Commonwealth AITR Communications Exchange

1. Commonwealth AITR Communications Exchange Lem Stewart CIO of the Commonwealth Commonwealth AITR Meeting October 23, 2006 expect the best www.vita.virginia.gov expect the best 1

2. Welcome! Our agenda Your questions • From last meeting • Service escalation • Federal cost allocation • 2007 legislative initiatives • IT Infrastructure Partnership • Procurement • Standard infrastructure practices • Open Q&A/discussion • Improving communications expect the best

3. Your questions expect the best www.vita.virginia.gov expect the best 3

4. Questions from September • Parking lot • Improving communications (Today) • Service escalation process (Today) • Enterprise Applications PPEA (defer to future) • Individual questions • Pat Wilson, Dept. of Correctional Education, procurement issue with battery backup • Sanford Hostetter, follow-up on metrics/SLAs for DMHRMRSAS • All, sharing names of Customer Advisory Council (now Partnership Advisory Council) expect the best

5. Service escalation process Question • How do I escalate critical service problems when the normal VITA processes aren’t working? Answer • Our first priority is to resolve IT emergencies as quickly as possible • If the normal processes aren’t working, you can follow an escalation path expect the best

6. Service escalation process • Critical incidents should be assigned a ticket number by the VITA Customer Care Center (804) 786-3932 or 1-866-637-8482 • Contact your Customer Account Manager (CAM) • CAM Director Debbie Secor and Service Management Director Fred Duball • IT Investment & Enterprise Solutions Director Jerry Simonoff • CIO of the Commonwealth Lem Stewart expect the best

7. CAMs Mary Davis-Barton (804) 371-0628 office (804) 559-2453 cell (804) 263-1232 home mary.davis-barton@vita.virginia.gov Bobby Keener (804) 652-7293 cell (804) 304-1171 home bobby.keener@vita.virginia.gov Linda Smithson (804) 343-9053 office (804) 614-0639 cell (757) 259-7959 home linda.smithson@vita.virginia.gov Anne Wingfield (804) 371-5620 office (804) 400-0722 cell (804) 320-2113 home anne.wingfield@vita.virginia.gov Debbie Secor CAM Director (804) 343-9049 office (804) 652-5705 cell (703) 362-2196 home Fred Duball SMO Director (804) 343-9026 office (804) 283-6479 cell Jerry Simonoff ITIES Director (804) 343-9001 office (804) 840-9265 cell Lem Stewart CIO of the Commonwealth (804) 343-9002 office (804) 363-9644 cell Service escalation contacts expect the best

8. Federal cost allocation Question • I hope we can get an update relating to agencies who receive federal funding and recent communications from HHS to agencies in the Commonwealth. Question • Does this [letter] mean that we can not charge the Federal Government the VITA Fee but need to pay it from the general fund? expect the best

9. VITA’s Services Charges - Background • Internal Service Fund agency • Budget is the fees VITA collects • Rates are approved by ITIB & JLARC • Security • Project management • E-911 • GIS (pending ISF July 2007) • Direct Bill: charged from its inception in 2003 until July 2006 expect the best

10. VITA’s Service Charge Evolution • Agency Services: From Direct Bill, VITA began charging in July 2006 • Consistent vs. discretionary budgeting philosophy • Based upon each agencies’ historic IT spending • Transitional step • Enterprise Shared Services: 2007-2008 • Based on service usage • Customers choose service levels • Consistent service levels at consistent costs expect the best

11. Federal Cost Allocation VITA’s response to HHS • “Considering in your judgment we only appear non-compliant, that you and your colleagues in the various federal offices hold in abeyance any action on your September 29 letter for 60-90 days. That will give us time to work with you and our agencies on acceptable alternatives or modification. It will also avoid any interruption of federal and state program services since we will be unable to provide such services without revenue to support them.” • VITA convened a group of 6-8 seasoned agency financial officers to assist in crafting a new solution. • VITA plans to bring in an experienced and objective third party to help guide the development of a new plan. expect the best

12. Legislative initiatives expect the best www.vita.virginia.gov expect the best 12

13. Legislative initiatives Question • I would like to know what issues VITA will pursue during the next General Assembly.  Are there any Code changes or additions VITA will push? Answer • VITA has not submitted any legislation through the executive branch review process. At present, VITA has no plans to present any agency legislation in the 2007 Session. expect the best

14. IT Infrastructure Partnership expect the best www.vita.virginia.gov expect the best 14

15. IT Infrastructure Partnership Question • Can we get an update on the IT partnership? Question • Several months ago at a general meeting preparing for the NG transition, mention was made of 10 or more technology tower areas that would be involved. Is there an update to the status on this? Can VITA provide a list of milestone dates when centralized services will be initiated? expect the best

16. Infrastructure Partnership Update Fred Duball and Joe Fay Program Directors October 23, 2006Agency Information Technology Resource Communications Meeting

17. The IT Infrastructure Partnership Program is a multi-year, multi-phase effort to stabilize, optimize and transform the people, processes and technologies for IT infrastructure services that support citizen services A well-ordered introduction of services to VITA’s customers

18. Stabilize • Completed • Established the Operations Working Group • Built Root Cause Analysis (RCA) process, completed 28 RCAs • Bolstered operations organization with project, communications, and change management personnel • Held four in-scope manager Q&A calls • Disseminated and implemented 10 standard infrastructure practices • Published Central Operations Quality of Service (QoS) Report • Started collection of customer agency facing metrics • Implemented fixes to correct central operations Yellow and Red metrics • Planned • 10/16 -11/8 - 10 regional NG new employee training meetings • 10/31 – Complete evaluation of infrastructure against CIS Configuration Standards • 11/15 - In-scope manager off-site – management team alignment • 11/30 – Build process for flowing information on vital service interruptions • 11/30 - Build Emergency Operations IT support plan • 12/15 – Include all customer agency facing metrics in the QoS Report • Early 2007 – Consolidate service support contracts

19. Transition Challenges • Move Operations from primarily distributed/agency-focused model to centrally-focused model • Description • Effort now primarily performed in agency buildings and focused on agency support • Eventually move help desk, break/fix, server, network, security monitoring, e-mail to the Commonwealth Enterprise Solutions Center (CESC) and the Southwest Enterprise Solutions Center (SWESC) and focus on enterprise support • Near-term efforts • Moved East and West regions to geographic model, Capital region will move in early 2007 • Accelerating interim help desk consolidation • Accelerating move of customer agencies to interim, existing single e-mail • Gain better understanding customer satisfaction at the agency level • Description • Currently getting informal, ad hoc comments • No overall view of agency satisfaction • Near-term efforts • Started collection of agency facing metrics, first report December 2006 • Customer Account Managers (CAMs) providing agency satisfaction assessment • Customer agency survey planned for early 2007

20. Initial, Notional Order for Help Desk and Desktop Transformation

21. IT Infrastructure Services

22. Central Operations Measures * Current measure assumes all initial calls can be resolved immediately; beginning Oct 06 and per industry standard, basis will consider resolvable versus all calls

23. Baseline Agency Measures(Sep 06)

24. Incidents • Since service commencement: • 8,674 total incidents, 74 critical • 28 RCAs prepared and corrective action identified • Significant incidents for period: • 7/6, 12 Hours, VDOT: Poorly written script caused all employees to not be able to access applications • 7/9, 7 Hours, VDOT: Improper Raid Array configuration caused VDOT website to go down when a drive failed • 7/23, 32 Hours, VEC: Improper server restart after maintenance caused the VEC website to go down • 7/25, 6 Hours, VDEM: Antivirus software upgrade caused external e-mails to not be passed to VDEM • 8/8, DSS, DMV, VRS: A file storage parameter was improperly changed in Jan 06 causing permanent file deletion after 180 days • 9/2, 80 Hours, DGIF: Verizon circuit failure caused DGIF website to be unavailable to the public

25. 40+ separate help desks 20 incident management systems Limited call metrics Desk side agency support centric Multiple manufactures and support models 40+ email systems 40+ Global Address Lists Unsecured Messaging Enterprise help desk Single Incident management system Established call metrics Regionalized management services Standard systems, centralized software delivery, remote support Centralized messaging system Single Global address list Secure Messaging End User Services Transition To Be As Is Desktop & asset mgmt system operational (1/1/07) SWESC Staffed and trained (1/1/08) Complete Desktop Refresh 90% (3/1/09) Single Statewide Address List (4/1/07) Complete Desktop Refresh 50% (3/1/08) Incident Mgmt. Web Accessible (8/1/06) End User Services Transition Knowledge Mgt. System Operational 10/1/06 DNS / WINS Infrastructure (8/1/07) Enterprise messaging 90% complete (6/1/09) Incident Mgmt System / SPOC Help Desk (SWESC) (7/1/08) Begin Desktop Refresh (3/1/07) 2006 2007 2008 2009 • Notes: • SWESC – Southwest Enterprise Solutions Center, Russell County • SPOC – Single Point of Contact Help Desk solution

26. End User Services Status and Progress

27. Data Center Services Transition To Be As Is Tape Automation Complete (3/1/08) • 3000+ servers 75% distributed throughout agencies • 3 mainframes located at RPB and VDACs • Minimal performance monitoring • Disaster recovery within 72 Hours • No standard server tools or processes • Multiple point storage solutions • Remote high volume print operations • Manual operations and tape management CESC Ready for Occupancy (7/1/07) • Consolidated storage servers and tape • 75% centralized versus agency based server location • Enterprise monitoring performance data • 24 Hour disaster recovery • Centralized operations and printing • Automated tape processing and operations Server consolidation 90% complete (6/1/09) SWESC Ready For Occupancy (11/1/07) Server consolidation 65% complete (8/1/08) Infrastructure Ops Center - Interim (11/1/06) Data Center Services Transition RPB Server consolidation in-place (4/1/07) Mainframe Print Consolidated (6/1/08) Mainframe / server workload migration from RPB to CESC (1/1/08) Server consolidation 25% complete (11/1/07) 2006 2007 2008 2009 • Notes: • CESC – Commonwealth Enterprise Solutions Center, Chesterfield County • SWESC – Southwest Enterprise Solutions Center, Russell County • RPB – Richmond Plaza Building Data Center

28. Data Center Services Status and Progress

29. Network Services Transition To Be As Is 75% LAN Migration (10/1/09) • Agency Centric Approach to Network Design, Management Operations • Network Solution Not Scalable • Varying Levels of Network Technology • Multiple Connections (85+) to the Internet • IP Address Duplication Across Agencies • Frame Relay / ATM Network Enterprise NOC (11/107) • Enterprise-Managed Single Multi-Service Network • Centralized Network Operations Center • Reliable, Scalable and Secure Network Infrastructure • Converged Communications (e.g., VoIP, QoS, MPLS / VPN) • Increased Performance and SLAs • Consolidated Internet Connections and WAN Links Connectivity to CESC (7/1/07) 45% LAN Migration (4/1/08) Temporary NOC (11/1/06) Network Services Transition Architecture Blueprint and Network Addressing Plan 2/1/07 60% LAN Migration (7/1/08) MPLS Core Established (9/1/07) Complete LAN Migration (1/1/09) Connectivity to SWESC (11/1/07) 2006 2007 2008 2009 • Notes: • NOC – Network Operations Center

30. Network Services Status and Progress

31. Security Services Transition To Be As Is ESOC transitional (11/1/07) • 85 or More Internet Entrances to Defend to Varying Degrees, 40+ intrusion detection systems • Various Levels of Security Monitoring • Various Levels of Security incident Response • No Enterprise Wide View of IT Security Status • No Central Management of Enterprise Security Environment • Two Internet Gateways, Strongly Defended • 24x7 Enterprise Security Posture • Centralized Highly Trained Incident Response Team • Enterprise Security Dashboard Governance, Operational Control • Centralized Management, Standardized Enterprise Security Protection Enterprise Vulnerability Assessment Program Operational (3/1/08) Interim Security Incident Tracking and Management System (10/1/06) CSIRC System Detailed Design Complete (5/15/07) Security Services Transition Certification & Accreditation Planning Document (9/30/06) CSIRC complete (3/1/08) ESOC System Detailed Design Complete (6/1/07) Transitional ESOC Design Complete (1/15/07) ESOC complete (6/1/08) 2006 2007 2008 2009 • Notes: • CSIRC – Computer Security Incident Response Center • ESOC – Enterprise Security Operations Center

32. Security Services Status and Progress

33. IV&V • CACI concluded its initial review and delivered its formal report 8/31 – assessed ITP as maturity level 2 (Repeatable) • ITP could be expected to achieve level 3 (Defined) in next 8-12 months • 180 positive findings, 138 minor negative • ITP action plan to sustain positive findings and address minor negative findings: • Evolve senior management teams, committees and forums with respective charters and prioritized processes • Document and communicate those prioritized processes • Establish consistent work methods producing artifacts and evidence of the processes and their outputs • First follow-up review by CACI scheduled Nov 27 – Dec 14

34. Procurement expect the best www.vita.virginia.gov expect the best 34

35. Procurement Question • Could you spend a little more time on what plans VITA has to improve the current procurement process? Question • It appears that the new VITA processing is adding 3 to 6 weeks to expected delivery times; this is not very convenient but is probably adequate for many situations. There will be some situations though when we need goods and services much quicker than that - will there be an emergency process through VITA to get goods & services when we need them in a pinch or can we get waivers to procure and be reimbursed by VITA ? expect the best

36. Procurement Question • The IT goods and services commodity code listing provides a good start to determine items as in-scope, or out-of-scope. However, there are still questions for special situations, certain items not listed, or listing discrepancies, or a new category now identified when things may be in-scope for VITA but out of scope for Northrop Grumman. There continues to be a level of confusion at the agency level and perhaps also at VITA and NG. Can you provide guidance on how these items can be categorized? expect the best

37. Background • Since service commencement, there’s a combined NG and eVA procurement process • There are new standards based on transformation • There are three pathways for obtaining items/services: Procurement, requests for special services and TSR • There has been a backlog buildup

38. Why are Purchase Requests Taking So Long to Process? • NG process added to eVA process – the process is more complex • Lack of standard IT items and services across the environment • Until recently, lack of clarity around definition of standards

39. What is Being Done to Speed Up the Process? • Senior members of VITA’s and Northrop Grumman’s technical team conduct weekly “Burn Down” sessions. • If a PR does not contain all of the required information, rather than deny it and make the user start over, it will be turned over to VITA APM (Agency Performance Manager), who will work with you to capture the necessary information. • Standards are being developed that will assist in speeding up the review process by reducing requests for non-standard items. • Additional clarity is being sought around in-/out-of- scope services

40. What Have We Accomplished? • One-time mass approval of PRs to reduce the backlog • “Burn Down” sessions to address non-standard requests • Documented the Technical Review process to ensure understanding of responsibilities • Modified criteria for denial of PRs and enlisted the aid of APMs to obtain missing information • Have established transformation standards for some of the towers. Should have all of the standards defined by the end of November. • Developed initial communication for eVA buyers and AITRs

41. What Problems Are We Still Encountering? • Lack of understanding of what information must be included on the PR • Business justification around … • Agency need • NG-VITA contractual obligation • Determination of timing related to transformation • Current vendor and or contract number if PR is for a renewal • New workstations – what is the current agency standard in addition to what features are required • Overall lack of understanding of the transformation strategy and how that impacts the procurement of goods and services today • SLDs/APMs need more information to assist the agency personnel and to coordinate the solutioning process prior to submission of the PR

42. What if there’s a Need for an Emergency Procurement? • Contact your SLD • SLD will contact their RSDs to see if other options are available • RSDs will contact NG Procurement for next steps

43. What Can You Do To Help? • As they are released, become familiar with the transformation strategy and schedule, and plan purchases accordingly • As they are released, become familiar with the transformation standards and work with your agency to plan your procurements around these standards • Realize purchases that don’t correspond to the transformation strategy may not have positive return on investment • Provide detailed business requirements versus requests for specific manufacturer equipment • Provide detailed justification of the business requirements • Be open to the technical solution we provide • Be patient with requests for non-standard items/services • Provide continuous feedback

44. What’s Next? • Joint VITA - Northrop Grumman weekly review of outstanding Purchase Requests • Establish a steering committee to provide direction and monitor progress • Implement revised process that will expedite the technical review process • Communicate to the SLDs and the agency the eVA PR criteria and the transformation standards • Communicate Transformation Plan and Schedule to Agency personnel • Implement reporting metrics and track trends • Report progress to VITA and Northrop Grumman management

45. In-Scope Out-of-Scope Questions • Cable plant issues (in state building / non-state building) • In-Scope = outside the wall • Out-of-Scope = inside the wall • MS Office products – software. Will VITA cover the cost of licenses? Are there in-scope / out-of-scope components • In-Scope • Agency specific application software. Are there in-scope / out-of-scope components? • In-Scope = DBMS (Oracle, Sequel Server) • Out-of-Scope = everything else • Video Teleconferencing Equipment • Out-of-Scope

46. In-Scope Out-of-Scope Questions • Closed Circuit TV’s • Out-of-Scope • Voice Over IP (VoIP) telephony • In-Scope • Units utilizing adaptive technology. Are there in-scope / out-of-scope components? • Units supporting for profit business activities, are there in-scope / out-of-scope components? • Units supporting general public customer (not agency staff) direct use, with / or without agency specific software. Are there in-scope / out-of-scope components?

47. Standard infrastructure practices expect the best www.vita.virginia.gov expect the best 47

48. Standard infrastructure practices Question • VITA recently communicated some standard infrastructure practices to technical staff. What are they and what’s changing? expect the best

49. Standard infrastructure practices • Purpose: Ensure basic infrastructure practices are being followed enterprise wide • Detailed description of Practices sent out to the field through Management Chain - Sept 21 • Compliance Tracking sheet will be sent back up through Management Chain – Tracking sheet consists of checkboxes for compliance, working on compliance, exceptions. • Response due Oct 27 • Have allowed exceptions, will address those exceptions to determine if we can assist agencies reach compliance. expect the best

50. Standard infrastructure practices Production server backup daily Rotate backup tapes Change user passwords every 90 days Admin passwords restrictions Load OS patches monthly or as directed Distribute virus patches daily Test 2 server restores yearly Default passwords removed from network monitoring accounts Document RAID configuration Firewall on laptop - recommended expect the best