INFORMATION RESOURCES MANAGEMENT 12.1 Information Resources and Technology Management A. Proponent: Assistant Director for Information Technology Division (ITD) and Chief Information Officer (CIO). Telephone: 202-307-9677. B. Purpose: To establish United States Marshals Service (USMS) policy governing the planning, management, operation, and use of information technology (IT) and information resources (IR). This policy applies to all persons who use USMS IT resources, including but not limited to employees, contractors, task force officers, and interns. This policy applies to classified and unclassified computer and telecommunications systems, technology, peripheral devices, and resources that are acquired for use by, owned, operated, or managed by USMS offices and users. C. Authority: References to selected laws and regulations applicable to this policy directive are in Appendix 1, Authority. D. Policy: ITD is responsible for the promulgation of policy, procedures, management and oversight, and provision of support services for all IR management and IT systems in the USMS. The Tactical Operations Division (TOD) is responsible for the management and provision of support services for secure telecommunications equipment and services. 1. The Assistant Director for ITD, also known as the CIO, is responsible for: a. Advising and assisting the Director, Deputy Director (DD), Associate Directors (AD), Assistant Directors (A/AD), United States Marshals (USM), and other senior USMS staff in order to ensure that the USMS plans, acquires, manages, and uses IT and IR in a manner that enhances mission accomplishment; improves work processes and paperwork reduction; provides sufficient protection for the privacy of personal information; promotes citizen-centered electronic government; and is consistent with all applicable federal laws and policy directives; b. Recommending USMS-wide policies, and issuing standards, procedures and guidelines to ensure an effective and integrated approach to IT planning, management, and reporting; c. Developing and managing a USMS IT Strategic Plan that supports Department of Justice (DOJ) and USMS mission-oriented goals and performance measures, and is consistent with the laws and regulations affecting IT security; d. Developing strategic performance measures which apply to the objectives in the DOJ IT Strategic Plan; and e. Developing, maintaining, and implementing the USMS Enterprise Architecture (EA) program. The EA program guides the selection and implementation of the USMS IT investments. The EA program: USMS Policy Directive 12.1, Information Resources and Technology Management. Page 1 of 4 Effective: 3/19/2010 1) Defines the various elements of USMS architecture, connections to departmental and federal architecture, and the interaction with other DOJ component architectures; 2) Delivers optimum IR requirements necessary to support DOJ's mission and strategic goals, thereby facilitating consolidated, centralized, and integrated component IT services which improve information access, quality, and economies of scale; 3) Identifies the IT capabilities required to achieve USMS IT strategic goals and specifies a plan to develop, acquire, and integrate those capabilities into DOJ's architecture; 4) Ensures compliance with the Office of Management and Budget (OMB) federal architecture guide, standards, and requirements; and 5) Ensures that USMS IT investments are aligned with DOJ architecture, and that those investments are delivering the expected technical and functional performance results. f. Administering the IT Investment Management (ITIM) program. The CIO: 1) Establishes and maintains a USMS-wide enterprise portfolio management process that manages USMS investments from inception to retirement; 2) Integrates the USMS enterprise portfolio management process into the USMS budget process and manages the IT portion of the budget process; and 3) Ensures compliance with OMB federal investment management guidance and with DOJ and OMB reporting requirements. g. Administering and coordinating USMS IT acquisition management with the Assistant Director for the Financial Services Division (FSD). The IT acquisition management process: 1) Is governed by the Federal Acquisition Regulations (FAR) and by the Justice Acquisition Regulations (JAR), Circulars, and Procurement Guidance Documents (PGD); 2) Includes the completion of key activities for acquiring products and services, including the identification of discrete units of work or modules to be contracted, market research, identification of competition, potential contracting sources, contract types and budget and funding; 3) Addresses risks and provides the appropriate incentives for contractors to perform based on the government's expectations; 4) Develops an acquisition strategy for all major IT projects, which shall be revised whenever significant changes occur during the life cycle of the IT project; 5) Utilizes acquisition planning to direct procurements throughout the life cycle of the major IT project; USMS Policy Directive 12.1, Information Resources and Technology Management. Page 2 of 4 Effective: 3/19/2010 6) Utilizes DOJ and General Services Administration (GSA) enterprise license agreements, if available, and adheres to OMB policy directives to procure products and services required for IT projects; 7) Utilizes modular contracting to acquire major IT systems to the maximum extent feasible to provide incremental benefits and costs versus lengthier contract delivery approaches. Contracts and modules shall be aligned with current and anticipated program funding. Contracts shall contain discrete units of work as identified in the acquisition strategy; 8) Utilizes Statements of Work (SOWs) which reference all of the relevant DOJ IT policies, the EA, and other standards including the Technical Reference Model (TRM), where compliance is required for the acquisition of IT products and services; and 9) Requires contractors to use an earned value management system to monitor and report on project cost and schedule performance outcomes. h. Ensuring Privacy Impact Assessments (PIAs) are: 1) Conducted in accordance with the E-Government Act of 2002 and applicable DOJ and OMB guidance, including OMB Memorandum 03– 22; 2) Conducted and reviewed prior to the development of a new system (or system modification), ideally when requirements are being analyzed and decisions are being made about data usage and system design; and 3) Published on a publicly available web site on a page devoted to privacy or to the system for which the PIA was conducted, or Freedom of Information Act (FOIA) electronic reading room. i. Ensuring the compliance with and implementation of USMS-wide policy and procedures concerning the accessibility of DOJ information technology by federal employees, contractors, and members of the public sector, as specified by 1998 Amendment to Section 508 of the Rehabilitation Act. j. Assessing IT human capital needs and requirements and developing and implementing strategies and plans for meeting these needs and requirements. k. Reviewing and evaluating: 1) The performance of USMS IT programs and projects; and 2) IT funding requests, including reprogramming actions. l. Providing IT services and operations to the USMS. m. Delegating responsibilities, as necessary, for the effective and efficient operation of the USMS IR program and IT systems. n. Consulting and coordinating, as appropriate, with the Office of General Counsel (OGC) to identify legal issues and ensure compliance with the E-Government Act of 2002, the Privacy Act of 1974, and other applicable statutes and regulations. USMS Policy Directive 12.1, Information Resources and Technology Management. Page 3 of 4 Effective: 3/19/2010 2. The Security Program Manager (SPM): The designation of a USMS security officer is intended to establish clear accountability for setting policy for all security matters, including personnel, physical, IT, and information security activities. The SPM for the USMS is the Chief of the Office of Security Programs (OSP) within TOD. E. Procedures: 1. All requests for waivers to this policy are to be submitted in writing, e-mail is acceptable, to the CIO, who will direct the request to the appropriate USMS official for approval. 2. Procedures associated with the management, use, allocation, deployment, and accountability of USMS IT resources and systems are found in Policy Directive 12.2, The Management, Use, Allocation, Deployment, and Accountability of United States Marshals Service (USMS) Information Technology (IT) Resources and Systems. 3. Procedures associated with USMS user accounts and IT system accesses are found in Policy Directive 12.3, Information Technology Account Management and User Support. 4. Procedures associated with the acquisition, management and use of network and telecommunications services and equipment are found in Policy Directive 12.4, Guidelines for Telecommunications Requests. 5. Procedures associated with ITIM, the IT strategic plan, and IT change management processes are found in Policy Directive 12.5, Investment Management. 6. Procedures associated with Intranet and Internet web management and E-Government are found in Policy Directive 12.6, E-Government/Web Management. 7. Procedures associated with IT security management are found in Policy Directive 12.7, Information Technology (IT) Security. F. Definitions: References to selected terms and definitions applicable to this policy directive are in Appendix 2, Definitions. G. Cancellation Clause: