eGovernment Draft Internal Scorecard FY 2006
Q![](media/image1.jpeg){width="0.875in" height="0.875in"}4

+-----------+----+-----------------------------------------------------+
| **Overall |    | To earn an overall score of Green, CPIC, Cyber      |
| Program   |    | Security, Enterprise Architecture and eGov          |
| Score**   |    | Implementation and Alignment Milestones must all be |
|           |    | Green.                                              |
|           |    |                                                     |
|           |    | A Yellow in CPIC, Cyber Security, Enterprise        |
|           |    | Architecture, or eGov Implementation and Alignment  |
|           |    | Milestones makes the overall score Yellow. A Red in |
|           |    | CPIC, Cyber Security, Enterprise Architecture or    |
|           |    | eGov Implementation and Alignment Milestones makes  |
|           |    | the overall score Red.                              |
+-----------+----+-----------------------------------------------------+

  --------------------------------------------------------------------------------------------------------------------
                    **Score**   **To Get to **Stay      **Green**            **Yellow**           **Red**
                                Green**     Green**                                               
  ----------------- ----------- ----------- ----------- -------------------- -------------------- --------------------
  **1. CPIC**       **Overall               **To        **To earn an overall **To earn an overall **The Program/Staff
                    CPIC                    maintain a  score of Green in    score of Yellow in   Offices will receive
                    Score**                 Green       CPIC, the            CPIC, the            an overall score of
                                            status:**   Program/Staff Office Program/Staff Office Red in CPIC if they
                                                        must receive scores  received at least    receive a Red in any
                                                        of Green in all      one score of Yellow  respective
                                                        respective           and no score of Red  category.**
                                                        categories.**        in the respective    
                                                                             categories.**        

                                                                                                  

  **1.1 CPIC IT                                                                                   
  Investment                                                                                      
  Reporting- All IT                                                                               
  investments meet                                                                                
  the requirements                                                                                
  of OMB Circular                                                                                 
  A-11 and OMB                                                                                    
  guidance.**                                                                                     

  1.1a. **A-11 IT                                       Met the OMB Circular Program/Staff Office Not provided OMB
  Reporting**                                           A-11 IT [OMB         submitted the OMB    Circular A-11 IT
                                                        Submission]{.mark}   Circular A-11 IT     [OMB
                                                        reporting            [OMB                 Submission]{.mark}
                                                        requirements for the Submission]{.mark}   investment reporting
                                                        BY 2008 IT Portfolio reporting            for the BY 2008 IT
                                                        reporting            requirements for the Portfolio reporting
                                                                             BY 2008 IT           
                                                                             Portfolio, however,  
                                                                             OCIO                 
                                                                             questions/concern    
                                                                             about the submission 
                                                                             were not resolved    
                                                                             prior to OMB         
                                                                             submission           

  1.1b.                                                 No [BY 2007]{.mark}  Has [BY 2007]{.mark} Has [BY 2007]{.mark}
  **Investment                                          IT investments       IT investments       IT investments
  Review**                                              identified as \"at   identified as \"at   identified as \"at
                                                        risk\" (Source:      risk\", and has      risk\" and has not
                                                        OMB\'s published     submitted            submitted
                                                        Management           documentation (i.e.  documentation (i.e.
                                                        Watchlist, DOE       a revised OMB        a revised OMB
                                                        Watchlist Strategy   Exhibit 300 or       Exhibit 300 or
                                                                             Corrective Action    Corrective Action
                                                                             Plan) on progress    Plan) on progress
                                                                             but has not yet been (Source: OMB\'s
                                                                             removed from the     published Management
                                                                             Watchlist (Source:   Watchlist)
                                                                             OMB\'s published     
                                                                             Management           
                                                                             Watchlist)           

  1.1c **Privacy                                        Submitted required   Identified systems   Not conducted or
  Impact                                                Privacy Impact       required to be       submitted required
  Assessments**                                         Assessments through  included in the      Privacy Impact
                                                        the OCIO for         Privacy Impact       Assessments to the
                                                        submission to OMB    Assessments through  OCIO for submission
                                                        (Source: OMB Exhibit the OCIO for         to OMB (Source: OMB
                                                        300 Section II.B.5)  submission to OMB    Exhibit 300 Section
                                                                             but has not yet      2.B.5)
                                                                             conducted the        
                                                                             applicable Privacy   
                                                                             Impact Assessments   
                                                                             (Source: OMB Exhibit 
                                                                             300 Section 2.B.5)   

  1.1d **Integrated                                     All [EVMS]{.mark}    [All EVMS required   All required major
  Baseline Review                                       required major IT    major IT investments IT investments have
  [Validation                                           investments have     have completed an    not completed an IBR
  and]{.mark}                                           completed an IBR     IBR and submitted    [and submitted
  Reporting**                                           [and submitted       performance data     performance
                                                        performance          consistent with OCIO data]{.mark}
                                                        data]{.mark}         guidance and all     consistent with OCIO
                                                        consistent with OCIO major steady state   guidance and/or all
                                                        guidance [and all    IT investment        [major steady state
                                                        steady state major   operational analysis IT investment have
                                                        IT investments have  and performance data not submitted an
                                                        submitted an         consistent with OCIO operational analysis
                                                        operational analysis guidance but data    and performance data
                                                        and performance data was incomplete or    consistent with OCIO
                                                        consistent with OCIO inadequate per OCIO  guidance.]{.mark}
                                                        guidance.]{.mark}    review               
                                                                             analysis.]{.mark}    

  **1.1e. eCPIC     []{.mark}   []{.mark}   []{.mark}   100 % of users given 50 -- 99% of users   Less than 50% of
  Training**                                            \"edit\" access to   given "edit" access  users given \"edit\"
                                                        eCPIC have completed to eCPIC have        access to eCPIC have
                                                        training or are      completed training   not completed or
                                                        scheduled to         or are scheduled to  scheduled training
                                                        participate in       participate in eCPIC 
                                                        training             training.            

  **1.2. CPIC IT                                                                                  
  Performance- All                                                                                
  major IT projects                                                                               
  operate within                                                                                  
  90% of Exhibit                                                                                  
  300 cost,                                                                                       
  schedule and                                                                                    
  performance                                                                                     
  targets.**                                                                                      

  1.2a. **EVMS**                                        If EVMS is required, If EVMS is required, If EVMS is required,
                                                        Program's Major IT   Program's Major IT   Program has at least
                                                        Investment(s) EVMS   Investment(s) EVMS   one Major IT
                                                        have been            successfully         Investment that has
                                                        successfully         self-assessed by the had neither a
                                                        independently        Program Office       successful
                                                        reviewed, validated  and/or prime         independent nor
                                                        or certified to ANSI contractor to ANSI   self-assessment of
                                                        Standard 748 by      Standard 748 with a  the investments ANSI
                                                        OECM, OCIO or an     copy of the          STD 748 EVMS or
                                                        independent entity;  evaluation report    Program is not
                                                        with a copy of the   provided to the      reporting EVM data
                                                        evaluation report    OCIO; and with the   monthly into PARS
                                                        provided to the      OCIO concurrence of  
                                                        OCIO; and with the   the self-assessment  
                                                        OCIO concurrence of  evaluation report;   
                                                        the evaluation       and Program is       
                                                        report; and Program  reporting EVM data   
                                                        is reporting EVM     monthly into PARS.   
                                                        data monthly into    (Source: DOE         
                                                        PARS. (Source: DOE   413.3-1, OMB Memo    
                                                        413.3-1, OMB Memo    August 23, 2004,     
                                                        August 23, 2004,     DEPSEC Memo December 
                                                        DEPSEC Memo December 28, 2004, and eGOV   
                                                        28, 2004 and eGOV    PMA Scorecard)       
                                                        PMA Scorecard)                            

  1.2b. **Quarterly                                     Submitted data for   Submitted data for   Not submitted data
  Control Review**                                      all major IT         all major IT         for all major IT
                                                        investments with     investments for OCIO investments for OCIO
                                                        proper documentation Quarterly Control    Quarterly Control
                                                        for OCIO Quarterly   Reviews, but         Reviews (Source: DOE
                                                        Control Reviews      documentation is     OCIO Quarterly
                                                        (Source: DOE OCIO    insufficient to      Control Reviews)
                                                        Quarterly Control    support a full OCIO  
                                                        Reviews)             Quarterly Control    
                                                                             Reviews (Source: DOE 
                                                                             OCIO Quarterly       
                                                                             Control Reviews)     

  1.2c.                                                 [Submitted Q3        []{.mark}            [Program Office did
  **[Performance                                        Performance Data on                       not submit all Q3
  Data]{.mark}**                                        all major IT                              performance data for
                                                        Investments on the                        major IT Investments
                                                        August due date per                       on the August due
                                                        OCIO Guidance                             date per OCIO
                                                        provided separately                       Guidance provided
                                                        via the IT                                separately via the
                                                        Council.]{.mark}                          IT Council]{.mark}.

  1.2d.                                                 Using EVM if         Using EVM if         Using EVM if
  **Performance**                                       required or          required or          required or
                                                        Operational          Operational          Operational
                                                        Analysis, each major Analysis, each major Analysis, each major
                                                        investment's cost    investment's cost    investment's cost
                                                        and schedule         and schedule         and schedule
                                                        overruns, and        overruns and         overruns, and
                                                        performance          performance          performance
                                                        shortfalls, are less shortfalls, is       shortfalls, are
                                                        than 10% (Source:    greater than 10% but greater than 10%
                                                        PMA eGov Scorecard)  sufficient           (Source: PMA eGov
                                                                             corrective actions   Scorecard)
                                                                             are in place to      
                                                                             correct the variance 
                                                                             problems (Source:    
                                                                             PMA eGov Scorecard)  

  1.2e. **PM                                            All Project Managers Has between 50% and  Less than 50% of all
  Certification**                                       [qualified]{.mark}   99% of all Project   Project Managers
                                                        in Project           Managers             [qualified]{.mark}
                                                        Management (Source:  [qualified]{.mark}   in Project
                                                        DOE OCIO Quarterly   in Project           Management (Source:
                                                        Control Reviews)     Management and all   DOE OCIO Quarterly
                                                                             remaining PMs        Control Reviews)
                                                                             currently taking     
                                                                             certification        
                                                                             courses (Source: DOE 
                                                                             OCIO Quarterly       
                                                                             Control Reviews)     

  1.2f. **High Risk                                     All "high risk"      "High risk" major IT "High risk" major IT
  Reporting**                                           major IT investments investments have     investments have not
                                                        have reported status reported status, but reported status.
                                                        consistent with OCIO data was incomplete  (Source: OMB
                                                        guidance (Source:    or unsatisfactory.   Memorandum, and OCIO
                                                        OMB Memorandum, and  (Source: OMB         Guidance document)
                                                        OCIO Guidance        Memorandum, and OCIO 
                                                        document)            Guidance document)   
  --------------------------------------------------------------------------------------------------------------------

+-----------+---+------+-------+------------+-----------+-----------+
|           | * | **To | *     | **Green**  | *         | **Red**   |
|           | * | Get  | *Stay |            | *Yellow** |           |
|           | S | to   | Gr    |            |           |           |
|           | c | Gre  | een** |            |           |           |
|           | o | en** |       |            |           |           |
|           | r |      |       |            |           |           |
|           | e |      |       |            |           |           |
|           | * |      |       |            |           |           |
|           | * |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| **2.      | * |      | **To  | **To earn  | **To earn | **The     |
| Cyber     | * |      | mai   | an overall | an        | Prog      |
| S         | O |      | ntain | score of   | overall   | ram/Staff |
| ecurity** | v |      | a     | Green in   | score of  | Offices   |
|           | e |      | Green | Cyber      | Yellow in | will      |
|           | r |      | stat  | Security,  | Cyber     | receive   |
|           | a |      | us:** | the        | Security, | an        |
|           | l |      |       | Pro        | the       | overall   |
|           | l |      |       | gram/Staff | Prog      | score of  |
|           | C |      |       | Office     | ram/Staff | Red in    |
|           | y |      |       | must       | Office    | Cyber     |
|           | b |      |       | receive    | received  | Security  |
|           | e |      |       | scores of  | at least  | if they   |
|           | r |      |       | Green in   | one score | receive a |
|           | S |      |       | all        | of Yellow | Red in    |
|           | e |      |       | respective | and no    | any       |
|           | c |      |       | cat        | score of  | r         |
|           | u |      |       | egories.** | Red in    | espective |
|           | r |      |       |            | the       | ca        |
|           | i |      |       |            | r         | tegory.** |
|           | t |      |       |            | espective |           |
|           | y |      |       |            | cate      |           |
|           | S |      |       |            | gories.** |           |
|           | c |      |       |            |           |           |
|           | o |      |       |            |           |           |
|           | r |      |       |            |           |           |
|           | e |      |       |            |           |           |
|           | * |      |       |            |           |           |
|           | * |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
|           |   |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| **2.1.    |   |      |       |            |           |           |
| Cyber     |   |      |       |            |           |           |
| Security  |   |      |       |            |           |           |
| Imple     |   |      |       |            |           |           |
| mentation |   |      |       |            |           |           |
| and       |   |      |       |            |           |           |
| Perf      |   |      |       |            |           |           |
| ormance** |   |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1a.     |   |      | Have  | Installed  | []{.mark} | Has not   |
| *         |   |      | inst  | and        |           | installed |
| *Security |   |      | alled | maintained |           | and       |
| Conf      |   |      | and   | minimum    |           | m         |
| iguration |   |      | maint | security   |           | aintained |
| In        |   |      | ained | con        |           | minimum   |
| stalled** |   |      | with  | figuration |           | security  |
|           |   |      | mi    | on 100% of |           | conf      |
|           |   |      | nimum | all        |           | iguration |
|           |   |      | sec   | critical   |           | on 100%   |
|           |   |      | urity | IT         |           | of all    |
|           |   |      | conf  | infr       |           | critical  |
|           |   |      | igura | astructure |           | IT        |
|           |   |      | tions | and key IT |           | infra     |
|           |   |      | on    | Resources  |           | structure |
|           |   |      | 100%  | and 80% of |           | and key   |
|           |   |      | of    | all other  |           | IT        |
|           |   |      | all   | systems in |           | Resources |
|           |   |      | cri   | the        |           | and 80%   |
|           |   |      | tical | systems    |           | of all    |
|           |   |      | IT    | inventory  |           | other     |
|           |   |      | infr  |            |           | systems   |
|           |   |      | astru |            |           | in the    |
|           |   |      | cture |            |           | systems   |
|           |   |      | and   |            |           | inventory |
|           |   |      | key   |            |           |           |
|           |   |      | IT    |            |           |           |
|           |   |      | Reso  |            |           |           |
|           |   |      | urces |            |           |           |
|           |   |      | and   |            |           |           |
|           |   |      | at    |            |           |           |
|           |   |      | least |            |           |           |
|           |   |      | 80%   |            |           |           |
|           |   |      | of    |            |           |           |
|           |   |      | all   |            |           |           |
|           |   |      | other |            |           |           |
|           |   |      | sy    |            |           |           |
|           |   |      | stems |            |           |           |
|           |   |      | in    |            |           |           |
|           |   |      | the   |            |           |           |
|           |   |      | sy    |            |           |           |
|           |   |      | stems |            |           |           |
|           |   |      | inve  |            |           |           |
|           |   |      | ntory |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1b.     |   |      |       | Integrated | []{.mark} | Has not   |
| *         |   |      |       | minimum    |           | i         |
| *Security |   |      |       | security   |           | ntegrated |
| Conf      |   |      |       | con        |           | minimum   |
| iguration |   |      |       | figuration |           | security  |
| P         |   |      |       | standards  |           | conf      |
| lanning** |   |      |       | for all    |           | iguration |
|           |   |      |       | future IT  |           | standards |
|           |   |      |       | pr         |           | for all   |
|           |   |      |       | ocurements |           | future IT |
|           |   |      |       | into the   |           | pro       |
|           |   |      |       | PCSP       |           | curements |
|           |   |      |       |            |           | into the  |
|           |   |      |       |            |           | PCSP      |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1c.     |   |      | Have  | 100% of    |           | Has not   |
| **C&A**   |   |      | all   | all        |           | certified |
|           |   |      | o     | o          |           | and       |
|           |   |      | perat | perational |           | a         |
|           |   |      | ional | IT systems |           | ccredited |
|           |   |      | IT    | certified  |           | 100% of   |
|           |   |      | sy    | and        |           | all       |
|           |   |      | stems | accredited |           | op        |
|           |   |      | cert  | (to        |           | erational |
|           |   |      | ified | receive    |           | IT        |
|           |   |      | and   | credit for |           | systems   |
|           |   |      | accre | C&A,       |           | (to       |
|           |   |      | dited | Program    |           | receive   |
|           |   |      | (to   | Offices    |           | credit    |
|           |   |      | re    | must have  |           | for C&A,  |
|           |   |      | ceive | a copy of  |           | Program   |
|           |   |      | c     | the system |           | Offices   |
|           |   |      | redit | C&A        |           | must have |
|           |   |      | for   | letters)   |           | a copy of |
|           |   |      | C&A,  |            |           | the       |
|           |   |      | Pr    | (Source:   |           | system    |
|           |   |      | ogram | Cyber      |           | C&A       |
|           |   |      | Of    | Security   |           | letters)  |
|           |   |      | fices | Cer        |           |           |
|           |   |      | must  | tification |           | (Source:  |
|           |   |      | have  | and        |           | Cyber     |
|           |   |      | a     | Acc        |           | Security  |
|           |   |      | copy  | reditation |           | Cert      |
|           |   |      | of    | Guide,     |           | ification |
|           |   |      | the   | March 24,  |           | and       |
|           |   |      | s     | 2006)      |           | Accr      |
|           |   |      | ystem |            |           | editation |
|           |   |      | C&A   |            |           | Guide,    |
|           |   |      | le    |            |           | March 24, |
|           |   |      | tters |            |           | 2006)     |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1d      |   |      |       | A          | A plan to | Has not   |
| **Cyber   |   |      |       | continuous | establish | est       |
| Boundary  |   |      |       | process    | a         | ablished, |
| Control** |   |      |       | for        | c         | or        |
|           |   |      |       | id         | ontinuous | developed |
|           |   |      |       | entifying, | process   | a plan to |
|           |   |      |       | fixing,    | for       | e         |
|           |   |      |       | and        | ide       | stablish, |
|           |   |      |       | scanning   | ntifying, | a         |
|           |   |      |       | networks   | fixing,   | c         |
|           |   |      |       | for        | and       | ontinuous |
|           |   |      |       | vulne      | scanning  | process   |
|           |   |      |       | rabilities | networks  | for       |
|           |   |      |       | and        | for       | ide       |
|           |   |      |       | boundary   | vulner    | ntifying, |
|           |   |      |       | discovery  | abilities | fixing,   |
|           |   |      |       | for all    | and       | and       |
|           |   |      |       | systems,   | boundary  | scanning  |
|           |   |      |       | and        | discovery | networks  |
|           |   |      |       | systems    | for all   | for       |
|           |   |      |       | interc     | systems,  | vulner    |
|           |   |      |       | onnections | and have  | abilities |
|           |   |      |       | identified | i         | and       |
|           |   |      |       | for 100%   | dentified | boundary  |
|           |   |      |       | of all     | system    | discovery |
|           |   |      |       | systems    | interco   | for all   |
|           |   |      |       |            | nnections | systems.  |
|           |   |      |       |            | for at    | Also,     |
|           |   |      |       |            | least 80% | have not  |
|           |   |      |       |            | of        | i         |
|           |   |      |       |            | systems   | dentified |
|           |   |      |       |            |           | system    |
|           |   |      |       |            |           | interco   |
|           |   |      |       |            |           | nnections |
|           |   |      |       |            |           | for at    |
|           |   |      |       |            |           | least 80% |
|           |   |      |       |            |           | of all    |
|           |   |      |       |            |           | systems   |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1e.     |   |      |       | Corrected  | A plan to | Has not   |
| **Cyber   |   |      |       | and        | correct   | c         |
| Security  |   |      |       | validated  | and       | orrected, |
| Audit     |   |      |       | all GAO,   | validate  | or have a |
| F         |   |      |       | IG or OA   | all GAO,  | plan to   |
| indings** |   |      |       | Audit      | IG or OA  | correct,  |
|           |   |      |       | findings   | Audit     | and       |
|           |   |      |       | within 12  | findings  | validate  |
|           |   |      |       | months of  | within 12 | all GAO,  |
|           |   |      |       | iden       | months of | IG or OA  |
|           |   |      |       | tification | ident     | Audit     |
|           |   |      |       |            | ification | findings  |
|           |   |      |       |            |           | within 12 |
|           |   |      |       |            |           | months of |
|           |   |      |       |            |           | ident     |
|           |   |      |       |            |           | ification |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1f.     |   |      |       | Documented | No Yellow | Has not   |
| **Cont    |   |      |       | c          | criteria. | d         |
| ingency** |   |      |       | ontingency |           | ocumented |
| **P       |   |      |       | plans for  |           | co        |
| lanning** |   |      |       | 100% of    |           | ntingency |
|           |   |      |       | the        |           | plans for |
|           |   |      |       | systems    |           | 100% of   |
|           |   |      |       | identified |           | the       |
|           |   |      |       | as         |           | systems   |
|           |   |      |       | critical   |           | i         |
|           |   |      |       | IT         |           | dentified |
|           |   |      |       | infr       |           | as        |
|           |   |      |       | astructure |           | critical  |
|           |   |      |       | and Key IT |           | IT        |
|           |   |      |       | resources  |           | infra     |
|           |   |      |       | and        |           | structure |
|           |   |      |       | documented |           | and Key   |
|           |   |      |       | c          |           | IT        |
|           |   |      |       | ontingency |           | Resources |
|           |   |      |       | plans for  |           | or have   |
|           |   |      |       | 80% of all |           | only      |
|           |   |      |       | other      |           | d         |
|           |   |      |       | systems in |           | ocumented |
|           |   |      |       | the system |           | co        |
|           |   |      |       | inventory  |           | ntingency |
|           |   |      |       |            |           | plans for |
|           |   |      |       | (Original  |           | less than |
|           |   |      |       | deadline   |           | 51% of    |
|           |   |      |       | was June   |           | all other |
|           |   |      |       | 30, 2005;  |           | systems   |
|           |   |      |       | Source:    |           | in the    |
|           |   |      |       | Cyber      |           | system    |
|           |   |      |       | Security   |           | inventory |
|           |   |      |       | I          |           |           |
|           |   |      |       | mprovement |           | (Original |
|           |   |      |       | Across DOE |           | deadline  |
|           |   |      |       | Enterprise |           | was June  |
|           |   |      |       | memo,      |           | 30, 2005; |
|           |   |      |       | March 10,  |           | Source:   |
|           |   |      |       | 2005)      |           | Cyber     |
|           |   |      |       |            |           | Security  |
|           |   |      |       |            |           | Im        |
|           |   |      |       |            |           | provement |
|           |   |      |       |            |           | Across    |
|           |   |      |       |            |           | DOE       |
|           |   |      |       |            |           | E         |
|           |   |      |       |            |           | nterprise |
|           |   |      |       |            |           | memo,     |
|           |   |      |       |            |           | March 10, |
|           |   |      |       |            |           | 2005)     |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.1g.     |   |      |       | Tested     | Tested    | Has not   |
| **Co      |   |      |       | 100% of    | 100% of   | tested    |
| ntingency |   |      |       | c          | co        | 100% of   |
| Testing** |   |      |       | ontingency | ntingency | co        |
|           |   |      |       | plans for  | plans for | ntingency |
|           |   |      |       | systems    | systems   | plans for |
|           |   |      |       | identified | i         | systems   |
|           |   |      |       | as         | dentified | i         |
|           |   |      |       | critical   | as        | dentified |
|           |   |      |       | IT         | critical  | as        |
|           |   |      |       | infr       | IT        | critical  |
|           |   |      |       | astructure | infra     | IT        |
|           |   |      |       | and key IT | structure | infra     |
|           |   |      |       | resources  | and key   | structure |
|           |   |      |       | and tested | IT        | and Key   |
|           |   |      |       | 80% of     | resources | IT        |
|           |   |      |       | c          | and       | Resources |
|           |   |      |       | ontingency | tested at | or have   |
|           |   |      |       | plans of   | least     | only      |
|           |   |      |       | all other  | 51%-79%   | tested    |
|           |   |      |       | systems in | of        | less than |
|           |   |      |       | the system | co        | 51% of    |
|           |   |      |       | inventory  | ntingency | co        |
|           |   |      |       |            | plans of  | ntingency |
|           |   |      |       |            | all other | plans of  |
|           |   |      |       |            | systems   | all other |
|           |   |      |       |            | in the    | systems   |
|           |   |      |       |            | systems   | in the    |
|           |   |      |       |            | inventory | system    |
|           |   |      |       |            |           | inventory |
+-----------+---+------+-------+------------+-----------+-----------+
|           |   |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.2a.     |   |      |       | Collect,   | Have      | Has not   |
| **Re      |   |      |       | maintain,  | provided  | collected |
| mediation |   |      |       | and submit | a POAM.   | or        |
| Status    |   |      |       | quarterly  | However,  | submitted |
| Reports** |   |      |       | r          | a score   | quarterly |
|           |   |      |       | emediation | of Yellow | re        |
|           |   |      |       | status     | is given  | mediation |
|           |   |      |       | reports    | for POAMs | status    |
|           |   |      |       | (POAMs for | that did  | reports   |
|           |   |      |       | all known  | not       | (POAMs)   |
|           |   |      |       | cyber      | identify  | for all   |
|           |   |      |       | security   | all known | known     |
|           |   |      |       | weaknesses | cyber     | cyber     |
|           |   |      |       | including  | security  | security  |
|           |   |      |       | those from | w         | w         |
|           |   |      |       | GAO, IG,   | eaknesses | eaknesses |
|           |   |      |       | or OA      | including | including |
|           |   |      |       | Audits     | those     | those     |
|           |   |      |       |            | from GAO, | from GAO, |
|           |   |      |       |            | IG, or OA | IG, or OA |
|           |   |      |       |            | Audits    | Audits    |
|           |   |      |       |            | and was   |           |
|           |   |      |       |            | not       |           |
|           |   |      |       |            | submitted |           |
|           |   |      |       |            | to OCIO   |           |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.2b.     |   |      |       | Co         | Con       | Has not   |
| **Cyber   |   |      |       | nsistently | sistently | con       |
| Security  |   |      |       | report     | report at | sistently |
| Incident  |   |      |       | 100% of    | least 80% | reported  |
| Re        |   |      |       | cyber      | to 99% of | at least  |
| porting** |   |      |       | security   | cyber     | 80% to    |
|           |   |      |       | incidents  | security  | 99% of    |
|           |   |      |       | to CIAC    | incidents | cyber     |
|           |   |      |       | (and IG    | to CIAC   | security  |
|           |   |      |       |            | (and IG   | incidents |
|           |   |      |       | and CN as  | and CN as | to CIAC   |
|           |   |      |       | ap         | app       | (and IG   |
|           |   |      |       | propriate) | ropriate) | and CN as |
|           |   |      |       | or file a  | or file a | app       |
|           |   |      |       | negative   | negative  | ropriate) |
|           |   |      |       | monthly    | monthly   | or file a |
|           |   |      |       | report     | report    | negative  |
|           |   |      |       |            |           | monthly   |
|           |   |      |       |            |           | report    |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.2c.     |   |      |       | Have       | Have      | Has not   |
| **Cyber   |   |      |       | identified | i         | i         |
| Security  |   |      |       | and        | dentified | dentified |
| Vuln      |   |      |       | r          | and       | and       |
| erability |   |      |       | emediated, | re        | re        |
| Re        |   |      |       | on a       | mediated, | mediated, |
| duction** |   |      |       | continuous | on a      | on a      |
|           |   |      |       | basis, all | c         | c         |
|           |   |      |       | vulne      | ontinuous | ontinuous |
|           |   |      |       | rabilities | basis,    | basis,    |
|           |   |      |       | on the     | all       | all       |
|           |   |      |       | SANS/FBI   | vulner    | vulner    |
|           |   |      |       | Top 20     | abilities | abilities |
|           |   |      |       | List       | on the    | on the    |
|           |   |      |       |            | MITRE     | SANS/FBI  |
|           |   |      |       |            | Common    | Top 20    |
|           |   |      |       |            | Vulner    | and/or    |
|           |   |      |       |            | abilities | MITRE     |
|           |   |      |       |            | Exposure  | Common    |
|           |   |      |       |            | (CVE)     | Vulner    |
|           |   |      |       |            |           | abilities |
|           |   |      |       |            |           | Exposure  |
|           |   |      |       |            |           | (CVE)     |
+-----------+---+------+-------+------------+-----------+-----------+
| 2.2d.     |   |      |       | Reported   | Reported  | Has not   |
| **Cyber   |   |      |       | the        | the       | reported  |
| Security  |   |      |       | testing    | testing   | the       |
| Co        |   |      |       | results    | results   | testing   |
| ntingency |   |      |       | for 100%   | for 100%  | results   |
| Plan      |   |      |       | of         | of        | for 100%  |
| Results** |   |      |       | c          | co        | of        |
|           |   |      |       | ontingency | ntingency | co        |
|           |   |      |       | plans for  | plans for | ntingency |
|           |   |      |       | systems    | systems   | plans for |
|           |   |      |       | identified | i         | systems   |
|           |   |      |       | as         | dentified | i         |
|           |   |      |       | critical   | as        | dentified |
|           |   |      |       | IT         | critical  | as        |
|           |   |      |       | infr       | IT        | critical  |
|           |   |      |       | astructure | infra     | IT        |
|           |   |      |       | and key IT | structure | infra     |
|           |   |      |       | resources  | and key   | structure |
|           |   |      |       | and        | IT        | and Key   |
|           |   |      |       | reported   | resources | IT        |
|           |   |      |       | the        | and       | Resources |
|           |   |      |       | testing    | reported  | or has    |
|           |   |      |       | results    | the       | reported  |
|           |   |      |       | for 80% of | testing   | testing   |
|           |   |      |       | c          | results   | results   |
|           |   |      |       | ontingency | for at    | for less  |
|           |   |      |       | plans for  | least     | than 51%  |
|           |   |      |       | all other  | 51%-79%   | of        |
|           |   |      |       | systems in | of        | co        |
|           |   |      |       | the system | co        | ntingency |
|           |   |      |       | inventory  | ntingency | plans for |
|           |   |      |       |            | plans for | all other |
|           |   |      |       |            | all other | systems   |
|           |   |      |       |            | systems   | in the    |
|           |   |      |       |            | in the    | system    |
|           |   |      |       |            | system    | inventory |
|           |   |      |       |            | inventory |           |
+-----------+---+------+-------+------------+-----------+-----------+
| []{.mark} |   |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
|           | * | **To | *     | **Green**  | *         | **Red**   |
|           | * | Get  | *Stay |            | *Yellow** |           |
|           | S | to   | Gr    |            |           |           |
|           | c | Gre  | een** |            |           |           |
|           | o | en** |       |            |           |           |
|           | r |      |       |            |           |           |
|           | e |      |       |            |           |           |
|           | * |      |       |            |           |           |
|           | * |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| **3.      | * |      | **To  | **To earn  | **To earn | **The     |
| E         | * |      | mai   | an overall | an        | Prog      |
| nterprise | O |      | ntain | score of   | overall   | ram/Staff |
| Arc       | v |      | a     | Green in   | score of  | Offices   |
| hitecture | e |      | Green | EA, the    | Yellow in | will      |
| (EA)**    | r |      | stat  | Pro        | EA, the   | receive   |
|           | a |      | us:** | gram/Staff | Prog      | an        |
|           | l |      |       | Office     | ram/Staff | overall   |
|           | l |      |       | must       | Office    | score of  |
|           | E |      |       | receive    | received  | Red in EA |
|           | A |      |       | scores of  | at least  | if they   |
|           | S |      |       | Green in   | one score | receive a |
|           | c |      |       | all        | of Yellow | Red in    |
|           | o |      |       | respective | and no    | any       |
|           | r |      |       | cat        | score of  | r         |
|           | e |      |       | egories.** | Red in    | espective |
|           | * |      |       |            | the       | ca        |
|           | * |      |       |            | r         | tegory.** |
|           |   |      |       |            | espective |           |
|           |   |      |       |            | cate      |           |
|           |   |      |       |            | gories.** |           |
+-----------+---+------+-------+------------+-----------+-----------+
|           |   |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| **3.1.    |   |      |       |            |           |           |
| Prog      |   |      |       |            |           |           |
| ram/Staff |   |      |       |            |           |           |
| Offices   |   |      |       |            |           |           |
| have      |   |      |       |            |           |           |
| par       |   |      |       |            |           |           |
| ticipated |   |      |       |            |           |           |
| and       |   |      |       |            |           |           |
| supported |   |      |       |            |           |           |
| the EA    |   |      |       |            |           |           |
| Program   |   |      |       |            |           |           |
| m         |   |      |       |            |           |           |
| ilestones |   |      |       |            |           |           |
| and       |   |      |       |            |           |           |
| respons   |   |      |       |            |           |           |
| ibilities |   |      |       |            |           |           |
| provided  |   |      |       |            |           |           |
| to the    |   |      |       |            |           |           |
| EAWG the  |   |      |       |            |           |           |
| first     |   |      |       |            |           |           |
| month of  |   |      |       |            |           |           |
| the       |   |      |       |            |           |           |
| q         |   |      |       |            |           |           |
| uarter.** |   |      |       |            |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| [3.1.1    | [ |      |       | [Pro       | [Prog     | [Prog     |
| **Pe      | ] |      |       | gram/Staff | ram/Staff | ram/Staff |
| rformance | { |      |       | Offices    | Offices   | Offices   |
| Arch      | . |      |       | have       | have      | have not  |
| itecture* | m |      |       | e          | updated   | updated   |
| *]{.mark} | a |      |       | stablished | EA plans  | EA plans  |
|           | r |      |       | p          | to        | to        |
|           | k |      |       | erformance | develop   | develop   |
|           | } |      |       | measures   | metrics   | metrics   |
|           |   |      |       | for major  | to        | to        |
|           |   |      |       | i          | measure   | measure   |
|           |   |      |       | nitiatives | and       | and       |
|           |   |      |       | linked to  | report EA | report EA |
|           |   |      |       | the DOE EA | return on | return on |
|           |   |      |       | Transition | in        | i         |
|           |   |      |       | Sequencing | vestment, | nvestment |
|           |   |      |       | Plan, and  | and are   | , and     |
|           |   |      |       | have       | working   | have not  |
|           |   |      |       | updated EA | with the  | initiated |
|           |   |      |       | plans to   | OCIO to   | the       |
|           |   |      |       | develop    | link      | de        |
|           |   |      |       | metrics to | pe        | velopment |
|           |   |      |       | measure    | rformance | of        |
|           |   |      |       | and report | measures  | pe        |
|           |   |      |       | EA return  | for major | rformance |
|           |   |      |       | on         | in        | measures  |
|           |   |      |       | investme   | itiatives | for major |
|           |   |      |       | nt]{.mark} | with the  | in        |
|           |   |      |       |            | DOE EA    | itiatives |
|           |   |      |       |            | T         | linked to |
|           |   |      |       |            | ransition | the DOE   |
|           |   |      |       |            | S         | EA        |
|           |   |      |       |            | equencing | T         |
|           |   |      |       |            | Pla       | ransition |
|           |   |      |       |            | n]{.mark} | S         |
|           |   |      |       |            |           | equencing |
|           |   |      |       |            |           | Pla       |
|           |   |      |       |            |           | n]{.mark} |
+-----------+---+------+-------+------------+-----------+-----------+
| [3.1.2    |   |      |       | [The       | [Although | [Prog     |
| **        |   |      |       | technology | work has  | ram/Staff |
| Improving |   |      |       | ar         | not been  | Offices'  |
| IT        |   |      |       | chitecture | completed | t         |
| Implem    |   |      |       | i          | to ensure | echnology |
| entation: |   |      |       | nitiatives | the       | arc       |
| T         |   |      |       | and        | Prog      | hitecture |
| echnology |   |      |       | standards  | ram/Staff | in        |
| Arch      |   |      |       | planned    | Offices'  | itiatives |
| itecture* |   |      |       | and in use | t         | and       |
| *]{.mark} |   |      |       | by the     | echnology | standards |
|           |   |      |       | Pro        | arc       | are not   |
|           |   |      |       | gram/Staff | hitecture | in        |
|           |   |      |       | Offices    | in        | alignment |
|           |   |      |       | are in     | itiatives | with the  |
|           |   |      |       | alignment  | and       | EITA TRM  |
|           |   |      |       | with the   | standards | and       |
|           |   |      |       | EITA TRM   | planned   | standards |
|           |   |      |       | and        | and in    | and the   |
|           |   |      |       | standards, | use are   | process   |
|           |   |      |       | and have   | in        | for EITA  |
|           |   |      |       | been       | alignment | coo       |
|           |   |      |       | par        | with the  | rdination |
|           |   |      |       | ticipating | EITA TRM  | have not  |
|           |   |      |       | as         | and       | been      |
|           |   |      |       | required   | standards | initiate  |
|           |   |      |       | in OCIO    | the       | d]{.mark} |
|           |   |      |       | EITA       | Prog      |           |
|           |   |      |       | co         | ram/Staff |           |
|           |   |      |       | ordination | Offices   |           |
|           |   |      |       | meetings   | have been |           |
|           |   |      |       | to ensure  | part      |           |
|           |   |      |       | the EITA   | icipating |           |
|           |   |      |       | TRM and    | in the    |           |
|           |   |      |       | standards  | OCIO EITA |           |
|           |   |      |       | have been  | coo       |           |
|           |   |      |       | updated    | rdination |           |
|           |   |      |       | a          | meetings  |           |
|           |   |      |       | ccordingly | to ensure |           |
|           |   |      |       | for        | the EITA  |           |
|           |   |      |       | supporting | TRM and   |           |
|           |   |      |       | the        | standards |           |
|           |   |      |       | governance | are being |           |
|           |   |      |       | proce      | updated   |           |
|           |   |      |       | ss]{.mark} | ac        |           |
|           |   |      |       |            | cordingly |           |
|           |   |      |       |            | to        |           |
|           |   |      |       |            | support   |           |
|           |   |      |       |            | the       |           |
|           |   |      |       |            | g         |           |
|           |   |      |       |            | overnance |           |
|           |   |      |       |            | proces    |           |
|           |   |      |       |            | s]{.mark} |           |
+-----------+---+------+-------+------------+-----------+-----------+
| [3.1.3.   |   |      |       | [Pro       | [Prog     | [Prog     |
| **Go      |   |      |       | gram/Staff | ram/Staff | ram/Staff |
| vernance* |   |      |       | Offices    | Offices   | Offices   |
| *]{.mark} |   |      |       | have       | have      | have not  |
|           |   |      |       | approved   | approved  | approved  |
|           |   |      |       | the EA     | the EA    | the EA    |
|           |   |      |       | Policy to  | Policy to | Policy    |
|           |   |      |       | include EA | include   | for EA    |
|           |   |      |       | d          | EA        | de        |
|           |   |      |       | evelopment | de        | velopment |
|           |   |      |       | and        | velopment | and       |
|           |   |      |       | ma         | and       | ma        |
|           |   |      |       | intenance, | ma        | intenance |
|           |   |      |       | have       | intenance | to ensure |
|           |   |      |       | provided   | and are   | alignment |
|           |   |      |       | guidance   | in the    | with DOE  |
|           |   |      |       | for the    | process   | standards |
|           |   |      |       | Field and  | of        | and       |
|           |   |      |       | Program    | providing | policie   |
|           |   |      |       | elements   | guidance  | s]{.mark} |
|           |   |      |       | in support | for the   |           |
|           |   |      |       | of the     | Field and |           |
|           |   |      |       | approved   | Program   |           |
|           |   |      |       | EA Policy, | elements  |           |
|           |   |      |       | and        | to ensure |           |
|           |   |      |       | de         | alignment |           |
|           |   |      |       | monstrated | with DOE  |           |
|           |   |      |       | evidence   | standards |           |
|           |   |      |       | of reviews | and       |           |
|           |   |      |       | to ensure  | policie   |           |
|           |   |      |       | alignment  | s]{.mark} |           |
|           |   |      |       | with DOE   |           |           |
|           |   |      |       | standards  |           |           |
|           |   |      |       | and        |           |           |
|           |   |      |       | polici     |           |           |
|           |   |      |       | es]{.mark} |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| [3.1.4.   | [ |      |       | [Pro       | [Prog     | [Prog     |
| **F       | ] |      |       | gram/Staff | ram/Staff | ram/Staff |
| ederation | { |      |       | Offices    | Offices   | Offices   |
| of        | . |      |       | continued  | are in    | have not  |
| E         | m |      |       | populating | the       | populated |
| nterprise | a |      |       | the DEAR   | process   | the DEAR  |
| and       | r |      |       | EA         | of        | EA        |
| Cros      | k |      |       | Repository | p         | R         |
| s-Cutting | } |      |       | with new   | opulating | epository |
| Services* |   |      |       | initiative | the DEAR  | with new  |
| *]{.mark} |   |      |       | ar         | EA        | i         |
|           |   |      |       | chitecture | R         | nitiative |
|           |   |      |       | artifacts, | epository | arc       |
|           |   |      |       | and        | with new  | hitecture |
|           |   |      |       | capture EA | i         | a         |
|           |   |      |       | i          | nitiative | rtifacts, |
|           |   |      |       | nformation | arc       | or        |
|           |   |      |       | in         | hitecture | captured  |
|           |   |      |       | alignment  | a         | EA        |
|           |   |      |       | with the   | rtifacts, | in        |
|           |   |      |       | DOE EA     | and       | formation |
|           |   |      |       | Framework  | capturing | in        |
|           |   |      |       | to allow   | EA        | alignment |
|           |   |      |       | for        | in        | with the  |
|           |   |      |       | Depar      | formation | DOE EA    |
|           |   |      |       | tment-wide | in        | Framework |
|           |   |      |       | i          | alignment | in a      |
|           |   |      |       | nformation | with the  | manner to |
|           |   |      |       | sharing    | DOE EA    | allow for |
|           |   |      |       | across the | Framework | Depart    |
|           |   |      |       | enterpri   | with      | ment-wide |
|           |   |      |       | se]{.mark} | specific  | in        |
|           |   |      |       |            | EA Plans  | formation |
|           |   |      |       |            | to        | sharing   |
|           |   |      |       |            | de        | across    |
|           |   |      |       |            | monstrate | the       |
|           |   |      |       |            | alignment | enterpris |
|           |   |      |       |            | for       | e]{.mark} |
|           |   |      |       |            | enterp    |           |
|           |   |      |       |            | rise-wide |           |
|           |   |      |       |            | in        |           |
|           |   |      |       |            | formation |           |
|           |   |      |       |            | sharin    |           |
|           |   |      |       |            | g]{.mark} |           |
+-----------+---+------+-------+------------+-----------+-----------+
| [3.1.5.   |   |      |       | [Pro       | [Prog     | [Prog     |
| **EA      |   |      |       | gram/Staff | ram/Staff | ram/Staff |
| De        |   |      |       | Offices    | Offices   | Offices   |
| ployment* |   |      |       | have       | have      | have not  |
| *]{.mark} |   |      |       | provided   | provided  | provided  |
|           |   |      |       | all        | all       | all       |
|           |   |      |       | necessary  | necessary | necessary |
|           |   |      |       | EA         | EA        | EA        |
|           |   |      |       | doc        | materials | materials |
|           |   |      |       | umentation | to        | to        |
|           |   |      |       | and        | support   | support   |
|           |   |      |       | ar         | c         | c         |
|           |   |      |       | chitecture | ompletion | ompletion |
|           |   |      |       | artifacts  | of the    | of the    |
|           |   |      |       | to support | DEAR      | DEAR      |
|           |   |      |       | completion | R         | R         |
|           |   |      |       | of the     | epository | epository |
|           |   |      |       | DEAR       | C&A,      | C&A       |
|           |   |      |       | Repository | however,  | .]{.mark} |
|           |   |      |       | C&A and    | OCIO      |           |
|           |   |      |       | de         | questions |           |
|           |   |      |       | monstrated | /concerns |           |
|           |   |      |       | adherence  | were not  |           |
|           |   |      |       | to any     | resolved  |           |
|           |   |      |       | risk       | prior to  |           |
|           |   |      |       | mitigation | review    |           |
|           |   |      |       | strategies | completio |           |
|           |   |      |       | that have  | n]{.mark} |           |
|           |   |      |       | been       |           |           |
|           |   |      |       | identified |           |           |
|           |   |      |       | through    |           |           |
|           |   |      |       | the C&A    |           |           |
|           |   |      |       | process to |           |           |
|           |   |      |       | ensure     |           |           |
|           |   |      |       | Authority  |           |           |
|           |   |      |       | To Operate |           |           |
|           |   |      |       | (AT        |           |           |
|           |   |      |       | O)]{.mark} |           |           |
+-----------+---+------+-------+------------+-----------+-----------+
| [3.1.6.   |   |      |       | [Pro       | [Prog     | [Prog     |
| **CPIC/EA |   |      |       | gram/Staff | ram/Staff | ram/Staff |
| Int       |   |      |       | Offices    | Offices   | Offices   |
| egration* |   |      |       | met the    | submitted | have not  |
| *]{.mark} |   |      |       | OMB        | the OMB   | submitted |
|           |   |      |       | Circular   | Circular  | the OMB   |
|           |   |      |       | A-11 IT    | A-11 IT   | Circular  |
|           |   |      |       | OMB        | OMB       | A-11 IT   |
|           |   |      |       | Submission | S         | OMB       |
|           |   |      |       | reporting  | ubmission | S         |
|           |   |      |       | re         | reporting | ubmission |
|           |   |      |       | quirements | req       | reporting |
|           |   |      |       | for        | uirements | req       |
|           |   |      |       | CPIC/EA    | for       | uirements |
|           |   |      |       | i          | CPIC/EA   | for the   |
|           |   |      |       | ntegration | in        | EA        |
|           |   |      |       | by         | tegration | section   |
|           |   |      |       | providing  | for the   | of the BY |
|           |   |      |       | evidence   | EA        | 2008 IT   |
|           |   |      |       | of EA data | section   | Portfolio |
|           |   |      |       | in the EA  | and long  | reporting |
|           |   |      |       | section    | de        | demo      |
|           |   |      |       | and long   | scription | nstrating |
|           |   |      |       | d          | in        | evidence  |
|           |   |      |       | escription | formation | of EA use |
|           |   |      |       | i          | of the BY | and       |
|           |   |      |       | nformation | 2008 IT   | alignmen  |
|           |   |      |       | of the BY  | Portfolio | t]{.mark} |
|           |   |      |       | 2008 IT    | r         |           |
|           |   |      |       | Portfolio  | eporting, |           |
|           |   |      |       | reporting  | however,  |           |
|           |   |      |       | and        | OCIO      |           |
|           |   |      |       | de         | questions |           |
|           |   |      |       | monstrated | /concerns |           |
|           |   |      |       | the use of | were not  |           |
|           |   |      |       | EA for     | resolved  |           |
|           |   |      |       | portfolio  | for       |           |
|           |   |      |       | f          | demo      |           |
|           |   |      |       | ormulation | nstrating |           |
|           |   |      |       | and        | the use   |           |
|           |   |      |       | approv     | of EA for |           |
|           |   |      |       | al]{.mark} | portfolio |           |
|           |   |      |       |            | fo        |           |
|           |   |      |       |            | rmulation |           |
|           |   |      |       |            | and       |           |
|           |   |      |       |            | approval  |           |
|           |   |      |       |            | prior to  |           |
|           |   |      |       |            | OMB       |           |
|           |   |      |       |            | submissio |           |
|           |   |      |       |            | n]{.mark} |           |
+-----------+---+------+-------+------------+-----------+-----------+

  ---------------- ------------ --------- ----------- ----------------- ---------------- ------------------
                   **Score**    **To Get  **Stay      **Green**         **Yellow**       **Red**
                                to        Green**                                        
                                Green**                                                  

  **4. eGov        **Overall              **To        **To earn an      **To earn an     **The
  Implementation   eGov                   maintain a  overall score of  overall score of Program/Staff
  and Alignment    Milestones             Green       Green in eGov     Yellow in eGov   Offices will
  Milestones**     Score**                status:**   Implementation    Implementation   receive an overall
                                                      and Alignment     and Alignment    score of Red in
                                                      Milestones, the   Milestones, the  eGov
                                                      Program/Staff     Program/Staff    Implementation and
                                                      Office must       Office received  Alignment
                                                      receive scores of at least one     Milestones if they
                                                      Green in all      score of Yellow  receive a Red in
                                                      respective        and no score of  any respective
                                                      categories.**     Red in the       category.**
                                                                        respective       
                                                                        categories.**    

                                                                                         

  **4.1.                                                                                 
  Program/Staff                                                                          
  Offices have                                                                           
  achieved                                                                               
  satisfactory                                                                           
  progress in                                                                            
  implementing the                                                                       
  E-Gov, Line of                                                                         
  Business and                                                                           
  SmartBUY                                                                               
  initiatives                                                                            
  and/or aligning                                                                        
  the office's IT                                                                        
  investments to                                                                         
  those                                                                                  
  initiatives.**                                                                         

  4.1a.                                               Program/Staff     Program/Staff    Program/Staff
  **Milestone                                         Office has        Office has not   Office has not
  Achievement**                                       completed all FY  completed one or completed any FY
                                                      2006 [4th]{.mark} more FY 2006     2006 [4th]{.mark}
                                                      Quarter           [4th]{.mark}     Quarter
                                                      implementation    Quarter          implementation and
                                                      and alignment     implementation   alignment
                                                      milestones or has and alignment    milestones and has
                                                      submitted and     milestones and   not received or
                                                      received written  has not received submitted written
                                                      approval to       written approval approval to
                                                      postpone          to postpone      postpone
                                                      milestones        milestones       milestones

  **4.1b[.                                            [Submitted all                     [Program Office
  Enterprise                                          required                           did not submit all
  Licensing                                           Enterprise                         required
  Data]{.mark}**                                      License Data on                    Enterprise License
                                                      the August due                     data on the August
                                                      date per OCIO                      due date per OCIO
                                                      Guidance provided                  Guidance provided
                                                      separately via                     separately via the
                                                      the IT                             IT
                                                      Council]{.mark}                    Council]{.mark}.
  ---------------- ------------ --------- ----------- ----------------- ---------------- ------------------