1. IT Management and Modernization (IT M&M) August Meeting
08/14/18

2. Agenda Opening Remarks Review of ITMM COI Existing Projects ELC Update
Wrap Up

3. IT M&M Project Updates Expand FITARA Implementation Guidance
Technology Business Management
IT Modernization Best Practices

4. Expand FITARA Implementation Guidance
Background
Through OMB request, ACT-IAC created a number of artifacts to support agencies in FITARA implementation, including an IT Management Maturity Model that describes maturity in five functions, including overall IT governance.
The model describes the attributes of what maturity is in a government agency, and for governance, includes the attributes of horizontal integration (across CXOs, mission and business owners), vertical integration (from HQ to bureaus or components), right authority (decision making at appropriate levels), right data (having good data an analysis to support decisions), etc.
The model is helpful to assess level of governance maturity but does not fully address how to improve an agency’s maturity nor present sample models.
Project Goals
Develop expanded toolkit ACT-IAC FITARA Maturity Model for FITARA 6.0 (Megabyte, MGT, Cyber, etc..)
Enhance FITARA model performance metrics (e.g. gaps in scorecard, etc.)
Gov Sponsor
Flip Anderson, Executive Director of FITARA Operations at USDA

5. FITARA Expansion Project Scope
Reconstituted a team to create version 2 of the IT Management Maturity Model:
Add Cyber Security as a 6th function in the model (e.g. NIST model attributes)
Add MGT Act, MEGABYTE and TBM specific attributes/traits in model
Update model for non-IT staff language
Cross-reference other FITARA documentation (e.g. OMB Common Baseline)
Reference artifacts that would help indicate level of maturity for the attribute trait
Clarify language and add definitions
Validate MGT, TBM & Cyber updates with USDA team
Have Federal CIO Council, OMB, and GAO review before publishing
Develop a generic Implementation Plan for agencies based on the USDA plan
Create drafts of two potential additional measures for the FITARA Scorecard:
A measure on Project and Program Management training and certification
A measure on Governance/Process maturity
Work to become the liaison between Agencies/OMB/GAO/Hill on feedback and discussions related to the FITARA Scorecard.

6. FITARA Maturity Model Project Plan

7. FITARA 6.0 Scorecard for input into the Maturity Model
Agency CIO Authority Enhancements (Incremental Development) – Avoid “big bang” approach measure investments to deliver functionality every 6 months
Enhanced Transparency and Improved Risk Management (OMB’s IT Dashboard) - Categorize their major IT investments by risk –addressing the causes of the risk
Portfolio Review (PortfolioStat) - process to review agency IT investment portfolios to, increase efficiency and effectiveness, and identify potential waste and duplication
Federal Data Center Optimization Initiative (DCOI) - data center inventory, along with a strategy for consolidating and optimizing the data centers
Software Licensing (included in both FITARA and MEGABYTE) - establish a comprehensive, regularly updated inventory of software licenses and analyze software usage to make cost-effective decisions
Modernizing Government Technology Act (MGT) – establish working capital funds (WCF) for use in transitioning from legacy IT systems, as well as for addressing evolving modernization and threats to information security.
Federal Information Security Modernization Act of 2014 (FISMA) - promote the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies

8. Technology Business Management (TBM)
Background
Technology Business Management (TBM) is a value-management methodology to provide IT cost, consumption, and performance transparency.
Initiated in private industry and adopted by Australia, OMB included TBM into the F19 budget formulation process per recent A-11 and CPIC guidance.
Implementation necessitates a partnership of CFOs and CIOs.
Project Goals
Longer Term: Develop playbook to assist agencies in implementing TBM (OMB requests delay until PMA is released).
Short Term: “What does TBM Mean to Me” project to help stakeholders across budget formulation and execution, acquisitions and IT understand the value of TBM.
Gov Sponsor
Jon Kraden, Director of Customer Coordination & Communication, GSA

9. Technology Business Management Project
Project Scope:
This project will assist senior government leaders in improving their understanding and ability to articulate TBM to their portfolio and program managers and staff to support the TBM adoption in the planning process, and driving business goals through a standard methodology
Project Deliverable-TBM Value Conversation:
The deliverable is a document that discusses the C-Suite value conversations that TBM can enable between various agency stakeholders
Document Outline
What does TBM mean?
What does TBM mean to different groups
CIO, CAO, CFO, Sr. Leadership
What are TBM Best Practices to conduct Value Conversations
What works
What doesn’t work

10. Technology Business Management Project Plan
Date
Define Scope and Action Plan
4/27/2018
Gather Information (research)
5/4/2018
Gather Information (interviews)
5/18/2018
Draft Guide / White Paper
8/22/2018
OMB/GSA Review
8/31/2018
Socialize Guide / White Paper
9/7/2018
Final Deliverable
9/14/2018

11. NEW - Modernization Best Practices & Case Studies
Background
Agencies are in varying stages of implementing IT modernization
Sharing lessons learned and best practices can assist agencies in successfully modernizing their IT portfolio
Harvest government case studies and provide a playbook on IT Modernization best practices
Project Goals
Interview multiple departments and agencies who have tackled modernization
Document case studies from the interview results highlighting the challenge, approach and results as well as lessons learned
Distill results into a set of best practices to provide agencies with roadmap/playbook for initiating and driving IT Modernization
Gov Sponsor
TBD

12. ELC 2018 Conference Imagine Nation ELC 2018 – October 14-17
ITMM Session Topic Areas Summary
Modernization:
FITARA Forward - Propelling the Mission Forward
Navigating the Labyrinth from Legacy to Modernization
IT Modernization Dark Data Discovery and Classification in your Journey to the Cloud
Optimizing for Excellence:
Driving Cross-Fed Efficiency via PMA
TMF Pioneers: Business Case Tips & Project Status

13. Wrap Up and Next Steps Calendar Ahead Next Steps
ITMM 2019 Project Charter/Workplan due 8/30
Next monthly ITM&M meeting scheduled for 9/11 - speaker TBD
Next Steps
Ongoing Project Activities (FITARA, TBM, Cloud Security)
Initiation of “IT Modernization Best Practice Project”
Finalize ITMM Project Charter
ELC Modernization Track activities
September Meeting - Finalize Speaker

14. Questions

15. Cloud Security for Ongoing Operations
Background
As more government information system are migrated – or being prepared to migrate – to a cloud hosting model, Federal CISOs are faced with the challenge of identifying, mitigating risk and managing risk to these systems in a new operational environment.
There is a need to collect best practices, lessons learned and additional guidance, gleaned from both agency and industry SMEs, for cloud security requirements and managing cloud operations.
This will be a cross-collaboration project with Cybersecurity COI.
Project Goals
Produce actionable, scenario-based playbooks for IT leaders (CISOs, CTO, CIO) around the management of cloud operations including: Identity, Credential & Access Management in the Cloud; Trusted Connectivity in the Cloud (Cloud Architecture); and Implementing Cloud Optimized CDM.
The project will provide best practices and lessons learned guidance supporting the modernizing government technology for the Cloud and IT security communities.
Gov Sponsor
Beau Hauser, CISO SBA

16. Cloud Security-updates
Project Plan
Call for volunteers & conduct project kickoff
Refine the desired goals and objectives of the project with SCC and ODNI PE-ISE sponsor
Conduct independent research on CISO pains / gains / concerns related to managing cloud operations (e.g. input from federal, state and local government and private sector, etc..)
Conduct interviews with government and industry leaders to on cloud security challenges and potential solutions.
Identify several case studies of several ICAM initiatives and best practices, particularly those that apply to law enforcement – care ICAM best for law enforcement and other applications
Key Deliverable
Cloud security management playbook, with discrete, actionable guidance tied to the pains and gains, based on the best thinking/lessons learned including:
Identity, Credential & Access Management in the Cloud
Trusted Connectivity in the Cloud (Cloud Architecture)
Implementing Cloud Optimized CDM