responsive document crew: hhs: regarding record management and cloud computing (6/24/2011 foia...

8/6/2019 Responsive Document CREW: HHS: Regarding Record Management and Cloud Computing (6/24/2011 FOIA Reques

1/185

Pages 1 through 9 redacted for the following reasons:- - - - - - - - - - - - - - - - - - - - - - - - - - - -All pages withheld under exemption (b)(5) - drafts


2/185

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

Washington DC 20201

Meeting MinutesCTO Council Meeting

Januar 10:30 AMDial in number: Participant:

Roll CallCeline Neves, OCIO/EA

Office Member Present

ACF Jenkins, David Jim TysonFu, James

AHRQ Erny, Tim Phone

AoA Banning, Sue

CDC Sagoo, Jaspal PhoneCDC Boyd, Terry Phone

CDC Baum, Earl W Phone

CMS Margush, Doug C.

CMS Wilke, Sherry Phone

FDA Coene, Michael

NIH Burton, Adriane Phone

NIH Bailey, Steve Phone

NIH Akiyama, Darrick Phone

OCIO Mitchell, Timothy Phone

OCIO Neves, Celine Phone

PSC Rollins, Dwayne Phone

SAMHSA Walters, James R. Phone

Welcome - Opening RemarksChair Jaspal Sagoo, CDC Chief Technology Officer (CTO)

Jaspal Sagoo recapped the last meeting and encouraged everyone to read thedocuments in SharePoint. He went on to say that we are in Phase II and assignmentswere distributed.

CDC Transition Plan, Process Documentation, Alternative Analysis Process HHS EA Service Architecture (all of back office support: data architecture,

SOA) ?? Technical Architecture Not yet assigned because it is dependent on

design of the service architecture.

Jas indicated that Celine and he would be reaching out to the members to solicit furtherparticipation as the tasks are rather large.

0010


3/185

Page 2 of 4

Business

Status of Alternate Analysis guidance

The first priority is to provide the guidance to all the OPDIVs on how to conduct the

alternate analysis for cloud computing. The old OMB passback language had givenenough time and latitude to conduct the analysis, but in December new passbacklanguage came out specifying Cloud first for ALL IT investments. What it means for theDepartment is that for every investment, whether it is minor or major, whether it isreported in the OMB-300 or not, the IT organization has to do the analysis for cloud aswell as doing the analysis for hosting internally. As a result, the workgroup needs todevelop the guidance.

After reviewing the OMB-300 submission, where we had put standard language for whatthe Department was doing, OMB came back and asked the Department to specify whatwe are doing and identify timelines for our initiatives. As such, the CTO Council

requested guidance on how to conduct the alternative analysis by the end of January.Jas and the team have started developing the guidance and are seeking assistance.The intent is to present the guidance to the CTO Council so that IT organizations haveguidance on how to conduct the analysis; the draft guidance needs to be completed bythe end of the week, the final guidance needs to be completed by the end of the month,and the alternative analysis needs to be completed by the mid or end of February. Theguidance will go before the CIO council for ratification. The intent of giving the alternateanalysis guidance to the IT organizations is so that they can disseminate it to thebusiness owners that need it so that they can do the analysis come mid-February. Thisis why the timeline has been set so aggressively.

Jas provided a paragraph to Mary Forbes so she can respond back to OMB and satisfytheir requirements. OMB is pushing us to show them we are in earnest makingattempts for all of our investments to look at Cloud first. The paragraph discusses thework the HHS CCAC group is doing; to include the timeline and when the guidance willbe in place. Mary is going to be sending the information to OMB this week. ProvidingOMB accepts our proposal, this committee has a little bit more latitude in timeline if wehave to shift back on the timeline.

The first guidance tells the business owner what they have to tell their IT organizationabout their system; it could be a new system or an enhancement or steady state. Thepass back language doesnt discriminate against investments. All investments must

consider cloud alternative. Jas said they are developing a set of questions in a templateform, similar to a security base line, which asks the same kinds of questions. As soonas the template is ready, it will be sent to the committee to vet. The turn-around time isgoing to be very short. Thats the first part.

Then the analysis begins. The IT organization then determines costing within their ownorganization. The committee will provide guidance on the vendors. Jas is looking atFedRAMP and the Fed CCAC. They are putting together a care package for us. This

0011


4/185

Page 3 of 4

will turn into a list of questions to ask vendors, which will be forwarded to the HHSCCAC members for vetting.

The HHS Governance council has not yet been established.

How does a system already in steady state, production, etc, get back into the loop sothat analysis is done. The obvious choice was the ELPC process.

IT infrastructure is not well represented in the ELPC process; there was a critical partnerrole for EA but not one that specifically addressed the impact of IT initiatives to theoverall IT infrastructure of an organization. So they are proposing to the EA PMO thatIT infrastructure be included in the partnership review so that they can conduct theanalysis in the review process.

Need to ensure that the IT organization has visibility into the earliest stages of an ITinitiative so that we can capture not only the business requirement but also technical

and infrastructure requirements and make sure those are directed to best serviceprovider (remembering that the current guidance from OMB is cloud first). Is there acommercial or government-wide cloud provider that can provide the services at whatsecurity level needed? If not direct the project internally. An RFI is being developed.

The question was posed, where the money is going to come from to transition currentsystems into the cloud. When you do the analysis you need to take this intoconsideration. If its an existing system, part of the analysis will be what the cost will beto transition the system into the cloud. It could well be that the cost is the prohibitingfactor and that is going to have to be factored in. If the cost of moving it is not costeffective, then that will be one of the factors that determine whether the system istransitioned to the cloud. All OMB is saying is that we have to consider cloud first andat least do the analysis.

OMB recognizes the financial constraints that agencies are facing and are working torectify this matter, in particular the way that funding is handled. Many organizationsdont have IT funds for such initiatives.

25 point Implementation plan to reform Federal IT management

Cloud first OMB is expecting us to favor cloud first and address the funding issues(the color of money).

The work breakdown structure is posted in SharePoint.

Discuss the formation of an HHS Cloud Computing Governance Council

Its critical that we have a permanent body that deals with ongoing cloud governance forthe department. It could be that this committee morphs into the governance body. Weneed representation from all the OPDIVs.

0012


5/185

Page 4 of 4

Since there was no dissention, the topic will be raised at the Tuesdays CTO Councilmeeting and will seek membership so that the charter to be developed.

Wrap up

Draft guidance will be distributed to the members for review. There will be a request fora quick turnaround.

CDC will compile a list of vehicles that are being used for procurements throughout thedepartment and the POC as to who the contract holder. That way if theres a particularvendor that the OPDIVs can use, they can leverage the contract.

Next Meeting January 25, 2011 9:00 10:30

0013


6/185

ITSO 1 of 6 Revision: 7/20/204-CCAC Minutes Jan-25-2011 (tracker plus roll call)

CCAC Meeting MinutesDate: 1/25/2011Time: 9:00 10:30 AMLocation: Phone

Attendees: OFFICE MEMBER PRESENT OFFICE MEMBER PRESENT

ACF David Jenkins NIH Steve Bailey

ACF James Fu x NIH Adriane Burton x

ACF Jim Tyson x NIH Darrick Akiyama x

AHRQ Tim Erny x OCIO Timothy Mitchell x

AoA Sue Banning x OCIO Celine Neves x

CDC Jaspal Sagoo x PSC Dwayne Rollins x

CDC Terry Boyd x SAMHSA James R.Walters

CDC Earl W. Baum x EA/OCIO/CTR KumarRadhakrishnan

x

CMS Sherry Wilke x EA/OCIO/CTR Brian Leitao x

CMS Doug C. Margush EA/OCIO/CTR Nick Mistry x

FDA Michael Coene

IHS Bernie Dailleboust

IHS Mark Rives x

Facilitator: Jaspal Sagoo, CDC

Recorder: Nicole DElia

Agenda & NotesTopic/Time/Lead Notes

Welcome/Opening Remarks

- Chair Jaspal Sagoo, CDC ChiefTechnology Officer (CTO)

Action Items:

Need to get minutes out on time for review; need to approve minutes asfirst order of business in future meetings starting with Feb 8

thmeeting

Introduction of New HHS EA TeamMembers

- Earl Baum, CDC& HHS EA Team

Introduction Kumar and Brian: EA portion and helping out with cloudportion for the organization

Have prior experience with implementing cloud; working to enable agood cloud strategy for HHS and making sure we have a goodformulated strategy

Nick Mistry, et al. working with Earl and Jaspal

HHS Cloud Update

- Jaspal Sagoo, CDC

The HHS Cloud Computing Advisory Committee is developing the HHS

Cloud Computing Architecture and Transition Plan, based on input fromthe following sources:

Original OMB Pass back Language Federal CIOs 25-Point document Draft Federal Cloud Computing Strategy document

OMB Cloud Computing Alternative Analysis necessary first step indeveloping and deploying Cloud-hosted services in a consistentmanner across HHS

Customer Requirements Development part of the existing EPLCprocess; done during initiation/concept phase; want to capture sufficient

0014


7/185



information in the concept stage gate

Cloud Computing Governance provides additional input into thealternative analysis; need to nail down the actual processes and how

they relate to the other processes Looking at forming Governance Council for Cloud Computing

Services, Costs, and Contracts tracking, developing standardizedlanguage for RFIs, cloud service providers, maintain list of approvedvendors/service providers that can be applied to initiatives

Cloud Service Provider Analysis RFI care package (from GSA?) developing templates where each vendor can provide standardized ratecards/includes how to request customized quotes

To some extent looking at internal IT organizations as cloud serviceprovider during Alternative Analysis each internal IT org at OPDIVlevel provide rate card information as well

Proposing formalizing an IA critical partner role for major and smaller

investments, starts at conceptual stage/first stage gate Need to know what it will cost for the existing internal IT organization to

host the system/gather RFI information to see cost for external host

Business Steward IT organization will send from EPLC orindependently to the Business Steward questions that BusinessSteward has to answer about characteristics of the system (similar tosecurity baseline)

Questions/Responses

When is the Alternative Analysis triggered? New investment triggerduring initiation and concept; Steady state/upgrading existing atminimum Alternative Analysis before the 53s and 300s.

Action Items:

Target Key Business Process Model Responsibility: CDC, In Progress carry-on work from reference

architecture worked on last summer

All top-level Cloud Service Processes

Cloud vendor service catalog/rate-sheet maintenance

Cloud alternative analysis

EPLC extensions - IT Infrastructure Critical Partner Role

Target Service Component Architecture

Responsibility: HHS EA, Not Started

HHS Federated Data Architecture

HHS Federated SOA Catalog

Target Technical Architecture

Responsibility: Unassigned, Not Started

Depends on input from the previous steps need to see what thedependencies are

Transition Recommendation & Blueprint Document

Responsibility: CDC, In Progress Terry Boyd

Depends on input from the previous steps; in a holding pattern at themoment

Will need to divide the work up

Sequence Diagram and Milestones should be complete within 90 days,to feed into OMB 120-day guidance core components need to be

0015


8/185



fairly far along in 120 days

Guidance Development

Target Key Business Process Model: (This flows out of statement of

work) Key Points: nailing down key processes and relationships between

processes

Assigning who owns each process

Define target business processes and their performance includingorganizational relationships

Define target data relationships and business data stewards

Define the target information services

Ensure target business and information architecture addressesstrategic improvement opportunities

Progress To-Date

- Earl Baum, CDC& Charles Martin,CDC

On the contract side CDC, HHS contracting staff; make sure wereasking for enough information from each service provider to come up

with a rate card that is sufficiently useful and complete/accurate

Likewise with the governance enough guidance but not too much

To make this happen: Taking a federated approach each OPDIVmaintains own suite of contracts and list of approved vendors; one sizefits all process is the goal for feeding into analysis

On the back end; adopt recommendation; looking at tying clouddeployment into standardized data architecture HHS wide

Federated approach to SOA; to ensure/have a useful catalog ofservices as we deploy cloud

Overarching set of HHS wide processes/standards; implemented atOPDIV level with OPDIV level additional conditions and procedures ensure everyone is following same general process

Internal IT organizations have potential to become cloud providers forother organizations, not just your own internal programs

Funding issues will ensure that strategies and processes that wedevelop stay within boundaries of current appropriations laws andlanguage

Document templates sanity check, are we capturing everything youneed to know? Feed information back to us

Action Items:

Defined individual/group specific to IT infrastructure within each OPDIVwho handles the alternative analysis; tie to existing EPLC process aswell will send out within next wk or so (recommended for HHS wide)

want consistent POC within each OPDIV Responsibility: CDC? Due around February 1

st

Requirements Definition trying to get enough information w/ogathering too much to do effective analysis; scope, security level- willsensitive data be posted on system?Timeline for system; tie into EPLCdocumentation

Responsibility: CDC? Due around February 1

st

Document Templates for Alternative Analysis Responsibility: CDC?

0016


9/185



Due around February 1st

Reaching out for contract vehicles, data call for existing contractvehicles and vendors within the OPDIVs; then will figure out how to

request information from all these vendors Responsibility: Jaspal/CDC Due prior to February 8

thmeeting?

Wrap Up Hoping to receive care package RFI from GSA

Prior to next meeting: End of this week/beginning of next week: Jaspalwill be sending out a lot of these documents for comment, first to theCTO Council, then to Mary and John Teeter to be put on the agenda forthe CIO Council.

Next Meeting February 8, 2011 9:00 10:30

0017


10/185


Action Item Tracker:

ID Action Accountable Due Date Status

1

Need to get minutes out on time for review; need to approve minutes

as first order of business in future meetings starting with Feb 8th

meeting

2

Target Key Business Process Model


Cloud vendor service catalog/rate-sheet maintenance

Cloud alternative analysis EPLC extensions - IT Infrastructure Critical Partner Role

CDC In Progress

3

Target Service Component Architecture


HHS Federated SOA CatalogHHS EA Not Started

4Target Technical Architecture

Depends on input from the previous steps

Unassigned Not Started

5

Transition Recommendation & Blueprint Document

Depends on input from the previous steps; in a holding pattern at

the moment


Sequence Diagram and Milestones should be complete within 90

days, to feed into OMB 120-day guidance

CDC Terry Boyd In

Progress/Holding

Pattern

6

Guidance Development



Define target business processes and their performance including

organizational relationships

Define target data relationships and business data stewards


Ensure target business and information architecture addresses

strategic improvement opportunities

CDC?

7Defined individual/group specific to IT infrastructure within each

OPDIV who handles the alternative analysis; tie to existing EPLC

CDC? Around

February 1st

0018


11/185


process as well (recommended for HHS wide) identify consistent

POC within each OPDIV

8Requirements Definition/Gathering Timeline for system; tie into

EPLC documentation

CDC? Around

February 1st

9Document Templates for Alternative Analysis CDC? Around

February 1st

10

Data call for existing contract vehicles and vendors within the

OPDIVs, then will figure out how to request information from all

these vendors

CDC Jaspal Prior to

February 8th

0019


12/185

ITSO 1 of 6 Revision: 7/20/205-CCAC Minutes Feb-8-2011




ACF James Fu X NIH Adriane Burton X

ACF Jim Tyson X NIH Darrick Akiyama X

AHRQ Tim Erny X OCIO Timothy Mitchell X

AoA Sue Banning X OCIO Celine Neves

CDC Jaspal Sagoo X PSC Dwayne Rollins X

CDC Terry Boyd X SAMHSA James R.Walters X

CDC Earl W. Baum X EA/OCIO/CTR KumarRadhakrishnan

X

CMS Sherry Wilke X EA/OCIO/CTR Brian Leitao X

CMS Doug C. Margush X EA/OCIO/CTR Nick Mistry

FDA Michael Coene Jay Burton X

IHS Bernie Dailleboust CDC Charles Martin X

IHS Mark Rives X

Facilitator: Brian Leitao, EA/OCIO/CTR

Recorder: Nicole DElia, EA/OCIO/CTR


Welcome/Opening Remarks- Chair Jaspal Sagoo, CDC ChiefTechnology Officer (CTO)

Alternative Analysis and SupportingProcesses

- Jaspal Sagoo, CDC

Developing the Alternative Analysis for Cloud first will be used onceratified as guidance for Analysis for each OPDIV; needed for OMB 300s

Action Items:

Read HHS Cloud Computing Implementation and Governance Draftv0.1 (Alternative Analysis first draft) provideinput/comments/questions/errors/omissions

CIO Slides- Jaspal Sagoo, CDC

Slides for the upcoming presentation for CIO Council

3 Must Move services to the Cloud in the next 18 months

CIOCouncil will deliberate

Need to provide guidance to HHS and OPDIVs to consider Cloud first this will be accomplished through the Alternative Analysis

The NIST Definition of Cloud Computing will be covered with the CIOs Will be considering all three service models: SaaS, PaaS, IaaS

The CCAC is: Developing Guidance on Alternatives Analysis for Program

Managers; Developing Information Gathering Template; Developing Process Models and Rules;

0020


13/185



Updating EPLC to account for Cloud Innovation

Draft Alternative Analysis document contains: roles, functions,processes and criteria

RFI building in standard way of requesting customized quotes Governance Body will maintain and update list of vendors, make

available to all stakeholders; maintain service provider cost and securitydata

Internal Analysis (cost of hosting system internally) then ExternalAnalysis; based on the RFI responses you get back, makerecommendation this is an iterative process (not a one-time process)

Can accept/reject recommendation but then need to follow protocols

Cloud Training will need to be provided for Critical Partner as well

Work Assignments- Jaspal Sagoo and Earl Baum, CDC

Deliverable A0 Customer Requirements Development

Lead: Earl Baum

Leveraging existing processes to the extent possible

Adding Critical Partner / Alternative Analysis to the EPLCprocess

Security adding to existing CNA process

Trying to provide standardized language and feed into existingprocesses

Tim Mitchell requested to join this workgroup

Deliverable E0 Cloud Computing Support Governance

Lead: should be Sherry Wilke or Doug Margush

Leveraging existing processes to the extent possible here too

Need to fine tune procurement cycle, security

Deliverable B0 Services, Costs, Contracts Ginny Howard, Terry Boyd

Lead: not determined

Internal and external hosting providers

Early draft of contract language for RFI

Potential for interagency collaboration

Need a lead for all of these areas

Deliverable C0 Cloud Support Services

Lead: Kumar

Longer term

Support overall Cloud and other EA HHS architecture

Develop consistent HHS-wide data architecture

NIH working on this as well as HHS EA team Deliverable F0 Solution Implementation

Lead: not determined/CDC?

Date due is after 4/1/2011

Need support from anyone and everyone

Transition Plan/Blueprint that ties everything together turningthis all into a roadmap

End goal: turn suite of processes over to CTO and CIOCouncils for them to use

0021


14/185



As deliverables are developed, theyre being tied into this

Security Jay Burton tied closely with Governance workflow

Action Items:

Draft timeline, work assignments for each team

Top level work plan/timeline; include any information needed from otherworkgroups

Look for any gaps in information

Be prepared to talk about your work plans

Jaspal and Earl will provide feedback from the CIO Council, updates onthe document; submission to OMB on February 11th

Wrap Up Contact Brian and Kumar (CC: Earl and Jaspal) to join a workgroup

Next Meeting February 22, 2011 9:00 10:30

Send all information by Friday, February 18th

since Monday, February21

stis Presidents Day

0022


15/185

TSO 4 of 6 Revision: 7/20/201105-CCAC Minutes Feb-8-2011


ID OPDIV/

Department

Action Item Description Priority

Level

Owner/

Lead

Date

Assigned

Date Due Date

Complete

Percent

Complete

Progress Notes

1

CCAC Minutes Need to get minutes out on time forreview; need to approve minutes as first

order of business in future meetings

starting with Feb 8th

meeting

1/25/2011 In Progress

2

Target Key Business

Process Model


Cloud vendor service catalog/rate-sheetmaintenance

Cloud alternative analysis EPLC extensions - IT Infrastructure

Critical Partner Role

CDC 1/25/2011 In Progress

3

Target Service

ComponentArchitecture



HHS EA 1/25/2011 Not Started

4Target Technical

Architecture

Depends on input from the previous steps Unassigned 1/25/2011 Not Started

5

Transition

Recommendation &

Blueprint Document

Depends on input from the previous

steps; in a holding pattern at the

moment


Sequence Diagram and Milestones

should be complete within 90 days, to

feed into OMB 120-day guidance

CDC Terry

Boyd

1/25/2011 In

Progress/Holding

Pattern

6

Guidance

Development



Define target business processes and

their performance including


Define target data relationships andbusiness data stewards

CDC? 1/25/2011

0023


16/185


ID OPDIV/

Department


Level

Owner/

Lead

Date

Assigned

Date Due Date

Complete

Percent

Complete

Progress Notes


Ensure target business and information

architecture addresses strategicimprovement opportunities

7

Defined IT

Infrastructure POC

Defined individual/group specific to IT

infrastructure within each OPDIV who

handles the alternative analysis; tie to

existing EPLC process as well (recommended for HHS wide) identify

consistent POC within each OPDIV

CDC? 1/25/2011 Around

2/1/2011

8Requirements

Definition/Gathering

Timeline for system; tie into EPLC

documentation


2/1/2011

9

Document

Templates forAlternative Analysis


2/1/2011

10

Data call for existing

contract vehiclesand vendors within

the OPDIVs, then

will figure out howto request

information from all

these vendors

CDC

Jaspal

1/25/2011 Prior to

2/8/2011

11

HHS Cloud

ComputingImplementation and

Governance Draft

v0.1

Read Alternative Analysis first draft and

provideinput/comments/questions/errors/omissions

Medium 2/8/2011 2/22/2011 0% Not Started

12

Workgroup

Timeline and WorkPlan

Draft timeline, work assignments for each

team; include any information needed fromother workgroups

Look for any gaps in information

Be prepared to talk about your work plans

High Workgroup

Leads

2/8/2011 2/22/2011 0% Not Started

0024


17/185


ID OPDIV/

Department


Level

Owner/

Lead

Date

Assigned

Date Due Date

Complete

Percent

Complete

Progress Notes

13

CDC Feedback from CIO

Council

Provide feedback from the CIO Council,

updates on the document; submission to

OMB on February 11th

Medium Jaspal

Sagoo/Earl

Baum

2/8/2011 2/22/2011 0% Not Started

0025


18/185

ITSO 1 of 6 Revision: 7/20/206-CCAC Minutes Mar-1-2011



ACF David Jenkins NIH Steve Bailey X

ACF James Fu X NIH Adriane Burton

ACF Jim Tyson X NIH Darrick Akiyama X

AHRQ Tim Erny X NIH Debbie Bucci X

AoA Sue Banning OCIO Timothy Mitchell

CDC Jaspal Sagoo X OCIO Celine Neves

CDC Terry Boyd X PSC Dwayne Rollins X

CDC Earl W. Baum X SAMHSA James R.Walters

CMS Sherry Wilke EA/OCIO/CTR Kumar

Radhakrishnan

X

CMS Doug C. Margush X EA/OCIO/CTR Brian Leitao

FDA Michael Coene X CDC Jay Burton X


IHS Mark Rives X CDC Ginny Howard X

Facilitator: Nicole DElia, EA/OCIO/CTR




Alternative Analysis and SupportingProcesses / CTO and CIO CouncilUpdates

- Jaspal Sagoo, CDC

The CTO and CIO Councils expressed anxiety over the governanceprocess

Alternative Analysis EPLC Integration: Various trigger points depending on the lifecycle of the system Trying to simplify and streamline this process; but there is

additional work that is going to need to be done (due to OMBCloud First mandate)

Need full CPIC support

Our job to make sure stakeholders understand their roles andresponsibilities

IT Critical Partner up to the individual programs and IT organizations

A lot of this information should be gathered during the EPLC processalready; not necessarily new work, just formalizing the process

New Initiatives Alternative Analysis triggered: At the end of concept phase determining whether the

initiative can be cloud At the end of the requirements analysis stage Prior to implementation stage sanity check, make sure

0026


19/185



sufficient information has been collected

Enhancements Alternative Analysis triggered: Similar process as for new initiatives

Quick touch point on previous stage gates to see what haschanged With upgrades and enhancements, is cloud now feasible?

Steady State Alternative Analysis triggered when OMB 300 isproduced every year

If updates, enhancements, or a technology refresh are planned,they still will have to do the Alternative Analysis

Data Call- Jaspal Sagoo, CDC

Trying to develop vendor list with standard rate cards

Looking to control sprawl; every OPDIV has contract vehicles in place

Asking each OPDIV for feedback on existing contract vehicles, theCOTR, and POC (both on the vendor side and on the procurementside)

Then we will be able to reach out with RFIs weve agreed on

Will compile working spreadsheet of vendors, servicesprovided, and standard rate cards

As soon as the Alternative Analysis document has been blessed, thislist will be necessary to move forward

Work with your CTO to get this information going

Looking for both development vehicles and service vehicles

Action Items:

Will send out generic RFI template; please provide feedback on thisdocument.

Market Research Briefings withVendors

- Jaspal Sagoo, CDC

Vendors have been asking for time to brief the committee

As we look at the vendor list were developing, were going to want tolook at those vendors first

Want to make sure that when vendors provide briefing, it is lessmarketing and more services oriented, including their rate cards

Action Items:

Develop template of questions/formatting for the briefing for eachvendor Kumar will come up with a template and circulate to thecommunity

Work Plan and Timeline Overview- Jaspal Sagoo and Earl Baum, CDC& Workgroup Leads

Deliverable A0 Customer Requirements Development

Lead: Earl Baum

Timeline is complete, pending review

Deliverable will be complete EOM March


Lead: Sherry Wilke or Doug Margush

Still aiming for April 1st

deadline, but need requirements

Deliverable B0 Services, Costs, Contracts Ginny Howard, Terry Boyd

Lead: not determined

Should be able to complete by April 1st

Draft of contract language for RFI has incorporated Ginnyscomments

All committee members need to review the RFI draft so that itcan be sent out to the vendors

0027


20/185




Lead: Kumar Radhakrishnan

Draft timeline will be sent to Earl by EOW

Deliverable F0 Solution Implementation

Lead: not determined/CDC?

Looking at 5/1/2011 for the Transition Plan


Security Jay Burton tied closely with Governance workflow

Ties GSA FEDRAMP ANA into CNA process

Tie this to HHS driver

Action Items:

Workgroup leads need to send an email to Earl, CC: Jaspal and Kumarto confirm timelines

Review and comment on draft documents by EOW HHS Cloud Computing RFI Draft v0.1.2 HHS Cloud Computing Implementation and Governance Draft

v0.2.1

Wrap Up Action Items:

Will create list of published documents to track comments, feedback,and approval from each OPDIV for each version Jaspal will showtracker to the CTO Council at the March 8

thmeeting

Next Meeting March 22, 2011 9:00 10:30 AM

0028


21/185

TSO 4 of 6 Revision: 7/20/201106-CCAC Minutes Mar-1-2011


ID OPDIV/Department


Level

Owner/ Lead Date

Assigned

Date

Due

Date

Complete

Percent

CompleteProgress Notes

1CCAC Minutes Need to get minutes out on time for review;

need to approve minutes as first order of

business in future meetings

High Nicole DElia 1/25/2011 In Progress

2

Target Key Business Process

Model





CDC 1/25/2011 In Progress; Jay Burton will

be providing the CISOviewpoint; Transition Planstill needs to be finalized;

Addressed as far as the

Alternative Analysis draft

document (just need review

and approval)

3

Target Service ComponentArchitecture


HHS Federated SOA CatalogHHS EA 1/25/2011 In Progress timeline will

be out by Mar 4; will be

reaching out to NIH as

soon as Transition Plan isfinalized

4Target Technical

Architecture

Depends on input from the previous steps Unassigned 1/25/2011 Not Started Dependent on

Item 3

5

Transition Recommendation

& Blueprint Document

Depends on input from the previous

steps; in holding pattern Will need to divide the work up

Sequence Diagram and Milestones

should be complete within 90 days, to

feed into OMB 120-day guidance

CDC Terry

Boyd

1/25/2011 In Progress/Holding Pattern

initial drafts are beingstarted, still need a lot ofinformation

6

Guidance Development Target Key Business Process Model


Define target business processes andtheir performance including




Ensure target business and information

architecture addresses strategic

CDC? 1/25/2011 In Progress ties back toItem 2

0029


22/185


ID OPDIV/Department

Action Item Description PriorityLevel

Owner/ Lead DateAssigned

DateDue

DateComplete

PercentComplete

Progress Notes

improvement opportunities

7

Defined IT Infrastructure

POC

Defined individual/group specific to IT

infrastructure within each OPDIV whohandles the alternative analysis; tie toexisting EPLC process as well

(recommended for HHS wide) identify

consistent POC within each OPDIV

Committee

members needto talk to CTOs& CIOs

1/25/2011 Around

2/1/2011

In Progress: Need to have

POC for each OPDIV forcoordination purposes;dont need to necessarily

provide name to the CCAC

8RequirementsDefinition/Gathering

Timeline for system; tie into EPLCdocumentation Draft of this is in the

Governance Document

CDC? 1/25/2011 Around2/1/2011

9Document Templates for

Alternative Analysis


2/1/2011

In Progress: Draft is

complete pending review

10

Data call for existing

contract vehicles and

vendors within the OPDIVs

Data call went out (2/28/2011) Kumar

Radhakrishnan

1/25/2011 Prior to

2/8/2011

In Progress: As information

comes back, will compile

spreadsheet

11HHS Cloud ComputingImplementation and

Governance Draft v0.1

Read Alternative Analysis first draft andprovide

input/comments/questions/errors/omissions

Medium 2/8/2011 2/22/2011

100% Complete: See Item 16

12

Workgroup Timeline andWork Plan

Draft timeline, work assignments for eachteam; include any information needed from

other workgroups

Look for any gaps in informationBe prepared to talk about your work plans

High WorkgroupLeads

2/8/2011 2/22/2011

0% In Progress: See Item 18

13

CDC Feedback from CIO Council Provide feedback from the CIO Council,

updates on the document; submission to

OMB on February 11th

Medium Jaspal

Sagoo/Earl

Baum

2/8/2011 2/22/201

1

3/1/2011 100% Complete

14Market Vendor Question

Template

Starter template of questions for vendors

when they brief the CCAC

Medium Kumar

Radhakrishnan

3/1/2011 In Progress

15

CCAC Published

Documents Tracker

Create tracker to log comments, feedback,

and approval for each OPDIV for CCACdocuments

High Nicole DElia 3/1/2011 3/4/2011 In Progress

16

HHS Cloud Computing

Implementation andGovernance Draft v0.2.1

Read Alternative Analysis draft and provide


High Committee

Members

3/1/2011 3/4/2011 In Progress

17HHS Cloud Computing RFI

Draft v0.1.2

Read RFI draft and provide


High Committee

Members

3/1/2011 3/4/2011 In Progress

0030


23/185


ID OPDIV/Department

Action Item Description PriorityLevel


DateDue

DateComplete

PercentComplete

Progress Notes

18Confirm Workgroup

Timelines

Send email to Earl Baum to confirm the

timeline for each workgroup

High Earl Baum 3/1/2011

0031

I


24/185





ACF James Fu X NIH Adriane Burton X

ACF Jim Tyson NIH Darrick Akiyama X

AHRQ Tim Erny X NIH Debbie Bucci X

AoA Sue Banning OCIO Timothy Mitchell X

CDC Jaspal Sagoo OCIO Celine Neves

CDC Terry Boyd PSC Dwayne Rollins X

CDC Earl W. Baum X PSC/CTR Ali Bilgrami X

CMS Sherry Wilke SAMHSA James R. Walters X

CMS Doug C. Margush X EA/OCIO/CTR KumarRadhakrishnan

CMS Daniel Lazenby X CDC Michelle Hines X

FDA Michael Coene CDC Jay Burton


IHS Mark Rives X CDC Ginny Howard X




Welcome/Opening Remarks- Earl Baum, CDC

SharePoint site now has three additional documents for the committeeto review

We are also working on RFQ documents which will be shared with thecommittee shortly

Action Items:

Review and comment on draft documents by March 29th HHS Cloud Computing RFI Draft v0.1.3 RACI Document Draft v 9 Role of an IT Infrastructure Critical Partner v0.9.8

Approval of 3-1-2011 Minutes- Earl Baum, CDC

Minutes were reviewed by the committee and approved as is

Alternative Analysis and SupportingProcesses / CTO Council Update

- Earl Baum, CDC

We have been focusing our efforts on infrastructure elements

There will be additional work involved and there are questions on wheregovernance is going

Please take the governance document and EPLC IT Infrastructuredocument out to your people to get feedback

We want to make sure we are capturing the right level of detail

Jaspal presented the Governance and Implementation document to theCTO Council

0032


25/185



Received mostly positive responses, with 2 exceptions Security Comments: the document is being too restrictive at

this point for what can go to the cloud

Check with your local CISOs and ask for feedback Want to achieve a consensus

Maybe add caveat to the document OPDIVs can bemore restrictive than what we proscribe, but cannot beless restrictive than this document

NIH Comments: regarded the level of effort/work/moneyrequired to implement

We acknowledge there is additional work, trying tominimize this to the extent possible, but still need tomake sure we capture enough information

Working on trying to make sure the right people/SMEsare doing this work

Funding will continue to be an issue until Congress

changes appropriations language, but this is amandate, we have to consider Cloud First

Action Items:

Nicole will send out the CTO Council comments on the Governanceand Implementation Document

Committee members need to review the comments and theGovernance Document with their CISOs and other relevant members ofyour organization

Data Call- Earl Baum, CDC

Asking each OPDIV for feedback on existing contract vehicles (thatinclude cloud services), the COTR, and POC (both on the vendor sideand on the procurement side)


Looking for both development vehicles and service vehicles, not limited

to cloud hosting providers If you are able to support other OPDIVs on the contract vehicles, make

note of that as well

Action Items:

Data Call needs to be answered by EOW

Market Research Briefings withVendors

- Earl Baum, CDC

Propos

Committee agreed on having 2 presentations per call during existing

CCAC meetings 40 minutes for each presentation 10 minutes for committee business

Committee reviewed Draft Vendor Questionnaire for IaaS want tomake sure that when vendors provide briefing, it is less marketing andmore services oriented, including their rate cards

Additional questions were added to the Security portion of theQuestionnaire, including:

Has the vendor already gone through FedRAMP A&A

0033


26/185



and at what level? TIC

Intrusions, Detections

Monitoring health and well-being of the systems from

both SLA and reporting standpoint as well as who hasaccess to those tools/logs and at what level?

HIPPA

2 factor authentication under IAM

Action Items:

If committee members already have representatives for any of thesevendors, please send contact information to Earl, Jaspal, and Nicole

Once the updated Vendor Questionnaire is ready, committee needs toreview for completeness

Then similar questionnaires will be produced for PaaS andSaaS

Jaspal and Earl will begin scheduling these vendor presentations

Work Plan and Timeline Overview- Earl Baum, CDC & WorkgroupLeads

Deliverable A0 Customer Requirements Development Lead: Earl Baum

Ongoing; tied to EPLC ITI Critical Partner documents

Deliverable should be complete and pending review EOMMarch

Customer Requirements documents; RFI; RFQ


Lead: Sherry Wilke / Doug Margush

Meeting this afternoon with Earl to discuss status

Will tie back to Governance and Implementation document

May need to push back April 1st

deadline

Deliverable B0 Services, Costs, Contracts Ginny Howard, Terry Boyd Lead: not determined

Should be able to complete by April 1

Changed to fit SIMs contract (CDC specific)

Get the draft RFQs to Ginny this week

RFQ is driven by what the government needs specifically

Let us know if we are way off base

Number of contracts will be between 1 and many

There are questions that have to be asked strategy wise atHHS level and OPDIV level

What services do we actually want to implement, how do we

pay for it? TBD


Lead: Kumar Radhakrishnan

Earl will follow-up with Kumar and team; begin tying NIH intothis

Deliverable F0 Solution Implementation

Lead: Terry Boyd

Looking at 5/1/2011 for the Transition Plan

0034


27/185




Looking for specific template and guidance information

Security Jay Burton commented extensively on the draft that went

to the CTO Council Still reviewing the Critical Partner Documents

Ties GSA FedRAMP A&A into C&A process

Action Items:

Review and comment on draft documents by March 29th

Wrap Up Next Meeting April 5, 2011 9:00 10:30 AM

0035


28/185



ID Action Item Description Priority

Level

Owner/ Lead Date

Assigned

Date

Due

Date

Complete

Percent





High Nicole DElia 1/25/11 3/22/11 100% Complete; this is now a regular part ofthe agenda

2


Model





CDC 1/25/11 In Progress; Jay Burton will be

providing the CISO viewpoint;Transition Plan still needs to befinalized; Addressed as far as the

Alternative Analysis draft document

(just need review and approval)

3Target Service ComponentArchitecture

HHS Federated Data Architecture HHS Federated SOA Catalog

HHS EA 1/25/11 In Progress timeline will be out byMar 4; will be reaching out to NIH as

soon as Transition Plan is finalized

4 Target Technical Architecture Depends on input from the previous steps Unassigned 1/25/11 Not Started Dependent on Item 3

5

Transition Recommendation &Blueprint Document

Depends on input from the previous steps;in holding pattern


Sequence Diagram and Milestones should

be complete within 90 days, to feed intoOMB 120-day guidance

CDC TerryBoyd

1/25/11 In Progress/Holding Pattern initialdrafts are being started, still need a lot

of information

6



Define target business processes and their

performance including organizationalrelationships



Ensure target business and informationarchitecture addresses strategic


CDC? 1/25/11 In Progress ties back to Item 2

7

Defined IT Infrastructure POC Defined individual/group specific to IT

infrastructure within each OPDIV whohandles the alternative analysis; tie to existing

Committee

members needto talk to CTOs

1/25/11 Around

2/1/11

In Progress: Need to have POC for

each OPDIV for coordinationpurposes; dont need to necessarily

0036


29/185


ID Action Item Description PriorityLevel


DateDue

DateComplete

PercentComplete

Progress Notes

EPLC process as well (recommended for

HHS wide) identify consistent POC withineach OPDIV

& CIOs provide name to the CCAC



Governance Document

CDC? 1/25/11 Around2/1/11

In Progress



CDC? 1/25/11 Around

2/1/11

In Progress: Draft is complete

pending review

10Data call for existing contractvehicles and vendors within the

OPDIVs

Data call went out (2/28/2011) High KumarRadhakrishnan

1/25/11 3/25/11 20% In Progress: As information comesback, will compile spreadsheet

11HHS Cloud ComputingImplementation and Governance

Draft v0.1



Medium 2/8/11 2/22/11 100% Complete: See Item 16

12

Workgroup Timeline and Work

Plan




High Workgroup

Leads

2/8/11 2/22/11 0% In Progress: See Item 18

13

Feedback from CIO Council Provide feedback from the CIO Council,

updates on the document; submission to OMB

on February 11th

Medium Jaspal

Sagoo/Earl

Baum

2/8/11 2/22/11 3/1/11 100% Complete

14

Market Vendor Question

Template



Medium Kumar

Radhakrishnan

3/1/11 75% In Progress awaiting additional

feedback from Earl & committee

members; then similar questionnaires

will be developed for PaaS and SaaS

15

CCAC Published Documents

Tracker

Create tracker to log comments, feedback, and

approval for each OPDIV for CCACdocuments

High Nicole DElia 3/1/11 3/4/11 3/8/11 100% Complete and posted to SharePoint

16HHS Cloud ComputingImplementation and GovernanceDraft v0.2.1

Read Alternative Analysis draft and provideinput/comments/questions/errors/omissions

High CommitteeMembers

3/1/11 3/4/11 3/7/11 75% In Progress

17 HHS Cloud Computing RFIDraft v0.1.2

Read RFI draft and provideinput/comments/questions/errors/omissions


3/1/11 3/4/11 3/7/11 100% Complete: See Item 19

18Confirm Workgroup Timelines Send email to Earl Baum to confirm the


High Earl Baum 3/1/11 In Progress

0037


30/185




DateDue

DateComplete

PercentComplete

Progress Notes


Draft v0.1.3


input/comments/feedback

High Committee

Members

3/22/11 3/29/11

20RACI Document Draft v 9 Read RACI drafts and provide

input/comments/feedbackHigh Committee

Members3/22/11 3/29/11

21Role of an IT Infrastructure

Critical Partner v0.9.8

Read Critical Partner draft and provide


High Committee

Members

3/22/11 3/29/11

22CTO Council Comments on theImplementation and Governance

Document

Review these comments and theImplementation and Governance document

with your CISOs


3/22/11 3/31/11

23Vendor Contact Information Send contact information for any vendor

representatives that you are already working

with


3/22/11

24Set up Market VendorPresentations

Begin scheduling these vendor presentations Medium Jaspal Sagoo/Earl Baum

3/22/11

0038


31/185

ITSO 1 of 6 Revision: 7/20/208-CCAC Minutes Apr-05-2011



ACF David Jenkins NIH Steve Bailey X

ACF James Fu NIH Adriane Burton

ACF Jim Tyson NIH Darrick Akiyama X

AHRQ Tim Erny NIH Debbie Bucci X

AoA Sue Banning OCIO Timothy Mitchell

CDC Jaspal Sagoo X PSC Dwayne Rollins

CDC Terry Boyd PSC/CTR Ali Bilgrami

CDC Earl W. Baum X SAMHSA James R. Walters

CMS Sherry Wilke X EA/OCIO/CTR Kumar

Radhakrishnan

X

CMS Doug C. Margush X EA/OCIO/CTR Brian Leitao

CMS Daniel Lazenby EA/OCIO/CTR Robert Patt-Corner

X

CMS Don Bartley X CDC Michelle Hines

FDA Michael Coene X CDC Jay Burton


IHS Mark Rives CDC Ginny Howard X





Approval of 3-22-2011 Minutes

- Jaspal Sagoo, CDC

Action Items:

Review the minutes from 3-22-2011 so we can approve them at thenext meeting If there are any errors/omissions please let Nicole know

Alternative Analysis and SupportingProcesses Update

- Jaspal Sagoo, CDC

We are on a fast track to get the documents we have created approved Want to get all of the committee members comments consolidated

On April 11th, the documents will be sent out to the CTO Council so that

they can vote on the documents at the meeting on the 19th

HHS Cloud Computing Information System Questionnaire v0.2.0 Let us know if there are still any areas that need to be captured This is going to be a living document

HHS Cloud Computing RFI Draft v0.1.3 This is a key artifact we have to have complete so that the

Alternative Analysis can be completed We have refined a lot of the language in this document

0039


32/185



Pass this along to your procurement staff for them to review, ifyou have time

ITI CP RACI Draft v0.9.1

This document was designed to enumerate who hasresponsibility for what Added a column for accountability

Role of an IT infrastructure Architecture Critical Partner v0.9.8 Dont expect a lot of changes to this document, but we are still

adding members to this workgroup

Once the CTO Council approves these documents, they will be passedalong to the CIO Council for approval the following week

Action Items:

Committee members need to review the following documents andprovide comments and feedback by Friday April 8

th:

HHS Cloud Computing Information System Questionnairev0.2.0

HHS Cloud Computing RFI Draft v0.1.3 ITI CP RACI Draft v0.9.1 Role of an IT infrastructure Architecture Critical Partner v0.9.8

Governance Processes Update

- Doug Margush, CMS

Weve gone through a rough draft , and are working on refining beforesending out to the group

The document that was sent to Jaspal and Earl seems to be on target

Missed the 4/1/2011 deadline, but looks like it will be ready to send tothe group before next Tuesday (4/12)

SOA and Data Architecture Update

- Kumar Radhakrisnan,OCIO/EA/CTR

Working through scheduling issues in order to discuss more in depthwith NIH

Should be beginning to nail stuff down over the next week or so


Once we have a complete list, need to send RFI out to the procurement

vehicles Asking each OPDIV for feedback on existing contract vehicles (that

include cloud services), the COTR, and POC (both on the vendor sideand on the procurement side)


Looking for both development vehicles and service vehicles, not limitedto cloud hosting providers

Action Items:

Will be contacting those OPDIVs who have not yet responded to theData Call

Vendor RFIs and Analysis

- Jaspal Sagoo, CDC

The workload for this is going to be quite large

Going to try to stand up a permanent governance council to maintain

this data Will bring up a permanent governing body again at the CTO

Council meeting Rates and services are in constant flux Our information/baseline data may become stale after a month

or two

Baseline will have to be tackled by this committee, to capture existingcontract vehicles

Need to address the number one concern of the CIO Council preventvendor sprawl, want defined boundary of approved vendors

Even getting this baseline is proving to be a large project

0040


33/185



Need some volunteers (2 or 3) to channel this along Coordinate and start working on matrix of vendors and rate

cards

Critical part of the Alternative Analysis IT community needsthis information Send your name to Nicole, if you would like to volunteer If no one volunteers, a lead will be chosen

Once the RFI is ratified, it can be sent to contract offices, who canforward it on to their vendors

CDC sent out a preliminary RFI, which is due back by 4/8, as a litmustest

Will make sure that the RFI is updated based on this litmus test

Action Items:

If you would like to volunteer to be the lead on the RFI analysis, pleasesend an email to Nicole, Jaspal, and Earl

RFI will be updated after CDC litmus test RFI is analyzed

Work Plan and Timeline Overview- Earl Baum, CDC

Looking to tie SOA and Data Architecture into the transition plan byMay

Final transition plan will lag by about a month compared to the otherdeliverables

Built some flexibility into this

How do we assure we get input from every OPDIVs EA/PMO?

Will develop something to send out to the OPDIVs EA, andCPIC offices

Maybe make an announcement to the EA Community

This should be a consideration in the Data Architecture

Action Items:

Reach out to OPDIV EA and CPIC offices regarding the DataArchitecture

Wrap Up Next Meeting April 19, 2011 9:00 10:30 AM

0041


34/185

TSO 4 of 6 Revision: 7/20/201108-CCAC Minutes Apr-05-2011



Level

Owner/ Lead Date

Assigned

Date

Due

Date

Complete

Percent





High Nicole DElia 1/25/11 3/22/11 100% Complete; this is now a regular part ofthe agenda

2


Model





CDC 1/25/11 In Progress; Jay Burton will be

providing the CISO viewpoint;Transition Plan still needs to befinalized; Addressed as far as the



3Target Service ComponentArchitecture

HHS Federated Data Architecture HHS Federated SOA Catalog

HHS EA 1/25/11 In Progress timeline will be out byMar 4; will be reaching out to NIH as

soon as Transition Plan is finalized


5

Transition Recommendation &Blueprint Document

Depends on input from the previous steps;in holding pattern


Sequence Diagram and Milestones should

be complete within 90 days, to feed intoOMB 120-day guidance

CDC TerryBoyd

1/25/11 In Progress/Holding Pattern initialdrafts are being started, still need a lot

of information

6



Define target business processes and their







7

Defined IT Infrastructure POC Defined individual/group specific to IT

infrastructure within each OPDIV whohandles the alternative analysis; tie to existing

Committee

members needto talk to CTOs

1/25/11 Around

2/1/11

In Progress: Need to have POC for

each OPDIV for coordinationpurposes; dont need to necessarily

0042


35/185




DateDue

DateComplete

PercentComplete

Progress Notes

EPLC process as well (recommended for

HHS wide) identify consistent POC withineach OPDIV

& CIOs provide name to the CCAC



Governance Document

CDC? 1/25/11 Around2/1/11

In Progress



CDC? 1/25/11 Around

2/1/11

In Progress: Draft is complete

pending review


OPDIVs

Data call went out (2/28/2011) High KumarRadhakrishnan

1/25/11 3/25/11 75% In Progress: As information comesback, will compile spreadsheet


Draft v0.1




12


Plan




High Workgroup

Leads


13


updates on the document; submission to OMB

on February 11th

Medium Jaspal

Sagoo/Earl

Baum

2/8/11 2/22/11 3/1/11 100% Complete

14

Market Vendor Question

Template



Medium Kumar

Radhakrishnan

3/1/11 75% In Progress awaiting additional

feedback from Earl & committee

members; then similar questionnaires

will be developed for PaaS and SaaS

15


Tracker



High Nicole DElia 3/1/11 3/4/11 3/8/11 100% Complete and posted to SharePoint

16HHS Cloud ComputingImplementation and GovernanceDraft v0.2.1

Read Alternative Analysis draft and provideinput/comments/questions/errors/omissions


3/1/11 3/4/11 3/7/11 75% In Progress

17 HHS Cloud Computing RFIDraft v0.1.2

Read RFI draft and provideinput/comments/questions/errors/omissions


3/1/11 3/4/11 3/7/11 100% Complete: See Item 19




0043


36/185




DateDue

DateComplete

PercentComplete

Progress Notes


Draft v0.1.3



High Committee

Members

3/22/11 3/29/11 3/29/11 100% Updates were made to the Document

Comment Tracker on SharePoint

20RACI Document Draft v 9 Read RACI drafts and provide

input/comments/feedbackHigh Committee

Members3/22/11 3/29/11 3/29/11 100% Updates were made to the Document


21Role of an IT Infrastructure

Critical Partner v0.9.8

Read Critical Partner draft and provide


High Committee

Members

3/22/11 3/29/11 3/29/11 100% Updates were made to the Document


22CTO Council Comments on theImplementation and Governance

Document

Review these comments and theImplementation and Governance document

with your CISOs


3/22/11 3/31/11 In progress; updates were made to theDocument Comment Tracker on

SharePoint

23Vendor Contact Information Send contact information for any vendor

representatives that you are already working

with


3/22/11



3/22/11

25HHS Cloud ComputingInformation System

Questionnaire v0.2.0Read Questionnaire and provideinput/comments/feedback


4/4/11 4/8/11


Draft v0.1.3 Read RFI draft and provideinput/comments/feedback High CommitteeMembers 4/4/11 4/8/1127

ITI CP RACI Draft v0.9.1 Read RACI drafts and provide


High Committee

Members

4/4/11 4/8/11

28

Role of an IT infrastructure

Architecture Critical Partner

v0.9.8Read Critical Partner draft and provide


High Committee

Members

4/4/11 4/8/11

293-22-2011 Meeting Minutes Review meeting minutes and provide errors

and omissions to NicoleHigh Nicole DElia 4/5/11 4/19/11

30

Vendor RFI Analysis Need two or three committee member to

volunteer to be the lead on creating baseline

matrix of vendors, services, and rate cards

High Jaspal Sagoo 4/5/11

0044


37/185


CCAC Meeting MinutesDate: 4/19/2011Time: 9:00 10:30 AMLocation: 502H Humphrey, Phone


ACF David Jenkins NIH Darrick Akiyama X

ACF Gary Cochran Present NIH Debbie Bucci Present

ACF James Fu Present NIH Steve Thornton X

ACF Jim Tyson OCIO Mary Forbes X

AHRQ Tim Erny X OCIO Timothy Mitchell X

AoA Sue Banning X PSC Dwayne Rollins X

CDC Jaspal Sagoo Present PSC/CTR Ali Bilgrami X

CDC Terry Boyd PSC/CTR DeniseUnderwood

X

CDC Earl W. Baum X PSC Ellen Vizzini X

CMS Sherry Wilke X SAMHSA James R. Walters X

CMS Doug C. Margush X HHS/ASPA Richard Stapleton

CMS Daniel Lazenby HHS/ASPA Craig Lafond X

CMS Don Bartley EA/OCIO/CTR KumarRadhakrishnan

Present

CMS Bryce Golwalla EA/OCIO/CTR Robert Patt-Corner

Present

FDA Michael Coene X EA/OCIO/CTR Brian Leitao X

IHS Bernie Dailleboust CDC Michelle Hines XIHS Mark Rives CDC Jay Burton X

NIH Steve Bailey X CDC Charles Martin X

NIH Adriane Burton X CDC Ginny Howard X





Approval of 3-22-2011 and 4-05-2011Minutes

- Jaspal Sagoo, CDC

Minutes were approved for the March 22nd and April 5th meetings.

Action Items:

Email Nicole if you have any questions/comments/errors/omissions forthe minutes

Alternative Analysis and SupportingProcesses / CTO Council Update

Going to try to get these four documents approved by the CTO Councillater today:

0045


38/185



- Jaspal Sagoo, CDC HHS Cloud Computing Information System Questionnaire v1.0 HHS Cloud Computing RFI v1.0 ITI CP RACI Draft v1.0

Role of an IT infrastructure Architecture Critical Partner v1.0 They will be living documents, but we need to freeze them in time for

now with the understanding that we will make additional updates asnecessary based on continued feedback and comments

Process for amending approved documents will be discussedat todays CTO Council meeting.

Programs are waiting for the Alternatives Analysis and Guidance

Governance document comments (this document was alreadyapproved by the CTO Council)

We are addressing a mandate up to the individualorganization to determine whether to use cloud, based oncriteria and the EPLC process

We have tidied up some security language FedRAMP simplifies the A&A/C&A, does not replace it

Role of an IT infrastructure Architecture Critical Partner v1.0 This critical partner is very narrowly defined Will be reviewing with CPIC staff to incorporate other existing

critical partners into this documentation James Walters (SAMHSA) who will fill this role for the smaller

OPDIVs that are supported by the ITIO? In general whichever organization supports your IT should be

taking on this role As more programs adopt the EPLC, more stage gates Required to do the Alternatives Analysis burden will fall on

the IT Critical Partner, but should already be gathering most ofthis information

Trying to develop a more streamlined process If a small OPDIV does a program outside of ITIO, then there is

a void only certain programs have followed to EPLC processso far.

We are developing a workflow with swim lanes on how to conduct theAlternative Analysis, which will show roles

Should be ready for distribution in 1-2 weeks

HHS Cloud Computing Information System Questionnaire v1.0 Purpose is to be incorporated in the EPLC process, adding

cloud computing questions

Cloud Alternatives Analysis will be wrapped into the Critical Partner role(IT Infrastructure CP)

There are two Alternatives Analysis processes: CPIC AlternativesAnalysis and now Cloud Alternatives Analysis (triggered first)

Will be changes to the EPLC process going forward Need to meet with the EPLC group

Action Items:

No Action Items

Governance Processes Update

- Doug Margush, CMS

We have a draft for the Governance Process

It is now posted on SharePoint for the committee to view and providecomments (in the Documents for Review folder)

The governance process will be too much work for this body, but iscritical to the implementation of cloud going forward

0046


39/185



Action Items:

Please review the Governance Process draft and provide commentsand feedback before May 3rd

SOA and Data Architecture Update

- Kumar Radhakrisnan,OCIO/EA/CTR

Working on pulling necessary documents together Have been simultaneously working on the HHS Cloud Computing

Strategy, trying to divide up time equally

Will be going through documents from NIH

Will provide an update by the end of the week

Action Items:

No Action Items


Data Call is almost complete

Still waiting on HRSA and ACF

Once the RFI is ratified, will reach out to these vendors and contractingoffices

Action Items:

Please respond to the Data Call if your OPDIV has not already done so

Vendor RFIs and Analysis

- Group 1: Michael Coene, FDA;Bernie Dailleboust & Mark Rives, IHS

- Group 2: David Jenkins, James Fu,& Jim Tyson, ACF; Tim Erny, AHRQ;Sue Banning, AoA

Were developing the tasks for the two groups now

Will take the RFI to contract vehicles, work with the contract officers

Reach out to vendors; they may come back asking additional clarifyingquestions

End result should be a fairly clear, vetted list of vendors

Required to have completed FedRAMP and submit rate cards forstandard services

Will still have to go through new procurement cycle

Cannot exclude a vendor if they did not answer the RFI, if already havea contract with them

Can get around this issue by issuing a BPA, but this path could limit

options going forward Similar vendors may be on multiple contract vehicles

Need to consider what meets the requirements as well as whats thepath of least resistance.

Action Items:

Set up a conference call for the two workgroups

Review initial RFI analysis from CIMS responses

Work Plan and Timeline Overview- Earl Baum, CDC

Still looking at completing all outstanding draft documents by the end ofMay

Looks like there is sufficient governance to at least generate keymilestones

High level architecture to map out long-term Transition Plan

Still in the May timeframe

Once everything else is complete, 30 days later the Transition Planshould be complete

Need to circle back to the HHS Cloud Computing Strategy

Nothing has really been done yet on the CCAC side

Shared Services and Cloud Computing Architecture is coming out fromScott Bernard (OMB) probably around June or July

Will probably be akin to the LOB work that has been done in

0047


40/185



the past

We are at a more detail level here

Action Items:

No Action Items

Wrap Up Next Meeting May 3, 2011 9:00 10:30 AM

Action Items:

Please let Nicole know if you are having any issues accessing thedocuments on SharePoint

Review the Action Item Tracker at the end of the minutes for accuracyand completeness

0048


41/185




Level

Owner/ Lead Date

Assigned

Date

Due

Date

Complete

Percent


2

Target Key Business ProcessModel


Cloud vendor service catalog/rate-sheet

maintenance



CDC 1/25/11 In Progress; Jay Burton will beproviding the CISO viewpoint;

Transition Plan still needs to befinalized; Addressed as far as the



3

Target Service Component

Architecture



HHS EA 1/25/11 In Progress timeline will be out by

Mar 4; will be reaching out to NIH assoon as Transition Plan is finalized


5

Transition Recommendation &

Blueprint Document Depends on input from the previous steps;

in holding pattern Will need to divide the work up

Sequence Diagram and Milestones shouldbe complete within 90 days, to feed into

OMB 120-day guidance

CDC Terry

Boyd

1/25/11 In Progress/Holding Pattern initial

drafts are being started, still need a lotof information

6


Assigning who owns each process Define target business processes and their


Define target data relationships and

business data stewards Define the target information services




7

Defined IT Infrastructure POC Defined individual/group specific to ITinfrastructure within each OPDIV who

handles the alternative analysis; tie to existingEPLC process as well (recommended for

HHS wide) identify consistent POC within

each OPDIV

Committeemembers need

to talk to CTOs& CIOs

1/25/11 Around2/1/11

In Progress: Need to have POC foreach OPDIV for coordination

purposes; dont need to necessarilyprovide name to the CCAC

0049


42/185




DateDue

DateComplete

PercentComplete

Progress Notes

8

Requirements

Definition/Gathering

Timeline for system; tie into EPLC

documentation Draft of this is in theGovernance Document

CDC? 1/25/11 Around

2/1/11

In Progress


OPDIVs

Data call went out (2/28/2011) High Nicole DElia 1/25/11 3/25/11 75% In Progress: As information comesback, will compile spreadsheet

12


Plan




High Workgroup

Leads


14

Market Vendor QuestionTemplate

Starter template of questions for vendorswhen they brief the CCAC

Medium KumarRadhakrishnan

3/1/11 75% In Progress awaiting additionalfeedback from Earl & committee

members; then similar questionnaireswill be developed for PaaS and SaaS






3/22/11 In Progress

30

Vendor RFI Analysis Two workgroups will be responsible for

creating baseline matrix of vendors, services,

and rate cards

High RFI Analysis

Workgroups

4/5/11 Before

5/3/11

Need to set up conference call for the

workgroups to discuss tasks that need

to be completed

31

Governance Process Draft Review Governance Process Draft and

provide


High Committee

Members

4/19/11 5/3/11

32RFI Analysis from CIMSContract Responses

Review the analysis on the CIMS contractvendor responses to the RFI document


4/19/11 5/3/11

33

Action Item Tracker Review Action Item Tracker at end of minutes

for accuracy and completeness; send

updates/corrections to Nicole

High Nicole DElia 4/19/11 5/3/11

0050


43/185


CompletedAction Items:


Level

Owner/ Lead Date

Assigned

Date

Due

Date

Complete

Percent


1

CCAC Minutes Need to get minutes out on time for review;

need to approve minutes as first order ofbusiness in future meetings

High Nicole DElia 1/25/11 3/22/11 100% Complete; this is now a regular part of

the agenda



CDC? 1/25/11 Around

2/1/11

100% Complete


Draft v0.1




13


updates on the document; submission to OMBon February 11th

Medium Jaspal

Sagoo/EarlBaum

2/8/11 2/22/11 3/1/11 100% Complete

15


Tracker



High Nicole DE