HHS OCIO Policies, Standards and Charters

Policies, Standards, and Charters - Categories

Capital Planning and Investment Control (CPIC)
Charters
Earned Value Management
Enterprise Architecture

Link to Historical Policies, Standards, Charters

Information Collection
IT Enterprise Solutions
IT Policy Development and Review Process
IT Security and Privacy
Mail Management

Personal Use of IT Resources
Printing Management
Records Management
Section 508
Standards
Web Policies

Policy is defined as the "what" and the "when" whereas Procedure is defined as the "how".

Oversight groups (the President; Congress; Office of Management and Budget (OMB); General Services Agency (GSA); Office of Personnel Management (OPM); etc.) set the standards, the goal, the expectations that all Cabinet-Level Departments and their equivalents are to meet.

The delta between where a Department is from that oversight-set goal, that expectation; that is the Department's Policy on "what" and "when" activities must occur in order to achieve progress towards that set that goal.

The HTML links below will take you to the Policy, Standard, or Charter listed. If you would like to view a summary of all the documents shown below, please click here: OCIO Summary Page.

POLICIES [30 Total]

Description	Number	Date Issued	HTML Document	Word Document
Capital Planning and Investment Control [4 Policies]
HHS OCIO Policy for Information Technology (IT) Enterprise Performance Life Cycle (EPLC)	2008-0004.001	10/06/2008	HTML	[DOC - 206KB]
HHS-OCIO Policy for IT Earned Value Management See Procedures Section for EVM Procedures Document	2007-0001	06/11/2007	HTML	[DOC - 272KB]
HHS Policy for IT Capital Planning and Investment Control (CPIC) See Procedures Section for CPIC Procedures Document and its related Appendices Document	2005-0005.001	12/30/2005	HTML	[DOC - 153KB]
HHS IRM Policy for Conducting Information Technology Alternatives Analysis	2003-0002	06/13/2003	HTML	[DOC - 121KB]
Enterprise Architecture [3 Policies]
Policy for Management of the Enterprise IT System Inventory	2009-0004	07/28/2009	HTML	[DOC - 153KB]
HHS-OCIO IT Policy for Enterprise Architecture (EA)	2008-0003.001	08/07/2008	HTML	[DOC - 269 KB]
CIO Roles and Responsibilities – Circular No. IRM-101		03/1999	HTML	[DOC - 495KB]
Information Collection
IT Enterprise Solutions [8 Policies]
HHS-OCIO IT Policy for Networx Program Designated Agency Representatives	2009-0001	01/14/2009	HTML	[DOC - 310KB]
HHS-OCIO Trusted Internet Connection Access Provider (TICAP)Steering Committee Charter	2008-0002.001C	06/23/2008	HTML	[DOC - 205KB]
HHS-OCIO IT Policy for HHS Mail Change Management	2006-0002	03/02/2006	HTML	[DOC - 700KB]
HHS IRM Policy for Government Emergency Telecommunication System Cards Ordering, Usage and Termination	2002-0001	11/25/2002	HTML	[DOC - 146KB]
HHS IRM Policy for Directory Services Using LDAP	2000-0012	01/08/2001	HTML	[DOC - 84KB]
HHS IRM Policy for Public Key Infrastructure (PKI); Certification Authority (CA)	2000-0011	01/08/2001	HTML	[DOC - 92KB]
HHS IRM Policy for Active Directory	2000-0010	01/08/2001	HTML	[DOC - 75KB]
Use of Broadcast Messages, Spamming and Targeted Audiences	2000-0004	01/08/2001	HTML	[DOC - 103KB]
IT Policy Development and Review Process [4 Policies]
HHS Policy for IT Policy Development	2006-0004	11/28/2006	HTML	[DOC - 224KB]
HHS OCIO Policy for E-Gov. Forms	2006-0003	06/07/2006	HTML	[DOC - 700KB]
HHS IRM Policy for Personal Use of Information Technology Resources	2006-0001	02/17/2006	HTML	[DOC - 156KB]
HHS IRM Policy For Comments From And Responses To Operating Divisions On Newly Developed Policies and CIO Council and ITIRB Clearance Documents	2003-0001	02/14/2003	HTML	[DOC - 92KB]
IT Security and Privacy [9 Policies]
HHS Policy for Privacy Impact Assessments (PIA)	2009-0002.001	02/09/2009	HTML	[DOC - 258KB]
HHS Policy for Responding to Breaches of Personally Identifiable Information (PII)	2008-0001.003	11/17/2008	HTML	[DOC - 181KB]
HHS Policy for Department-wide Information Security	2007-0002	09/24/2007	HTML	[DOC - 168KB]
HHS IRM Information Security Program Policy	2004-0002.001	12/15/2004	HTML	[DOC - 461KB]
Usage of Persistent Cookies	2000-0009	01/08/2001	HTML	[DOC - 79KB]
HHS IRM Policy for Prevention, Detection, Removal and Reporting of Malicious Software	2000-0007	01/08/2001	HTML	[DOC - 125KB]
HHS IRM Policy for Establishing an Incident Response Capability	2000-0006	01/08/2001	HTML	[DOC - 111KB]
HHS IRM Policy for IT Security for Remote Access	2000-0005	01/08/2001	HTML	[DOC - 96KB]
Mail Management
Printing Management
Records Management [2 Policies]
HHS Policy for Records Management for E-mails	2008-0002.001	05/15/2008	HTML	[DOC - 230KB]
HHS Policy for Records Management	2007-0004.001	01/30/2008	HTML	[DOC - 227KB]
Section 508
Web Policies [1 Policy]
HHS Policy for Internet Domain Names	WEB-2005-01	06/13/2005	HTML

PROCEDURES AND APPENDICES
Procedures and Appendices are available for CPIC and EVM at the HHS intranet site for authorized users.

STANDARDS [9 Total]

Description	Number	Date Issued	HTML Document	Word Document
IT Security and Privacy [9 Standards]
HHS-OCIO Standard for IEEE 802.11 WLAN	2009-0003.001S	7/27/2009	HTML	[DOC - 40KB]
HHS-OCIO Standard for Encryption Language in HHS Contracts	2009-0002.001S	01/30/2008	HTML	[DOC - 40KB]
HHS-OCIO Standard for Security Configurations Language in HHS Contracts	2009-0001.001S	01/30/2008	HTML	[DOC - 45KB]
HHS Standard for Encryption	2008-0007.001S	12/23/2008	HTML
HHS Standard for FISMA Inventory Management	2008-0006.001S	12/23/2008	HTML	[DOC - 54KB]
HHS Standard for Plan of Action and Milestones	2008-0005.001S	12/23/2008	HTML	[DOC - 125KB]
HHS Standard for the Segregation of Development/Test Environments from Production	2008-0003.002S	08/07/2008	HTML	[DOC - 40KB]
HHS Standard for Managing Outbound Web Traffic	2008-0002.003S	06/06/2008	HTML	[DOC - 37KB]
HHS Rules of Behavior (For Use of Technology Resources and Information)	2008-0001.003S	02/12/2008	HTML	[DOC - 115KB]
Enterprise Systems

CHARTERS [4 Total]

Description	Number	Date Issued	HTML Document	Word Document
Enterprise Architecture [1 Charter]
CIO Council Charter	2007-0001.001C	06/27/2007	HTML	[DOC - 463KB]
Records Management [1 Charter]
Records Management Council Charter	2007-0002.001C	08/21/2007	HTML	[DOC- 159KB]
IT Security and Privacy[1 Charter]
Personally Identifiable Information (PII) Breach Response Team (BRT) Charter	2008.0001.003C	11/17/2008	HTML	[DOC- 161 KB]
Enterprise Systems [1 Charter]
HHS Trusted Internet Connection Access Provider (TICAP) Steering Committee Charter	2008.0002.001C	06/23/2008	HTML