The Department of Homeland Security

1. The Department of Homeland Security CPIC Innovation and DHSFirst Annual Federal CPIC ConferenceCharles A. SantangeloDirector, CPIC, U.S. Department of Homeland SecurityJuly 22, 2008

2. Outline • CPIC: What is it? • PPBE – CPIC Timeline • Capital Planning – Key Elements • Innovations • FY10 Budget Cycle Exhibit 300 Review Process • PRS/nPRS -- New Periodic Reporting System • FY10-14 DHS IT Budget Review • Earned Value Management • Operational Analysis • High Risk and Management Watch Lists • DHS CPIC Resources • DHS CPIC Information Sources • DHS CPIC Training Program • Points of Contact

3. CPIC: What is it? • Capital Planning and Investment Control (CPIC) - is a structured, integrated approach to selecting, managing, and evaluating investments. • The CPIC process integrates strategic planning, enterprise architecture, privacy, security, budgeting, portfolio management, procurement, and the management of assets. • CPIC directed out of DHS OCIO/EBMO

4. PPBE* - CPIC Timeline Develop Long - Range Program & Component Budgets to DHS FYHSP Budget Final RAD DHS PPBE DHS RAP Plans (BY10 - 14) Budget Review (BY10 – 14) (BY10) (BY10) (BY10 – -14) Dec. – Feb. Mid-July Mid - Sept. April Early Aug - Oct July Nov Dec Jan Feb Mar Apr May June Aug Sept Aug Final Exhibit 300 (BY10) Late Nov. Feb. Early Sept. Early June Passback Submit to Submit to Exhibit 300 and 53s due to DHS (BY09) Congress OMB (BY10) (BY09) CPIC (BY10) *PPBE: Planning, Programming, Budget and Execution

5. Capital Planning: Some Key Elements • Business Cases (Exhibit 300s) and IT Portfolio (Exhibit 53) are produced and submitted to OMB • Periodic Reporting is the primary vehicle for collecting cost, schedule and performance data from Component programs on a quarterly basis. • IT Budget Process: OCIO reviews IT budgets of Components and sends its recommendations to CFO for consideration. • Earned Value Management (EVM) is the OMB-mandated approach for evaluating program cost, schedule and performance. • Operational Analysis (OA) is the method traditionally used to capture cost and performance data for investments in the O&M phase. • High Risk List/Management Watch List – OMB monitors the performance of DHS investments and places under-performing ones on one of these lists.

6. Innovation 1: FY10 Budget Cycle Exhibit 300 Review Process • DHS, only five years old, now ranks about the average of all federal agencies in OMB 300 scoring with a score of 33, a broad indication of budget management quality and progress. In 2008 our score was below 29. • Our internal scoring review team understands OMB’s priorities: • OMB provided either the same score or a higher score for 82% of the total sectional scores for DHS’s Exhibit 300s in FY09. Internal reviews force improvements in business case quality prior to submission to OMB. • Successful Scoring and Coaching Methodology • Briefings to Components on OMB 300 Changes (May) • Independent Scoring by Outside Consultants (Fujitsu) of entire Exhibit 300 (June) • Expert review by DHS SMEs of selected Exhibit 300 sections and associated scores (Funding, Privacy, Project Management, Acquisition, Enterprise Architecture, Security, and Operational Analysis review) (June-July). • Presentations by SMEs at biweekly CAG meetings • Feedback to Components (July) • Second round of Scoring (July-August) • Coaching for Project Management Offices with poorly scoring Exhibits 300 (July-August) • Goes to OMB for final scoring (September) • Late November: OMB “Passback” to Components • Analyze and Share Lessons Learned after Passback

7. OMB Exhibit 300 • Authority • OMB Circular A-11: Planning, Budgeting, Acquisition, and Management of Capital Assets, Section 300 • Legislation • Article 1, Section 9, US Constitution – Permission to spend government funds • Anti-Deficiency Act (1906) – Control Spending • Chief Financial Officers Act (1990) – Establish Accountability • GPRA (1993) – Analyze and measure performance • Clinger-Cohen Act (1996) – requires disciplined CPIC process for information technology • FASA Title V (1994) – OMB is required to coordinate its collection of agency information for its reports to Congress • FISMA – requires agencies to integrate IT security into CPIC and EA • E-Government (2002) – agencies are required to develop performance measures • Others: Energy Policy, PRA

8. Periodic ReportingHow Process is Currently Conducted • Integrated decision-support process to capture and assess department-wide performance metrics on major acquisition programs • Quarterly reporting for all Level 1 and 2 (over $50 million Lifecycle) investments • Data call issued after end of quarter, followed by training sessions • Inputs due 4 weeks after end of quarter

9. Periodic Reporting (Continued) • Analyses (2-3 months after end of quarter) • DHS Internal PMA Scorecards • OMB High Risk Report (Breach Report) • President’s Management Agenda (PMA) E-Gov Scorecard • Component Summary Report • Use Prosight and SAS software tools for Reports

10. Innovation 2: PRS/nPRS Comparison • New PRS System reports: • Monthly • At Project Level (including Contracts) • Current system reports: • Quarterly • At Program level

11. nPRS Benefits • More timely and fact-based decision-making (early notification) • Enhance program and project performance/Decrease risk of project failure • Provide program/project visibility • Greater use of SAS software to improve usefulness to senior management • Enhance data analysis and incorporate risk assessment through use of Probability of Project Success (PoPS). • One-time entry, used by many; e.g. Reuse for OMB 300 in BY11 (Cost & Schedule, Milestones, Contracts and Earned Value) • Reduce data entry by pre-populating forms • User alert for upcoming IRB • Track program baseline

12. Innovation 3: FY10-14 DHS IT Budget Review • DHS’s IT Budget Review collects all IT budget information from 15 DHS Components. • OCIO works closely with the OCFO. • OCIO taps the knowledge of three SMEs and six Portfolio Managers to provide informed analysis to CFO. • The DHS CIO meets with Component CIOs about its priorities (May/June) • The CFO’s Program Review Board (PRB) issue teams review Component initiatives affected by CFO/CIO priority issues (OCIO participates) • OCIO recommendations reflected in CFO’s Resource Allocation Decision (RAD)

13. FY10-14 OCIO Data and Analysis Overview • Portfolio Data • Cross Cutting • Transition Plans to Targets • Consumer/Provider of DHS Services • Component CIOs: Review/Analyze all component IT investments and over-guidance requests • OCIO SMEs: Focus reviews in CIO Priority areas (Infrastructure, EACOE/EAB, ITAR, Security, etc.) • Portfolio Managers:Screening, Case Mgt, Infrastructure, HR, Financial, Geospatial

14. Innovation 4: Earned Value Management • Earned Value challenges • How to capture performance metrics from Components with investments in the development phase whose contracts are Firm Fixed Price (FFP), Level of Effort (LOE) or Time and Materials (T&M)? • How to capture such metrics for Components with Non-ANSI Compliant Accounting Systems? • Our Approach at DHS OCIO • Discussed with OMB the use of EVM “work-arounds” • Met with Social Security Administration, Energy Department and Treasury Department to identify EVM “best practices” • Developing EVM work-around, along the lines of a modified Operational Analysis, for development projects with FFP, LOE and T&M contracts. • Key elements for EVM work-arounds for these types of contracts are: • Costs to be tied to Milestones • Identification of Percentage of milestones completed • Identification of Cost Variance and Cost Variance Percentage • Identification of Schedule Variance and Schedule Variance Percentage

15. Innovation 5: Operational Analysis • Steady state IT programs are required to annually perform and report on an OA to DHS in the Exhibit 300 • Steady state non-IT programs are required to annually perform and have the Component review an OA • IT PMOs will document evidence of their OA in the Exhibit 300 (sections 1.A, 1,E, and Part III) • OA information on IT programs will be reviewed and scored as part of the Exhibit 300 scoring process • New OA Guidance for Components is now available

16. Innovation 6: High Risk List/Management Watch List • DHS has 32 investments on the OMB High Risk list, and 27 investments on the MWL -- a 61% decrease in MWL investments since submission to OMB • EBMO is monitoring the remediation plans for these investments, with a goal of dramatically reducing the numbers by the end of the Fiscal Year (FY). • Key factors for listings are • Appropriate level of Project Manager (PM) Certification • Investments operating within 10% variance for cost and schedule from the approved baseline • Lack of approved baseline • Low OMB 300 scores (Watch List only) • APB process in the Chief Procurement Office has been improved; CIO working with CPO to expedite improved APBs and PM certification. • nPRS system now providing additional performance data to CPO.

17. DHS CIOCPIC Resources • CPIC Administrator Group • Made up of CPIC staff from each • Component • Meets every first and third Tuesday at DHS HQ • Discusses CPIC policies, procedures, processes, systems, timelines, statuses, and training • Acts as the Configuration Change Board (CCB) for IMS • IMS/PRS Support Services • Fujitsu Consulting provides Help • Desk support, maintenance, training, • scoring and coaching for DHS.

18. CPIC Information Sources • OMB Circular A-11 • Homeland Security Enterprise Architecture (HLS EA), Transition Plan for IT investments • DHS Investment Review Process Management Directive (MD 1400) [Change pending] • DHS CPIC Guide • DHS EVM & Operational Analysis Guides • Investment Management System (IMS) Guidance • Periodic Reporting Manual

19. DHS CPIC Training • We offer training for federal government employees and DHS contractors working on Exhibit 300s in the areas of: • Business Case preparation • Cost Benefit Analysis (CBA) Course • Basic Earned Value Management (EVM) Course • Advanced EVM Course • IMS Hands-On Training • Periodic Reporting and New Periodic Reporting • Investment Lifecycle

20. Points of Contact • DHS CIO: Charles Santangelo (Charles.Santangelo@dhs.gov) Becky Nichols (Rebecca.Nichols@dhs.gov) THANK YOU!