CDC UP Phase 3 Project Life Cycle (PLC) Integration

1. CDC UP Phase 3 Project Life Cycle (PLC) Integration

2. Background • Advance Understanding of the CDC Unified Process • Foster understanding of how the CDC UP and various PLCs are connected • Illustrate links between phases and processes of CDC UP and various PLCs • Clarify phase differences between CDC UP and various PLCs • Clarify terminology differences between CDC UP and various PLCs • Publish specific PLC standards • Satisfy Regulatory Requirements • Comply with FISMA audit • Align with NIST requirements Why Address Project Lifecycle Integration?

3. Background • Regardless of project type, project management activities remain the same. However, life cycle activities vary • CDC UP Framework encompasses project management activities that have to do with planning, administration, and leadership of a project • Various PLCs, encompass specific activities that have to do with producing project deliverables and concentrate more on the technical and/or product requirements of a project • Neither the CDC UP Framework nor an SDLC are solely sufficient to successfully manage a project; both are required Understanding PLC Integration

4. Lifecycles Integration Standards • IEEE standard does not proscribe a specific software development life cycle (SDLC) model, development methodology, nor the creation of specific documents • IEEE provides a list of activities specified in the standard to be incorporated into an organization’s PLC • IEEE standards should not be construed to prohibit the imposition of additional or more stringent requirements where the need exists Institute of Electrical and Electronics Engineers (IEEE) Capability Maturity Model (CMM) • CMM provides only guidance for improving processes • CMM contains a framework that provides the ability to generate multiple process models • Actual processes used in an organization depend on internal organizational factors

5. Lifecycles Integration Standards • NIST assumes many different SDLCs models exist • In general an SDLC includes the following phases: initiation, acquisition/development, implementation/assessment, operations/maintenance, and sunset (disposition) • NIST is a framework, a roadmap for information security process improvement • Each of these five phases includes a minimum set of tasks National Institute of Standards and Technology (NIST) Information Technology Investment Management (ITIM) • ITIM is a generic framework, a roadmap for investment process improvement • There is no right way to implement ITIM. The framework describes characteristics of success, not specific techniques • ITIM framework can be applied to multiple disciplines as a tool to improve processes • ITIM is technology independent. No specific tools, methods, or technologies are mandated. Appropriate tools, methods, and technologies should be made available to support the processes that an organization develops within ITIM

6. Lifecycles Integration Standards • CMS assumes many different SDLCs models exist • In general SDLC phases fall within one of three CMS phases: IT Investment Selection, IT Investment Implementation, and IT Investment Evaluation • CMS acknowledges that “regardless of the system development methodology that is employed for a given IT project, the primary activities performed throughout the system life cycle generally remain the same”...“While the phases of the life cycle are graphically depicted in sequential order, some of the phases may overlap on some projects or may occur iteratively for other projects, depending on the SDLC selected for the project”. Centers for Medicare & Medicaid Services (CMS) Food & Drug Administration (FDA) • One methodology does not fit all sizes & types of system development & delivery efforts • The FDA SDLC establishes a logical order of events and a common language for conducting system development and delivery for both full sequential and for iterative work patterns

7. Phase 3 SDLC IntegrationSummary Summary • Many different life cycles exist but specific activities within each lifecycle vary • Project management activities remain the same regardless of lifecycle • A framework is a roadmap that identifies key practices for success. However, it describes what to do, not how to do it • CDC UP Framework encompasses project management activities such as planning, administration, and leadership, not specific activities associated with product development • Neither the CDC UP Framework nor an SDLC are solely sufficient to successfully manage a project; both are required

8. Phase 3 SDLC IntegrationRecommendation CDC UP Recommendation for SDLC Integration • Map the CDC UP Framework to a generic SDLC • Without standardizing the CDC on one SDLC, a generic SDLC mapping: • Clarifies phase differences between the CDC UP and SDLCs • Clarifies terminology differences between CDC UP and SDLCs • Illustrate links between phases and processes of CDC UP and SDLCs • Publishes specific lifecycle standards without favoring one SDLC over other SDLCs • Foster understanding of how the CDC UP & SDLCs are connected • Furthers the acceptance of the Unified Process