NUREG-1908 Volume 4, United States Nuclear Regulatory Commission Information Technology Information Management Strategic Plan Fiscal Years 2020-2024
| ML19323D858 | |
| Person / Time | |
|---|---|
| Issue date: | 11/30/2019 |
| From: | Basia Sall NRC/OCIO |
| To: | |
| Malone, Tina | |
| References | |
| NUREG-1908 V4 | |
| Download: ML19323D858 (25) | |
Text
i l P a g e i
Information Technology Information Management Strategic Plan Fiscal Years 2020-2024
AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material As of November 1999, you may electronically access NUREG-series publications and other NRC records at the NRCs Library at www.nrc.gov/reading-rm.html. Publicly released records include, to name a few, NUREG-series publications; Federal Register notices; applicant, licensee, and vendor documents and correspondence; NRC correspondence and internal memoranda; bulletins and information notices; inspection and investigative reports; licensee event reports; and Commission papers and their attachments.
NRC publications in the NUREG series, NRC regulations, and Title 10, Energy, in the Code of Federal Regulations may also be purchased from one of these two sources:
- 1. The Superintendent of Documents U.S. Government Publishing Office Washington, DC 20402-0001 Internet: www.bookstore.gpo.gov Telephone: (202) 512-1800 Fax: (202) 512-2104
- 2. The National Technical Information Service 5301 Shawnee Road Alexandria, VA 22312-0002 Internet: www.ntis.gov 1-800-553-6847 or, locally, (703) 605-6000 A single copy of each NRC draft report for comment is available free, to the extent of supply, upon written request as follows:
Address: U.S. Nuclear Regulatory Commission
Office of Administration Multimedia, Graphics, and Storage &
Distribution Branch Washington, DC 20555-0001 E-mail: distribution.resource@nrc.gov Facsimile: (301) 415-2289 Some publications in the NUREG series that are posted at the NRCs Web site address www.nrc.gov/reading-rm/
doc-collections/nuregs are updated periodically and may differ from the last printed version. Although references to material found on a Web site bear the date the material was accessed, the material available on the date cited may subsequently be removed from the site.
Non-NRC Reference Material Documents available from public and special technical libraries include all open literature items, such as books, journal articles, transactions, Federal Register notices, Federal and State legislation, and congressional reports.
Such documents as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings may be purchased from their sponsoring organization.
Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at The NRC Technical Library Two White Flint North 11545 Rockville Pike Rockville, MD 20852-2738 These standards are available in the library for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from American National Standards Institute 11 West 42nd Street New York, NY 10036-8002 Internet: www.ansi.org (212) 642-4900 Legally binding regulatory requirements are stated only in laws; NRC regulations; licenses, including technical specifications; or orders, not in NUREG-series publications.
The views expressed in contractor prepared publications in this series are not necessarily those of the NRC.
The NUREG series comprises (1) technical and administrative reports and books prepared by the staff (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX),
(2) proceedings of conferences (NUREG/CP-XXXX),
(3) reports resulting from international agreements (NUREG/IA-XXXX),(4) brochures (NUREG/BR-XXXX), and (5) compilations of legal decisions and orders of the Commission and the Atomic and Safety Licensing Boards and of Directors decisions under Section 2.206 of the NRCs regulations (NUREG-0750).
DISCLAIMER: This report was prepared as an account of work sponsored by an agency of the U.S. Government.
Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third partys use, or the results of such use, of any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.
Information Technology Information Management Strategic Plan Fiscal Years 2020-2024 Manuscript Completed: November 2019 Date Published: November 2019 Prepared by: B. Sall Office of the Chief Information Officer NUREG -1908, Vol. 4
ABSTRACT The U.S. Nuclear Regulatory Commissions (NRCs) Information Technology/Information Management (IT/IM) Strategic Plan for fiscal years 20202024 describes how the agency will leverage IT/IM goals, objectives, and strategies to support and enable the NRC mission. The IT/IM Strategic Plan responds as part of Title 44 of the Code of Federal Regulations, Section 3506(b)(2), and the Clinger-Cohen Act of 1996. The Office of the Chief Information Officer is required to develop and maintain an information resources management strategic plan. The plan lays out the mission and vision for the agencys IT/IM efforts and establishes three goals along with associated objectives and strategies. This plan provides the technology and strategic guidance that informs and supports the agencys budget formulation and prioritization processes over the next 4 years.
P a g e l iii
TABLE OF CONTENTS ABSTRACT....................................................................................................... iii EXECUTIVE
SUMMARY
.................................................................................. vii MESSAGE FROM THE CHIEF INFORMATION OFFICER............................... ix INTRODUCTION............................................................................................... 1 LOOKING TOWARD THE FUTURE.................................................................. 2 IT/IM GOALS, OBJECTIVES AND STRATEGIES............................................. 3 ACRONYMS......................................................................................................xi P a g e l v
EXECUTIVE
SUMMARY
The U.S Nuclear Regulatory Commission (NRC) has updated its Information Technology/Information Management (IT/IM) Strategic Plan for fiscal years 20202024. The IT/IM Strategic Plan describes how the current plans support the NRCs Strategic Plan: Fiscal Years 20182022. The NRCs Strategic Plan states, Information technology developments in an increasingly mobile society will impact the agencys operations. NRC will need to take advantage of technology to enable an effective and efficient work environment. It is essential to maintain a reasonable balance between the need to maximize technological innovation to perform our mission and the secure use and protection of sensitive and proprietary information. The NRC needs to be aware of the heightened risk that sensitive information held by the agency or its licensees could be lost, misplaced, or intercepted and obtained by unauthorized users. The agency will need to develop and maintain a knowledgeable workforce capable of addressing both these technology and security challenges. This statement is the main influence in the development of the IT/IM Strategic Plan Framework. In addition, the Presidents Management Agenda, which outlines cross-agency priority goals, was leveraged to ensure that the NRC implements the long-term vision for modernizing the Federal Government.
P a g e l vii
MESSAGE FROM THE CHIEF INFORMATION OFFICER I am pleased to present this update to the U.S. Nuclear Regulatory Commissions (NRCs) Information Technology (IT)/Information Management (/IM) Strategic Plan. The objective of the NRCs IT/IM Strategic Plan Framework is make it easier for the NRC staff to get the right information to the right people at the right time while enabling and supporting the NRCs mission: The NRC licenses and regulates the Nations civilian use of radioactive materials to provide reasonable assurance of adequate protection of public health and safety and to promote the common defense and security and to protect the environment.
The IT/IM Strategic Plan Framework includes three goals: to empower, serve, and protect.
The NRC developed these goals with a view to the future to ensure that it develops staff and processes that are agile and allow for innovation to manage an ever-changing IT/IM environment. At a high level, the goals aspire to (1) entrust a highly engaged IT/IM staff to effectively partner with business counterparts and customers, (2) deliver effective and efficient IT/IM services that meet customer needs, and (3) safeguard the agencys information and IT assets by detecting, protecting, and responding to events.
As the NRCs Chief Information Officer, I am accountable for the agencys IT/IM programs, the scope of which extends to every NRC office and affects both internal and external stakeholders. The NRC workforce strives to maintain an open and transparent partnership with our stakeholders and to ensure responsiveness to data and business needs. The right-sized IT/IM capabilities and resources, in alignment with the agencys mission priorities, provide a path to the future.
David Nelson Chief Information Officer U.S. Nuclear Regulatory Commission P a g e l ix
ACRONYMS CAP cross-agency priority CISA Cybersecurity and Infrastructure Security Agency DHS U.S. Department of Homeland Security ESP empower, serve, and protect GAO Government Accountability Office IG Inspector General IM information management IT information technology NIST National Institute of Standards and Technology NRC U.S. Nuclear Regulatory Commission OCIO Office of the Chief Information Officer PMA Presidents Management Agenda P a g e l xi
INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC) Information Technology (IT)/Information Management (IM) Strategic Plan supports the agencys mission to license and regulate the Nations civilian use of radioactive materials to protect public health and safely, promote the common defense and security, and protect the environment. Although the current NRC Strategic Plan does not outline corporate support goals, it does reference the need to provide a technology foundation that is mobile, innovative, and secure.
The NRCs Office of the Chief Information Officer (OCIO) has four main functions: (1) plan, direct, manage, and implement the delivery of centralized IT infrastructure, applications, and IM services, (2) provide principal advice and assistance to the agencys senior executives to ensure that the NRC selects and manages IT/IM resources in a manner that maximizes their value, (3) provide oversight of the NRCs IT portfolio to ensure compliance with the requirements imposed by the Federal Information Technology Acquisition Reform Act of 2014, the Clinger-Cohen Act of 1996, and the Federal Information Security Modernization Act of 2014, and (4) provide authoritative assistance, consultation, and guidance to the agencys senior management in the areas of computer security and compliance. To support the OCIO functions, the framework was developed to guide the people and the processes to achieve success. This framework includes the IT/IM mission, vision, goals, objectives, and strategies that feed into the IT/IM Enterprise Roadmap and Performance Measures.
The NRC designed the IT/IM mission and vision to support the foundations of the framework by keeping them at the forefront to ensure that the staff knows what it should accomplish at a high level (mission) and what it should aspire to (vision) every day.
NRC IT/IM Mission
- Provide IT/IM services to support the NRCs critical safety and security mission.
NRC IT/IM Vision
- Deliver modern, high-quality IT/IM services.
P a g e l 1
One of the guiding documents in the preparation of the framework is the Presidents Management Agenda (PMA). The PMA states that it lays out a long-term vision for modernizing the Federal Government in key areas that will improve the ability of agencies to deliver mission outcomes, provide excellent service and effectively steward taxpayer dollars on behalf of the American people. By leveraging the PMA, the NRC developed the framework to incorporate the three PMA cross-agency priority (CAP) goals that are the key drivers of transformation:
(1) to modernize IT to increase productivity and security (CAP Goal 1)
(2) to leverage data as strategic assets (CAP Goal 2)
(3) to develop a workforce for the 21st century (CAP Goal 3)
From the PMA LOOKING TOWARD THE FUTURE The NRC continues to build an agile and innovative IT/IM environment to incorporate advancements in IT/IM. The following future opportunities will keep the momentum moving forward to achieve a right-sized footprint:
a continued focus on cybersecurity enhancements implementation of mobility tools that take advantage of enhanced wireless and fifth-generation infrastructure an increased use of Big Data to inform risks and actions quickly the adoption of more cloud services and shared services to minimize the Government-owned and -managed data center footprint In support of the agency, the IT/IM Strategic Plan Framework has defined the mission, vision, goals, objectives, and strategies as a guide to empower, serve, and protect (ESP). The framework will be incorporated into the day-to-day work to ensure that the path outlined in this document is transformative. Using this framework in conjunction with the NRCs Leadership Model and FranklinCoveys Speed of Trust will give the staff a foundation on which to implement the modern NRC IT/IM services and solutions of the future.
P a g e l 2
IT/IM GOALS, OBJECTIVES AND STRATEGIES The agency constructed the IT/IM Strategic Plan Framework to reflect the ever-changing environment of IT and IM. As the development of the framework unfolded, it was clear that it needed to be flexible and agile with the rapid development of new technologies throughout the Federal Government and the changes in the nuclear industry as a whole.
The development of the NRC IT/IM Strategic Plan incorporated work from several other documents, including, but not limited to, the following:
NRC Strategic Plan: Fiscal Year 20182022 (link)
Presidents Management Agenda: Modernizing Government for the 21st Century (link)
NRC Leadership Model (link) various internal NRC executive-level presentations, including Commission briefings agencywide analysis of staff strengths, weaknesses, opportunities, and threats At a high level, the framework goals will be the main source of reference within the agency.
The acronym ESP will help the staff remember the guiding goals and outcomes that should influence how day-to-day IT/IM business is accomplished.
Empower
- GOAL: Entrust a highly engaged IT/IM staff to effectively partner with business counterparts and customers.
- OUTCOME: The IT/IM staff embraces clear roles and responsibilities.
Establish valued business partnerships across the agency that demonstrate shared trust while empowering ownership.
Serve
- GOAL: Deliver effective and efficient IT/IM services that meet customer needs.
- OUTCOME: Focus on customer service to continuously improve all aspects of service management practices, including communication, responsiveness, and service delivery. Increase service uptime while offering additional streamlined and modern capabilities.
Protect
- GOAL: Safeguard the agency's information and IT assets by detecting, protecting, and responding to events.
- OUTCOME: Establish an awareness of cybersecurity risk and knowledge; strengthen policies, processes, and controls; and implement effective governance.
P a g e l 3
STRATEGIC GOAL 1: EMPOWER The first IT/IM Strategic Goal is to empower. Embracing its roles and responsibilities will enable the staff to establish valuable business partnerships across the agency and demonstrate trust and leadership skills.
Objectives and Strategies The NRC developed the overview of the objectives and strategies below to support the goal of empower. The goal will entrust a highly engaged IT/IM staff to effectively partner with business counterparts and customers.
1.1 Incorporate ownership and leverage trust with IT/IM staff to deliver and implement innovative solutions to increase agencywide productivity and agility:
Establish and own clear organizational and service roles and responsibilities.
Leverage the NRC Leadership Model, focusing on PREDICT characteristics.
Build and demonstrate trust to gain confidence through consistency, communication, and integrity.
1.2 Build valued business partnerships that provide IT/IM solutions:
Collaborate internally and externally to develop relationships across the agency.
Provide partnership outreach to meet the needs of offices and the agency.
1.3 Transform the delivery of IT/IM services through receptivity to new ideas, adaptability, and diversity of thought:
Develop communication methods that are responsive to the level of need.
Leverage the NRC Leadership Model to spur innovation.
Support continuous development of the staffs external awareness.
The NRC has two agencywide initiatives that lend their support to implementing this goal.
First is the NRC Leadership Model. This model communicates how we individually and collectively demonstrate leadership. It outlines seven leadership characteristics using the acronym PREDICT:
(1)
Participative Decisionmaking (2)
Receptivity to New Ideas and Thinking (3)
Empowerment and Shared Leadership (4)
Diversity in Thought (5)
Innovation and Risk Tolerance (6)
Collaboration (7)
Teamwork As the staff begins to embrace the PREDICT characteristics, the level of empowerment rises.
The other initiative currently in place is FranklinCoveys Speed of Trust. As stated in the FranklinCovey workshops, Trust means confidence. This program begins with a series of Goal 1: Empower The IT/IM staff embraces clear roles and responsibilities.
Establish valued business partnerships across the agency that demonstrate shared trust while empowering ownership.
P a g e l 4
workshops designed to provide opportunities for strengthening mutual trust among agency leaders, supervisors, and staff. As trust is built, it increases the speed and quality of the work while reducing costs.
Leveraging these two initiatives along with clearly outlining expectations to IT/IM staff will provide the environment necessary for the staff to demonstrate empowerment.
STRATEGIC GOAL 2: SERVE The second IT/IM Strategic Goal is to serve. Much of the NRCs IT/IM work focuses on customer service. Developing governance to support processes and procedures will benefit the entire agency by removing ambiguity. Currently, the NRC is merging all IT/IM acquisitions into a more streamlined and defined process to allow the staff to provide customer service that is responsive and timely.
As technology progresses at a quicker rate, the NRC must ensure that its foundation it designed to respond to changing environments.
Objectives and Strategies The NRC developed the overview of the objectives and strategies below to support the goal of serve. The goal will deliver effective and efficient IT/IM services that meet customer needs.
2.1 Develop and deliver an IT/IM service portfolio that is right sized:
Ensure that the staff performs day-to-day duties successfully to build a foundation to respond to emergent needs.
Deliver high-quality project planning to customers.
Provide end-to-end services.
2.2 Leverage a proactive approach to service that is responsive to customer needs in an efficient and effective manner:
Improve IT process tools and communications.
Respond to potential issues via a vetted process to deliver timely solutions.
Provide end-to-end services.
2.3 Strive to improve customer experience:
Actively seek feedback and examine performance.
Build a culture to encourage constructive feedback on improvements to processes.
Provide end-to-end services.
To improve IT/IM customer service, the NRC did the following:
restructured the organization to align with the agencys IT/IM service demands shifted to enterprisewide IT/IM contracts to deliver effective and agile IT/IM services Goal 2: Serve Focus on customer service to continuously improve all aspects of service management practices, including communication, responsiveness, and service delivery. Increase service uptime while offering additional streamlined and modern capabilities.
P a g e l 5
modernized legacy IT and adopted cost-neutral or cost-minimal shared, cloud, and third-party-managed services to facilitate long-term cost savings Providing quality end-to-end services that improve the customer experience will offer an environment that serves customers and ensures that the IT/IM staff has a path to success.
STRATEGIC GOAL 3: PROTECT The third IT/IM Strategic Goal is to protect. The three main areas of focus under this goal are to detect, protect, and respond.
Ensuring that NRC staff and contractors are educated will increase awareness and strengthen policies and procedures.
Objectives and Strategies The NRC developed the overview of the objectives and strategies below to support the goal of protect. The goal will safeguard the agencys information and IT assets by detecting, protecting, and responding to events.
3.1 Continue to improve the way we protect information assets:
Partner with peer organizations to coordinate and improve programs (e.g., the U.S. Department of Homeland Security (DHS)/Cybersecurity and Infrastructure Security Agency (CISA)/Government Accountability Office (GAO)/Inspector General (IG)/National Institute of Standards and Technology (NIST)).
Evaluate tools and programs to inform, adapt, and improve the NRCs information security posture.
Educate customers on good security practices and known threats.
3.2 Practice risk-informed decisionmaking to provide protection while supporting the effectiveness and efficiency of the mission.
Continuously review and improve processes to achieve efficiencies.
Leverage data to drive decisions.
Assess, identify, and mitigate agency risks with internal and external counterparts.
3.3 Educate system users and business owners to understand their roles in detecting, protecting, and responding to events.
Provide training programs.
Communicate change management programs.
Deliver briefing reports to inform decisionmakers.
Identifying opportunities to improve security and reliability while modernizing is important.
These opportunities include a continued focus on security at every level. The NRC is a leader among Federal cybersecurity programs; it is modernizing security toolsets while implementing cloud/shared services and device refreshes and more cloud opportunities for standard industry services that reduce significant internally provided infrastructure.
Goal 3: Protect Establish an awareness of cybersecurity risk and knowledge; strengthen policies, processes, and controls; and implement effective governance.
P a g e l 6
Overall NRC IT/IM Strategic Plan Framework Goal 1: Empower Entrust a highly engaged IT/IM staff to effectively partner with business counterparts and customers.
Goal 2: Serve Deliver effective and efficient IT/IM services that meet customer needs.
Goal 3: Protect Safeguard agency information and IT assets by detecting, protecting, and responding to events.
Outcome Goal 1: The IT/IM staff embraces clear roles and responsibilities. Establish valued business partnerships across the agency that demonstrate shared trust while empowering ownership.
Outcome Goal 2: Focus on customer service to continuously improve all aspects of service management practices, including communication, responsiveness, and service delivery. Increase service uptime while offering additional streamlined and modern capabilities.
Outcome Goal 3: Establish an awareness of cybersecurity risk and knowledge; strengthen policies, processes, and controls; and implement effective governance.
OBJECTIVES and STRATEGIES 1.1 Incorporate ownership and leverage trust with IT/IM staff to deliver and implement innovative solutions to increase agencywide productivity and agility:
Establish and own clear organizational and service roles and responsibilities.
Leverage the NRC Leadership Model, focusing on PREDICT characteristics.
Build and demonstrate trust to gain confidence through consistency, communication, and integrity.
2.1 Develop and deliver an IT/IM service portfolio that is right sized:
Ensure that the staff performs day-to-day duties successfully to build a foundation to respond to emergent needs.
Deliver high-quality project planning to customers.
Provide end-to-end services.
3.1 Continue to improve the way we protect information assets:
Partner with peer organizations to coordinate and improve programs (e.g., DHS, CISA, GAO, IG, NIST).
Evaluate tools and programs to inform, adapt, and improve the NRCs information security posture.
Educate customers on good security practices and known threats.
1.2 Build valued business partnerships that provide IT/IM solutions:
Collaborate internally and externally to develop relationships across the agency.
Provide partnership outreach to meet the needs of offices and the agency.
2.2 Leverage a proactive approach to service that is responsive to customer needs in an efficient and effective manner:
Improve IT process tools and communications.
Respond to potential issues via a vetted process to deliver timely solutions.
Provide end-to-end services.
3.2 Practice risk-informed decisionmaking to provide protection while supporting the effectiveness and efficiency of the mission:
Continuously review and improve processes to achieve efficiencies.
Leverage data to drive decisions.
Assess, identify, and mitigate agency risks with internal and external counterparts.
1.3 Transform the delivery of IT/IM services through receptivity to new ideas, adaptability, and diversity of thought:
Develop communication methods that are responsive to the level of need.
Leverage the NRC Leadership Model to spur innovation.
Support continuous development of the staffs external awareness.
2.3 Strive to improve customer experience:
Actively seek feedback and examine performance.
Build a culture to encourage constructive feedback on improvements to processes.
Provide end-to-end services.
3.3 Educate system users and business owners to understand their roles in detecting, protecting, and responding to events:
Provide training programs.
Communicate change management programs.
Deliver briefing reports to inform decisionmakers.
P a g e l 7
BIBLIOGRAPHIC DATA SHEET (See instructions on the reverse)
NRC FORM 335 (12-2010)
NRCMD 3.7 U.S. NUCLEAR REGULATORY COMMISSION
- 1. REPORT NUMBER (Assigned by NRC, Add Vol., Supp., Rev.,
and Addendum Numbers, if any.)
- 3. DATE REPORT PUBLISHED MONTH YEAR
- 5. AUTHOR(S)
- 6. TYPE OF REPORT
- 7. PERIOD COVERED (Inclusive Dates)
- 8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U. S. Nuclear Regulatory Commission, and mailing address; if contractor, provide name and mailing address.)
- 9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type "Same as above", if contractor, provide NRC Division, Office or Region, U. S. Nuclear Regulatory Commission, and mailing address.)
- 10. SUPPLEMENTARY NOTES
- 12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report.)
- 14. SECURITY CLASSIFICATION
- 13. AVAILABILITY STATEMENT unlimited (This Page) unclassified (This Report) unclassified
- 15. NUMBER OF PAGES
- 16. PRICE NRC FORM 335 (12-2010)
NUREG-1908, Volume 4
- 2. TITLE AND SUBTITLE United States Nuclear Regulatory Commission Information Technology Information Management Strategic Plan Fiscal Years 2020-2024 November 2019 Basia Sall Senior Information Technology Specialist FY 2020 - FY 2024 Governance and Enterprise Management Services Division Office of Chief Information Officer U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Same as above This IT/IM Strategic Plan supersedes NUREG-1908, Volume 3
- 11. ABSTRACT (200 words or less)
The U.S. Nuclear Regulatory Commissions (NRCs) Information Technology/Information Management (IT/IM) Strategic Plan for fiscal years 20202024 describes how the agency will leverage IT/IM goals, objectives, and strategies to support and enable the NRC mission. The IT/IM Strategic Plan responds as part of Title 44 of the Code of Federal Regulations, Section 3506(b)(2), and the Clinger Cohen Act of 1996. The Office of the Chief Information Officer is required to develop and maintain an information resources management strategic plan. The plan lays out the mission and vision for the agencys IT/IM efforts and establishes three goals along with associated objectives and strategies. This plan provides the technology and strategic guidance that informs and supports the agencys budget formulation and prioritization processes over the next 4 years.
IT/IM Strategic Plan, information technology, information management, goals, strategies, Information Resource Management Plan, IRM, IT, IM, Enterprise Architecture, governance, budget
UNITED STATES NUCLEAR REGULATORY COMMISSION NUREG -1908, Vol. 4 November 2019
NUREG -1908, Vol. 4 United States Nuclear Regulatory Commission Information Technology Information Management Strategic Plan Fiscal Years 2020-2024 November 2019