses
processes needed to finalize the Abbreviated Exhibit 300.

### 12.3.1 Screening Questions

Only the following Screening questions must be answered for Abbreviated
Exhibits 300 PB:

-   Name of Investment (Project)

-   Investment Initiation Date

-   Investment Planned Completion Date

-   This Investment is: Initial Concept, Planning, Full Acquisition,
    Steady-state, Mixed Lifecycle

-   Did the Project (Investment) Manager identified in Section I.D.
    review this exhibit?

-   Is this investment included in your Agency's annual performance plan
    or multiple annual performance plans?

-   Is this investment IT?

In addition to the SoS table, the abbreviated Exhibit 300 PB includes
the table below to show the costs of only the phase or segments for
which JRC baseline funding approval is being sought.

  --------------------------------- ------- ------- ------ ------ ------ -------
  **F&E**                           First   FY+1    FY+2   FY+3   FY+4   Total
                                    FY                                   EAC

  Baseline requested for funding                                          

                                                                         

  **OPS**                                                                

  Baseline requested for funding                                          

                                                                          

  **Total**                                                              

  Baseline requested for funding                                          
  --------------------------------- ------- ------- ------ ------ ------ -------

Table 6: Standard format for financial information (Then-Year \$\$)

This table, along with the other investment analysis and decision
documentation can be found in the JRC briefing template in the JRC
guidance in the FAST web page.

### 12.3.2 Section I.A -- Description

A response is not required for Section I.A.3, Supporting Documentation.

### 12.3.3 Section I.B -- Justification

A response is not required for Section I.B.7, Multi Agency Initiative.

### 12.3.4 Section I.C -- Performance Goals and Measures

Only Table 2 must be completed. Table 1 is not required regardless of
when the investment was initiated.

### 12.3.5 Section I.D -- Program Management

Responses must be provided to all of the Exhibit 300 questions in
Section I.D.

### 12.3.6 Section I.E -- Alternatives Analysis

Responses must be provided to all of the Exhibit 300 PB questions in
Section I.E

### 12.3.7. Section I.F -- Risk Inventory and Assessment

The Abbreviated Exhibit 300 should focus on the schedule, cost,
technical, security/privacy, and strategic risk areas. This section
should also address any other risk that is not included in those risk
areas but is rated as being High and is applicable and specific to an
investment.

### 12.3.8 Section I.G -- Acquisition Strategy

Responses must be provided only for the following sections:

-   Question I.G.1: Will you use a single contract or several contracts
    to accomplish this investment?

-   Question I.G.1.A: What type of contract/task order if a single
    contract is used?

-   Question I.G.1.B: If multiple contract/task orders will be used,
    discuss the type, how they relate to each other to reach investment
    outcomes, and how much each contributes to the achievement of the
    investment cost, schedule and performance goals. Also discuss the
    contract/task order solicitation or contract provisions that allow
    the contractor to provide innovative, transformational solutions.

-   Question I.G.2: For other than firm-fixed price, performance-based
    contracts, define the risk not sufficiently mitigated in the risk
    mitigation plan, for that contract/task order, that requires
    Government to assume the risk of contract achievement of cost,
    schedule and performance goals. Explain the amount of the risk the
    government will assume.

-   Question I.G.4: Discuss the competition process used for each
    contract/task order, including the use of RFP's, schedules or other
    multiple agency contracts, etc.

-   Question I.G.5: Will you use commercially available commercial
    off-the-shelf (COTS) products for this investment?

```{=html}
<!-- -->
```
-   Question I.G.5.A: To what extent will these items be modified to
    meet the unique requirements of this investment?

-   Question I.G.7: How will you ensure Section 508 compliance?

### 12.3.9 Section I.H -- Project (Investment) and Funding Plan

Responses must be provided to all parts of this section. However the
response need not include information about Earned Value Management
(EVM) assessments, their results, and the status or recommended actions,
if this type of assessment has not been completed for the specific
investment.

### 12.3.10 Section II.A -- Enterprise Architecture (EA)

Responses must be provided only to the questions in Section II.A.1,
Business.

### 12.3.11 Security and Privacy (Required for IT Investments Only)

Responses must be provided only for the following Sections:

Question II.B.1: How is security provided and funded for this investment
(e.g., at the program office level or by the CIO through a general
support system/network)?

Question II.B.1.A: What is the total dollar amount allocated to IT
security for this project in the budget year? Please indicate whether an
increase in IT security funding is requested to remediate IT security
weaknesses, specifying the amount and a general description of the
weaknesses.

Section II.B.2: Please describe how the investment (system/application)
meets the following security requirements of the Federal Information
Security Management Act, OMB policy, and NIST guidance

[]{.mark}

Question II.B.2A: Does the investment (system/application) have an
up-to-date security plan that meets the requirements of OMB policy and
NIST guidance? What is the date of that plan?

Question II.B.2.B: Has the investment been certified and accredited
(C&A)?

Note: Certification and accreditation refers to a full C&A and does not
mean interim authority to operate. Additionally, specify the C&A
methodology used (e.g., NIST guidelines) and the date of the last
review. C&As are to be performed prior to the system becoming
operational. If the system(s) described in the business case are in the
initial concept, planning, or development phase, the agency needs to
state that a C&A will be conducted prior to the system becoming
operational. Please include the planned date for any system not yet
operational. FAA uses the Security Certification and Accreditation Plan
(SCAP) process for C&A. Refer to this section for the full Exhibit 300
for more information on the C&A and SCAP.

Question II.B.2.C: Have the management, operational, and technical
security controls been tested for effectiveness? When were the most
recent tests performed?

Question II.B.4. How does the agency ensure that the handling of
personal information is consistent with relevant government-wide and
agency policies?

*Note: The response to this question needs to focus primarily on the
information about the PIA, for which instructions are included in
Section 11.3 of this guide.*

# APPENDIX A - CROSSWALK OF THE EXHIBIT 300 SECTIONS

**Screening Questions**

Please note that several of these questions need to be cross checked
with other sections of the business case.

+------+--------+------------------------------------------------------+
| **S  | **T    | **What to check**                                    |
| ecti | opic** |                                                      |
| on** |        |                                                      |
+======+========+======================================================+
| **   | **     | Guidance for this number is found in OMB Circular    |
| Part | Unique | A-11 Exhibit 53. The number includes the primary BRM |
| I    | P      | mapping information from section II.A of the Exhibit |
| s    | roject | 300. The UPI shown for this project/investment on    |
| cree | Iden   | the Exhibit 300 should be consistent with the UPI    |
| ning | tifier | shown in the Exhibit 53 and in the Plan of Action    |
| que  | (      | and Milestone (POAM), if there is a POAM for this    |
| stio | UPI)** | project.                                             |
| ns** |        |                                                      |
+------+--------+------------------------------------------------------+
|      | **Inve | These dates should reflect the life of the           |
|      | stment | project/investment, from its conceptual/initiation   |
|      | Init   | phases up to its disposal and/or replacement by      |
|      | iation | another system. The duration should be consistent    |
|      | Date   | with the duration of costs shown in the spending     |
|      | and    | summary.                                             |
|      | P      |                                                      |
|      | lanned |                                                      |
|      | Comp   |                                                      |
|      | letion |                                                      |
|      | Date** |                                                      |
+------+--------+------------------------------------------------------+
|      | **     | The phase of the investment during the budget year   |
|      | System | should be indicated. If the investment reflects      |
|      | Phase  | costs for more than one phase or will be             |
|      | (I     | transitioning phases, "mixed" would normally be the  |
|      | nitial | most accurate response. Make sure that the phase     |
|      | co     | selected correctly reflects the costs and milestones |
|      | ncept, | shown in the spending summary and section I.H. For   |
|      | pla    | example, if the spending summary and/or section I.H  |
|      | nning, | show costs in either planning or acquisition, as     |
|      | full   | well as maintenance, the phase should be defined as  |
|      | acquis | mixed, not steady-state.                             |
|      | ition, |                                                      |
|      | s      |                                                      |
|      | teady- |                                                      |
|      | state, |                                                      |
|      | mixed  |                                                      |
|      | lifecy |                                                      |
|      | cle)** |                                                      |
+------+--------+------------------------------------------------------+
|      | **Se   | Make sure that the same security costs have been     |
|      | curity | included in the spending summary, section I.H, and   |
|      | Percen | section II.B. Zero percent is normally not an        |
|      | tage** | acceptable answer. If other organizations are paying |
|      |        | for large parts of the security for this project,    |
|      |        | this should be explained in section II.B.            |
+------+--------+------------------------------------------------------+
|      | **Does | This is determined both by whether the department of |
|      | this   | homeland security is a user of the project/system    |
|      | inve   | and the mission supported by the investment itself.  |
|      | stment |                                                      |
|      | s      | If you check off yes for any of the Homeland         |
|      | upport | Security items, use section IA.3 (supporting         |
|      | ho     | information) to elaborate.                           |
|      | meland |                                                      |
|      | secur  |                                                      |
|      | ity?** |                                                      |
+------+--------+------------------------------------------------------+
|      | **c.   | The information provided in this section should be   |
|      | Was a  | consistent with the information provided in section  |
|      | P      | II.B.                                                |
|      | rivacy |                                                      |
|      | Impact |                                                      |
|      | Asse   |                                                      |
|      | ssment |                                                      |
|      | (PIA)  |                                                      |
|      | sub    |                                                      |
|      | mitted |                                                      |
|      | via    |                                                      |
|      | PIA@o  |                                                      |
|      | mb.eop |                                                      |
|      | .gov** |                                                      |
+------+--------+------------------------------------------------------+
|      | **d.   | The answers in this section should be consistent     |
|      | Was    | with information provided in section I.F and II.B in |
|      | this   | terms of the security risk level of the system and   |
|      | inve   | the status of FISMA weaknesses. If weaknesses were   |
|      | stment | found but not included in the POAM, this should be   |
|      | re     | explained in section II.B. If a system has undergone |
|      | viewed | certification and/or has had a NIST 800-26           |
|      | as     | self-assessment performed, then the answer is yes.   |
|      | part   | Weaknesses found during the certification process    |
|      | of the | and/or the self-assessment must be identified in a   |
|      | F      | Plan of Action and Milestone for that system and if  |
|      | ederal | so, then you can say yes, they have been             |
|      | Infor  | incorporated into the Agency\'s corrective action    |
|      | mation | plan.                                                |
|      | Se     |                                                      |
|      | curity |                                                      |
|      | Mana   |                                                      |
|      | gement |                                                      |
|      | Act    |                                                      |
|      | (      |                                                      |
|      | FISMA) |                                                      |
|      | review |                                                      |
|      | pr     |                                                      |
|      | ocess? |                                                      |
|      | d.1 If |                                                      |
|      | yes,   |                                                      |
|      | were   |                                                      |
|      | any    |                                                      |
|      | weak   |                                                      |
|      | nesses |                                                      |
|      | found? |                                                      |
|      | d.2    |                                                      |
|      | Have   |                                                      |
|      | the    |                                                      |
|      | weak   |                                                      |
|      | nesses |                                                      |
|      | been   |                                                      |
|      | incorp |                                                      |
|      | orated |                                                      |
|      | into   |                                                      |
|      | the    |                                                      |
|      | ag     |                                                      |
|      | ency's |                                                      |
|      | corr   |                                                      |
|      | ective |                                                      |
|      | action |                                                      |
|      | pl     |                                                      |
|      | ans?** |                                                      |
+------+--------+------------------------------------------------------+
|      | **Has  | Review of the list of Ex 300 programs by AIS         |
|      | this   | indicates the following:                             |
|      | inve   |                                                      |
|      | stment | \- CAS is considered essential                       |
|      | been   |                                                      |
|      | iden   | \- ASCM, ASKME, SWIFT and SASO are non-critical      |
|      | tified | (Note: In fiscal year 2005, ASCM, ASKME, and SWIFT   |
|      | as a   | were not required to submit Exhibits 300 to OMB for  |
|      | na     | Budget Year 2007.)                                   |
|      | tional |                                                      |
|      | cr     | \- the remaining programs are considered mission     |
|      | itical | critical                                             |
|      | ope    |                                                      |
|      | ration |                                                      |
|      | or     |                                                      |
|      | asset  |                                                      |
|      | by a   |                                                      |
|      | P      |                                                      |
|      | roject |                                                      |
|      | Matrix |                                                      |
|      | review |                                                      |
|      | or     |                                                      |
|      | other  |                                                      |
|      | agency |                                                      |
|      | de     |                                                      |
|      | termin |                                                      |
|      | ation? |                                                      |
|      | E.1.   |                                                      |
|      | If no, |                                                      |
|      | is     |                                                      |
|      | this   |                                                      |
|      | an     |                                                      |
|      | agency |                                                      |
|      | m      |                                                      |
|      | ission |                                                      |
|      | cr     |                                                      |
|      | itical |                                                      |
|      | or     |                                                      |
|      | ess    |                                                      |
|      | ential |                                                      |
|      | se     |                                                      |
|      | rvice, |                                                      |
|      | system |                                                      |
|      | oper   |                                                      |
|      | ation, |                                                      |
|      | or     |                                                      |
|      | asset  |                                                      |
|      | other  |                                                      |
|      | than   |                                                      |
|      | those  |                                                      |
|      | iden   |                                                      |
|      | tified |                                                      |
|      | as     |                                                      |
|      | above  |                                                      |
|      | as     |                                                      |
|      | na     |                                                      |
|      | tional |                                                      |
|      | infras |                                                      |
|      | tructu |                                                      |
|      | res.** |                                                      |
+------+--------+------------------------------------------------------+
|      | **Was  | All projects with F&E funding should answer YES in   |
|      | this   | section I (f.) If a PART review was completed but no |
|      | inve   | weaknesses were identified that pertained to the     |
|      | stment | specific investment, then the answer to I.(f1)       |
|      | in     | should be yes but section I.A.2 should clearly       |
|      | cluded | explain that there were no weaknesses nor action     |
|      | in a   | items that pertained to the investment.              |
|      | Perfo  |                                                      |
|      | rmance | AVR projects should answer YES in section I (f) and  |
|      | Asse   | I (f1).                                              |
|      | ssment |                                                      |
|      | Rating |                                                      |
|      | Tool   |                                                      |
|      | (PART) |                                                      |
|      | R      |                                                      |
|      | eview? |                                                      |
|      | Does   |                                                      |
|      | the    |                                                      |
|      | inve   |                                                      |
|      | stment |                                                      |
|      | a      |                                                      |
|      | ddress |                                                      |
|      | a      |                                                      |
|      | we     |                                                      |
|      | akness |                                                      |
|      | found  |                                                      |
|      | during |                                                      |
|      | the    |                                                      |
|      | PART   |                                                      |
|      | rev    |                                                      |
|      | iew?** |                                                      |
+------+--------+------------------------------------------------------+
|      | **Sp   | The spending summary reflects the total lifecycle    |
|      | ending | costs of the project. The spending summary costs     |
|      | Sum    | should be consistent with the costs shown in Section |
|      | mary** | I.H for the duration of the useful segment. Summary  |
|      |        | costs should also be consistent with the chosen      |
|      |        | alternative in section I.E (for the years covered by |
|      |        | the alternative analysis). Differences, such as CIP  |
|      |        | changes reflected in the Summary of Spending should  |
|      |        | be explained in Sections I.E and II.H as             |
|      |        | appropriate. FAA shows Government FTE costs in a     |
|      |        | separate line at the bottom of the chart (Planning / |
|      |        | Acquisition / O&M Phase costs at the moment do not   |
|      |        | include FTE costs). If there is spending in two or   |
|      |        | more phases (Planning / Acquisition / O&M), the      |
|      |        | answer to the screening question "This investment    |
|      |        | is" would normally be mixed lifecycle.               |
+------+--------+------------------------------------------------------+

**President's Management Agenda (PMA)**

  ------------- ---------------- ------------------------------------------------------
  **Section**   **Topic**        **What to check**

  **I.A.1**     **Investment     The description of the investment should state what it
                Description**    does and its purpose. The "what" should include the
                                 scope, functionality, data captured and the purposes
                                 and use of that data in program operations, components
                                 (such as software, hardware, databases, etc.), user
                                 community and interfaces. The description should make
                                 it explicitly clear which specific system components
                                 are being funded (requested), and the scope of any
                                 upgrade or modernization components. The "purpose"
                                 part should include a brief description of the
                                 performance gap or business need and major function of
                                 the investment, including any legal
                                 requirements/regulations satisfied by the investment,
                                 the investment's objectives, and why this investment
                                 is (still) the best way to achieve the business
                                 requirements. The discussion of the why this
                                 investment is still the best way to achieve the
                                 business requirements and benefits expected from it
                                 should reflect the chosen alternative in section I.E.

  **I.A.3**     **Provide        This should reflect research, interviews and other
                supporting       documentation about the chosen alternative in section
                information      I.E. In this section, an agency can provide links or
                derived from     the titles and dates of supporting studies and other
                research**       documents. Each website or document reference,
                                 however, should include a brief description of the
                                 kind of information that is provided by the web site
                                 or document that relates to the investment, as well as
                                 how that information supports the business case.
                                 Documents should not be attached to the 300.

  **I.B.1**     **Investment     Include and ensure consistency with the information
                support of       and major benefits that are measured in section I.C,
                agency's mission and are consistent with benefits discussed in section
                and strategic    I.E in relation to the chosen alternative.
                goals**          

  **I.B.3**     **Alternative    If there are alternative sources, they should be
                sources**        included in the Alternatives Analysis section I.E. If
                                 the private sector/contractors are currently being
                                 used as part of the solution, this should be
                                 mentioned.

  **I.B.7**     **Multi-agency   This is not just about funding from different
                initiative**     agencies, but if there is funding, this should be
                                 reflected in section I.H. as milestones each agency is
                                 responsible for. Plans for partnering in the future
                                 should also be discussed where applicable. It would
                                 strengthen the business case if the different agencies
                                 were reflected in the Integration Project Team in
                                 section I.D.

  **I.B.8.**    **How will this  These benefits should be the same things (only
                investment       addressed in less detail) that are measured in section
                reduce costs or  I.C. AND analyzed in section I.E. There may be a
                improve          number of clear benefits, which have either not yet
                efficiencies**   been measured or that may be considered "intangible"
                                 benefits that are not listed in I.C but should be
                                 mentioned in I.B.1. If such benefits are listed, they
                                 should be specific and concrete examples or an
                                 explanation. For example, if the investment somehow
                                 contributes the improvement in the agency's image, the
                                 response should explain exactly how.
  ------------- ---------------- ------------------------------------------------------

**Performance Goals, Section I.C**

  ------------- ----------------- ------------------------------------------------------
  **Section**   **Topic**         **What to check**

  **I.B.1**     **Justification   Is the mapping described in this section and the
                -- Support of     information shown in Section I.C, Table 1 and/or 2
                Agency's mission  consistent with the discussion on support of the
                and strategic     agency's mission and strategic goals that is provided
                goals**           in section I.B.1?

  **1.B.8**     **Justification   Are the planned performance improvements identified in
                -- Reduction in   section I.C consistent with the benefits described in
                costs/or          sections I.B.8? If there are additional benefits
                improvement in    (maybe intangible) described in section I.B for which
                efficiency**      there are no performance goals and measures in section
                                  I. C, is an explanation provided?

  **I.E**       **Alternatives    Are the planned Performance improvements identified in
                Analysis**        section I.C consistent with the benefits described in
                                  section I.E?

  **II.A**      **Enterprise      Are the measurement areas in Table 2 consistent with
                Architecture**    the Business Reference Model information in section
                                  II.A?
  ------------- ----------------- ------------------------------------------------------

**Project Management -- Section I.D**

The project management area does not get scored just based on the
questions in Section I. D. It is important to show an overall
understanding of the business case and consistency with other sections,
especially sections dealing with project costs, risks, and performance.

+------+--------+------------------------------------------------------+
| **S  | **T    | **What to check**                                    |
| ecti | opic** |                                                      |
| on** |        |                                                      |
+======+========+======================================================+
| **   | **     | The phase identified in Part I should correctly      |
| Part | System | reflects the costs and milestones shown in the       |
| I    | Phase  | spending summary and section I.H. For example, if    |
| s    | (I     | the spending summary and/or section I.H show costs   |
| cree | nitial | in either planning or acquisition, as well as        |
| ning | co     | maintenance, the phase should be defined as mixed,   |
| que  | ncept, | not steady-state.                                    |
| stio | pla    |                                                      |
| ns** | nning, |                                                      |
|      | full   |                                                      |
|      | acquis |                                                      |
|      | ition, |                                                      |
|      | s      |                                                      |
|      | teady- |                                                      |
|      | state, |                                                      |
|      | mixed  |                                                      |
|      | lifecy |                                                      |
|      | cle)** |                                                      |
+------+--------+------------------------------------------------------+
|      | **Se   | Make sure that the same security costs have been     |
|      | curity | included in the spending summary, section I.H, and   |
|      | Percen | section II.B. Zero percent is not an acceptable      |
|      | tage** | answer.                                              |
+------+--------+------------------------------------------------------+
|      | **Sp   | The spending summary costs should be consistent with |
|      | ending | the costs shown in Section I.H for the duration of   |
|      | Sum    | the useful segment. The spending summary reflects    |
|      | mary** | the total lifecycle costs of the project. Section    |
|      |        | I.H covers the current useful segment and/or phase.  |
|      |        | Differences should be explained.                     |
+------+--------+------------------------------------------------------+
| **   | **Jus  | This section should demonstrate an understanding of  |
| Part | tifica | the whole business case by showing consistency with  |
| I.B  | tion** | other sections of the investment, especially in      |
| .8** |        | terms of the performance gap, expected benefits, and |
|      |        | alternatives.                                        |
+------+--------+------------------------------------------------------+
| **   | *      | Demonstrate linkage with the descriptions of         |
| Part | *Perfo | expected improvements/benefits in section I.B        |
| I.   | rmance | (justification), with planned / expected             |
| C.** | Goals  | improvements in section I.C (Performance Goals) and  |
|      | and    | I.E (Alternatives Analysis). The business case       |
|      | Meas   | should also show consistency and linkage among       |
|      | ures** | sections I.C, I.H and I.G, in that the contracts     |
|      |        | that are being tracked for schedule and cost are     |
|      |        | also being tracked for the quality of their          |
|      |        | deliverables (as specified by performance goals in   |
|      |        | I.C).                                                |
+------+--------+------------------------------------------------------+
| **   | **     | The lifecycle costs included in section E of the     |
| Part | Altern | alternatives analysis (AA) should be consistent with |
| I    | atives | the costs shown in the spending summary. (The costs  |
| .E** | Anal   | should reflect the same lifecycle phases for the     |
|      | ysis** | period covered by the AA for the selected            |
|      |        | alternatives. Differences should be explained)       |
|      |        |                                                      |
|      |        | Benefits discussed in I.E should be consistent with  |
|      |        | the benefits (performance improvement goals, cost    |
|      |        | savings and avoidances, etc) discussed in I.B and    |
|      |        | I.C.                                                 |
+------+--------+------------------------------------------------------+
| **I  | **Risk | The risk table must be completely filled out and     |
| .F** | Inv    | kept up to date. The costs shown in the spending     |
|      | entory | summary, alternative analysis and Section I.H have   |
|      | and    | been risk adjusted. The risk levels shown are        |
|      | Assess | consistent with the schedule, cost, and security     |
|      | ment** | performance/status and other information in the      |
|      |        | business case.                                       |
+------+--------+------------------------------------------------------+
| **I  | *      | Contracts should have an EVMS clause requiring the   |
| .G** | *Acqui | contractor to implement a program management system  |
|      | sition | that meets the criteria in ANSI/EIA Standard 748-A.  |
|      | Stra   |                                                      |
|      | tegy** | EVMS is required for all contracts for DME efforts,  |
|      |        | including tests and prototypes that may be part of   |
|      |        | the planning phase and upgrades/modifications to an  |
|      |        | operational/steady-state system.                     |
|      |        |                                                      |
|      |        | OMB wants to see consistency and a connection        |
|      |        | between sections I.C, I.H and I.G, in that the       |
|      |        | contracts that are being tracked for schedule and    |
|      |        | cost are also being tracked for the quality of their |
|      |        | deliverables (as specified by performance goals in   |
|      |        | I.C).                                                |
+------+--------+------------------------------------------------------+
| **I. | **P    | IPT skills and training are discussed in section     |
| H.** | roject | I.D.                                                 |
|      | and    |                                                      |
|      | F      | Section I.H should address the project management    |
|      | unding | and governance processes being used by the project   |
|      | Plan** | managers, and IPT to mange project cost, schedule    |
|      |        | and performance goals. The roles of the IPT in these |
|      |        | processes should be described in section I.H.        |
+------+--------+------------------------------------------------------+
| **II | **Ente | Information in this section should indicate the      |
| .A** | rprise | project is consistent with the agency\'s EA and      |
|      | Archit | there is a process to help ensure that consistency.  |
|      | ecture | Information should also demonstrate and              |
|      | (EA)** | understanding of the business missions being         |
|      |        | supported by the investment, as well as the          |
|      |        | technology supporting it. The information about the  |
|      |        | system should be consistent with section II.B as     |
|      |        | well as the system description in I.A, and the       |
|      |        | performance goals in I.C.                            |
+------+--------+------------------------------------------------------+
| **II | **Secu | Security cost and status information should be       |
| .B** | rity** | consistent with the screening questions, spending    |
|      |        | summary, the project and funding plan (I.H), and the |
|      |        | risk assessment (I.F). Security should be            |
|      |        | represented in the IPT.                              |
+------+--------+------------------------------------------------------+

**Alternatives Analysis, Lifecycle Costs Formulation, and related
sections.**

+------+--------+------------------------------------------------------+
| **S  | **T    | **What to check**                                    |
| ecti | opic** |                                                      |
| on** |        |                                                      |
+------+--------+------------------------------------------------------+
| **   | **Sp   | The costs in the Alternatives Analysis should be     |
| Part | ending | consistent with the costs in the Summary of Spending |
| I    | Sum    | for the time period of the alternatives analysis.    |
| s    | mary** | The Summary of Spending table represents the total   |
| cree |        | investment cost for the full estimated lifecycle of  |
| ning |        | the selected alternative. Consequently, the summary  |
| que  |        | of spending will include all the projects past costs |
| stio |        | as well as its present and future ones, whereas an   |
| ns** |        | alternatives analysis will normally address the      |
|      |        | remaining life of the project (not including sunk    |
|      |        | costs) from the time of the latest alternatives      |
|      |        | analysis update or completion.                       |
+------+--------+------------------------------------------------------+
| **I  | **Jus  | Describe alternatives considered keeping in context  |
| .B** | tifica | of agency strategic goals, closing performance gap,  |
|      | tion** | providing a service, or performing a function,       |
| **I  |        | rather than how to build to a technical              |
| .C** | *      | specification in different way.                      |
|      | *Perfo |                                                      |
| **I  | rmance | Provide comparison of returns for each alternative   |
| .H** | Goals  | and demonstrate thoroughness, using well-grounded,   |
|      | and    | consistent estimates for the ROIs.                   |
|      | Meas   |                                                      |
|      | ures** | Do not cite benefits in I.E. that are not mentioned  |
|      |        | in sections I.B and I.C.                             |
|      | **P    |                                                      |
|      | roject | For steady-state, especially legacy systems, where   |
|      | and    | an e-Gov strategy review is needed, planned or       |
|      | F      | underway, sections I.B, I.E, and I.H should address  |
|      | unding | e-Gov strategy issues consistently and in relation   |
|      | Plan** | to the specific sections. For examples in relation   |
|      |        | to explaining whether the project still meets the    |
|      |        | agency and PMA goals addressed in section I.B,       |
|      |        | whether updates to the alternatives analysis         |
|      |        | (section I.E) are or will address e-Gov strategy     |
|      |        | issues, and whether post-implementation reviews and  |
|      |        | other operational analysis processes take into       |
|      |        | account e-Gov strategy issues.                       |
+------+--------+------------------------------------------------------+

**Risk Management I.F**

  ------------- -------------- ------------------------------------------------------
  **Section**   **Topic**      **What to check**

  **Part I      **Spending     The costs shown in the spending summary should be risk
  screening     Summary**      adjusted.
  questions**                  

  **I.H.**      **Project and  Must have a plan, with milestones and completion
                Funding Plan** dates, to eliminate, mitigate, or manage the risks.
                               Section I.H should clearly state if and how the
                               milestones shown in the section I.H tables have been
                               adjusted to address the project's schedule, cost and
                               performance risks, as well as risk mitigation actions.
                               If there are significant risk mitigation actions,
                               section I.H should either show these as separate
                               milestones or describe if they have been included as
                               part of other project milestones.

  **II.B**      **Security**   Section I.F descriptions and probability levels for
                               security related risks (such as 17 and 18) should be
                               consistent with the findings in FISMA assessments,
                               other security assessments and tests, and with the
                               information in section II.B. If certifications and
                               accreditations have not been completed on operational
                               systems and/or many of the controls mentioned in
                               section II.B are not in place, a basic security risk
                               rating may not be justified.
  ------------- -------------- ------------------------------------------------------

**Acquisition Strategy, Section I.G**.

  ------------- --------------- ------------------------------------------------------
  **Section**   **Topic**       **What to check**

  **I.C and     **Performance   Performance-based acquisition management means you
  I.H**         Goals and       have a documented, systematic process for program
                Project and     management, which includes: Integrating program scope,
                Funding Plan**  schedule and cost objectives; Establishing a baseline
                                plan for accomplishment of program objectives; and
                                Using earned value techniques for performance
                                measurement during execution of the program. This
                                means that your contracts are integrally tied to your
                                performance, including: cost/schedule performance
                                reported in section I.H. and; technical/project
                                performance reported in section I.C. The information
                                on expected performance provided in section I.C and
                                the types of contracts that are used and their
                                relationship should be consistent with the EVM
                                information provided in Section I.H.
  ------------- --------------- ------------------------------------------------------

**Performance Based Management and Lifecycle Costs Formulation, Section
I.H. and Related Sections**

+------+--------+------------------------------------------------------+
| **S  | **T    | **What to check**                                    |
| ecti | opic** |                                                      |
| on** |        |                                                      |
+======+========+======================================================+
| **   | **Sp   | The spending summary reflects the total lifecycle    |
| Part | ending | costs of the project. The spending summary costs     |
| I    | Sum    | should be consistent with the costs shown in Section |
| s    | mary** | I.H for the duration of the useful segment. The      |
| cree |        | phases covered in I.H for the duration of the        |
| ning |        | segments depicted in the tables should be consistent |
| que  |        | with the phases in the summary of spending for the   |
| stio |        | same duration. Cost differences due to CIP or other  |
| ns** |        | funding changes should be explained.                 |
|      |        |                                                      |
|      |        | FAA shows Government FTE costs in a separate line at |
|      |        | the bottom of the chart (Planning/Acquisition/O&M    |
|      |        | Phase costs at the moment do not include FTE costs). |
|      |        | FTE costs however should be shown at least as a      |
|      |        | separate line for each useful segment in the Section |
|      |        | I.H tables.                                          |
+------+--------+------------------------------------------------------+
|      | **     | The phase selected should correctly reflect the      |
|      | System | costs and milestones shown in the spending summary   |
|      | Phase  | and section I.H. For example, if the spending        |
|      | (I     | summary and/or section I.H show costs in either      |
|      | nitial | planning or acquisition, as well as maintenance, the |
|      | co     | phase should be defined as mixed, not steady-state.  |
|      | ncept, |                                                      |
|      | pla    |                                                      |
|      | nning, |                                                      |
|      | full   |                                                      |
|      | acquis |                                                      |
|      | ition, |                                                      |
|      | s      |                                                      |
|      | teady- |                                                      |
|      | state, |                                                      |
|      | mixed  |                                                      |
|      | lifecy |                                                      |
|      | cle)** |                                                      |
+------+--------+------------------------------------------------------+
|      | **Se   | Make sure that the same security costs have been     |
|      | curity | included in the spending summary, section I.H, and   |
|      | Percen | section II.B.                                        |
|      | tage** |                                                      |
+------+--------+------------------------------------------------------+
| **   | **Jus  | If this is a multi-agency initiative and other       |
| Part | tifica | agencies/ organizations are paying for part of this  |
| I.B  | tion** | investment, these agencies should be identified in   |
| .7** |        | the funding agency column of the tables in section   |
|      |        | I.H.                                                 |
+------+--------+------------------------------------------------------+
| **   | *      | Ensure section I.H.1 describes how these measures    |
| Part | *Perfo | will be tracked by the operational analysis system   |
| I    | rmance | and any other management processes.                  |
| .C** | Goals  |                                                      |
|      | and    | OMB wants to see consistency and a connection        |
|      | Meas   | between sections I.C, I.H and I.G, in that the       |
|      | ures** | contracts that are being tracked for schedule and    |
|      |        | cost are also being tracked for the quality of their |
|      |        | deliverables (as specified by performance goals in   |
|      |        | I.C).                                                |
+------+--------+------------------------------------------------------+
| **I  | **P    | Section I.H should address the project management as |
| .D.3 | roject | well as governance processes being used by the       |
| .a** | M      | project managers and IPT to mange project cost,      |
|      | anagem | schedule and performance goals. The roles of the IPT |
|      | ent/** | in these processes should be described in section    |
|      |        | I.H.                                                 |
|      | *      |                                                      |
|      | *Skill |                                                      |
|      | Set**  |                                                      |
+------+--------+------------------------------------------------------+
| **   | **     | The costs shown in section I.E should [encompass the |
| Part | Altern | whole life of the project (not including sunk costs  |
| I    | atives | -- except in cases where they are still relevant to  |
| .E** | An     | that phase/useful segment because the AA does not    |
|      | alysis | yet need to be updated) and be consistent with the   |
|      | (AA)** | costs covering the same time span in the spending    |
|      |        | summary and well as the useful segment of section    |
|      |        | I.H]{.underline}. The alternative costs should       |
|      |        | include all the risk adjustments and risk mitigation |
|      |        | strategies that are included in the spending summary |
|      |        | and section I.H.                                     |
|      |        |                                                      |
|      |        | If section I.H.3 is used to re-baseline a useful     |
|      |        | segment/phase of a project, the AA cost information  |
|      |        | should be updated to reflect the new cost and        |
|      |        | milestone information, but may not need to be        |
|      |        | completely redone. If the AA is out of date, a new   |
|      |        | one must be completed regardless of whether section  |
|      |        | I.H has been re-baselined.                           |
+------+--------+------------------------------------------------------+
| **   | **Risk | Section I.H costs and dates must incorporate risk    |
| Part | Inv    | adjustments and the risk reserve. The cost of risk   |
| I    | entory | mitigation actions identified in section I.F         |
| .F** | and    | (including security risk mitigation actions          |
|      | Assess | identified in more detail in the POAM) should be     |
|      | ment** | included in the mitigation costs and milestones      |
|      |        | described in section I.H.                            |
+------+--------+------------------------------------------------------+
| **   | *      | Contracts should have an EVMS clause requiring the   |
| Part | *Acqui | contractor to implement a program management system  |
| I    | sition | that meets the criteria in ANSI/EIA Standard 748.    |
| .G** | Stra   | This includes all contract types including firm      |
|      | tegy** | fixed price (except for contracts when there is no   |
|      |        | DME or integration work). Contracts need to specify  |
|      |        | schedule and performance goals.                      |
|      |        |                                                      |
|      |        | EVMS is required for all contracts for DME efforts,  |
|      |        | including tests and prototypes that may be part of   |
|      |        | the planning phase and upgrades/modifications to an  |
|      |        | operational/steady-state system.                     |
|      |        |                                                      |
|      |        | Section I.G, I.H.1 and I.H.4 need to clearly and     |
|      |        | consistently identify what portion of the contracts  |
|      |        | and which milestones are covered by EVM. OMB wants   |
|      |        | to see consistency and a connection between sections |
|      |        | I.C, I.H, and I.G, in that the contracts that are    |
|      |        | being tracked for schedule and cost are also being   |
|      |        | tracked for the quality of their deliverables (as    |
|      |        | specified by performance goals in I.C). Section      |
|      |        | I.H.1 should clearly explain what portion of the     |
|      |        | project costs shown in section I.H use EVM and which |
|      |        | do not. It should also clearly explain which of the  |
|      |        | milestones shown in section I.H are ones belonging   |
|      |        | to EVM contracts and being tracked using EVM in      |
|      |        | section I.4. Section I.H.1 should also explain how   |
|      |        | those contracts that do not use EVMS are being       |
|      |        | managed and how project performance is being tracked |
|      |        | for those portions of the project.                   |
+------+--------+------------------------------------------------------+
| **I  | **Was  | If reviews by the EA committee are mentioned as part |
| I.A. | this   | of the investment governance process in section I.H, |
| 1C** | inve   | the information should be consistent with that       |
|      | stment | provided in this section of the Exhibit 300. If an   |
|      | ap     | operational analysis or\                             |
|      | proved | e-Gov strategy review is being conducted on an       |
|      | t      | existing operational system, it should address       |
|      | hrough | adherence to the agency's EA.                        |
|      | the EA |                                                      |
|      | review |                                                      |
|      | com    |                                                      |
|      | mittee |                                                      |
|      | at     |                                                      |
|      | your   |                                                      |
|      | age    |                                                      |
|      | ncy?** |                                                      |
+------+--------+------------------------------------------------------+
| **   | **Tec  | Costs attributable to technology described in the    |
| II.A | hnical | TRM that supports this project should be included in |
| .3.C | Ref    | the costs that are reflected in section I.H and the  |
|  **  | erence | spending summary.                                    |
|      | M      |                                                      |
|      | odel** |                                                      |
+------+--------+------------------------------------------------------+
| **   | **Se   | If there is a security milestone identified in the   |
| II.B | curity | tables in I.H, then make sure the \$\$ are           |
| .1** | C      | consistent with the security % and the security \$\$ |
|      | osts** | mentioned II.B.1.A.                                  |
|      |        |                                                      |
|      |        | Significant security actions/activities should be    |
|      |        | clearly included security as independent milestones  |
|      |        | or as part of the description of other milestones.   |
|      |        | It is important to show that C&A and other security  |
|      |        | actions are being scheduled, budgeted for, and       |
|      |        | completed.                                           |
+------+--------+------------------------------------------------------+

**Enterprise Architecture II.A**

  ------------- --------------- ------------------------------------------------------
  **Section**   **Topic**       **What to check**

  **Part I      **Unique        The number includes the primary BRM mapping
  screening     Project         information from section II.A of the Exhibit 300, if
  questions**   Identifier      the BRM for that Exhibit 300 still includes the
                (UPI)**         primary BRM mapping , which is no longer required.

  **I.C**       **Performance   The measurement area in Table 2 of Section I.C should
                Goals**         be consistent with the business areas described in the
                                BRM.

  **I.H**       **Project and   The Operational Analysis and e-Gov strategy reviews
                Funding Plan**  discussed in section I.H for existing operational
                                systems should address compliance with the EA and
                                modernization blueprint.

  **II.B**      **Security**    The security aspects/controls pertinent to this
                                project/investment should be reflected in the Service
                                Reference Model (SRM) and the Technical Reference
                                Model (TRM) information and mappings provided in
                                section II.A (See Security section for an example.).
  ------------- --------------- ------------------------------------------------------

**Security, Section II.B**

+------+--------+------------------------------------------------------+
| **S  | **T    | **What to check**                                    |
| ecti | opic** |                                                      |
| on** |        |                                                      |
+======+========+======================================================+
| **   | **d.   | Make sure that these are consistent answers with     |
| Part | Was    | II.B.1.A -- that is, if you say there are weaknesses |
| I    | this   | up front, there should be weaknesses discussed here. |
| S    | part   | The discussion of weaknesses in section II.B does    |
| cree | of a   | not have to be detailed but it should be consistent  |
| ning | FY03   | with the information in the POAM.                    |
| Que  | FISMA  |                                                      |
| stio | rev    |                                                      |
| ns** | iew?** |                                                      |
|      |        |                                                      |
|      | **d1:  |                                                      |
|      | Were   |                                                      |
|      | weak   |                                                      |
|      | nesses |                                                      |
|      | i      |                                                      |
|      | dentif |                                                      |
|      | ied?** |                                                      |
|      |        |                                                      |
|      | **d2:  |                                                      |
|      | Have   |                                                      |
|      | the    |                                                      |
|      | weak   |                                                      |
|      | nesses |                                                      |
|      | been   |                                                      |
|      | incorp |                                                      |
|      | orated |                                                      |
|      | into   |                                                      |
|      | the    |                                                      |
|      | ag     |                                                      |
|      | ency's |                                                      |
|      | corr   |                                                      |
|      | ective |                                                      |
|      | action |                                                      |
|      | p      |                                                      |
|      | lan?** |                                                      |
+------+--------+------------------------------------------------------+
| **   | **Se   | Make sure that these are consistent answers with     |
| Part | curity | II.B.1.A (\$\$ vs. %).                               |
| I    | Percen |                                                      |
| S    | tage** |                                                      |
| cree |        |                                                      |
| ning |        |                                                      |
| Que  |        |                                                      |
| stio |        |                                                      |
| ns** |        |                                                      |
+------+--------+------------------------------------------------------+
| **   | **Jus  | If the security benefits in terms of satisfying a    |
| Part | tifica | security performance gap are significant they need   |
| I    | tion** | to be consistently addressed in sections I.B         |
| .B** |        | (justification), I.C (performance goals), and I.E.   |
|      |        | (alternatives and cost benefit analysis). However,   |
|      |        | security activities such as the completion of        |
|      |        | security plans or C&As should normally be included   |
|      |        | in section I.H milestones.                           |
+------+--------+------------------------------------------------------+
| **   | *      | If the security benefits in terms of satisfying a    |
| Part | *Perfo | security performance gap are significant they need   |
| I    | rmance | to be consistently addressed in sections I.B         |
| .C** | Goals  | (justification), I.C (performance goals) and I.E     |
|      | and    | (alternatives and cost benefit analysis). However,   |
|      | Meas   | security activities such as the completion of        |
|      | ures** | security plans or C&As should normally be included   |
|      |        | in section I.H milestones.                           |
+------+--------+------------------------------------------------------+
| **I  | **P    | This section must include a statement about security |
| .D.3 | roject | skills being part of the project team. If the IPT    |
| .a** | manag  | does not currently include individuals with security |
|      | ement/ | skills, the planned date for including such          |
|      | skill  | individuals should be provided.                      |
|      | set**  |                                                      |
|      |        | Example:                                             |
|      |        |                                                      |
|      |        | "Other functional areas, such as quality assurance   |
|      |        | and information security, are readily available and  |
|      |        | accessible from within the Terminal Business Unit.   |
|      |        | These areas are called in to advise and consult on   |
|      |        | specific issues as they arise. In so doing, we are   |
|      |        | able to manage the program effectively and           |
|      |        | efficiently while save the cost of dedicated         |
|      |        | functional support that we may not need full-time."  |
+------+--------+------------------------------------------------------+
| **   | **     | If security considerations are a significant part of |
| Part | Altern | your criteria for selecting an alternative, this     |
| I    | atives | should be mentioned in the business case. The        |
| .E** | Anal   | security benefits of one alternative may outweigh    |
|      | ysis** | its higher costs. If the security benefits are       |
|      |        | significant, they need to be consistently addressed  |
|      |        | in sections I.B (justification), I.C (performance    |
|      |        | goals) and I.E (alternatives and cost benefit        |
|      |        | analysis).                                           |
+------+--------+------------------------------------------------------+
| **   | **Risk | \# 17. The level of risk indicated in the table must |
| Part | #1     | be consistent with the weaknesses described in       |
| I.F  | 7-Secu | section II.B.1.A. The current status column for this |
| Risk | rity** | risk (milestones remaining to mitigate the risk)     |
| Tab  |        | should be consistent with the description of         |
| le** | **Risk | security activities in II.B.2 (especially II.B.2.A,B |
|      | #      | and C -- results of FISMA review, risk assessments,  |
|      | 18-Pri | and security tests or the need to complete security  |
|      | vacy** | plan and C&A activities).                            |
|      |        |                                                      |
|      |        | #18. The level of risk and its description should be |
|      |        | consistent with findings of the PIA if one was       |
|      |        | conducted and with the screening question, section   |
|      |        | II.A.2.F and section II.B, especially II.B.3,        |
|      |        | II.B.4, and II.B.5.                                  |
+------+--------+------------------------------------------------------+
| **   | *      | Contracts used for security support should be        |
| Part | *Acqui | mentioned and their relationship to other contracts  |
| I    | sition | should be described. For example, the contractor     |
| .G** | Stra   | responsible for providing security risk assessment   |
|      | tegy** | and security test and evaluation support should be   |
|      |        | independent of the contractor providing development  |
|      |        | or operational support.                              |
+------+--------+------------------------------------------------------+
| **   | **Cost | If there is a security milestone identified in the   |
| Part | and    | table, then make sure the \$\$ are consistent with   |
| I.   | Sc     | the security % and the security \$\$ mentioned       |
| H.** | hedule | II.B.1.A. Security milestones should include         |
|      | G      | security activities either as independent milestones |
|      | oals** | or as part of the description. It is important to    |
|      |        | show that C&A and other security actions are being   |
|      |        | scheduled and budgeted for.                          |
+------+--------+------------------------------------------------------+
| **   | **S    | The project should address its relationship to the   |
| II.A | ervice | security portion of the service component reference  |
| .3.A | Ref    | model. Example:                                      |
|  **  | erence |                                                      |
|      | M      | Relation to SRM (Component Description): Air         |
|      | odel** | Navigation Services: (6) Infrastructure-Information  |
|      |        | Management. Support subsystem requires               |
|      |        | identification and authorization for users to access |
|      |        | the system.                                          |
|      |        |                                                      |
|      |        | Service: Support Services                            |
|      |        |                                                      |
|      |        | Service Type: Security Management                    |
|      |        |                                                      |
|      |        | Service Component: Identification and Authentication |
+------+--------+------------------------------------------------------+
| **II | **Tec  | The project should address their relationship to the |
| .A.3 | hnical | security aspects of the TRM. Examples:               |
| .C** | Ref    |                                                      |
|      | erence | -   Relation to SRM (SRM service component): NAS OR  |
|      | M      |     Identification and Authentication                |
|      | odel** |                                                      |
|      |        | -   Service Area/Area Name: Component Framework      |
|      |        |                                                      |
|      |        | -   Service Category: Security                       |
|      |        |                                                      |
|      |        | -   Service Standard: Certificates/Digital Signature |
|      |        |                                                      |
|      |        | -   Product Name: Provide Name of the specific       |
|      |        |     product being used                               |
|      |        |                                                      |
|      |        | -   Vendor Name: Provide the name of the Vendor      |
|      |        |                                                      |
|      |        | ```{=html}                                           |
|      |        | <!-- -->                                             |
|      |        | ```                                                  |
|      |        | -   Relation to SRM (SRM service component): NAS or  |
|      |        |     Intrusion Detection                              |
|      |        |                                                      |
|      |        | -   Service Area/Area Name: Component Framework      |
|      |        |                                                      |
|      |        | -   Service Category/Category Name: Security         |
|      |        |                                                      |
|      |        | -   [Service Standard/ Standard Name: Supporting     |
|      |        |     Security Services]{.underline}                   |
|      |        |                                                      |
|      |        | -   [Product Name: Network Virus Scan]{.underline}   |
|      |        |                                                      |
|      |        | -   [Vendor: Provide the name of the                 |
|      |        |     vendor.]{.underline}                             |
+------+--------+------------------------------------------------------+

# APPENDIX B -- USEFUL WEB LOCATIONS

FAA's Exhibit 300 portal **-** [https://nase.amc.faa.gov]{.underline}

FAA Acquisition Management System FAST URL -
<http://fast.faa.gov/index.htm>

FAA Contract Writing Toolbox URL - <http://204.108.10.60/conwrite/>

FAA Policies, Regulations, and Guidelines -
<http://www.faa.gov/regulations/>

FAA Flight Plan - <http://www.faa.gov/AboutFAA/Plans.cfm>

DOT Strategic Plan -
<http://www.dot.state.tx.us/insdtdot/geninfo.htm?pg=stratplan>

DOT Publications -
<http://www.dot.state.tx.us/business/manuals_publications.htm>

DOT Departmental Information Resource Management Manual (DIRMM -
<http://cio.ost.dot.gov/policy/dirmm.html>

DOT Capital Planning and Investment Control Guidelines -
<http://cio.ost.dot.gov/capital_programming/index.html>

Department of Homeland Security (DHS) Strategic Plan -
<http://www.dhs.gov/dhspublic/theme_home1.jsp>

OMB URLs important for Capital Planning processes and documentation:

-   **OMB Circular A-11, Section 300, Planning, Budgeting, acquisition,
    and management of Capital Assets,** The most recent official and
    final version of the Exhibit 300 reporting instructions and format
    document are on OMB's website. Section 300 includes **OMB's 5-Point
    Scoring Criteria for IT Investments (also used by FAA**): OMB
    Circulars are located on OMB's website at:
    <http://www.whitehouse.gov/omb/circulars/index.html>. Please note
    again that scoring is based on OMB's perception of the strength of
    the IT project management, rather than simply the writing of the
    Exhibit 300.

-   **OMB Circular A-11, Section 53, Information Technology and
    E-Government.** This section or exhibit shows all of an agency's IT
    and e-Gov spending, and lists major as well as non-major projects
    individually and using a unique project identifier (UPI). This
    section of Circular A-11 is also found at:
    <http://www.whitehouse.gov/omb/circulars/index.html>.

-   **OMB Circular A-94: Guidelines and Discount Rates for Benefit-Cost
    Analysis of Federal Programs:** This circular provides general
    guidance for conducting benefit-cost and cost-effectiveness
    analyses. It also provides specific guidance on the discount rates
    to be used in evaluating Federal programs whose benefits and costs
    are distributed over time. Located on OMB's website:\
    <http://www.whitehouse.gov/omb/circulars/a094/a094.html#1>

-   The OMB Circular A-11, Part 7, **Capital Programming Guide:** The
    document's purpose is to provide guidance for a disciplined capital
    programming process for capital assets. Located on OMB's website:
    <http://www.whitehouse.gov/omb/circulars/a11/cpgtoc.html>

-   **Implementing the President's Management Agenda for E-Government:**
    This document describes the E-Government achievements since February
    2002, the challenges facing E-Government leaders in 2003 and 2004,
    and the strategy to address these challenges. Located on OMB's
    website: <http://www.whitehouse.gov/omb/egov/2003egov_strat.pdf>

-   *The President's Management Agenda is located at:
    <http://www.whitehouse.gov/omb/budget/fy2002/mgmt.pdf>.*

-   The FEA reference models can be found on [www.egov.gov]{.underline},
    This URL includes the PRM with detailed guidance about how to
    incorporate PRM Indicators into the performance goals and measures
    in Table 2 of the Exhibit 300 and on how to incorporate the PRM into
    agencies' performance goals and measures.

-   The Federal Architecture Management System (FEAMS) is a web-based
    management system designed to provide agencies with access to
    initiatives aligned to the FEA and the associated reference models.
    FEAMS should be checked to help identify other government
    initiatives that might be alternatives to addressing a performance
    gap. FEAMS is located on: https://www.feams.gov

-   Information on EVMS is available at <http://www.acq.osd.mil/pm>.

# APPENDIX C - E-GOV STRATEGY REVIEW SAMPLE 

Government agencies are using technology to enhance the access to and
the delivery of government services for the benefit of citizens,
business partners and employees. To achieve these overall goals an
adequate E-Government Strategy has to be developed which will determine
the success or failure of the ensuing E-Government Projects.
E-Government is not only about technology but impacts every aspect of an
organization involved.

The purpose of an E-Government Strategy at the Agency or
organization-wide level is to foster the use of information technology
aimed at helping people make better- decisions and enhancing their
ability to achieve the Agency's mission. The Agency/organization
E-Government Strategy will follow Agency-wide guidance and further
augment this effort through specific E-Government Strategies and
Initiatives.

As an enterprise pursues a commitment to e-business, it must include all
the IT and business process re-engineering implications or it will not
meet performance expectations for fulfillment and service.

Agency senior business management and IT governance must ensure that the
business and IT operate from a common strategy, with common short- and
long-term objectives. In particular, enterprises must synchronize the
development of the Web-based and incumbent IT infrastructure with the
business commitment to an e-business strategy.

To develop an effective agency/organization-wide e-Government Strategy a
review process should be implemented that addresses agency-wide issues
as well as individual investments.

The development of an agency E-Government strategy or approach refocuses
attention on: how to collaborate more effectively across agencies to
address complex, shared problems; how to enhance customer focus; and how
to build relationships with private sector partners.

The mission and objectives of an agency's E-Government Strategy should
include:

-   Simplifying delivery of services to citizens,

-   Minimizing the burden to the public,

-   Collecting information only once and reusing it,

-   Simplifying business processes, and

-   Utilizing information technologies to reduce costs through
    integrating and eliminating redundant systems.

The development and implementation of an agency-wide E-Government
strategy normally should involve the following activities.

**E-GOVERNMENT FRAMEWORK**

An organization's E-Government strategy needs to allow the organization
to implement an E-Government Framework that allows it to make progress
in the following four areas simultaneously and in **an integrated**
manner.

1.  Customer Relationship Management

2.  Organizational Capability

3.  Enterprise Architecture

4.  Security & Privacy

5.  E-Government Strategy Activities

The following activities are part of the e-Government strategy
development and review processes.

-   Develop awareness of E-Government within the organization, with
    citizens, business partners, customers, and employees and an
    understanding of the services E-Government can provide. This
    includes reviewing agency processes and systems to identify
    opportunities for:

```{=html}
<!-- -->
```
-   Partnering with other federal, state, and local agencies and many of
    our stakeholders.

-   Harnessing the power and capacity of new information technologies.

-   Providing secure, reliable access to scientifically-sound data and
    information.

-   Integrating data that pertains to the same topic, facility, place,
    or resource.

```{=html}
<!-- -->
```
-   Gain the support of the Agency/organization executive management in
    the development and subsequent implementation of E-Government
    strategy and review processes within the Agency/organization.

-   Identify and incorporate best practices in the public and private
    sector for similar IT organizations.

-   Conduct interviews of the appropriate senior management and project
    managers in the organization to gather their vision for the
    implementation and development of an E-Government framework within
    their organization.

-   Build upon the Government Paperwork Elimination Act (GPEA) which
    serves as an official driver to ensure that E-Government continues
    to evolve, provides specific technology options that must be
    explored, and establishes guidelines to develop fully electronic
    transactions.

-   Follow OMB's Federal E-Government and ensure the overall goals of
    the President's "Expanding E-Government Initiatives", listed below,
    are incorporated into the Agency/organization E-Government Strategy.

    -   Make it easy for citizens to obtain service and interact with
        the Federal Government;

    -   Improve government efficiency and effectiveness; and

    -   Improve government's responsiveness to citizens.

```{=html}
<!-- -->
```
-   The Federal E-Government Strategy identifies 24 Presidential
    Priority Initiatives (PPIs) designed to significantly improve
    customer service in an 18 to 24 month period.

    -   Determine which of the 24 PPIs your organization aligns against.

    -   Review existing agency investments to determine Agency's Current
        alignment or involvement with the PPIs.

```{=html}
<!-- -->
```
-   Review the agency's or organization\'s existing Mission, Goals, and
    Vision Statements strategic and performance plans to ensure
    consistency between the E-Government Strategic Plan, the
    organization and the Agency Strategic Plans.

    -   Link IT and E-Government initiatives to the Agency Strategic
        Plan. Clearly demonstrate that IT investments are being planned
        and implemented to successfully deliver the benefits of
        increased effectiveness and efficiency to the business lines and
        programs of the Agency/organization.

    -   Develop E-Government Goals -- describing how each can be
        achieved to fulfill the E-Government mission.

    -   Break the goals into distinct objectives with defined targeted
        outcomes, project initiatives, and high-level performance
        measures (ensure these performance measures are incorporated
        into the Exhibit 300 process).

    -   Each objective should highlight current E-Government
        capabilities and prospective short- and long-term initiatives.

```{=html}
<!-- -->
```
-   Ensure consistency with the President's Management Agenda (PMA). The
    five elements or Government-wide initiatives of the PMA are:

    -   Strategic Management of Human Capital

    -   Competitive Sourcing

    -   Improved Financial Performance

    -   Expanded Electronic Government

    -   Budget and Performance Integration

```{=html}
<!-- -->
```
-   Strengthen IT Management of the Agency/organization by reviewing ALL
    elements of the business case(s) (Exhibit 300s) to identify any
    performance gaps.

-   Identify and document existing E-Government initiatives underway.

-   Analyze existing systems and applications against OMB E-Government
    guidance and criteria.

    -   Obtain listing of all systems and applications with the
        Organization.

    -   Identify any redundant systems and possible cross-cutting agency
        applications.

    -   Identify opportunities for reducing redundancies of effort.

    -   Identify opportunities to provide cost savings through
        streamlining of activities.

    -   Identify organizational realignments to maximize efficiencies.

```{=html}
<!-- -->
```
-   Identify enterprise level opportunities (the agency, other federal,
    state, and local agencies) collaborative efforts.

-   Review the Agency's Modernization Blueprint and the
    Agency/organization's alignment with the Agency's Enterprise
    Architecture (EA). Review potential opportunities for aligning with
    the Federal Enterprise Architecture (FEA) and using the FEA to model
    the future business.

-   Review THE Agency's and the organization's Security and Privacy
    framework and implement a unified approach for developing and
    implementing security policies, procedures, analyses and risk
    mitigation plans.

-   Identify Challenges facing the implementation of the E-Government
    Strategy. In every E-Government Strategy, Organizational, Change
    Management, and Governance issues are major challenges that need to
    be addressed.

-   Identify the E-Government Initiatives of the organization and
    develop an Implementation Plan or Timeline for accomplishing the
    Initiatives. Monitor and evaluate the progress of implementing The
    Agency/organization's E-Government Initiatives.

-   Incorporate and document E-Government Strategy review and planning
    activities and their results of into the appropriate sections of the
    Exhibit 300 and update the status each budget cycle.

**E-GOV STRATEGY REVIEW AND PLANNING ACTIVITIES REPORT OUTLINE**

EXECUTIVE SUMMARY

INTRODUCTION

OFFICE OF MANAGEMENT AND BUDGET (OMB) and PRESIDENTIAL MANAGEMENT AGENDA
(PMA) GUIDANCE

THE AGENCY & ORGANIZATION E-GOVERNMENT FRAMEWORK

The ORGANIZATION & THE AGENCY STRATEGIC OVERVIEW

THE AGENCY & ORGANIZATION E-GOVERNMENT GOALS

DESCRIPTION OF RESULTS OF GAP ANALYSIS OF BUSINESS CASE(S)

ENTERPRISE OPPORTUNITIES & OTHER COLLABORATIVE EFFORTS

> *Describe potential alignments within The Agency/organization (per
> review of all systems and applications identified on Exhibit 53) and
> external collaboration opportunities*

DESCRIPTION OF THE AGENCY & ORGANIZATION E-GOVERNMENT INITIATIVES

CHALLENGES OF IMPLEMENTING E-GOVERNMENT AND RELATED ACTION PLAN(S)

# 

# APPENDIX D -- FAA RISK MANAGEMENT GUIDANCE

[]{.mark}

For each of the OMB risk areas, program managers need to document
specific program risks, to include the level of risk and any planned
mitigation for reducing the risk. The mitigation strategy selected
should be tied to the root cause and consequence of the risk.

The results stemming from Section I.F become key links to several other
sections of the Exhibit 300 (it is important to note that risk needs to
be reflected consistently throughout the Exhibit 300):

-   Section I.G (Acquisition Strategy) requires that the program
    describe the investments' cost risk and mitigation strategy.

-   Section I.H (Performance-Based Management) requires a brief
    explanation of where and how risk is being included in the program's
    costs and milestones (define the operational analysis system/process
    that will be used). Mitigation activities identified in Section I.F
    must be linked with individual useful segment milestones in this
    section (milestone descriptions should show if they include risk
    mitigation). In addition, lifecycle costs identified in this section
    need to be adjusted for risk. For any negative actual performance
    and variance metrics, there should be the relevant lifecycle risks.

-   Section I.E (Alternatives Analysis) requires that lifecycle costs
    shown for each alternative reflect risk-adjusted values found in
    Section I.H (Performance-Based Management).

-   Risk is an aspect in I.B.7.a, I.C, II.B, I.D.4.A, and 3.3 also.
    These sections must be consistent with the items listed in Section
    I.F.

A subsequent requirement of Section I.F consists of the reporting of a
program's risk reserve. The process the FAA uses to account for risk
reserve within program estimates is outlined in Section I.E
(Alternatives Analysis). This or any other method for addressing risk
reserves is to be outlined within this section.

**Mapping of IA Risk Facets to OMB Exhibit 300 Risk Elements:**

The FAA System Engineering Manual (Section 4.10) and the AMS contain
guidance for implementing Risk Management across an investment's
lifecycle. Specific investment phases may use a tailored approach to the
basic guidance found in the FAA SEM. For example, In the AMS guidance
the risk facets currently used in the risk assessment phase of the
Investment Analysis (IA) process include the following: technical,
operability, information security, supportability, cost estimate,
funding, human factors, stakeholder, producibility, management,
schedule, benefits estimate, safety, and architecture. Other risk
sources considered include: political, interdependencies, requirements,
and equipage. These facets capture the sources of risk that the FAA has
determined over the years to be the most relevant to the success of its
investment decisions. Risks identified via the facet areas outlined
above can be mapped directly to the OMB Exhibit 300 (seeTable 2.0).

**Table 1: FAA Investment Analysis Risk Sources Mapped to OMB Risk
Areas**

The above table demonstrates a notional mapping of the FAA's IA risk
facets to the OMB risk areas. It should be noted, that depending on your
program type, (i.e. system modernization, new concept implementation, or
system reengineering) the nature of the risks identified during the
pre-investment analysis may impact the actual mapping to the Exhibit 300
and analysts should use their best judgment.

**General Risk Guidance:**

The FAA System Engineering Manual (Section 4.10) provides detailed
information for implementing the FAA's risk management process. The data
generated during the risk management process is compiled into a risk
table/database, as a means to satisfy continued FAA programmatic risk
management requirements. This data can easily be summarized, sorted by
OMB category, and incorporated into section I.F of the Exhibit 300.

**Relationship of Risk Management to other Exhibit 300 sections.**

It is important to reflect risks and risk management processes
consistently throughout the Exhibit 300, and especially in relation to
the sections described below.

-   **Section I.E-- Alternatives Analysis Section (from an FAA
    perspective)**

The FAA's approach to Alternatives Analysis, as performed for an Initial
Investment Decision is consistent with the OMB Exhibit 300 Section I.E
reporting. The presentation of alternatives and lifecycle cost estimates
in this section should accurately reflect risk and any associated
mitigations. When the FAA performs an alternatives analysis, it reflects
risk in three ways:

-   adjusting schedule assumptions to reflect schedule risk

-   addition of costs for mitigations identified in the risk definition
    phase

-   assignment of risk ranges to cost estimates where there is
    uncertainty about the exact magnitude of costs.

The FAA develops its estimates under the AMS, by starting with point
estimates for the schedule, cost and benefits. For each of the models,
the FAA then evaluates key risk drivers and areas of uncertainty and
applies ranges of estimates based on best, most likely, and worst case
scenarios. The schedule, using critical path analysis is adjusted to
reflect an 80% confidence level schedule. For all programs arising from
the FAA's IA or Re-base lining processes, the 80% confidence cost
estimate (i.e. the cost estimate that has an 80% probability of being
under run in actual program execution) will be used for both budgeting
(e.g., CIP financial baseline) and the Exhibit 300 Program Baseline
costs. Only this cost baseline will be recorded in the Exhibit 300 PB.
This cost baseline includes "contingency" or "risk reserve" funds in
each of the relevant Work Breakdown Structure (WBS) elements that
require reporting in section I.F.

It is important to note that when cost estimates are developed at the
80% confidence level (risk adjusted), each of the FAA's relevant WBS
elements accounts for "contingency" or "risk reserve" as necessary.

-   **Section I.H -- Performance-Based Management**

Section I.H requires a brief explanation of where and how risk is being
included in the program's costs and milestones (define the operational
analysis system/process that will be used). Mitigation activities
identified in section I.F (Risk Management) must be linked with
individual useful segment milestones (milestone descriptions should show
if they include risk mitigation). In addition, lifecycle costs
identified in this section should be adjusted for risk, especially for
those investments that involve COTS (with or without modification).

**Section I.G -- Acquisition Strategy**

Section I.G requires that you describe your cost risk (e.g., contract
type) and mitigation strategy (e.g., EVMS, utilization of COTS
products). Within your acquisition strategy description, it is important
to tie it back to your risk section, ensuring consistency of approach.
It should be noted that it is important to employ a strong acquisition
strategy that mitigates risk to the Federal Government, particularly in
response to question 1.G.2.

# APPENDIX E -- ADDITIONAL 508 GUIDANCE

A program/system must comply with the Section 508 standards if it is
classified as electronic information technology (EIT). All EIT procured,
developed, maintained or used by FAA lines of business must comply with
the Section 508 EIT accessibility standards.

EIT is any equipment or interconnected system or subsystem of equipment,
that is used in the automatic acquisition, storage, manipulation,
management, movement, control, display, switching, interchange,
transmission, or reception of data or information. Specifically, EIT
includes:

-   telecommunication products, such as telephones

-   Information kiosks

-   Transaction machines

-   World Wide Web sites (Intranet and Internet)

-   Multimedia (including videotapes)

-   Office equipment, such as copiers, fax machines, printers,
    calculators

-   Computers

-   Ancillary equipment

-   Software

-   Firmware and similar procedures

-   Services (including support services)

-   Related resources

The Access Board Section 508 EIT Accessibility Standards are as follows:

-   CFR 1194.21-Software Applications and Operating Systems

-   CFR 1194.22-Web Based Information and Applications

-   CFR 1194.23-Telecommunication Product

-   CFR 1194.24-Video and Multimedia Products

-   CFR 1194.25-Self-Contained, Closed Products

-   CFR 1194.26-Desktop and Portable Computers

-   CFR 1194.31-Functional Performance Criteria

-   CFR 1194.41-Information, Documentation, and Support

During the procurement process, the requiring official must indicate
which of the Access Board Section 508 EIT Accessibility Standards are
applicable to the procurement. It may be necessary to consult with
procurement officials, Legal, and/or FAA's Section 508 Coordinator and
Technical Support to determine which Section 508 EIT Accessibility
Standards may apply.

For additional information about FAA's Section 508 Program go to
<http://intranet.faa.gov/aio/e-government/section_508/index.htm>.

A program/system complies with the Section 508 standards when it uses
and follows FAA's Section 508 Procurement Standard Operating Procedures
when procuring Section 508.

**[Step 1]{.underline}**: During the procurement process, the first
question one would ask is, "Does the EIT standards apply"? If they do
not apply, then you can disregard the Section 508 requirement.

**[Step 2]{.underline}**: If the answer is yes, then you would ask, "Is
the procurement eligible for exception?" Additional detail is provided
on exceptions in the Section 508 Procurement Standard Operating
Procedures under Section 4. There are four exceptions which are (1) EIT
acquired by a contractor incidental to a contract, (2) Systems used for
military command, weaponry, intelligence, and crypto logic activities
(National Security System), (3) "Back Office" equipment used by service
personnel for maintenance, repair or occasional monitoring of equipment,
and (4) EIT that would impose an undue burden (significant difficulty of
expense) on the agency.

After you identify the exception, you submit your write-up and support
documentation to the Contracting Officer and FAA Legal, which is General
Counsel. This documentation will be maintained in the COs contract file.

**[Step 3]{.underline}**: If the answer is No, and no exception applies,
then you would proceed to identify the applicable Access Board Section
508 EIT Accessibility standard. The requiring official selects the EIT
standards that will apply to the procurement. He/she would have to
select from 1194.21 thru 1194.41 or he/she may select then all depending
on the procurement requirements. The requiring official may have to
consult other technical personnel, the Section 508 Program Office,
and/or persons in the procurement office to assist in identifying the
EIT standards.

**[Step 4]{.underline}**: After you select the applicable EIT standard
or standards, you would conduct the market research. For example, you
could query Government databases, review on-line catalogs and product
literature, hold pre-solicitation conferences, use technical analysis
publications and review Government-managed web sites. For more
specifics, on the methods of market research that are available, please
consult Exhibit B in the Section 508 Procurement Standard Operating
Procedures.

After you have completed the market research, you would decide whether
the electronic information technology is available in the marketplace.

**[Step 5]{.underline}**: If the answer is no, then the requiring
official would document to the file that the EIT was not available in
the marketplace and submit to the Contracting Officer and FAA Legal,
which is General Counsel. This documentation will be maintained in the
Contracting Officer's contract file.

**[Step 6]{.underline}**: If the answer were yes, then the Contracting
Officer would initiate all the Pre-award Process tools to purchase the
EIT product. For more specifics, on the Pre-award Process tools, consult
Exhibit E in your Section 508 Procurement Standard Operating Procedures.

If the program/system is not electronic information technology (EIT)
then it does not have to comply with the standards. Also, there are four
exceptions that are as follows:

(1) EIT acquired by a contractor incidental to a contract

```{=html}
<!-- -->
```
(1) Systems used for military command, weaponry, intelligence, and
    crypto logic activities (National Security System)

(2) "Back Office" equipment used by service personnel for maintenance,
    repair or occasional monitoring of equipment

(3) EIT that would impose an undue burden (significant difficulty or
    expense) on the agency.

Additional detail is provided on exceptions in the Section 508 Standard
Operating Procedures under Section 4.

All exceptions, with write-up and support documentation must be
submitted to the Contracting Officer and FAA Legal, which is General
Counsel.

How could I respond to the OMB question, "How will you ensure Section
508 compliance?" My program/system is in the planning stages and I am
unfamiliar with the Section 508 requirements.

**Programmatic Condition**

If your program requirements were contracted out or ordered under a task
order subsequent to 6/21/01, then Insert one of the following responses
in Section I.G Acquisition Strategy after question Number 7, \"How will
you ensure Section 508 compliance?\"

**Standard Response\--(Please choose one)**

In accordance with FAA\'s Section 508 Procurement Standard Operating
Procedures, **(insert name of program)** will determine which of the
Section 508 standards apply to the program and comply with each
applicable standard.

**OR**

In accordance with FAA\'s Section 508 Procurement Standard Operating
Procedures, **(insert name of program)** has determined that the
following Section 508 standards apply to the program and will comply
with each applicable standard.

List standards that apply:

-   1194.21 Software Applications and Operating Systems

-   1194.22 Web-based Information or applications

-   1194.23 Telecommunication Products

-   1194.24 Video and Multimedia Products

# APPENDIX F -- GLOSSARY OF ESSENTIAL TERMS

**Appropriation**

An appropriation is an act of Congress that enables Federal agencies to
spend money for specific purposes. Congress must then pass
*appropriations* bills to provide money to carry out government programs
for that year. Appropriations bills divided up by type of program and
agency into thirteen separate bills: Agriculture;
Commerce/Justice/State; Defense; District of Columbia; Energy and Water;
Foreign Operations; Interior; Labor/Health and Human Services/Education;
Legislative Branch; Military Construction; Transportation;
Treasury/Postal Service; and Veterans Affairs/Housing and Urban
Development.

**Authorization**

An authorization is an act of Congress that establishes or continues a
federal program or agency, and sets forth the guidelines to which it
must adhere.

**Balanced Budget**

**A balanced budget occurs when total receipts equal total outlays for a
fiscal year.**

**Budget Authority (BA):** The authority provided by law to incur
financial *[obligations]{.underline}* that will result in
*[outlays]{.underline}*. Specific forms of budget authority include
appropriations, borrowing authority, contract authority, and spending
authority from offsetting collections.

**Budget Resolution**

The budget resolution is the annual framework within which Congress
makes its decisions about spending and taxes. This framework includes
targets for total spending, total revenues, and the deficit, as well as
allocations, within the spending target, for discretionary and mandatory
spending.

**"Cap"**

A "cap" is a legal limit on annual discretionary spending.

**Capital Planning and Investment Control**

A decision-making process for ensuring that information technology (IT)
investments integrate strategic planning, budgeting, procurement, and
the management of IT in support of agency missions and business needs. A
Capital Planning and Investment Control cycle typically includes three
major strategies: Select (investments are selected), Control
(investments are controlled and monitored as they are implemented), and
Evaluate (investments are evaluated after they have reached full
operating capacity).

**Clinger-Cohen Act**

The Clinger-Cohen Act is also known as the Information Technology
Management Reform Act of 1996. The act supplements the Paperwork
Reduction Act of 1980 by establishing a comprehensive approach for
executive agencies to improve the acquisition and management of their
information resources (IT).

**Cost Benefit Analysis**

A systematic, quantitative method to assess the desirability of
government projects or policies when it is important to take a long view
of future effects and a broad view of possible side-effects.

**Deficit**

The deficit is the difference produced when spending exceeds revenues
within a fiscal year.

**Discount Factor**

The factor that translates expected benefits or costs in any given
future year into present value terms. The discount factor is equal to

1/(1 + i)t

where i is the interest rate and t is the number of years from the date
of initiation for the program or policy until the given future year.

**Discretionary Spending**

Discretionary spending is what the President and Congress decide to
spend through the 13 annual appropriations bills. Examples include money
for such activities as the FBI and the Coast Guard, housing and
education, space exploration and highway construction, and defense and
foreign aid. See Mandatory Spending.

**E-Government**

E-Government (electronic government) refers to the federal government's
use of information technologies (such as Wide Area Networks, the
Internet, and mobile computing) to exchange information and services
with citizens, businesses, and other arms of government. Refers to the
use by the Government of web-based Internet applications and other
information technologies, combined with processes that implement these
technologies, to enhance the access to and delivery of Government
information and services to the public, other agencies, and other
Government entities; or to bring about improvements in Government
operations that may include effectiveness, efficiency, service quality,
or transformation.

**Entitlement**

An entitlement program is one in which the federal government is legally
obligated to make payments or provide aid to any person who meets the
legal criteria for eligibility. Examples include Social Security,
Medicare, Medicaid, and Food Stamps.

**Fiscal year**

The fiscal year is the federal government's accounting period. It begins
on October 1 and ends up September 30. For example, fiscal year 2003
began on October 1, 2002 and will end on September 30, 2003.

**Full-time Equivalents (FTEs)**

Civilian employment in the Executive Branch is measured on the basis of
full-time equivalents. One FTE is equal to one work year or 2,080
non-overtime hours. For example, one full-time employee counts as one
FTE, and two half-time employees also count as one FTE.

**Lifecycle Costs**

The overall estimated cost, both government and contractor, for a
particular program alternative over the time period corresponding to the
life of the program, including direct and indirect initial costs plus
any periodic or continuing costs of operation and maintenance.

**Major IT Investment** (Investments that are required to be reported to
OMB): A Major IT investment means a system or investment that requires
special management attention because of its importance to an agency's
mission; was a major investment in the FY 2005 submission and is
continuing; is for financial management and spends more than \$500,000;
is directly tied to the top two layers of the Federal Enterprise
Architecture (Services to Citizens and Mode of Delivery); is an integral
part of the agency's modernization blueprint (EA); has significant
program or policy implications; has high executive visibility; and is
defined as major by the agency's capital planning and investment control
process. OMB may work with the agency to declare other investments as
major investments. Investments that are E-Government in nature or use
e-business technologies must be identified as major investments
regardless of the costs.

**Mandatory Spending**

Mandatory spending is authorized by permanent law rather than annual
appropriations. An example is Social Security. The President and the
Congress can change the law to change the eligibility criteria and thus
the level of spending on mandatory programs, but they do not have to
take annual action to ensure the continuation of spending.

**Mixed Lifecycle Investment**

An investment that has both development/modernization/enhancement (DME)
and steady-state aspects. For example, a mixed lifecycle investment
could include a prototype or module of a system that is operational with
the remainder of the system in DME stages; or, a service contract for
steady-state on the current system with a DME requirement for system
upgrade or replacement.

**Net Present Value/NPV**

The difference between the discounted present value of benefits and the
discounted present value of costs

**Obligations:** A binding agreement that will result in
*[outlays]{.underline}*, immediately or in the future. Budgetary
resources must be available before obligations can be incurred legally.

**"Off-Budget"**

By law, the Government must distinguish "off-budget" programs separate
from the budget totals. Social Security and the Postal Service are
"off-budget."

**"On-Budget"**

Those programs not legally designated as off-budget.

**Outlays:** A payment to liquidate an *[obligation]{.underline}* (other
than the repayment of debt principal). Outlays generally equal to cash
disbursements, but also are recorded for cash-equivalent transactions,
such as the subsidy cost of direct loans and loan guarantees, and
interest accrued on public issues of the public debt. [Outlays are the
measure of Government spending]{.underline}.

**ROI**

Return on Investment

**Risk Adjusted Lifecycle Costs**

The overall estimated cost for a particular investment alternative over
the time period corresponding to the life of the investment, including
direct and indirect initial costs plus any periodic or continuing costs
of operation and maintenance that has been adjusted to accommodate any
risk identified in the risk management plans.

**Sunk Cost**

A cost incurred in the past that will not be affected by any present or
future decision. Sunk costs should be ignored in determining whether a
new investment is worthwhile.

**Useful Segment/Module**

An economically and programmatically separate component of a capital
investment that provides a measurable performance outcome for which the
benefits exceed the costs, even if no further funding is appropriated.

**Budget Authority and Outlays**

Spending levels in the President's Budget and in congressional budget
resolutions are measured in dollars in two ways: budget authority and
outlays. Outlays represent actual disbursements by the Treasury. When
the Treasury issues a check in fiscal year 1998, that is a fiscal year
1998 outlay. Budget authority, on the other hand, is the legal authority
for an agency to enter into obligations of dollars in a certain amount
that will result in outlays. When Congress appropriates (appropriations
bills) funds for a particular program, it is enacting budget authority
-- not outlays.

> **Earned Value Management (EVM) Terms**

-   **Planned Value (PV) = [Budgeted Cost of Work Scheduled
    (BCWS):]{.underline}** The sum of the budgets for all work packages,
    planning packages, etc., scheduled to be accomplished (including
    in-process work packages), plus the amount of level of effort and
    apportioned effort scheduled to be accomplished within a given time
    period.

-   **Earned Value (EV) = [Budgeted Cost for Work Performed
    (BCWP):]{.underline}** The sum of the budgets for completed work
    packages and completed portions of open work packages, plus the
    applicable portion of the budgets for level of effort and
    apportioned effort. This is [value earned]{.underline} to date.

-   **Actual Cost (AC) = [Actual Cost of Work Performed
    (ACWP):]{.underline}** The costs actually incurred and recorded in
    accomplishing the work performed within a given time period.

-   **Variance --** The difference (in \$\$) between your plan and your
    actuals

    -   **Cost Variance --** the numerical difference between value
        earned (BCWP) and actual cost (ACWP)

    -   **Schedule Variance --** The numerical difference between value
        earned (BCWP) and the planned budget (BCWS)

```{=html}
<!-- -->
```
-   **Either one may be positive or negative**

    -   A negative value normally denotes either having accomplished
        less than scheduled or spent more than planned for the work
        accomplished.

    -   A positive value normally denotes having accomplished more than
        what had been scheduled or spent less than planned for the
        amount of work that was accomplished.

```{=html}
<!-- -->
```
-   **Performance Index --** A measure of the efficiency of work
    performed to date

    -   **Cost Performance Index --** cost efficiency factor achieved by
        relating value earned (BCWP) to the dollars actually spent
        (ACWP): CPI = BCWP/ACWP

    -   **Schedule Performance Index --** schedule efficiency factor
        achieved by relating value earned (BCWP) to the scheduled work
        (BCWS): SPI = BCWP/BCWS

```{=html}
<!-- -->
```
-   **Budget at Completion (BAC) --** The sum of all budgets (BCWS) on
    the project.

-   **Estimate at Completion (EAC) --** The sum of all actual costs to
    date plus the estimate of costs for authorized work remaining: EAC =
    ACWP + Estimate To Complete

    -   This should be updated periodically

```{=html}
<!-- -->
```
-   **Estimate to Complete (ETC) --** That portion of the EAC that
    addresses total expected costs for all work remaining