Federal CFO Maturity Model - IT Section_RS updated

Federal CFO Maturity Model – v4.3 December 19, 2012
1
Contents
Federal CFO Maturity Model – 9.0 Information Technology ......................................................................................................................................................................................................2
9.1 Portfolio Management...................................................................................................................................................................................................................................................2
9.2 Information Management............................................................................................................................................................................................................................................11
9.3 Data Management.......................................................................................................................................................................................................................................................15
9.4 Systems Integration.....................................................................................................................................................................................................................................................17
9.5 Compliance.................................................................................................................................................................................................................................................................19
9.6 Customer Service ........................................................................................................................................................................................................................................................21

2
Federal CFO Maturity Model – 9.0 InformationTechnology
Dimension Stage 1 Stage 2 Stage 3 Stage 4 Stage 5
Criterion Initial Managed Defined Predictable Optimized
9.1 Portfolio Management
9.1.1 Business System Alignment
to Agency Mission / Strategic
Objectives
No attempt has been made to
align to business systems with
the Agency mission. There is no
overarchingCFO/OCIO
framework for business system
development. No Business
Reference Model exists that links
the business needs to the
systems that Agency employees
are using. There is no attempt at
havingthe Chart of Accounts
reflect common business naming
convention or GL program
definition focus
Business systems arenot well
aligned with the Agency mission;
existingbusiness systems do not
supportthe production of
accurateand timely accounting
and managerial information that
the CFO needs to support the
Agency mission. The business
systems process and closethe GL
after much manual intervention
Business systems aregenerally
aligned with the Agency mission
and overall,provideaccurate,
timely and relevant data. There
may be critical information that
is not provided by the business
applications,butthe data that
are not availablein an
automated fashion is known,and
actions arebeing taken to
remedy the issue. The Business
Reference Model has been
completed, and a gap analysis
that identifies the business
needs versus existingcapabilities
is used to guide systems
development policy and funding
decisions. The Financesystem is
startingto move to a services
focus so that the fundamental
financeservices areno longer
part of a legacy ERP but actual
services, There is no
consideration of Cloud or Mobile
systems replacement
Business systems arealigned
with the Agency mission and
generally provideaccurate,
timely and relevant data. Some
non-critical information is
missing,butthe data that are
not availablein an automated
fashion is known and actions are
being taken to remedy the issue.
The Business Reference Model
has been completed, and a gap
analysisthatidentifies the
business needs versus existing
capabilities isused to guide
systems development policy and
fundingdecisions. The standard
financeservices arerunningand
the fundamentals of standard
Chart of Accounts for use across
the Agency and sub ledgers for
program distinction are
established so thatcosts,
expenses, and fundingcan be
viewed by program as well as
Department.
Business systems arewell
aligned with the Agency mission;
they provide accurate,timely
and relevant accountingand
managerial information theCFO
needs to supportthe Agency
mission. The business reference
model is defined and
maintained. The Chart of
Accounts and GL now completely
supportthese common
definitions and responsiblecost
and spend aggregation both
across Programand
organizational function... They
can be used to report on
Capabilities,Activities,
Resources, and Performers
performance for Portfolio
Management and Performance
activities to substantiate
improved government
performance
9.1.2 Enterprise Architecture
The Agency's Business Segment EA exists and meets some EA exists and is compliantwith A complete robustEA exists and A complete robustBusiness

3
EA either does not exist, or more
commonly, the EA does not meet
business user needs; non-
enterprise CUFF systems
proliferateas a result.
business user needs; new CUFF
systems are still created by
business users. EA is not used to
actively manage or control IT
investments, only to report them
to OMB through MAX
cabinetlevel and federal
requirements. EA meets much
of business user needs; new
CUFF systems are occasionally
created by business users.EAis
not actively used to determine IT
investment decisions. The
current architecturereflects the
current legacy system and is not
robustenough to be ableto
participatein a shared Financial
serviceevaluation as mandated
by OMB. There only exists a plan
for integration with procurement
and Treasury for a truly
integrated financial view.
Performance reporting a
portfolio management by
business owners is also in the
planningstage
has all required FEA PMO EA
components, is current(less than
5 years old) and meets most user
needs. Management is activein
meeting business user needs
with enterprise solutions and a
governance process exists for
evaluating,prioritizingand
executing upon requests. Only
rarely arenew non-enterprise
systems created, as the EA is
actively used when evaluating
the investment in new systems
for compliance. A Technical
solution Architecture and logical
data model existfor use as a
shared service.Integrated
procurement and performance
reporting
Segment EA exists and has all
required OMB Common
Methodology components. The
Agency Business Segment EA is
also is compliantwith the
Federal EA and overall Enterprise
EA. The Business Segment EA
document is current (less than 3
years old),and is actively used
when evaluatingnew systems
proposals for compliance. EA is
also used when redesigningor
upgradingexistingsystems. The
existence of a Technical solution
architecture, Logical Data Model,
and Transition Plan with business
cases exists and is updated on an
annual basis.
9.1.3 Business System Investment
Prioritization
There is no apparentrelationship
between business systems
investments and the fulfillment
of Agency or CFO mission.The
project selection and
prioritization process isnot
transparent.
Business systeminvestments are
generally aligned with the
Agency mission and fulfillmentof
goals and investments are
supported by analysis. The
prioritization process for
evaluation of business systems
investments may be either
unclear to participants, and/or
well-aligned with Agency mission
and support the fulfillmentof
Agency goals.Business casesare
developed, but may require
rework. Prioritization process for
prioritizinginvestment decisions
may exist, but may be overly
subjective.
The Agency's Business
Information Systems Investment
prioritization and decision
processes aredriven by thorough
analysiswith regard to strategic
objectives; the process is
transparentto Agency leaders
and program managers. There
is compliancewith most
analyzed,prioritized and
selected by the IRBbased upon
supportof strategic objectives
and Agency mission. The process
is supported by all participants
and a consensus exists among
Agency leadership thatthe
process is well-defined and high

4
lack objectivity or analytical
rigor. There arebeginnings of
lookingto add mobiledevice
solutions for field reportingbut
there will be redundant entries
until the mobilesolution proves
out.
The consideration of cloud
hostingor Mobil deviceusage is
still in a pilotstageand the
beginnings of usingserious
alternativeanalysisin business
cases to forecastoutcomes has
yet to be adopted
components of the Clinger-
Cohen Act.
Business cases havetrue
alternatives analysisand forecast
outcomes for performance
tracking. Internal finance
systems track the data and there
is a beginningmovement to start
doingmore sophisticated asset
management by trackingphysical
capital and intellectual capital so
as to truly understand the
Agency’s contributions,those
Agencies offering similar services
and creating a holistic service
enterprise view usingtechnology
at every step
functioning. Capabilities
Portfolio Management is used
and PortfolioStatis proactively
prepared and presented to assist
in the downloadingof various IT
dashboards for general viewing
by the public.As a result,
investments often yield superior
valuewhen measured against
objective criteria thatreflect an
enhanced ability to meet stated
strategic objectives. Future
compliancewith Cloud and
Mobileare anticipated and
alternativebusiness plansare
availablefor use. The impactof
Mobileon legacy replacement
and a re-provisioned workplace
will generate significant
workforce/workplace cost
savings and which arenow
obvious to most Program
Planners due to the forecasting
abilities of the Portfolio system
There is compliancewith most
components of the Clinger-
Cohen Act.

5
9.1.4 Business Cases for Business
System Investments (OMB e300)
OMB rejects the vastmajority of
business cases for rework,
providingscores ator below 3
for most e300 submissions.
Reworking business cases (OMB
e300s) to obtain a satisfactory
scorerequires significantAgency
time and resources.The OMB
examiner has a low degree of
confidence in the Agency's
business cases,as costand/or
scheduleoverruns for funded
systems are rampant. Agency
business cases areapproved and
funded in less than 50% of cases.
OMB rejects the majority of
business cases with scores below
3, which must be reworked at
significanteffortto the Agency in
pass backs.Agency processes for
business casedevelopment are
not robust,but areimproving.
The OMB examiner some degree
of confidence in business cases.
Agency business cases are
approved and funded in 60% of
all cases.
Business Cases with alternatives
analysis,new technologies,and a
services focus arebeginningto
be prepared and there is now
enough data availablewith
evidence to have only a few High
risk projects on the IT dashboard.
OMB accepts and rejects
business cases atapproximately
the same rate. Rejected business
cases arereworked at significant
effort. Internal review processes
for OMB Form e300s are
generally weak, but improving.
OMB examiner has some
confidence in initial business
cases,but has a high degree of
confidence in reworked business
cases.Agency business cases are
eventually approved and funded
70% of the time.
Portfolio management and
PortfolioStatarenow fully
embedded in the reporting
system and the performance
forecasting,the beginnings of
inter-agency cooperation,and
use of alternatives allowOMB to
accept most business cases,by
assigningscores of 4 or 5, but 3s
are occasionally given.Rejected
business cases arerefined and
improved followingOMB
guidance.OMB examiner has a
high degree of confidence in the
Agency and a good working
relationship with the CFO.
Agency business cases are
approved and funded 80% of the
time.
The Agency has now become a
leader in its servicedelivery to
the citizen and inter agency
because its business cases area
reflection of its business rules,
agency IP, and the use of
benchmarkingand analysisto
discover problems before they
occur. OMB accepts the
significantmajority of business
cases with a 4 or 5. All funds are
approved on accepted business
cases. The OMB examiner
consistently supports and
approves budget requests for
business systems. The CFO has
an excellent working relationship
with the OMB examiner and
good/collaborativerelationship
with appropriationscommittee
staff. Agency business casesare
approved and funded 90% or
more of the time. The agency
Portfolio needs to be constantly
updated and used as the
benchmark for performance
measurement.
9.1.5 Elimination of Redundant A master inventory of business A master inventory of enterprise- A master system inventory A master system inventory is A master system inventory

6
Business Systems systems and their functions does
not exist.No information exists
that identifies the level of
redundancy among business
management information
systems. The EA is siloed so it
has nothing.
level systems exists,and
significantinformation isknown
regardingbusiness system
functions. This information is
not consistentor systematically
used to pursue system
consolidation efforts. There is
no inventory of CUFF systems -
those that generally and funded
and operated by individual
offices without any central
CIO/CFO oversightor
governance.
exists,redundant systems have
been identified, and
consolidationsplanshavebeen
developed. Plans for system
consolidationsor retirements
have been routinely executed
yieldingITcostsavings for the
Agency, at no loss of
functionality for business system
end-users and at no detriment to
Agency mission. These existin
the EA and Agency business
cases havestarted to consider
these. The system portfolio also
has this data and it is beginning
to be used to begin consolidation
used to identify redundant
systems and contains significant
information that assists in the
prioritization process. TheCFO is
now takingthe lead by doing
forward planningusing
technology, workforce, and new
processes to reconfigurehow the
Agency provides services. This is
a data driven process requiring
EA, business cases,performance
forecasts,new technology like
cloud and mobile, and finally the
use of social networking,
crowdsourcing, Agency wide
challenges to antiquated
processes using better internal
financedata and the large
amounts of unstructured outside
data.
contains all businessinformation
systems. Redundancies arewell-
known and consolidation of
redundant systems is being
aggressively pursued. Business
system requirements are
centralized managed and used to
identify consolidation
opportunities.Consolidation of
IT systems for costsavings is
coordinated with system
enhancements to better meet
user needs. This is done through
the portfolio and is a refinement
of all of the planningwork done
before it.
The use of international
benchmarks put the Agency at
the top.
9.1.6 Moving to Commodity IT
and maximizing Federal Discounts
i.e. Software License and Vendor
Support Management
All procurement is done by the IT
silo and Software licenses are
not centrally managed and there
is no annual review to determine
whether or not all the licenses
being funded areactually
utilized. Significantfunctional
redundancies for licensed
products exist. Aging software
There is a movement to use
Smart Buy and other Strategic
sourcingavailableitems but
Software licenses arecentrally
managed and redundancies are
identified,but not proactively
eliminated. There is no annual
review process.Systems support
is provided,but vendor support
There is a movement across the
procurement folks to start using
Strategically sourced ITfor data
center consolidation,useof
cloud (FEDRAMP certs) and other
central Federal services provided
by GSA. Software licenses are
centrally managed and
redundancies areidentified,and
The CFO has consolidated the
procurement, performance, EA,
and other services by organizing
the data usingsemantic web
access so thatprogram folks are
talkingaboutAgency resources
and assets not justtheir silo
assets.This has allowed most
programs to provide better
The new commodity buying
team is workingwell and the
savings arebeingused by new
program services requiring
different technology and
different workforces
deployments and service
knowledge.

7
systems may no longer be
supported by vendors.
for some systems lapses prior to
the replacement of that system.
methodically eliminated often by
usingSaaS options which
eliminatemost of the classic
licensing problems.
services and the Agency to gain
costsavings by maximizing
commodity IT..
9.1.7 Business System O&M
Budget Execution
Business systems arenot
adequately budgeted for and
spendingrequirements are not
accurately assessed.
Business systems spending
requirements and budget are
generally aligned,but spending
requirements arenot accurately
assessed.
Business systems spendingand
budget are generally aligned,but
spendingrequirements are not
accurately assessed.
Systems are budgeted for and
the budget aligns with the
spendingrequired.
Systems are budgeted for and
the budget aligns with the
spendingrequired on a forward
lookingbasis.
9.1.8 Becoming a Finance Shared
Service
There is no thought of Financial
Shared Services
There is pressurefrom OMB but
there is no distinctdifference
costwise to make the move and
no pressureas longas the
Agency doesn’t try and upgrade
There is a need to upgrade the
financial systemin order to
adopt some of the new data
requirements, C of A, GL
consolidation and expanded
reporting. Fortunately the
existingsystems don’t provide
most of these new services.
The Financial services markethas
finally moved into the SaaS world
where distinctservices can be
purchased and supported
remotely. They can be tailored
by the Agency and the CFO has
petitioned OMB to become an
FMLoB usinga new SaaS
provider
The revenue from the new
services provided to other
Agencies has allowthe Agency to
set up a modern grants and
financial services center using
new technology and saved the
layoff off 550 FTEs who were
going to be fired if the Agency
had to shiftto another Agency to
use their LF LoB services
9.1.9 Business System
Requirements Management /
Change Management
Business systemrequirements
are not effectively managed.
Change Control and
Configuration Management are
weak. Highest priority systems
requirements arenot always
addressed first.
are not centrally managed, but
are managed on a system-by-
system basis for all critical
business systems.
are actively managed for each
system, but not centralized.
Change management processes
exist, areroutinely followed, but
unmanaged changes may
occasionally causeproblems.
are centrally managed,and a
governance process for change
management exists,and is
routinely followed, but
unmanaged changes may
occasionally causeproblems.
are centrally managed,and a
governance process for change
management exists,and is
strictly followed for all business
systems. They are in the EA and
accessibleto Agency.

8
9.1.10 System Security and Access
Control
Default passwords haven'tbeen
changed and no procedures exist
to prevent the use of default
passwords. No good
collaboration existsbetween the
CFO and HR, so that Systems
Administrators knowwhen
people are leaving,or getting
promoted and changingjobs,or
simply changingjobs. Inactive
accounts were not suspended.
No formal procedures existto
ensure segregation of duties to
prevent collusion and fraud (bill
paying,accounting,and
disbursing). Password controls
are poor or non-existent.
Password rotation intervals are
non-existent or not enforced.
No means exists to authenticate
callsto Agency Help Desks
(pin/security questions) to
prevent social engineering.
There are no procedures to
systemically to segregate the
duties of Agency employees who
Approve and enter Obligations,
and those employees who
approve and certify payments.
Some collaboration exists
between the CFO and HR, so that
Systems Administrators know
when people areleaving,or
getting promoted and changing
jobs,or simply changing jobs but
Inactiveaccounts arenot always
suspended. No formal
procedures existto ensure
segregation of duties to prevent
collusion and fraud (bill paying,
accounting,and disbursing).
Password controls arepoor.
Password rotation intervals exist
but arenot enforced. No means
exists to authenticate calls to
Agency Help Desks (pin/security
questions) to prevent social
engineering.
Manual procedures existto
segregate the duties of Agency
employees who Approve and
enter Obligations,and those
employees who approveand
Certify Payments. Some
collaboration existsbetween the
CFO and HR, so that Systems
Administrators knowwhen
people are leaving,or getting
promoted and changingjobs,or
simply changingjobs butinactive
accounts arenot always
suspended. Formal procedures
existto ensure segregation of
duties to prevent collusion and
fraud (bill paying,accounting,
and disbursing). Password
controls areadequate.
Password rotation intervals exist,
and are regularly enforced.
Authentication procedures exist
to authenticate callsto Agency
Help Desks (pin/security
questions) to prevent social
There are systemic procedures in
placeto segregate the duties of
Agency employees who Approve
and enter Obligations,and those
employees who approveand
certify payments. Collaboration
exists between the CFO and HR,
so that Systems Administrators
know when people are leaving,
or getting promoted and
changingjobs,or simply
changingjobs,and inactive
accounts areusually suspended
after 60 days of no account
activity. Formal procedures exist
to ensure segregation of duties
to prevent collusion and fraud
(bill paying,accounting,and
disbursing). Password controls
are excellent, password
assignmentmust meet stringent
Agency-established criteria.
Password rotation intervals exist
but arenot enforced.
Procedures exist to authenticate
Procedures exist to deny access
to undefined users or
anonymous accounts,and after
three log-on attempts
(regardless of user); HR works
with systems officeto notify of
all changes in duty status so that
appropriatesystems access is
maintained;accounts are
deactivated after 30 days of
dormancy; only information
needed to do accomplish job
duties is available;unneeded
system features and ports are
disabled prior to access. Default
passwords arereplaced;robust
password regulations are
required; user-IDs and access are
designed to prevent collusion
among business functions and
duties. Procedures existto
ensure the functions of paying
bills,approvingobligations,and
disbursingaresegregated.

9
engineering. callsto Agency Help Desks
(pin/security questions) to
prevent social engineering.
Systems Security Trainingis
required annually,and records of
trainingaremaintained by the
Security office. Inactiveaccounts
are disabled after 60 days.
Procedures allowdisabling of
system features and ports so
that users have systems access
or a purely "need-to know" basis.
A robustset of rules exists to
prevent use of default
passwords.
9.1.11 Password Rotation
No password rotation is
required; once a password has
been assigned,itremains in
place,unless the user elects to
change the password.
Some inconsistentpassword
rotation,but there is no uniform
Agency procedure for ensuring
password changes areenforced
at regular intervals.
Uniform Agency policies existto
require 180-day password
rotation.The business systems
administrator cuts off access
when a password is notchanged
after 180 days.
rotation.The business systems
administrator cuts off access,
after 90 days.
rotation.The systems
administrator cuts off access,
after 60 days.
9.1.12Deletion of Entries
The Agency business systems
allowselected users (with
"write" access) to eliminatedata
and no system rules/procedures
exists within the business
applicationsto require an audit
"write" access) to eliminatedata
and no system rules/procedures
exists within the business
applicationsto require an audit
"write" access) to
eliminate/modify data and
system rules/procedures exists
within the business applications
All the critical business
applications/modules
(Accounting, Accounts
Receivable, Accounts Payable,
Payroll,Disbursing,Travel) will
maintain a complete record copy
All the critical business
applications/modules
(Accounting, Accounts
Receivable, Accounts Payable,
Payroll,Disbursing,Travel) will
maintain a complete record copy

10
trail of all "deleted" records. trail of all "deleted" records. to requirean audittrail of all
deleted/modified records.
of all entries to remove or
modify a transaction previously
entered. All the critical business
system track every deletion, and
modified entry, and tracks,by
USER ID, date, and time, and
who performed the deletion, or
modification,as well as who
authorized the deletion or
modification.
of all entries to remove or
modify a transaction previously
entered. All the critical business
system track every deletion, and
modified entry, and tracks,by
user ID,date, and time, and who
performed the deletion, or
modification,and also who
authorized the deletion or
modification.
9.1.13 Tests of Controls
The Agency rarely,if ever,
conducts tests of controls to
check the quality/effectiveness
of system access and security
controls. Becausetests of
controls arerarely if ever
performed, weaknesses in
systems security frequently
remain undetected until there is
a security breach.
The Agency conducts periodic,
but infrequent, tests of controls
to check the
quality/effectiveness of system
access and security controls.
The Agency regularly conducts
periodic tests of controls to
check the quality/effectiveness
of system access and security
controls. Some systems access
and security control weaknesses
exist.
The Agency regularly conducts
tests of controls to check the
Few systems access and security
control weaknesses exist, and
those that do areidentified
duringthe regular tests of
controls.
The Agency frequently, and on
an un-announced basis,conducts
tests of controls to check the
Rarely do systems access and
security control weaknesses
exist, and those that do are
identified duringthe frequent
un-announced tests of controls.
9.1.14 Business System User
Communities
There are no informal or formal /
sanctioned user communities for
business systems.No formal
process drives new business
requirements to business
systems.
Ad-hoc or informal user
communities exist and identified
super-users participatein the
prioritization of business system
requirements for enhancements
or upgrades.
Formal business systemuser
communities exist and
participatein the creation and
prioritization of new
requirements for existing
systems. There are open
communication channels
communities exist and
participation in thecreation and
prioritization of new
requirements. There are open
between leadership / decision
communities exist, meeting
regularly and arean active part
in both the requirements
prioritization process for both
existingand new business
systems. There are open

11
makers and business system
users.
users.The agency promotes the
creation of new user groups to
championed new investments.
users.
9.2 Information Management
9.2.1 Data Warehouses / Data
Marts
Business data warehouseexists,
but data may be difficultto for
users to identify or extract data.
Business data warehouses exist
and are actively managed.
Standard OperatingProcedures
supportthe data warehouse user
community.
Business data warehouses exist,
are actively managed, and are
routinely enhanced as data
inputs change and mature with
maturing business systems.
Multipledata marts exist to
supportspecific user needs.
Business data warehouses exist
are actively managed and are
routinely updated as data inputs
change and mature with
maturing business systems.
Multipledata marts exist to
supportspecific user needs.
Enterprise-wide corporate data
warehouse for business
information exists,and
incorporates all businesssystem
information. The data
warehouse is maintained and
provides near-real time access
business information thatis
easily accessibleby end-user
software tools. Data marts are
created to meet specific end-
user needs.

12
9.2.2Semantic web to reference
and share data
There is littleor no use or
interest in new semantic
technologies to help sharedata
There is a beginning movement
to find technologies to assist
remote users in answering their
reporting requirements without
usingexpensive Data base
people to write data cubes at
$10,000 apiece.
Trials usingsemantic web and
meta data to increaseusability of
data across silosin EA, financial
reports and linkingfinancial data
to other areas.
CFO has authorized an
information center to provide
reports and data presentations
to assistmanagers in running
their business. Ithas become a
primary weapon in combating
Fraud, Waste,and Abuse
Agency has been cited as a
leadingInternational exampleof
how to increaseIP and corporate
knowledge while reducingcost
and increasingthe data
interoperability of the Agency
9.2.3 Software Tools
Ad-hoc reportingtools are either
unavailableor difficultto use and
do not allowfor cross-functional
access to data to create
information / insight.
Software tools areaccessible
allowfor some cross-functional
access to data to create
information / insight.
Reporting software and tools,
and underlyingdata marts
provideadequate capability to
combine information from
multiplesystems for data
synthesis and analysis... There is
a movement to SaaS providers
because of being more reliable,
less complex,and cheaper to use
Ad-hoc reportingcapability is
self-serviceand frequently used.
Personnel are trained to meet
self-servicereportingneeds. The
Agency has created a separate
reporting center becauseof all of
the different users,type of
reports, and reduced costs of
havinginteroperabledata.
Personnel have access to
integrated analysistools and
training,allowingfor advanced
statistical analysis,predictive
analytics,scenario modelingand
“Monte Carlo”simulations all
through the independent
information and reporting
center. Clients are switching
serviceproviders becauseof the
simplicity and completeness of
the agency’s reports

13
9.2.4 Ad-hoc and User Support
Personnel usually download data
for manipulation in offlinetools
as software and applicationsdo
not meet most users’needs.
Personnel occasionally need to
download data for manipulation
into offlinetools.
Advanced reporting needs are
provided by dedicated resources;
requests are frequently met, but
take time to execute. There is a
growing awareness of the need
to providebetter project
management, particularly with
scareresources.
provided by dedicated resources
with necessary skillsand
knowledge to fulfill reporting
needs in a timely manner.
There is better visualization and
integrated projectmanagement
tools to better track trends and
project/programcost/schedule.
Can also beused to more
effectively use scarce/expensive
resources on multipleprojects
provided by dedicated resources
with necessary skillsand
knowledge to fulfill reporting
needs in a timely manner.
Personnel proactively propose
value-added services. .
The establishmentof an
independent data reporting
center providingdata,tools,and
data feeds into performance,
project management, workforce
needs, and management reports
has both reduced costand
improved report provisioning
from weeks to hours
9.2.4 User Needs for Business
Information (Report Quality)
Standard reports meet minimum
user needs.
Reports meet user needs for
segmented business areas;
reports cannotbe run that
combine data from multiple
business system.
Reports meet user needs and ad-
hoc reports are easily generated
by the system end-user.
Reports meet user needs, are
widely trusted and used, and are
delivered on-time.
Reports meet user needs, are
widely trusted and used, and are
delivered on-time; near real-time
data are availablefor
appropriateinformation. CoP
and CoI mobilegroups formed to
specify required data to better
manage. Migrate away from
transactional systems to
manufacture usagedata that
doesn’t exist.

14

15
9.3 Data Management
9.3.1 Data quality & Integrity
Data quality and integrity is low.
Data is often inaccurate,
incomplete, out-of-date,
irrelevantand untrustworthy.
Data quality is marginal.Data
contains frequent errors and is
occasionally incomplete. Data
updates laguser demands.
Data quality in business systems
is good. Data is rarely
incomplete, but data may lag
user demands. Data is relevant
and trustworthy.
Data quality is high;data is
accurate,correct, timely,
relevant and complete. Data is
trustworthy.
Data quality is superior. Data is
accurate,correct, timely,
relevant, and complete. Data
are readily understood by
business systemusers.
9.3.2 Data Issue Management
The organization either is
incapableor chooses notto
respond to user demands for
improvements in data quality
and integrity.
The organization has limited
capabilities to respond to data
issues,butsome effort is made
to address data quality and
accuracy in a reactivemanner.
Root causes arenot always
identified.
The organization has dedicated
personnel who respond to data
issues reactively.Rootcauses are
identified and sources of critical
data issueareaddressed.
The organization has dedicated
personnel, who are
knowledgeable and responsive
for data quality within business
systems. Root causes are
identified and addressed.
Lessons learned are noted and
applied to future issues.
The organization has a formal
data governance policy
administered by a dedicated
staff/office.Knowledgeable
personnel proactively manage
and monitor data quality and
integrity across businesssystem.
Personnel are proactively
monitoringdata quality and
integrity and working with
business user groups and system
developers to better meet
customer needs.
9.3.3 Continuity of Operations
Planning
Continuity of Operations Plan
does not exist, in violation of
federal regulations
exists,but the effectiveness is
unknown as itis not routinely
tested or updated.
exists,and tests are haphazardly
scheduled. Plan executions are
may fail in certain areas,and
may be addressed.
exists,tests areroutinely
executed at regularly scheduled
intervals and lessonslearned are
applied.Weaknesses are
corrected immediately upon
receipt of test results.
exists,and is tested for
effectiveness at leastannually.
The results of planned tests are
positiveand lessons learned lead
to changes in the Continuity of
Operations Plan.

16
9.3 Data Management
9.3.4 Data Dictionaries for
Business Systems
Business systemdata
dictionaries do not exist,or are
not availableto end-users.
Business systemdata
dictionaries exist,butmay be out
of date. System users may not
know of their existence.
Business systemdata
dictionaries exist,and actively
used. There is no integrated
change control on common data
elements.
Business systemdata
dictionaries existareactively
used and actively maintained by
users.Integrated change control
processes existand are used
more often than not. They also
now contain business rules and
are used by the EA repository
Business systemdata
dictionaries areup-to-date,
accessibleto all users, and
reflective of state of maturity of
business systems. Identifies all
common data element, identifies
the common data elements
owner and a system for
integrated change control to
update the element in all
systems.

17
9.4 Systems Integration
9.4.1 Accounting and Business
System Integration
Accounting system is not
integrated with business
systems, which includegrants,
payroll,fixed assets,
procurement and travel.
Business systems arestove
piped, as an EA does not exist.
Integration projects are difficult
to execute.
Accounting system is integrated
with select business systems,
includingpayroll or
procurement. Business systems
are stove piped, as an EA does
not exist.Existingintegrations
were difficultto complete.
Accounting system is partially
systems, includingsome,but not
all of payroll,procurement,
grants,fixed assets and travel.
EA exists and is used to guide
future business system
integration projects.
Accounting system is partially
systems, includingsome,but not
all of payroll,procurement,
grants,fixed assets and travel.
EA exists and is used to guide
future business system
integration projects.
Accounting is fully integrated
with business systems,including
payroll,procurement, grants
management, fixed assets, and
travel. As new requirements for
existingsystems are defined,
business systems interfaces are
adapted to accommodate to
changingand modernizing
systems. EA as well as an
integrated change control
process existto ensure that
system changes are properly
planned for across business
systems.
9.4.2 Business System Integration
with External Systems
EA does not accountfor external
systems interfaces. Accounting
system is integrated with
required external systems:
Treasury SPS, IPAC, CCR,
FPDSNG; interfaces files arenot
well monitored and there may
be significanterror in interfaced
files.Responsiblepersonnel are
either slowto correct, or do not
know how to correct.
EA does not accountfor external
systems interfaces. Accounting
system is integrated with
required system. Procedures for
interface management may be
documented, but few people
know how to use the external
systems and there are few, if
any, alternates.
EA accounts for external
interfaces.Interfaces are
monitored and SOPs existfor
processingfiles. Human capital
planningensures there are
adequate personnel backups for
responsiblepersonnel.
processingfiles. Procedures
address how to correct data
exceptions and errors,but may
need to seek outside assistance.
Human capital planningensures
there are adequate personnel
backups for responsible
personnel.
processingfiles. Procedures
address how to correct data
exceptions and errors without
external assistance.Human
capital planningensures there
are adequate personnel backups
for responsiblepersonnel.

18
9.4.3 Agency Apps Store
There is no recognized need for
an Applications database
storefront (Apps Store) for
consumers and other agency
customers to
purchase/download the mobile
apps needed to accelerate
transaction processingand
updates
There is limited recognition of
the need and requirement, but
it’s not our job.
Some private sector firms have
created limited function apps
forcing the Agency to respond
Apps store applicationshave
become a major web presence
for inspections,codechanges
and survey interpretations and
are becoming more integrated
into servicedelivery
Apps Store has become a lineof
business and this Agency is a
primary supplier to the rest of
the Federal government
9.4.4 Report Generation
Department doesn’t respond to
new reports or changes to old
ones becausethey take time,
money, littleused, and are a
burden on IT
With the advent of Mobile
devices and agiledevelopment
some ITfolks are experimenting
with developing custom report
presentation on tablets for
executives.
Tablet use has greatly expanded
by agency managers and this
‘after hours’report creation is
worse than in the early stages of
mainframes as a productivity
drain (“forget about what you
are workingon I need this
tomorrow”)
-A partof the customer service
lab agileworkshops areheld that
allowrapid prototypingof a
report or “solution”within a
week. It has become the biggest
activity by volume and request
and the customer satisfaction
has never been higher
This servicehas morphed into a

19
9.5 Compliance
9.5.1 Business System Compliance
/ Certification and Accreditation
(CnA)
Business systems arenot
compliantwith all applicable
federal laws and regulations. IG
and GAO auditfindings from
system audits routinely identify
non-complianceissues,which
are addressed,but not
systematically.
Business systems comply with
most current Federal laws and
regulations;IGand GAO findings
consistently identify non-
compliance,and incremental
progress is made towards
achievingcompliance.
most current federal laws and
regulations. System
enhancements or replacements
are either in process,or planned
and budgeted for to meet these
regulations.
most current federal laws and
regulations.System
enhancements or replacements
to address IGor GAO audit
findings areplanned for and
prioritized,but may not always
be achieved in a timely manner.
Business systems areinitially
certified and accredited (CnA).
Startingto use GSA provided
tools likeFEDRAMP for cloud
certification
Business systems arenearly
always compliantwith current
federal laws and regulations,
such as FISIO,FISMA and CFO
Act. CFO monitors developments
in laws and regulations to
proactively address required
system changes with systems
upgrades, enhancements or
replacement well in advanceof
required changes.Business
systems are certified and
accredited; certification and
accreditation process is
periodically completed prior to
expiration of accreditations.

20
9.5.2 Compliance with OMB A
series (A-123, A 130, …
There is littleattention to OMB
dictates as they areunfunded
mandates and there is little
budgetary impactby ignoring
them
There is a growing awareness by
agency management that
compliancewith the A series can
be helpful in keeping the Agency
off the front pages and actually
helpful in steering new programs
in a better direction.
Management has become
believers in lookingatthe
requirements of the new GPRA
and A-123 for internal controls
because they spell outthe
changes that need to be made in
order for the Agency to become
more efficient and effective in
citizen servicedelivery or
warfighter missions. The
compliancecan be paid for in the
savings provided by the newer
technology which properly
applied make the new controls
“profitable”
Agency is becoming a leader in
“profitablecompliance”and
havingtrouble keeping career
people because they are in great
demand by agencies tryingto
catch up
Agency again is winning
international awards,keeping off
the front page, and making
money from its new compliance
and GPRA How to do it Center.
This center was set up to instruct
federal FTEs and Contractors on
the data required, the systems
modifications and a series of
installation and inspection teams
to come on siteto make it
happen.

21
9.6 Customer Service
9.6.1 Customer Service / Support
for Business System Users
Standards for responsetime are
not clear or established;high
degree of customer
dissatisfaction;60%customer
satisfaction.
Calls areanswered promptly;
mistakes arefrequently made,
and multiplecalls areneeded to
make progress toward
resolution.Customer satisfaction
is 70%.
Calls areanswered promptly;
one call typically resolves the
issue;the customer satisfaction
rate is above 80%.
Efficient help desk operations
exist. Callsand emails are
promptly addressed. Customer’s
satisfaction rates are85-95%,
but customer servicefunction is
not efficient. Staff is not
optimized based upon
performance standards for
efficiency in the process.
There is a high degree of
efficiency in customer service
and standards for supporting
each system at each tier level are
set. There is a clear escalation
process and callsareanswered
promptly within the established
standards of performance.
Customer satisfaction rateis 95%
or better.
9.6.2 Customer Service Labs
No idea of what they are or how
to usethem
Realizethat they are falling
behind becauseevery systems
improvement is a “one off” so
that there is always a struggleto
implement something new and a
fall off on customer satisfaction
which affects ratings,funding,
and general employee moral
Recognition that this is an “inside
job” that can’t be delivered by
contractors or faked. Made a
decision to establish a customer
lab to evaluate “a day in the life”
and create a demonstration of
the art of the possible
Build the lab and started
gathering data on customer
experience which they
published,put into their EA, and
used to train customer service
personnel. Programs adopted
the data to generate changes in
current servicing and used it to
expand programs.
Agency management used it to
help directmission needs and
train people
Customer Labs are now key to all
Mobileserviceofferings and very
helpful for inspections or audits
because they can be simulated in
the lab before executed which
provides better grades.

22
9.7 New Social Technologies
9.7.1 Social Media Applications
There is no tolerancefor new
ideas,applications,or processes.
“Legacy systems and data have
gotten us this far,and will
continue to serve us”
Experiments with social media
likeTwitter and Facebook are
being done in random and un
coordinated fashion
Facebook is beingused as a small
marketing experiment to see if
some customer loyalty can be
improved. Crowd sourcing
experiments arebeing done to
see if Financecan’timprove on
integratingand data provisioning
to performance and compliance
efforts by polingremote users,
customers and agency alumni
Department of Social Media is
established to centralizethe
packaging,providecompliance
and legal oversighteasily,and to
providea better audiencefor dry
runs before production runs.
Usage of Twitter scans to
indicatepatterns and unforeseen
issuedevelopment are used by
managers all the time to double
check ideas and validatecurrent
thinking. Much cheaper than
Gallop poll contracts.
This Agency is up to date and has
the lowest entry employee
refusal rateand the highest
transfer request rate becauseof
social media. Being firstin
anyone’s poll of federal Agencies
is no longer sought but expected
because of its obviously modern
approach. Incidentally the
Agency is also on the never
investigated by GAO because it
has adopted modern tools and
procedures across theentire
Agency, led by the CFO.
9.7.2 Social Media Data
We only use data created from
our legacy transactional system
Big Data,GeoSpatial co-
coordinating,and other
unstructured sources arebeing
looked at but current storage
costs prohibitany sizable
undertakings.
Social Media data pushed the
agency over the edge on relying
solely on data warehouse/marts
for data storage. There was so
much data being created by the
rest of the government, citizens,
regulatory/compliance,
procurement sources,etc that
they had to focus on better
management and stop reliance
solely on relational technology.
This led to a better performing
data provisioningwith higher
volumes at the same cost.
The social Media data system
was moved to the customer
supportcenter/lab and began to
analyzea great deal of Agency
related data that they no longer
had to purchasefrom numerous
data suppliers and they were
ableto create their own data
services which became a no cost
serviceto agency clients on key
serviceforecasts which were of a
governmental nature and
couldn’t be supplied by the
privatesector
The new social media services
coupled with other Agency data
became as popular as NASA
spacephotos becauseof their
focus and statistical reliability.
These products forced Congress
to reassess their mission and to
acceleratetheir development.

23

Federal CFO Maturity Model - IT Section_RS updated

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Federal CFO Maturity Model - IT Section_RS updated

Similar to Federal CFO Maturity Model - IT Section_RS updated (20)

Federal CFO Maturity Model - IT Section_RS updated