1. IT Management at NSF George O. Strawn NSF CIO

2. Outline  GAO Study of Agency IT Management  GAO Recommendations to NSF  BAH Draft Recommendations to NSF

3. Statutory Framework for IT Mgmt  Paperwork Reduction Act of 1995 Clinger-Cohen Act of 1996 E-Government Act of 2002 FISMA Act of 2002 Exec Order 13011, Fed IT Exec Order 13103, Software Piracy  GAO identified 30 IT management practices and reviewed 26 agencies for compliance

4. GAO Study of Agency IT Management  The title says it all: “Government-wide Strategic Planning, Performance Measurement (SP&PM), and Investment Management (IM) Can Be Further Improved” 46% of SP&PM practices are in place, 41% are partially in place, and 7% are not in place 44% of IM practices are in place, 37% are partially in place, and 17% are not in place

5. SP&PM Recommendations to NSF  Document IT strategic mgmt processes  Include IT security requirements in annual performance plan  Implement a process for assigning roles and responsibilities for achieving IT goals  Develop performance measures for controls to prevent software piracy  Develop mechanism for benchmarking IT management processes

6. IM Recommendations to NSF  Develop an IT management investment guide (IT IM vs other plans and processes; IT capital planning and invest control)  Implement a structured IT selection process  Involve the “IT investment management board” in controlling and evaluating IT investments  Define and document the elements of post- implementation reviews

7. IT Management Strategy Source: Business Analysis Technical Proposal & Statement of Work IT Governance FrmwrkIT VisionTechnology Forecast IT Mgmt Structures CPIC Performance Enterprise Arch. Long Term Imple. Plan Detailed Imple. Plan Business Cases EA Version 2.0 EMO Corp. Dir. SIA NGGMS Annotated LT plan IT Vision & Strategy Sustained Operations Plan EMO Data Quality Assurance ConOps* Disaster Recovery* * Already established

8. IT Governance Framework Source: Business Analysis Technical Proposal & Statement of Work Shaded components are addressed in the DRAFT NSF TT Governance Framework v0.51 1/16/04.doc. Non-shaded areas will be addressed in the final document v1.0 3/31/04 Baseline (As is) SDLC Technology Network Data Security Target (To Be) Implementation Plan CPICPerformanceEnterprise Arch. Performance Meas. Reporting IT Capital Planning Investment Management Business Cases Mgmt. Structures Committees Working groups NSF Personnel Investment CalendarSchedules IT Risk ManagementChange Control Standards Mgmt.

9. The CIO Advisory Committee (CIOAC) could become an IT Management Board as envisioned by GAO SMIG CIOAC KMAT E-Bit SWG WAG CIMG

10. Possible CIOAC sub-teams and functions  Capital Planning Investment Control coordinate IT capital investments made by NSF  Enterprise Architecture updating and maintaining EA managing the adoption, modification and retirement of standards in : Technology, Data, Network and Security address new projects, updates to existing systems and retirement of legacy systems  Performance & Risk management helps to control risks for major IT investments through and Identify Assess, Prioritize & Maintain procedure NB: The CIOAC, if expanded as described here, would probably take the place of the SASB