HHS Policy for Information Technology (IT) - Capital Planning and Investment Control (CPIC)

December 30, 2005

HHS-OCIO-2005-0005.001

Table of Contents

• 1. Purpose
• 2. Background
• 3. Scope
• 4. Policy
  • 4.1 General Policy
  • 4.2 CPIC Process
  • 4.3 Enterprise Architecture
  • 4.4 Privacy and Security
  • 4.5 IT Strategic Planning
  • 4.6 IT Investment Planning
  • 4.7 IT Investment Funding
  • 4.8 IT Acquisition
• 5. Roles and Responsibilities
  • 5.1 HHS Chief Information Officer (CIO)
  • 5.2 HHS OPDIV Chief Information Officers (CIOs)
  • 5.3 Deputy Assistant Secretary (DAS) for Finance
  • 5.4 Deputy Assistant Secretary (DAS) for Budget
  • 5.5 Deputy Assistant Secretary (DAS) for Human Resources (HR)
  • 5.6 Deputy Assistant Secretary for Acquisition Management and Policy (DAS AMP)
  • 5.7 Office of National Coordinator for Health Information Technology (ONC)
  • 5.8 HHS Chief Enterprise Architect (CEA)
  • 5.9 HHS Chief Information Security Officer (CISO)
  • 5.10 HHS Capital Planning and Investment Control Officer
  • 5.11 HHS Chief Technology Officer (CTO)
  • 5.12 HHS/OPDIV Business Sponsor or Functional Manager
  • 5.13 OPDIV CPIC Managers
  • 5.14 HHS/OPDIV IT Investment Managers
  • 5.15 The IT Governance Organization
• 6. Applicable Policies and Guidance
  • 6.1 Laws
  • 6.2 Regulations and Guidance
• 7. Information and Assistance
• 8. Effective Date/Implementation
• 9. Approved

1. Purpose

2. Background

3. Scope

4. Policy

• General Policy
• CPIC Process
• Enterprise Architecture
• Privacy and Security
• IT Strategic Planning
• IT Investment Planning
• IT Investment Funding
• IT Acquisition

4.1 General Policy

4. 4.1.1  HHS IT investments directly support and align with the HHS mission and strategic goals and are citizen centered. 
5. 4.1.2  Business processes are reengineered before investing in IT to support those processes. 
6. 4.1.3   Priority consideration is given to those IT investments that share use of IT across multiple entities within HHS and across other agencies.  Redundant IT investments within HHS and across other agencies shall be minimized.
7. 4.1.4  In order for an IT investment to be selected for funding in any fiscal year, it shall demonstrate a strong business case documenting the financial, technical and strategic merits justifying the investment.  Investments shall:

• Align with the HHS Enterprise Architecture.
• Fill a performance gap in HHS ability to meet strategic goals and objectives at the lowest life cycle cost among viable alternatives.
• Have an acceptable business case demonstrating strong project management capabilities as well as sound investment planning.
• Achieve a positive return on investment that is equal to or greater than that achievable through alternative use of resources.
• Provide risk-adjusted cost and schedule goals, and measurable and achievable performance goals.
• Provide a comprehensive risk mitigation and management plan.
• Ensure security of data and systems.

4. 4.1.5  IT investments that meet one or more of the criteria as shown in Figure 1 shall be designated for Department-level review.  All other IT investments shall be designated for HHS OPDIV-level review.  HHS OPDIVs shall comply with the requirements of this policy for those IT investments they review and manage.  The HHS CIO shall review and approve HHS OPDIV CPIC processes, as appropriate, to ensure compliance with this policy.

Figure 1:  HHS CPIC Review Thresholds

4. 4.1.6  All IT investments with development, modernization and enhancement (DME) activities shall demonstrate satisfactory progress toward achieving approved cost, schedule and performance goals.  All IT investments  with DME activities must apply earned value management (EVM) policies and procedures, establishing approved baselines and controlling these baselines such that cost and schedule deviations do not exceed  plus or minus10%.  Refer to the HHS EVMS Policy and Procedures for further details.  
5. 4.1.7  Each IT investment with steady state activities (includes mixed life-cycle investments) shall demonstrate, through operational analysis, how close it is to meeting original and current cost, schedule and performance goals, whether it continues to meet HHS and user requirements, and that the total investment costs for an IT investment covers the life cycle and includes all budgetary resources.
6. 4.1.8 HHS shall coordinate its internal IT management, strategic planning, budgeting, acquisition and human resource functions to meet the requirements of OMB Circular A-130 and the Clinger-Cohen Act of 1996.

4.2 CPIC Process

This section addresses HHS’

• CPIC Governance
• CPIC Process
• CPIC Phases

4.2.1  An IT Governance Structure is established to implement the CPIC process and provide review and approval for HHS IT investments.  The HHS OPDIVs establish and maintain IT Governance Structures to exercise IT management authority delegated to them by the HHS CIO.  Operational Level IT Governance structures shall be consistent with those established at the Department Level.  Figures 2 shows an Operating Division governance and execution structure that supports the Department level organizations.  Figure 3 represents a suggested model for working with a large scale and complex portfolio of HHS-wide IT investments.

Figure 2:  HHS Governance Structure

*Note: The HHS CPIC Team will review investments meeting Department-level CPIC review thresholds.

The Department-level IT governance structure consists of:

• The HHS Information Technology Investment Review Board (ITIRB), a cross-functional executive review committee responsible for overseeing the management of the HHS IT portfolio, approving and prioritizing IT investments to best achieve HHS strategic goals and objectives, and leveraging opportunities for collaboration across HHS OPDIVs on IT investments that support common lines of business.  The HHS ITIRB shall ensure that the HHS IT investment portfolio is of the highest quality and meets the business needs of the Department in the most effective and efficient manner.
• The HHS CIO Council, a cross-OPDIV review committee, comprised of the OPDIV CIOs and chaired by the HHS CIO, responsible for reviewing the technical and managerial soundness of IT investments and providing technical recommendations to the ITIRB. 
• The HHS CPIC Advisory Board (CPIC-AB) serves, through the HHS Chief Enterprise Architect, as the primary advisory board to the HHS CIO and the HHS CIO Council on CPIC policy, procedures, data standards, and tool configuration.  The CPIC-AB shall be chaired by the HHS Capital Planning and Investment Control Officer with membership comprised of the HHS Portfolio Management Tool Program Manager, a representative from each HHS OPDIV, HHS Critical Partners, and a technical representative from the IT Service Center.
• HHS CPIC Team, within the OCIO, provides subject matter expertise to HHS OPDIVs on IT CPIC and investment portfolio management to ensure consistency in meeting the intent of Federal and Departmental CPIC policy. The team manages the CPIC process to ensure consistency across the Department, and to provide clear understanding of process roles, responsibilities, and timing among all accountable parties.  The HHS CPIC Team also manages, measures and improves the CPIC policy,  procedures, and tools to promote continuous improvement of the CPIC process and its outcomes. The HHS CPIC Team coordinates the review and articulation of issues coming before the HHS IT Governance Boards; provides guidance to HHS OPDIVs on Board-established reporting and presentation requirements for Board reviews; and advises the HHS CIO.
• HHS CPIC Critical Partners are responsible for providing input to ensure that IT investments comply with HHS policy in the respective critical partner functional areas and to advise the HHS IT Governance Boards and individual IT investment managers regarding functional issues in their areas of expertise.  (Refer to Section 5. Roles and Responsibilities for a list of the Critical Partner functional areas and representatives.)
• Business Steering Committee, whether at the HHS or OPDIV level, reviews and recommends IT investments in its particular business area to ensure integration and alignment with HHS business goals and objectives, and to ensure that the proposed portfolio of systems in that particular business area meets HHS business requirements.  A Business Steering Committee looks across the organization and its key business functions to determine impacts on other systems, business operations, etc.  A Business Steering Committee interfaces with business sponsors and investment managers and provides recommendations to respective ITIRBs regarding business issues.  Members of a Business Steering Committee include key business managers from the organization.

The specific roles and responsibilities of the Planning and Development Committee (PDC) will be determined at the time the Business Steering Committee establishes a PDC.  See Figure 3 (above).

• Business Sponsor or Functional Manager is an HHS business official responsible for the strategic business processes under development or enhancement and for ensuring their integrity; and also serves as the primary user interface to the CIO and ITIRB.
• A qualified Investment Manager shall head an Integrated Project Team (IPT).  The IPT is established by the manager of each IT investment with technical and critical partner expertise appropriate to the size, complexity and operational requirements of the investment.  An IPT typically shall consist of representatives from the business office, including any applicable subject matter experts, technical IT staff, budget, acquisition, security, and EA.  The Investment Manager shall develop the investment business case in conjunction with the Business Sponsor to clearly define and capture business need requirements, conduct investment planning to adequately define and execute the tasks required to meet approved cost, schedule and performance baselines and conform to HHS policies that apply to IT investments.  Investment Managers shall be responsible for timely reporting of significant variances from approved baselines and providing corrective action plans or rebaselining proposals as appropriate.

1. 4.2.2  The CPIC process links mission needs, information, and IT in an effective and efficient manner.  It includes all stages of capital programming, including planning, budgeting, procurement, management, and assessment.  The CPIC process provides results-oriented IT budget justification for IT operational and improvement initiatives in the context of HHS missions and operations and integrates, in conjunction with the Deputy Assistant Secretary for Budget, the IT CPIC process with the overall HHS budget formulation process as reflected in Figure 4 below.

4.2.3 The CPIC process consists of three phases designated by OMB as illustrated in Figure 5.

Figure 5: CPIC Phases

The Select phase lays a solid foundation for success in the subsequent Control and Evaluate phases.  This phase begins with an IT investment concept and moves through the development of the business case by the Business Sponsor/Investment Manager, the HHS CIO Council/HHS ITIRB approval process, and IT investment initiation.  All information required for the HHS CPIC process shall be entered into the HHS IT Portfolio Management Tool.

During the CPIC Select phase each investment’s risks and returns are identified and analyzed before committing funds.  IT investments are selected that best support HHS core mission functions, are consistent with the HHS Strategic Plan, and comply with the enterprise architecture.  This process is repeated each time funds are allocated to IT investments, for both new investments at the beginning of their life-cycle and approved ongoing investments, which shall be subject to review each year as part of the annual budget process.

During the Select phase, the Business Sponsor and the Investment Manager prepare a Prospectus Summary form in the HHS IT Portfolio Management Tool, which provides the necessary information to build support and make funding decisions for an IT investment.  The Business Sponsor and the Investment Manager identify alternative solutions and develop an order of magnitude estimate of costs and benefits that may be realized by the investment.  Estimated milestones, with associated schedules and costs, are established.  The HHS CIO Council shall initially screen the IT investment seeking approval using a uniform set of evaluation criteria and thresholds.  The IT investment’s business alignment, benefits, costs, performance, risks, and interoperability with IT systems, are to be systematically evaluated and prioritized amongst other investments in the IT portfolio.  If the IT investment meets minimum requirements, the HHS CIO Council shall refer the IT investment to the HHS ITIRB, advising the HHS ITIRB on the IT investment’s technical soundness and recommending a priority relative to the remainder of the portfolio.

The HHS ITIRB shall make the final determination regarding which IT investments will be included in the IT portfolio and either funded or submitted as a budget request. IT investments not included in the HHS IT Portfolio remain in the HHS IT Portfolio Management Tool as unfunded unapproved IT investments available for future consideration by the HHS CIO Council and HHS ITIRB.

During the Control phase, an IT investment moves from requirements definition to implementation.  All IT investments in the investment portfolio shall be consistently controlled (monitored and managed) by the Investment Manager to maximize value, mitigate risks, ensure successful results, and to takecorrective action when necessary.

During the Control phase, the Investment Manager follows established milestones and reviews schedules, as well as utilizes an oversight mechanism to systematically evaluate and ensure the continuing security, interoperability and availability of the investment’s system and data.  The Investment Manager participates in two types of reviews:

1. Periodic control reviews assess the IT investment’s progress against approved baselines, typically on a quarterly basis.  The review’s purpose is to ensure that on-going IT investment status, progress, and outlook are satisfactory and consistent with approved investment baselines; identify deficiencies in investment management and monitor corrective actions; provide recommendations to the HHS CIO Council and HHS ITIRB to support their decision to continue, reduce, terminate, or defer IT investments; review investment status, control, performance, risk and outlook for approved and funded IT investments; and establish and execute the necessary project controls to manage requirements, risk, cost, and schedule baselines, and performance outcomes.
2. Milestone reviews typically take place near the end of each System Development Life Cycle phase or when changes to approved investment baselines are anticipated.  Milestone reviews confirm the IT investment’s strategic alignment; the appropriateness of current cost, schedule, and performance baselines; and the readiness of the investment to proceed to the next phase based on meeting established baselines and exit criteria for the current phase.  The review may re-evaluate the investment’s business case. The HHS ITIRB will determine whether to continue an IT investment with the current baselines (with corrective action plans, if necessary), approve re-baselining, or terminate the IT investment.

1. The Investment Manager shall conduct a Post Implementation Review (PIR) following each IT investment or useful segment’s implementation.  The Investment Manager shall evaluate actual investment cost, schedule and performance against original and latest baselines and level of stakeholder and customer satisfaction. A PIR determines the system’s efficiency and effectiveness in meeting performance and financial objectives.  It documents lessons learned from the PIR and updates CPIC and enterprise architecture processes as needed.

The Investment Manager shall conduct a PIR for any IT investment cancelled before going into operation.  During this review, results from the PIR are fed back to the Select and Control phases as lessons learned and actual versus expected results are compared.  This is done to (1) assess the IT investment’s impact on mission performance, (2) identify any changes or modifications to the IT investment that may be needed, and (3) revise the investment management process based on lessons learned.

2. The Investment Manager shall conduct an operational analysis annually for each steady state IT investment.  The operational analysis shall formally assess how well an investment is meeting program objectives, customer needs, and is performing within baseline cost, schedule, and performance goals. The results may signal to management the need to continue, enhance, or terminate the investment.

4.3 Enterprise Architecture

• Analyze business processes to take advantage of standardization based on common functions to customers.
• Ensure that automated systems optimally support the business processes and minimize the data collection burden.
• Acquire new systems and coordinate technology investments with the Federal business systems and architecture.
• Facilitate IT Capital Planning and Investment Control and coordinate information technology investments.

4.4 Privacy and Security

4.5 IT Strategic Planning

• HHS IT investments shall align with the HHS and HHS IT Strategic Plans and their respective mission and goals.  This alignment shall be articulated by all new and ongoing IT investments within their business case documentation.  Refer to the HHS and HHS IT Strategic Plans for specifics.  (Located on the HHS Intranet website:  www.hhs.gov)

4.6 IT Investment Planning

Figure 6:  IT Investment Categories  

1. Major IT investments are defined as those HHS IT investments that:

• Have total planned outlays (i.e., DME and Steady State) of $10 million or more in the budget year.
• Are for financial management and obligate more than $500,000 annually.
•  Are otherwise designated by the HHS CIO as critical to the HHS mission or to the administration of HHS programs, finances, property or other resources.
• Have life-cycle costs exceeding $50 million.

2. Tactical IT investments are defined as those IT investments that have not been    designated as major IT investments and:

•  Have planned total outlays (i.e., DME and Steady State) of $3 million or more in the budget year.
•  Are otherwise designated by the HHS CIO as significant to the HHS mission or to the administration of HHS programs, finances, property or other resources.

3. Supporting IT investments are those IT investments not otherwise designated as major or tactical that:

• Have planned total outlays (i.e., DME and Steady State) of less than $3 million in the budget year.
• Have been designated by the HHS CIO as supporting IT investments.

4. Life cycle cost is defined as all costs relating to an investment from initial planning to projected operational costs in the out-years throughout the expected lifetime of the investment.

4.7 IT Investment Funding

1. 4.7.1  HHS OPDIVs request appropriations for the full costs of IT investment acquisitions to ensure that all costs and benefits are fully considered when decisions are made.  Each useful segment of approved IT investments shall be fully funded with either regular annual appropriations or advance appropriations.  Full budgetary resources shall be requested for all ongoing and new proposals, or at least for each useful segment.
2. 4.7.2  Acquisitions using Share-in-Savings authority of Section 210 of the E-Government Act of 2002 shall be funded from funds that would have been appropriated for legacy system operations and maintenance.

4.8 IT Acquisition

1. 4.8.1  The primary purpose of IT investment acquisition-related activities is to support the execution of the investment decisions that are made by the ITIRB.
2. 4.8.2  IT investment acquisitions use competition to the greatest practical extent to provide the best value to the Government and to properly allocate risk between the Government and the contractor.  The availability and impact of alternative investment strategies and funding shall be thoroughly examined, to include the assurance that no existing private sector or government source is already capable of adequately meeting the need.
3. 4.8.3  IT investment acquisitions will consider the value proposition provided through compliance with the enterprise architecture to maximize the value of previous acquisitions, minimize redundant acquisitions, eliminate unnecessary transition costs to non-compliant technologies, and leverage investments in training and staffing  that have previously been made.
4. 4.8.4  The IT investment shall structure the acquisition into useful segments and shall support simplified or otherwise redesigned work processes to minimize cost, improve effectiveness, and use commercial off-the-shelf (COTS) software unless custom software is cost-effective as documented through pilot projects or prototypes.
5. 4.8.5  Acquisition plans shall be developed that reflect cost and schedule milestones and change as the baselines are adjusted, with inputs from all HHS plans, and that contain outputs that feed into the budget and CPIC processes.  The plans shall also link resources to results through performance and earned value management, and build from the current enterprise architecture and transition to the target architecture. 
6. 4.8.6  The use of prototypes or pilots shall be considered for large expensive IT investments where there is major uncertainty about proposed processes, procedures, or supporting information.  Where prototypes are acquired as part of the planning process, prototypes must be reported as full acquisitions.
7. 4.8.7  Accessibility in accordance with the Workforce Investment Act of 1998, Section 508 shall be addressed.
8. 4.8.8  IT investments under consideration shall maximize the usefulness, minimize the reporting burden and adequately protect the confidentiality of information.
9. 4.8.9   The prerogatives of state, local and tribal governments shall not be unnecessarily restricted.

5. Roles and Responsibilities

5.1 HHS Chief Information Officer (CIO)

• Establishing an effective Department CPIC program.
• Developing HHS policy and procedures for timely IT acquisition.
• Ensuring that HHS:
  • Cooperates with other agencies in the use of IT.
  • Promotes coordinated government infrastructure supported by a diversity of private suppliers.
  • Promotes effective and efficient IT capital planning in accordance with OMB Circular A-11.
  • Provides IT budget data to OMB in accordance with OMB Circular A-11.
  • Permits maximum use of HHS IT contracts by other agencies.
• Being an active participant in all HHS strategic management activities, including HHS strategic and operational planning.
• Advising the Assistant Secretary for Budget, Technology and Finance (ASBTF) on:
  • The information technology implications of strategic planning decisions.
  • Continuing, modernizing, or terminating IT investments.
  • Budget implications of IT decisions.
• Being an active participant throughout the HHS budget process in establishing HHS IT investment priorities.
• Chairing the Department ITIRB and CIO Council.
• Ensuring that the overall IT investment portfolio adheres to the mandates laid out in statutes and directives, including the Clinger-Cohen Act, OMB Circular A-11, and FISMA.
• Providing oversight for all individual IT investments requiring Department-level CPIC review.
• Working in conjunction with the Deputy Assistant Secretary for Human Resources and the Deputy Assistant Secretary for Acquisition Management and Policy, establishing criteria for the professional certification of IT Project Managers
• Reviewing and approving HHS OPDIV CPIC processes to ensure compliance with Department CPIC policy and to identify investments requiring Departmental CPIC oversight.

5.2 HHS OPDIV Chief Information Officers (CIOs)

• Establishing and maintaining an effective OPDIV CPIC program.
• Identifying HHS OPDIV IT investments that meet Departmental ITIRB review criteria.
• Prioritizing the HHS OPDIV IT investment portfolio to maximize the return on the IT resource investment against HHS OPDIV mission and goals, and advising the HHS CIO regarding relative priorities among HHS OPDIV IT investments.
• Providing oversight for all individual IT investments requiring HHS OPDIV-level CPIC review.
• Reviewing and approving sub-HHS OPDIV CPIC processes to ensure compliance with Department and HHS OPDIV CPIC policy.
• Serving as a member of the Department CIO Council and ITIRB.

5.3 Deputy Assistant Secretary (DAS) for Finance

• Serving as a member of the Department ITIRB.
• Reviewing IT investment business cases and CPIC reports coming before the Department ITIRB to ensure financial management implications are properly addressed.
• Ensuring IT investments that have financial management components or interact with financial systems are in compliance with financial standards and regulations.
• Assigning resources for CPIC critical partner support for Finance.
• Providing guidance to IT investment managers regarding financial management policies and issues.

5.4 Deputy Assistant Secretary (DAS) for Budget

• Serving as a member of the Department ITIRB.
• Providing budget guidance to the HHS CIO suitable to guide CPIC activities in support of budget formulation.
• Notifying the HHS CIO of all Department budget decisions affecting IT investments.
• Providing OMB passback guidance, appeals and results to the HHS CIO. 
• Assigning resources for CPIC critical partner support for Budget.
• Providing guidance to IT investment managers regarding budget policy and issues.
• Considering prioritized IT investment portfolio information in making budget formulation decisions.
• Reviewing IT investment business cases and CPIC reports coming before the Department ITIRB to address budget-related issues.

5.5 Deputy Assistant Secretary (DAS) for Human Resources (HR)

• Serving as a member of the Department ITIRB.
• Assigning resources for CPIC critical partner support for Human Resources.
• Reviewing IT investment business cases and CPIC reports coming before the Department ITIRB to address the human resource and union issues that may affect an investment’s progress and implementation.
• Providing guidance to IT investment managers regarding human-resource policy and issues.

5.6 Deputy Assistant Secretary for Acquisition Management and Policy (DAS AMP)

• Serving as a member of the Department ITIRB.
• Assigning resources for CPIC critical partner support for Acquisition Management.
• Reviewing IT investment business cases and CPIC reports coming before the Department ITIRB for conformance with the Federal Acquisition Regulation, Department acquisition policies and procedures, and successful business practices.  
• Working closely with HHS OPDIV contracting and program offices to develop and implement effective acquisition strategies and policies for IT investments.

5.7 Office of National Coordinator for Health Information Technology (ONC)

• Developing and implementing a comprehensive HHS strategy for health care information technology standards.
• Reviewing alignment of HHS IT investments to IT health care standards.

5.8 HHS Chief Enterprise Architect (CEA)

• Assigning resources for CPIC critical partner support for Enterprise Architecture.
• Providing guidance to IT investment managers regarding EA policy and issues.
• Reviewing IT investment business cases and CPIC reports coming before the Department IT governance boards for FEA alignment and conformance with Department architectural policy and standards (e.g., hardware, software, telecommunications and data).

5.9 HHS Chief Information Security Officer (CISO)

• Reviewing IT investment business cases and CPIC reports coming before the Department IT governance boards to ensure they are compliant with Department security and privacy policy and standards.
• Providing guidance to IT investment managers regarding security and privacy policy and issues.
• Assigning resources for CPIC critical partner support for Information Security and Privacy.

5.10 HHS Capital Planning and Investment Control Officer

• Maintaining an effective Department CPIC program.
• Chairing the HHS CPIC Advisory Board.
• Reviewing IT investment business cases and CPIC reports coming before the Department IT governance boards to ensure compliance with CPIC policies and procedures.
• Coordinating the review by CPIC Critical Partners and Department CIO Council and ITIRB members of matters coming before the CIO Council and ITIRB.
• Providing guidance to IT investment managers regarding CPIC policy and issues.

5.11 HHS Chief Technology Officer (CTO)

• Reviewing IT investment business cases and CPIC reports coming before the Department governance boards to ensure that optimal technical solutions are pursued.
• Providing guidance to IT investment managers regarding technical solutions and alternatives.

5.12 HHS/OPDIV Business Sponsor or Functional Manager

• Ensuring the integrity of the strategic business processes under development or enhancement.
• Serving as the primary user interface to the CIO and ITIRB.

5.13 OPDIV CPIC Managers

• Ensuring effective implementation of CPIC policy and procedures within the OPDIV
• Serving as a member of the HHS CPIC Advisory Board.
• Reviewing IT investment business cases and CPIC reports coming before the OPDIV IT governance boards to ensure compliance with CPIC policies and procedures.
• Coordinating the review by OPDIV CPIC Critical Partners and OPDIV TRB and ITIRB members of matters coming before the HHS CIO Council and ITIRB.
• Providing guidance to OPDIV IT investment managers regarding CPIC policy and issues.
• Obtain, document, and demonstrate the levels of experience and training appropriate for the type and size of investment being led.

5.14 HHS/OPDIV IT Investment Managers

• Comply with the requirements of this policy for IT investment planning and management.
• Provide investment data and reports as required by the HHS CPIC process.
• Plan, organize, control, and lead an IT investment to successful completion by accomplishing approved cost, time, and performance baselines.
• Develop and implement information systems security plans.
• Coordinate and integrate IT investment activities.
• Monitor IT investment activities to mitigate risk
• Implement and maintain quality assurance processes appropriate to the size and complexity of the investment.
• Participate in control (periodic and milestone) and evaluate phase IT investment reviews.
• Report on a timely basis any significant anticipated baseline variation along with a Corrective Action Plan (CAP) or rebaselining proposal, as appropriate.
• Execute investments and make investment tradeoff decisions among critical constraints such as scope, cost, schedule and policy needs.
• Ensure investment data is accurate and timely to enable effective portfolio decisions and tradeoffs to be made at the HHS OPDIV and Department levels.
• Follow CPIC processes and timelines by executing the procedures in a timely manner to ensure that all CPIC process milestones are met.
• Ensure that the appropriate EVM rigor, based on the EVM Tier categorization of the investment, is integrated into the management of the investment.

5.15 The IT Governance Organization

5.15.1  The HHS Information Technology Investment Review Board (ITIRB) shall:

• • Be chaired by the HHS CIO with membership comprised of the HHS Deputy Assistant Secretaries for Budget, Finance, Acquisition Management and Policy, and Human Resources and the HHS OPDIV CIOs.
  • Give business approval (including funding level and source) for IT investments for which the HHS ITIRB has CPIC review authority.
  • Approve cost, schedule and performance baselines for all HHS IT investments approved by the HHS ITIRB.
  • Ensure that the Department’s IT investments individually and collectively maximize mission and financial returns.
  • Establish a prioritized HHS IT investment portfolio during each annual budget cycle to support HHS budget formulation.
  • Ensure that each IT investment requiring Department-level review complies with CPIC and other management policies (e.g., IT, financial, acquisition, enterprise architecture, and security).
  • Recommend changes to Department policies relevant to IT investment management.
  • Approve exceptions to established CPIC policy and procedure.

5.15.2  Business Steering Committee membership consists of key business managers from HHS. Steering Committee shall:

• • Review and recommend IT investments that ensure integration and alignment with HHS business goals and objectives
  • Ensure that the proposed portfolio of systems in their particular business domain area meets HHS business requirements.
  • Look across the organization and its key business functions to determine impacts on other systems, business operations, etc. 
  • Interface with business sponsors and investment managers
  • Provide recommendations to the ITIRB regarding business issues.

5.15.3  The HHS CIO Council shall advise the ITIRB regarding the technical soundness of HHS IT investments requiring Departmental review.  The HHS CIO Council shall:

• • Be chaired by the HHS CIO with membership comprised of all HHS OPDIV CIOs. 
  • Review the technical approach of individual IT investments coming before the ITIRB and make recommendations to the ITIRB regarding technical aspects of affordability, soundness of design, risk, and compliance with architectural and security standards.
  • Review the IT investment planning and/or status of each individual IT investment coming before the ITIRB to ensure that the investment’s business case, IT investment plan, alternatives analysis and other IT investment documentation are complete, accurate and in compliance with Department policies and standards.  Recommend approval or non-approval to the ITIRB with comments.
  • Recommend a prioritized portfolio to the ITIRB during the budget formulation cycle and upon request of the ITIRB.

5.15.4  The HHS CPIC Advisory Board (CPIC-AB) shall serve, through the HHS Chief Enterprise Architect, as the primary advisory board to the HHS Chief Information Officer (CIO) and the HHS CIO Council on CPIC policy, procedures, data standards and tool configuration.  The CPIC-AB shall be chaired by the HHS IT Capital Planning and Investment Control Officer with membership comprised of the PMT Program Manager, a representative from each HHS OPDIV and a technical representative from the IT Service Center.  The CPIC-AB shall perform the following functions:

• • Provide recommendations to ensure the continued viability, integration and maximum return on investment of all aspects of the HHS Enterprise-wide CPIC program and its supporting HHS Portfolio Management Tool.
  • Assess the viability and impact of all proposals, change requests and enhancements across HHS OPDIVs related to CPIC policy, procedures, and data standards.
  • Review and evaluate all proposals, change requests and enhancements related to the acquisition, implementation, operation, and data standards of the HHS Portfolio Management Tool.
  • Establish and monitor Memoranda of Understanding with any HHS OPDIVs that acquire or operate separate instances of portfolio or IT investment management applications, or otherwise interface with the HHS Portfolio Management Tool.

5.15.5  The HHS CPIC Critical Partners shall participate within the CPIC process to ensure that IT investments comply with HHS policy in the respective critical partner functional areas and to advise the HHS IT Governance Boards and individual IT investment managers regarding issues relating to their specific functional areas.  Critical Partners are Subject Matter Experts from the following functional areas:

• • Enterprise Architecture ensures FEA alignment and conformance with Department architectural policy and standards (e.g., hardware, software, telecommunications and data).
  • Security and Privacy ensures full compliance with all HHS security and privacy policies and standards. 
  • Acquisition Management ensures that IT investments conform to the Federal Acquisition Regulation (FAR), Department acquisition policies and procedures, successful business practices, and the development and implementation of effective acquisition strategies and policies for IT investments
  • Finance ensures financial management implications are properly addressed and IT investments that have financial management components or interact with financial systems are in compliance with financial standards and regulations. 
  • Budget guides CPIC activities in support of budget formulation.  It also considers prioritized IT investment portfolio information in making budget formulation decisions, as well as addresses budget-related issues and decisions affecting IT investments, including OMB passback guidance, appeals and results.
  • Human Resources addresses the human resource and union issues that may affect an investment’s progress and implementation, and provides guidance to IT investment managers regarding human-resource policy and issues.

These functional areas are represented, respectively, by the:

• • HHS Chief Enterprise Architect
  • HHS Chief Security Officer
  • Deputy Assistant Secretary for Acquisition Management & Policy
  • Deputy Assistant Secretary for Finance
  • Deputy Assistant Secretary for Budget
  • Deputy Assistant Secretary for Human Resources

6. Applicable Policies and Guidance

6.1 Laws

6.2 Regulations and Guidance

7. Information and Assistance

8. Effective Date/Implementation

9.  Approved

_________________/s/_____________        12/30/2005

Charles Havekost, HHS Chief Information Officer