SD 415.1, Project Oversight for Information Technology (PO-IT)

SUPPLEMENTAL DIRECTIVE NNSA SD 415.1 Approved: 09-03-14 PROJECT OVERSIGHT FOR INFORMATION TECHNOLOGY (PO-IT) IA. ·!~~~~1 llV ~~:I National Nuclear Security Administration NATIONAL NUCLEAR SECURITY ADMINISTRATION Office of the Information Management and Chief Information Officer (OCIO) CONTROLLED DOCUMENT AVAILABLE ONLINE AT: http://nnsa.energy.gov OFFICE OF PRIMARY INTEREST (OPI): Office of Policy and Governance printed copies are uncontrolled THIS PAGE IS INTENTIONALLY BLANK. NNSA SD 415.1 09-03-14 PROJECT OVERSIGHT FOR INFORMATION TECHNOLOGY 1. PURPOSE. The objective of the Project Oversight for Information Technology (PO-IT) Supplemental Directive (SD) is to identify National Nuclear Security Administration (NNSA) specific direction and authority for implementing the requirements and responsibilities of the Department of Energy (DOE) Order (0) 415.1, Information Technology Project Management. This SD will serve to ensure Information Technology (IT) investments are managed with the proper safeguards, oversight, and security standards necessary in compliance with US Code: 5122 40 U.S.C. 11312 (Capital Planning and Investment Control); 5123 40 U.S.C. 11313 (Pe1for111ance and Results Based Management); 5124 40 U.S.C. 11314 (Authority to Acquire and Manage b?formation Technology); 5126 40 U.S.C. 11316 (Accountability); and 5127 40 U.S.C. 11317 (Sign(ficant Deviations) as outlined in DOE Delegation Order 00-031.00A. 2. CANCELLATION. NONE 3. APPLICABILITY. a. NNSA Applicability. This SD applies to all NNSA Federal personnel, who develop and maintain IT assets for NNSA. These NNSA entities shall hereafter be referred to as NNSA Elements. Contracting Officers are responsible for including this policy in M&O contracts. b. NNSA Contractors. The Contractor Requirements Document (CRD), Attachment 1, sets forth requirements of this policy that will apply to site/facility management contractors whose contracts include the CRD. (1) The CRD must be included in site/facility management contracts and supp01t contracts. (2) Affected site/facility management contractors are responsible for flowing down the requirements of the CRD to subcontractors at any tier to the extent necessary to ensure the site/facility management contractors' compliance with the requirements. (3) This SD does not automatically apply to other site/facility management contracts. Application of any of the requirements of this SD, to other than site/facility management contracts, will be communicated by the contracting officer. c. Exclusion. IT projects that are covered by or are a component under a Capital Asset Project covered by DOE 0 413.3B, Program and Project Management for the Acquisition of Capital Assets, are excluded from this SD 415.l d. Equivalency. In accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 USC sections 2406 and 25 I 1, and to ensure consistency throughout the joint Navy/DOE Naval Nuclear Propulsion 2 NNSA SD 415.l 09-03-14 Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Directive for activities under the Director's cognizance, as deemed appropriate.

4. BACKGROUND. DOE 0 415 .1, l1?formation Technology Project A1anagement was developed to provide Information Teclmology Project Management oversight for the acquisition and management of IT investments and initiatives (used interchangeably with an IT asset and IT project) across the Nuclear Security Enterprise (NSE). This SD addresses NNSA's commitment to support this conunon approach to manage IT investments using quantifiable measurements of benefits, risks, and progress, in terms of cost, capability to meet specified requirements, timeliness, and quality. To adhere to these mandates, the NNSA Office of the Associate Administrator for Information Management and Chieflnformation Officer (NNSA OCIO), as the Senior Management responsible for governance and oversight of the Agency's Federally-Directed IT assets, Program-Directed IT assets, and Indirect IT assets for NNSA, manages the coordination of resources, investment reporting, and managing IT assets while ensuring alignment with NNSA strategic goals. The NNSA PO-IT promotes a holistic approach to IT project management, governance, and oversight through collaboration between the NNSA OCIO Program Management Office (PMO) and NNSA Integrated Project Teams (IPT) to gain insight, exercise oversight, and promote efficiency. a. This SD applies to all NNSA IT investments with a Total Project Cost of $1 million or greater. The delegating official (NNSA Stakeholders and/or Federal Program Directors) sponsoring/funding organization of current or proposed IT projects must comply with the requirements of the PO-IT SD. b. The delegating official of the sponsoring/funding organization of an IT asset that is deemed exempt from compliance with the PO-IT should notify and coordinate oversight of the IT asset with the NNSA OCIO to ensure compliance with DOE/NNSA strategic goals, policies, and mission. c. The scope of IT projects includes new Development, Modernization, and Enhancement (DME) investments and projects, major enhancements to existing investments and projects, high priority investments and projects, and new Commercial Off-the-Shelf (COTS) IT product acquisitions. d. There may be non-IT investments or projects (e.g., construction projects), that may include NNSA IT assets or require the integration of IT. These non-IT projects should follow the direction of DOE 0 413.3B, managed by the Office of Acquisition and Project Management (NA-APM-20). NA-APM-20 shall request guidance and project oversight assistance from the NNSA OCIO to ensure the elements' compliance with this SD, as appropriate. 5. REQUIREMENTS. NNSA has created this directive to supplement the DOE policy as implemented in NNSA. It will allow the NNSA OCIO to make decisions that are consistent while supporting a degree of flexibility to accommodate special circumstances as they arise. NNSA SD 415.1 09-03-14 a. Establish NNSA OCIO PO-IT in supp011 of DOE 0 415.l: (I) Implement and support a strategic, focused approach that incorporates NNSA senior management and site office collaboration across the elements to support Project Management oversight and promote efficiencies; (2) Institutionalize NNSA IT acquisition and governance activities in support of IT project management throughout NNSA; and (3) Follow the DOE 0 415.l Section 4. Requirements, excluding Sections 4.b.3 and 4.b. l 0. 3

b. Implement IT project oversight as close to the work as practical, as required by the most recent versions ofNAP-21 , Transformational governance and oversight, DOE 0 226.1 B, Department of Energy Oversight Policy, utilizing NNSA management as defined in Responsibilities (Section 6) of this SD. 6. RESPONSIBILITIES. a. Chief Information Officer (CIO): (1) Assigned as the Senior Manager responsible and accountable for implementing the provisions of DOE 0 415.l along with this SD, as well as legislative and regulatory policies and procedures; (2) Delegated with the authority and responsibility for oversight and reporting ofIT projects across the Nuclear Security Enterprise (NSE); (3) Ensure NNSA IT projects are delivered within the agreed performance baseline and control costs while promoting consolidation of IT acquisitions whenever possible; (4) Promote a collaborative approach to IT project management oversight & governance practices while maintaining aligmnent with NNSA strategic goals and mission; and (5) Form and chair OCIO project oversight work groups. These PO-IT work groups will support the maturation ofNNSA's enterprise IT governance operations strategy: (a) OCIO Investment Review Board (IRB), (b) OCIO Program Management Office (PMO), and (c) OCIO Enterprise IT Acquisition Council (EIT-AC). b. OCIO Investment Review Board (IRB): 4 (1) (2) (3) (4) (5) NNSA SD 415.1 09-03-14 Identify special interest projects and ensure that appropriate Senior Executive Level reviews are provided for those projects; Promote Information Technology Strategic Platming; Identify critical IT investments and ensure that IT assets are acquired and information resources are managed consistent with statutory, Office of Management and Budget (OMB), and Departmental requirements and priorities; Review the results of internal and external compliance assessments and provide transparency across the Agency; and Ensure the development and management of an optimal IT portfolio that best supports Programmatic needs. c. OCIO Program Management Office (PMO): (1) Provide a means for Senior Management to monitor IT investments in terms of cost, schedule, and requirements; (2) Ensure the integration and alignment of the CPIC process and tools with IT Project Management, Enterprise Architecture (EA), and other management processes; (3) Support the development, implementation, and maintenance of policies, and procedures necessary to implement this SD; (4) Provide assistance and guidance to Integrated Project Teams (ITP) and Project Management Organizations managing IT projects covered by this SD; (5) Ensure sound application of IT Project Management practices for platming, management, budgeting, execution review, and reporting that demonstrates projects are effectively managed; (6) Ensure coordination and collaboration with NNSA Elements on IT Project Management; (7) Develop project performance measures, and monitor and evaluate project performance throughout the project ensuring compliance with NNSA standards, security requirements, and other mandates; (8) Ensure coordination and collaboration within the NNSA OCIO Organization, including Capital Planning, EA, Cyber security, and IT services; and (9) Participate in Quarterly Project Reviews (QPRs). NNSA SD 415.1 09-03-14 d. OCIO Enterprise IT Acquisition Council (EIT-AC): (1) Implement and manage IT acquisition processes to achieve cost savings through appropriate IT hardware and software standards, negotiated buying arrangements, and refreshed policies;

(2) Promote consolidation of software and hardware acquisition, volume purchasing arrangements, enterprise-wide agreements, and best practices; (3) Ensure all elements supporting NNSA IT investments utilize a risk and lifecycle-based Software Quality Assurance (SQA) program; (4) Support the OCIO in the development and implementation of Departmental IT acquisition policy, strategy, governance, and processes; (5) Prioritize investments, based upon performance and results; and (6) Ensure senior-level representation to serve on, support, and fulfill the membership responsibilities of the IT Council, Architecture Review Board, and EA governance activities. e. IT Point of Contact (ITPOC): (1) Support the implementation and necessary procedures to implement the provisions of DOE 0 415.l and this SD for IT investments; 5 (2) Coordinate with the OCIO to determine the best approach to ensure PO-IT requirements are met for existing IT investments or portfolios; and (3) Provide feedback to OCIO and the Field Office Manager on the M&O's performance in meeting the requfrements outlined in this supplemental directive and related DOE order. f. IT Integrated Project Team (JPT) (1) Provide advice and recommendations on key project decisions; (2) Promote collaboration, communication, effective and efficient project management, and use of information resources to reduce costs and improve the management and execution of IT investments in support of NNSA IT projects; (3) Provide recommendations to the OCIO regarding strategies, approaches, products, costs, benefits, cost-benefit feasibility, risks of alternative investment options, and architectural alig1m1ent of enterprise and application architecture projects; and 6 (4) NNSA SD 415.1 09-03-14 Facilitate communication with all IT Project Manager PM leads, Field Office Managers, PMO, and ITPOC. g. Field Office Manager (FOM)/Federal Project Manager (FPM) I M&O CIO is (1) Responsible for coordinating with OCIO for new NNSA IT projects to determine the best approach to ensure PO-IT requirements are met; (2) Maintain stewardship of Federal IT resources and ensure they are used efficiently and effectively to achieve intended program results; (3) Participate in formal Stage Gates or transition points during the project's life cycle to validate that the project is proceeding as planned and conunun.icate NNSA decisions supporting a go, no-go, or hold decision once made; ( 4) Ensure all IT projects with a Total Project Cost of $1 million or greater comply with policies and procedures supporting the acquisition, oversight and formal IT project management directives in support of DOE 0 415 .1 and PO-IT SD 415.1; (5) Ensure that projects and programs are utilizing a systems development lifecycle methodology that effectively manages the development and maintenance of IT systems; (6) Execute program- and office-specific processes that support NNSA Capital Plaiming and Investment Control (CPIC) efforts by monitoring and demonstrating effective control of the cost, schedule, and performance of investments and corresponding projects; (7) Report the cost, schedule, and performance on a monthly basis for all IT projects governed by this SD to the PMO as well as through the CPIC process, as required; (8) Hold the assigned PM accountable for delivering the project within cost, scope, and schedule; (9) Support the identification of opportunities for collaboration, acquisition, and reuse of hardware and software solutions;

(10) Support effective financial and project management oflT assets; (11) Ensure conununication channels are defined to support open and consistent communications by and between the PMO and the IT project' s Integrated Project Team (IPT); and NNSA SD 415.1 7 09-03-14 (12) Review and approve IT projects with a Total Project Cost of Jess than $1 million to ensure the IT Project Management plan is in compliance with established Policies, Directives, Orders, and Laws. h. Contracting Officers. Assist originators of procurement requests who want to incorporate the requirements of this SD into a new non-site/facility management contract, as appropriate. 7. IMPLEMENTATION. The PO-IT is established for all NNSA elements to implement. The implementation will be managed by Federal Project Directors (FPD) and Field Office Managers (FOM) responsible for oversight ofNNSA's IT assets, who will guide, monitor, report, and assist OCIO in executing the requirements of DOE 0 415.1 in conjunction with this SD. 8. REFERENCES. a. 40 U.S.C. 11312 Capital Planning and Investment Control; b. 40 U.S.C. 11313 Pe1:formance and Results Based Management; c. 40 U.S.C. 11314 Authority to Acquire and Manage il?formation Technology; d . 40U.S.C. 11316Accountability; e. 40 U.S.C. 11317 Sign{ficant Deviations as outlined in DOE Delegation Order 00- 031.00A; f. DOE 0 226. l B Department of Energy Oversight Policy; g. DOE 0 413.3B Program and Project Management.for the Acquisition o.fCapital Assets; h . DOE 0 415.1 J1iformation Technology Project Alfanagement; 1. NAP-21 Transformational governance and oversight. 9. CONTACT. Office of the Information Management and Chief Information Officer (NA­ IM), at (202) 586-5617. BY ORDER OF THE ADMINISTRATOR: Frank G. Klotz Administrator Attachment: Contractor Requirements Document (CRD) NNSA SD 415.1 09-03-14 Attachment 1: Contractor Requirements Document Attachment 1 ATl-1 NNSA Supplemental Directive (SD) 415.1, Project Oversight for I11for111atio11 Teclt110/ogy I . THE CONTRACTOR REQUIREMENTS DOCUMENT CCRD) a. This CRD establishes the requirements for the National Nuclear Security Administration (NNSA) Information Technology (IT) contractors, including Management & Operations (M&O) contractors, with access to NNSA information systems. Contractors must comply with the requirements listed in this CRD. b. Regardless of the performer of the work, the contractor is responsible for complying with and flowing down the appropriate requirements of the CRD to subcontractors at any tier, to the extent necessary, to ensure the contractors' compliance with the requirements. c. The contractor, using a formal IT Project Management process with a graded approach to project risk management, based on best business practices (BBPs), must develop a Project Management approach for IT investments that: (1) Fosters IT acquisitions and investments that support NNSA Program and Mission goals; (2) Describes the management methods, organization, governance process, control systems, and documentation for projects; and (3) Monitors and controls projects through Project Management practices. d. For Federally directed IT investments with a Total Project Cost (TPC) of $1 million or more, the contractor must submit a Project Management Plan to the appropriate Program Office for approval at the direction of the assigned Federal IT Project Manager.