Department of Administrative Services. Office of the State Chief Information Officer

Transcription

1 Status Report To Joint Ways And Means IT Subcommittee Dr. Alex Pettit State Chief Information Officer April 23, 2015 Department of Administrative Services 1

2 Enterprise Project and Portfolio Management Tool Major IT Projects Update Tenable Inventory & Security Scan Budget Note Report 2

3 Enterprise Project and Portfolio Management What is it? Why do we need it? Where are we now? 3

4 What is Enterprise PPM? Industry best practice in managing a group of related and unrelated programs or projects (portfolios) A portfolio approach is imperative to effectively prioritize, oversee and manage information resources at the enterprise level An automated tool to help identify duplication, shared service opportunities and trends Helps reinforce strong Project Management principles- fail small and early Standard/automated process for evaluating, overseeing and tracking: Future opportunities IT investments Project documentation, analyses, risks & decisions Provides transparency - major IT Project oversight, tracking and reporting A tool for effective IT Governance- prioritization, resource allocation, stewardship 4

5 Problem Statement/Business Opportunity The OSCIO is required by statute to manage the State s IT investments as a portfolio. Currently, IT investment management is through a manual process that is: Handled differently by each agency Lacking uniformity across the enterprise Often not timely or correct Limited by time and resources to verify, standardize and report data Lacking in transparency Without ability to manage the IT investment lifecycle Due to these factors, the OSCIO is unable to make timely informed decisions related to oversight, budget build, project execution and shared services opportunities. By implementing a PPM solution, the OSCIO will automate the tracking, management and reporting of the State s IT investment portfolio. 5

6 Project information tracked and provided to the decision makers Information Technology Project Initiation Document 2/22/2006 Strategic Alignment High Project Initiation Document (PID) Project Summary Project name Workforce management Objective To introduce best practice model for hire to pay workforce management allowing the district to: Improve inter-departmental coordination Create a broader reach to existing and potential district staff Increase confidence in district personnel budgeting Build transparency in district operations Executive sponsor(s) Heidi Franklin Richard Clarke Program manager(s) Michelle Riddell Steve Olson Cost $446,000-$491,000 Strategic Alignment (0-2) Legal / regulatory 0 N/A issues Student 0 N/A achievement Productivity enhancement 1 Streamlines process for staffing projections o Currently 3 formats required Integrates recruiting and hiring processes into PeopleSoft, enhancing ability to extract management information Cost reduction 2 Accurate, real-time staffing data will allow more disciplined hiring practices vis-à-vis approved budget Revenue 0 N/A enhancement Enterprise data 2 Single source of reliable, real-time staffing data will improve: o Budgeting accuracy o Clarity of staffing decisions o Time to identify vacancies and initiate hiring process Strategic alignment 0.83 total Project Risk (0-2) Technical People Process Project risk total Data integrity Changes to longstanding roles and responsibilities Deep engagement from stakeholders Inter-departmental collaboration Low High Project E Project B Project G (new) Project F Project risk Projected lifecycle cost: Project D Project C Project A $XM Project H (new) Low defined components of strategic alignment and risk indices 6

7 Why do we need PPM? Office of the State CIO Key Initiatives (from current EIRM strategic plan): Effective IT Governance helps ensure that IT supports business goals, optimizes business investment in IT, and appropriately manages IT-related risk and opportunities. IT Governance Institute, 2014 IT Governance Strategic Technology Office Enterprise Project Portfolio Management Oversight and Quality Assurance Enterprise Architecture Optimization Security 7

8 Strategic Alignments and Mandates Legal, Regulatory or Policy Mandates ORS mandates the use of portfolio-based management of IT investments; this project would implement a solution to meet this mandate. Tie to Oregon Enterprise Information Resources Management Strategy This project ties to Oregon Enterprise Strategy by providing an Enterprise wide solution which can be leveraged by both the OSCIO and state agencies to prioritize, track and report on major IT investments. While the initial implementation will focus on projects reportable to the OSCIO, the long term goal is to provide the application to any agency interested in leveraging this PPM solution to track their internal agency projects. 8

9 IT Governance Framework Charter Purpose: Implementation of phase 1 of the Enterprise IT Governance framework and develop a legislative package and staffing plan for complete program implementation. Expected Results: Implementation of the IT governance framework to: increase enterprise IT coordination increase enterprise IT compliance reduce system duplication align technology solutions streamline IT portfolio management 9

10 Identify duplication and shared opportunities Automated process in PPM tool 10

11 Project Prioritization Broadband project Public safety data projects Central Administration Projects Project Funnel (Enterprise PPM) Natural Resource Projects Licensing Board projects Improving Government Projects STOs/ARB Business Segment Portfolios Governance Agency Shared Utility Enterprise Portfolio Desired outcomes: Strategic Alignment Prioritized Programs and Projects Efficient Use of Funds 11

12 The PPM Opportunity Maturing the whole Organization Enterprise Value to Organization Basic Ad hoc No Portfolio Inventory or Process - Just Do It -Success is random -Poor transparency Project Inventory Processes are defined & documented, and most projects are aligned to Business Driver All projects are consistently captured in a project inventory Project Portfolio Portfolio analysis is repeatable, predictable, and consistently used to evaluate and optimize project portfolio selection Portfolio Management teams are able to understand, analyze, & recommend optimal portfolio bundles and schedules to technology and business partners Stages of Excellence Cross Portfolio PPM is adopted and used consistently across multiple organizations and portfolios Portfolio Analysts can compare and leverage portfolio analysis information across multiple departments Consistent measures enable cross portfolio analysis, selection, planning and management that supports predictive modeling and internal / external benchmarking PPM is optimized across the enterprise with a focus on continuous risk mitigation and value creation Project portfolio performance and risk data is understood and can be compared at the individual, cross-lob, and enterprise levels Senior leadership is able to leverage PPM analysis when allocating funds to various portfolios Ability to measure and benchmark entire portfolio lifecycle World-Class Crawl Walk Run 12

13 High level Project Outcomes Intended Outcomes Portfolio-based management of IT investments Improved Project Management maturity -Use of the PPM for agency project and portfolio management Reporting from the PPM Identification of shared service opportunities Use of the PPM for project prioritization and oversight Improved PPM Maturity - Provide a Project Portfolio Management Solution and education for agencies who do not currently have a tool 13

14 Enterprise PPM Project Update Limitation Authority for $388,000 received during December 2014 Legislative Days Project Start: January 2015 Original Project End: June 30, extending to mid August Funds will be spent on three key items: Item Cost Licenses for the first year $58,975 Implementation services $272,500 Administrative training services $1,530 Total $333,006 14

15 Implementation Services Overview Implementation services will include: Configuration of the application, screens and reports to meet requirements, including the Stage Gate workflow and addition of approved project artifacts Use of the tool for a pilot agency at the project level the pilot agency is the Department of Revenue Upload of project data for OSCIO and DOR Testing Training the end user staff in the tool Training the administrator in administrative functions of the tool 15

16 Schedule Overview 3/5/2015 Milestone 1 - Project Kickoff Today 5/22/2015 Milestone 3 - Completion of Design Document 6/11/2015-6/25/2015 User Testing 8/12/2015 Milestone - 5 System Deployed to PROD 7/29/2015-8/10/2015 Post Deployment Support 4/1/2015 5/1/2015 6/1/2015 7/1/2015 8/1/2015 8/13/2015-8/28/2015 3/11/2015-5/15/2015 OSCIO-lead Agency Onboarding 3/1/2015 Requirements Gathering & Design 8/31/2015 7/15/2015-7/17/2015 Mentoring Sessions 4/29/2015 Milestone 2 - Requirement & Value Realization 6/22/2015 Milestone 4 - System Configured, Testing Complete 16

17 Majority of IT Projects fail in BUILD due to lack of upfront planning 17

18 Enterprise Project and Portfolio Management Tool Major IT Projects Update Tenable Inventory & Security Scan Budget Note Report 18

19 Major Projects with IT Component Update As of April,

20 20

21 INCREMENTAL DELIVERY All new major IT projects (agency, shared or enterprise utility) will develop, incrementally, ensuring that key milestones are met before a project continues. This part of the oversight process is called Stage Gate- the workflow is automated in the PPM Tool 21

22 Number of projects and size of investments to track in PPM at the Enterprise Level Summary Governor s Budget Proposal to 2015 Legislature Executive Branch Proposed IT Projects Program Areas All Program Areas- 20 Agencies # of Projects >$150K Est. Cost($) All Biennia Est. Cost ($) 146 $285 M* $869.6 M Note: # of IT Projects > $1M 45 projects across 11 agencies 22

23 Simple Model (Stage Gate Focus) Stage Endorsement Stage Endorsement Stage Endorsement Stage Endorsement 4 Pre-Stage 1: Pre Planning Stage 1: High Level Planning Stage 2: Detailed Business Case & Foundational Planning Stage 3: Detailed Planning Stage 4: Execution 23

24 Projects Pre-Stage 1 Endorsement developing high level plans, high level business cases & foundational plans Agency Name Corrections Corrections Corrections DAS Education Project Name Corrections Intranet Business Analysis for CIS Replacement Electronic Health Record HR Information System ELIS (Early Learning Information System) Justice Oregon Employer Service Portal Phase 2 Justice Justice Military PERS Revenue State Police Transportation Transportation Transportation Transportation Transportation Youth Authority Child Support Micro Conversion Summation Upgrade Frame Relay Replacement ORION Maintenance & Enhancement Property Valuation System CRIMEvue Replacement ETS Server Upgrade (for ODOT projects) Financial/STIP Mgt Release 2 (Data Warehouse) Central Hwy. Approach Maint. Permitting Time & Attendance DMV Service Transformation Program (STP) JJIS.NET migration 24

25 Stage 1 Projects with Stage 1 Endorsement completed high level plans; developing detailed business case & foundational plans Agency Name DAS ETS DAS ETS DAS ETS DHS Health Authority Health Authority OEIB Revenue Teachers Standards & Practices Commission Project Name CFO Capital Assessment Plan Contract Voice Services Equipment Replacement MMIS: Transformed Medicaid Statistical Info Sys (TMSIS) Home Visiting Data Sys. (HVDS) Software Upgrade State Longitudinal Data System Processing Center System Modernization Database Suite 25

26 Stage 2 Projects with Stage 2 Endorsement completed detailed business case & foundational plans; developing detailed plans Agency Name DAS DAS Employment Employment Employment Employment Health Authority Health Authority PERS Project Name Data Management Consolidation FirstNet Public Safety Comm. Perf. Rpt. Info. Sys. Software Configuration Management Call Center Upgrade Unemployment Insurance Syst. Modernization MMIS Disaster Recovery (MMIS DR) MAGI Medicaid System Transfer Individual Acct. Prog. Administration Transfer 26

27 Stage 3 Projects with Stage 3 Endorsement completed detailed project plans; in execution Agency Name Justice CCWD DAS ETS DCBS DEQ DHS DHS DHS Education Employment Employment Fish Fish Forestry Forestry Project Name Child Support System Modernization (CSEAS2) Data for Analysis HVAC Central Control Oracle to.net Conversion Cross Media Rpt. Reg. WIC TWIST Elec. Benefits Transfer (WIC EBT) Child Care Billing/Attendance Community Outcome & Perf. Accountability Support Syst. (COMPASS) Advancing Longitudinal Data Enterprise Hardware Office of Admin Hearings (OAH) Case Management Internet Point of Sale Unisys Migration Forest Activity Electronic Rpt./Notification (FERNS) Woods Accounting & Log Tracking (WALT) 27

28 Stage 3 Projects with Stage 3 Endorsement completed detailed project plans; in execution (continued) Agency Name Health Authority Project Name MMIS ICD-10 Codes (ICD-10) Health Authority MMIS Electronic Data Interchange (5010) Health Authority Health Authority Revenue Transportation Transportation Transportation Transportation Transportation Behavioral Health Integration (BHIP, Avatar) Medical Assistance Provider Incentive Repository (MAPIR) Core Sys. Replacement (formerly TaPR) Windows Server Replacement Drivers License Issuance Replacement (DLIR) Remedy Upgrade Fuel Tax Sys. Replacement (FTSR) Microfilm Replacement (MR) Transportation Software Upgrades (Windows OS/Office 2010) Transportation Transportation Transportation Right of Way Info Tracking Syst (RITS) Road Usage Charge Project State Radio Project (SRP) 28

29 Stage 4 Projects with Stage 4 Endorsement Completed execution; closing project and transitioning to business operations Agency Name Transportation Project Name Financial/STIP Mgt Release 1 (Plan/Control) 29

30 Projects on Hold or Stopped Agency Name Project Name Stage DCBS Business Intelligence 1 DHS Child Welfare Elec. Client 1 Employment Payroll Rpt. 1 Employment UI Connectivity/Sign-on/Portal 3 DHS DHS Modernization Program (DHSM) 3 30

31 Enterprise Project and Portfolio Management Tool Major IT Projects Update Tenable Inventory & Security Scan Budget Note Report 31

32 Tenable Inventory and Security Scan 32

33 Automated Inventory Scanning Goals Automated, Repeatable, Accurate Considered two approaches Configuration management tools Security vulnerability scanning tools Selected security vulnerability scanning approach Significantly lower cost Added value as a security tool to help agencies reduce security vulnerabilities 33

34 Tenable Nessus Probes IT assets for potential security weaknesses Gathers inventory information in the scanning process Deployed locally in each agency network Reports to a central repository managed by OSCIO Tenable Security Center Nessus Scanner Agency A Nessus Scanner Agency B Nessus Scanner Agency C 34

35 Inventory Results 45 participating agencies Nearly 35 thousand devices scanned Device Types Network, 1029 Printer, 4799 Storage, 29 Virtual, 2503 Physical,

36 Inventory Results Inventory information on each device included: Operating Systems with versions Browsers Installed with versions Office Software with versions Hardware Manufacturer (where it could be determined) Database Software with versions (where found) Web Server Platforms with versions (where found) Web Application Platforms with versions (where found) 36

37 Inventory Challenges Data quality is inconsistent 45 agencies scanned, but only 25 considered reliable data 12 agencies significantly under reporting 8 agencies not getting good data due to technical issues Why? Good results require authenticated scans Windows had over 20% failure rate due to authentication issues Other operating systems failed over 2/3rds of the time Comprehensive scans must see whole network Complex agency network environments make it hard to scan all devices without more agency investment 37

38 Inventory Challenges Less than half of agencies covered Why? Complexity Numerous sessions required just to get agency started Agency networks all unique, requiring involved setup and troubleshooting OSCIO/ESO Staffing Lost primary engineer as project was ramping up Recent State-level security incidents have drawn focus Adoption resistance Trust issues with centralized vulnerability reporting Competing agency priorities and lack of available resources 38

39 Inventory Challenges Tenable is excellent for identifying security issues Challenges: Tenable doesn t implement inventory reports out of the box Inventory reports created using custom code to extract information from scan data Not easily repeatable Not flexible for generating different inventory report profiles OSCIO/ESO not staffed appropriately to support 39

40 Inventory Looking Forward Toolset and/or approach needs to change Tenable is a very good security tool, not a good inventory tool Recommend configuration management tool or an alternate approach Staffing changes required Rolling out and supporting automated inventory requires dedicated staffing OSCIO/ESO priorities not well-aligned to inventory 40

41 Tenable Looking Forward Continue to drive adoption At least six agencies using for regular vulnerability scanning and remediation ESO plans to build on this success to get others to do the same Asks? Source training for agencies in developing vulnerability management programs using this toolset Hands-on time with agencies to tune installations and educate on usage of scan information Increase overall coverage at each agency Develop State user community Annual budget to support Tenable as an Enterprise level tool Respect sanctity of agency vulnerability data 41

42 Enterprise Project and Portfolio Management Tool Major IT Projects Update Tenable Security Tool Budget Note 42

43 Budget Note Responses 43

44 Enterprise PPM Project Budget Notes Note: Present any roll-up costs associated with either project that cannot be accommodated in base budget during consideration of the DAS budget in the Joint Committee on Ways and Means. Response: We experienced a delay in the planned start date as well as a recent change in vendor staff which has moved our completion date to Mid August. We have informed the Legislative Fiscal Office of projected expenditure limitation needs for the biennium. 44

45 PPM Budget Notes continued Note: Ensure that the Project and Portfolio Management System project uses the Joint State CIO/LFO Stage Gate Review process. Response: The Stage Gate Review process has been identified as the number one deliverable for the project. The process is the core workflow and has been the baseline for all discussions with the CA/project team. All current Stage Gate projects will be added into the tool at their respective gate and will be used as test data during the testing phase of the project. 45

46 PPM Budget Notes continued Note: Mandate that state agencies utilize the Project and Portfolio Management System for projects that exceed $150,000 in alignment with the current Statewide IT Review and Approval Policy. Response: Because of the number of IT projects with budgets greater than $150,000, this will be phased in. The initial phase, which is part of the current project, will entail entering all projects over $1M and a data upload of all projects over $150K for the program areas currently represented by a Strategic Technology Officer (STO) Transportation & Economic Development, Healthy People and Public Safety and maintenance of that data by either the STO or OSCIO analyst or by the agency for agencies who have a license as part of the initial roll out. The Department of Revenue is the pilot agencies and will also load all project over $150K 46

47 PPM Budget Notes continued Note: Ensure that LFO has access to the Project and Portfolio Management System to support the Legislature s oversight role. Response: The PPM solution offers a robust feature set for roll based access allowing a wide cross section of interested parties views into the application and its projects. Once initial design work of the project has completed, the project team will work closely with LFO to ensure the appropriate level of access. 47

48 Inventory Budget Notes The Oregon Department of Administrative Services (DAS), working with the State CIO, was directed to produce a comprehensive inventory report of all current information technology (IT) assets as required under current law with a special emphasis on the planned replacement or modernization status of information systems in use by all executive branch agencies. This inventory report shall include, but not be limited to: Agency name, Information System (Application) name, Agency Program owner, and business purpose of the Information System Age, Date of last upgrade, and planned changes/enhancements/retirement for the Information System (Application) in the future The IT inventory report must include: A narrative explanation of the methods, assumptions and tools used and any challenges DAS or the State CIO faced in collecting IT asset information; A narrative description of any statutory, rule, or policy changes or resource allocations DAS or the State CIO believes are necessary to support continued or better IT asset inventory reporting. 48

49 Questions 49

50 Appendix: ORS IT Portfolio Management The purposes of information technology portfolio-based management are to: (a) (b) (c) (d) (e) (f) Ensure that state agencies link their IT investments with business plans; Facilitate risk assessment of IT projects and investments; Ensure that state agencies justify IT investments on the basis of sound business cases; Ensure that state agencies facilitate development and review of IT performance related to business operations; Identify projects that can cross agency and program lines to leverage resources; and Assist in state government-wide planning for common, shared IT infrastructure.

51 ORS IT Portfolio Management DAS Obligations (currently delegated to the State CIO): Integrate state agency strategic and business planning, technology planning and budgeting and project expenditure processes into the department s IT portfolio-based management program. Conduct and maintain a continuous inventory of each state agency s current and planned IT investments, a compilation of information about those assets and the total life cycle cost of those assets. Develop and implement state government-wide standards, processes and procedures for the required inventory and for the management of the state government-wide IT portfolio. Ensure that state agencies implement portfolio-based management of IT resources in accordance with rules adopted by the DAS Director (or via delegation by the State CIO). State Agency Obligations Participate in the IT portfolio-based management program and comply with the standards, processes and procedures established by the department (or via delegation by the State CIO).