Note: There may be special cases where none of the three formats above are appropriate for the review. In those cases, please consult with the CPIC Policy Lead, the CIO and responsible parties to determine the appropriate presentation and documentation requirements for review. Documentation Request Table 3 provides a list of the types of supporting documentation that could be requested of the investment for review. It is important to note that not all of the documents listed below would be applicable to every type of investment. An agency may wish to create a more granular representation of this list below based on type of investment being reviewed (e.g. process improvement vs. technology upgrade). Table 3: Recommended Documentation Requests by Investment Lifecycle Phase Initial Baseline Review Control Review Rebaseline Request Review Applicable Investment Lifecycle Planning Development Development Mixed Lifecycle Development Mixed Lifecycle Supporting Documentation* (submitted 2-4 weeks prior to the review date) Project Charter (or similar document that describes the mission/need statement and/or performance gap) Modernization Roadmap Project Schedule and Cost Estimate Integrated Baseline Review Results Packet Risk Management Plan Security Plan Acquisition Plan Segment Architecture Results of Internal or Independent Reviews or Audits Alternatives Analysis Project Charter or Project Management Plan Most Recent Agency-level Program Control Review Project Schedule and Cost Estimate Risk Management Plan and Risk Register Operational Analysis Post Implementation Review Acquisition Plan Segment Architecture Conceptual, Systems, Technology, and/or Data Architecture or Performance Referance (PRM), Business Reference Model (BRM), Data Reference Model (DRM), Service Reference Model (SRM), or Technical Reference Model (TRM) Test Results Security Plan of Action and Milestones (POA&M) Project Charter or Project Management Plan Integrated Baseline Review Results Packet Project Schedule and Cost Estimate Risk Management Plan and Risk Register Operational Analysis Post Implementation Review Alternatives Analysis Acquisition Plan Segment Architecture Conceptual, Systems, Technology, and/or Data Architecture or PRM, BRM, DRM, SRM, or TRM Test Results Security POA&M Results of Internal or Independent Reviews or Audits Performance Management Plan (goals, metrics, and actual results)
Description of Internal Approval and Overall Governance Framework Dependencies Target Architecture Acquisition Plan Project Manager Qualifications Project Manager’s Appraisal of status, reliability of estimates and requirements for success Risk Management Plan and Top and mitigation strategies Alternatives Analysis Description of Internal Approval and Overall Governance Framework Dependencies Target Architecture Alignment Security Metrics Acquisition Plan Vendor Performance Project Team Capability Organizational Change Management Technical Challenges Development, testing, and deployment plans overview Security and privacy approach Project Manager’s Appraisal of status, reliability of estimates and requirements for success Previous Corrective Action Plans to Prevent Future Rebaselining Risk Management Plan and Top risks and mitigation strategies Updated Alternatives Analysis Description of Internal Approval and Overall Governance Framework Dependencies Target Architecture Alignment Security compliance Acquisition Plan Vendor Performance Project Team Capability Project Manager’s Appraisal of status, reliability of estimates and requirements for success Facilitating a TechStat To ensure the TechStat achieves its objectives, the TechStat Team lead analyst should prepare appropriately for the session. It is essential that the CIO is fully briefed prior to the meeting so that he or she can confirm that the thesis is solid, and the supporting analysis is relevant and verifiable. Similarly, the TechStat analyst should ensure that invited subject matter experts were actively engaged in the analysis and thus can be actively engaged during the session if questioned about root causes and potential solutions. While the CIO and IRB Chair will lead the session, the analyst should be an active facilitator, presenting and clarifying important facts, asking probing questions of participants, and engaging subject matter experts for support. Use the Agenda (J) at as a reference. Additionally, the analyst must take accurate notes reflecting decisions and outcomes so that they can be recounted following the meeting in a formal follow-up memo. Meeting minutes may also be used to facilitate this, see Meeting Minutes (M).