I-TIPS: Initiative Manager OMB

Part I: Capital Asset Plan and Business Case (All Assets)

Agency: 005 Bureau: 3 Account Title: Account Identification Code: 000-00-000000-0 Program Activity: Name of Project: e-Payroll Unique Project Identifier: (IT only) 00503020001801300 (See Section 53.7) Project Initiation Date: 10/01/2002 Project Planned Completion Date: 09/30/2009 This Project is: 01

Project/useful segment is funded?: Fully

Was the project approved by OMB for previous Year Budget Cycle?: No

Did the Executive/Investment Review Committee approve funding for This No project this year?:

Did the CFO review the cost goal?: Yes

Did the Procurement Executive review the acquisition strategy?: No

Is this investment included in your agency's annual performance plan or No multiple agency annual performance plan?:

Does this project support homeland security goals and objectives, i.e., 1) No improve border and transportation security, 2) combat bio-terrorism 3) enhance first responder programs; 4) improve information sharing to decrease response times for actions and improve the quality of decision making?

Is this project information technology (See Section 53 for definition)? Yes For information technology projects only: a. Is this Project a Financial Management System (see section 53.2 for a Yes definition) If so, does this project address a FFMIA compliance area? Yes If yes, which compliance area? All

b. Does this project implement electronic transactions or record keeping Yes that is covered by the Government Paperwork Elimination Act (GPEA)? If so, is it included in your GPEA plan (and does not yet provide an Yes electronic option)? Does the project already provide an electronic option? Yes c.Was a privacy impact assessment performed for this project? No

d. Was this project reviewed as part of the FY02 Government No Information Security Reform Act review process? d.1 If yes, were any weaknesses found? d.2 Have the weaknesses been incorporated into the agency's No corrective action plans?

e. Has this project been identified as a national critical or asset by a No Project Matrix review or other agency determination? e.1 If no, is this an agency mission critical or essential service, system, Yes operation, or asset (such as those documented in the agency's COOP Plan), other than those identified as above as national critical infrastructures?

Fina Secu ncial rity Perc Perc enta enta ge: ge: 5.00 15.0 % 0 %

SUMMARY OF SPENDING FOR PROJECT STAGES (In Millions) (BY+1 and Beyond estimates are for planning purposes only and do not represent budget decisions) EPPCBBBBBT XYYYYYYYYo I- ++++t S12221234a T 000 l Ia000222a Nn234000n Gd 000d P567 3E r 0a oPPP B 0r j r r r e l eooo y i cj j j o e t eee n r eccc d dt t t eee P r o j e ddd c t e d

Planning:

B u d g e t a00000000 1 r ...... y03171000 3 07422000 5 R e s o u r c e s

O00000000 1 u...... t 03171000 3 l 07422000 5 a y s

Acquisition: 008211121 . . . 756640 007. . . . . 8 B05871800 . u 075236 d 0 g e t a r y

R e s o u r c e s

211121 O008 756640 u...... 8 t 007 71800 . l 058 075236 a 0 y s

TOTAL, Sum of Stages:

B u d g e t 1 a 21112 008 0 r 85664 . . . 9 y . . . . . 049 . 42800 022 9 R 29523 5 e s o u r c e s

1 O 21112 008 0 u 85664 . . . 9 t . . . . . 049 . l 42800 022 9 a 29523 5 y s Maintenance : 002410008 ...... 009090009 B008320003 u d g e t a r y

R e s o u r c e s

O00241000 8 u...... t 00909000 9 l 00832000 3 a y s

TOTAL, ALL Stages:

B u d g e t 1 a 131112 00 1 r 127664 . . 8 y ...... 04 . 942800 02 8 R 051523 8 e s o u r c e s

1 O 131112 00 1 u 127664 . . 8 t ...... 04 . l 942800 02 8 a 051523 8 y s

Plan and Busi ness Case (All Asse

Cycle Budg P 1 1 2 et & r 9 9 0 Finan e 9 9 0 cing 9 8 9 0 8 e/Ye

WC $ $ $ 0 0 0 Reimb . . . ursem 0 0 0 0 0 0

Total $ $ $ Yearl 0 0 0 . . . Budg 0 0 0 0 0 0

Current

I.A. Proj ect Des cript ion 1. Provide a brief description of this project and its status through your capital planning and investment control (CPIC) or capital programming "control" review for the current cycle. The Office of Chief Financial Officer (OCFO), National Finance Center (NFC) is currently one of the largest payroll providers in the Federal government. The Office of Personnel Management (OPM), in response to Presidential Initiatives, has been designated by OMB as the "managing partner" of the Electronic Payroll (e-Payroll) Initiative-- an effort to consolidate, by the end of 2004, the 22 existing payroll providers to only three, eventually using one common payroll system for the designated providers. NFC is currently seeking designation as a consolidated e- Payroll provider. To participate in the e-Payroll Initiative, NFC foresees an investment of $119 million over 8 years to consolidate, standardize, and modernize its Payroll/Personnel System (PPS) to meet increased demand and comply with OPM e-Payroll requirements.

NFC is part of the USDA Working Capital Fund (WCF) and funds all of its operating costs through reimbursed user fees. The WCF also has funds available for capitalized expenses. Phase I (consolidation) and Phase II (standardization) can be funded entirely through the Working Capital Fund. As such, no additional government funding or capital outlay is being requested at this time to fund Phase I and Phase II. The funding source for Phase III (system replacement)--NFC's compliance with the e-Payroll Initiative's Enterprise Architecture phase, specifically relating to "a single, standardized system" -- has not yet been determined. NFC budgets approximately 15% of its total ADP budget annually to fund data security/privacy requirements, including labor and all costs associated with disaster recovery and business continuity planning. The IT financial percentage represents estimates to provide interfaces from the Payroll/Personnel System to USDA and Agency financial systems.

The e-Payroll Initiative is currently in the Pre-Select Phase of the USDA Capital Planning Investment Control (CPIC) process and will be reviewed by the USDA Executive IT Investment Review Board (EITIRB) in the first quarter of FY 2003. Consolidation, standardization, and system replacement will be undertaken through three distinct phases. A description of the each phase is set forth below:

Phase I: Consolidation and Continuous Improvement Description: During Phase I, NFC assumes that it will take on up to 500,000 new customer employees and will focus on continuous improvement of the current PPS. In order to achieve this goal, NFC must expand its existing payroll service delivery model to support the additional workload. NFC must also market its services to potential customers and develop a new customer service structure. In this phase, NFC will complete key existing initiatives to improve their current offerings (i.e., Employee Personal Page, Employee Self Service). NFC will continue the proactive maintenance and upgrade schedule of the current hardware, software, security, reporting, and storage components of the PPS and will add processing and storage capacity using scheduled capital and operating funds.

Phase I Activities: 1) obtain approval by EITRB and OMB of Select Phase business case, 2) refinement and finalization of overall strategy for consolidation, 3) marketing to new customers, 4) development of key program management plans and tools, 5) system upgrade/enhancement of PPS, 6) customer conversion/consolidation to NFC system, and 7) enhancement of governance structure.

Phase II: Standardization and Technology Pilot Activities Description: During this phase, NFC will actively participate with OPM and customer agencies in developing government-wide standards for payroll/personnel processing. This effort includes the development of new policies, procedures, data standards, and a new Enterprise Architecture (EA). As the OPM governance bodies identify new components of the EA, NFC will sponsor efforts to pilot new tools and technologies that support these components.

Phase II Activities: 1) leverage COTS-based solutions from consolidated customers, 2) upgrade of existing system for compliance with standardization, 3) participation in key OPM e-Payroll initiatives (including pilot programs supporting standard technologies), 4) evaluation and planning of system replacement and implementation for Phase III, and 5) identification of financing strategy for phase III.

Phase III: System Replacement and Implementation Description: During this phase, NFC will undergo a complete systems modernization effort; executing plans developed during Phase II. By the completion of this phase, the new system will be fully operational and NFC will have converted all customers to the new payroll system.

Phase III Activities: 1) system acquisition, 2) implementation of new payroll architecture, 3) system enhancement, 4) interface development (to comply with new enterprise architecture), and 5) conversion of customers to e- government solution.

2. What assumptions are made about this project and why? In planning to meet the requirements of an e-Payroll provider, the following general assumptions have been made:

1) NFC will be designated by OPM as an e-Payroll provider. NFC submitted a proposal to OPM on July 31, 2002 demonstrating its capability to become one of the selected e-Payroll providers. OPM is expected to announce the designated e-Payroll providers on September 30, 2002. If NFC is not chosen as a provider, plans for consolidation, standardization, and modernization would change significantly or may not be realized.

2) NFC will significantly expand its customer base. NFC assumes that it will serve additional customers as a result of becoming a designated e-Payroll provider. After undertaking a coordinated marketing effort during the "open season" period, it is projected that NFC will service up to 500,000 additional customer employees. If customer base expansion did not materialize, plans for consolidation, expansion, and modernization would change significantly or may not be realized.

3) The e-Payroll Initiative will proceed according to plan. NFC assumes that, under the e-Payroll Initiative, 16 Federal payroll service providers will be consolidated to three payroll providers using their existing systems. It also assumes that, after consolidation, the three providers will replace each of their systems with a single software solution.

4) Under the e-Payroll Initiative, NFC will not service uniformed U.S. Military customers.

5) Certain legislative and regulatory changes affecting NFC will be made. NFC assumes that certain legislative and regulatory changes will be made that, by the start of fiscal year 2005, will permit NFC to 1) charge its customers prices that exceed NFC's cost basis; 2) retain earnings; and 3) enter into multi-year agreements with its customers.

6) NFC will play a lead role in the development of the single, standardized system for the e-Payroll Initiative. For the purpose of this business case, NFC assumes that it will lead the effort to develop the single, standardized system to be used by all e-Payroll providers. Cost estimates for development of the new system assume that NFC will not receive assistance from other payroll providers in the development of the new system.

7) There will be continuous funding for this project. If the revenue for the project budget is materially reduced or eliminated, the effort will be unsuccessful.

3. Provide any other supporting information derived from research, interviews, and other documentation. The following supporting documents informed the development of this OMB Exhibit 300 business case and are available upon request:

1) NFC's Payroll Provider Request for Response Package to OPM (NFC's e-Payroll "Proposal," included in the resource library)

2) OPM Exhibit 300 for e-Payroll Initiative

3) NFC's response to OPM's March 15 Data Call

4) NFC's Response to the JFMIP Study

I.B. Just ifica tion (All Ass ets) 1. How does this investment support your agency's mission and strategic goals and objectives? As an organization, NFC is dedicated to designing, developing, implementing, and operating cost-effective financial, administrative, and management information systems and services. Our mission is to enable USDA and our customers to fulfill their missions. Along with the USDA OCFO, NFC advocates an environment in which high quality financial and performance information can be commonly used to implement effective decisions regarding policy, management, stewardship, and programs. The e-Payroll Initiative aims to consolidate payroll operations, which promotes efficient and effective Federal payroll processing by improving service delivery and reducing operation costs and future capital investment costs. In addition, the e-Payroll effort adheres to USDA's OCFO strategic goals as the initiative:

- Promotes sound financial management through leadership, policy and oversight;

- Implements and maintains an infrastructure to provide management with on-line real time financial management information necessary for sound decision making; and

- Provides superior cross-servicing for financial and administrative services to USDA and other Federal Government agencies.

In addition, the e-Payroll Initiative complies with the USDA e-Government Strategic Plan which sets the Department's strategic direction for the next five years. By creating greater efficiencies in the Federal payroll processing, this initiative further augments the e-Government agenda. 2. How does it support the strategic goals from the President's Management Agenda? This initiative will provide USDA's business and technology infrastructure to enable Department efforts in support of the government-wide ePayroll/eHR Initiative. The USDA project serves to enhance and complement, rather than duplicate, the Presidential Initiative. Additionally, this investment supports the Presidential Management Agenda. It will eliminate barriers to cross-agency communication and coordination, by making existing systems more interoperable and using technology to enable smoother communication. Additionally, this initiative promotes citizen-centered government by presenting information in an integrated, uniform manner (rather than the current separation by agency) and by enabling exchange of information between USDA and other agencies, reducing redundant provision of information for business partners.

NFC's participation in the e-Payroll Initiative supports all five of the President's Management Agenda dimensions: strategic management of human capital; competitive sourcing; improved financial management; expanded electronic Government; and budget and performance integration. As NFC works closely with OPM to realize payroll consolidation, it aims to (1) augment the e-Government agenda by creating greater efficiencies in Federal payroll processing; (2) define regulations to help standardize payroll data across the Federal Government, improving information sharing between performance, budgets and financial management and enabling key officers to make well-informed decisions; (3) support the strategic investment in human capital, as Government employees benefit from cost-effective service through the implementation of best practices; and (4) drive costs down by leveraging economies of scale along with streamlined operations.

3. Are there any alternative sources in the public or private sectors that could perform this function? Yes. There are possible outsourcing options available. A description of an alternative solution involving outsourcing to a private sector Application Service Provider (ASP) is described in Section I.E.1 (Alternatives Analysis) of this exhibit.

4. If so, explain why your agency did not select one of these alternatives. Due to the lack of standardization in pay plans of Federal payroll processing, NFC realizes that it would be a major organizational and procedural change for a public or private sector Application Service Provider (ASP) to process Federal payroll. Internal research indicates that outsourcing for comparable services in the private sector would result in significantly higher processing costs, which would increase rates. Also, because payroll directly impacts the provision of US Treasury funds to Federal government employees, there are three Federal payroll functions that must be retained by the government relating to certification of time, payroll, and disbursement. Thus, at the very least, NFC as a Government payroll provider would have to manage the process and retain the authority to supply government paychecks.

5. Who are the customers for this project? The customers for the e-Payroll Initiative are Federal and quasi-Federal agencies. NFC currently services 122 government agencies, providing over 515,000 Federal employees with payroll and personnel services. Under the e-Payroll Initiative, NFC assumes that it will increase its customer base by up to 500,000 customer employees.

6. Who are the stakeholders of this project? The primary stakeholders for this project are OPM, OMB, USDA, Federal government employees, all Federal government agencies, and all US taxpayers.

- All Federal government agencies with payroll needs benefit from the customer-centered, results-oriented, and market-based operations, which promote competition.

- The Office of Personnel Management benefits from consolidated payroll service delivery and standardization of payroll process, which will eventually lead to Federally integrated HR/Payroll services.

- The Office of Management and Budget and Department of the Treasury benefits from streamlined financial management and reporting through the consolidation of Federal payroll providers.

- The USDA benefits from NFC's broadened customer based and increased working capital fund revenues, as well as NFC's key position in Federal payroll processing.

- Federal government employees benefit from the standard use of payroll best practices, such as customer relationship management, to be applied consistently by the consolidated payroll providers.

- All U.S. taxpayers benefit from the e-Payroll Initiative because of reduced acquisition, operations, and management costs that consolidation affords the Federal government.

7. If this is a multi-agency initiative, identify the agencies and organizations affected by this initiative. The e-Payroll consolidation effort is a multi-agency initiative, which affects all Executive Branch Federal and quasi- Federal government agencies/organizations and their employees that are currently serviced by NFC or another Federal payroll service provider.

8. How will this investment reduce costs or improve efficiencies? OPM has estimated that approximately $940 million in savings can be realized to the Federal government over the next 10 years by consolidating payroll services under the e-Payroll Initiative. The following benefits of the e-Payroll Initiative have been identified:

- Payroll service provider consolidation is expected to generate cost savings through economies of volume, provide additional cost avoidance by limiting capital system modernization activities across the government, and promote standardization and unified service delivery.

- The ability to consolidate and standardize payroll data across the Federal government will improve the link between performance and budgets, thereby improving financial management by providing both program managers and finance officers with information needed to make well-informed decisions.

- Competition among existing providers to serve other Federal customers will stimulate innovation, drive costs down and improve service, while creating an environment more conducive to commercial competition in the future.

NFC's investment to comply with requirements of the e-Payroll Initiative will create the following benefits for USDA:

- Decreased payroll processing fees for USDA payroll

- Increased Working Capital Fund (WCF) revenues

- More effective service from NFC to USDA's human resource offices

- Extensive management information from NFC to USDA that will improve financial management and program delivery.

Please refer to the MS Word version of the Exhibit 300 in the resource library for a table of improved efficiencies for NFC and its customers.

9. List all other assets that interface with this asset. NFC's Payroll/Personnel System (PPS) regularly interfaces with USDA's accounting and administrative systems, as well as various required external (non-USDA) systems. Please refer to the MS Word version of the Exhibit 300 in the resource library for a table of examples of NFC's PPS interfaces. None of the interfaced systems will need reengineering as a result of this effort.

Have these assets been reengineered as part of this project? No

I.C. Perf orm anc e Goa ls and Mea sur es (All Ass ets) I.C. Performance Goals and Measures (All Assets) A P c l t a u S n a n l P t A e P l r c d e a a t r n t u f n e E P a o e g x e l r d i i r P m c s f e a t o P rf n e G i r o c r o n m r e f a g a m n o a Fiscal l c I r n Year ( B e mm c s a p a e ) s r n M e I o c e l m S v e t i p u e ri n r p m c e o M p e R v e o n e e t r t s m r t R u e i e e lt n c d s s t u G l o t a s l

04+ P N I I r / n f o A c N v r F i e C d a ' e s s e t c i e u m c s e o t l n o y o m , m e r i r e e b l s a i s a o e b f l v i e o n , l c a u r n m e d e a s c o s t e f f e e c s t i b v y e 3 p 0 a % y , r a o n l n l u a a n l d c o p s e t r w s i o l n l n d e e l c s r e e r a v s i e c e b s y

t a o t l F e e a d s e t r 7 a . l 5 a % g . e n c i e s . 04+ P - M I r 0 a n o . i c v 5 n r i 5 t e d %a a e i s n e t i r i m e n e a l s a y o n , n n r a u e b a l l l i e u a n b u i l n t e i c , t o a c s n o t d s w t i c w l o h l s i n t l o e e t f e f i x e n c c c e t r e i e d v a e s 5 i % p n a g ( y n r c e o u g l s a l t t a o i n m v d e e r p b f e a i r s g s e u o r n e n e i l n s d e i r c v a i t c e e s s d t e o c r F e e a d s e r a l a g e e ) n . c i e s . 04+ P 1 M G r 0 a r o 0 i e v %n a i t t d a e e i r n t t h i c a m u n e r l r 9 y e 8 , n % r t e l o l e f i v d a e i b l s l o b e f u , p r a a s n y e d m m e e c n n o t t s t s t i c e m h f e e f l d e i u c n l t e e i s s v s e w w i p h l a i l y l b r e e o l i c l n e a c r n r t d e i a f p s i e i e r n d , r e s c o o n n n c e i l l s e e d g r ,

v a n i n u c d m e b s r e e r t l o o e f a p F s a e e y d d m e e r w n a i t l t s a h

g i e n n c 4 i e h s o . u r s . 04+ P 9 M G r 2 a r o %i e v n a i t t d a e e i r n t t h i c a m u n e r l r 9 y e 0 , n % r t e l o l e f i v c a e u b l s l o t e f o , c m a u e n s r d t s o c m w o s t e i f l f l e b c e t e

i r s v s a e a t t i p i s a s f y f i r a e o c d l t

l i w a o i n n t d h w

p h t e i h r l e s e i o r n i s n n e e c r l r v s e i e a c r s e v i s i n

c g ( e b s c a u s t s e o t d o

F m o e e n d r

e b s r a u a s r l e v a e g y e s n ) c . i e s . 04+ P 9 M I r 9 a T o %i v n i i t n d a f e i r n a t s i I t m T r e u l i c y n t , f u r r r e a e l s i t w a r i b u l l c l e t b , u e a r n e a d v a a c v i o a l s i a t l b e a l f b e f l e e 9 c 7 t w % i h v i o e l f e t p h a i e y n r c t o r i l e m l a e a s . n i N d n o g t p e e I : r T P s l o w e n o a n r s e k e l l s o r e a e r d f v e i r c t e o s t t h o e

F M e S d e W r o a r l d a g v e e n r c s i i e o s n . o f t h e

E x h i b i t 3 0 0

r e s o u r c e

l i b r a r y

f o r t h e

e - P a y r o l l b a l a n c e d

s c o r e c a r d .

I.D. Program Management (All Assets)

1. Is there a program manager assigned to the project? If so, what is Yes , Lohfink, Cyrus G his/her name?

2. Is there a contracting officer assigned to the project? If so, what is Yes , Phillips, Deidre his/her name?

3. Is there an Integrated Project Team? Yes 3.A. If so, list the skill set represented. Communications; Payroll Payment Calculation; Customer Service; Benefits Administration; Tax and Financial Reporting; Application Development; Accounting Reconciliation; Accounting Validation; Accounting Certification; Requirements Analysis; Systems Analysis; Program Analysis; System Engineering; Computer Programming; Database Administration; Technology Management; Telecommunications Engineering; Management Support; Administrative Support; Budget Analysis and Formulation; Financial Assessment; and Project Management

4. Sponsor / Owner: Yes Sponsor / Owner Name: McPherson, Edward (Ted) R

I.E. Alternatives Analysis (All Assets)

1. Descr ibe the altern ative soluti ons you consi dered for acco mplis hing the agenc y strate gic goals this proje ct was expec ted to addre ss. Descr ibe the result s of the feasib ility/p erfor manc e/ben efits analy sis. Provi de comp ariso ns of the return s (finan cial and other) for each altern ative.

I.E.1 Alternatives Analysis and Risk Management (All Assets) Descr Alternatives iptio n Alternative 1 - Take all neces sary steps to fulfill requir ement s of OPM's e- Payrol l Initiat ive(R ecom mend ed): Under this altern ative, NFC would take all neces sary steps to compl y with the e- Payrol l Initiat ive includ ing consol idatio n, stand ardiza tion, and payrol l syste m replac ement . This altern ative would allow NFC to fulfill the requir ement s of an e- Payrol l provid er and meet increa sed dema nd expec ted as a result of consol idatio n, yieldi ng signifi cant savin gs and increa ses in efficie ncy for the Feder al gover nmen t. Alternative 2 - Statu s Quo: Under this altern ative, NFC would not consol idate, stand ardize , or mode rnize its payrol l syste ms. While this appro ach requir es no invest ment in impro veme nt or mode rnizati on, it is not a viable altern ative becau se 1) NFC would not be able to meet the requir ement s of the e- Payrol l Initiat ive; 2) the cost of maint aining and opera ting legac y syste ms would beco me increa singly more costly over time; and 3) the risk of syste m failure would increa se signifi cantly over time. Alternative 3 - Outso urcing to an Applic ation Servic e Provid er (ASP) : Under this altern ative, NFC would outso urce payrol l servic es to a privat e sector vendo r that would utilize comm ercial- off- the- shelf produ cts (COT S). These syste ms would be stand ardize d based on gover nmen t requir ement s and devel oped and maint ained by vendo rs, who would also mana ge all associ ated hardw are. This altern ative is not a feasib le option at this time becau se the curre nt Feder al payrol l enviro nmen t lacks Gover nmen t wide stand ards that will be neces sary for ASP payrol l proce ssing. In additi on, the Depar tment of the Treas ury requir es that certai n payrol l functi ons be execu ted by a gover nmen t entity . These functi ons includ e certifi cation of time and payrol l disbur seme nt. There fore, compl etely outso urcing the PPS (i.e., an arran geme nt where outsid e contra ctors have full respo nsibili ty for the entire progr am and are not mana ged by NFC perso nnel) is not accep table given existi ng gover nmen t requir ement s.

2. Su mmar ize the result s of your life- cycle cost analy sis perfor med for each invest ment and the under lying assu mptio ns.

I.E.2 Alternatives Analysis(All Assets) Cost Alternative Alternative Alternative Elements 1 2 3 Phase I: Consolidation and Continuous $22.41 - - Improvements Phase II: Standardization and $7.29 - - Technology Pilot Phase III: System Replacement and $89.18 - - Implementation Total $118.88 $0.00 $0.00 3. Whic h altern ative was chose n and why? Defin e the Retur n on Invest ment (ROI). We have chose n Altern ative 1 and plan to take all neces sary steps to fulfill requir ement s of OPM's e- Payrol l Initiati ve. This altern ative would allow NFC to fulfill the requir ement s of an e- Payrol l provid er and meet increa sed dema nd expect ed as a result of consol idation , yieldin g signifi cant saving s and increa ses in efficie ncy for the Feder al gover nment . As stated in Sectio n 1.E.3. C, the return on invest ment for this appro ach is appro ximate ly $137 million over 10 years. This pre- select busine ss case does not requir e financi al analys is of altern atives.

The status quo altern ative was reject ed becau se 1) NFC would not be able to meet the requir ement s of the e- Payrol l Initiati ve; 2) the cost of maint aining and operat ing legacy syste ms would beco me increa singly costly over time; and 3) the risk of syste m failure would increa se signifi cantly over time.

Outso urcing is not a feasibl e option at this time becau se: 1) the curren t federa l payroll enviro nment lacks gover nment -wide stand ards that will be neces sary for ASP payroll proce ssing; and 2) compl etely outso urcing the PPS (i.e., an arrang ement where outsid e contra ctors have full respo nsibilit y for the entire progra m and are not mana ged by NFC perso nnel) is not accept able given gover nment requir ement s and the associ ated risk of an unpro ven comm ercial solutio n.

Pleas e note the followi ng assum ptions for life- cycle cost analys is 1) NFC will take on 500,0 00 new custo mer emplo yees; 2) for custo mer conve rsion estima tes in Phase I, NFC assum ed one compl ex conve rsion of 150,0 00 emplo yees and the remai ning 350,0 00 emplo yees would be simple conve rsions (using the definiti ons of compl ex and simple provid ed by OPM in the Reque st for Respo nse docu ment); and 3) in phase II, COTS acquis ition repres ents estima tes for licens es for pilot testing .

Pleas e note the followi ng assum ptions for Retur n on Invest ment calcul ations: 1) discou nt factor is assum ed to be 4.8%, the rate of the five- year treasu ry bill (yield to maturi ty as of March 22, 2002); 2) Retur n on Invest ment is define d as Net Prese nt Value (NPV) of invest ment divide d by Net Costs of invest ment; 3) NPV calcul ations use 2002 as the base year; and 4) for financi al benefi ts, $313 million in estima ted saving s to the Feder al gover nment from the e- Payrol l Initiati ve is sprea d over 7 years begin ning in FY 2005 (the expect ed compl etion date for consol idation is the end of FY 2004).

A. Are there any quant itative benefi ts that will be achie ved throu gh this invest ment (e.g., syste ms savin gs, cost avoid ance, stake holde r benefi ts, etc? C onsoli dation and stand ardiza tion of payroll servic e deliver y is expect ed to gener ate signifi cant cost saving s throug h the creati on of econo mies of volum e and cost avoida nce by limitin g capital syste m moder nizatio n invest ments across the gover nment , and impro ving servic es to emplo yees.

OPM has estima ted that consol idating to three provid ers under the e- Payrol l Initiati ve would result in saving s to the Feder al gover nment of appro ximate ly $940 million over a 10 year life- cycle. These saving s would occur throug h reduct ions in estima ted operat ing costs by stand ardiza tion, elimin ation of duplic ative syste m replac ement invest ments , and simplif ication of payroll proce ssing. OPM develo ped its estima tes using data that it assem bled from 16 existin g payroll provid ers, includi ng NFC.

For the purpo se of this pre- select busine ss case it is assum ed that, as one of three e- Payrol l provid ers, NFC's contri bution to the total saving s gener ated by the e- Payrol l Initiati ve is appro ximate ly one- third, or $313 million over the 10 year life cycle.

OPM's initial financi al analys is of the e- Payrol l Initiati ve is contai ned in its e- Payrol l Initiati ve OMB Exhibi t 300 dated April 2002 (includ ed in refere nce library ).

B. For altern ative select ed, provi de financ ial summ ary, includ ing Net Prese nt Value by Year and Payba ck Perio d Calcu lation s:

I.E.3(C) Net Present Value by Year F Y FFFFFFFF 1 YYYYYYYY 0 00000000 & 23456789 1 1

$$$$$$$ $ $

------13111110 0 Cost of Investment 1276630...... 0 4 94280900 2 0515249

$$$$$$ $$$

444448 000 444449 Financial Benefits ...... 000 777774 000 111112

$$ $ $$$$$$

-- - 222338 13 0 778049 Annual Cash Flow 12 ...... 4 586764 94 2 069722 05

$$$ $$ $ $$$

--- 11 - 137 141 09 Cumulative Net Cash 0 090 247 44 Flow ...... 4 520 372 60 2 985 277 79

$$$ $ $ $$$ $

--- 1 - 257 1415 3 Cumulative Discounted 0 816 117. 6 Net Cash Flow ...... 6 . 4 355 7347 5 2 692 823 7

4. What is the date of your cost benefit analysis? 08/16/2002 I.F. Risk Inve ntor y and Ass ess men t (All Ass ets)

In this sectio n, descri be the result s of your risk asses sment for this proje ct and discu ss your plans to elimin ate, mitiga te, or mana ge identi fied risks. Risk Asses sment s perfor med at the initial conce pt stage and then monit ored and contr olled throu ghout the life- cycle of the proje ct, and shoul d includ e risk infor matio n from all stake holde rs. Risk asses sment s for all proje cts must includ e sched ule, costs (both initial and life cycle) , techni cal obsol escen ce, feasib ility, reliabi lity of syste ms, depen denci es and intero perab ility betwe en this proje ct and other s, suret y (asset prote ction) consi derati ons risk of creati ng a mono poly for future procu reme nts, capab ility of agenc y to mana ge the proje ct, and overal l risk of proje ct failur e.

In additi on, for IT proje cts risk must be discu ssed in the follow ing categ ories 1) Organ izatio nal and Chan ge Mana geme nt, 2) Busin ess, 3) Data/I nfo, 4) Techn ology, 5) Strate gic, 6) Secur ity, 7) Priva cy, and 8) Proje ct Reso urces. (Agen cies may includ e other s for IT, and may define the core set for other asset s). For securi ty risks, identi fy under the descri ption colum n the level of risk as high, mediu m, or basic. What aspec t of securi ty deter mines the level of risk, i.e., the need for confi dentia lity of infor matio n, availa bility of infor matio n or the syste m, reliabi lity of the infor matio n or syste m?

I.F. Risk Inventory and Assessment Date A D P S C Identified r e r t u rr e n t S o r t b a a a t t b e u i g s e s l y a a c i f s r t o o y f o i r o t f p M f h R t i e i i t O d s o i c a k n g c t a u t e r i o a o f n n t c hi e s E x hi bi t 08/16/2 O I H E Pl 002 r n i s a g s g t n a t h a fo n i b r i t li c z u s h a t h a t i a n i o c g o n r e n a o m a l, s a l p s n e - a r f g s u e o n m n c e n t nt e i l o a n n a d l c s u t l e t e u r r i a n l g b c a o r m r m i i e t r t s e m e a w y i p t r h e a v ll e i n n t v s o u l c v c e e d s p s a f r u t l i i e m s p . l I e d m e e n n t t if a y t a i n o d n a t d h d r r o e u s g s h , o e u a t r a l g y e o n n c , i t e h s e . p o t e n t i a l b a r r i e r s . I d e n t if y a n d e s t a b li s h c h a m p i o n s f o r c h a n g e w i t h i n a f f e c t e d a g e n c i e s . 08/16/2 S S H S S 002 t c i e c r h g t h a e h i e t d n d e u t ul g l e e i e r e c i i st s ma o bl v mis e il h r e e l s d y t b a o y g n O g e M r s B e t / s o O s c P i h M v e is e c in a k pl n p a d r c m o e a g y r n e o s t s b o e n m s e c t h . e d u l e . R e v i s e s c h e d u l e a s w a r r a n t e d t o e n s u r e o v e r a ll s u c c e s s o f i n i t i a t i v e . 08/16/2 S U H D R 002 t n i e e r a g v vi a b h e s t l l e e e o b g t p u i o b d c c u g a o d et n n g st d t e ra B i t te u n a g s u r y i e y a n d s n e u t d s e r b s t a u o t si l e n a g e c i ss k e pl o s a f t n f o s u o to n b a d t nt i a ici n i p g n at f n e o e pr r e oj a d e d e ct d d c i f o t u st i n s o d n i a n l g d f e o v r e e l a o c p h m s e t n a t g a e n o d f o t p h e e r t a r t a i n o s n i . t i o n . S e e k t o e s t a b li s h a s e r v i c e f e e s t r u c t u r e t h a t a ll o w s f u ll c o s t r e c o v e r y p l u s s u f fi c i e n t r e t a i n e d e a r n i n g s t o u n d e r w r i t e m o d e r n i z a t i o n . I m p l e m e n t t h e i n i t i a t i v e i n c r e m e n t a ll y t h r o u g h d i s c r e t e s e t s o f t a s k s t h a t c a n d e li v e r e a r l y a n d c o n t i n u i n g b e n e fi t s . E v a l u a t e m il e s t o n e r e s u l t s t h r o u g h a n e a r n e d v a l u e . 08/16/2 B L M D D 002 u e e e e s v d v v i e i e el n l u l o e o mo p s f p m s e a e f p nt f r of o o pr r j oj t e e o c ct r t m t p a i l n m a a e n g r t e e h m q a e u t nt i r pl r e a e a n d li s t s a o t n c i d o c to m a ol p ll s l y e e t s e t s i y m s a t t e e m s t t h o e m l e e e v t e a l ll o r f e e q f u f i o r r e t m n e e n e t d s e i d s , g a r n e d a c t l e o r s t e h l a y n t t r h a a c t k a d v e a v il e a l b o l p e m . e n t p r o g r e s s a g a i n s t f r e q u e n t m il e s t o n e s . C o n s i d e r s c h e d u l e m o d if i c a t i o n s w h e r e w a r r a n t e d t o e n s u r e o v e r a ll s u c c e s s o f t h e t r a n s i t i o n . A s s i g n r e s p o n s i b il i t y f o r m o n i t o r i n g a n d t a k i n g c o r r e c t i v e a c t i o n . 08/16/2 B D H T N 002 u e i h / s g g o A i r h r n e o e e u s o g s f h , t l T e y e c p c h l h n a n o n o l i l o n o g t g y e y i g , n r S t a t e t r g i a r o t a n e t w g i o i o r c n k r , e i q n u t i e r g e r d a i t s e m i o n r c e r d e if m fi e c n u t l a t ll t y h w a i n t p h r a e g d e i n c c t i e e d s . . F u ll y u n d e r s t a n d t h e e x i s t i n g t e c h n o l o g i e s u s e d b y s e r v i c e d a n d p r o v i d e r a g e n c i e s . 08/16/2 B R L S N 002 u e o e / s q w t A i u r n i e e r a s e li s m s , e t T n i e t c c s e h s x n p p o e e l c c o if t g i a y e t , d i S b o t y n r O s a P e t M a e / r g a l i g y c e o n n c w i i e t s h c c a u n s n t o o t m b e e r m a e g t e . n c i e s w i t h r e g a r d t o c a p a b il i t i e s a n d li m i t a t i o n s o f a v a il a b l e t e c h n o l o g y . F o c u s s t a n d a r d i z a t i o n p r i o r i t i e s o n o b s t a c l e s t o c o n s o li d a t i o n t o r e d u c e t h e e x t e n t o f a g e n c y - s p e c if i c r e q u i r e m e n t s . E n g a g e a f f e c t e d s t a k e h o l d e r s t o n e g o t i a t e c h a n g e s i n r e q u i r e m e n t s t o f a c il i t a t e c o n s o li d a t i o n . E m p l o y s t r o n g p r o g r a m m a n a g e m e n t , a n d m a i n t a i n b o t h a c c u r a t e d o c u m e n t a t i o n t h r o u g h c o n fi g u r a t i o n m a n a g e m e n t a n d f u ll t r a c e - a b il i t y o f r e q u i r e m e n t s t h r o u g h i m p l e m e n t a t i o n . 08/16/2 O C H C N 002 r h i o / g a g ll A a n h a n g b i e o z s r a i a t n t i F i o e v n d e a e l l, r y B a a u l n s o a i r l n l y e e z s g e s i e , s a T l c e a h c t i h i n n v s o e t l m a o a n g n c y d e , a w a t h n e e d s r S m e t a a r y r a r e t e q e q u g u i i i r c r e e m c e h n a t n w g a e s i n n o b t u i s n i c n l e u s d s e o d b o j r e a c d t e i q v u e a s t , e p l r y o c c l e a s r s if e i s e , d a a n n d d f a u g n r c e t e i t o o n a a s l t r a e n q d u a i r r d e s m o e l n u t t s i . o n t h a t p r e s e n t s t h e b e s t c o m b i n a t i o n o f m e e t i n g t h e b u s i n e s s r e q u i r e m e n t . 08/16/2 O P M P In 002 r a e e c g y d r or a c i f p n h u o or i e mr at z c me a k m t s e iti i a x g o n h at n d a io a o u n l, t s in B h t to u e i e s r v xi i d e st n i t in e s e g s b c C s u h o , r n nt T s i in e e c g c m a e h e l n n n a c o t n y l s d a o r f n g e u d y l n R , a c e D t t c a e i o t d o v a t n er / o a y I e l Pl n m p a f p l n o l a s o n y n e i e n d g a t t o a e a n r s e u n r o e t t g h e a n t e p r a a y t r e o d ll i s n e t r h v e i n c e i w n g c c o o n n s t o i li n d u a o t u e s d l s y t m a e t e e t , s c t a h u e s e i x n p g e b c r t e a a t k i i o n n s s e f r o v r i o c n e - . t i m e a n d a c c u r a t e s e r v i c e . R e v i e w

a n d t e s t p r o v i d e r ' s D i s a s t e r R e c o v e r y P l a n s . C o n d u c t c o m p r e h e n s i v e t e s t p l a n s b e f o r e f u ll y c o n v e r t i n g t o t h e n e w s y s t e m . R e v i e w c u s t o m e r a g e n c y p a y r o ll o p e r a t i o n s t o d e t e r m i n e a p p r o p r i a t e s t r a t e g y a n d r e c o v e r y p l a n s . P l a n s s h o u l d i n c l u d e t h e e s t a b li s h m e n t o f p r o c e d u r e s f o r e m p l o y e e s t o o b t a i n e x p e d i e n t r e v i e w a n d r e s o l u t i o n o f p a y r o ll p r o b l e m s a n d o f f - c y c l e c o r r e c t i o n s o f p a y r o ll e r r o r s . P e r f o r m c a p a c i t y p l a n n i n g a n d s t r e s s t e s t s o f t h e s y s t e m s u s e d b y t h e s e l e c t e d p r o v i d e r s . I m p l e m e n t c o m p r e h e n s i v e d i s a s t e r r e c o v e r y p r o c e d u r e s a n d s y s t e m s , a n d t e s t t h e s e b a c k u p p l a n s r e g u l a r l y . P l a n t o r u n e x i s t i n g s y s t e m s i n p a r a ll e l t o n e w l y a d o p t e d s y s t e m s u n t il v e r if i c a t i o n o f t h e a c c u r a c y o f t h e n e w

s y s t e m

h a s o c c u r r e d . 08/16/2 S T L T A 002 e h o h d c e w e dr u I me r T o ss i I d e t n e d y f r b r n y a i th s z e t e e r d xi u a st c r in t c g u h S r i e e t c m e ur u c it s t y t u Pr b r o e e gr p w a r il m o l t p e r c o t v e i d d f e r m o o m r e u o n p a t u i t o h n o s r / i c z a e p d a a b c il c i e t s i s e . s f o r s e c u r i t y . A

d e t a il e d s e c u r i t y p l a n w il l e n s u r e s e c u r i t y w h il e a ll o w i n g f o r e x p a n d e d m i s s i o n a c c o m p li s h m e n t . 08/16/2 P S L E E 002 r e o x x i n w i pl v s s ici a i t t c t i pr y i n iv v g a e p c p r y e i pr r v ot s a o o c c n y ol n g s e u ar l i e d d in a a pl t n a a c c m e e u w il l b e f o ll o w e d t o e n s s t u b r e e m a a p i p n r t o a p i r n i e a d t . e c o n t r o l o f d a t a . 08/16/2 P S M T Pr 002 r k e h o o il d e gr j l i I a e e u T m c d mI m t p n a R e f n e r r a s s a g o o s er u n t c r n r o c e u n e l c st s a t a r u nt e r ly n e e o u v t t al a il u v i at a z e il e s a s th b i e l n i e d m t u p o s a m t ct a r of i y p n s er t t s a a o i n n n d n t a el h r c e d h I e a T q n I u g n i e f p s r m a e s n t t r a u n c d t p u r r o e t a o n c d o i l m s p . l B e y m m e o n v t i t n h g e t r o e a q m u o i r r e e s d t u a p n g d r a a r d d e I c T o i m n p f o r n a e s n t t r s u . c t u r e , t h e N F C

w il l b e a b l e t o a t t r a c t a n d r e t a i n I T p r o f e s s i o n a l s . A n i n d u s t r y - s t a n d a r d c o n fi g u r a t i o n w il l e n a b l e n e w l y h i r e d I T p r o f e s s i o n a l s t o g e t u p - t o - s p e e d m o r e q u i c k l y .

1. What is the date of your risk management plan? 08/16/2002

I.G. Acq uisit ion Stra tegy

1. Will you use a single contr act or sever al contr acts to acco mplis h this proje ct? This projec t is in the Pre- Select Phase and a contra cting strate gy has not been finaliz ed. There are two contra cting option s availa ble to ensur e full imple menta tion. The first is to use separ ate contra cts to imple ment each comp onent of the projec t that can be identifi ed as a logical entity. Using separ ate contra cts for each of the comp onent s (or for a combi nation of comp onent s, when appro priate) would allow USDA to gain the expert ise of expert s in the variou s discipl ines neces sary to succe ssfully imple ment each of the comp onent s and would enabl e simple r (and possib ly more detaile d) results meas ureme nt and, as a result, compli ance with requir ement s and perfor manc e goals. Howe ver, as there are interc onnec tions betwe en variou s projec t comp onent s, contra cts would need to requir e intero perabi lity (and potent ially specif y partic ular platfor ms to achiev e this). Furthe r, intern al USDA projec t mana geme nt would be neces sary to coordi nate all contra cts and facilita te linkag es betwe en contra cts.

The secon d option is to use a single contra ct, utilizin g the servic es of a prime contra ctor. This option would allow the prime contra ctor to assum e many projec t mana geme nt and oversi ght capabi lities and coordi nate all subco ntract s neces sary to fully imple ment the functio nality specifi ed in this initiati ve. In this scena rio, the prime contra ctor would be respo nsible for ensuri ng intero perabi lity betwe en projec t comp onent s; howev er, perfor manc e and results meas ureme nt on such an omnib us contra ct would be compl ex.

The selecti on of one of these option s will be made after a thorou gh deter minati on of each option' s impact on USDA , after condu cting resear ch on the viabilit y of execut ing each type of contra ct, and other analys is, resulti ng in a deter minati on of which type of contra ct would offer the best value to the Depar tment.

Curre ntly, it is anticip ated that multipl e contra cts will be used to accom plish NFC's partici pation in the Presid ential e- Payrol l Initiati ve. 1.A. If multi ple contr acts are plann ed, explai n how they are relate d to each other, and how each supp orts the proje ct perfor manc e goals. To compl y with the requir ement s of the e- Payrol l Initiati ve, NFC curren tly plans to use sever al existin g contra cts for intern al suppo rt of its data center operat ions and LAN conne ctivity and maint enanc e. In additio n, NFC will use USDA' s existin g e- gover nment Blank et Purch ase Agree ment (BPA) contra ct for all Phase I and Phase II activiti es. The existin g intern al contra cts will contin ue to suppo rt the expan ding data center and deskto p perso nal comp uter netwo rk enviro nment s at NFC during phase s I and II. The BPA contra ct will be used to suppo rt trainin g new custo mers and assisti ng new custo mers in their conve rsion activiti es such as data mappi ng, buildin g conve rsion data files, identif ying and docu menti ng uniqu e custo mer requir ement s, testing and imple menta tion. Both the intern al and extern al contra cts descri bed above will assist NFC in its perfor manc e goals to compl ete consol idation of agenci es into its payroll /perso nnel syste m by the end of FY 2004 withou t affecti ng servic es to its curren t custo mers. (Thes e contra cts are for entirel y differe nt intern al and extern al functio ns yet they are both neces sary as NFC signifi cantly expan ds its custo mer base.) In Phase II, NFC will identif y its acquis ition needs and resour ces for Phase III.

2. What type(s ) of contr act(s) will you use (e.g. cost reimb urse ment, fixed- price, etc.)? Fixed- price, perfor manc e- based , and labor hour contra cts will be used. We will also explor e value- and transa ction- based arrang ement s

2.A. For cost reimb urse ment contr acts, define risk not suffici ently cover ed by the risk mitiga tion plan to requir e this type of contr act. If neces sary, this inform ation will be calcul ated and evalua ted once the procur ement metho dology is deter mined .

3. Will you use financ ial incent ives to motiv ate contr actor perfor manc e (e.g. incent ive fee, award fee, etc.)? Yes. Finan cial incenti ves will be used where ver possib le.

4. Will you use comp etitio n to select suppli ers? NFC plans to select suppli ers throug h full and open comp etition.

5. Will you use comm erciall y availa ble or COTS produ cts, or custo m- desig ned produ cts? A primar y goal of the initiati ve is to reduc e costs associ ated with providi ng inform ation servic es to the public. Where possib le, the initiati ve will levera ge COTS produ cts that have been deem ed to be part of best practic e solutio ns develo ped for comm ercial enterp rises. COTS and other comm erciall y availa ble produ cts will be used whene ver possib le; howev er, where there exists a specia lized nature to some projec t comp onent s, comm ercial produ cts may need to be modifi ed and custo m produ cts develo ped when COTS altern atives are not availa ble.

6. What is the date of your acqui sition plan? 08/16/ 2002

7. Will you ensur e Secti on 508 compl iance ? We addre ss all of the requir ement s and criteri a outline d in Sectio n 508. NFC fully compli es with USDA' s Depar tment al Notice 4030- 001, Sectio n 508 Imple menta tion Interi m Guida nce that requir es all IT acquis itions to meet Sectio n 508 stand ards. Projec t mana geme nt will ensur e compli ance for all releva nt comp onent s of this initiati ve. Specif ically, all contra cts and State ments of Work will requir e that deliver ables must compl y with Sectio n 508 requir ement s. Soluti ons will be further tested for compli ance, and vendo rs will certify produ cts as compli ant.

I.H. Proj ect and Fun ding Plan

Is this proj ect an Exis ting Bas elin e? No

I.H.1. Descr iption of perfor manc e- based syste m (PBM S):

Name the softw are progr am that meets ANSI/ EIA Stand ard 748 that you will use, or are using, to monit or and mana ge contr act and proje ct perfor manc e? If the proje ct is opera tional (stead y state) define the opera tional analy sis syste m that will be used. If the proje ct is an IT servic e contr act with both opera tional and syste m impro veme nt aspec ts, EVMS must be used on the syste m impro veme nt aspec ts of the contr act and opera tional analy sis on the opera tions aspec ts. Using infor matio n consi stent with a work break down struct ure (WBS) appro ach, provi de the follow ing in all parts of this sectio n. USDA uses the Inform ation Techn ology Invest ment Portfol io Syste m (I- TIPS) to monit or and mana ge projec t perfor manc e. I- TIPS tracks the planni ng, acquis ition, and operat ions of autom ated inform ation syste ms and inform ation techn ology invest ments and compli es with Feder al reporti ng requir ement s, such as those found in GPRA , PRA, and Clinge r- Cohen . We use I- TIPS as the found ation for NFC IT invest ment portfol ios, and it suppo rts the decisi on makin g proce ss for selecti ng, evalua ting and contro lling IT invest ments . NFC will contin ue to use the I- TIPS to provid e a perfor manc e- based mana geme nt syste m, which monit ors the relatio nship of the cost/s chedul e and perfor manc e goals of the progra m. When existin g suppo rt servic es contra cts expire , NFC will specif y the ANSI- stand ard EVMS in follow- on contra cts and deploy Micros oft Projec t and/or other tools to mana ge softwa re develo pment projec ts.

I.H.2. Origin al baseli ne (OMB - appro ved at proje ct outse t):

A. What are the cost and sched ule goals for this segm ent of phase or segm ent/m odule of the proje ct (e.g., what are the major proje ct milest ones or event s; when will each occur ; and what is the estim ated cost to acco mplis h each one)? Also identi fy the fundi ng agenc y for each milest one or event if this is a multi- agenc y proje ct. (This baseli ne must be includ ed in all subse quent report s, even when there are OMB appro ved baseli ne chang es show n in I.H.3).

Cost and Schedule Goals Planned Sc Du P he rat l du io a D le n n F e n u s e n c d di r S E n i t n C g p a d D H o A t r a r s g i t D y s t e o D a s . ( n n a t B c t e C y e W S ) 1 ------. P h a s e

I : F Y

C o n s o li d a ti o n a n d

C o n ti n u o u s I m p r o v e m e n t 0 0 8 - $ T 1 7 9 3 2 B . / / 2 D 1 0 3 8 . 9 0 , R / / 5 e 2 2 0 fi 0 0 0 n 0 0 e 2 2 m e n t a n d

F i n a li z a ti o n o f O v e r a ll S t r a t e g y f o r C o n s o li d a ti o n

1 . 2 . M a r k e 0 1 ti 9 1 $ n / / 1 g 0 2 8

1 9 8 6 T t / / 9 - , B o 2 2 5 D

0 0 0 N 0 0 0 e 2 2 w

C u s t o m e r s 0 1 1 - $ T 1 8 2 2 5 B . / / 0 7 D 3 1 1 , . 5 3 6 D / / 0 e 2 2 0 v 0 0 e 0 0 l 2 2 o p m e n t o f P r o g r a m

M a n a g e m e n t P l a n s a n d

T o o l s

1 . 4 . S y s t e m

U p 1 0 $ g 0 9 7 r / / , a 0 3 6 7 d 1 0 1 T 3 e / / - 9 B 0 / 2 2 , D

E 0 0 3 n 0 0 1 h 2 4 1 a n c e m e n t o f P P S

0 0 6 - $ T 1 1 9 3 1 B . / / 8 4 D 5 0 3 , . 1 0 2 C / / 6 u 2 2 5 s 0 0 , t 0 0 3 o 3 4 0 m 0 e r C o n v e r s i o n / C o n s o li d a ti o n t o

S y s t e m

0 1 1 - $ T 1 7 2 6 5 B . / / 9 1 D 6 1 3 , . 5 1 8 E / / 6 n 2 2 3 h 0 0 a 0 0 n 2 2 c e m e n t o f G o v e r n a n c e

S t r u c t u r e

2 . P h a s e

I I F Y

0 3 - 0 5 : S t a n d a r d i z a ------ti o n a n d

T e c h n o l o g y P il o t A c ti v it i e s 0 0 6 - $ - 2 7 3 0 5 . / / 3 0 1 2 1 0 . 1 5 , L / / 0 e 2 2 0 v 0 0 0 e 0 0 r 3 5 a g e

C O T S - b a s e d

S o l u ti o n s f r o m

C o n s o li d a t e d

C u s t o m e r s ( p u r c h a s e a d d it i o n a l li c e n s e s )

2 . 2 . U p g r a d e o f E x i s ti n g

S y s 1 0 $ t 0 9 1 e / / , m 0 3 3 7 1 0 0 T f 3 / / - 0 B o 0 2 2 , D r 0 0 0 C 0 0 0 o 2 4 0 m p li a n c e w it h

S t a n d a r d i z a ti o n

1 0 1 - $ T 2 0 9 0 4 B . / / 9 , D 3 0 3 5 5 . 1 0 0 P / / 0 a 2 2 , r 0 0 0 ti 0 0 0 c 2 5 0 i p a ti o n i n k e y O P M e - P a y r o ll I n it i a ti v e s ( i n c l u d i n g p il o t p r o g r a m s s u p p o r ti n g s t a n d a r d t e c h n o l o g i e s ) 0 0 1 - $ T 2 1 9 0 9 B . / / 0 4 D 4 0 3 3 9 . 1 0 , E / / 0 v 2 2 7 a 0 0 1 l 0 0 u 3 5 a ti o n a n d

P l a n n i n g o f S y s t e m

R e p l a c e m e n t / I m p l e m e n t a ti o n i n

P h a s e

2 . 5 . I d e n ti fi c a ti o n o f F 1 1 i 0 2 $ n / / 4 a 0 3 8 4 n 1 0 T 2 , c / / - B 1 6 i 2 2 D 5 n 0 0 2 g 0 0

2 4 S t r a t e g y f o r P h a s e

I I I 3 ------. P h a s e

I I I : S y s t e m

R e p l a c e m e n t a n d

I m p l e m e n t a ti o n

3 . 1 . S $ y 1 0 1 s 0 2 2 t / / , e 0 1 1 3 m1 5 2 T 7 / / 3 - B 5 A 2 2 2 D , c 0 0 0 q 0 0 0 u 4 8 0 i s it i o n

1 0 1 - $ T 3 0 2 2 1 B . / / 3 0 D 2 0 1 2 , . I m p l e m e n t a ti o n o 1 f 1 5 2 N / / 1 e 2 2 , w 0 0 1 0 0 0 P 4 8 8 a y r o ll A r c h it e c t u r e

3 . 3 . S $ y 1 0 4 s 0 4 1 t / / , e 0 3 1 0 m1 0 3 T 3 / / 0 - B 2 E 2 2 7 D , n 0 0 2 h 0 0 8 a 4 8 2 n c e m e n t 1 0 1 - $ T 3 0 4 3 5 B . / / 0 , D 4 0 3 7 0 . 1 0 5 I / / 4 n 2 2 , t 0 0 1 e 0 0 9 r 4 8 4 f a c e

D e v e l o p m e n t ( t o c o m p l y w it h n e w e n t e r p r i s e a r c h it e c t u r e ) 0 0 1 - $ T 3 1 9 3 2 B . / / 6 0 D 5 0 3 4 , . 5 0 6 C / / 0 o 2 2 0 n 0 0 , v 0 0 2 e 6 9 1 r 0 s i o n o f C u s t o m e r s P R O J E C T ------

T O T A L :

Part II: Addi tiona l Busi ness Case Crite ria for Infor mati on Tech nolo gy

II.A Ente rpris e Arc hite ctur e II.A. 1 Busi nes s

A. Is this proje ct identi fied in your agenc y's enter prise archit ectur e? If not, why? This projec t is tightly linked to the Depar tment' s eGove rnmen t and enterp rise archit ecture activiti es. This projec t is a part of a group of eGove rnmen t initiati ves that are curren tly being develo ped by USDA . Collec tively, these eGove rnmen t initiati ves will evolve into a large comp onent of Depar tment' s future activiti es that enco mpass IT busine ss proce sses, inform ation needs , and suppo rting techn ologie s (i.e., its "to- be" archit ecture ).

USDA has undert aken a coope rative appro ach to the develo pment of an Enterp rise Archit ecture (EA). Agenc y archit ecture s are direct ed towar d missio n- specifi c proce sses, syste ms, data, and applic ations. The emerg ing Depar tment al comp onent is direct ed at infrast ructur e invest ments (e.g., securit y and teleco mmun ication s), crossc utting invest ments (e.g., corpor ate syste ms), and areas where there are demo nstrab le econo mies of scale from a Depar tment al appro ach.

NFC is curren tly in the proce ss of definin g its comp onent of the USDA EA. As the EA plan evolve s, it is imper ative that e- Payrol l is identifi ed as a key comp onent of this plan. The e- Payrol l Initiati ve should be develo ped in close accor dance with the NFC EA plan. This projec t will confor m to depart menta l enterp rise archit ecture goals and objecti ves that promo te intero perabi lity, reduc e cost, and share resour ces, proce sses and inform ation.

B. Explai n how this proje ct confo rms to your depar tment al (entir e agenc y) enter prise archit ectur e. This invest ment aligns with the coope rative appro ach to EA undert aken by USDA and will be a comp onent of the emerg ing EA model . The USDA Enterp rise Archit ecture Plan, dated Janua ry 22, 2002, provid es guida nce to NFC regard ing prioriti es, objecti ves, and IT directi on. The imper atives relate d specifi cally to NFC, as outline d in the EA Plan, includ e:

- Work towar ds contro lling costs

- Enhan ce custo mer satisfa ction of the servic es it provid es in a corpor ate admini strativ e syste ms enviro nment

- Impro ve efficie ncy and custo mer satisfa ction with NFC operat ion

- Ensur e that the NFC autom ated data proce ssing operat ions and capabi lities meet curren t and/or leadin g edge indust ry stand ards

- Compl ete all action s neces sary to ensur e that NFC operat ions meet Indust ry Stand ards for IT securit y and fully suppo rt the USDA Office of the Chief Inform ation Officer initiati ves in IT Securi ty

- Work with the Cyber Securi ty Officer of the USDA Office of the Chief Inform ation Officer 's staff to explor e potent ial deploy ment of a public key infrast ructur e (PKI) in order to bring further securit y contro ls to client transa ctions, data, and applic ations.

NFC's propo sed initiati ves are in full confor mity with these directi ves. Each of the propo sed initiati ves can be identifi ed with one or more of these directi ves, and none are contra ry to the directi ves.

C. Identi fy the Lines of Busin ess and Sub- Funct ions within the Feder al Enter prise Archit ectur e Busin ess Refer ence Model that will be supp orted by this initiati ve. Since, by Feder al Enterp rise Archit ecture Progr am Mana geme nt Office (FEAP MO) definiti on, the Servic es to Citize ns and the Suppo rt Delive ry of Servic es busine ss areas pertai n only to those servic es directl y provid ed to citizen s by the Feder al gover nment , they are not affect ed by the NFC plan. The followi ng Busin ess Area/L ine of Busin ess/S ub Functi on combi nation s, howev er, will all be suppo rted and impact ed by the propo sed initiati ves:

Busin ess Area: Intern al Opera tions/I nfrastr ucture (Inter- Agenc y).

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Payrol l Mana geme nt and Expen se Reimb ursem ent; Resou rce Traini ng and Devel opme nt; and Benefi ts Mana geme nt.

Line of Busin ess: Admin istratio n. Sub Functi ons: Help Desk Servic es; IT Infrast ructur e Maint enanc e; Securi ty Mana geme nt; and Workp lace Policy Devel opme nt and Mana geme nt.

Line of Busin ess: Finan cial Mana geme nt. Sub Functi ons: Cost Mana geme nt and Finan cial Repor ting.

Busin ess Area: Intern al Opera tions/I nfrastr ucture (Intra- Agenc y)

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Payrol l Mana geme nt and Expen se Reimb ursem ent; Resou rce Traini ng and Devel opme nt; Benefi ts Mana geme nt; and Staff Recrui tment and Emplo yment .

Line of Busin ess: Admin istratio n. Sub Functi ons: Help Desk Servic es; Faciliti es, Fleet and Equip ment Mana geme nt; IT Infrast ructur e Maint enanc e; Securi ty Mana geme nt; and Workp lace Policy Devel opme nt and Mana geme nt.

Line of Busin ess: Finan cial Mana geme nt. Sub Functi ons: Cost Mana geme nt; and Finan cial Repor ting and Funds Mana geme nt.

Line of Busin ess: Suppl y Chain Mana geme nt. Sub Functi ons: Goods Acqui sition; Invent ory Contr ol; and Servic es Acqui sition.

D. Briefl y descri be how this initiati ve supp orts the identi fied Lines of Busin ess and Sub- Funct ions of the Feder al Busin ess Archit ectur e. The propo sed initiati ve suppo rts the above - menti oned Lines of Busin ess and Sub- Functi ons in a numb er of interc onnec ted ways. As this initiati ve is expan sive and consis ts of multipl e comp onent s, variou s LoBs are affect ed. The suppo rting featur es of this initiati ve for each Busin ess Area, LoB, and Sub- Functi on are outline d below, and broke n down into the gener al areas of: payroll consol idation /stand ardiza tion, infrast ructur e impro veme nts, reporti ng impro veme nts, and custo mer servic e impro veme nts.

Payrol l Conso lidatio n/Stan dardiz ation

Busin ess Area: Intern al Opera tions/I nfrastr ucture (Inter- Agenc y)

Line of Busin ess: Admin istratio n. Sub Functi ons: Help Desk Servic es; and Workp lace Policy Devel opme nt and Mana geme nt.

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Resou rce Traini ng and Devel opme nt .

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Resou rce Traini ng and Devel opme nt; and Staff Recrui tment and Emplo yment

As NFC conve rts new custo mers during consol idation , we will be enlarg ing our workfo rce signifi cantly. NFC mana geme nt is alread y consid ering new and impro ved recruit ment, hiring, educa tion, trainin g, and emplo yee develo pment proce dures in anticip ation of the requisi te influx of new perso nnel. In additio n, applic able policie s and proce sses will be evalua ted, impro ved, docu mente d, and stand ardize d as a result of this consol idation . This policy impact will affect both NFC and our extern al custo mers.

Infrast ructur e Impro veme nts

Line of Busin ess: Admin istratio n. Sub Functi ons: IT Infrast ructur e Maint enanc e and Securi ty Mana geme nt.

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Resou rce Traini ng and Devel opme nt.

Line of Busin ess: Admin istratio n. Sub Functi ons: IT Infrast ructur e Maint enanc e; Faciliti es, Fleet and Equip ment Mana geme nt; and Securi ty Mana geme nt.

Includ ed in the impro ved servic e deliver y initiati ves are ongoi ng and plann ed impro veme nts to IT infrast ructur e and securit y aspect s of PPS. These initiati ves cross agenc y bound aries, as NFC updat es its intern al infrast ructur e and securit y, interfa cing agenci es will neces sarily be affect ed and suppo rted. Impro ved interfa cing mech anism s, for exam ple, will suppo rt some of our custo mers' intern al IT initiati ves. Likewi se, NFC's Web acces sibility initiati ves will suppo rt our custo mer's own Web enabl ement efforts . Also, NFC is curren tly analyz ing variou s hardw are/so ftware invent ory mana geme nt proce sses and tools, which will be used in impro ving NFC's equip ment, softwa re, licensi ng and servic es contro l capabi lities. This impro ved capaci ty, in turn, will suppo rt the acquis ition proce ss.

Repor ting Impro veme nts

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Payrol l Mana geme nt and Expen se Reimb ursem ent; and Benefi ts Mana geme nt.

Line of Busin ess: Admin istratio n. Sub Functi ons: Workp lace Policy Devel opme nt and Mana geme nt.

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Payrol l Mana geme nt and Expen se Reimb ursem ent; and Benefi ts Mana geme nt.

Line of Busin ess: Admin istratio n. Sub Functi ons: Workp lace Policy Devel opme nt and Mana geme nt.

Many of NFC's ongoi ng and propo sed projec ts are directl y aimed at impro ving the deliver y and conte nt of report s to our custo mers and other constit uencie s. Includ ed in these are efforts to 1) impro ve the quality and distrib ution of report data and inform ation, and 2) incorp orate variou s new and impro ved reporti ng tools to store, extrac t, analyz e, prese nt, and distrib ute the report ed data and inform ation. These data and reporti ng impro veme nts are design ed, largely , to have a direct benefi cial impact on the distrib ution of appro priate and accur ate financi al inform ation both within USDA and to our extern al custo mers. By impro ving payroll /perso nnel data availa ble to our custo mers and to the Feder al gover nment in gener al, we hope that these reporti ng initiati ves can contri bute benefi cially to upco ming payroll policy/ stand ardiza tion discus sions and decisi ons throug hout the Feder al gover nment as the e- Payrol l effort matur es.

Custo mer Servic e Impro veme nts

Line of Busin ess: Admin istratio n. Sub Functi ons: Help Desk Servic es.

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Resou rce Traini ng and Devel opme nt.

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Resou rce Traini ng and Devel opme nt; and Staff Recrui tment and Emplo yment .

In additio n to impro veme nts on actual servic e deliver y, NFC is activel y engag ed in impro veme nt of the actual and percei ved custo mer servic e aspect s of our proce sses, infrast ructur e, and syste ms. Includ ed in this is the contin ual impro veme nt in help desk servic es within NFC and in the coordi nation betwe en the help desk servic es of NFC and our custo mers' help desk servic es, where appro priate. Implici t in this effort is the requir ement of hiring, trainin g, and develo pment of applic able custo mer servic e emplo yees. E. Was this proje ct appro ved throu gh the EA Revie w comm ittee at your agenc y? No

F. What are the major proce ss simpli ficatio n/ree ngine ering/ desig n proje cts that are requir ed as part of this initiati ve? During the initial, two- year phase of this long- term initiati ve, there will be no neces sary major chang es to the organi zation. Howe ver, during this time, there will be multi- agenc y discus sions to deter mine the future enterp rise archit ecture , data stand ards, and policie s regard ing the Feder al payroll enviro nment . These discus sions will likely result in very substa ntial proce ss simplif ication , reengi neerin g, and design projec ts for NFC. It is unkno wn at the prese nt, howev er, how these chang es will affect NFC, since the new policie s, proce dures, archit ecture s, and syste ms have not yet been deter mined .

G. What are the major organ izatio n restru cturin g, traini ng, and chang e mana geme nt proje cts that are requir ed? During the initial two- year phase of this long- term initiati ve, staff is projec ted to increa se by 50%. As the additio nal staff will simply supple ment the curren t staff within the curren t organi zation al model , no restru cturin g or chang e mana geme nt efforts will be neces sary or undert aken. Howe ver, signifi cant trainin g efforts will take place to train new emplo yees in the areas of payroll operat ions, custo mer suppo rt, accou nting, debt mana geme nt, inform ation techn ology, and applic ation develo pment and maint enanc e

Howe ver, during this time, there will be multi- agenc y discus sions to deter mine the future enterp rise archit ecture , data stand ards, and policie s regard ing the Feder al payroll enviro nment . These discus sions will likely result in the need for NFC to drastic ally chang e organi zation al struct ure, proce sses, and IT syste ms. It is unkno wn at the prese nt how these chang es will affect NFC, since these new policie s, proce dures, archit ecture s, and syste ms have not yet been deter mined . From appro ximate ly FY 2005 on, we anticip ate substa ntial organi zation restru cturin g, trainin g, and chang e mana geme nt efforts .

H. What are the Agen cy lines of busin ess involv ed in this proje ct? Since NFC servic es many agenci es in a payroll servic e capaci ty, the agenc y lines of busine ss involv ed in this projec t are the same as those Feder al, intra- agenc y lines of busine ss listed in answe r 2.A.1. C:

Line of Busin ess: Huma n Resou rces. Sub Functi ons: Payrol l Mana geme nt and Expen se Reimb ursem ent; Resou rce Traini ng and Devel opme nt; Benefi ts Mana geme nt, and Staff Recrui tment and Emplo yment .

Line of Busin ess: Admin istratio n. Sub Functi ons: Help Desk Servic es; Faciliti es, Fleet and Equip ment Mana geme nt; IT Infrast ructur e Maint enanc e; Securi ty Mana geme nt; and Workp lace Policy Devel opme nt and Mana geme nt.

Line of Busin ess: Finan cial Mana geme nt. Sub Functi ons: Cost Mana geme nt; Finan cial Repor ting; and Funds Mana geme nt.

I. What are the implic ations for the agenc y busin ess archit ectur e? USDA' s busine ss archit ecture will not under go major chang es as a direct result of this initiati ve. Howe ver, during this initiati ve, major chang es in the busine ss archit ecture will be consid ered and evalua ted while deter mining the appro priate long- term archit ecture for USDA and NFC. While the exact chang es in the busine ss archit ecture have not been deter mined , some or all of the followi ng areas may be impact ed in the long run, as a result of this evalua tion: 1) custo mer suppo rt, 2) additio n/mod ificatio n/mer ging of variou s busine ss functio ns, and 3) outso urcing of specifi ed busine ss functio ns.

II.A. 2 Data

A. What types of data will be used in this proje ct? As this projec t is a multi- facete d initiati ve compr ise of multipl e individ ual projec ts, variou s types of emplo yee- specifi c payroll and HR data will be used and will impact in the cours e of the initiati ve. In additio n, summ ary data will also be impact ed to impro ve reporti ng and execut ive inform ation syste ms.

B. Does the data neede d for this proje ct alread y exist at the Feder al, State, or Local level? If so, what are your plans to gain acces s to that data? All of the releva nt data curren tly exists within NFC's syste m, for existin g custo mers, or within the existin g payroll syste ms for any agenci es that will be conve rted. No new data requir ement s are anticip ated.

C. Are there legal reaso ns why this data canno t be transf erred ? If so, what are they and did you addre ss them in the barrie rs and risk sectio ns above ? Not applic able.

D. If this initiati ve proce sses spatia l data, identi fy plann ed invest ments for spatia l data and demo nstrat e how the agenc y ensur es compl iance with the Feder al Geogr aphic Data Com mittee stand ards requir ed by OMB Circul ar A- 16. Not applic able.

II.A. 3 Appl icati on and Tec hnol ogy

A. Discu ss this initiati ve/pr oject in relati onshi p to the applic ation and techn ology layers of the EA. Includ e a discu ssion of hardw are, applic ations , infras tructu re, etc. The techn ology and applic ations elated to this projec t will be incorp orated into the Depar tment' s emerg ing Enterp rise Archit ecture (EA); as the EA refere nce model is develo ped, NFC will consid er its ramific ations on the projec t's applic ations and techn ology. NFC is curren tly in the proce ss of definin g its comp onent of the USDA Enterp rise Archit ecture (EA). Howe ver, the initiati ve will have moder ate impact on this EA throug h upgra ded capaci ty and strate gic reconf igurati on of mainfr ame proce ssors; data storag e; applic ation and netwo rk server s; LAN protoc ols/co nfigur ation; and conne ctivity enhan ceme nts.

Also, many of the propo sed projec ts within this initiati ve focus on movin g curren t applic ations to the Web for more distrib uted and efficie nt acces s. This move ment to the Web is a signifi cant impro veme nt to NFC's histori cally non- Intern et archit ecture , and repres ents modifi cation to both the applic ation and the techn ology layers of the EA. These projec ts will requir e the inclusi on of new server s, securit y contro ls, and distrib ution protoc ols, as well as some modifi cation s to the existin g applic ations thems elves.

Existin g comp onent s of the techn ology layer of the EA will be consis tently impro ved and upgra ded as a direct result of many of the propo sed projec ts contai ned within this initiati ve. For exam ple, CPUs will be added to the mainfr ame syste ms, storag e capaci ty will be increa sed, conne ctivity will be moder nized, and new, more efficie nt hardw are syste ms will be integr ated into the existin g EA. New reporti ng tools and metho ds will be evalua ted and, where applic able, integr ated. Furthe rmore, NFC is evalua ting the cost/b enefit of portin g numer ous datab ases from their existin g IDMS enviro nment s onto DB2 enviro nment s in order to realize techn ology impro veme nt and to reduc e licens e fees.

B. Are all of the hardw are, applic ations , and infras tructu re requir ement s for this proje ct includ ed in the EA Techn ical Refer ence Model ? If not, pleas e explai n. All hardw are, applic ations, and infrast ructur e will be incorp orated as USDA define s its Enterp rise Archit ecture (EA). NFC is curren tly in the proce ss of definin g its EA. As the EA plan evolve s, it is imper ative that e- Payrol l is identifi ed as a key comp onent of this plan. The e- Payrol l initiati ve should be develo ped in close accor dance with the NFC EA plan. This projec t will confor m to depart menta l enterp rise archit ecture goals and objecti ves that promo te intero perabi lity, reduc e cost, and share resour ces, proce sses and inform ation.

II.B Sec urity and Priv acy

NOTE : Each categ ory below must be addre ssed at the proje ct (syste m/app licatio n) level, not at a progr am or agenc y level. Referr ing to securi ty plans or other docu ments is not an accep table respo nse.

II.B.1. How is securi ty provi ded and funde d for this proje ct (e.g., by progr am office or by the CIO throu gh the gener al supp ort syste m/net work) ? The fundin g is cover ed as part of the operat ing unit costs that NFC charg es its custo mers for data center servic e.

NFC budge ts appro ximate ly 15% of its total ADP budge t annua lly to fund data securit y/priva cy requir ement s, includi ng labor and all costs associ ated with disast er recov ery and busine ss contin uity planni ng.

A. What is the total dollar amou nt alloca ted to securi ty for this proje ct in FY04? 48700 00.00

II.B.2. Does the proje ct (syste m/app licatio n) meet the follow ing securi ty requir ement s of the Gover nmen t Infor matio n Secur ity Refor m Act, OMB policy , and NIST guida nce? Yes. We ensur e securit y by applyi ng indust ry best practic es and adopti ng a "defen se in depth" appro ach to protec ting NFC's critical infrast ructur e. We follow a proce ss of keepin g curren t with threat s and vulner abilitie s by (1) makin g contin ual self asses sment s of our techn ology, hardw are, softwa re, faciliti es, applic ations, and perso nnel; (2) having asses sment s condu cted by GAO, OIG, and other indep enden t audito rs; (3) makin g contin uous impro veme nts to our infrast ructur e based on risk/vu lnerab ility asses sment s; (4) disse minati ng this inform ation to the appro priate perso nnel/o rganiz ations within NFC; (5) subscr ibing to indust ry alerts from organi zation such as FedCI RC, CIAC, Gartn er Group , SANS , and CSI; (6) maint aining a viable and proact ive securit y aware ness progra m; (7) maint aining a viable busine ss contin uity plan, having up-to- date disast er recov ery proce dures, and testing our busine ss contin uity regula rly; and (8) alertin g mana geme nt to potent ial threat s, risks, and vulner abilitie s, and reque sting the appro priate fundin g to imple ment mitigat ion strate gies. Contr actor perso nnel work under the super vision and oversi ght of NFC mana geme nt at all times. They are subjec t to the same backg round investi gation s and securit y contro ls as NFC perso nnel.

A. Does the proje ct (syste m/app licatio n) have an up-to- date securi ty plan that meets the requir ement s of OMB policy and NIST guida nce? What is the date of the plan? Yes. NFC has the neces sary inform ation syste ms securit y contro ls and securit y plan in place to compl y with all applic able Feder al and Depar tment al policie s, regula tions, stand ards, guideli nes, and all applic able public laws such as (1) OMB Circul ar A- 130, (2) Feder al Inform ation Proce ssing Stand ards (FIPS) , (3) Comp uter Securi ty Act of 1987, (4) the Comp uter Fraud and Abuse Act of 1986, (5) Privac y Act of 1974, (6) Presid ential Decisi on Directi ves, (7) Feder al Telec ommu nicatio ns Stand ards (FED- STDS ), (8) NIST Guidel ines Speci al Public ations (e.g., NIST 800- 16, NIST 800- 18), (9) Gener ally Accep ted Syste m Securi ty Princi ples (GAS SP), and (10) Gover nment Inform ation Securi ty Refor m Act (GISR A). NFC maint ain a viable and curren t securit y progra m consis ting of a Securi ty Plan, Contin uity of Opera tions Plan (includ ing a Busin ess Contin uity Plan, Disast er Recov ery Plan, and Emerg ency Respo nse Plan), mana geme nt directi ves, and techni cal contro ls. Drafte d under the guida nce of OMB policy, NIST, and USDA regula tions, the securit y progra m is develo ped, maint ained, and imple mente d in order to protec t agains t variou s securit y risks such as (1) uninte ntional disclo sure or intenti onal theft of privat e, sensiti ve inform ation of individ uals, (2) physic al destru ction or loss of data, equip ment, or softwa re due to natura l or man- made disast ers, (3) uncon trolled or unaut horize d acces s to our comp uter syste ms and physic al facility , (4) operat ional delays or denial of servic e, and (5) unreli able acces s to syste ms, applic ations, and data. The securit y progra m is contin ually monit ored and audite d for compli ance with all applic able Feder al laws, regula tions, and guideli nes. Securi ty contro ls are contin ually streng thene d to assur e all comp uter proce sses, data, and equip ment are protec ted by the best contro ls possib le. Additi onally, risk asses sment s of the securit y progra m/app licatio ns are condu cted to identif y vulner abilitie s. Mitigat ion strate gies are identifi ed, and the neces sary fundin g to carry out these strate gies is reque sted. As part of the GISR A requir ement s, an annua l intern al and indep enden t review of securit y mana geme nt practic es is compl eted and submit ted with the annua l budge t reque st to OMB. Our Securi ty Plan is dated June 2001.

B. Has the proje ct under gone an appro ved certifi cation and accre ditati on proce ss? Speci fy the C&A meth odolo gy used (e.g., NIST guida nce) and the date of the last revie w. Yes. NFC emplo ys a compl ex mix of extern al, and intern al docu mente d securit y mech anism s to satisfy the requir ement s of Feder al, agenc y, and public securit y policie s and proce dures. These contro ls provid e the guideli nes for certific ation and accre ditatio n of the NFC syste ms at a C2 level (or Evalu ation Assur ance Level 3 in the Comm on Criteri a). This provid es a frame work or guideli ne to enforc e the requir ement s for contro lled acces s protec tion focusi ng on discret ionary acces s contro l mech anism s that provid e (1) a securit y policy imple mente d throug h acces s contro l lists, (2) accou ntabilit y, (3) inform ation assur ance and confid entialit y, (4) data integri ty and availa bility, and (5) docu menta tion (e.g., owner ship of data, monit oring report s, etc.).

NFC has a staff that evalua tes and certifie s the securit y safeg uards of applic ation softwa re used in the operat ional enviro nment . Sensit ive applic ation softwa re is subjec ted to a formal certific ation and accre ditatio n proce ss using FIPS 102 guideli nes, and is operat ionally evalua ted and re- certifie d after major modifi cation s or every three years. The dates of last review for each of the applic ations within payroll are: 07/19 99 Adjust ment Proce ssing Syste m (ADJP ); 04/20 02 - Corre ctions, Adjust ments , and Manu al Paym ents (CAP S); 08/19 99 - Payrol l Accou nting (PAC S); 08/20 01 - Payrol l Proce ssing (PAY E); 06/19 99 - Payrol l Interfa ce to Centr al Accou nting (PICA ); 07/20 01 - State ment of Earnin gs and Leave Syste m (EAR N); 07/20 01 - Speci al Payrol l Proce ssing Syste m (SPP S); 05/19 99 - Time and Attend ance Valida tion Syste m (TIME ); 08/20 01 - Time Inquir y, Leave Updat e Syste m (TINQ ); 08/20 00 - Table Mana geme nt Syste m (TMG T); 07/20 01 - Traini ng Inform ation Syste m (TRAI) ; 05/20 00 - Time Suspe nse (TSU S); 06/19 99 - Unem ploym ent Comp ensati on for Feder al Emplo yees Syste m (UCF E); and 09/20 00 - W-2 Syste m (WTW O).

C. Have the mana geme nt, opera tional, and techni cal securi ty contr ols been tested for effecti venes s? When were most recen t tests perfor med? Yes. The USDA OIG condu cted an audit to evalua te the design and test the effecti venes s of (1) IT applic ation chang e contro ls over applic ations develo ped and maint ained by the NFC, (2) mana geme nt contro ls over "speci al produ ction proce ssing;" and (3) select ed IT gener al contro ls. Its March 2002 report includ ed no payroll - specifi c issues and 24 recom mend ations for impro veme nt to our existin g securit y infrast ructur e. Eighte en of the correc tive action s are closed with all expect ed to be closed by Dece mber 2002.

In March 2002, OIG execut ed a scan of NFC's infrast ructur e lookin g for vulner abilitie s. Of the more than 1,000 device s, OIG was able to identif y few issues , citing NFC as being more prepar ed than other data center s review ed. NFC has institut ed a chang e in proce dure to elimin ate future issues by disse minati ng self- inspec tion tools to syste m engin eers. In additio n, KPMG LLP condu cted scans and penetr ation tests as part of its asses sment of NFC's comp uter acces s contro ls and overall inform ation syste m securit y progra m. Its report stated , "...the NFC has imple mente d suffici ent proce dures and contro ls to provid e a reaso nable level of assur ance over acces s to its inform ation syste ms. The overall securit y mana geme nt enviro nment is progre ssive and embra ces new techn ology and techni ques design ed to impro ve the contro l enviro nment . Furthe rmore, NFC demo nstrat ed that it has establi shed, imple mente d, and is maint aining physic al and logical contro ls to protec t comp uter resour ces from unaut horize d use, disclo sure, and loss."

D. Have all syste m users been appro priate ly traine d in past year, includ ing rules of behav ior and conse quenc es for violati ng the rules ? Yes. NFC condu cts regula r securit y aware ness trainin g for all emplo yees and contra ctors upon hiring, and updat es it annua lly. This trainin g includ es NFC's comp uter securit y policie s, good securit y practic es, roles and respo nsibilit ies, identifi cation of threat s to comp uter syste ms, rules of behavi or, conse quenc es for violati ng rules, and disast er recov ery. Additi onally, NFC provid es ongoi ng securit y aware ness trainin g using aware ness poster s, securit y/virus alerts, netwo rk vulner ability alerts, newsl etter article s, and meeti ngs with variou s staffs/ organi zation s where securit y aware ness topics are prese nted. Becau se securit y trainin g is crucial to syste m mana geme nt, operat ion and techni cal securit y, NFC requir es that all emplo yees meet their trainin g requir ement s each year. Traini ng provid es our staff with the expert ise to condu ct regula r disast er recov ery exerci ses and imple ment comp ensati ng contro ls, such as monit oring report s, except ion report s, and audit report s, which are regula rly monit ored, review ed, and report ed to oversi ght agenci es such as GSA, USDA' s OIG, and extern al audito rs. NFC's securit y staff also provid es trainin g to custo mer securit y officer s during which NFC reinfor ces the need for securit y officer s to condu ct similar annua l securit y aware ness trainin g sessio ns within their own agenci es.

E. How has incide nt handli ng capab ility been incor porat ed into the syste m, includ ing intrus ion detect ion monit oring and audit log revie ws? Are incide nts report ed to GSA’ s FedCI RC? Incide nt- handli ng capabi lity has been incorp orated into NFC's syste ms. Incide nts are report ed to USDA' s OCIO who in turn report s them to FedCI RC. FedCI RC alerts are trans mitted to NFC by the OCIO.

F. Is the syste m opera ted by contr actor s either on- site or at a contr actor facilit y? If yes, does any such contr act includ e specif ic securi ty requir ement s requir ed by law and policy ? How are contr actor securi ty proce dures monit ored, verifie d, and valida ted by the agenc y?" No.

II.B.3. How does the agenc y ensur e the effecti ve use of securi ty contr ols and authe nticati on tools to prote ct privac y for those syste ms that prom ote or permi t public acces s? NFC ensur es the effecti ve use of securit y contro ls and authe nticati on tools to protec t privac y, especi ally for the syste ms that allow public acces s. NFC analyz es securit y requir ement s for applic ation softwa re, and imple ment cost- effecti ve contro ls to protec t the syste m from losses due to fraud, waste, errors, abuse , misus e, physic al destru ction of data, theft or disclo sure of inform ation, denial of servic e; and to ensur e the reliabl e availa bility of data. Securi ty requir ement s and contro ls are maint ained as part of the syste m's perma nent docu menta tion. Syste ms that are used by more than one custo mer agenc y have acces s contro ls at the record /row level, and custo mer data acces s paths contro ls acces s (e.g., by organi zation al code, office code, etc.). Custo mers are not allowe d to acces s record s of anoth er custo mer unless specifi cally author ized by the data owner .

Our autom ated comp ensati ng contro ls ensur e manu al proce sses are compl eted proper ly. Any user accou nt not used for a period of 60 days is autom aticall y suspe nded. Any user accou nt not used for a period of 150 days is delete d from the securit y file along with all relate d acces s author ization s. Users separ ating from Gover nment servic e are autom aticall y delete d from the securit y syste m via an interfa ce with PPS. NFC is fully compli ant with all applic able Feder al laws and regula tions protec ting our comp uter resour ces and custo mer data by admini sterin g securit y acces s to users and adheri ng to the princip les of individ ual accou ntabilit y, separ ation of duties, least privile ge, and "need to know."

NFC is one of the few Feder al entitie s in positio n to addre ss e- Comm erce securit y by providi ng servic es as a CA for Feder al Gover nment agenci es and by develo ping applic ations that incorp orate certific ate- based securit y.

II.B.4. How does the agenc y ensur e that the handli ng of perso nal infor matio n is consi stent with releva nt gover nmen t-wide and agenc y polici es. NFC protec ts the privac y of individ uals by adheri ng to Privac y Act requir ement s.

NFC has a Privac y Officer who overs ees the protec tion of privac y for the individ uals whose record s are maint ained by NFC.

NFC also follow s Depar tment of Defen se guideli nes for Truste d Comp uter Syste m Evalu ation Criteri a (i.e., C2), the comm on criteri a (i.e., EAL3) , and indust ry best practic es (i.e., GASS P) for data protec tion.

II.B.5. If a Priva cy Impac t Asses sment was cond ucted, pleas e provi de a copy to OMB.

II.C. Gov ern men t Pap erw ork Elim inati on Act (GP EA)

II.C.1. If this proje ct supp orts electr onic trans action s or recor d- keepi ng that is cover ed by GPEA , briefl y descri be the trans action or recor d- keepi ng functi ons and how this invest ment relate s to your agenc y's GPEA plan

As a multi- agenc y initiati ve under the USDA e- Gover nment Progr am as well as the OPM e- Payrol l effort, this projec t suppo rts e- Payrol l electr onic transa ctions. Curre ntly, NFC's electr onic transa ctions have been incorp orated into the existin g Payrol l/Pers onnel Syste m (PPS), meeti ng their Inform ation Collec tion deadli ne of Dece mber 2001. In additio n, the PPS meets the GPEA record - keepin g requir ement , storin g payroll record s for up to 12 years. NFC's existin g custo mers can view their payroll history throug h the NFC Websi te (www. nfc.us da.go v).

II.C.2. What is the date of your GPEA plan? 10/29/ 2001

II.C.3. Identi fy any OMB Paper work Redu ction Act (PRA) contr ol numb ers from infor matio n collec tions that are tied to this invest ment. Not applic able. Due to the nature of NFC, all GPEA relate d transa ctions are non- PRA. NFC's transa ctions are Gover nment to Gover nment becau se our custo mers are Feder al and quasi- Feder al agenci es.