The IA Roadmap Baked-in versus Brushed-on Integrating IA into Major Programs Art King IBM Business Consulting Services Acquisition Team, DIAP ext th Annual IA Workshop 3 February 2004 Atlanta, Georgia

2 Purpose The IA Roadmap is conceptual device for organizing IA implementation activities in a manner that is relevant to a typical acquisition program (i.e. an IA “thread” teased out of the overall program effort) It is a generic approach that must be customized for unique situations, such as: –SCI processing –Late program initiation The IA Roadmap is being introduced in the DAU “IA for Program Managers” Learning Module The IA Roadmap has been integrated into the Enterprise Integration (EI) Toolkit for COTS/ERP acquisitions

3 IA Roadmap Steps Establish an IA organization Identify IA requirements Develop an acquisition IA strategy Secure resources for IA Initiate DITSCAP Incorporate IA solutions Test and evaluate IA solutions Accredit the system Maintain the system’s security posture throughout its life-cycle

4 IA Roadmap Correlation to DoD 5000 Lifecycle Establish an IA organization Identify IA requirements Develop an acquisition IA strategy Secure resources for IA Initiate DITSCAP Incorporate IA solutions Test and evaluate IA solutions Accredit the system Maintain the system’s security posture throughout its life-cycle

5 Slide from DAG 28 June

6 IA Roadmap Capsule Step Descriptions 1. Establish an IA organization Trained IA professional as IA Manager IA support – organic/matrixed/contracted 2. Identify IA requirements Specified in Requirements/Capabilities Documents Baseline IA Controls Other requirements (e.g. IPv6, DoD PKI) 3. Develop an acquisition IA strategy Required for Mission Critical/Mission Essential IT systems; recommended for others Approved by Component CIO ACAT 1AC, ACAT 1AM and ACAT 1D reviewed by DoD CIO

7 IA Roadmap Capsule Step Descriptions 4.Secure resources for IA Include IA in program budget Determine funding sources 5.Initiate DITSCAP Begin Phase I SSAA effort Phase I SSAA should be signed at/near MS-B 6.Incorporate IA solutions Systems Security Engineering efforts Procurement of IA/IA enabled products Implementing security policies, plans, procedures IA Training

8 IA Roadmap Capsule Step Descriptions 8.Test and evaluate IA solutions Developmental Test (DT) Security Test & Evaluation, C&A activities Operational Test (OT ) 9.Accredit the system DITSCAP Phase III completed ATO/IATO should be issued prior to MS-C 10. Maintain the system’s security posture throughout its life-cycle Periodic assessments Re-accreditation minimum of 3 years “Fielded System” assessments by Service OTA

9 For your consideration Is this tool helpful? If it is of value, how best to document and disseminate it? How can it be improved?

10 DIAP Acquisition Team Points of Contact Mr. Eustace King ASD(NII)/DIAP-Technologies and Capabilities (703) Mr. Art King (IBM) (703) ext. 104 Mr. Dominic Cussatt (IBM) (703) ext. 119