NRC COMMON BASELINE 

SELF-ASSESSMENT AND PLAN

NOVEMBER 10, 2015
1 

Introduction 

Background 

The Federal Information Technology Acquisition Reform Act (FITARA) was enacted on December 19, 

2014. To assist agencies with the implementation of FITARA, the Office of Management and Budget 

(OMB) issued Memorandum M-15-14, “Management and Oversight of Federal Information Technology,” 

on June 10, 2015. Attached to the memorandum was the “Common Baseline for IT Management” 

(commonly referred to as the Common Baseline), which provides guidance on the roles and 

responsibilities of the agency Chief Information Officer (CIO) and other senior agency officials for the 

management of information technology (IT). The memorandum directs each covered agency to 

conduct a self-assessment that identifies current conformity with the Common Baseline and identify 

and develop a plan for any areas in need of improvement to ensure that all Common Baseline 

responsibilities are implemented by December 31, 2015. 

Purpose 

This document explains the implementation of the Common Baseline by the U.S. Nuclear Regulatory 

Commission (NRC). It explains the roles and responsibilities of the CIO and other senior agency 

officials in the management of IT and demonstrates how the NRC’s CIO retains overall accountability. 

Key to the NRC’s Common Baseline Implementation Plan is understanding its organizational structure, 

its IT and acquisition governance structures, and the relationship and crossover of responsibilities 

between them. Since the governance structure and processes explained in the NRC’s Common 

Baseline Implementation Plan establish IT management controls and responsibilities required by 

FITARA and demonstrate that the CIO retains accountability, this document provides a brief overview 

of these structures in lieu of the optional “CIO Assignment Plan”. The overview and plan are followed 

by the NRC’s Common Baseline Self-Assessment and Plan, which refers to the structures described in 

the overview and processes provided in the plan. 

Overview of the NRC’s Organizational and Relevant Governance Structures 

The NRC is a small independent agency and its organizational structure is headed by a five-member 

Commission. The President designates one member to serve as the Chairman and official 

spokesperson of the Commission. The Commission as a whole formulates policies and regulations 

governing nuclear reactor and materials safety, issues orders to licensees, and adjudicates legal 

matters brought before it. The Commission also establishes the strategic direction and goals of the 

agency and on an annual basis works with the Chief Financial Officer (CFO) and Executive Director for 

Operations (EDO) to establish budget direction that the CFO and EDO will issue as fiscal and 

programmatic budget guidance to the offices. 

The EDO is responsible for executing the policies and decisions of the Commission and directing the 

activities of the program offices. Among other roles, the EDO serves as the NRC’s Chief Operating 

Officer (COO). The EDO is assisted by two deputies in directing the program offices. 

The Deputy Executive Director for Reactor and Preparedness Programs (DEDR) oversees the 

direction of the following offices: 

• Office of New Reactors 

• Office of Nuclear Reactor Regulation 

• Office of Nuclear Security and Incident Response 

• Regional Office I 

• Regional Office II 

• Regional Office III 

• Regional Office IV 
2 

The Deputy Executive Director for Materials, Waste, Research, State, Tribal, Compliance, 

Administration, and Human Capital (DEDM) oversees the direction of the following offices: 

• Office of Administration 

• Office of the Chief Human Capital Officer 

• Office of Enforcement 

• Office of Investigations 

• Office of Nuclear Material Safety and Safeguards 

• Office of Nuclear Regulatory Research 

The NRC’s CIO is also a direct report to the EDO. The EDO ensures that statutory responsibilities 

regarding IT investments and their oversight are appropriately assigned to the CIO. The EDO also 

assigns the CIO, DEDR, and DEDM to be the Designated Approving Authority (DAA) for IT systems to 

assume formal responsibility for approving the operation of an IT system at an acceptable level of risk 

based on an agreed-upon set of implemented security controls, in accordance with Federal Information 

Security Modernization Act of 2014 (FISMA) and guidelines set forth by the National Institute of 

Standards and Technology (NIST). The DAAs formally assume the responsibility for operating a major 

system or network at an acceptable level of risk; evaluate the mission, business case, and budgetary 

needs for an NRC system in view of the security risks; and permit or deny operations or use based on 

unacceptable security risk. 

The NRC’s IT/IM Governance 

The NRC Capital Planning and Investment Control (CPIC) process is critical to the management and 

oversight of the agency’s IT resources. It is key to the NRC’s IT investment management because it 

provides a mechanism for providing quality data and recommendations to executive decisionmakers on 

IT investments for inclusion into the IT portfolio. The NRC’s IT investment management, comprised of 

the NRC’s CPIC and IT budget processes, is part of the NRC’s integrated information technology and 

information management (IT/IM) governance framework. The CPIC process ensures that IT 

investments integrate and adhere to the framework’s other disciplines: 

• strategic planning and enterprise architecture (SP/EA) 

• project management methodology (PMM) 

• information and records management (IRM) quality principles 

The NRC CPIC process also ensures that IT investments are reviewed for compliance with 

cybersecurity internal standards set forth by the NRC’s Information Security Directorate (ISD) in the 

Office of the Chief Information Officer (OCIO) and external standards mandated by NIST and the U.S. 

Department of Homeland Security (DHS) throughout their lifecycle and supports the CIO’s involvement 

in relevant governance boards. 

The CIO serves as one of the Co-chairs on the IT/IM Portfolio Executive Council (IPEC), along with the 

CFO. The IPEC is an executive management body established to determine the NRC’s strategic 

direction for IT/IM and to manage the agency’s IT portfolio by setting current fiscal year priorities and 

determining the funding of IT investments that effectively integrate into the IT portfolio, as required by 

the Clinger-Cohen Act, OMB Circular A-130, FISMA, and other Government requirements. This 

executive level IT governance body has established roles, responsibilities, and processes consistent 

with those required by FITARA. The key to the IPEC’s success is its membership. In addition to the 

IPEC Co-chairs, members include the Chief Acquisition Officer (CAO); Chief Human Capital Officer 

(CHCO); Chief Information Security Officer (CISO); Deputy CIO; directors of the major program offices; 

and a regional administrator to represent all four regional offices. The IPEC recognizes the importance 

to have representation from the regional offices due to the critical role they play in the NRC’s safety 

and security mission even though the regional offices have relatively small IT resources in comparison 

to the major program offices at headquarters and have minimal IT staff to provide local onsite support 
3 

for the regional office (i.e., Lan, help desk, phone support, document processing) to have effective 

internal operations. The directors of the major program offices serve as business line leads in budget 

formulation and execution, and also as functional/business sponsors of IT investments. It is worth 

noting that the regional work activities are budgeted within a corresponding business line at 

headquarters. Business line leads, working within partner offices across NRC, provide insight into the 

funding needs and impacts to the program and to the mission in the absence of sufficient funding. As 

directors of major programs and as CXOs, IPEC members are able to provide valuable input and 

advice on the many aspects of the NRC’s mission and business needs. Collaboratively they obtain an 

understanding of interdependencies and achieve an agencywide perspective upon which they can 

base decisions on what is in the best interest of the agency and its mission. 

The IPEC is responsible for the following: 

• Deciding IT/IM direction, values, information security activities, and the agency’s risk tolerance 

for IT activities to achieve strategic program objectives. 

• Approving major investments that will effectively integrate into the IT portfolio. 

• Ensuring that the agency’s capital plan supports the NRC’s priorities. 

• Reviewing the IT portfolio in the year of execution to address current fiscal year priorities. 

• Overseeing the execution of the portfolio by reviewing the portfolio health on a quarterly basis 

against established direction, values and risk tolerance. 

• Communicating IPEC discussion and decisions to other NRC boards or committees. 

The CIO established the IT/IM Board (ITB), a management-level investment review board, to review 

and recommend changes to the agency’s IT portfolio based on the NRC’s mission and business needs. 

The mission of the ITB is to align IT investments and technology standards with the NRC’s strategic 

plan and architecture portfolio; provide resource, investment, and priority recommendations to IPEC; 

and ensure that IT investments are made according to the agency direction set by the IPEC. The ITB 

reviews new proposals and current IT investments to ensure the following: 

• alignment with the IPEC priorities, agency’s strategic direction and budget 

• ability to integrate into the NRC’s IT architecture 

• conformance with technology standards 

• identification of potential risks to the NRC environment 

The ITB leverages the expertise of the Architecture Council (AC) for technical reviews. The ITB reviews 

are also supported and facilitated by the NRC’s CPIC processes and staff. The CPIC staff works 

closely with the Integrated Program/Project Teams (IPTs) of existing investments to execute control 

and evaluate processes that inform ITB reviews. ITB reviews can result in minor corrective actions or in 

recommendations to the IPEC for matters warranting executive decision. 

To support ITB reviews of new proposals, the CPIC staff facilitates subject matter expert (SME) 

reviews, the pre-select process, and the select process based on input provided by office-level 

stakeholders. The CPIC staff will ensure proper facilitation through the entire IT governance process 

and that the most viable solution to meet the business need is considered for inclusion into NRC’s IT 

portfolio. As the secretariat of both the IPEC and the ITB, the CPIC staff facilitates the meetings of both 

boards and acts as a channel for communicating information, recommendations, and decisions 

between boards and among stakeholders. 

 
4 

The figure below shows the NRC’s IT governance boards and supporting IT/IM governance framework, 

as well as the acquisition governance relevant to IT acquisition, that support executive decisionmaking. 

Figure 1. The NRC’s IT Governance Structure. 

NRC Acquisition Governance Structure 

The CIO, CAO, and Deputy CFO also serve as members of the Strategic Sourcing Group (SSG). The 

SSG provides senior level oversight of strategic acquisition business process improvements for the 

agency being implemented through various Portfolio Councils. Portfolio Councils are cross-functional 

agency teams responsible for the centralized acquisition planning, identification, and prioritization of 

opportunities to establish strategic sourcing strategies, including establishing enterprisewide contracts 

(EWCs) to address similar requirements across office and program lines. The SSG provides oversight 

of the Portfolio Councils (PCs), including the IT Portfolio Council (ITPC). 

The SSG is an executive level board, which comprises of the following members: 

• Deputy Executive Director for Materials, Waste, Research, State, Tribal, Compliance, 

Administration, and Human Capital, SSG Chair 

• Deputy Executive Director for Reactor and Preparedness Programs 

• Chief Information Officer 

• Deputy Chief Financial Officer 
5 

• Chief Acquisition Officer/Senior Procurement Executive 

• Deputy Assistant General Counsel/Special Council for Acquisition 

• Director, Office of Small Business and Civil Rights 

The SSG performs the following: 

• Ensures alignment between the acquisition process and the budget formulation and execution 

processes. 

• Provides strategic feedback to Portfolio Councils’ commodity-centered recommendations. 

• Considers recommendations on EWCs within and across Portfolio Councils. 

• Monitors execution of Portfolio Councils’ strategic sourcing strategies, including achieving 

agency socio-economic contracting goals. 

• Provides senior level sponsorship of process improvements from the Portfolio Councils. 

• Communicates status and progress to the Chairman and Commissioners. 

• Prioritizes initiatives across Portfolio Councils, as needed. 

Another important function of the SSG is to enhance the agency’s procurement oversight process by 

ensuring that proposed procurement actions (i.e., commercial contracts, agreements with National 

Laboratories administered by the U.S. Department of Energy (DOE), and interagency agreements 

(IAA) exceeding $1 million meet agency and programmatic needs and expectations, and that the 

documentation adequately supports the proposed procurement. This includes any IT contracts or 

contracts with IT components over the $1 million threshold; procurement action documentation for the 

development of IT software or services must also demonstrate that adequate incremental development 

principles will be applied, as appropriate. 

The ITPC is a cross-functional team responsible for managing the commodity category of IT. This 

involves monitoring agency spend through the spend analysis, conducting centralized acquisition 

planning and developing strategies around: strategic sourcing, supplier relationship management, 

demand management and total cost of ownership. 

The key objectives of the PCs are the following: 

• Oversee enterprise approach to acquisition planning and execution. 

• Ensure compliance with small business laws, mitigate the impact of justified contract bundling, 

and provide the maximum practicable prime and subcontract opportunities for small business. 

• Prioritize implementation for strategic sourcing vehicles. 

• Improve commitment, obligation and expenditure of funds as the result of reduced procurement 

cycle times during the budget execution year. 

• Eliminate redundancies among offices buying similar commodities. 

• Implement streamlined processes with an enterprise approach to meeting programmatic 

requirements. 

• Develop policies to drive demand in accordance with strategies and vehicles. 

• Establish supplier relationship management with the NRC’s critical vendors (top commercial 

vendors). 

• Provide robust reporting on NRC-wide acquisition performance, such as tracking savings and 

spend for commodity initiatives. 

The ITPC will use detailed spend analysis data and the ITPC members’ experience and expertise to: 

• Identify and prioritize opportunities to establish a category management approach including 

establishment of strategies spanning: strategic sourcing, supplier relationship management, 

total cost of ownership and demand management. Activities may include the establishment of 
6 

EWCs, to address similar requirements across office and program lines; or development of 

policy and procedures for using existing and future contract vehicles. 

• Support appropriate comprehensive market research. 

• Determine the sourcing strategy for the IT commodities. 

• Make sourcing recommendations to the SSG for approval. 

• Make recommendations to the SSG for updates to management directives, delegations, 

policies, etc., needed to implement ITPC recommendations. 

• Actively manage the performance of the strategic sourcing initiatives for the commodity. 

An annual spend analysis will inform subsequent procurements. As much of the agency’s work is the 

same, similar or routine from year to year, this approach will be used to plan the majority of all agency 

work, with sufficient contract ceilings to allow for growth, unplanned changes, and emergent needs in 

agency priorities. The scope of the PCs’ work encompasses all agency procurements, (i.e., commercial 

contracts, DOE laboratory agreements and IAAs). Consistent with the current process, all acquisitions 

will be supported by Commission budget decisions, and executed in compliance with existing financial 

and contractual regulations, policies, and internal controls. 

By planning procurement requirements well in advance of the execution year, the agency can develop 

better sourcing strategies, explore the full range of alternatives to satisfy the agency’s needs, consider 

the effect of all procurements on socio-economic contracting goals, and provide vendors sufficient lead 

time to develop improved proposals. With early identification of anticipated high level requirements and 

associated funding through monitoring of the contract landscape, discussions with the PC members, 

and monitoring the Advanced Procurement Plan (APP) process, the agency will be able to establish 

contract vehicles for known, or reasonably anticipated, upcoming agency requirements prior to the start 

of an execution year. Once the agency has an appropriation, task orders (or other ordering 

mechanism) for that work can be placed. 

The ITPC also supports the various acquisition initiatives developed by the U.S. General Services 

Administration. The Acquisition Gateway and the category hallways allow for agencies to interact with 

new digital services that improve acquisition outcomes including various contracting vehicles across 

the government. The Federal Strategic Sourcing Initiative (FSSI) has established and continues to 

develop Federalwide vehicles for agencies to utilize. The ITPC actively monitor the IT commodities 

under the Acquisition Gateway and FSSI and incorporate into their strategies as appropriate. 

NRC’s Common Baseline Implementation Plan 

The Common Baseline sets forth requirements A through Q in the areas of Budget Formulation and 

Planning; Acquisition and Execution; and Organization and Workforce. Within each area the 

requirements are further broken down into (1) CIO Roles and Responsibilities and (2) CXO/Other 

Roles and Responsibilities, with the exception of requirements G, J, M and Q. 

Budget Formulation and Planning 

A1. Visibility of IT resource plans/decisions to CIO. The CFO and CIO jointly shall define the level 

of detail with which IT resource levels are described distinctly from other resources throughout the 

planning, programming, and budgeting stages. This should serve as the primary input into the IT 

capital planning and investment control documents submitted with the budget (formerly Exhibits 53 and 

300). 

In 2014, under the direction of the CIO and CFO, the NRC’s IT/IM budget was centralized within 

OCIO and the IT portfolio was restructured into groups of IT investments with the same or similar 

functional capabilities. These groupings help the NRC identify multiple investments duplicating the 

same service or business function in order to streamline the portfolio with the goal of having a single 

investment meet a given need (i.e., provide a given service) for headquarters and for all regional 

offices, when appropriate. Building an IT portfolio comprising IT investments (or services), that 
7 

provide all required capabilities to meet the business needs in a given area aligns with mandates and 

OMB requirements and with the select criteria based on these mandates and set forth in the NRC’s 

CPIC policy and select process. It is a cost-effective strategy to help the NRC fulfill its mission 

efficiently and effectively. 

The CIO and CFO jointly defined the level of detail with which IT resources levels are described 

throughout the planning, programming, and budgeting stages. Based on the data collected, the IPEC 

selects investments and recommends an IT budget for inclusion in the overall agency budget. The 

portfolio of investments approved during the select process and the associated funding levels 

approved during the budget process are the inputs used to populate the Agency IT Portfolio 

Summary. 

The following definitions help explain the portfolio structure and the level of detail with which the IT 

resource levels are described distinctly from other resources throughout the planning, programming, 

and budgeting stages. 

Segment refers to a group of related IT services that support the agency’s needs within a given 

business area. For example, the Administrative Services segment provides IT services to support the 

agency’s administrative functions, such as facilities and personnel security, facilities management, 

and space and property management. 

Investment/Service refers to the expenditure of IT resources to enable core functions and 

processes that support the agency’s mission and operational business requirements. An IT 

investment may include one or more project(s) for the development, modernization, enhancement, or 

maintenance of a single IT component or group of IT components with related functionality, and the 

subsequent operation of the component(s) in a production environment. All investments should have 

a defined lifecycle with start and end dates. The end date should represent the end of the currently 

estimated useful life of the investment based on its components’ most current alternative analyses or 

the results of the investment’s most current operational analysis summarizing the operational 

performance of its components and the investment’s ability to deliver required functionality. 

[Note: Each Investment/Service is assigned a Unique Investment Identifier (UII) for tracking, 

budgeting, and reporting purposes, both internally and externally to OMB. All IT acquisitions 

require the associated UII of the approved investment.] 

Component refers to an IT system, module, or application; IT network or computing device; physical 

or virtual computing platform; other IT asset; and/or personnel needed to deliver or support a given IT 

service. The NRC’s goal is to invest in single enterprise solutions to provide a given service to meet 

common business needs across the agency. Where this is not possible, multiple related components 

would be associated with the given parent investment/service. 

[Note: Each Component is assigned a Component Identifier (CI) for internal tracking, budgeting, and 

reporting purposes, and to facilitate the necessary rollup to meet OMB tracking and reporting 

requirements (i.e., components are child investments that are part of a consolidated parent 

investment reported to OMB on the Agency IT Portfolio Summary). All IT acquisitions require an 

associated CI, as well as an assigned Cost Center.] 

Activity refers to expenses, projects, tasks, processes, and other undertakings that constitute the 

costs and resources associated with a given component. Activities are further divided into the 

following funding types, as defined by OMB in the annual IT budget and capital planning guidance: 

• Operations and Maintenance (O&M) refers to the expenses required to operate and maintain 

an IT asset that is operating in a production environment. O&M includes costs associated with 

operations, maintenance activities, and maintenance projects needed to sustain the IT asset at 
8 

the current capability and performance levels. It includes Federal and contracted labor costs, 

corrective hardware and software maintenance, voice and data communications maintenance 

and service, replacement of broken or obsolete IT equipment, overhead costs, and costs for 

disposal of an asset. O&M is also commonly referred to as “steady state.” 

• Development, Modernization, and Enhancement (DME) refers to projects and activities 

leading to new IT assets/systems, as well as projects and activities that change or modify existing 

IT assets to substantively improve capability or performance, implement legislative or regulatory 

requirements, or meet an agency leadership request. DME activity may occur at any time during 

a program’s lifecycle. As part of DME, capital costs can include hardware, software development 

and acquisition costs, commercial off-the-shelf acquisition costs, government labor costs, and 

contracted labor costs for planning, development, acquisition, system integration, and direct 

project management and overhead support. 

In fiscal year (FY) 2016, NRC is implementing the assignment of a cost activity code (CAC) to each 

component to track full time equivalent (FTE) cost associated with IT investments. Each component 

is assigned a CAC for recording time spent on O&M activities and a CAC for recording hours spent 

on IT security activities performed. For components under a non-major investments, a single CAC is 

also assigned for tracking time spent of DME projects. For components under major investments, a 

CAC is assigned for each DME project under the component. This supports the accuracy of data 

submitted to the Federal IT Dashboard (ITDB) on projects and activities in the Major IT Business 

Case Detail (formerly called the Exhibit 300B). 

The CIO has visibility at all stages of the planning, programming, and budgeting process through 

involvement in the SSG and IPEC. In addition, the CIO leverages monthly reviews and CIO 

evaluations to keep informed of the status of all major IT investments and quarterly reviews of all IT 

spending (major and non-major investments). Based on these reviews, the CIO can request more 

information or analysis on any system or investment and advise the IPT on addressing current 

concerns and future planning. In addition, the CIO holds a CIO TouchPoint with each IPT of the 

major IT investments at least once per year to provide direction and engage in future planning. 

A2. Visibility of IT resource plans/decisions in budget materials. The CFO and CIO jointly shall 

define the level of detail with which IT resource levels are described as detailed in A1. 

Please refer to A1, above. 

B1. CIO role in pre-budget submission for programs that include IT and overall portfolio. The 

agency head shall ensure the agencywide budget development process includes the CFO, CAO, and 

CIO in the planning, programming, and budgeting stages for programs that include IT resources (not 

just programs that are primarily IT oriented). 

The IT Budget Formulation Lead in the OCIO works closely with a liaison from the Office of the Chief 

Financial Officer (OCFO) to ensure proper timing and alignment with the overall annual budget 

formulation process and to develop IT/IM budget instructions. The initial analysis and prioritization 

allows for proper timing for the IT governance boards to begin their reviews, recommendations, and 

approvals of the IT budget to be included in the overall agency budget. 

In February, the CFO and EDO issue fiscal and programmatic budget guidance based on 

Commission direction and priorities. In addition, the CFO and EDO issue resource targets for the 

budget being formulated. The IT Budget Formulation Lead works with the offices, CPIC, and the ITB 

to complete the prioritization based on Commission high level planning guidance and direction, as 

well as the CFO’s budget instructions. The ITB makes recommendations on an Agency IT Portfolio 

and associated IT resources to the IPEC for approval. In addition, the ITB develops a proposed 
9 

prioritized lower-priority list, representing approximately 5 percent of the IT portfolio as well as a 

major unfunded items list representing activities that could be accomplished if additional funds 

become available beyond the initial fiscal targets established by OCFO. The ITB members, 

supported by investment IPTs, are responsible for briefing their respective IPEC members/business 

sponsors in advance of the IPEC discussion and vote. The CPIC staff and IT Budget Formulation 

Lead brief the CIO and CFO in preparation of IPEC decision meetings. 

In March, the CFO performs an independent financial analysis of the overall budget. The CFO and 

EDO also conduct a program/organizational review of the budget with the offices. The CIO 

participates in these reviews. In April, the IPEC (co-chaired by the CIO and CFO) reviews the 

prioritized IT portfolio and budget request recommended by the ITB, and approves an IT portfolio and 

IT budget request to be included in the budget for review as part of the broader NRC budget. The 

IPEC also approves or amends the proposed lower-priority list and major unfunded items list to 

ensure that they reflect the agency’s IT priorities. The IT Budget Formulation Lead then enters the IT 

budget data into the Budget Formulation System (BFS) to create the initial budget proposal. 

The CFO and EDO will then affirm or make adjustments to the prioritization of the IT budget request 

within the context of the overall agencywide budget request for consideration by the Chairman. In so 

doing, the CFO and EDO may adjust the resources associated with activities to be funded, promote 

activities from the major unfunded list for inclusion in the budget request, and/or remove activities 

from the lower-priority list to accommodate other agency priorities. OCFO then finalizes and submits 

the budget proposal for consideration by the Deputy Executive Directors for Operations (DEDOs), 

who may further adjust the budget request in preparation for submission to the Chairman in May. 

Following review of the budget by the Chairman’s staff, OCFO then works with the IT Budget 

Formulation Lead to address questions from the Chairman’s staff to enable the Chairman to submit 

the Chairman’s budget proposal to the Commission in the June-July timeframe. During the 

Commission’s review, OCFO again works with the IT Budget Formulation Lead to address any 

questions that arise, in order to enable the Commission to vote on the Chairman’s budget proposal 

and issue a Staff Requirements Memorandum (SRM) describing any final adjustments to the budget 

request. As IPEC Co-Chairs, the CIO and CFO are integrally involved throughout the budget review 

cycle. In addition, the CIO advises the CFO and EDO regarding the potential impacts of any ITrelated budgetary adjustments by the DEDOs, Chairman, or Commission. The Commission-approved 

budget becomes the annual NRC Performance Budget submitted to OMB. 

The IT Budget Formulation Lead implements any resource changes as directed by the SRM, and the 

Commission-approved IT budget is used to update the input into the IT CPIC documents. The CPIC 

staff will enter the data into the IT portfolio management and submission tool to update the Agency IT 

Portfolio and Major IT Business Cases and facilitate the CIO/CFO IT budget certification process. 

The CPIC staff works with OCFO to ensure that the “IT Table” and “IT Statements” are included in 

the NRC’s Performance Budget submission to OMB, as required by FITARA and described in the 

Common Baseline, annual OMB Circular A-11, Section 51.3 and IT Budget and Capital Planning 

Guidance. 

Please note that the timing of activities discussed are indicative and are subject to some variance in 

the year of formulation. 

B2. CIO role in pre-budget submission for programs that include IT and overall portfolio. The 

agency head shall ensure the agencywide budget development process includes the CFO, CAO, and 

CIO as described in B1 and that CIO guidelines are applied to the planning of all IT resources during 

budget formulation.

Please refer to B1, above. 
10 

C1. CIO role in planning program management. The CIO shall be included in the internal planning 

processes for how the agency uses IT resources to achieve its objectives. The CIO shall approve the 

IT components of any plans, through a process defined by the agency head that balances IT 

investments with other uses of agency funding. This includes CIO involvement with planning for IT 

resources at all points in their life cycle, including operations and disposition or migration. 

The CIO plays a significant role in IT planning and program management through the various roles 

as an SSG member, the IPEC Co-Chair, and a DAA. The internal planning processes for how the 

NRC uses IT resources to achieve its objectives throughout the lifecycle of the agency’s IT 

investments are reflected in the agency’s IT budget guidance and CPIC select process, as well as 

the responses to elements F1 and L1, herein. The NRC’s IT/IM Strategic Plan provides the CIO’s 

vision and direction for the focus areas that guide the formulation and prioritization of the IT budget 

request. The CIO also advises the CFO and EDO regarding recommendations related to the 

Commission’s high-level budget guidance, and co-chairs the IPEC to approve or amend the agency 

IT budget request, as well as the lower-priority list and major unfunded items list to ensure that they 

reflect the agency’s IT priorities and support the mission objectives outlined in the NRC Strategic 

Plan (for which the CIO also provides input). As IPEC Co-chair, the CIO also collaborates with other 

IPEC members (including the CFO, other CXOs, and directors of major offices/programs) to provide 

an enterprise perspective on what is in the best interest of the agency and its mission, as well as the 

impacts to the mission should the required IT resources not be available. As a result, the CIO and 

other IPEC members ensure that the agency’s IT budget request aligns with the agency’s mission 

and adequately supports the funded IT investments throughout the various stages in their lifecycles. 

Following approval by the IPEC, the CFO and EDO will affirm or make adjustments to the 

prioritization of the IT budget request within the context of the overall agencywide budget request. In 

so doing, the CFO and EDO may adjust the resources associated with activities to be funded, 

promote activities from the Major Unfunded List for inclusion in the budget request, and/or remove 

activities from the lower-priority list to accommodate other agency priorities. The CIO participates in 

reviews to ensure an appropriate balance between IT investments and agency spending in other 

areas. OCFO finalizes and submits the budget proposal to the Chairman. OCFO then works with the 

IT Budget Formulation Lead to address questions from the Chairman’s staff to enable the Chairman 

to submit a budget proposal to the Commission for vote. During the Commission’s review, OCFO 

again works with the IT Budget Formulation Lead to address any questions that arise, in order to 

enable the Commission to vote on the Chairman’s budget proposal and issue a SRM to reflect final 

budget adjustments. The Commission-approved budget becomes the NRC Performance Budget that 

is submitted to OMB. As Co-Chairs of the IPEC, the CIO and CFO are integrally involved throughout 

the budget review cycle. In addition, the CIO advises the CFO and EDO regarding the potential 

impacts of any IT-related budgetary adjustments by the DEDOs, Chairman, or Commission. 

The CIO continues to play an integral role in the agency’s IT investments during the year of 

execution. As IPEC Co-chair, the CIO maintains awareness of planned IT expenditures (as described 

in F1), and approves on an ongoing basis IT reallocations that exceed $500K or 4 FTE, consistent 

with IT/IM resource review guidance and the execution year IT/IM budget changes guidance (as 

described in L1) which are based on OCFO’s reprogramming guidance. In this manner, the CIO 

authorizes reprogramming requests before they are submitted to the OEDO and OCFO. In addition, 

the CIO advises the CFO and EDO regarding recommendations to the Commission that relate to 

plans to reduce IT budgetary resources associated with sequestration, rescission, or cancellation. 

In addition to the planning, budget approvals, and acquisition oversight, the CIO reviews monthly 

status updates on all major investments and updates CIO evaluations as significant changes occur, 

or at a minimum of quarterly. In addition, the CIO holds CIO TouchPoints with each major 

investment’s IPT at least once a year. As an IPEC Co-Chair, the CIO reviews the IT portfolio in the 

year of execution to address current fiscal year priorities and oversees the execution of the portfolio 
11 

by reviewing the portfolio health on a quarterly basis against established direction, values and risk 

tolerance. The IPEC is also responsible for conducting TechStats when needed. The CIO also 

provides the IT/IM Quarterly Performance Report (QPR) to the OEDO to provide executive-level 

review and visibility into the IT program and spending. The QPR focuses on IT/IM performance 

indicators tied to program goals, accomplishments, challenges, and mitigation strategies, as well as 

financial metrics reporting budget execution (commitment and obligation rates, and expenditures), 

FTE utilization, and contract performance. 

C2. CIO role in program management. CIO, CFO, and program leadership shall define an 

agencywide process by that the CIO shall advise on all planning described in C1. 

The NRC’s new Management Directives on Budget Formulation and Budget Execution, which are 

currently under review by the Commission, clearly outline the role of the CIO in budget-related 

aspects of internal planning processes. The “Capital Planning and Investment Control Policy and 

Process Overview,” “Capital Planning and Investment Control Process,” and “IT/IM budget guidance” 

provide additional information regarding the CIO’s role in the NRC’s IT/IM governance framework and 

other agencywide processes through which the CIO advises the NRC on all aspects of internal 

planning described in C1, above. For related information, please see F1 and L1 herein. 

D1. CIO role in major IT investment. Agency budget justification materials in their initial budget 

submission to OMB shall include a statement that affirms: 

• The CIO has reviewed and approves the major IT investments portion of this budget request. 

• The CFO and CIO jointly affirm that the CIO had a significant role in reviewing planned IT support 

for major program objectives and significant increases and decreases in IT resources. 

• The IT Portfolio (formerly Exhibit 53) includes appropriate estimates of all IT resources included in 

the budget request. 

The CIO approves all new major IT investments for inclusion in the Agency IT Portfolio as part of the 

select process. As a DAA, the CIO formally assumes the responsibility for operating a major system 

or network at an acceptable level of risk; evaluates the mission, business case, and budgetary needs 

for an NRC system in view of the security risks; and permits or denies operations or use based on 

unacceptable security risk. The CIO also approves the updated Major IT Business Cases and Major 

IT Business Case Detail during the annual submissions. 

Once OMB issues the IT Budget – Capital Planning Guidance, the CPIC staff provide the IT 

investment program manager and IT project managers with the instructions for preparing and 

updating Major IT Business Cases and Major IT Business Case Details. For new major IT 

investments, the CIO approved PMM business case and budgetary decisions made by the IPEC 

become the main input for preparing the Major IT Business Cases and Major IT Business Case 

Details to be submitted to OMB. For existing major IT investments, updates to the previous Major IT 

Business Cases and Major IT Business Case Details submitted to OMB will be based on the CIO 

direction provided to the IPTs through the various control and evaluate processes applied to the 

major IT investment each year and budgetary decisions made by the IPEC. 

The CPIC staff provides OCFO with the information needed for the “IT Table” in the agency’s budget 

justification materials and works with OCFO to keep informed of any budgetary changes resulting 

from EDO, Chairman, and Commission decisions throughout the budget formulation process. After 

making any necessary changes to the Major IT Business Cases and Major IT Business Case Details 

based on the Commission-approved budget, the CPIC staff submit the final versions to the CIO for 

final review and approval. Once the CIO approves, the CPIC staff will provide the affirmation 
12 

statements to OCFO and submit the Major IT Business Cases and Major IT Business Case Details to 

the ITDB. 

OMB reviews the Major IT Business Case and Major IT Business Case Details and provides 

feedback to the NRC CPIC staff in December/early January. At this time, the NRC also receives the 

OMB budget passback and makes any necessary adjustments to the agency budget request to be 

included in the Congressional Budget Justification. The CPIC staff work with the IT investment 

program managers and project managers to address OMB’s feedback and to update Major IT 

Business Cases and Major IT Business Case Details to reflect the final budget funding levels for the 

Congressional Budget Justification. The CPIC staff submit the final versions to the CIO for final 

review and approval. Once approved, the CPIC staff submit the Major IT Business Cases and Major 

IT Business Case Details to the ITDB. 

D2. CIO and CFO roles. The CFO shall work with the CIO to establish the affirmations in D1. 

As IPEC Co-chairs, the CIO and CFO lead the review of planned IT support for major program 

objectives and significant increases and decreases in IT resources and affirm that the Agency IT 

Portfolio includes appropriate estimates of all IT resources. As part of this IPEC review and 

decisionmaking process, the CIO and CFO approve the Agency IT Portfolio and IT budget requests. 

The CIO and CFO remain involved in the budget formulation process. The CIO will make the IT 

budget recommendation to the Chairman and provide mission impacts of changes being considered. 

Lastly, the CIO performs a final review and approval of the IT CPIC documents reflecting the 

Commission-approved budget. Upon CIO approval, the CPIC staff will provide the affirmation 

statements to OCFO and submit the Major IT Business Cases and Major IT Business Case Details to 

the ITDB. 

Acquisition and Execution 

E1. Ongoing CIO engagement with program managers. The CIO should establish and maintain a 

process to regularly engage with program managers to evaluate IT resources supporting each agency 

strategic objective. It should be the CIO and program managers’ shared responsibility to ensure that 

legacy and on-going IT investments are appropriately delivering customer value and meeting the 

business objectives of programs. 

The CIO has established ongoing processes to regularly engage with program managers to evaluate 

IT resources supporting agency strategic objectives. Monitoring and evaluation of operational 

performance metrics for all major IT investments are conducted via the monthly review and update 

process, the annual operational analysis, and CIO TouchPoints. Each of these processes involves 

collaboration among the CIO, program managers, and the CPIC staff. The results of monthly reviews 

help inform CIO evaluations. Annual operational analyses and CIO TouchPoints help identify 

potential areas for improvement and opportunities to gain efficiencies and help inform future planning. 

Program managers for non-major investments are engaged during the IT budget formulation and 

prioritization processes, as well as in the reprioritization and shortfall processes during the year of 

execution. The CIO and Deputy CIO supervise the program managers for a very significant portion of 

the IT portfolio. 

E2. Ongoing CIO engagement with program managers. Program managers shall work with the CIO 

to define IT performance metrics and strategies to support fulfillment of agency strategic objectives 

defined in the agency’s strategic plan. 

Throughout the year of execution each investment’s performance metric results are monitored and 

reported through monthly reviews. Evaluation of these results are documented in the annual 

operational analysis. Performance metric results are provided to the CIO monthly and trends or 

findings from the operational analysis are provided to the CIO annually. The CIO Touchpoints are an 
13 

opportunity for the CIO and program managers to discuss progress being driven by the metrics, 

evaluate the customer and business value being delivered, and adjust existing or define new IT 

performance metrics and strategies to support agency strategic objectives defined in the agency’s 

strategic plan. The CPIC staff uses direction provided by the CIO to work with the SP/EA staff and 

the program managers to update metrics, adjust targets, and create new metrics, as appropriate, 

during the annual Major IT Business Case updates and submissions. 

F1. Visibility of IT planned expenditure reporting to CIO. The CFO, CAO and CIO should define 

agencywide policy for the level of detail of planned expenditure reporting for all transactions that 

include IT resources. 

The NRC’s CIO (with support from CFO and CAO staff), is currently establishing an agencywide 

IT/IM resource review guidance which is planned for release on January 1, 2016. This guidance 

states that planned expenditures for IT transactions and resources shall be reported at the contract 

and task order levels and at the NRC’s budget structure levels throughout the year of execution. This 

guidance will be implemented through the use of the following agency systems: 

• The Spend Plan module within the NRC’s BFS tracks contract costs and projected funding 

needs based on planned expenditures, combined with financial and contract information. The 

Spend Plan is a centralized, standardized tool, which increases efficiency in budget execution 

planning and management. 

• The Financial Accounting and Integrated Management Information System (FAIMIS) is the 

NRC’s core financial accounting system and is the authoritative source for budget execution 

and fees for reimbursable work. FAIMIS also supports accounting for assets, liabilities, fund 

balances, revenues, and expenses, in accordance with Federal standards. 

• The Human Resources Management System (HRMS) supports the submission, approval, 

and adjustment of employees' hours, as well as management of time, attendance, leave, and 

payroll processing. 

The OCFO requires contracting officer representatives (CORs) in all offices to update their spending 

plans for active contracts on a quarterly basis for the upcoming 12 months. During FY 2015, the 

CPIC staff, with OCFO support, piloted a process to compare spend plans, aggregated at office 

and/or product levels to the enacted budget to identify significant anomalies. Identified discrepancies 

were communicated to the responsible ITB representative, who was then tasked to work with the 

COR(s) to validate and explain the anomaly using contract and task order level reports. ITB 

representatives were requested to assess whether the anomaly was a short-term or long-term 

deviation, and determine whether the discrepancy resulted in projected excess funds that could be 

reallocated to other agency priorities or represented an unfunded need that could be met by 

rebalancing the IT portfolio or reallocating other non-IT agency resources. The collective findings of 

the ITB representatives were then presented to the CIO, CFO and IPEC to facilitate FY 2015 

rebalancing decisions. In FY 2016, the CIO plans to refine and formalize the process to facilitate a 

repeatable, quarterly review of the execution of the IT budget, with excess funds and unfunded needs 

presented to the IPEC to facilitate rebalancing decisions, as appropriate. 

In addition, IT Spend Plans guide the CORs in establishing advanced procurement plans, which are 

consistent with Management Directive (MD) 11.1, “NRC Acquisition of Supplies and Services” 

(ADAMS Accession No. ML13322B277), and overseen by the CAO’s acquisition management staff. 

The acquisition management staff reviews the advanced procurement plans on a quarterly basis to 

ensure that planned contracting activities are consistent with the agency’s budget. Any anomalies 

involving IT resources are brought to the attention of the responsible office, and may be escalated to 

the CFO and CIO (as IPEC Co-Chairs), when necessary, to facilitate appropriate action. 
14 

The IT/IM resource review guidance ensures that the NRC expends its IT resources in accordance 

with MD 4.1, “Accounting Policy and Practices” (ADAMS Accession No. ML052650463), and MD 4.2, 

“Administrative Control of Funds” (ADAMS Accession No. ML14157A275). In so doing, it ensures 

compliance with the requirements of OMB Circular A-11, “Preparation, Submission, and Execution of 

the Budget”; the Antideficiency Act (31 U.S.C. 1341 et seq.); the Impoundment Control Act of 1974 (2 

U.S.C. 681–688); the Chief Financial Officers Act of 1990 (Public Law 101-576) (CFO Act); NRC 

Appropriations Acts; Government Accountability Office (GAO) guidance; and the Economy Act (31 

U.S.C. 1535). 

F2. Visibility of IT planned expenditure reporting to CIO. The CFO, CAO and CIO shall define 

agencywide policy for the level of detail of planned expenditure reporting for all transactions that 

include IT resources. 

Please refer to F1, above. 

G1. CIO defines IT processes and policies. The CIO defines the development processes, milestones, 

review gates, and the overall policies for all capital planning, enterprise architecture, and project 

management and reporting for IT resources. At a minimum, these processes shall ensure that the CIO 

certifies that IT resources are adequately implementing incremental development (as defined in the 

definitions in Appendix A). The CIO should ensure that such processes and policies address each 

category of IT resources appropriately—for example, it may not be appropriate to apply the same 

process or policy to highly customized mission-specific applications and back office enterprise IT 

systems depending on the agency environment. These policies shall be posted publicly at 

agency.gov/digitalstrategy, included as a downloadable dataset in the agency’s Public Data Listing, 

and shared with OMB through the IDC. For more information, see OMB Circular A-130: Management 

of Information Resources. 

The CIO oversees policies for all capital planning, enterprise architecture, and project management 

and reporting for IT resources, as well as IT policy implementation. The NRC’s CPIC policy and 

processes have been recently updated and posted to the NRC’s IT Policy Archive. As new or 

updated processes are implemented, it is expected that the processes will be updated at least 

annually based on lessons learned as the NRC’s investment management matures. 

The NRC’s MD 2.8, “Project Management Methodology” will be replaced with a new MD 2.X, 

“Integrated Information Technology/Information Management (IT/IM) Governance Framework,” 

currently in concurrence. It is expected to be published in the second quarter of FY 2016. This will 

include sections on investment management, SP/EA, PMM, and IRM. 

 
15 

H1. CIO role on program governance boards. In order to ensure early matching of appropriate IT 

with program objectives, the CIO shall be a member of governance boards that include IT resources 

(including “shadow IT” or “hidden IT”—see definitions), including bureau investment review boards 

(IRB). The CIO shall notify OMB of all governance boards the CIO is a member of and at least annually 

update this notification. 

The table below lists all the governance boards the CIO participates in and provides a brief 

description of his involvement. 

Governance 

Board 

CIO Involvement 

Designated 

Approving 

Authority for IT 

Systems (DAA) 

CIO assumes responsibility for operating a major network or system at an acceptable 

level of risk. Risk is evaluated by reviewing the mission, business cases and budget 

requirements of an NRC system in light of the security risks. As a result of this 

assessment, the CIO shall permit or deny operations or use based on an 

acceptable/unacceptable security risk. 

Executive 

Review Board 

(ERB) 

CIO is involved in the recruitment and selection of Senior Executive Service employees. 

IT/IM Portfolio 

Executive 

Council (IPEC) 

CIO reviews and evaluates IT budget requests including those approved by the IPEC 

governing body in his role as an IPEC Co-chair. Based upon this review, decisions are 

made and a budget proposal is compiled for the CFO and EDO to submit to the 

Chairman. After review and approval by the Commission, the CIO approves final IT 

capital planning and investment documents before submission of the budget to OMB. 

Strategic 

Sourcing Group 

(SSG) 

CIO is a member of the SSG. In this role, the CIO approves IT acquisitions of or 

exceeding $1M that meet agency and programmatic needs and expectations provided 

that the supporting documentation supports the proposed procurement. The CIO also 

provides oversight of the IT Portfolio Council, retaining visibility into and accountability of 

IT acquisitions under the $1M threshold. 

H2. Participate with CIO on governance boards as appropriate. 

The CIO serves as a DAA, an IPEC Co-Chair and a member of the SSG. He also provides oversight 

for the Deputy CIO, CISO, ITPC, ITB and AC. 

I1. Shared acquisition and procurement responsibilities. The CIO reviews all IT-related cost 

estimates and ensures all acquisition strategies and acquisition plan that include IT apply adequate 

incremental development principles (see definitions). 

The NRC has an existing governance structure in place to manage IT procurements. For items 

$1 million and above, the SSG provides oversight to ensure all procurements meet agency and 

programmatic priorities, and that the documentation adequately supports the proposed procurement 

strategy. For items below $1 million, IT requirements and costs are vetted as part of the IT budget 

formulation through the CPIC process and the ITB review; and once approved for funding, go through 

the ITPC to ensure alignment with the NRC’s strategic sourcing efforts. All new requirements, 

regardless of dollar value, are reviewed to determine if they can be purchased under the NRC’s 

EWCs, Government-Wide Acquisition Contracts (GWACs), a standalone contract, or an IAA. For IT 

contracts, EWCs are written to enforce incremental development principles, and deviation from the 

use of these contracts would require CIO approval. For any IT contracts or contracts with IT 

components, regardless of the dollar threshold, the procurement action documentation for the 

development of IT software or services must demonstrate that adequate incremental development 

principles will be applied, as appropriate. Regardless of whether the requirement is reviewed by the 

SSG or through the ITB, costs are thoroughly reviewed to ensure that the NRC will receive the best 

value for each requirement. The business justifications must be provided as part of the budget 
16 

submissions to provide information on the item/service being purchased, as well as the impact for 

those items or services if the budget was reduced or eliminated. 

The NRC is implementing a procedure by which the CIO will be provided a report on a weekly basis 

that lists all requisitions received by the Acquisition Management Division for new IT purchases, 

regardless of dollar amount. The CIO, Deputy CIO and Chief of the Information Security Directorate 

will receive notification that the report is available. The CPIC staff in OCIO will receive the report as 

well to determine if funds are being committed as budgeted. The report will be posted on an internal 

SharePoint site and will track the CIO’s approval or disapproval. 

When a requisition is provided to begin the acquisition process, the program office nominates a COR 

for each contract. The Acquisition Management Division reviews that person’s Federal Acquisition 

Certification (FAC)-COR or FAC-Program and Project Manager (P/PM) certification level to ensure 

that it matches the complexity level of the procurement. If the nominated staff member does not have 

the required certification, a replacement must be named before the contract can be awarded. 

I2. Shared acquisition and procurement responsibilities. The CAO, in consultation with the CIO 

and-where appropriate-CFO, shall ensure there is an agencywide process to ensure all acquisitions 

that include any IT: 

• are led by personnel with appropriate federal acquisition certifications (FACs), including 

specialized IT certifications as appropriate; 

• are reviewed for opportunities to leverage acquisition initiatives such as shared services, category 

management, strategic sourcing, and incremental or modular contracting and use such 

approaches as appropriate; and 

• are supported by cost estimates that have been reviewed by the CIO; and adequately implement 

incremental development. 

The NRC’s CAO, working closely with the Head of Contracting Activity (HCA), ensures that policies 

and procedures are in place that require the appropriate FAC certifications for both acquisition 

personnel as well as program office personnel. As stated in the response for item I1, CORs 

nominated to a contract are reviewed for the appropriate FAC-COR or FAC-P/PM certification prior to 

moving forward with the contract award. FAC-C, FAC-COR, and FAC-P/PM certification status is 

posted on the NRC’s Enterprise Acquisition Toolset for easy reference. 

The CAO is a member of the SSG along with the CIO and Deputy CFO. To that end, these members 

of the SSG, along with the other voting members are privy to receiving regular briefings from the 

Strategic Sourcing Team, to include results of the spend analysis and category management. The 

NRC follows the following process: 

• Pulls contract data from the NRC’s acquisition system to update the contract landscape. 

• Reviews new contracts and identify categories and subcategories. 

• Validates other fields, such as whether it is a EWC, small business, etc. 

• Pulls payment data from the NRC’s financial system. 

• Systematically analyzes each payment record against the contract landscape and previous 

spend analysis through a series of logic to identify the initial recommendations for categories 

and subcategories for each payment record. 

• Manually reviews each payment record and finalize the categories and subcategories. 
17 

• Compiles data into the spend cube, which contains three fiscal years’ worth of data for 

analysis. 

Spend is categorized into Commodity Categories and Commodity Subcategories. The Commodity 

Subcategories for IT are as follows: 

• AV Equipment 

• IT Application Software 

• IT Desktop / Laptop 

• IT Other 

• IT Security 

• IT Server / Hardware 

• IT Support / Maintenance 

• Printer / Scanner / Copier 

• Telecommunications 

The CAO, working closely with the HCA, has implemented a business process that requires all 

requisitions for IT requirements be submitted to the Acquisition Management Division with proof of 

approval from one of the governing bodies, or demonstrates that it is an item that has been approved 

and is listed on the technical reference model (TRM) approved list. A procurement cannot move 

forward without proof of approval through one of these methods. 

J1. CIO role in recommending modification, termination, or pause of IT projects or initiatives.

The CIO shall conduct TechStat reviews or use other applicable performance measurements to 

evaluate the use of the IT resources of the agency. The CIO may recommend to the agency head the 

modification, pause, or termination of any acquisition, investment, or activity that includes a significant 

IT component based on the CIO’s evaluation, within the terms of the relevant contracts and applicable 

regulations. 

The CIO has the authority to recommend modification, termination, or pause of IT projects or initiatives. 

The CIO is involved in these decisions through several mechanisms. As an IPEC Co-Chair, the CIO 

plays a lead role in conducting TechStat reviews. A review of any project or investment can be 

requested at any time based on status reports provided to the CIO as part of monthly updates and 

CIO evaluations submitted to the ITDB. The CIO meets with the IPTs of each major investment at 

least annually. The purpose of these reviews are to have open conversations with program managers 

about the status of each major investment with special focus on current performance; current project 

cost, schedule, milestones, and deliverables; and future plans or strategies. The CIO also serves as 

a DAA, which has formal responsibility for approving, modifying or terminating the operation of an IT 

system in accordance with FISMA and NIST guidelines. 

The CIO is provided the current status of all major IT investments as part of the NRC’s monthly 

review and update process. These monthly status reports help inform CIO evaluations. CIO 

evaluations are updated when changes are significant enough to warrant an update, or at a minimum, 

quarterly to ensure the current status is accurately reflected on the ITDB. In addition, the CIO can 

request the review of any project or investment at any time; however at a minimum, the CIO meets 

with each major investment’s IPT at least once a year through the NRC’s CIO TouchPoint process. 

NRC policy is to hold a TechStat on any investment with high-risk rating for more than a quarter. The 

TechStat outcomes and corrective actions are decided by the IPEC which is co-chaired by the CIO 
18 

and CFO. The outcome of a TechStat can be the modification, termination, or pause of IT projects or 

initiatives. 

It is also NRC’s TechStat Policy to evaluate any investment (major or non-major) to determine the 

need for a TechStat if the CIO or the IPEC request the evaluation due to concerns over cost, 

schedule variance or dependencies, performance, usage, organizational impact, or corrective actions. 

Non-major investments are monitored and reported to the CIO on a quarterly basis as part of the 

reporting of planned expenditures for IT transactions and resources. Additionally, during the year of 

execution IT expenditure data is compared to budget allocation and is presented to the IPEC. The 

data is used to evaluate the health of the portfolio and to facilitate rebalancing or reallocation 

decisions at the IPEC level. Any concerns raised through the various reviews and reporting channels 

could potentially result in an in-depth review of certain investments or portions of the IT portfolio. 

K1. CIO review and approval of acquisition strategy and acquisition plan. Agencies shall not 

approve an acquisition strategy or acquisition plan (as described in FAR Part 7) or interagency 

agreement (such as those used to support purchases through another agency) that includes IT without 

review and approval by the agency CIO. For contract actions that contain IT without an approved 

acquisition strategy or acquisition plan, the CIO shall review and approve the action itself. 

The CIO shall primarily consider the following factors when reviewing acquisition strategies and 

acquisition plans: 

• Appropriateness of contract type; 

• Appropriateness of IT related portions of statement of needs or statement of work; 

• Appropriateness of above with respect to the mission and business objectives supported by the IT 

strategic plan; and 

• Alignment with mission and program objectives in consultation with program leadership. 

The NRC has a governance structure in place to manage all IT procurements. The SSG reviews all 

awards for $1 million and above. This group reviews the acquisition plan to ensure that the award 

supports the mission of the agency. The acquisition plan submitted to and reviewed by the SSG 

includes a discussion of the contract type including a risk mitigation strategy for nonfixed price 

contracts, a summary of the statement of work to include IT portions, and the objectives of the 

acquisition. Each SSG paper is reviewed by the program office’s management chain to ensure 

alignment. For items below $1 million, IT requirements are vetted as part of the IT budget process, 

through the ITPC, and the IT CPIC process. The budget process and the CPIC process review the 

project along with expected costs associated with each project. The ITPC conducts a spend analysis 

each year to review how IT funds are expended, including credit card purchases. The ITPC 

membership includes representatives from acquisition, IT, legal counsel and OCFO. New 

requirements are reviewed to determine if they are being purchased smartly and whether they can be 

purchased under EWCs, GWACs, a standalone contract, or IAA. 

K2. CAO role. CAO is responsible for ensuring contract actions that contain IT are consistent with 

CIO- approved acquisition strategies and plans. The CAO shall indicate to the CIO when planned 

acquisition strategies and acquisition plans include IT. The CAO shall ensure the agency shall initiate 

no contract actions or interagency agreements that include IT unless they are reviewed and approved 

by the CIO or are consistent with the acquisition strategy and acquisition plan previously approved by 

the CIO. 

Similar process or contract modifications. CAO shall also ensure that no modifications that make 

substantial changes to the scope of a significant contract are approved that are inconsistent with the 

acquisition strategy and acquisition plan previously approved by the CIO unless the modification is 

reviewed and approved by the CIO. 
19 

The CAO, working closely with the HCA, has implemented a business process that requires all 

requisitions for IT requirements, whether they be new requirements or modifications to existing 

contracts, be submitted to the Acquisition Management Division with proof of approval from one of 

the governing bodies, or demonstrates that it is an item that has been approved and is listed on the 

TRM approved list. A procurement cannot move forward without proof of approval through one of 

these methods. 

L1. CIO approval of reprogramming. The CIO must approve any movement of funds for IT 

resources that requires Congressional notification. 

The NRC is committed to efficient and responsible use of IT/IM resources to ensure that available 

funding is directed to the agency’s highest priority activities. Toward that end, the NRC plans and 

budgets its IT/IM activities to support the agency’s regulatory functions in a manner that meets the 

requirements and performance goals established in legislation, regulations, and the NRC IT/IM 

Strategic Plan. One aspect of this Planning, Budgeting, and Performance Management (PBPM) 

process is the need to identify, prioritize, and adjust IT/IM resource allocations to account for fact-oflife changes, emergent needs, underfunding in the enacted budget for the given fiscal year, and other 

business line priorities. Any unbudgeted needs are typically identified through the review of planned 

expenditures, as described previously in F1 and/or via requests identified by ITB representatives. 

To the extent possible, unbudgeted needs are met through reallocation of resources into or within the 

IT/IM product lines. This approach is consistent with the CIO’s draft agencywide IT guidance for 

execution year IT/IM budget changes which is planned for release on January 1, 2016. Together with 

the established OEDO procedures, the IT guidance formalizes the agency’s approach to 

accommodating emergent, execution year funding needs and the reallocation of funds into and within 

the IT/IM budget. The IT guidance ensures that the CIO has visibility into reallocations of IT 

resources during the year of execution and concurs where appropriate and practical. 

In the event of a request for re-allocation of resources within the IT/IM Portfolio, CPIC staff will use 

existing financial reports to determine whether the reallocation requires CIO approval. The cases 

below outline the criteria for which reallocations will require CIO approval: 

• Reallocation will result in forward funding levels that exceed CIO/CFO guidance for the 

execution year. 

• Cumulative IT/IM funds allocated to the business line, product line, product and office budget 

string exceed the enacted budget by $500K or 4 FTE in the given fiscal year. 

• Reallocation of funds will result in development or acquisition of a new capability, or 

modernization or replacement of an existing system or service. 

• Total cumulative amount allocated to all offices under an IT/IM budget string exceeds the total 

fiscal year IT/IM budget by more than 5 percent (the CIO must be briefed on every cumulative 

$1 million reallocated into IT/IM up to the 5 percent threshold). 

• Funding for the effort will impact the ability of the requesting or impacted office(s) to complete 

other budgeted IT/IM activities approved for the given fiscal year. 

As part of the quarterly execution review described previously under F1 and F2, CPIC staff will also 

proactively determine whether sufficient funds exist in the IT/IM portfolio to take advantage of excess 

or unused IT funding to meet emergent needs where existing funds meet any of the following criteria: 

• Cannot be obligated by September 30 of the current fiscal year, allowing for procurement 

action lead times and other factors. 
20 

• Cannot be expended within the timeframe established by the NRC IT/IM budget guidance for 

carryover funding. 

• Cannot be justified based on the spend plans defined by the responsible allowance holder. 

• Is no longer needed as a result of cost savings achieved through greater efficiency or the 

cancellation or deferment of a budgeted activity. 

In his role as Co-chair of the IPEC, the CIO will review and concur on IT/IM re-allocations identified 

via the quarterly execution review. 

Where reallocation of resources within the IT/IM portfolio is inadequate to meet the identified needs, the 

OCIO may request shortfall funding for its own needs or those of partner offices. The IT/IM shortfall 

funding guidance governs the management and use of shortfall funding, consistent with the broader 

agencywide policy set forth in MD 4.1, “Accounting Policy and Practices” (ADAMS Accession No. 

ML052650463), and MD 4.2, “Administrative Control of Funds” (ADAMS Accession No. 

ML14157A275). As Co-Chair of the IPEC, the CIO is integrally involved throughout the IT/IM shortfall 

process. In addition, the CIO advises the CFO and EDO regarding recommendations to the Commission 

that relate to prioritization of unfunded needs (shortfall request) and any subsequent adjustments that 

involve IT resources. 

Budget reprogramming actions that require Congressional notification have been very rare at the 

NRC. When such actions are required, the OEDO in conjunction with the OCFO prepares the 

requests for Chairman and Commission approval. However, as Co-Chairs of the IPEC, the will CIO 

will approve significant IT reallocations on an ongoing basis during the year of execution in line with 

the IT/IM resource review guidance and the execution year IT/IM budget changes guidance 

described above. In this manner, the CIO authorizes reprogramming requests before they are 

submitted to the OEDO and OCFO. 

In addition, the CIO advises the CFO and EDO regarding recommendations to the Commission that 

relate to plans to reduce IT budgetary resources associated with sequestration, rescission, or 

cancellation. 

L2. CIO approval of reprogramming. The CFO shall ensure any notifications under L1 are approved 

by the CIO before submission to OMB. 

Please refer to L1, above. 

Organization and Workforce 

M1. Role of CIOs and bureau CIOs. The CIO shall be involved in the recruitment and shall approve 

the selection of any new bureau CIO (includes bureau leadership with CIO duties but not title - see 

definitions). The title and responsibilities of current bureau CIOs may be designated or transferred to 

other agency personnel by the agency head or his or her designee as appropriate, and such decisions 

may take into consideration recommendations from the agency CIO. 

The NRC is a small independent agency that has no bureaus and only one CIO. The agency CIO 

retains all CIO accountability and responsibilities, and no other staff has “CIO-like” responsibilities. 

There are IT personnel in the program offices that support IT systems and capabilities to support 

mission and business needs and processes. The co-location of IT personnel that are members of an 

IPT with the program offices they provide IT support to is in alignment with capital planning guidance 

and best practices. The IT program and project managers are placed in the office of the 

functional/business sponsor and business process owners/SMEs of the system and projects they 
21 

support. The systems themselves are either cloud or other provisioned IT external to NRC’s IT data 

center or are on the IT infrastructure managed by the OCIO. 

For example, the OCFO has an IT branch containing IT staff that manage the three systems under 

the Financial Services investment: 

• BFS is housed on a virtual service within the NRC’s data center managed by OCIO. 

• FAIMIS is a cloud service. 

• HRMS is housed on a virtual service within the NRC’s data center managed by OCIO. 

The program and project managers are housed with the main stakeholders and are directly involved 

in the business of the office, but do not make any IT budget or acquisition decisions on their own. 

The IPTs must follow the IT governance policies and processes and adhere to the decisions of the 

CIO and IPEC. 

The regional offices are relatively small in comparison to the major program offices at headquarters 

and have a small group of IT staff to provide local onsite support for the regional office (i.e., Lan, help 

desk, phone support, document processing) to have effective internal operations. The regional 

administrators are not business line leads; rather the business supported by the regional offices has 

a corresponding business line lead at headquarters. The directors of the major program offices serve 

as business line leads and work with their partner offices in budget formulation and execution 

activities. The business line leads also serve as functional/business sponsors of IT investments. 

N1. CIO role in ongoing bureau CIOs’ evaluations. The CHCO and CIO shall jointly establish an 

agencywide critical element (or elements) included in all bureau CIO’s performance evaluations. In 

cases where the bureau CIO is a member of the Senior Executive Service and the agency uses the 

Basic SES Appraisal System, this critical element(s) is an “agency-specific performance requirement” 

in the Executive Performance Plan. Each such agency may determine that critical element(s) (ECQs) 

contain these requirements. For agencies that do not use the Basic SES Appraisal System or for 

bureau CIOs who are not members of the SES, then these shall be critical elements in their 

evaluations. 

The [agency] CIO must identify “key bureau CIOs” and provide input to the rating official for this critical 

element(s) for at least all “key bureau CIOs” at the time of the initial summary rating and for any 

required progress reviews. The rating official will consider the input from the [agency] CIO when 

determining the initial summary rating and discusses it with the bureau CIO during progress reviews. 

As discussed in M1, there is no senior level IT management in the program or regional offices. This 

does not apply. 

N2. CIO role in ongoing bureau CIOs’ evaluations. The CHCO and CIO shall jointly establish an 

agencywide critical element (or elements) for the evaluation of bureau CIOs as described in N1. 

Although there is no senior level IT management in the program or regional offices for which the CIO 

should provide input into critical elements or appraisals, the CIO and CHCO will continue to work 

jointly on the position descriptions and qualifications of the 2210 series for the entire agency. 

 
22 

O1. Bureau IT Leadership Directory. CIO and CHCO will conduct a survey of all bureau CIOs and 

CIO and CHCO will jointly publish a dataset identifying all bureau officials with title of CIO or duties of a 

CIO. This shall be posted as a public dataset based on instruction s in the IDC by August 15, 20 l 5 

and kept up- to- date thereafter. The report will identify for each: 

• Employment type (e.g. GS, SES, SL, ST, etc.) 

• Type of appointment (e.g. career, appointed, etc.) 

• Other responsibilities (e.g. full-time CIO or combination CIO/CFO) 

• Evaluation “rating official” (e.g. bureau head, other official) 

• Evaluation “reviewing official” (if used) 

Whether [agency) CIO identifies this bureau CIO as a “key bureau CIO” and thus requires the [agency) 

CIO to provide the rating official input into the agencywide critical element(s) described in N1. 

The NRC does not have a bureau CIO construct. As noted in M1, program offices responsible for 

mission and business functions participate through the IT governance process in planning the 

strategy, budget, and deployment plans for those systems supporting their mission and business 

functions. However, a list of IT staff located in the program and regional offices is provided in O2 for 

context and reference. 

O2. Bureau IT Leadership Directory. CHCO will work with CIO to develop the Bureau IT Leadership 

Directory as described in O1. 

The NRC does not have bureau IT leadership or senior level management with “CIO-like” 

responsibilities. The following individuals have IT responsibilities within their programs as described in 

M1, but the responsibilities are distributed such that programs do not have a single individual serving in 

the role of a Bureau CIO. 

Office of Administration 

ADM TEAM LEADER (2) GG 2210

ADM SENIOR PROJECT MANAGER GG 2210

ADM INFORMATION TECHNOLOGY SPECIALIST (2) GG 2210

ADM ACQUISITION DATABASE MANAGER GG 2210

ADM SENIOR IT SYSTEM ANALYST GG 2210

Atomic Safety and Licensing Board Panel 

ASLBP IT SPECIALIST (SYSADMIN/SYSANALSIS) GG 2210

ASLBP IT SPECIALIST (SYSANALYSIS/DATAMGT) (2) GG 2210

Office of the Chief Financial Officer 

CFO SENIOR SYSTEMS ANALYST (5) GG 2210

CFO IT SPECIALIST GG 2210

CFO SYSTEMS ANALYST GG 2210

CFO SR IT SPECIALIST (PROJECT MANAGER) GG 2210

Office of Nuclear Material Safety and Safeguards 

NMSS IT SPECIALIST (SYSANALYSIS) (2) GG 2210

NMSS IT SPECIALIST GG 2210
23 

NMSS IT SPECIALIST (PROJECT MANAGER) GG 2210

Office of New Reactors 

NRO IT PROJECT MANAGER GG 2210

NRO IT SPECIALIST (SYSANALYSIS) (2) GG 2210

NRO IT PROJECT MANAGER (2) GG 2210

Office of Nuclear Reactor Regulation 

NRR SENIOR INFORMATION TECHNOLOGY SPEC GG 2210

NRR IT SPECIALIST GG 2210

NRR SENIOR IT SPECIALIST (2) GG 2210

Office of Nuclear Security and Incident Response 

NSIR IT SPECIALIST (PROJECT MANAGER) GG 2210

NSIR IT PROJECT MANAGER GG 2210

NSIR IT SPECIALIST (INFOSEC) GG 2210

NSIR CYBER SECURITY SPECIALIST GG 2210

NSIR IT SPECIALIST (PLCYPLN) GG 2210

NSIR IT SPECIALIST (INFOSEC) GG 2210

Office of the Chief Human Capital Officer 

OCHCO IT SPECIALIST (PROJECT MANAGER) GG 2210

OCHCO IT SPECIALIST (SYSADMIN) GG 2210

OCHCO IT PROJECT MANAGER GG 2210

OCHCO IT SPECIALIST (SYSANALYSIS) GG 2210

Office of the General Counsel 

OGC INFORMATION MANAGEMENT SPECIALIST GG 2210

Office of Investigations 

OI INFORMATION TECHNOLOGY SPECIALIST GG 2210

Region I 

R-I IT SPECIALIST (4) GG 2210

R-I INFO SYSTEMS SECURITY ANALYST GG 2210

Region II 

R-II IT SPECIALIST (4) GG 2210

R-II INFO. SYSTEMS SECURITY/SAFETY OFFICER GG 2210

Region III 

R-III INFO SYSTEMS SECURITY OFFICER GG 2210

R-III IT SPECIALIST (COMMUNICATIONS) GG 2210

R-III IT SPECIALIST (2) GG 2210

R-III IT SPECIALIST (CUSTSPT) GG 2210

R-III IT SPECIALIST (APPSW/DATAMGT) GG 2210

Region IV 

R-IV IT SPECIALIST (3) GG 2210

R-IV INFORMATION TECHNOLOGY SPECIALIST GG 2210
24 

R-IV IT SPECIALIST (NETWORK/CUSTSPT) GG 2210

R-IV INFORMATION TECHNOLOGY TEAM LEADER GG 2210

R-IV IT SPECIALIST (INFOSEC) GG 2210

Office of Nuclear Regulatory Research 

RES SR IT SPECIALIST GG 2210

RES IT SPECIALIST GG 2210

P1. IT Workforce. The CIO and CHCO will develop a set of competency requirements for IT staff, 

including IT leadership positions, and develop and maintain a current workforce planning process to 

ensure the department/agency can (a) anticipate and respond to changing mission requirements, (b) 

maintain workforce skills in a rapidly developing IT environment and (c) recruit and retain the IT talent 

needed to accomplish the mission. 

The NRC contracted with an independent contractor to conduct an agencywide IT workforce training 

needs assessment to identify competency areas that needed to be strengthened and the associated 

learning needs. The assessment approach included interviews with internal and external subject 

matter experts, review of NRC relevant documents, and a review of best practices from other Federal 

agencies. 

The IT workforce training needs assessment identified general and technical competencies as well 

as the associated training needed for various IT positions throughout the agency. As a result of the 

assessment, OCIO in partnership with OCHCO identified existing internal and external training 

courses that mapped to the competencies identified. OCHCO continues to work with OCIO to identify 

off-the-shelf training courses and when possible, offer them through the NRC’s Professional 

Development Center. 

P2. IT Workforce. CIO, CHCO, and CAO where relevant-shall develop a set of competency 

requirements for IT staff, including IT leadership positions, and develop and maintain a current 

workforce planning process to ensure the department/agency can (a) anticipate and respond to 

changing mission requirements, (b) maintain workforce skills in a rapidly developing IT environment, 

and (c) recruit and retain the IT talent needed to accomplish the mission. 

OCHCO has worked with OCIO in a variety of ways to enhance the workforce planning effort 

including: streamlining of position descriptions, development of the FY 2016 staffing plan and review 

of current workforce structure. It is also in the process of conducting a surplus/gap analysis. 

Position Descriptions: In 2013, all of the position descriptions (PDs) in the OCIO were reviewed and 

updated. The agency was able to take approximately 260 PDs that were in existence and narrow 

them down to 105 standardizing PDs where applicable. The NRC will continue to review PDs to 

ensure consistency across like positions. 

Staffing Plan: OCHCO issued FY 2016 staffing plan guidance to offices to ensure that the staffing 

plans reflect the right mix of employee skills, grades, and numbers to accomplish the agency’s 

mission in an effective and efficient manner. OCHCO collaborated with OCIO to develop their staffing 

plan. 

Analysis of Current Workforce: OCHCO is in the midst of analyzing the current workforce in 

partnership with OCIO, with the following objectives in mind: determining what the current resources 

are and how they will evolve over time; identifying workforce sectors (agency staff, contractors, etc.) 

that are present and assessing their contribution, determining whether the current grade structure is 

appropriate; and determining if the skills of the current workforce meet current mission needs. Once 
25 

all of the data has been compiled, the agency will begin working toward identifying future workforce 

needs. 

Gap/Surplus Analysis: OCHCO is also working with OCIO to determine what gaps exist between the 

current and desired projected workforce. The analysis will be completed in the first quarter of FY 

2016. 

OCHCO will continue to partner with OCIO on strategic workforce planning and will present findings 

and recommended solutions to the CIO for approval. 

Q1. CIO responsibilities. CIO reports to agency head (or deputy/COO). As required by the 

Clinger-Cohen Act and left in place by FITARA, the CIO “shall report directly to such agency head to 

carry out the responsibilities of the agency under this subchapter.” 

This provision remains unchanged, though certain agencies have since implemented legislation under 

which the CIO and other management officials report to a COO, Undersecretary for Management, 

Assistant Secretary for Administration, or similar management executive ; in these cases, to remain 

consistent with the Clinger-Cohen requirement as left unchanged by FITARA, the CIO shall have direct 

access to the agency head (i.e., the Secretary, or Deputy Secretary serving on the Secretary’s behalf) 

regarding programs that include information technology. 

The CIO reports directly to the EDO, who serves as the NRC’s COO. In addition, the CIO has direct 

access to the Chairman and Commission as needed, but at least quarterly through scheduled 

periodic meetings. 
26 

NRC Common Baseline Self-Assessment OMB asked agencies to provide ratings in each area of the self-assessment based on the following overall rating de

1: Incomplete – Agency has not started development of a plan describing the changes it will make to ensure baseline FITARA responsibilities are in place by December 31, 2015. 2: Partially Addressed – Agency is working to develop a plan describing the changes it will make to ensure t

FITARA responsibilities are in place by December 31, 2015. 3. Fully Implemented – Agency has developed and implemented its plan to ensure that all common baseline 

are in place. 

Please note that it is not the intent of the NRC to indicate that it is as mature as possible by providing a self-assess

category. Instead, such a rating is provided to denote that the agency believes it is in full alignment with the guidancFITARA Common Baseline. In the true spirit of CPIC, the agency uses its evaluate process to continuously improve and maintain the appropriate levels of oversight and governance to ensure the most effective use of its IT resource

mission to protect the safety and security of the public. The maturity of the NRC’s investment and portfolio manage

to grow as lessons learned are performed and additional improvements are adopted. Also, please note that all approved IT policy, processes and governance board charters reference in the NRC ComAssessment and Plan are posted publicly to the NRC IT Policy Archive at http://www.nrc.gov/public-involve/open/di

archive.html. In cases where documents are being updated to reflect changes based on lessons learned and/or FITimplementation, the NRC has provided a rating of 2; they will be posted upon final approval by the CIO. All publishedirectives (MD) are posted at http://www.nrc.gov/reading-rm/doc-collections/management-directives/; however it shpolicy documents and MDs referenced are being updated to reflect recent organizational changes effective Novem
27 

Overall 

Rating 

(1-3)* Agency Explanation for Overall Rating Agency Action Plans (provide for ratings of 1 & 2) Agency Evidence 

(prov

Budget Formulation and Planning. FITARA: “The CIO has a significant role in the decision processes for all annual and multi-year planning, programming, budgetingA 2 

In 2014, IT/IM resources across the U.S. Nuclear Regulatory Commission (NRC) were collected and centralized into the IT/IM product line. The objective of this centralization was to create greater transparency with regard to the expenditure of IT/IM resources across the agency and to facilitate the prioritization of agencywide IT/IM resources. The centralization of the IT/IM resources was accompanied by the centralization of the IT budget formulation process into the Office of the Chief Information Officer (formally known as the Office of Information Services). This centralization required that the OCIO facilitate the budget formulation process from data collection through approval and that it serve as the central point of contact for the management of the IT/IM budget. Since 2014, OCIO has gained a number of lessons learned through the implementation of the budget formulation process that have resulted in a set of best practices as well as a set of rules and expectations for the formulation of the agency’s IT/IM budget. These rules and expectations have provided the basis for a new set of IT/IM budget formulation policies which will provide greater consistency to support the formulation and management of the agency’s IT/IM budget. Under the authority designated by the Chief Information Officer (CIO), the IT/IM Budget Team has been charged to develop and implement the policies found here within as a supplement to the budget guidance provided by the Office of the Chief Financial Officer (OCFO). This IT/IM budget guidance represents the IT budget guidance as set forth by the OCIO in collaboration with the OCFO under the joint direction provided by the CIO and CFO. 

 See response to A1 in the NRC’s Common Baseline Implementation Plan. The NRC IT/IM budget guidance is going through the agency concurrence process for final approval by the CIO. Once approved, it will be made publicly available under ADAMS Accession No. ML15300A002 and posted to the NRC IT Policy Archive.

The NRC’s Capital Planning and Investment Control Process, the supplement to the NRC’s Capital Planning and Investment Control Policy and Process Overview, is in concurrence. Upon CIO approval, it will be issued under ADAMS Accession No. ML15260A904 and posted to the NRC IT Policy Archive.

B 3 

The CIO works with the CFO, CAO, and program leadership on the overall IT portfolio and the budget request submission for all programs that include IT resources. 

 Through IPEC roles, the 

CAO, and program leadeassociated IT resources budget request for consiCIO continues to work wrefine the budget proposCommission for vote. See the IPEC charter po

Note that this charter is bchanges. 
28 

Overall 

Rating 

(1-3)* Agency Explanation for Overall Rating Agency Action Plans (provide for ratings of 1 & 2) Agency Evidence 

(prov

C 2 

The current versions of the NRC’s IPEC and SSG charters, CPIC Policy and Process Overview, and TechStat Policy posted at NRC IT Policy Archive. Note 

that all these documents are being updated to reflect organizational changes effective November 1, 2015. 

See response to C1 and C2 in the NRC’s Common Baseline Implementation Plan. The NRC IT/IM budget guidance is going through the agency concurrence process for final approval by the 

CIO. Once approved, it will be made publicly available under ADAMS Accession No. ML15300A002 and posted to the NRC IT Policy Archive.

The NRC’s Capital Planning and Investment Control Process, the supplement to the NRC’s Capital Planning and Investment Control Policy and Process Overview, is in concurrence. Upon CIO approval, it will be issued under ADAMS Accession No. ML15260A904 and posted to the NRC IT Policy Archive.

D 2 

The CIO and CFO work jointly on the IT budget throughout the agency’s budget formulation process. As IPEC Co-Chairs, they approve and certify the IT portfolio, including the major investments. All final CPIC documents are reviewed by the CIO for approval to submit to OMB with the agency’s overall budget request. See the NRC’s IPEC charter posted at the NRC IT Policy 

Archive. Note that this charter is being updated to reflect organizational changes. 

See response to D1 in the NRC’s Common Baseline 

Implementation Plan. The NRC IT/IM budget guidance is going through the agency concurrence process for final approval by the 

CIO. Once approved, it will be made publicly available under ADAMS Accession No. ML15300A002 and posted to the NRC IT Policy Archive.

The NRC’s Capital Planning and Investment Control Process, the supplement to the NRC’s Capital Planning and Investment Control Policy and Process Overview, is in concurrence. Upon CIO approval, it will be issued under ADAMS Accession No. ML15260A904 and posted to the NRC IT Policy Archive.

Acquisition and Execution. FITARA: “The CIO has a significant role in the decision processes for all annual and multi-year planning, programming, budgeting, and e

governance and oversight processes related to IT; and certifies that IT investments are adequately implementing incremental development as defined in OMB capital p

E 2 

The CIO has established ongoing processes to regularly engage with program managers to evaluate IT resources supporting agency strategic objective as describe in E1 

and E2. Formal documentation of processes are in concurrence. 

See response to A1 in the NRC’s Common Baseline Implementation Plan. The NRC’s Capital Planning and Investment Control Process, the supplement to the NRC’s Capital Planning and Investment Control Policy and Process Overview, is in concurrence. Upon CIO approval, it will be issued under ADAMS Accession No. ML15260A904 and posted to the NRC IT Policy Archive.
29 

Overall 

Rating 

(1-3)* Agency Explanation for Overall Rating Agency Action Plans (provide for ratings of 1 & 2) Agency Evidence 

(prov

F 2 

The following policy documents supporting the plan are either in development or in concurrence: The NRC IT/IM budget guidance is going through the agency concurrence process for final approval by the CIO. 

Once approved, it will be made publicly available under ADAMS Accession No. ML15300A002 and posted to the NRC IT Policy Archive.

MD 4.8, Budget Execution and MD 4.X, Budget Formulation are in development and will be posted to http://www.nrc.gov/reading-rm/doccollections/management-directives/ once approved. 

As discussed in F1, the NRC plans to finalize and release the draft IT/IM resource review policy in January 2016. Beginning in February 2016, the NRC’s CPIC staff, with support from the OCFO, will present the results of the first FY 2016 quarterly review to the executive-level ITB for concurrence. Through FY 2016, processes and reporting relating to the quarterly budget execution will continue to be refined and enhanced.

G 2 

The CIO oversees policies for all capital planning, enterprise architecture, and project management and reporting for IT resources, as well as IT policy implementation. The NRC’s CPIC policy and processes are being updated and will be posted to the NRC’s IT 

Policy Archive. 

MD 2.8, Project Management Methodology will be replaced with a new MD 2.X, Integrated Information Technology/Information Management (IT/IM) Governance Framework; however it is currently in concurrence and not expected to be published until the second quarter of FY 2016. The NRC plans to continuously apply lessons learned and best practices to mature its IT investment and portfolio management. As new or updated processes are approved, they will be posted to the NRC’s IT Policy Archive. 

H 2 

The CIO serves as a DAA, an IPEC Co-Chair and a member of the SSG. He also provides oversight for the Deputy CIO, CISO, ITPC, and ITB. 

 The NRC’s IPEC and SS

responsibilities, posted a

I 2 

The CIO, CAO and Deputy CFO are members of the SSG. The CIO also provides oversight for the ITB. An IT Portfolio Council has been established and reports regularly to the SSG on the results of the quarterly spend analysis. The CAO ensures that only staff with appropriate federal acquisition certifications are assigned to contracts. 

While the SSG and ITPC charters are available in the NRC IT Policy Archive, the NRC IT/IM budget guidance 

is going through the agency concurrence process for final approval by the CIO. Once approved, it was be made publicly available under ADAMS Accession No. ML15300A002 and posted to the NRC IT Policy Archive.In addition, formal documentation of the process to assign resources to contracts is underway and will be published to the NRC IT Policy Archive. 
30 

Overall 

Rating 

(1-3)* Agency Explanation for Overall Rating Agency Action Plans (provide for ratings of 1 & 2) Agency Evidence 

(prov

J 3 

The CIO has the authority to recommend modification, termination, or pause of IT projects or initiatives. The CIO is informed in these decisions via several mechanisms. As an IPEC Co-Chair, the CIO plays a lead role in conducting TechStat reviews. A review of any project or investment can be requested at any time based on status reports provided to the CIO on a monthly basis as part of monthly updates and CIO evaluations submitted to the ITDB. The CIO meets with the IPTs of each major investment at least annually. The purpose of these reviews are to have open conversations with program managers about the status of each major investment with special focus on current performance; current project cost, schedule, milestones, and deliverables; and future plans or strategies. The CIO also serves as a DAA, and has formal responsibility for approving, modifying or terminating the operation of an IT system in accordance with FISMA and NIST guidelines. 

The CIO is provided the investments on a monthlreview and update proceinform CIO evaluations. changes are significant eminimum, quarterly to enreflected on the ITDB. In review of any project or iminimum, the CIO meets least once a year througIn addition, the NRC poliinvestment with high-risk TechStat sessions are hby the CIO and CFO. Thmodification, terminationSee the NRC’s TechStat 

Archive.

K 2 

The CIO, CAO and Deputy CFO are members of the SSG. The CIO also provides oversight for the ITB. The CAO ensures that all IT requirements provide proof of approval from one of the IT governing bodies. 

While the SSG and ITPC charters are available in the NRC IT Policy Archive, the NRC IT/IM budget guidance 

is going through the agency concurrence process for final approval by the CIO. Once approved, it was be made publicly available under ADAMS Accession No. ML15300A002 and posted to the NRC IT Policy Archive, In addition, formal documentation of the process regarding proof of approval for IT requirements is underway and will be published to the NRC IT Policy Archive, 

L 2 

Requests for Chairman and Commission approval on reprogramming requiring Congressional approval are prepared by the OEDO in conjunction with the OCFO. As an IPEC Co-Chair, the CIO approves significant IT reallocations on an ongoing basis during the year of execution. In the DEDO role, the CIO authorizes the reprogramming request requiring Congressional approval before it is submitted to the Chairman and Commission for approval. 

As discussed in L1, the NRC plans to release the policy for execution year IT/IM budget changes in January 2016. Through FY 2016, processes and reporting to facilitate execution of re-allocations based on the policy described above, will be refined and enhanced. Additionally, the NRC’s new Budget Execution Management Directive (MD 4.8), currently under review by the EDO, clearly outlines the role of the CIO in the reallocation of IT related resources during budget execution. 

Organization and Workforce. FITARA: “The CIO reports to the agency head (or deputy/COO) and assesses the requirements established for agency personnel rega

information resources management and the adequacy of those requirements for facilitating the achievement of the established IRM performance goals; and assesses tpersonnel at the executive and management levels meet those requirements.”

M NA 

No rating has been provided because the NRC does not have bureau CIOs or staff with “CIO-like” responsibilities. See M1 and O2 in the NRC’s Common Baseline Implementation Plan for a description of and list of IT positions outside of OCIO. 

Not applicable. Not applicable.
31 

Overall 

Rating 

(1-3)* Agency Explanation for Overall Rating Agency Action Plans (provide for ratings of 1 & 2) Agency Evidence 

(prov

N NA 

No rating has been provided because the NRC does not have bureau CIOs or staff with “CIO-like” responsibilities. See M1 and O2 in the NRC’s Common Baseline Implementation Plan for a description of and list of IT positions outside of OCIO. Even though there is no senior level IT management in the program or regional offices for which the CIO should provide input into critical elements or appraisals, the CIO and CHCO will continue to work jointly on the position descriptions and qualifications of the 2210 series for the entire agency. 

Not applicable. Not applicable.

O NA 

No rating has been provided because the NRC does not have bureau CIOs or staff with “CIO-like” responsibilities. See M1 and O2 in the NRC’s Common Baseline Implementation Plan for a description of and list of IT positions outside of OCIO. 

Not applicable. Not applicable.

P 1 

The agency is developing the FY 2016 staffing, but still needs to perform a gap analysis to assess critical skill needs. An implementation plan will be based on results of the gap analysis and the approved solutions. 

As discussed in P1, the gap analysis will be completed in the first quarter of FY 2016. An implementation plan will be based on results of the gap analysis and the approved solutions. 

Q 3 

The CIO reports directly to the EDO, who serves as the NRC’s COO. In addition, the CIO has direct access to the Chairman and Commission as needed, but at least quarterly through scheduled periodic meetings. 

 MD 9.17, Organization a

Director for Operations, Because of a reorganizaNovember 1, 2015, MD 9the elimination of and disresponsibilities of the DEdirectly to the EDO/COO MD 9.17. An updated orgon the NRC’s public Web MD 9.17 can be viewed http://pbadupws.nrc.gov/
Appendix A: Definitions of Terms for Purposes of this Guidance 

Agency CIO The Chief Information Officer at the headquarters level of a department or establishment of the government as 

defined in Section 20 of OMB Circular A-11 (contrast with ‘bureau CIO’). 

Bureau CIO

Official with the title or role of Chief Information Officer within a principal subordinate organizational unit of the 

agency, as defined in Section 20 of OMB Circular A-11, or any component organization of the agency (contrast 

with ‘agency CIO’). 

Major IT 

Investment 

An IT investment requiring special management attention because of its importance to the mission or function to 

the government; significant program or policy implications; high executive visibility; high development, operating, 

or maintenance costs; unusual funding mechanism; or definition as major by the agency’s capital planning and 

investment control process. Agencies should also include all “major automated information system” as defined 

in 10 U.S.C. 2445 and all “major acquisitions” as defined in the OMB Circular A-11 Capital Programming Guide 

consisting of information resources. OMB may work with the agency to declare IT investments as major IT 

investments. Agencies must consult with assigned OMB desk officers and resource management offices 

(RMOs) regarding which investments are considered “major.” Investments not considered “major” are “nonmajor ”

Reprogramming Any movement of funds for IT resources that requires Congressional notification. 

Adequate 

Incremental 

Development

For development of software or services, planned and actual delivery of new or modified technical functionality 

to users occurs at least every six months. 

Information 

Technology

As described in Section A above: 

(1) Any services or equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in 

the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, 

control, display, switching, interchange, transmission, or reception of data or information by the agency; 

where 

(2) such services or equipment are ‘used by an agency’ if used by the agency directly or if used by a 

contractor under a contract with the agency that requires either use of the services or equipment or 

requires use of the services or equipment to a significant extent in the performance of a service or the 

furnishing of a product. 

(3) The term “information technology” includes computers, ancillary equipment (including imaging peripherals, 

input, output, and storage devices necessary for security and surveillance), peripheral equipment designed 

to be controlled by the central processing unit of a computer, software, firmware and similar procedures, 

services (including provisioned services such as cloud computing and support services that support any 

point of the life cycle of the equipment or service), and related resources. 

(4) The term “information technology” does not include any equipment that is acquired by a contractor 

incidental to a contract that does not require use of the equipment. 

IT Resources

As described in Section A above: 

All agency budgetary resources, personnel, equipment, facilities, or services that are primarily used in the 

management, operation, acquisition, disposition, and transformation, or other activity related to the life cycle of 

information technology; acquisitions or interagency agreements that include information technology and the 

services or equipment provided by such acquisitions or interagency agreements; but does not include grants to 

third parties which establish or support information technology not operated directly by the Federal 

Government. 

“Shadow IT” or 

“Hidden IT”

Refers to spending on IT that is not fully transparent to the agency CIO and/or IT resources included as a 

portion of a program that is not primarily of an “information technology” purpose but delivers IT capabilities or 

contains IT resources. For example, a grants program that contains a portion of its spending on equipment, 

systems, or services that provide IT capabilities for administering or delivering the grants. 

Contract

A mutually binding legal relationship obligating the seller to furnish the supplies or services (including 

construction) and the buyer to pay for them. It includes all types of commitments that obligate the Government 

to an expenditure of appropriated funds and that, except as otherwise authorized, are in writing. In addition to 

bilateral instruments, contracts include (but are not limited to) awards and notices of awards; job orders or 

task letters issued under basic ordering agreements; letter contracts; orders, such as purchase orders, under 

which the contract becomes effective by written acceptance or performance; and bilateral contract 

modifications. Contracts do not include grants and cooperative agreements covered by 31 U.S.C. § 6301, et 

seq. For discussion of various types of contracts, see Part 16. – FAR definitions