,.

. .~.. ..~-. i~l( .~ ,:I.

~ j.'~.

--

-
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

TABLE OF CONTENTS

MESSAGE FROM THE CHIEF INFORMATION OFFICER 1

1.0 INTRODUCTION 2

2.0 IT STRATEGY 0VERVIEW 3

2.1 DEPARTMENTOFENERGYMISSION 3

2.2 DEPARTMENTOFENERGYINFORMATIONTECHNOLOGYVISION 3

2.3 STRATEGICGOALSOVERVIEW 3

3.0 IRM 0 UTL00 K 5

3.1 IDENTIFYTARGETOPPORTUNITIES 5

3.2 IT INVESTMENTPORTFOLIO 5

3.3 ORGANIZATIONOFTHEDEPARTMENT 6

4.0 IRM STRATEGIC GOALS 8

4.1 GOAL1: SIMPLIFYACCESSTODOE INFORMATIONANDPRODUCTS 8

Objective 1: Partner and Support the Presidential e-Government Initiatives 8

Objective 2: Support the Department's e-Government Activities 9

4.2 GOAL2: INSTITUTEA ROBUSTINFORMATIONTECHNOLOGYGOVERNANCEPROGRAMWITHINDOE 9

Objective 1: Enhance Capital Planning and Investment Control (CPIC) Processes for IT 9

Objective 2: Maintain a Complete, Mature Enterprise Architecture 10

Objective 3: Ensure Effective Information Technology Project Performance 11

Objective 4: Implement Enterprise Licensing 12

Objective 5: Recruit, Develop, and Retain a Qualified, Professional IT Workforce 12

4.3 GOAL 3: IMPROVE CYBER SECURITY BY REDUCING THE NUMBER OF VULNERABILITIES AT DOE 13

Objective 1: Improve the Information Security Posture and Reduce the Cyber Security

Vulnerabilities of the Department by Improving Compliance with FISMA and All

Other Cyber-Security Government-Wide Regulations, Policies, and Procedures 13

Objective 2: Implement a Comprehensive DOE-Wide Security Management Program to Improve

Cyber Security 13

Objective 3: Implement a Comprehensive Vulnerability Management Program to Identify and

Mitigate Vulnerabilities in DOE Information Systems 14

APPENDIX A: STRATEGIC IT INITIATIVES 15

APPENDIX B: DOE E-GOVERNM ENT PARTICIPATION 17

APPENDIX C: LIST 0 F ACRONYMS 18

DOE IRM Strategic Plan
U.S.Departmentof Energy.

OfficeoftheChiefInformationOfficer

IRM Strategic Plan

FY 2006-2008

MESSAGE FROM THE CHIEF INFORMATION OFFICER

I am pleased to present the Department's FY 2006-2008 Information Resources Management (IRM)

Strategic Plan. This plan represents a vision for utilizing information management resources to effectively

meet the Nation's Energy and National Security challenges.

The IRM Strategic Plan outlines the information technology (IT) strategic goals, outcomes, and the means

for accomplishing these goals over the next three years. Through employing e-business technologies,

protective cyber security controls, enterprise architecture principles, effective portfolio management, and

strategic human capital practices, the Department is better positioned for implementing effective

information resources management processes and addressing future IT challenges. The IRM Strategic

Plan communicates the IT strategies as they link to the overall Departmental Strategic Plan and, thereby,

ensures proper guidance and technological support to accomplish DOE's critical-mission requirements.

In addition to supporting DOE's immediate IT needs, the IRM Strategic Plan also outlines a strategy for

supporting government-wide initiatives documented in the President's Management Agenda,

e-Government Strategies, and Homeland Security Strategies. By working collaboratively, the Department

can meet its program needs, support its customers, and utilize IT to further its mission.

~~ Q~L

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

1.0 INTRODUCTION

The Chief Information Officer (CIO) at the U.S. Department of Energy (DOE) has primary responsibility to

ensure that Information Technology (IT) is acquired and information resources are managed in a manner

consistent with statutory, regulatory, and Departmental requirements and priorities. With this

responsibility, the CIO provides information resources management advice and assistance to the

Secretary of Energy and to other senior managers. The CIO also coordinates and articulates a shared

vision and corporate perspective among the Department's information activities, which permits the CIO to

champion Departmental initiatives that effectively manage information and provide for value-added

corporate systems. It is in this capacity that the CIO has prepared and now presents DOE's Information

Resources Management (IRM) Strategic Plan for FY 2006 - 2008.

Strategic planning is the process by which the Office of the Chief Information Officer (OCIO) determines

its future direction, identifies the resources and transformational agenda needed to meet that direction

and establishes an accountability system by which to manage progress towards that direction. The IRM

Strategic Plan serves as the strategic document for the OCIO, and it builds from the operational and

tactical plans of each OCIO element ranging from IT human resources to e-Government. The IRM

Strategic Plan describes what will be done over the next three years, while the tactical and operational

plans execute the strategy and describe how these goals will be accomplished. Together, these plans

permit the OCIO to more effectively know if its efforts are accomplishing its strategic goals, objectives,

and outcomes, thereby supporting DOE in its efforts to meet its mission.

In addition to this internal focus, DOE recognizes the need to integrate external policy directions as

defined by Congress and the Administration into its IT initiatives. The DOE IRM Strategic Plan responds

to the Government Paperwork EliminationAct (GPEA) of 1998, the e-Government Act of 2002, the

Clinger-Cohen Act of 1996, the Federal Information Security ManagementAct (FISMA), Office of

Management and Budget (OMB) Circular A-130, the Government Performance Results Act of 1993, the

Federal Enterprise Architecture, and the President's ManagementAgenda (PMA).

The scope of the IRM Strategic Plan addresses all information resource elements including, but not

limited to: Business and Information Management, IT Human Resource Management, Enterprise

Architecture, Capital Planning and Investment Control (CPIC), Cyber security, IT Operations, and eGovernment. The scope also includes all DOE locations: Federal sites, laboratories, and management

and operational facilities.

The OCIO recognizes that the success of an organization goes beyond just identifying an IT strategy.

The strategy must be envisioned, accepted, aligned, communicated and governed within the

organization. A strategy-focused organization links IT strategy with internal processes to deliver value to

the organization. The following sections of this Strategic Plan identify the primary IT strategic goals and

objectives for the Department and the means for achieving these goals.

2

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

2.0 IT STRATEGY OVERVIEW

2.1 Department of Energy Mission

DOE is responsible for fulfilling its mission of

"advancing the national, economic, and energy security of the United States; promoting scientific

and technological innovation in support of that mission; and ensuring the environmental cleanup

of the national nuclear weapons complex."

2.2 Department of Energy Information Technology Vision

DOE'sITVisionaimsto affectgovernanceandprocessesinorderto provideaccessto modern,reliable,

andsecureIT infrastructureandsystemsto supportandenhanceDOE'smissioninthe21st century.

2.3 Strategic Goals Overview

DOE views IRM as a critical component in achieving the Department's Mission, Strategic Goals, the PMA

initiatives, e-Government strategies, and Homeland Security strategies. The OCIO has carefully selected

IRM Strategic Goals and Objectives that reflect the Department's commitment.

Figure 1 - Information Resources Management Strategic Goals

Strategic Goal 1: Simplify access to DOE information and products

Objective 1:

Objective 2:

Strategic Goal 2:

Objective 1:

Objective 2:

Objective 3:

Objective 4:

Objective 5:

Strategic Goal 3:

Objective 1:

Objective 2:

Objective 3:

Partner and support the Presidential e-Government Initiatives.

Support the Department's e-Government activities.

Institute a robust IT governance program within DOE

Enhance CPIC processes for Information Technology.

Maintain a complete, mature enterprise architecture.

Ensure effective IT project performance.

Implement enterprise licensing.

Recruit, develop, and retain a qualified, professional IT workforce.

Improve cyber security by reducing the number of vulnerabilities at

DOE

Improve the information security posture and reduce the number of

vulnerabilities of the Department by improving compliance with FISMA and

all other cyber-security Government-wide regulations, policies and

procedures.

Implement a comprehensive DOE-wide security-management program to

improve cyber security.

Implement a comprehensive vulnerability management program to identify

and mitigate vulnerabilities in DOE information systems.

DOE IRM Strategic Plan

3
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

In accordance with OMB Circular A-13O,DOE's IRM Strategic Plan supports the Department's strategic

goals and direction. The IRM Strategic Plan provides a description of how information resources

management activities help accomplish the Department's mission and ensures that IRM decisions are

integrated with organizational planning, budget, procurement, financial management, human resources

management, and program management.

In September 2003, the Department released a new Strategic Plan that will meet the Nation's Energy and

National Security challenges. The DOE Strategic Plan provides direction for the next 25 years by

"focusing our capabilities to meet today's needs and provide innovative solutions to tomorrow's

challenges." The Department has further integrated the Strategic Plan's long-term and intermediate goals

into the annual performance budget. This performance structure establishes a concrete link between the

Strategic Plan's goals and the Department's annual budgets, performance metrics, and performance

reporting. Table 1 below illustrates the strategic goal for each of the four business lines to which the

performance structure ultimately aligns.

Table 1 - Alignmentof DOEBusiness Linesand Strategic Goals

By aligning the IRM Strategic Goals to the Department's Strategic Goals, the IRM activities are positioned

to support the Department's mission and can be integrated within the overall DOE performance structure.

This integration further solidifies IRM activities throughout organizational planning, budget, procurement,

financial management, human resources, and program processes. Table 2 below illustrates how the IRM

Strategic Goals link to the Department's Strategic Goals.

Table2 - DOEIRMStrategic Goalsto DOE'sStrategic Goals

1 Note that "Direct"indicates that the IRM Strategic Goal provides direct support (i.e., the support provided can be related to

information explicitly stated in DOE Business Line Strategic Goal). "Crosscutting" indicates that the IRM Strategic Goal provides

crosscutting support (i.e., the support provided supports all goals and is not directly attributable to only one Business Line.)

4

DOE IRM Strategic Plan

DOE Business DOE Strategic Goal

Lines

Defense To protect our national security by applying advanced science and nuclear

technoloav to the nation's defense.

Energy To protect our national and economic security by promoting a diverse supply and

deliverv of reliable. affordable and environmentallv sound enerav.

Science To protect our national and economic security by providing world-class scientific

research caoacitv and bv advancina scientific knowledne.

To protect the environment by providing a responsible resolution to the

Environment environmental legacy of the Cold War and by providing for the permanent disposal

of the Nation's hiah-Ievel radioactive waste.

IRM Strategic Goal DOE Business Line Strateaic Goals 1

Defense Enerav Science Environment

Simplify access to DOE Direct Direct Direct Direct information and products

Institute a robust IT

governance program within Crosscutting Crosscutting Crosscutting Crosscutting

DOE

Improve cyber security by

reducing the number of Direct Direct Direct Direct

vulnerabilities at DOE
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

The next section provides a detailed background on how DOE utilizes the IRM Strategic Plan to ensure

its IRM planning, decisions, management responsibilities, and accountability are positioned to meet the

Department's present and future needs.

3.0 IRM OUTLOOK

3.1 Identify Target Opportunities

As a companion to IRM strategic planning, DOE developed an Enterprise Architecture (EA) framework

that identifies opportunities for management to leverage both strategic and operationallRM planning

activities. Through utilizing its EA, DOE can identify and analyze "points of entry" (e.g., number of

investments supporting a business line/sub function) that can result in recommendations for long-term

savings and increased efficiency. The EA is also aligned with the annual budget cycle and provides

updates that further define the baseline and target architectures based on decisions made in the IT

investment portfolio selection process (part of IT CPIC). The framework operates to reduce performance

gaps in the overall portfolio by retiring obsolete systems, developing e-Government solutions that

incorporate greater quality and access, and supporting the development of reusable application

components.

Overall, DOE's EA guides both the strategic and operationallRM planning activities through its baseline

and target oversight as well as its integration with other Departmental processes. As the section below

illustrates, these parallel and integrated processes enable the Department to best select, align and

maximize its IT portfolio to fulfill its mission.

3.2 ITInvestment Portfolio

IRM strategic planning and establishing the EA targets/standards precedes the selection of IT

investments to ensure that annual investments and operations fully support established organizational

goals and directions. The annual selection of IT investments is done in concert with the budgetformulation process under the direction of the CIO and the Chief Financial Officer (CFO) so that IT

investment needs and requests are fully integrated into DOE's annual budget request.

Each year, the Department selects IT investments that meet mission needs, close performance gaps,

align with EA targets, and align with external drivers such as Government-wide e-Government initiatives.

DOE's IT investment activities exceed $2.9 billion per year, constituting approximately 4% of the total

Federal budget expended on IT investments. Figure 2 and Table 3 show the breakout of DOE's FY 2006

IT portfolio based on DOE strategic goal supported or on cross-cutting/infrastructure activities. In

addition, Appendix A highlights the CIO priorities and strategic initiatives for FY 2006.

5

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

Figure 2 - DOE's FY 2006 ITPortfolio Breakout

Table 3 - DOE Total IT Investments FY 2006 (in Millions)

As indicated in Table 3, 45% of DOE's Total Portfolio can be directly attributed to the four strategic goals.

Conversely, while a large percentage of the IT Portfolio directly supports DOE's strategic goals, a

significant amount of the Department's investments are for cross-cutting capabilities such as networks,

telecommunications, general corporate and staff functions, and cyber-security functions/services. DOE is

demonstrating its ability to meet the needs of individual strategic goals while leveraging opportunities

across DOE to increase efficiency and lower costs.

DOE's IT Portfolio is characterized by a wide array of initiatives ranging in size and sophistication, all of

which are aimed at improving public service and efficiency. The success of an IT initiative and the

Department's portfolio depends on end-to-end management that ensures that DOE accomplishes its

mission and goals while actively pursuing the Federal Government's strategic agenda.

3.3 Organization of the Department

The missions of the Department are accomplished through 23 laboratories and technology centers, four

Power Marketing Administrations, nine Program Offices, 18 Staff Offices, operations and field

organizations located in 13 locations across the United States, the Energy Information Administration,

and the National Nuclear Security Administration. Supporting these entities are over 100,000 federal and

contractor employees. .

6

DOE IRM Strategic Plan

StrategicArea TotalPortfolio

Dollars PercentaQe

Defense $ 838.448 28.95%

Energy $ 68.967 2.38%

Scientific $ 257.167 8.88%

Environment $ 143.873 4.97%

Cross-Cutting $ 1,587.773 54.82%

Total: $ 2,896.228 100%

Derivedfromthe Department'sFY2006OMSExhibit53 submission
u.s. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

Figure 3 - DOE Organizational Structure

DEPARTMENT OF ENERGY

UnderSec_ry fo, NUClea, Secu,ity/ Admlnlatrator fo' National

Nuclea' Security Admlnlsttation

DOE's organizational structure is decentralized and aligned with its multiple missions. Department senior

management provides strategic plans, IRM strategic plans, EA targets, and standards to Program Offices

to guide program planning, decision making, and investing. Program Officials are responsible for

acquiring and implementing approved programs and investments to achieve performance goals. In this

way, the Department ensures that within the decentralized organizational structure, all decisions and

activities continue to support the overall strategic goals of the organization.

The CIO's role is to provide advice and assistance to the Secretary of Energy and other senior managers

to ensure that IT is acquired and information resources are managed in a manner that implements the

policies and procedures of relevant legislation. Within the structure, the Department has established a

strategic plan which guides program, mission and activities. The CIO has established this companion

document, the IRM Strategic Plan, to guide IT acquisition, operations and management. As a result, IT is

fully aligned to support program, missions, and activities.

The IRM Strategic Plan also details a vision of how DOE will use IT to ensure the effective management

and delivery of high-quality information to be used and shared in a secure and cost-effective manner.

The strategy includes goals, objectives, and outcomes to support mission accomplishment, close

performance gaps, and establish a solid infrastructure foundation for the Department. The following

sections detail the IRM strategy for the Department.

7

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

4.0 IRM STRATEGIC GOALS

4.1 Goal 1: Simplify Access to DOE Information and Products

The overarching mission of DOE is to advance the national, economic, and energy security of the United

States; to promote scientific and technological innovation in support of that mission; and to ensure the

environmental cleanup of the national nuclear-weapons complex. Within this program context-in its goal of

simplifying access to DOE's information and products- this IRM strategic goal becomes an enabler to

achieving DOE's mission. The Department will successfully realize this goal through e-Government and its

development of the Department e-Government Strategy.

DOE's e-Government Strategy directly supports the PMA, the Federal Lines of Business initiative, and the

Department's core mission requirements by evaluating and applying new information technologies and

modernizing the way we govern by unifying core applications through a secure environment and simplifying

access to energy-related Government information and services. The goal is to adhere to the three basic

principles established by the PMA:

1. to be Citizen-centered, not bureaucracy or Agency-centered;

2. to be Results-oriented, producing measurable improvements for citizens; and

3. to be Market-based, actively promoting innovation.

Objective 1: Partner and Support the Presidential e-Government Initiatives

DOE continues to support the President's e-Government Initiatives. DOE is an active participant in 19 of 24

of these initiatives. DOE is also involved in the six federal Lines of Business initiatives and is the managing

partner for the Financial Management Line of Business (FM LoB). Finally, DOE is developing an enterprise

IT acquisition program that will govern Department IT acquisitions in accordance with the government-wide

SmartBUY program. DOE recognizes that active partnership in these important initiatives will result in

government cost reductions, improved services to citizens, business-process and technology

standardization, and elimination of duplicative systems.

In DOE's role as managing partner (in conjunction with the Department of Labor) of the FM LoB, DOE is

continuing the efforts to provide streamlined financial management services across the Federal Government.

Through the FM LoB, partner agencies will use EA based principles and best practices, proven through the

e-Gov initiatives and Federal EnterpriseArchitecture (FEA), to implement financial management Centers of

Excellence (COEs) and standardize core financial business processes and data elements across the Federal

Government. The consolidation of each agency's financial systems into centralized COEs will decrease

system redundancy while driving cost savings through full time equivalents (FTE) re-deployment, system

development and operation cost reductions, and process standardization. The end result of the FM LoB

efforts will be to save taxpayer dollars, reduce administrative burdens, and significantly improve financial

management services across the government.

Outcomes:

. Reduced cost of government operations

0 Continueactivepartnershipinthee-Government,Lineof Business,andSmartBUY

initiatives in order to effectuate cost reductions across the government

0 Identify existing DOE investments that align to government-wide initiatives and implement

migration and alignment plans

Streamlined delivery of services and products to the customer

0 Work with customers and federal agency partners to identify ways to more efficiently provide services and information

.

8

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

. Standardized business processes across Agencies

0 Collaboratewithsimilarmissionagenciesto developjoint effortsandpromotebestpractices

across the Federal Government

0 Continueleadershiproleon theFinancialManagementLineof Businessinorderto

standardize core financial business processes and data elements across the Federal

Government

0 Continueto transitionto InternetProtocolVersion6 (IPv6)capabletechnology

Objective 2: Supporl the Deparlment's e-Govemment Activities

DOE continues to experience significant success with its internal e-Government initiatives known as the

Innovative Department of Energy e-Government Applications (IDEA). In a continual effort to become more

effective and efficient, the Department has integrated the Innovative Department of Energy e-Government

Applications (IDEA) project with the Department's EA effort. The EA program will institutionalize semi-annual

strategic portfolio reviews to ensure that the Department's information technology investments are in line with

its strategic goals and missions.

Outcomes:

. Realize cost savings through streamlined information technology activities

Implement change management processes to support organizational realignments to maximize

information technology efficiencies

.

4.2 Goal 2: Institute a Robust Information Technology Governance Program within DOE

Information Technology is a key supporting element in accomplishing DOE goals. As such, it must be

acquired, managed, and used in a way that maximizes its efficiency and effectiveness in supporting

missions. To achieve this, the OCIO has established an IT governance structure and process that enables

sound management of IT assets. This governance structure includes a Departmental IT capital-planning and

investment-control process, EA activity, IT project- and asset-management processes, and enterpriselicensing opportunities to achieve efficiency. Descriptions of objectives, strategies, and outcomes for the IT

governance program are described below.

Objective 1: Enhance Capital Planning and Investment Control (CPIC) Processes for IT

By enhancing the established CPIC process, the Department has the ability to manage its IT investments as

a financial portfolio. Implementing a comprehensive CPIC process ensures that the Department's portfolio of

IT investments adequately addresses DOE's business strategies and are managed to achieve the expected

benefits in accordance with accurate and complete cost, schedule, technical, and performance baselines.

Additionally, monitoring and controlling investments are as important to ensure success as selecting the right

portfolio of projects or investments. Investments are monitored over time and resources are shifted to

investments that perform best, keeping in mind the established investment rules and parameters with regard

to risks and returns. DOE recognizes that effective IT portfolio-management practices result in significant

savings of Departmental annual IT budgets, enhanced efficiency, and increased mission alignment.

To date, the Department has made significant progress in enhancing the CPIC process through the use of

scorecards at the investment-portfolio level and at the Program level. In addition, improved linkages

between IT investments and the annual budget process have been implemented in partnership with the

Office of the CFO. To further leverage these accomplishments, DOE is continuing to review its CPIC

processes in an effort to identify additional opportunities for improvement. The Department envisions a CPIC

process that provides decision-making bodies with the appropriate information to ensure that optimal

decisions are made with regard to the selection and maintenance of the Department's IT portfolio.

9

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

Outcomes:

. Business cases aligned to the Department's missions

0 ImplementIRMStrategicPlanwith"Iine-of-sight"linkagesto DOEStrategicPlan

0 Modifyreview/approvalcriteriafor all majorIT investmentsto includedemonstrated"Iine-ofsight" linkages to appropriate program and strategic plans

0 Documentclosureof performancegapsfacilitatedby IT

. Investment funding aligned to DOE priorities

0 Ensurethatall majorIT investmentsarereviewedandthatdatarelevantto annualIT

selection is provided to the Corporate Review Budget (CRB)

0 Work in partnership with Program Offices and the CFO to identify, align, and redirect funding

for investments targeted for migration to corporate or Government-wide e-Government

initiatives

Objective 2: Maintain a Complete, Mature Enterprise Architecture

DOE is currently undertaking an EA effort to clearly define its business, strategy, performance, technology,

applications, data, and stakeholders that support meeting the Department's mission. While the development

and maintenance of the EA is mandated by OMB, DOE approaches EA as a tool for business transformation

and progress. DOE has steadily built an active EA practice to meet the business needs of the Department.

The EA practice is led by DOE's Chief Architect within the OCIO, but its activities rely heavily on a

partnership with the business and IT communities across the Department.

The development and implementation of an architecture is an ongoing and iterative cycle. With each

iteration of the cycle, DOE's architecture matures and progresses. It is, to some extent, a gradually shifting

target that continually strives to improve upon the current state as dictated by mission requirements. It is one

element in a broader set of inter-related planning activities that collectively enable DOE managers and staff

to define a vision, develop strategies and plans for achieving the vision, make resource decisions, implement

strategies, and evaluate performance. By defining the desired future state from several distinct perspectives

(e.g. business, data, etc.), the Target EA also provides stakeholders with a "line of sight" into the complex

relationships that exist among these different perspectives.

The DOE EA practice will continue to further refine and implement a Target EA through a number of related

and coordinated efforts. The Target EA will evolve through a series of releases or versions. The DOE EA

practice will use the current version of the Target EA as a communication document to begin bringing a

broader community of stakeholders more actively into the discussion about the desired future state for the

Department. This Target EA will also serve as a framework for managing investments and developing

recommendations for improving DOE's IT investment portfolio.

DOE recently completed an EA Transition Strategy to describe the approach the Department will employ to

achieve its target architecture. It will be augmented by Enterprise Architecture Implementation Plans that will

provide greater detail on specific milestones, schedules, resources, and activities associated with the key EA

implementation efforts. This information will evolve over the next few years in order to implement many of

the business and technology changes that are required to support DOE's overarching mission.

Outcomes:

. Identify and implement common solutions and eliminate redundant systems

0 Implement a segment architecture approach that is focused on providing structured business

analysis to achieve improved mission performance

10

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

. Use EA to drive IT investment decisions

0 Use the Target Architecture and Transition Strategy to guide IT investments decision-making

and develop recommendations for improving the IT investment portfolio for the Department

0 Enhance the CPIC select process to better utilize EA information

0 Enhance the IT governance process to ensure that EA information is provided to senior

managers in a timely way to better inform decision making

. Establish a single, consolidated, integrated DOE-wide infrastructure

0 UsetheDOEEAasthecoordinatingmechanismto makeinfrastructureconsolidationand

integration decisions

Objective 3: Ensure Effective Information TechnologyProject Performance

Technology investments provide DOE with the necessary means to achieve its four strategic goals as well as

those goals identified in the PMA. However, as with any type of investment, the success of IT investments

requires thorough planning and effective management throughout the investment life cycle. Currently, the

Department evaluates the business cases on their baseline goals each year to ensure that milestones and

costs are accurately planned and documented. Subsequent to the evaluation of planned baseline goals,

DOE has implemented a quarterly review process that evaluates investments on their ability to achieve the

planned cost, schedule, and performance goals that were established in the business cases. This review

process is facilitated by the OCIO, and the Department's IT Council is responsible for the final investment

evaluations each quarter.

DOE will continue to mature its methodologies for ensuring effective IT project performance by implementing

standardized processes for developing and evaluating baseline goals for investments, as well as enhancing

the quarterly review process for assessing the achievement of those goals. This effort will provide more

stringent reporting requirements and evaluation criteria to ensure that each Program Office is accurately

reporting their baseline goals and performing regular reviews of their investments.

Outcomes:

. Adherence to cost, schedule, and performance targets

0 Developstandardizedrequirementsfor definingcostandschedulebaselinegoalsandfor

reporting actual results

0 Validate that cost and schedule reporting requirements are met during the business-case

reviews that are conducted in support of the annual budget submission process

0 Implement performance-goal reviews during the Select phase that evaluate "line-of- sight"

connections to program plans and the DOE Strategic Plan and also ensure that performance

goals define the current baseline and provide quantifiable measures/metrics

0 Develop an automated template for the quarterly review process that is linked to the Cost and

Schedule table and the Performance Goals table in the Exhibit 300 to improve the ease of

reporting and ensure that the achievement of planned goals is continuously evaluated

throughout the year

0 Institute requirements where IT project managers report monthly cost and schedule variances

0 Certifythe EarnedValueManagement(EVM)activitiesandsystemsusedby majorIT

investments that meet DOE internal e-Government criteria

. Timely decisions on projects in remediation

0 Implementheuseof corrective-actionstrategiesintothequarterlyreviewprocessfor IT

investments that have demonstrated negative performance trends for two quarters or more

0 Provide performance-review data to DOE's senior leaders when investments show continued

performance issues for two or more quarters

0 Adhere to cost, schedule, and performance targets

0 Ensure timely decisions on projects in remediation

0 Verify the validity and the accuracy of EVM data

11

DOE IRM Strategic Plan
u.s. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

Objective 4: Implement Enterprise Licensing

Procuring software licenses that apply across DOE, known as enterprise licensing, consolidates information

technology contracts. DOE achieves contract administration efficiencies by reducing multiple contracts to

one. DOE negotiates a better price by leveraging the Department's total buying power thereby reducing total

cost of ownership and cost for each individual user. Aggregating enterprise software requirements and

having a single contract vehicle facilitates and streamlines software acquisition efforts while achieving the

same level of quality. By implementing these buying practices, acquisitions and support costs will be

reduced, leading to the increase use of standards-compliant software.

Outcomes:

. Leverage buying power

0 Identify opportunities for consolidation of legacy information technology contracts into

Enterprise Licensing Agreements (ELAs) through review and analysis of financial contract

data, asset inventories and the target enterprise architecture

Reduce costs

0 Implement a SmartBUY program in collaboration with the General Services Administration to

assist in negotiation of lower prices for some types of software

Reduce total cost of ownership

0 Identify software through the enterprise licensing program that is widely used across the

Department

.

.

Objective 5: Recruit, Develop, and Retain a Qualified, Professional IT Workforce

DOE recognizes the strategic management challenge required to hire and retain a highly skilled IT workforce

and is working to address the criticality of strengthening human capital as a driver for organizational

effectiveness. The PMA has identified a specific human-capital initiative that is directed toward aligning a

professional workforce in support of a Department's mission, goals, and strategies. DOE has developed

recruitment requirements to focus efforts on identifying qualified candidates who are easily able to adapt to

changes brought about by new technologies. In addition, initiatives have been implemented that focus on

maximizing employee performance by instituting development programs and enrichment opportunities that

motivate and inspire employees. DOE has already made significant progress in the area of human capital

with the implementation of Corporate Human Resource Information System (CHRIS) Workflow.

DOE will continuously strive to maintain a high-performing workforce through enrichment opportunities,

comprehensive training programs, leadership development, and an open culture that promotes the sharing of

intellectual capital and demonstrates high standards of integrity for employees. Because of competitive

sourcing and constantly emerging technologies, a workforce must be maintained that is both easily

adaptable and highly skilled in mission critical competencies.

Outcome:

. Align workforce skills with DOE missions and priorities

0 Implement a new performance-management system to better recognize and reward superior

performance ensuring a high-performing and accountable workforce

0 Implement a performance framework for accountability at the employee level

12

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

4.3 Goal 3: Improve Cyber Security by Reducing the Number of Vulnerabilities at DOE

The rangeof risks confronting the operation of DOE's complex global networks include, but are not

necessarily limited to natural disasters, intentional malicious acts, inadvertent errors, unforeseen

software/hardware conflicts and/or cascading failures from interconnected systems. Risk sources from

malicious actors include foreign powers, terrorist groups and, sadly, occasional corrupt insiders, each of

which can compromise or otherwise do significant damage to DOE classified national security and/or

unclassified systems. As a result, active internal controls are vitally necessary to assure uninterrupted

availability of information system resources; confidentiality and integrity of information systems and their

contents; user authentication and access controls; non-repudiation of identity, and accountability

mechanisms assuring compliance for access to and use of information and data under DOE control.

Objective 1: Improve the Information Security Posture and Reduce the Cyber Security Vulnerabilities of the

Department by Improving Compliance with FISMA and All Other Cyber-Security Government-Wide

Regulations, Policies, and Procedures

With an eye to reducing cyber security vulnerabilities, the OCIO will continue to develop Department-wide

directives, manuals and/or other standards that comply with the kaleidoscope of Federal statutory and

regulatory requirements. Compliance with the directives, manuals and/or other guidance by DOE Program

Offices and contractor-run facilities will demonstrate improved cyber security performance to the satisfaction

of external review bodies such as the Government Accountability Office (GAD), OMB, and the Independent Public Auditor.

Outcomes:

. Provide a comprehensive set of cyber security performance expectations across the Department

Enable Program Offices and contractor-run facilities to improve their FISMA annual grades

0 Increase oversight and monitoring of FISMA compliance requirements within DOE

Standardized cyber security performance requirements that incorporate government requirements

and industry best practices

0 Institute a review cycle for statutory and regulatory requirements for new polices and

procedures to ensure continual update to address changing requirements.

Identify and proliferate common cyber security controls and measures 0 Rules of behavior

0 Training, awareness and professionalization program

0 Pre-Acquisition security considerations

0 Risk-management-based certification and accreditation

0 Contingency planning, testing, and updates

0 System categorization (sensitivity and criticality)

.

.

.

Objective 2: Implement a Comprehensive DOE-Wide Security Management Program to Improve Cyber

Security

DOE is working internally to develop and implement an improved comprehensive cyber security

management program. DOE is focusing on those cyber-security initiatives that have a significant role to play

in continuous improvement of the program and demonstrate improved cyber security performance to the

satisfaction of external review bodies such as GAO, OMB, and the Independent Public Auditor.

Outcomes:

. Improved continuity/contingency planning, testing and remediation

Continuous IndependentValidation and Verification (lV&V) testing of system controls

A common approach to operating system and application software configuration controls through an

integrated asset management program

.

.

13

DOE IRM Strategic Plan
u.s. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

. Standards for cyber security enterprise architecture and system development life cycle

Diskless workstation implementationfor classified environments

Cyber security early warning and incident response, recovery and reconstitution of services support

Significant enhancements to the logical access control process (authentication and authorization)

through implementation of HSPD-12 and FIPS-201 requirements

Improved identification, categorization and prioritization of critical infrastructure assets and other

responsibilities assigned by HSPD-7

Implementation and validation of interconnection agreements

Built-in security and privacy in 100% of IT investments

100% C&A of operational systems

0 Continue,aswellas improve,the monitoringof allC&Aprocessesto encourage100%

compliance to ensure, with relatively limited resources, that systems are evaluated and meet

the minimal security-control requirements for their established level of sensitivity and risk

0 Leverageexistingplansof actionandmilestones(POA&M)andFISMAQuarterlyUpdatesto

track the progress of system certification and, where needed, provide additional emphasis

and resources

Create a process for providing multilayer cyber security protections in sufficient depth to mitigate risk

to an acceptable level

.

.

.

.

.

.

.

.

Objective 3: Implement a Comprehensive Vulnerability Management Program to Identify and Mitigate

Vulnerabilities in DOE Information Systems

DOE continues to focus resources on preventing harmful events, as opposed to responding to unwanted

activities. By identifying vulnerabilities and implementing corrective measures, DOE is able to effectively

reduce the number of opportunities for system compromise, resulting in an overall improvement in the level

of protection afforded our information resources. Ongoing monitoring is used to continuously assess the

security posture of our operational environments to detect new or unpatched vulnerabilities, offering

opportunities for proactive remediation and control.

Outcomes:

. Establish and implement minimum baseline security configuration standards

0 Develop platform-specific security configuration standards to ensure implementation of

appropriate security controls prior to systems being placed in production

0 Ensure implementation of security controls to protect DOE information commensurate with

the risk and magnitude of loss from unauthorized activities

Perform periodic vulnerability assessments to continuously monitor production environments

0 Establish a vulnerability assessment program to effectively monitor DOE information

technology systems to detect known, unpatched vulnerabilities

0 Measure effectiveness of the vulnerability remediation activities through ongoing analysis of

vulnerability metrics, including the ratio of vulnerabilities to the number of systems scanned

Formulate vulnerability remediation and tracking efforts to ensure mitigation of identified

vulnerabilities

0 Institute mandates for remediation of identified vulnerabilities within specified timeframes,

dependent upon the risk and magnitude of harm from compromise

0 Track remediation of vulnerabilities, and take appropriate action for systems found to be out

of compliance with remediation requirements

.

.

14

DOE IRM Strategic Plan
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

APPENDIX A: STRATEGIC IT INITIATIVES

Homeland Security Presidential Directive 12

This investment will bring the Department in compliance

with Homeland Security Presidential Directive 12. The

initiative establishes and maintains an enterprise

standards-based authentication and authorization

infrastructure that provides secure seamless business

transactions and information exchange within DOE and

across many disparate agencies and organizations. The

objective is to improve DOE's business processes using

commercial-of-the-shelf based products that enable DOE

to implement a more robust authentication and

authorization infrastructure.

The program will reduce existing logical and physical

security vulnerabilities and mitigate risks to establish the

prerequisite level of security for critical enterprise

business functions. Both the technology solutions and

ongoing support provided by the initiative will enable DOE

to ensure that system users are who they claim to be

(authentication), allow effective use of digital signatures (data integrity and accountability), and restrict

access to appropriately authorized users (access control).

Consolidated Infrastructure, Office Automation, and Telecommunications (I,OA& T) Program

Infrastructure, Office Automation and

Telecommunications (I, OA&T) are the underpinnings

required for DOE to perform its most basic business

functions. Neither business activities nor the mission

functions can operate effectively without sound

infrastructure, office automation, and telecommunications.

The goal of the I,OA&T Consolidated Infrastructure

Program is to successfully implement and manage all of

its underlying projects and contribute to the overall

achievement of the Department's mission goals.

The Consolidated I,OA&T is defined by six service lines:

telecommunications and networks; application and data

hosting/housing; office automation; telephony; enterprise

collaboration service; and cyber security. The service

lines provide the necessary foundation across all the

Business Lines to facilitate the achievement of the

Department's mission goals and objectives.

Consolidating the I,OA&T projects will create a more solid

network infrastructure supporting collaboration across the DOE sites. The sharing of resources across sites

allows for more efficient use of human capital and more effective sharing of resources across the enterprise.

DOE IRM Strategic Plan

15
U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

Geospatlal Science Program Management Office

DOE shall establish a Geospatial Sciences Program

Management Office (GS-PMO) to maximize the complexwide investment in geospatial activities as they support

the mission of the Department. The GS-PMO, led by

Program Offices, will provide the framework and strategic

direction to coordinate, manage, and deploy an integrated

investment in the application of geospatial sciences

technology for DOE National Laboratories, Facilities and

Operations, Power Administrations, and Headquarters

Program Offices.

Each of the four strategic goals of the Department

involves the collection, analysis, and display of geospatial

data as an element of their respective program activities.

The applied geospatial sciences, and the underpinning

technology of geographic information systems (GIS), have

become an important and embedded capability of the

Department's Program operations. The geospatial

sciences activities across the DOE complex have emerged from the need for basic scientific research and

applied solutions requiring the integration capabilities of GIS.

The establishment of the GS-PMO will align with the goals and objectives of the Department's Information

Resources Management Strategic Plan to simplify access to DOE information and products and provide a

robust governance structure in support of IT programs.

Spectrum Management

Continued support of the President's Spectrum Policy

Initiative (SPI) has provided the Department with a solid

foundation for continuing to enhance its spectrum

management processes. Responding to the November

30, 2004, Presidential Determination, the latest step in the

SPI, ensures that DOE continues to evaluate and improve

its methods of efficiently and effectively managing the

way the Department uses spectrum. DOE also

recognizes the importance of contributions to the SPI,

which will culminate in a national spectrum plan that will

facilitate national and homeland security, foster economic

growth, and effectively support vital U.S. spectrum needs.

In response to the Presidential Determination, DOE is evaluating its current spectrum management

processes and developing the Department's Strategic Spectrum Plan (SSP). The SSP will examine three

distinct issues-spectrum requirements, including bandwidth and frequency location for future technologies

or services; the planned uses of new technologies or expanded services requiring spectrum; and suggested

spectrum efficient approaches to meet identified spectrum requirements. Examining the planned uses for

new and future technologies allows DOE to incorporate spectrum resources into the EA, further enhancing

that framework. The SSP is being organized around the DOE's LOB structure to provide a more organized

and holistic approach to the spectrum management process regarding resource allocation and future

investments.

DOE IRM Strategic Plan

16
. U.S. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

APPENDIX B: DOE E-GOVERNMENT PARTICIPATION

DOE Participation in Inter-Agency Initiatives and Federal Lines of Business

Inter-Agency Initiative Role

I6ovararnent to

USA Services

GovBenefits.gov

Go\L8rnmentt&~usines9

Business Gateway

e-Rulemaking

Consolidated Health Informatics

Federal Asset Sales

ernmeitto Govel'~

Grants.gov

SAFECOM

Participant

Parti3eant

Participant

Participant

Participant

Particip,?nt

2..0

Participant

Participant

Participant

Participant

Participant

Participant

Participant

Parti~ipant

ParticiQant

Ongoing Internal DOE e-Government Initiatives

Line of Business Role

Financial Management

Grants Management

Human Resources Management

Federal Health Architecture

Case Management

Information System Securit

Lead Partner

Participant

Participant

Participant

Participant

ParticiQant

----

- -- -- --- -

Environment}

DOE IRM Strategic Plan

17
u.s. Department of Energy

Office of the Chief Information Officer

IRM Strategic Plan

FY 2006-2008

APPENDIX C: LIST OF ACRONYMS

APP

C&A

CFO

CIO

CHRIS

COE

CPIC

CRB

DOE

EA

eXCITE

FEA

FISMA

FM LoB

GAO

GC

GPEA

GPRA

GSA

IDEA

I,OA&T

I-MANAGE

IRM

IT

LOB

NIST

NNSA

OCIO

OMB

PIA

PMA

POA&M

R&D

Annual Performance Plan

Certification and Accreditation

Chief Financial Officer

Chief Information Officer

Corporate Human Resource Information System

Center of Excellence

Capital Planning and Investment Control

Corporate Review Budget

Department of Energy

Enterprise Architecture

Extended Common Integrated Technology Environment

Federal Enterprise Architecture

Federal Information Security Management Act

Financial Management Line of Business

General Accountability Office

General Council

Government Paperwork EliminationAct

Government Performance and Results Act

General Services Administration

Innovative Department of Energy e-Government Applications

Infrastructure Office Automation and Telecommunications

Integrated Management Navigation System

Information Resources Management

Information Technology

Line of Business

National Institute of Standards and Technology

National Nuclear Security Administration

Office of the Chief Information Officer

Office of Management and Budget

Privacy Impact Assessment

President's ManagementAgenda

Plan of Action and Milestones

Research and Development

18

DOE IRM Strategic Plan