E4. ENCLOSURE 4

IT CONSIDERATIONS

E4.1. Mission-Critical/Mission-Essential Information System

E4.1.1. Mission-Critical Information System. A system that meets the definitions of "information system" and "national security system" in the CCA (reference (l)), the loss of which would cause the stoppage of warfighter operations or direct mission support of warfighter operations. (Note: The designation of mission critical shall be made by a Component Head, a Combatant Commander, or their designee. A financial management IT system shall be considered a mission-critical IT system as defined by the USD(C).) A .Mission-Critical Information Technology System. has the same meaning as a "Mission-Critical Information System".

E4.1.2. Mission-Essential Information System. A system that meets the definition of information system. in reference (l), that the acquiring Component Head or designee determines is basic and necessary for the accomplishment of the organizational mission. (Note: The designation of mission essential shall be made by a Component Head, a Combatant Commander, or their designee. A financial management IT system shall be considered a mission-essential IT system as defined by the USD(C).) A .Mission-Essential Information Technology System. has the same meaning as a "Mission-Essential Information System".

E4.2. IT System Procedures

E4.2.1. The MDA shall not approve program initiation or entry into any phase that requires milestone approval for an acquisition program (at any level) for a mission-critical or mission-essential IT system until the DoD Component CIO confirms or certifies (for MAIS only) that the system is being developed in accordance with reference (l). At a minimum, the DoD Component CIO.s confirmation or certification shall include a written description of the three materiel questions of section 3.6.4 and the considerations in Table E4.T1.

E4.2.2. PMs shall prepare a table such as the one illustrated at Table E4.T1. to indicate which acquisition documents correspond to the CCA requirements. DoD Component CIOs shall use the acquisition documents identified in the table to assess CCA compliance. The requirements for submission of written confirmation or certification (for MAIS only) shall be satisfied by the DoD Component CIO.s concurrence with the PM.s CCA Compliance Table. Issues related to compliance shall be resolved via the IPT process. The cognizant PSA shall coordinate on the CCA Compliance Table. No Milestone A, B, or Full-Rate Production decision (or their equivalent) shall be granted for a MAIS until the DoD CIO certifies that the MAIS program is being developed in accordance with the CCA.

E4.2.3. For MDAP and MAIS programs, the DoD Component CIO's confirmation (for MDAP) and certification (for MAIS) shall be provided to both the DoD CIO and the MDA.

E4.2.4. The DoD Components shall not award a contract for the acquisition of a mission-critical or mission-essential IT system, at any level, until the following have been accomplished:

E4.2.4.1. The DoD Component registers the system with the DoD CIO;

E4.2.4.2. The DoD CIO determines the system has an appropriate information assurance strategy; and

E4.2.4.3. The DoD Component CIO confirms that the system is being developed in accordance with the CCA by complying with paragraph E4.2.1 (above).

E4.2.5. The requirement to confirm or, for MAIS only, to certify CCA compliance applies to milestone decisions for each increment of an evolutionary acquisition. The requirements of the CCA apply to all IT (including NSS) acquisitions, but subparagraph E4.2.4, above, applies only to mission-critical and mission-essential IT systems.

E4.2.6. At Milestone C, for MAIS, the MDA shall approve, in coordination with DOT&E, the quantity and location of sites for a limited deployment for IOT&E.

E4.2.7. When the use of commercial IT is considered viable, maximum leverage of and coordination with the DoD Enterprise Software Initiative shall be made.

E4.2.8. For financial management MAIS acquisition programs, the MDA shall not grant any milestone or full-rate production approval, or their equivalent, until the USD(C) certifies that the system is being developed and managed in accordance with the DoD Financial Management Enterprise Architecture (reference (t) and Sec.1004 of Pub.L. 107-314 (reference (ax))).

E4.2.9. An amount in excess of $1,000,000 may be obligated for defense financial system improvement (i.e., a new, or modification of, a budgetary, accounting, finance, enterprise resource planning, or mixed (financial and non-financial) information system) only if the USD(C) determines and certifies that the system is being developed or modified, and acquired and managed in a manner that is consistent with both the DoD Financial Management Enterprise Architecture and the DoD Financial Management Enterprise Architecture Transition Plan. The USD(C) shall provide such certification to the MDA before any milestone or full-rate production approval, or their equivalent, is made by the MDA.

Table E4.T1. CCA Compliance Table

Requirements Related to the Clinger-Cohen Act (CCA) of 1996 (reference (l))	Applicable Program Documentation **
*** Make a determination that the acquisition supports core, priority functions of the Department	ICD Approval
*** Establish outcome-based performance measures linked to strategic goals	ICD, CDD, CPD and APB approval
*** Redesign the processes that the system supports to reduce costs, improve effectiveness and maximize the use of COTS technology	ICD, CDD, CPD and APB approval
* No Private Sector or Government source can better support the function	Acquisition Strategy page XX, para XX AoA page XX
* An analysis of alternatives has been conducted	AoA
* An economic analysis has been conducted that includes a calculation of the return on investment; or for non-AIS programs, a Life-Cycle Cost Estimate (LCCE) has been conducted There are clearly established measures and accountability for program progress The acquisition is consistent with the Global Information Grid policies and architecture, to include relevant standards. The program has an information assurance strategy that is consistent with DoD policies, standards and architectures, to include relevant standards To the maximum extent practicable, (1) modular contracting has been used, and (2) the program is being implemented in phased, successive increments, each of which meets part of the mission need and delivers measurable benefit, independent of future increments	Program LCCE Program Economic Analysis for MAIS Acquisition Strategy page XX APB APB (Interoperability KPP) C4ISP (Information Exchange Requirements) Information Assurance Strategy Acquisition Strategy page XX
The system being acquired is registered	Registration Database