Federal Information Technology
Acquisition Reform Act
Implementation Plan and
Chief Information Officer Assignment
Plan
December 18, 2015
V 1.1.1

-------
Revision Table
Version
Date
Comments
1.0
August 14, 2015
Original Submission
1.1
November 14. 2015
Address OMB Comments
1.1.1
December 18, 2015
Address OMB to clarify
participation in pre-Exhibit 100
portfolio reviews

-------
1 Executive Summary
The Environmental Protection Agency (EPA) is pleased to present its plan to implement the
Office of Management and Budget (OMB) Common Baseline Controls for the Federal Information
Technology Acquisition Reform Act (FITARA).
Soon after OMB's initial release of a draft Common Baseline, EPA recognized that FITARA posed
a game changer for IT management. EPA established an interim Chief Information Office (CIO) IT
acquisition review process that has provided many valuable lessons learned as to both what FITARA can
accomplish and how we can incorporate existing practices into the implementation. EPA also leveraged
outcomes from previously initiated projects that had implications for FITARA, particularly with regard to
IT skill sets. We hosted conversations between program and IT leadership on FITARA requirements and
implementation approaches. And we leveraged resources from GSA's 18F program to start infusing EPA
IT management practices with proven methodologies for rapid delivery of user-focused requirements.
The 17 controls of the Common Baseline are grouped around 3 major themes. These are listed
below, along with EPA's high-level strategy for meeting the objectives of those controls.
Budget Formulation and Planning Controls
The first set of FITARA controls engage the CIO in the budget process to ensure that IT needs are
properly planned and resourced. EPA has several practices in play that support our ability to meet these
controls, including a unique "Exhibit 100" Capital Planning and Investment Control (CPIC) process that
gathers BY IT investment budget estimates in the second quarter of the fiscal year, and an IT coding
scheme that identifies all IT budget items in the IT Portfolio (formerly the Exhibit 53). To fully meet the
spirit of these controls, EPA will introduce "pre-Exhibit 100" portfolio reviews with the Programs and
Regions to ensure the CIO has sufficiently in-depth knowledge of IT system purpose, roadmaps, and
plans to ensure they are resourced correctly in the budget submission.
Acquisition and Execution Controls
This set of controls establishes solid communication and engages the CIO with the programs and
regions to ensure that their IT plans are well designed, directly drive agency strategic objectives, and
follow best practices. The "pre-Exhibit 100 reviews" listed above will also support these controls. In
addition, EPA will build on the interim acquisition review processes already put in place to update and
synchronize our CPIC, System Life Cycle Management (SLCM), and acquisition review processes around
the objectives of these controls.
Organization and Workforce Controls
This set of controls engages the CIO more heavily with key IT decision-makers across EPA and
engenders plans to refresh IT skills within OEI and across programs and regions. In this section, EPA
names its "Bureau" ClOs and provides plans to onboard permanent employees with needed IT skills as
well as to create a constant refresh of IT best practices and ideas via a two-year Fellowship program.
EPA looks forward to working with OMB to perfect and implement this plan.

-------
Table of Contents
1	Executive Summary	
2	Introduction	
3	EPA FITARA Implementation Plan	
3.1	Budget Formulation and Planning Controls	
3.1.1	How Current EPA Practices Support these Controls	
3.1.2	Actions to complete implementation	
3.1.3	Milestones	
3.2	Acquisition and Execution Controls	
3.2.1	How Current EPA Practices support these controls	
3.2.2	Actions to Complete Implementation	
3.2.3	Milestones	
3.3	Organization and Workforce Controls	
3.3.1	How Current EPA Practices Support These Controls	
3.3.2	Actions to Complete Implementation	
3.3.3	Milestones	
3.4	CIO Assignment Plan	
Appendix A - Questions Addressed During Interim FITARA Reviews	
Appendix B - Bureau CIO List	
Appendix C - Policies and Guidance Documents that May be Updated as Part of FITARA
Appendix D - Acronyms	
.. 1
..4
...4
..5
..6
..7
...9
11
12
14
.16
17
18
20
.22
24
25
28
29
ii

-------
2 Introduction
The Environmental Protection Agency (EPA) is pleased to present its plan to implement the OMB
controls for the Federal Information Technology Acquisition Reform Act (FITARA). This plan incorporates
lessons learned from practices put in place since the first draft Common Baseline was published,
developments from initiatives that started before FITARA was enacted, and ideas developed in
consultation with agency staff and leadership over the past several months.
Incorporating Lessons Learned
EPA implementation efforts are already underway, specifically with regard to requirements that
the Chief Information Officer (CIO) approve Information Technology (IT) acquisitions. The CIO started
conducting acquisition reviews in April 2015, and these reviews have been such a valuable source of
lessons learned that EPA has identified several specific objectives of its own for the FITARA
implementation. These include:
•	Avoiding vendor lock-in by letting contracts with multiple vendors or confining the scope of
the contract to a limited task
•	Driving down out-year operations and maintenance (O&M) costs
•	Ensuring use of Agile development methodologies
•	Ensuring ease of migration from aging technology platforms
•	Avoiding development of duplicative systems
•	Avoiding development of systems available via Commercial off the Shelf Services (COTS)
•	Ensuring proper leveraging of shared services and SharePoint platforms
•	Developing acquisition vehicles that support the agency in the objectives listed above
Incorporating Developments from New Initiatives
While FITARA offers powerful tools for helping EPA achieve these objectives, other initiatives
over the past two years have helped lay the groundwork for our plans.
Ongoing conversations between the EPA Office of Environmental Information (OEI) and its
customer organizations have driven plans for a significant reorganization of OEI. This reorganization
plan focuses on improving delivery of IT services and has tactical outcomes directly related to FITARA
controls concerning the upkeep of IT skill sets. Relatedly, early retirement plans enacted at EPA in FY14-
15 allowed all EPA programs, including OEI, to identify their priorities for modernizing skill sets to meet
current mission requirements.
To round out EPA's preparatory actions for implementing FITARA, we have appointed a new
Chief Technology Officer (CTO) from GSA's 18F program. This individual brings an invaluable track
record in establishing Agile technology and acquisition practices, and has already started bringing them
to play in major EPA IT projects.
1

-------
Incorporating Input from Agency Leadership
EPA recognized from the outset that FITARA would be a significant game changer in IT
management. While FITARA was enacted specifically to empower ClOs to be more accountable for
agency IT planning and spending, EPA's approach to developing this plan extended well beyond the CIO
staff. When the initial OMB draft baseline was published in early 2015, OEI initiated discussions with the
CFO, the CAO, and the EPA programs and regions to familiarize them with the requirements and to elicit
opinions for implementation. We have held several discussions with agency leadership and IT staff as to
what gaps exist and what processes should be implemented to address them. We have also had candid
conversations as to the impact on current operations. The ClO's position during these discussions has
sought to seek balance between achieving the objectives described above and maximizing re-use of
existing processes so that EPA can implement FITARA with minimal burden added to our programs and
regions as they pursue our mission.
EPA Organization and Impact on FITARA Implementation
For purposes of understanding this plan, it is worthwhile to take a few moments to address
some key points about the organization of EPA and how IT fits into that organization.
EPA is an independent agency, and has no "bureaus" per se. However, the primary
organizational structures of the EPA that could be considered equivalent to bureaus are:
•	Program Offices. These offices, located mostly in DC Headquarters (HQ), are organized
around the key mission areas of EPA (Air, Water, Solid Waste and Emergency Response,
Pesticides, Compliance) as well as around EPA business needs - (Chief Financial Officer,
General Counsel, Administration, and OEI). From an IT management perspective, it is
important to note that many of the Program Offices maintain enterprise mission IT systems,
but that OEI provides basic IT infrastructure and services.
•	Regional Offices. EPA includes 10 regional offices, each of which oversees all aspects of key
EPA missions in their jurisdictions. As such, they do not create or maintain enterprise
mission systems. But they do maintain basic IT infrastructure needed to support day to day
work.
While there are some organizational structures (program laboratories located within regions)
that do not fully fall within these categories, the description above is sufficiently clear to show that the
IT responsibilities of the regions are different from the IT responsibilities of the program offices at HQ.
Those differences will be reflected in this implementation plan.
2

-------
Organization of this Plan
Finally, we would like to take a moment to discuss the construction of this plan. The OMB
baseline consists of 17 independent controls, each of which requires a gap analysis and an
implementation plan. While some of these controls can be addressed as stand-alone actions, EPA will
address most of them via one or more of three major FITARA-driven EPA initiatives:
1.	Amending the CPIC process to include ClO-led pre-Exhibit 100 portfolio reviews in the
programs and regions.
2.	Revising the acquisition process to include CIO involvement in IT acquisitions
3.	Reorganizing OEI to include adoption of a Digital Services consulting team
Because the FITARA implementation is reliant on these major changes, the plan will be
presented in thematic groups of controls rather than on a control-by-control basis. The plan is
organized along the same groupings (Budget Formulation and Planning Controls, Acquisition and
Execution Controls, Organization and Workforce Controls) that are provided in the OMB template for
the Self-Assessment plan. Within each of these sections, the plan presents the OMB controls,
documents existing practices that support those controls, describes actions needed to complete
implementation of the controls, and provides a table of milestones for doing so. Within this construct,
the plan also makes a point of documenting how larger actions map back to specific controls to allow for
traceability.
With these comments, EPA is pleased to present its FITARA Implementation Plan.
3

-------
3 EPA FITARA Implementation Plan
3.1 Budget Formulation and Planning Controls
The first set of FITARA controls engage the CIO in the budget process to ensure that IT needs are
properly planned and resourced. The budget formulation process at EPA is a distributed process. EPA
hosts budget planning conferences in May and June that result in a set of guidance and targets issued by
the Office of the Chief Financial Officer (OCFO) in July. Each program and region then updates its budget
submission numbers in the Budget Automation System (BAS) to roll up into the overall budget. IT
resources are encoded within the budget numbers to provide information as to system size, lifecycle
stage, and other specifics that are consistent with the capital planning and investment control (CPIC)
process. EPA's plan is to build on this process to ensure that the CIO is confident that budget numbers
are based on sound planning, sound estimating, and required visibility.
Table 1 lists the FITARA Budget Formulation and Planning Controls.
Table 1
Budget Formulation and Planning Controls
CIO Responsibility	CXO Responsibility
Al. Visibility of IT resource plans/decisions to CIO. The CFO and
CIO jointly shall define the level of detail with which IT resource
levels are described distinctly from other resources throughout the
planning, programming, and budgeting stages. This should serve as
the primary input into the IT capital planning and investment
control documents submitted with the budget (formerly Exhibits 53
and 300).
A2. Visibility of IT resource
plans/decisions in budget
materials. The CFO and CIO
jointly shall define the level of
detail with which IT resource
levels are described as detailed
in Al.
B 1. CIO role in pre-budget submission for programs that include IT
and overall portfolio. The agency head shall ensure the agency-
wide budget development process includes the CFO, CAO, and CIO
in the planning, programming, and budgeting stages for programs
that include IT resources (not just programs that are primarily IT
oriented). The agency head, in consultation with the CFO, CIO, and
program leadership, shall define the processes by that program
leadership works with the CIO to plan an overall portfolio of IT
resources that achieve program and business objectives and to
develop sound estimates of the necessary IT resources for
accomplishing those objectives.
B2. CIO role in pre-budget
submission for programs that
include IT and overall portfolio.
The agency head shall ensure
the agency-wide budget
development process includes
the CFO, CAO, and CIO as
described in B 1 and that CIO
guidelines are applied to the
planning of all IT resources
during budget formulation. The
CFO and program leadership
shall work jointly with the CIO to
establish the processes and
definitions described in B 1.
4

-------
CIO Responsibility
CXO Responsibility
C.l. CIO role in planning program management. The CIO shall be
included in the internal planning processes for how the agency uses
IT resources to achieve its objectives. The CIO shall approve the IT
components of any plans, through a process defined by the agency
head that balances IT investments with other uses of agency
funding. This includes CIO involvement with planning for IT
resources at all points in their lifecycle, including operations and
disposition or migration.
Dl. CIO reviews and approves major IT investment portion of
budget request. Agency budget justification materials in their initial
budget submission to OMB shall include a statement that affirms:
•	the CIO has reviewed and approves the major IT investments
portion of this budget request;
•	the CFO and CIO jointly affirm that the CIO had a significant role in
reviewing planned IT support for major program objectives and
significant increases and decreases in IT resources; and
•	the IT Portfolio (formerly Exhibit 53) includes appropriate
estimates of all IT resources included in the budget request.
3.1.1 How Current EPA Practices Support these Controls
EPA already has several practices in place that will help address this set of controls:
1.	EPA has a unique CPIC process which requires iterative builds on the CPIC documentation.
In the second quarter of the fiscal year, all CPIC owners, major and non-major, are required
to submit in CPIC an "Exhibit 100" entry. This entry provides their first estimate of their BY
submission numbers. It also provides basic information on any new investments that will be
introduced to the CPIC portfolio. This provides the CIO and the Information Investment
Review Board (IIRB) an early look at proposed IT budget estimates for CPIC investments.
During the third quarter, owners of CPIC major and CPIC medium investments submit an
"Exhibit 200" investment update, which provides project management and milestone
updates on projects. These processes help conduct a progressive build on the OMB Exhibit
300 updates that are submitted annually as part of the budget submission.
2.	The CIO participates in May and June budget conferences, and can provide input to the
budget memo that OCFO issues to provide final guidance to programs. This guidance can
request specific data concerning IT numbers in the submission.
3.	EPA has an IT coding structure that is used to identify all line items in BAS that will be
incorporated into the IT Portfolio Summary (formerly known as the Exhibit 53). The IT
Portfolio Summary is inclusive of costs for CPIC investments, non-CPIC applications, and
Working Capital fund infrastructure provisioning.
4.	The EPA Office of Acquisition Management (OAM) also conducts annual data calls on
projected acquisitions (IT and non-IT).
C2. CIO role in program
management. CIO, CFO, and
program leadership shall define
an agency-wide process by that
the CIO shall advise on all
planning described in C I.
D2. CIO and CFO Certify IT
Portfolio. The CFO shall work
with the CIO to establish the
affirmations in Dl.
5

-------
3.1.2 Actions to complete implementation
While the EPA CIO has several opportunities to review budget estimates and numbers over the
course of the year, in order to fully meet the objectives of these controls, EPA will introduce new
practices to ensure that the CIO is sufficiently engaged with IT planning in the programs and the regions
to have meaningful understanding of their IT and IT resource requirements.
Starting in FY16Q1, the CIO will meet with program offices, the CFO, and the CAO to conduct a
"pre-Exhibit 100" review of the mission portfolios. These reviews will assess the CPIC and application
portfolios of each program, or the infrastructure portfolios of the regions to allow the CIO to engage
meaningfully in both the strategic planning and the accompanying resource estimating to support those
plans. They will include designates from the CFO and CAO. As alluded to in the Introduction, these
program reviews will be sufficiently robust that they will inform EPAs response to budget planning
controls, other controls as called out throughout the rest of this document, and pertinent PortfolioStat
or GAO audit findings. As such, these reviews will be referred to in subsequent sections of this report to
address how they will meet additional controls.
Table 2 below shows the controls that will be addressed and the meeting outcomes that will
address controls related Budget Formulation and Planning.
Table 2
Objectives of the "pre-Exhibit 100 review"
Control
Meeting outcome
A. Visibility of IT
resource
plans/decisions to
the CIO
Based on the outcomes of discussions related to Controls B and C, (as well as to
other controls addressed throughout this document), the CIO will be able to
identify specific areas of visibility required for IT during the budget planning
processes.
B.	CIO Role in pre-
budget submission
for programs that
include IT and
overall Portfolio; &
C.	CIO role in planning
program
management.
The CIO will review the entire portfolio of CPIC investments and applications for
each program to understand the business need met, lifecycle phase, strategies for
development/maintenance in the BY, and resources required to meet those
objectives. The CIO will provide input into each of these and suggest alternative
strategies if applicable. If necessary, the CIO will schedule follow-up discussions to
assess feasibility of those alternatives and revised resource estimates. As
necessary, output of these meetings will feed the instructions for the Exhibit 100
data call.
D. CIO reviews and
approves Major IT
investment portion
of the budget
request.
The outcome of these meetings, combined with final review processes developed
in conjunction with the CFO, will provide the CIO with the ability to make the
required affirmations starting with the BY18 cycle.
EPA will merge the outcomes of the controls listed in Table 2 with the annual budget
formulation cycle. Table 3 shows how the CIO will use this data during the budget formulation and
submission processes.
6

-------
Table 3
Integration of CIO into the IT Budget Approval process
Timeframe
Action
October - December
CIO conducts initial batch of pre-Exhibit 100 portfolio reviews. This includes a
review of each program/region's:
•	Infrastructure/investments, to include review investment purpose,
performance metrics, annual budget, projected end date, history of
TechStat or FITARA reviews, and drivers for change that affect
strategic planning and budget formulation
•	Organization and governance topics
•	Upcoming acquisitions
January
CIO issues Exhibit 100 data call with updated input based on pre-Exhibit 100
portfolio reviews conducted to date; results due in February
January - March
CIO completes pre-Exhibit 100 portfolio reviews.
April
EPA receives OMB planning targets
May-June
EPA holds budget planning discussions. CIO brings results of pre-Exhibit 100
portfolio reviews as well as data from the Exhibit 100 data call to discuss IT
budget needs.
June-July
CFO issues Final Agency Targets Guidance to agency for building budget
submission. CIO reviews and approves instructions with regard to the IT
portion of the guidance.
August
CIO and CFO conduct joint review of the IT portion of the budget submission.
September
CIO participates in the final budget review with CFO and Deputy
Administrator; signs affirmations required by OMB for FITARA.
3.1.3 Milestones
Table 4 provides EPA's key milestones for coming into compliance with these controls.
Table 4
Budget Formulation and Planning Milestones
Date
Milestone
9/30/2015
Conduct pilot pre-Exhibit 100 reviews for 1 program office and 1 regional office. Use
results to develop briefing templates and preparation SOPs for subsequent reviews. Part
of the outcome of these pilots should be to synchronize information requirements with
those of OCFO and CAO to reduce duplicative data calls on programs.
11/30/2015
Complete at least 3 additional Program and 3 additional regional pre-Exhibit 100 reviews
7

-------
Date
Milestone
12/31/2015
As a result of pre-Exhibit 100 reviews completed to date:
~	Document revised instructions for the Exhibit 100 data call
~	Document any requirements for visibility of IT resource planning
~	Document any final revisions to the templates and standard operating
procedures required to meet the objectives of Controls B and C
~	Document a Standard Operating Procedure for these reviews with swim lanes
for all affected programs and stakeholders
3/31/2016
Complete the remaining program and regional reviews. EPA envisions that the first year
will require at least 2 quarters to complete these reviews, but that in subsequent years
we may be able to streamline the schedule.
8

-------
3.2 Acquisition and Execution Controls
EPA envisions that this set of controls will more heavily engage the CIO with the programs and
regions to ensure that their IT plans are well designed, directly drive agency strategic objectives, and
follow best practices. As noted in the previous section, the "pre-Exhibit 100 reviews" will be key to
addressing these objectives. In addition, EPA will build on the interim acquisition review processes
already put in place to update and synchronize our CPIC, SLCM, and acquisition review processes.
Table 5 lists the Acquisition and Execution Controls
Table 5
Acquisition and Execution Controls
CIO Controls
CXO Controls
El. Ongoing CIO engagement with program managers. The CIO
should establish and maintain a process to regularly engage with
program managers to evaluate IT resources supporting each agency
strategic objective. It should be the CIO and program managers'
shared responsibility to ensure that legacy and on-going IT
investments are appropriately delivering customer value and
meeting the business objectives of programs.
E2. Ongoing CIO engagement
with program managers.
Program managers shall work
with the CIO to define IT
performance metrics and
strategies to support fulfillment
of agency strategic objectives
defined in the agency's strategic
plan.
Fl. Visibility of IT planned expenditure reporting to CIO. The CFO,
CAO and CIO should define agency-wide policy for the level of detail
of planned expenditure reporting for all transactions that include IT
resources.
F2. Visibility of IT planned
expenditure reporting to CIO.
The CFO, CAO and CIO shall
define agency-wide policy for
the level of detail of planned
expenditure reporting for all
transactions that include IT
resources.
Gl. CIO defines IT processes and policies. The CIO defines the
development processes, milestones, review gates, and the overall
policies for all capital planning, enterprise architecture, and project
management and reporting for IT resources. At a minimum, these
processes shall ensure that the CIO certifies that IT resources are
adequately implementing incremental development (as defined in
the below definitions). The CIO should ensure that such processes
and policies address each category of IT resources appropriately—
for example, it may not be appropriate to apply the same process or
policy to highly customized mission-specific applications and back
office enterprise IT systems depending on the agency environment.
These policies shall be posted publicly at agency.gov/digitalstrategy,
included as a downloadable dataset in the agency's Public Data
Listing, and shared with OMB through the IDC.
[None]
9

-------
CIO Controls
CXO Controls
HI. CIO role on program governance boards. In order to ensure
early matching of appropriate IT with program objectives, the CIO
shall be a member of governance boards that include IT resources
(including "shadow IT" or "hidden IT"—see definitions), including
bureau Investment Review Boards (IRB). The CIO shall notify OMB
of all governance boards the CIO is a member of and at least
annually update this notification.
H2. Participate with CIO on
governance boards as
appropriate.
II. Shared acquisition and procurement responsibilities. The CIO
reviews all cost estimates of IT related costs and ensures all
acquisition strategies and acquisition plans that include IT apply
adequate incremental development principles (see definitions).
12. Shared acquisition and
procurement responsibilities.
The CAO, in consultation with
the CIO and-where appropriate-
CFO, shall ensure there is an
agency-wide process to ensure
all acquisitions that include any
IT: • are led by personnel with
appropriate federal
certifications; • are reviewed for
opportunities to leverage
acquisition initiatives; • are
supported by cost estimates
that have been reviewed by the
CIO; and • adequately
implement incremental
development.
J1. CIO role in recommending modification, termination, or pause
of IT projects or initiatives. The CIO shall conduct TechStat reviews
or use other applicable performance measurements to evaluate the
use of the IT resources of the agency. The CIO may recommend to
the agency head the modification, pause, or termination of any
acquisition, investment, or activity that includes a significant IT
component based on the ClO's evaluation, within the terms of the
relevant contracts and applicable regulations.
[None]
K 1. CIO review and approval of acquisition strategy and
acquisition plan. Agencies shall not approve an acquisition strategy
or acquisition plan (as described in FAR Part 724) or interagency
agreement (such as those used to support purchases through
another agency) that includes IT without review and approval by
the agency CIO. For contract actions that contain IT without an
approved acquisition strategy or acquisition plan, the CIO shall
review and approve the action itself. The CIO shall primarily
consider the following factors when reviewing acquisition strategies
and acquisition plans: • Appropriateness of contract type; •
Appropriateness of IT related portions of statement of needs or
statement of work; • Appropriateness of above with respect to the
mission and business objectives supported by the IT strategic plan;
and • Alignment with mission and program objectives in
consultation with program leadership.
K2. CAO is responsible for
ensuring contract actions that
contain IT are consistent with
CIO approved acquisition
strategies and plans. The CAO
shall indicate to the CIO when
planned acquisition strategies
and acquisition plans include IT.
The CAO shall ensure the agency
shall initiate no contract actions
or interagency agreements that
include IT unless they are
reviewed and approved by the
CIO or are consistent with the
acquisition strategy and
acquisition plan previously
approved by the CIO.
10

-------
CIO Controls
CXO Controls
LI. CIO Approval of Reprogramming. The CIO must approve any
movement of funds for IT Resources that requires Congressional
notification.
L.2. CIO Approval of
Reprogramming. The CFO shall
ensure any notifications under
L.l. are provided by the CIO
prior to submission to OMB.
3.2.1 How Current EPA Practices support these controls
Controls E, F, and H are addressed at a very high level via the ClO's participation in IT
governance boards. The CIO is the chair of the Quality Information Council (QIC). The QIC was created
in 1999 as a forum to address enterprise-wide issues and to develop Agency policies to guide EPA
decision makers in the area of information technology/information management. It has four
subcommittees to support its IT governance work, including the IT Investment Review Board (IIRB), on
which the CIO also sits. Through these channels, the CIO gets some insight into IT systems planning, IT
planned spend, and of course, IT governance. The CIO also sits on governance boards for high-visibility IT
projects and initiatives, including e-Enterprise and e-Manifest. The CIO will survey IT leadership to
compile a list of other boards which require CIO membership, whether in person or delegated through
the assignment plan.
OEI is currently reviewing the QIC Charter and subcommittee structure to look for opportunities
modernize the governance objectives and streamline the subcommittee structure. An initial set of
recommendations is targeted for the end of September.
In addition, the IT Portfolio Summary is the baseline document for defining IT Planned
Expenditure reporting to the CIO. The CPIC team creates several views of the IT Portfolio Summary data
for the CIO over the course of the CPIC cycle, including breakdown by program, by CPIC category, and by
O&M/DME.
Control G Requires no further action. Per the EPA delegations manual, the CIO has the authority
to "Establish policies and procedures for the management and security of records, files, data, and
information systems and technology." EPA policies are reviewed periodically for update, and it is worth
noting that two key IT policies, the CPIC policy and the SLCM policy, will be updated and sent into
agency review during 2015. That review will include incorporating FITARA, such as ensuring that the
SLCM policy provides guidance for developing systems with Agile or modular approaches. Also, IT
policies will be posted per FITARA requirements.
Control J. EPA did conduct three TechStat reviews in FY15, all tailored to supporting the
objectives of e-Enterprise. The FITARA Acquisition Reviews and pilot pre-Exhibit 100 reviews conducted
to date have already provided opportunities for the CIO to "modify" project direction on items such as
system acquisition strategies, accelerated deployments, alternative development platforms, and
initiation of next-generation projects. For example, during the pre-acquisition FITARA release process to
review our e-Manifest project, EPA restructured the e-Manifest strategy to bring Agile development
work in-house and to outsource only non-technical work. Using this approach, EPA has met its interim
milestone to build a minimal viable product pilot by September 30.
11

-------
Controls I and K are currently addressed by an interim IT acquisition review process. During Q2
FY15, the CIO issued a data call to understand the landscape of IT acquisitions through the end of the
fiscal year. Based on the responses, the CIO initiated a series of FITARA reviews. Program offices were
asked to submit their SOWs and IGCEs, as well as prepare a briefing with responses to a list of questions
(including questions as to the use of incremental development). (See Appendix A). Based on those
reviews, the CIO issued decisions of with either "Approve" or "Approve with Conditions."
These reviews have been a valuable source of lessons learned for the CIO, and have helped set a
series of objectives for the CIO in implementing FITARA. These objectives include:
•	Avoiding vendor lock-in by letting contracts with multiple vendors or confining the scope of
the contract to a limited task
•	Driving down out-year O&M costs
•	Ensuring use of Agile development methodologies
•	Ensuring ease of migration from aging technology platforms
•	Avoiding development of duplicative systems
•	Avoiding development of systems available via COTS
•	Ensuring proper leveraging of shared services and SharePoint platforms
In addition, EPA has hired a new Chief Technology Officer (CTO) who has started working with
program offices to implement user-focused, agile/modular approaches into system planning. He is
incorporating many of the practices used at the GSA 18F program (https://18f.gsa.gov) and is developing
a plan for institutionalizing these at EPA.
Control L will be incorporated into procedures. However, budget reprogramming actions that
require Congressional notification have been very rare at the EPA.
3.2.2 Actions to Complete Implementation
EPA requires closer coordination between the CIO and the program offices and regions in the
area of IT systems planning and review to meet the objectives of Controls E, F, and J. That closer
coordination is envisioned to begin with the pre-Exhibit 100 reviews introduced in the previous section.
Table 6 indicates the meeting outcomes that will enable the EPA to meet these objectives.
Table 6
Objectives of the "pre-Exhibit 100 review"
Control
Meeting outcome
E. Ongoing
These meetings are envisioned to occur at least annually, with intermittent
engagement
touchbacks as required. In addition, the meetings will include review of proposed
with program
benefits and performance metrics of systems so that the CIO can participate in
managers
"shared responsibility" for delivering customer value and meeting business

objectives.
12

-------
Control
Meeting outcome
F. Visibility of IT
planned
expenditures
As noted with control A, the in-depth portfolio review will inform the CIO and CFO
of areas of visibility required for both IT budget planning and expenditure planning
For example, one area where planned expenditure planning is critical is in our e-
Rulemaking program. This is a shared system funded by users across the Federal
government, but delays in receipt of user fees based on Continuing Resolution or
other factors can hinder EPA's ability to make its planned expenditures on this
contract.
J. CIO role in
Data collected during these reviews concerning budget, schedule, deployment
strategy, or success in delivery of benefits can provide early indicators of systems
that require a deeper TechStat review.
recommending
modification,
termination, or
pause of IT
projects
Regarding Control H, OEI needs to complete its assessment of its own IT governance structure to
evaluate whether it serves the needs of IT customers, and whether it is sufficiently linked to other
program governance boards to provide the CIO with needed awareness and influence in Agency
decisions on IT planning and resources. OEI will complete its review and recommendations during Q1
Regarding Controls I and K, EPA needs to further develop the IT acquisition review process to
engage the CIO earlier in decision process. In the interim process, the CIO has been engaged either
immediately prior to award or prior to the release of the RFP package. The final process will engage the
CIO farther upstream in acquisition decisions in order to better shape the acquisition strategy. In
addition, the CIO will provide tools that help programs and regions introduce more competition in their
programs, make faster awards, and better introduce Agile methodologies into development work where
appropriate. Actions to support this include:
1.	Update and synchronize CPIC, SLCM, and FITARA practices (and policy documents) to ensure CIO
decision points at the following milestones:
a.	Certification of requirement for an IT acquisition. The CIO will review the business
request and determine whether an IT acquisition is required or whether required
capability already exists.
b.	Approval of the Acquisition Strategy. The CIO will review the Acquisition Strategy and
issue a decision to:
i.	Approve strategy without conditions (e.g., no further FITARA review required)
ii.	Approve strategy with conditions (e.g., require a second review prior to release
of the procurement package to vendors)
iii.	Disapprove
2.	Update the SLCM policy documentation to support Agile development processes
3.	Work with Office of Acquisition Management (OAM) to ensure that EPA's acquisition strategy
addresses all elements of interest to the CIO (see Appendix A) and can be easily routed and
reviewed via EPA's Enterprise Acquisition System (EAS). Pilot this process.
4.	Establish under the new CTO Digital Service offerings within OEI, consistent with the US Digital
Services Playbook, that help EPA regions and programs implement modern IT program
management, development, and acquisition practices. This will include:
a.	Project Management and Consulting Services
b.	Technical Architecture and Consulting Services
FY16.
13

-------
c.	Pilot Data Visualization Development Teams
d.	Agile Acquisition Consulting and Acquisition Vehicle Support
Regarding Control J, it is EPA's intention to continue using acquisition reviews and pre-Exhibit
100 reviews to surface significant issues early enough that we can take corrective actions prior to
requiring a TechStat. The questions addressed during acquisition reviews are included in Appendix A,
and include points such as acquisition strategy, agile development, hosting and security, risk, and other
items that could be the point of a modify/terminate decision. In the Pre-Exhibit 100 reviews we gather
data on system benefits and performance metrics and key change drivers that could be relevant to CIO
decisions. The CIO will reserve the right to call for a TechStat review where reviews indicate the need
for a closer look at risk, technical roadmap, or design approach. In addition, EPA is currently revising its
System Lifecycle Management Procedure (see language for controls I and K) to accommodate Agile
systems development. As we move away from waterfall procedures to Agile, EPA will engage
Modify/Terminate decisions in more incremental fashion. For example, a new project may be
incrementally funded to provide a minimum viable product (MVP). Upon review of the MVP, EPA would
determine whether to fund further development, to reassess project direction, or to stop further
funding.
Regarding Control L, EPA needs to ensure a standard operating procedure is in place for these
notifications. The CIO and CFO will work to ensure the proper procedural documents are identified and
updated with the statement "OCFO will require the signature of the EPA CIO on a Congressional
Programming Request document."
3.2.3 Milestones
Table 7 contains the milestones for this task
Table 7
Milestones for Acquisition and Execution Controls
Date
Milestone
9/30/2015
• [Controls E, F, H, J] Complete pilot pre-Exhibit 100 reviews for one program

office and one regional office

• [Control H] Complete initial alternatives analysis for QIC restructuring

• [Controls 1, K] Finalize an IT review template that can be routed through EAS to

support a FITARA review and track any conditions.

• [Controls 1, K] Build an initial e-Manifest minimum viable product working demo

using Agile methods

• [Controls 1, K] Kick off efforts with GSA's 18F program to build an Agile

acquisition vehicle for EPA
14

-------
Date
Milestone
10/30/2015
•	[Control H] Complete assessment of IT governance board structure within OEI.
•	[Controls 1, K] Pilot FITARA review template with an existing project. Pilot
should assess (1) effectiveness of routing structure (e.g., CIO receives the
request during the correct stage of the acquisition process); (2) effective
delivery of needed information to the CIO; (3) effective capture and tracking of
conditions. Capture any needed revisions.
•	[Controls l,K] Complete draft of revised SLCM procedures and guidance to
provide guidance on incorporating Agile and modular approaches into system
life cycle management
•	[Control L] Identify appropriate Standard Operating Procedure (SOP) to review
for obtaining CIO approval on reprogramming
11/30/2015
•	[Controls E, F, H, J] Complete at least 3 additional Program and 3 additional
regional pre-Exhibit 100 reviews
•	[Controls 1, K] Pilot revised FITARA review in EAS
12/31/2015
•	[Controls E, F, H, J] As a result of pre-Exhibit 100 reviews completed to date:
~	Document revised instructions for the Exhibit 100 data call
~	Document any requirements for visibility of IT resource planning
~	Document any final revisions to the templates for the pre-Exhibit 100
reviews
•	[Controls E, F, H, J] Document a Standard Operating Procedure for these
reviews with swim lanes for all affected programs and stakeholders
•	[Controls E, F, H, J] Survey IT leadership to identify governance boards which
require CIO membership, either in person or by delegation through the
assignment plan.
•	[Controls 1, K] Complete updated instructions for completing FITARA reviews in
EAS
•	[Controls 1, K] Pilot an acquisition using the Agile acquisition vehicle
•	[Controls L] Update appropriate SOP for CIO approval of IT funds
reprogramming
15

-------
3.3 Organization and Workforce Controls
EPA envisions this set of controls as key activities the get the CIO more heavily engaged with key
IT decision-makers across EPA as well as to engender a plan to refresh IT skills within OEI and across
programs and regions.
Table 8 lists the Organization and Workforce Controls
Table 8
Organization and Workforce Controls
CIO Control	CXO Control
Ml. CIO approves bureau ClOs. The CIO shall be involved in the
recruitment and shall approve the selection of any new bureau CIO
(includes bureau leadership with CIO duties but not title-see
definitions). The title and responsibilities of current bureau ClOs
may be designated or transferred to other agency personnel by the
agency head or his or her designee as appropriate, and such
decisions may take into consideration recommendations from the
agency CIO.
[None]
N 1. CIO role in ongoing bureau ClOs' evaluations. The CHCO and
CIO shall jointly establish an agency-wide critical element (or
elements) included in all bureau ClOs' performance evaluations. In
cases where the bureau CIO is a member of the Senior Executive
Service and the agency uses the Basic SES Appraisal System, this
critical element(s) is an "agency-specific performance
requirement" in- the Executive
Performance Plan. Each such agency may determine that critical
element(s) (ECQs) contain these requirements. For agencies that
do not use the Basic SES Appraisal System or for bureau ClOs who
are not members of the SES, then these shall be critical elements
in their evaluations.
The [agency] CIO must identity "key bureau ClOs" and provide input
to the rating official for this critical element(s) for at least all "key
bureau ClOs" at the time of the initial summary rating and for any
required progress reviews. The rating official will consider the input
from the [agency] CIO when determining the initial summary rating
and discusses it with the bureau CIO during progress reviews.
N2. CIO role in ongoing bureau
ClOs' evaluations. The CHCO
and CIO shall jointly establish an
agency-wide critical element (or
elements) for the evaluation of
bureau ClOs as described in N 1.
16

-------
CIO Control
CXO Control
01. Bureau IT Leadership Directory. CIO and CHCO will conduct a
survey of bureau ClOs and CIO and CHCO will jointly publish a
dataset identifying all bureau officials with the title or duties of a
CIO. This shall be posted as a public dataset base on instructions in
the IDC by August 15, 2015, and kept up-to-date thereafter. The
report will identify for each:
•	Employee Type (e.g., SES, GS, SL)
•	Career or Appointed
•	Full time or part time
•	Evaluation "rating official"
•	Evaluation "reviewing official" (if used)
•	Whether individual is a "key bureau CIO"
02. Bureau IT Leadership
Directory. CHCO will work with
CIO to develop the Bureau IT
Leadership Directory as
described in 0 1.
PI. IT Workforce. The CIO and CHCO will develop a set of
competency requirements for IT staff, including IT leadership
positions, and develop and maintain a current workforce planning
process to ensure the department/agency can (a) anticipate and
respond to changing mission requirements, (b) maintain workforce
skills in a rapidly developing IT environment, and (c) recruit and
retain the IT talent needed to accomplish the mission.
P2. IT Workforce. CIO and
CHCO-and CAO where relevant-
shall develop a set of
competency requirements for IT
staff, including IT leadership
positions, and develop and
maintain a current workforce
planning process to ensure the
department/agency can (a)
anticipate and respond to
changing mission requirements,
(b) maintain workforce skills in a
rapidly developing IT
environment, and (c) recruit and
retain the IT talent needed to
accomplish the mission.
Ql. CIO reports to Agency Head or Deputy.
N/A
3.3.1 How Current EPA Practices Support These Controls
Controls M, N, and 0: Bureau ClOs. The EPA does not currently employ a Bureau CIO construct.
As noted earlier, Regions maintain their IT infrastructure, and this duty is carried out by individuals with
the title Information Resource Management Branch Chief (IRM BC). Programs do not manage
infrastructure, but to varying degrees they create and maintain enterprise mission IT systems. Within
programs, the responsibility for planning the strategy, budget, and deployment plans for those systems
is varyingly distributed between Senior Information Officers, Information Management Officers, IT
Division Directors, and IT system managers. For purposes of this submission, EPA will name the IRM BCs
as Bureau ClOs. Their names and information are listed in Appendix B and will be published at EPA's
digital strategy site per OMB instructions. EPA also anticipates that as it conducts pre-Exhibit 100
reviews, it may determine whether a single Bureau CIO position could be consolidated within the
Programs. We have consolidated a list of individuals with who have some degree of IT responsibilities in
the Programs, and have included their names as "Candidate Bureau ClOs" in a separate list in the
Appendix B. This list will not be published at the Digital Strategy site.
EPA does not anticipate designating "key" Bureau ClOs at this time.
17

-------
Control P, IT Workforce. During FY14-15, EPA executed an early retirement program (Voluntary
Separation Incentive Payments and Voluntary Early Retirement Authority) to meet budget reductions
and to create targeted changes in its workforce skills set. Each program office and region developed its
own targets according to its particular needs. OEI objectives included moving away from infrastructure
management to information management, increasing skills for information technology project
management and portfolio management, and realigning IT security functions.
During this same period, OEI, which has the bulk of IT staff for the agency, has been examining
its own organizational structure to look for opportunities to improve performance and service delivery
to the EPA. As part of that exercise, OEI documented objectives to improve:
•	IT Service Delivery
•	IT Planning
•	Customer Relationship Management
•	Security
•	Information Management
As part of the reorganization exercise, OEI conducted extensive interviews with its own division
directors to understand the position types and skill sets needed for current operations and service to the
agency. The OEI team is working with the Office of Human Resources (OHR) to develop these
requirements into modernized position descriptions that can be used within OEI and across the agency
to recruit IT staff for current needs.
OEI also envisions developing a Systems Engineering and Project Management Division which
will serve as a Center of Excellence for Agile system engineering and project management, to include
consulting support and training for OEI and agency staff.
EPA has also founded a Project Management Community of Practice. This is a grass-roots
organization open to all employees who have an interest in improving project management skills,
including IT project management. This group includes a training workgroup which is identifying areas of
requested training. EPA staff interested in pursuing professional certifications can also access our FAC-
P/PM intranet resource site at http://oamintra.epa.gov/node/424
Control Q, no action needed. The CIO currently reports to the Administrator.
3.3.2 Actions to Complete Implementation
Controls M and N. EPA has identified its initial list of Bureau ClOs as the IRM BCs. EPA will still
need to implement processes to engage the CIO in the selection of any new IRM BC to fully comply.
Currently, the CIO does not consult on IRM BC appointments. EPA will need to check current personnel
processes f or these positions and amend accordingly.
In addition, EPA still needs to address the requirement for a single performance appraisal
element for all individuals serving in the role of a Bureau CIO. Under the current proposal, it could be
fairly straightforward to develop a uniform standard because the IRM BCs have similar responsibilities.
However, it is prudent to not draft a performance element based solely on the responsibilities of IRM
BCs. The pre-Exhibit 100 portfolio reviews could result in the consolidation of a Bureau CIO position in
18

-------
at least some of the Programs, and those positions would have somewhat different responsibilities than
those of the IRM BCs. The pre-Exhibit 100 process may unearth issues of such significance that the CIO
may want to make them the subject of those performance elements. Thus EPA will use the pre-Exhibit
100 process to determine whether to expand the list of Bureau ClOs and how to structure their
performance objectives. The Bureau CIO list will be updated, if needed, at the first annual update in
2016.
Control P: As part of its efforts to refresh IT skill sets, EPA is taking a three-pronged approach
that combines acquiring permanent OEI staff with modern skill sets, introducing a two-year Fellowship
program that will regularly infuse participating EPA programs with fresh talent and knowledge of
cutting-edge IT practices, and conducting an IT Skillset Workforce Gap Analysis for the agency that will
inform the development of recruiting and training requirements.
Acquisition of permanent OEI staff with modern skill sets. OEI will continue ongoing work with
the Office of Human Resources to create updated position descriptions for IT staff that can be used
across the agency for new recruitments.
Innovation Fellowship. OEI will create a Digital Services consulting team, based on the construct
of GSA's 18F program, to assist program offices with system development and acquisitions. That team
will stand up the EPA Innovation Fellowship program. This will bring in up to 50 experienced Agile and
user-centered practitioners annually to embed in the programs for two-year fellowships. The Digital
Services team will consult with interested programs to assess their particular skill set needs as well as
the work culture so that a suitable candidate can be identified. Participating programs in turn must
agree to abide by a set of values that ensure iterative, user-focused design. The Fellows brought in will
be charged with delivering successful projects and engaging in skill set exchange with the EPA staff. The
two-to-four year refresh ensures that EPA regularly brings in staff with cutting edge practice and
experience. The Fellowship will target specialties such as, but not limited to:
•	Senior Technologists
•	Software Developers
•	User Experience (UX) Designers
•	Product Managers
•	Data Scientists
•	Data Managers
•	Security Specialists
•	Acquisitions specialists
IT Skillset Workforce Gap Analysis. While the updated position descriptions will help OEI meet
its workforce needs, and the Fellowship will impart vital skillsets to programs or regions who elect to
participate, EPA still needs to take steps to evaluate the skillset needs of the Agency as a whole.
This assessment will start in the second quarter of FY16, and will be completed by the end of FY16.
This start date will allow us to leverage several items into the study plan, including:
1. Lessons learned from the Innovation Fellowship. The interviews conducted with the
participating programs will provide some insight into EPA managers' knowledge of the
current IT skillset marketplace.
19

-------
2.	Lessons learned from the OMB IT Workforce Capability Planning Group. This group was
recently convened on the FITARA listserv, and EPA will be participating in those
discussions.
3.	Input from stakeholders, including Bureau ClOs and Unions.
3.3.3 Milestones
Table 9 contains the milestones for meeting the Organization and Workforce Controls
Table 9
Milestones for Organization and Workforce Controls
Date	Milestone
9/30/2015
•	[Controls M and N] Complete pilot pre-Exhibit 100 reviews for one
program office and one regional office
•	[Controls M and N] Identify any existing common performance
elements among IRM BCs
•	[Controls M and N] Identify EPA processes for selecting IRM BCs
•	[Control P] Create the website for the EPA Innovation Fellowship
Program and kick off recruitment efforts
10/30/2015
•	[Controls M and N] Work with OCFO, CAO, and CHCO to identify any
recommended revisions to IRM BC performance elements that might be
needed to support generic Bureau CIO performance elements
•	[Controls M and N] Document revisions needed to processes for
selecting IRM BCs to ensure sign-off by the CIO
•	[Control P] Complete revised draft IT position descriptions
11/30/2015
•	[Controls M and N] Complete 3 additional Program and 3 additional
Regional pre-Exhibit 100 reviews
•	[Controls M and N] Based on pre-Exhibit 100 reviews completed to date,
identify key elements of a generic Bureau CIO performance element.
•	[Control P] Continue coordination between CIO and CHCO to finalize
and sign off on IT position descriptions
•	[Control P] Complete literature review to support an EPA IT Skillset
Workforce Gap Analysis project plan, to include reviews of previous EPA
analyses and review of material provided by Gartner and the OMB IT
Workforce Capability Planning Group.
20

-------
Date
Milestone
12/31/2015
•	[Controls M and N] Work with CHCO and Bureau CIO supervisors to
incorporate into the next performance evaluation cycle
•	[Controls M and N] Update policies to ensure involvement of the CIO in
the selection of IRM BCs and other potential Bureau ClOs
•	[Control P] Continue coordination between CIO and CHCO to finalize
and sign off on IT position descriptions
•	[Control P] Select the first class of candidates for the EPA Innovation
Fellowship program
•	[Control P] Complete initial framework for the EPA IT Skillset Workforce
Gap Analysis Project Plan to include objectives, methodology,
timeframes, stakeholder analysis and engagement plan, and
assumptions/constraints. Begin stakeholder engagement.
2/19/16
• [Control P] Complete Gap Analysis Project plan, taking into account
lessons learned from Fellowship Program and OMB IT Workforce
Planning Capability Group.
3/31/16
• [Control P] Kick off EPA IT Skillset Workforce Gap Analysis Project Plan.
9/30/16
• [Control P] Complete IT Skillset Workforce Gap Analysis.
21

-------
3.4 CIO Assignment Plan
EPA recognizes the need to allocate some FITARA authorities, particularly acquisition
authorities, to personnel outside of the office of the CIO. At present, however, the CIO assignment plan
will remain minimal. OEI is still garnering valuable lessons learned from the interim FITARA acquisition
review processes, and is also using that process to ensure compliance with use of required acquisition
vehicles. Thus EPA will maintain CIO responsibility for even fairly small dollar items in the near term but
then phase increased authority to Programs and Regions by the end of the calendar year.
CIO presence on governance boards is an area that may require future assignment plans, but
will be addressed following the completion of OEI's own revamping of its IT governance board structure.
This re-examination of IT governance, conducted in concert with the FITARA implementation, will cause
EPA to revisit several internal policy and governance documents. An initial list of these documents is
included at Appendix C.
The CIO does not envision assigning out authority related to budget formulation.
The following table summarizes current assignment plans:
Authority	Assigned to	Control
Immediately: Government
purchase of IT hardware or
software under the micro-
purchase limit ($3,500).
Information Management
Officers and IRM BCs
IT procurements via purchase
card are governed by EPA's
purchase card policy. IMOsand
IRM BCs are required to abide
by policies for use of the
purchase card in general and IT
in particular.
By 12/31/15, this dollar
threshold may be increased per
review of FY15 FITARA
acquisition data. Regions and
programs will be required to
include any spend plans in their
pre-Exhibit 100 portfolio
reviews.
Immediately: Contractor
procurement of IT hardware or
software under $10,000.
IRM BCs (in regions) or
Information Management
Officers or Senior Information
Officials (SIOs) in programs,
according to existing practice.
(Designation in the programs
may change as program Bureau
ClOs are identified.)
Programs and regions will
submit quarterly reports on
ODC expenditures.
22

-------
Authority
Assigned to
Control
Immediately: Procurement of
hardware or software via the
Working Capital Fund, including
the PC Purchase service of the
Working Capital Fund
Local authorities for WCF
procurement
The Working Capital Fund board
has agency-wide representation
and comes to agreement on
equipment and services to be
provided at an agreed upon
price. No further review is
required to ensure that
equipment purchased meets
FITARA objectives.
By 12/31/2015: Purchase of IT
hardware procured via EPA's
hardware Indefinite Delivery
Indefinite Quantity (IDIQ)
vehicle and the Emergency
Response Equipment BPA.
IRM BCs (in regions) or Senior
Information Officials (SIOs) in
programs (designation to SIO
may change as office Bureau
ClOs are identified for
programs).
Bureau ClOs will be required to
report these procurements to
OEI. In addition, the pre-Exhibit
100 portfolio reviews will ask
for hardware requirements over
the year, and compare to the
IDIQ so the CIO can understand
any differences between HW
requirements and the
provisions of the IDIQ. The CIO
reserves the right to expand this
authority to any other EPA
acquisition vehicle identified by
OAM.
By 12/31/2015: A list of specific
hardware products and
software license renewals, to be
determined based on analysis of
end-of-2015 IT spending and
FY2016 IT spend plans.
IRM BCs (in regions) or Senior
Information Officials (SIOs) in
programs (designation to SIO
may change as office Bureau
ClOs are identified for
programs).
Approval will be granted up to a
given dollar amount with
flexibility to increase by a given
percent to account for options
for using expiring funds.
Contracting officers will be
provided with these thresholds
to ensure that Bureau ClOs do
not exceed them.
23

-------
Appendix A-Questions Addressed During Interim FITARA Reviews
~	Indicate whether the purpose of the review is to approve a pending award or to approve
release of a procurement package to vendors
~	Describe the business need/program objectives for this acquisition
~	Describe the scope of the contract in terms of services and materials to be procured; include
the estimated dollar value
~	If other acquisition actions will be needed to meet all program objectives, describe them here
~	Describe the acquisition strategy in terms of contract type (Firm Fixed Price, Time and
Materials, Cost Plus) and duration (e.g., base year plus X option years). Describe alternatives
considered when determining this strategy.
~	Describe any other alternatives discussed during process, e.g., buy vs. build, buy vs. lease, etc.
~	Describe any hard deadlines or agency dependencies on this acquisition
~	If the scope includes development, describe actions taken to ensure incremental development
steps are followed
~	Describe any use of brand name justifications, if applicable
~	Describe any IT waivers required related to this acquisition, if applicable
~	Describe how your program plans to leverage OARM's strategic sourcing vehicles, if applicable
~	Describe any planned use of shared services associated with this acquisition
~	Describe your approach to hosting and security
~	Describe your SLA requirements, if applicable
~	Describe how you created your cost estimate
~	Is any CROMERR documentation required?
~	Describe any key risks and your mitigation approach
~	Describe how the vendor will work with EPA to comply with e-Discovery requests (e.g., FOIA) or
records management requirements, if applicable
~	Describe your Incorporation of Section 508 requirements
~	Describe your incorporation of IPv6 requirements
~	Indicate whether the purpose of the review is to approve a pending award or to approve
release of a procurement package to vendors
~	Describe the business need/program objectives for this acquisition
24

-------
Appendix B - Bureau CIO List
Note: None of the personnel in this table are "key Bureau ClOs"
Program/
Region
Last Name
First Name
Appointment
Type
FT/PT
Rating Official
Region 1
G iff in
Thomas
Career
GS
Full Time
Fred Weeks
Region 2
Demarco
Frank
Career
GS
Part Time
Donald Pace
Region 3
O'Tormey
Carol
Career
GS
Full Time
Ron Borsellino
Region 4
Mills
Keith
Career
GS
Full Time
Ken LaPierre
Region 5
Tindall
Kenneth
Career
GS
Full Time
Cheryl Newton
Region 6
McFarland
Verne
Career
GS
Full Time
James
McDonald
Region 7
Krehbiel*
Ben
Career
GS
Full Time
Luetta
Flournoy
Region 8
Duran
Matt
Career
GS
Full Time
Rick Buhl
Region 9
Sullivan*
Peter
Career
GS
Full Time
Serena
Mcllwain
Region 10
Tyree
James
Career
GS
Full Time
Ed Chu
*Acting

-------
Candidate Bureau ClOs
The following individuals have IT responsibilities within their Programs, but the responsibilities are distributed such that Programs do not have a
single individual serving in the role of a Bureau CIO. As EPA conducts pre-Exhibit 100 Program Portfolio Reviews, we will assess whether it would
be advantageous to consolidate a Bureau CIO in any given Program.
Program/
Last Name
First Name
Appointment
Type
IT Responsibility
Region




FT/PT
Office of Administration
Showman
John
Career
SES
Part Time
and Resources
Settle
Steve
Career
GS
Full Time
Management
Wiskerchen
Nicholas
Career
GS
Full Time

Lynch
Margaret
Career
GS
Full Time

Etheridge
William
Career
GS
Full Time

Wilson
Joe
Career
GS
Full Time

Collard
Erin
Career
GS
Full Time

Harris
Chanya
Career
GS
Full Time

Caro
Vique
Career
GS
Full Time
Office of Air and Radiation
Laporte
Roy
Career
GS
Part Time

Bui lard
Pamela
Career
GS
Part Time

Galano
Fidel
Career
GS
Part Time

Minorics
Josh
Career
GS
Part Time

Slade
Reginald
Career
GS
Part Time
Office of Chemical Safety
Myrick
Pam
Career
GS
Part Time
and Pollution Prevention
Schultz
Robert
Career
GS
Full Time

Syed
Hamaad
Career
GS
Full Time

Williamson
Tracy
Career
GS
Part Time

Price
Michelle
Career
GS
Part Time

Morales
Oscar
Career
SES
Part Time

Hartman
Mark
Career
SES
Part Time

Tran
Chi
Career
GS
Full Time

Vineski
Steve
Career
GS
Full Time
26

-------
Program/
Last Name
First Name
Appointment
Type
IT Responsibility
Region




FT/PT
Office of Enforcement and
Badalamente
Mark
Career
SES
Part Time
Compliance Assurance
Dombrowski
John
Career
SES
Part Time

James
Valerie
Career
GS
Part Time
Office of General Counsel
Lattimore
Craig
Career
SES
Part Time

Blackmond
Victoria
Career
GS
Full Time
Office of International and
Abunassar
Elias
Career
GS
Full Time
Tribal Affairs
Schwimmer
Sergio
Career
GS
Full Time
Office of Research and
Blancato
Jerry
Career
SES
Full Time
Development
Updike
David
Career
GS
Full Time

Brennan
Beverly
Career
GS
Full Time
Office of Solid Waste and
Wyman
Steve
Career
GS
Part Time
Emergency Response
Schaefer
Joe
Career
GS
Part Time

Raia
Tony
Career
GS
Part Time

Furr
Lori
Career
GS
Part Time

Beasley
Lynn
Career
GS
Part Time

Gattuso
Peter
Career
GS
Part Time

Ward
Dondra
Career
GS
Part Time

Schmitt
Steve
Career
GS
Full Time
Office of the Administrator
Howard
James
Career
GS
Full Time
Office of the Chief
Terris
Carol
Career
SES
Part Time
Financial Officer
Jones
Quentin
Career
SES
Full Time

Dubbs
Kimberly
Career
GS
Part Time
Office of the Inspector
Shields
Edward
Career
GS
Full Time
General





27

-------
Appendix C - Policies and Guidance Documents that May be Updated as Part of
FITARA
•	Quality Information Council Charter
•	Information Investment Review Board Charter
•	EPA Delegations Manual
•	System Life Cycle Management Policy and Procedures
•	CPIC Policy and Procedures
•	Senior Information Officials policy
•	IT Approvals Under FITARA interim policy
•	Accounting for Information Technology

-------
Appendix D - Acronyms
BAS
Budget Automation System
CAO
Chief Acquisition Officer
CIO
Chief Information Officer
COTS
Commercial Off the Shelf
CPIC
Capital Planning Investment Control
CTO
Chief Technology Officer
EPA
Environmental Protection Agency
FITARA
Federal Information Technology Acquisition Reform Act
GSA
General Services Administration
HQ
Headquarters
IGCE
Independent Government Cost Estimate
IIRB
Information Investment Review Board
IT
Information Technology
O&M
Operations and Maintenance
OAM
Office of Acquisition Management
OCFO
Office of the Chief Financial Officer
OEI
Office of Environmental Information
OMB
Office of Management and Budget
QIC
Quality Information Council
SLA
Service Level Agreement
SLCM
System Life Cycle Management
SOW
Statement of Work
WCF
Working Capital Fund
29

-------