DOC

federalstudentaidedgov

By Amanda Sanchez,2014-07-08 08:54
6 views 0
federalstudentaidedgov

    U.S. Department of Education

    Federal Student Aid

    Production Readiness Review (PRR)

    Process Description

    Version 11.0

    Final

    July 28, 2011

    Document Number: FSA_TOQA_PROC_RLS.PRR_001

     Production Readiness Review (PRR) Process Description Document Version Control

    Document Version Control

    Version Date Description

    11.0 7/28/2011 ; Revised PRR applicability criteria to be based on the

    operational risk associated with implementing a release

    (matching the same criteria that are planned by Enterprise

    Change Management). ECM operational risk determination

    will determine if PRR applies to a release.

    ; Expanded slide presentation template to incorporate all

    information from PRR Checklist and include a Sign-off

    memo at the end of the presentation; removed PRR

    Checklist and Sign-off memo artifacts from PRR Process

    (combined three documents into one).

    ; Revised presentation template to include additional

    information on the business impact of delaying release

    implementation.

    ; Revised presentation template to include additional

    information regarding test results with a focus on

    performance testing.

    ; Revised presentation template to include a slide for reporting

    status of configuration management audits.

    ; Revised procedures for distributing PRR Meeting Notices

    and PRR Presentation materials to include the technology

    office distribution list.

    ; This PRR Process Description document and the associated

    presentation template completed and passed Section 508

    accessibility review by the ED OCIO Assistive Technology

    Team on 7/26/2011.

    10.0 7/30/2010 ; Removed sign-off types (i.e. conditional, provisional, etc).

    ; Expanded timeline of events in the PRR process to add

    planning steps earlier in the project lifecycle and to

    accommodate an optional review of test data by CIO

    Enterprise Testing Group.

    ; Minor re-organization of order and titles of information

    presented in PRR slides.

    ; Re-organized and updated PRR Checklist (Appendix C and

    D) to improve usability.

    ; Updates to appendices to support changes.

    Version 11.0 i July 28, 2011

     Production Readiness Review (PRR) Process Description Document Version Control

    Version Date Description

    9.0 7/31/2009 ; Added LCM Framework reference (Section 1).

    ; Changes to sign-off for large-scale releases (Section 6).

    ; Added System Test Lead, FSA Computer Security Officer,

    and Responsible ELT Member descriptions to Sign-off

    requirements (Section 6).

    ; Clarifications to PRR Process steps, including better

    identification of the role of the QA Team (Section 4).

    ; Reformatted PRR Summary Checklist to portrait layout

    instead of landscape and removed risk mitigation columns

    (Appendix C).

    ; Reformatted PRR Summary Checklist Definitions to portrait

    layout instead of landscape and removed risk mitigation

    columns (Appendix D).

    ; Updated sample sign-off memo (Appendix E)

    ; Minor editorial changes for grammar, spelling, formatting, etc

    (entire document).

    8.1 01/30/2009 ; Modified Applicability section to address concerns related

    conducting PRRs on infrastructure and toolset changes.

    ; Clarified the sign-off authorities for the CIO signature.

    ; Added Checklist items to cover re-validation of disaster

    recovery objectives (RTO and RPO) and vulnerability scans.

    ; Minor clarifications in PRR checklist definitions.

    8.0 7/30/2008 Major Document Revision includes the following:

    ; Major Checklist updates to reflect stakeholder

    discussions

    ; New information regarding rationale for holding PRRs

    ; New diagram depicting the role of the PRR in the

    context of other related activities

    ; Addition of PRR presentation slides

    ; Updated signoff role descriptions

    ; Updates to signature page

    ; Updated terminology based on VDC Configuration

    Management Database (CMDB) Data Dictionary,

    ECOM, and Security documents.

    ; Major formatting and editorial changes to conform to the

    Federal Student Aid Document Template

    1.0 - 7.0 6/19/2007 For previous revision history of Versions 1.0-7.0, see Version

    7.0

    Version 11.0 ii July 28, 2011

Production Readiness Review (PRR) Process Description Table of Contents

    Table of Contents

    Document Version Control ............................................................................................ i Table of Contents ......................................................................................................... iii Executive Summary ...................................................................................................... 1 Section 1. Introduction ................................................................................................. 2 Section 2. Risk-based criteria for conducting a PRR ................................................ 4 Section 3. PRR Process ................................................................................................ 6

    Step 1: LMM Tailoring Plan and Project Schedule ........................................................8

    Step 2: QA Review of Project Schedule and PMP ..........................................................8

    Step 3: Requirements, Design, Development, and Testing Activities .............................8

    Step 4: Implementation Change Request Created ..........................................................9

    Step 5: Schedule Pre-PRR and PRR ................................................................................9

    Step 6: Reviews by Technology Office Support Areas ....................................................9

    Step 7: Operational Readiness Review .......................................................................... 10

    Step 8: Draft PRR Presentation Distributed ................................................................. 10

    Step 9: Pre-PRR ............................................................................................................. 10

    Step 10: Service Delivery Review (SDR)........................................................................ 10

    Step 11: PRR Presentation Distributed ......................................................................... 11

    Step 12: PRR Presentation and Sign-off ........................................................................ 11

    Step 13: Release Production Implementation ............................................................... 11 Section 4. PRR Presentation ...................................................................................... 12 Section 5. Sign-Off Responsibilities .......................................................................... 42 Appendix A - Acronyms and Abbreviations ............................................................. 45 Appendix B - Glossary ................................................................................................ 48

    Version 11.0 iii July 28, 2011

     Production Readiness Review (PRR) Process Description Executive Summary Executive Summary

    The Production Readiness Review (PRR) Process is a quality review of system releases before each release is implemented in Federal Student Aid’s (FSA) production environment. The PRR process is intended to keep FSA management informed of critical release activities and is intended to reduce the likelihood of new system releases causing unintended adverse impact to FSA’s business or end-users.

    The PRR Process also supports the responsibilities of Federal Student Aid's Technology Office, Chief Information Officer (CIO), as described by the Clinger-Cohen Act. These include:

    ; Developing, maintaining, and facilitating the implementation of sound and integrated

    information technology architecture.

    ; Promoting the effective and efficient design and operation of all major information

    resource management processes.

    In addition, the PRR is intended to satisfy the requirements of the third Stage Gate Review (between the Construction & Validation and Implementation Stages), as described in the Department of Education’s directive on the Lifecycle Management Framework (OCIO: 1-106,

    dated 07/16/2010). The PRR also serves as the stage gate between the Testing and Implementation Stages (Technical Stage Gate 4), as described in FSA’s Lifecycle Management

    Methodology.

    The PRR covers several areas associated with implementing a system release, including: a review of open risks associated with the implementation, testing activities and results for the release, the readiness of the data center to support implementation and operations of the release, security and privacy impacts of the release, configuration management reviews that have taken place, end user support and communication activities that are associated with the release, and the status of documentation needed to support and operate the information system that is being enhanced by the release. Further, the PRR provides an opportunity for the Integrated Project Team (IPT) to discuss lessons learned and process improvements with FSA management and relevant stakeholders.

    Version 11.0 1 July 28, 2011

     Production Readiness Review (PRR) Process Description Section1. Introduction Section 1. Introduction

    The Production Readiness Review (PRR) Process is a high-level quality assurance review of system releases before the release is implemented in Federal Student Aid’s (FSA) production environment. The PRR process is intended to keep FSA management informed of critical release activities and is intended to reduce the likelihood of new system releases causing unintended adverse impact to FSA’s business or end-users. PRR confirms to FSA Management that

    appropriate system and software development lifecycle activities have occurred in support of the release.

    1.1 Purpose

    The Production Readiness Review (PRR) Process Description defines Federal Student Aid’s

    approach for conducting PRR activities prior to implementing a system release. This process description provides guidance to individuals responsible for, or involved in these efforts. 1.1.1 Scope

    This document defines FSA’s PRR process that is used by system development and support

    teams. The PRR is conducted prior to the implementation of a release of an information system to FSA’s production environment, regardless of data center location of the information system. The PRR Process provides for standardized documentation and communication of quality review information.

    1.2 Intended Audience

    Table 1-1 lists the individuals this document applies to and the purpose for which they may utilize the information in this document:

    Intended Audience Uses

    FSA Management Provides guidance on participation and sign-off responsibilities

    in the PRR Process.

    FSA systems development, Provides guidance on information gathering, preparation,

    operations, maintenance, and presentation, participation and sign-off responsibilities in the

    infrastructure staff PRR Process.

    System Support Contractors Provides guidance on the PRR Process in order to appropriately

    support FSA as the review activities occur for each system

    release.

    Table 1-1: Intended Audience and Uses

    Version 11.0 2 July 28, 2011

     Production Readiness Review (PRR) Process Description Section1. Introduction 1.3 Document Organization

    This document comprises the following sections:

    ; Section 1 Introduction: describes the reason and background for this document. ; Section 2 Risk-based criteria for conducting a PRR

    ; Section 3 PRR Process

    ; Section 4 - PRR Presentation

    ; Section 5 PRR Sign-off Responsibilities

    ; Appendix A Acronyms and Abbreviations: provides a list of acronyms and

    abbreviations

    ; Appendix B Glossary: defines terminology within the context of this process

1.4 References and Related Documents

    This following references and related documents impact the PRR Process Description:

; Clinger-Cohen Act of 1996 (Public Law 104-106)

    ; Lifecycle Management (LCM) Framework, ED OCIO, July 16, 2010 ; Lifecycle Management Methodology (LMM), Federal Student Aid, Draft, July 2011 ; LMM Stage Gate Process Description, Federal Student Aid, Draft, July 2011 ; Enterprise Change Management Plan, Draft Version 1.0, Federal Student Aid, April 20,

    2011

    ; Procuring Electronic and Information Technology (EIT) In Conformance with Section

    508 of the Rehabilitation Act of 1973, ED OCIO, May 1, 2006

    ; Information Technology Investment Management (ITIM) and Software Acquisition

    Policy, ED OCIO, September 15, 2006

    ; Enterprise Test Management Standards, Version 3.0, Federal Student Aid

    ; Federal Information Processing Standards (FIPS) 199 Standards for Security

    Categorization of Federal Information and Information Systems, NIST

    ; Government Performance and Results Act of 1993 (Public Law 103-62) ; Special Publication 800-60, Guide for Mapping Types of Information and Information

    Systems to Security Categories, NIST

    ; Special Publication 800-37, Guide for the Security Certification and Accreditation of

    Federal Information Systems, NIST

    ; Special Publication 800-53 Revision 3, Recommended Security Controls for Federal

    Information Systems and Organizations, NIST, August 2009

    ; Circular A-130 Management of Federal Automated Information Resource, OMB

    Version 11.0 3 July 28, 2011

     Production Readiness Review (PRR) Process Description Section 2. Risk-based criteria for conducting a PRR Section 2. Risk-based criteria for conducting a PRR

    A Production Readiness Review (PRR) is required for application system releases or infrastructure changes that have a high operational risk associated with implementation. System releases and infrastructure changes that have a medium operational risk will hold a PRR at the discretion of the Enterprise Change Control Board (ECCB) based on an informed analysis of the specific risk characteristics of the release. System releases and infrastructure changes with a low operational risk are not required to perform a PRR, but have the option of performing a PRR at the discretion of the Project Manager or Project Sponsor.

    The risk ratings are high, medium, and low and are based on the following seven categories:

    ; System Criticality system is categorized as critical, important, or supportive.

    ; System End User Type and Volume external or internal to FSA and the

    volume/audience impacted

     the scope and intricacies of the change (simple, multifaceted, intricate). ; Complexity

    ; Size the change in configuration items or functionality to the system or system

    components (major, minor, patch see definitions in the glossary under System

    Release Type)

    ; Technology new to the market or FSA’s operating environment, or out-of-support

    ; Maturity system’s age or support organization’s time in supporting system

    ; Business Cycle Proposed time for the change to be implemented based on the

    system’s use and processing schedule and potential peak processing of other systems.

    The table below is used to determine the operational risk associated with a system release or infrastructure change. The “high water mark” method is used when determining the risk rating. A single risk category being rated higher moves the overall evaluation into the higher rating.

    Category High Medium Low

    System Criticality Critical or important Critical, important, or Important or supportive

    supportive

    System End User External Public / Students / External Title IV Partners Type and Volume Schools Internal Significant Internal Limited audience

    Internal organization-wide audience of ED / FSA of ED / FSA employees,

    audience of ED / FSA Employees or contractors contractors, or auditors

    Employees or contractors

    Complexity Intricate Multifaceted Simple

    Size Major or minor Minor or patch Patch

    Technology New to FSA, new to market, Currently supported in FSA Exact version/ model used is

    or out-of-support environment, but not the currently supported in FSA

    exact version/ model environment

    Version 11.0 4 July 28, 2011

     Production Readiness Review (PRR) Process Description Section 2. Risk-based criteria for conducting a PRR

    Category High Medium Low

    Maturity Federal project management Federal project management Federal project management

    team is new to FSA or team has performed similar team has performed previous

    releases of this scope. releases. releases of this system.

    OR OR AND

    Development team Development team Development team

    (contractor) is new to FSA. (contractor) has completed (contractor) has preformed

    similar projects at FSA. previous releases of this

    system.

    Business Cycle During peak processing Prior to peak processing During low point(s) in the

    period for the system or period, but inadequate time processing cycle(s)

    another impacted system’s to complete first live batch

    peak processing period and make corrections

    Table 2-1: Operational Risk Ratings

    The Enterprise Change Control Board (ECCB) has responsibility for assigning operational risk, which determines the requirement for a PRR. ECCB determinations of risk for each release and infrastructure change are documented in the bi-weekly Enterprise Master Release Schedule.

    Version 11.0 5 July 28, 2011

     Production Readiness Review (PRR) Process Description Section 5. Sign-Off Responsibilities

    Section 3. PRR Process

    The following table provides the process steps and timeline for the PRR Process. The IPT

    developing a system release or infrastructure change has responsibility for carrying out the steps

    below with support from many other teams throughout the organization. It is understood that the

    exact timing of releases and infrastructure changes will be driven by project dependencies and

    other constraints such as legislative and operational requirements. The steps in the table are

    explained in detail following the table.

    PRR Timeframe Responsible Group # Process Step (T = Production Date)

    IPT:

    Sr. Project Manager

    LMM Tailoring Plan completed and LMM Project inception and monitored IT Project Manager 1 Artifacts incorporated in project schedule. throughout project. Business Project Manager

    System Technical Lead

    COTR, ISSO, Test Lead, etc.

    Technology Office, Quality Assurance Team

    review of Draft Project Schedule and Project

    Management Plan (PMP) IPT Submits to QA Team

     During IPT reviews of project 2 Note: Project Schedule and Project schedule and PMP. QA Team reviews and provides

    Management Plan are two different comments and questions.

    documents. See LMM for additional guidance

    on these artifacts.

    IPT carries out requirements, design,

    development, and testing activities consistent

    with LMM and applicable system/software

    development methodologies.

     IPT - Leads Note: Regular project updates should be 3 provided to the Technology Office, Quality Based on project schedule. QA Team Participates / stays Assurance Team so that this group is in touch informed with the project throughout the lifecycle. This

    can be accomplished by including the QA

    Team in regularly scheduled status meetings,

    copying the QA Team on regular status

    reports, etc.

    Based on project schedule.

    3 6 months before release

    implementation date. Implementation change request created IPT 4 Note: For VDC hosted systems, this is done and/or Prefer that this ticket is opened through the VDC CCM Tool in Rational. as soon as project has a realistic Application Support Contractor implementation date and that

    change request ticket is updated

    if implementation dates changes.

    Minimum of 3 weeks before the

    Pre-PRR and PRR events.

5 Schedule Pre-PRR and PRR Prefer that this scheduling is IPT

    done as soon as project has

    realistic dates for Pre-PRR and

    PRR Activities.

    Version 11.0 6 July 28, 2011

Report this document

For any questions or suggestions please email
cust-service@docsford.com