SD 415.1A, Project Oversight for Information Technology (PO-IT)

CONTROLLED DOCUMENT OFFICE OF PRIMARY INTEREST (OPI): AVAILABLE ONLINE Office of the Chief Information Officer https://directives.nnsa.doe.gov/ Printed copies are uncontrolled SUPPLEMENTAL DIRECTIVE Approved: 04-27-21 Expires: 04-27-24 PROJECT OVERSIGHT FOR INFORMATION TECHNOLOGY (PO-IT) Office of Information Management and Chief Information Officer (OCIO) NNSA SD 415.1A https://directives.nnsa.doe.gov/ THIS PAGE INTENTIONALLY LEFT BLANK NNSA SD 415.1A 1 04-27-21 PROJECT OVERSIGHT FOR INFORMATION TECHNOLOGY 1. PURPOSE. To identify National Nuclear Security Administration (NNSA) specific direction and authority for implementing the requirements and responsibilities of the Department of Energy (DOE) Order (O) 415.1, Information Technology Project Management. This Supplemental Directive (SD) serves to ensure information technology (IT) investments are managed with the proper safeguards, oversight, and security standards necessary to comply with federal laws and regulations. The scope of IT projects includes new development, modernization, and enhancement (DME) investments and projects; major enhancements to existing investments and projects; high priority investments and projects; and new commercial off-the-shelf (COTS) IT product acquisitions. 2. AUTHORITY. DOE O 415.1, Information Technology Project Management, issued 1/13/17 3. CANCELLATION. SD 415.1, Project Oversight for Information Technology (PO-IT), issued 9/03/14 09-03-14. 4. APPLICABILITY. a. Federal. This SD applies to all NNSA federal personnel who develop and maintain IT investments and assets for NNSA. b. Contractors. The Contractor Requirements Document (CRD), provided as Attachment 1, sets forth requirements that apply to the Management and Operating contractors. The CRD must be included in laboratory/plant/site/facility management contracts and support contracts, as appropriate. c. This SD applies to all NNSA IT investments with a total project cost (TPC) of $1 million (M) or greater, or projects with an IT component(s) with the same values. d. Exemptions/Equivalencies. (1) Exemptions. IT projects that are covered by, or are a component under, a capital asset project covered by DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets. The delegating official of the sponsoring/funding organization of an IT project that is deemed exempt from this SD must notify and coordinate oversight of the IT project with the Office of the Chief Information Officer (OCIO) to ensure compliance with DOE/NNSA strategic goals, Federal Information Technology Acquisition Reform Act (FITARA), law, organizational policies, and mission requirements. 2 NNSA SD 415.1A 04-27-21 (2) Equivalencies. (a) In accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 United States Code sections 2406 and 2511, and to ensure consistency throughout the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Directive for activities under the Director's cognizance. (b) In accordance with the responsibilities and authorities assigned by NNSA Delegation Order No. NA-005.01, the NNSA Office of Defense Programs, Deputy Administrator for Defense Programs (NA-10) will implement and oversee requirements and practices pertaining to this Directive for IT that is contained within the physical boundary of the nuclear weapon or is connected directly to the weapon components, or is used for testing equipment that connects directly to the nuclear weapon.

(c) There may be non-IT investments or projects (e.g., construction projects) that may include IT assets or require the integration of IT. These non-IT projects should follow the direction of DOE O 413.3B, managed by the Office of Acquisition and Project Management (NA-APM-20), as applicable and be executed in alignment with FITARA requirements. 5. BACKGROUND. DOE O 415.1 was developed to provide IT project management oversight for the acquisition and management of IT investments and initiatives (used interchangeably with IT asset and IT project) across the Department. This SD addresses NNSA’s commitment to support this common approach to manage IT investments using quantifiable measurements of benefits, risks, and progress, in terms of cost, capability to meet specified requirements, timeliness, and quality. To adhere to these mandates, the Office of the Associate Administrator for Information Management and Chief Information Officer (NA-IM), as the senior manager responsible for governance and oversight of the NNSA’s federally directed IT assets, program-directed IT assets, and indirect IT assets, manages the coordination of resources, investment reporting, and managing IT assets while ensuring alignment with NNSA strategic goals. The NNSA PO-IT promotes a holistic approach to IT project management, governance, and oversight through collaboration between the NNSA OCIO, and the NNSA IT Investment Review Board (IRB) to gain insight, exercise oversight, and promote efficiency. 6. REQUIREMENTS. a. Enterprise-wide policies and procedures must be developed and implemented that document the roles in project management, support major program objectives and federal IT projects, initiatives, programs, investments, and acquisitions. NNSA SD 415.1A 3 04-27-21 b. OCIO project oversight must be established for IT investments in support of DOE Orders: (1) Implement and support a strategic, focused approach that incorporates NNSA senior management and site office collaboration across the elements to support IT project management oversight and promote efficiencies. (2) Institutionalize IT acquisition and governance activities in support of IT project management throughout NNSA. b. Project/Program Managers of projects greater than $1M, but less than $25M, may tailor the scope of project planning, documentation, approach, and alignment with DOE O 415.1 to align the project objectives with the available resources and project risk. The project tailoring plan must be approved by the respective governance boards under which the project is being executed and be in alignment with FITARA and Office of Management and Budget (OMB) guidance for incremental development. c. IT project management and oversight must be implemented as required by FITARA and other federal IT legislative and regulatory policies and procedures. 7. RESPONSIBILITIES. a. Chief Information Officer (CIO). (1) Implements the provisions of DOE O 415.1, along with this SD, and other legislative and regulatory policies and procedures concerning IT investments; (2) Oversees and reports on IT projects across the nuclear security enterprise (NSE) as required by FITARA and other federal IT legislative and regulatory policies; (3) Ensures IT projects are delivered within the agreed performance baseline and costs while promoting consolidation of IT acquisitions whenever possible; (4) Promotes a collaborative approach to IT project management oversight and governance practices while maintaining alignment with NNSA strategic goals and mission;

(5) Forms and chairs OCIO project oversight investment review boards to provide oversight, portfolio management, and IT investment reviews to facilitate decision making; approves baseline change requests, critical decisions, or stage gates for projects involving IT investments implemented under DOE O 413.3B, DOE O 415.1, or exceeding $25M. 4 NNSA SD 415.1A 04-27-21 b. NNSA OCIO IT Investment Review Board (IRB). (1) Serves as an overarching governance board that monitors all initiatives included in NNSA’s Capital Planning and Investment Control (CPIC) IT dashboard (i.e., IT portfolio) as well as the acquisition of all IT over $15M; (2) Identifies special interest projects and ensures that appropriate senior executive level reviews are provided for those projects; (3) Identifies critical IT investments and ensures that IT projects are managed consistent with statutory, OMB, and Departmental requirements and priorities; (4) Reviews the results of internal and external compliance assessments and provides transparency across the Administration; (5) Ensures the development and management of an optimal IT portfolio that best supports programmatic needs; (6) Provides oversight, portfolio management, and specific reviews to facilitate decision making to ensure IT investments align with the NNSA’s goals, mission, and vision, ensuring the project is proceeding as planned; and (7) Recommends and approves project tailoring relative to the degree of rigor for project management documentation, reporting, and conformance to the requirements of DOE O 415.1 as part of project initiation, provided tailoring measures remain in compliance with FITARA and OMB guidance for incremental development. c. OCIO Enterprise Program Management Office (ePMO). (1) Provides a means for senior management to coordinate and monitor IT investments in terms of cost, schedule, procurement approvals, and requirements in accordance with FITARA; (2) Ensures IT investments establish measurable success criteria and follow best practices; (3) Ensures the integration and alignment of the CPIC process and tools with IT project management, enterprise architecture (EA), and other management processes; (4) Supports the development, implementation, and maintenance of procedures necessary to execute this SD; (5) Provides assistance and guidance to program and field offices managing IT projects covered by this SD; NNSA SD 415.1A 5 04-27-21 (6) Ensures sound application of IT project management practices for planning, management, budgeting, execution review, and reporting that demonstrates projects are effectively controlled; (7) Ensures coordination and collaboration with NNSA elements on IT project management; (8) Develops project performance measures, and monitors and evaluates project performance, ensuring compliance with NNSA standards, security requirements, and other mandates as directed by the OCIO; (9) Ensures coordination and collaboration within the OCIO organization, including capital planning, enterprise architecture (EA), cybersecurity, and IT services; and (10) Coordinates the Quarterly Project Reviews (QPRs), investment planning, and oversight of external IT initiatives as required by the OCIO. d. IT Point of Contact (ITPOC). (1) Supports the necessary procedures to implement the provisions of DOE O 415.1 in conjunction with FITARA, the NNSA FITARA Framework, and this SD for IT investments;

(2) Coordinates with the OCIO to determine the best approach to ensure PO- IT requirements are met for existing IT investments or portfolios; and (3) Provides feedback to the OCIO and the Field Office Managers on the management and operating contractor's (M&O) performance in meeting the requirements outlined in this SD and related DOE Orders. e. Program Office (PO). (1) Coordinates with the OCIO on new IT projects to determine the best approach to ensure PO-IT requirements are met; (2) Maintains stewardship of PO funded IT resources and ensures they are used efficiently and effectively to achieve intended program results; (3) Prepares an annual IT portfolio/budget plan that details proposed IT spending for approval by the respective CIO, and establishes an annual planning and approval process; (4) For IT projects executed by the PO or with PO funding Chairs/Co-Chairs formal Stage Gates, Critical Decisions, or transition points during the project’s life cycle to validate that the project is proceeding as planned, and communicates NNSA decisions supporting a go, no-go, or hold decision once made; 6 NNSA SD 415.1A 04-27-21 (5) Ensures all IT projects executed under PO purview are reviewed and comply with policies and procedures supporting the acquisition, oversight, and formal IT project management directives in support of DOE O 415.1 and this SD, which includes reporting to the NNSA OCIO for approval; (6) Ensures that projects and programs under PO purview are using a systems development lifecycle methodology that effectively manages the development and maintenance of IT systems; (7) Executes program- and office-specific processes that support NNSA Capital Planning and Investment Control (CPIC) efforts by monitoring and demonstrating effective control of the cost, schedule, risk, and performance of IT investments and corresponding projects; (8) Holds the PM accountable for delivering the project within cost, scope, and schedule, and identifying and managing any risks throughout the project life cycle which may compromise these programmatic elements; (9) Supports the identification of opportunities for collaboration, acquisition, and reuse of hardware and software solutions; (10) Supports effective financial and project management of IT investments; (11) Ensures communication channels are defined to support open and consistent communications by and between the FPM, ePMO and the respective ITPOC; (12) Reviews and approves initiation of IT projects with a TPC of less than $1 million to ensure the IT Project Management Plan is in compliance with established policies, directives, orders, and laws; and (13) Serves as the approver, or otherwise designates a person with FITARA approval authority, on purchases above $15M prior to being sent to OCIO for final approval. f. Field Office Manager (FOM). (1) Provides local oversight of NNSA’s IT projects; monitors, reports, and assists the OCIO in executing the requirements of DOE O 415.1 in conjunction with FITARA, the Framework, and this SD; (2) Coordinates with the OCIO on new IT projects to determine the best approach to ensure FOM-IT requirements are met; (3) Co-Chairs in formal Stage Gates, Critical Decision reviews, or transition points during the project’s life cycle to validate that the project is proceeding as planned, and communicates NNSA decisions supporting a go, no-go, or hold decision once made; NNSA SD 415.1A 7 04-27-21

(4) Ensures all IT projects under FOM purview are reviewed and comply with policies and procedures supporting the acquisition, oversight, and formal IT project management directives in support of DOE O 415.1 and SD 415.1, which includes reporting to the NNSA OCIO for approval; (5) Ensures that NNSA Capital Planning and Investment Control (CPIC) entries for IT projects under FOM purview are effectively monitored and managed to ensure control of the cost, schedule, risk, and performance of the IT investment and project; (6) Reports cost, schedule, risk, and performance monthly for all IT projects governed by this SD to the respective PO as well as through the CPIC process, as required; (7) Holds the PM accountable for delivering the project within cost, scope, and schedule, and identifying and managing any risks throughout the project life cycle which may compromise these programmatic elements; (8) Ensures open and consistent communications by and between the ePMO and the respective ITPOC; (9) Reviews and approves initiation of IT projects with a TPC of less than $1 million to ensure the IT Project Management Plan is in compliance with established policies, directives, orders, and laws; and (10) Serves as the approver, or otherwise designates a person with FITARA approval authority, on purchases above $15M prior to being sent to OCIO for final approval. g. Federal Project Manager (FPM) (1) Implements and manages NNSA’s IT projects; monitors, reports, and assists the OCIO in executing the requirements of DOE O 415.1 in conjunction with FITARA, the Framework, and this SD; (2) Manages federal IT resources and ensures they are used efficiently and effectively to achieve intended project results; (3) Prepares and presents all formal Stage Gates, Critical Decisions, or transition points during the project’s life cycle to demonstrate that the project is proceeding as planned, and documents NNSA decisions supporting a go, no-go, or hold decision once made; (4) Supports and provides access to the FOM, PO, and OCIO for monitoring and reviews to ensure project compliance with policies and procedures. (5) Ensures that projects use an appropriate systems development lifecycle methodology that effectively manages the development and maintenance of IT systems; 8 NNSA SD 415.1A 04-27-21 (6) Ensures project level entries for Capital Planning and Investment Control (CPIC) correctly reflect the cost, schedule, risk, and performance of IT investments; (7) Reports cost, schedule, risk, and performance monthly for all IT projects governed by this SD to the respective FOM, PO, or PMO, as well as through the CPIC process, as required; (8) Accountable for delivering the project within cost, scope, and schedule, and identifying and managing any risks throughout the project life cycle which may compromise these programmatic elements; (9) Ensures effective financial and project management of IT investments; (10) Ensures open and consistent communications; (11) Follows FITARA and the NNSA Framework and seeks approval of all purchases. h. Office of Enterprise Project Management (NA-APM-20). (1) Coordinates with the OCIO to integrate the CIO into the review of investments when acquisition strategies and acquisition plans include IT; and (2) Assists in incorporating details (e.g. project documentation development, Cost Estimating/Cost Analysis) for new and planned expenditure reporting for all transactions that include IT investments into policy and procedures.

i. Contracting Officers. (1) Assist originators of procurement requests who need to incorporate the requirements of this SD into a laboratory/plant/site/site/facility management or support contract, as appropriate; (2) Be aware of provisions to incorporate or make the appropriate modifications to M&O contracts to include the attached CRD where IT procurement requests occur; and (3) After notification by the appropriate program official, incorporate this SD’s CRD into affected contracts via the laws, regulations, and DOE Directives within clauses of the contracts. 8. REFERENCES. See Attachment 2. NNSA SD 415.1A Attachment 1 04-27-21 AT1-1 ATTACHMENT 1: CONTRACTOR REQUIREMENTS DOCUMENT (CRD) NNSA Supplemental Directive (SD) 415.1A, Project Oversight for Information Technology (PO-IT) This Contractor Requirements Document (CRD) establishes requirements for the National Nuclear Security Administration (NNSA) contractors, with access to NNSA information systems. Contractors must comply with the requirements listed in this CRD, which includes Attachments 1 and 2. Regardless of the performer of the work, the contractor is responsible for complying with, and flowing down, the appropriate requirements of the CRD to subcontractors at any tier, to the extent necessary, to ensure the contractor’s compliance with the requirements. That is, the contractor will ensure that it and its subcontractors cost-effectively comply with the requirements of this CRD and incur only those costs that are reasonable and would be incurred by a prudent person in the conduct of a competitive business. 1. REQUIREMENTS. a. The contractor, using a formal IT Project Management process with a graded approach to project risk management, based on best business practices, must develop a Project Management approach for IT investments that: (1) Fosters IT acquisitions and investments that support NNSA program and mission goals; (2) Describes the management methods, organization, governance process, control systems, and documentation for projects; and (3) Monitors and controls projects through project management practices. b. For federally directed IT investments with a Total Project Cost (TPC) of $1 million or more, the contractor must submit a Project Management Plan to the appropriate program office for approval at the direction of the assigned federal IT Project Manager. c. The M&O program office must report the cost, schedule, and performance on a monthly basis for all IT projects to the Project Manager and through enterprise Capital Planning and Investment Control (eCPIC) and the CPIC process, as required by federal laws. AT1-2 NNSA SD 415.1A 04-27-21 2. RESPONSIBILITIES. a. M&O Chief Information Officer or delegate. (1) Coordinates with the Federal IT Project Manager and the NNSA Program Office that funded the project, on new IT projects to determine the best approach to meet PO-IT requirements; (2) Participates in formal transitional review points during the project’s lifecycle to validate project progress and communicate NNSA decisions; (3) Ensures IT projects with a TPC of $1 million or more comply with policies and procedures supporting the acquisition, oversight, and formal IT project management directives in support of DOE O 415.1, Information Technology Management, and this Supplemental Directive; (4) Executes program processes that support NNSA Capital Planning and Investment Control (CPIC) efforts by monitoring, reporting, and demonstrating effective control of the cost, schedule, and performance of investments and projects;

(5) Reports the cost, schedule, and performance on a monthly basis for all IT projects to the Federal IT Project Manager and through the CPIC process, as required by federal laws. SD 415.1A Attachment 2 04-27-21 AT2-1 ATTACHMENT 2: REFERENCES Note: This attachment applies to NNSA contractor and federal personnel. a. 40 U.S.C. 11312, Capital planning and investment control b. 40 U.S.C. 11313, Performance and results-based management c. 40 U.S.C. 11314, Authority to acquire and manage information technology d. 40 U.S.C. 11316, Accountability e. 40 U.S.C. 11317, Significant deviations f. Federal Information Technology Acquisition Reform Act, H.R. 1232, 113th Congress (2014), incorporated in National Defense Authorization Act of Fiscal Year 2015 (Title VIII, Subtitle D, H.R. 3979), 113 Pub. L. No. 113-291, 128 STAT. 3438 §§ 831-837 (2014) g. OMB Memorandum 15-14, Management and Oversite of Federal Information Technology, dated June 10, 2015 h. DOE O 415.1 Change 2, Information Technology Project Management, dated 01-17-17 i. DOE O 413.3B Change 5, Program and Project Management for the Acquisition of Capital Assets, dated 04-12-18 j. DOE O 226.1B, Implementation of Department of Energy Oversight Policy, dated 04-25- 11 k. DOE O 200.1A, Change 1, Information Technology Management Program, dated 01-13- 17 l. NNSA Delegation Order No. NA-005.01, To The Associate Administrator for Information Management and Chief Information Officer, signed February 11, 2019 m. NNSA FITARA Implementation Framework, September 25, 2019 1. REQUIREMENTS. 2. RESPONSIBILITIES. a. M&O Chief Information Officer or delegate.