The above-mentioned rules are being amended to: revise the requirements associated with the different project levels based on the risk and complexity assessment; update the AST-F-0505B Status Report form to ensure it captures information necessary ...

 

AGENCY FOR STATE TECHNOLOGY

RULE NOS.:RULE TITLES:

74-1.001Purpose and Applicability; Definitions

74-1.003Initiation

74-1.004Planning

74-1.005Execution

74-1.006Monitoring and Controlling

74-1.007Closeout

74-1.009Agency for State Technology (AST) Oversight

PURPOSE AND EFFECT: The above-mentioned rules are being amended to: revise the requirements associated with the different project levels based on the risk and complexity assessment; update the AST-F-0505B Status Report form to ensure it captures information necessary to efficiently report project status information; provide clarification regarding project oversight requirements contained in Rule 74-1.009; F.A.C., and; update definitions consistent with these changes.

SUMMARY: The proposed rulemaking updates the Florida Information Technology Project Management and Oversight Standards to provide greater clarity regarding project management and standards that state agencies must comply with when implementing information technology projects.

SUMMARY OF STATEMENT OF ESTIMATED REGULATORY COSTS AND LEGISLATIVE RATIFICATION: The Agency has determined that this will not have an adverse impact on small business or likely increase directly or indirectly regulatory costs in excess of $200,000 in the aggregate within one year after the implementation of the rule. A SERC has not been prepared by the Agency. The Agency has determined that the proposed rule is not expected to require legislative ratification based on the statement of estimated regulatory costs or if no SERC is required, the information expressly relied upon and described herein: the economic review conducted by the Agency.

Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.

RULEMAKING AUTHORITY: 282.0051(18) FS.

LAW IMPLEMENTED: 282.0051(3) and (15) FS.

A HEARING WILL BE HELD AT THE DATE, TIME AND PLACE SHOWN BELOW:

DATE AND TIME: May 9, 2016, 2:00 p.m.

PLACE: First District Court of Appeal, 2000 Drayton Drive, Room 1183, Tallahassee, Florida 32399

Pursuant to the provisions of the Americans with Disabilities Act, any person requiring special accommodations or persons who require translation services is asked to advise the agency at least five days before the workshop/meeting by contacting:  Lisa Hopkins at [phone] or at [e-mail]. If you are hearing or speech impaired, please contact the agency using the Florida Relay Service, 1(800)955-8771 (TDD) or 1(800)955-8770 (voice).

THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Lisa Hopkins at [phone] or at [e-mail]

 

THE FULL TEXT OF THE PROPOSED RULE IS:

 

74-1.001 Purpose and Applicability; Definitions.

(1) Purpose and Applicability

(a) Rules 74-1.001, F.A.C., through 74-1.009, F.A.C., will be known as the Florida Information Technology Project Management and Oversight Standards. These rules include two separate sets of requirements - project management standards defined in Rules 74-1.001, F.A.C., through 74-1.008, F.A.C., and Agency for State Technology (AST) project oversight requirements defined in Rule 74-1.009, F.A.C.

(b) This Rule establishes project management standards when implementing information technology (IT) projects. These standards are documented in Rule 74-1.001, F.A.C., through 74-1.008, F.A.C. State Agencies must comply with these standards when implementing all IT projects., and, pursuant to Section 282.0051(15)(a), F.S, Cabinet Agencies must comply with these standards when implementing adopt the standards contained in Rule 74-1.001, F.A.C., through 74-1.008, F.A.C., for IT projects that have a total cost of $25 million or more and that impact one or more other agencies. For all other IT projects, Cabinet Agencies are required to either adopt these standards or adopt alternative standards based on best practices and industry standards. (See 282.00515, F.S.). These standards are documented in Rule 74-1.001, F.A.C., through 74-1.008, F.A.C.

1. Operations and Maintenance (O&M) activities that support an existing product or service to keep it in conformance with its originally intended specifications, functionality, and service levels are exempt from these standards. O& M activities include:

a. Adaptive Maintenance - the modification of a product, performed after delivery, to keep a product usable in a changed or changing environment.

b. Corrective Maintenance - the reactive modification of a product performed after delivery to correct discovered problems.

c. Perfective Maintenance - the modification of a product after delivery to detect and correct latent faults in the product before they are manifested as failures.

d. Preventive Maintenance - the modification of a product after delivery to detect and correct latent faults in the product before they become operational faults.

The terms above originate from the International Organization for Standardization standard No.: ISO/IEC 14764:2006, which may be found at: https://www.iso.org/obp/ui/#iso:std:iso-iec:14764:ed-2:v1:en.

O&M activities include, but are not limited to, break-fix actions, routine software upgrades, and network component replacements.

2. through 4. No change.

(2) Definitions.

(a) The following terms are defined:

1. through 25. No change.

26. Project Management Plan or Project Plan - The document that describes how the project will be executed, monitored, and controlled. Definition from: A Guide to the Project Management Body of Knowledge (PMBOK Guide) 5th Edition. Newtown Square, PA: Project Management Institute, 2013.

27. through 39. No Change.

40. Variance – a calculated value that illustrates how far (positive or negative) a projection has deviated when measured against documented estimates within a project plan as defined in Section 282.0041(27), F.S.

4140. Work Breakdown Structure (WBS) - A hierarchical decomposition of the total scope of work to be carried out by the project team to accomplish the project objectives and create the required deliverables. Definition from: A Guide to the Project Management Body of Knowledge (PMBOK Guide) 5th Edition. Newtown Square, PA: Project Management Institute, 2013. The WBS is a framework for overall planning and is the basis for dividing work into definable increments from which schedule, cost, and scope can be defined.

4241. Work Package – The work defined at the lowest level of the work breakdown structure for which cost and duration can be estimated and managed. Definition from: A Guide to the Project Management Body of Knowledge (PMBOK Guide) 5th Edition. Newtown Square, Pa: Project Management Institute, 2013.

(b) No change.

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.00515, FS. History-New 7-16-15. Amended             .

 

74-1.003 Initiation.

(1) through (2) No change.

(3) The following matrix lists Initation phase activities and documents required for the project based on its R&C Category as determined by the Pre-Charter R&C Assessment.

(4) If an individual document listed in the matrix below is not required for a given R&C Category, the Agency is still expected to conduct the planning activity and summarize the results in the Project Charter.

(4)(5) Specific document types, templates, or formats are not prescribed – any project documentation that contains the information specified in the requirements below is acceptable. 

 

INITIATION PHASE - Requirements by Risk & Complexity Category
	4	3		2	1
Pre-Charter Risk and Complexity (R&C) Assessment	Required

	4	3		2	1
Business Case and Alternative Analysis	Required – Articulate a clear path to a return on investment (ROI) or business value in instances where a positive ROI is not present. Demonstrate a clear understanding of the processes, costs, strengths, and weaknesses of the Agency’s current business process. Document, identify, and analyze potential solutions. Provide a compelling argument for implementation and examine benefits and risks associated with the recommended course of action as well as not taking the action.			Required - Provide a brief justification for the project in the Project Charter by answering the questions: Why is the project necessary?  What problem is being solved?

	4	3		2	1
Cost Benefit Analysis	Required - Document the economic feasibility of the alternatives being considered including the planned project costs, as well as each of the tangible benefits, and then calculate key financial performance metrics such as ROI and payback period.			Required - Include a brief discussion of any cost savings or cost avoidance expected, if applicable, in the Project Charter.

	4	3		2	1
Project Charter	Required - Document the project description and high level objectives; scope / out of scope; initial estimates for budget, duration, and work effort; assumptions / constraints; and initial risks. Identify the project manager, stakeholders and anticipated project resources.

	4	3		2	1
Centralized Project Repository	Required - Establish a centralized project repository to house and archive all project documentation. This repository should be documented in project planning materials.

	4	3		2	1
PMP® Certified Project Manager	Required - The Project Manager must be PMP® certified.			Not Required

	4	3		2	1
Risk Manager	Recommended -Appointment of a Risk Manager, other than the Project Manager.	Not Required

	4	3		2	1
Independent Verification and Validation (IV&V)	Recommended - Employ Independent Verification and Validation (IV&V).			Not Required
	4		3	2		1
Initiation Gate R&C Assessment	Required

 

 

INITIATION PHASE	Risk & Complexity Category
Documentation or Activity	Requirements	4	3	2	1
Business Case and Alternative Analysis	Articulate a clear path to a return on investment (ROI) or business value in instances where a positive ROI is not present. Demonstrate a clear understanding of the processes, costs, strengths, and weaknesses of the Agency’s current business process. Document, identify, and analyze potential solutions. Provide a compelling argument for implementation and examine benefits and risks associated with the recommended course of action as well as not taking the action.	Required	Required	Preparation of a Business Case and Alternatives Analysis is not required; however, the planning in this area must be included in the Project Charter.	Preparation of a Business Case and Alternatives Analysis is not required; however, the planning in this area must be included in the Project Charter.
Cost Benefit Analysis	Document the economic feasibility of the alternatives being considered including the planned project costs, as well as each of the tangible benefits, and then calculate key financial performance metrics such as ROI and payback period.	Required	Required	Preparation of a Cost Benefit Analysis is not required; however, the planning in this area must be included in the Project Charter.	Preparation of a Cost Benefit Analysis is not required; however, the planning in this area must be included in the Project Charter.
Project Charter	Document and formally communicate the existence of the project; appoint the project manager; identify the stakeholders and the project governance framework; authorize the expenditure of resources; establish the initial budget, schedule, and scope. This will serve as the basis for detailed planning.	Required	Required	Required	Required
Centralized Project Repository	Establish a centralized project repository to house and archive all project documentation. This repository should be documented in project planning materials.	Required	Required	Required	Required
Project Manager	The Project Manager must be PMP® certified.	Required	Required	Not Required	Not Required
Risk Manager	Appointment of a Risk Manager, other than the Project Manager.	Recommended	Not Required	Not Required	Not Required
Independent Verification and Validation (IV&V)	Employ Independent Verification and Validation (IV&V).	Recommended	Recommended	Not Required	Not Required

 

(5)(6) The Agency must complete the Initiation Gate R&C Assessment (see 74-1.002, F.A.C. - Risk and Complexity Assessment). This Assessment will confirm or adjust the project’s risk and complexity levels and the resulting R&C Category, validate Initiation management control requirements, and set management control requirements for the subsequent Planning phase.

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.0041, 282.0051, FS. History-New 7-16-15. Amended             .

 

74-1.004 Planning.

(1) No change.

(2) The following matrix lists planning activities and documents required for the project based on the project’s Risk and Complexity (R&C) Category.

(a) Specific document types, templates, or formats are not prescribed – any project documentation that contains the information specified in the requirements below is acceptable.

(2)(b) No change.

(3) If an individual document listed in the matrix below is not required for a given R&C Category, the Agency is still expected to conduct the planning activity and summarize the results in the Project Plan Summary.

 

 

PLANNING PHASE - Requirements by Risk & Complexity Category
	4	3	2	1
Project Scope	Required - Clearly delineate the project scope, specifically what is in scope, what is out of scope, project objectives, and deliverables.  This will determine scope baselines and variances. Discuss how the project scope and objectives trace back through the Project Charter to initial project documents such as the Schedule IV-B.   Document the approach for project execution (identify the Software Development Life Cycle model that will be used – such as Agile, waterfall, etc.)  Identify assumptions and constraints.			Required - Summarize the project scope (in scope and out of scope).
	4	3	2	1
Work Breakdown Structure (WBS)	Required - The hierarchical and incremental decomposition of the project into phases, deliverables, and work packages. Identifies all the tasks required to deliver the total project scope of work to produce each deliverable. Tasks must be decomposed into subtasks until they can be estimated, observed, and evaluated.		Not Required
	4	3	2	1
Project Organizational and Governance Structure	Required - A representation of the project from an organizational perspective. Include an organization chart with stakeholder and governance structures identified. Include a detailed description of the project and the Agency’s governance process with roles, responsibilities, and approval authorities identified for project documents or artifacts, including any processes for final product acceptance. Include reporting and escalation parameters for variances in baseline schedule, cost, and scope.		Required - Identify the project stakeholders and the responsibilities for decision-making and escalation.
	4	3	2	1
Resource Plan	Required - Document the resources required to complete the project and how these resources will be acquired. For human resources – identify project roles, skills, number, and resource type required, and specify the method(s) for acquiring new personnel or incorporating and backfilling the current responsibilities of existing personnel. For equipment or materials- identify types, quantities, and purpose, and specify the method(s) for acquiring equipment or materials.		Recommended:  List the number and type of resources anticipated and what, if any, resources must be procured.
	4	3	2	1
Schedule Management Plan	Required - Document the approach to create an integrated master schedule that encompasses the total scope of the project and identifies the projects critical path.  Describe the process for establishing and changing the schedule baseline. Describe the responsibilities, timeframes, and methods to manage, update and report progress (including Earned Value Analysis) throughout the project.		Recommended - Document the approach to create an integrated master schedule that encompasses the total scope of the project and identifies the projects critical path.
	4	3	2	1
Project Schedule	Required - Develop and maintain an integrated master project schedule that identifies the total project scope of work (including milestones and deliverables); is task, resource, and cost loaded; identifies the project critical path, is baselined and updated with project progress; and contains the information necessary to provide earned value analysis and support schedule and cost performance index (SPI and CPI) variance analysis and reporting.		Required - Develop, and maintain a schedule that identifies the total project scope of work, assigned resources, and task start and end dates.
	4	3	2	1
Project Budget	Required - Develop and maintain a Project Budget, which must include specific fiscal year cost totals over the life of the project and the overall total cost of the project. Also include a description of the funding source(s) for the Project and a breakdown of the Project costs by major expense categories.		Required –Develop and maintain a Project Budget, which must include specific fiscal year cost totals over the life of the project and the overall total cost of the project.
	4	3	2	1
Project Spending Plan	Required - Develop and maintain a Project Spending Plan, which, as a component of the Project Budget, must include monthly planned (baselined) and actual expenditures (by expenditure or expenditure category) for each fiscal year.		Required - Document current fiscal year planned expenditures and actual expenditures by month and Fiscal Year total to date.  Include other expenditure detail as required for the Project Status Report.	Recommended - Document current fiscal year planned expenditures and actual expenditures by month and Fiscal Year total to date.
	4	3	2	1
Communications Management Plan	Required - Identify the project information requirements of stakeholders and detail what, when, and how information will be collected and reported. This will include the responsibility, frequency, format, and distribution method for meeting summaries, project status reports, project governance meetings, and stakeholder communications, including reporting variances in schedule, cost, or scope and emerging risks or issues. Include documentation for Decision Tracking and Action Item Tracking (see Rule 74-1.006, F.A.C. - Monitoring and Controlling).		Required - Identify the project information requirements of stakeholders and detail what, when, and how information will be collected and reported.
	4	3	2	1
Change Management Plan	Required - Document the change control process and documentation involved in identifying, analyzing impacts, escalating, approving, and managing project change requests related to the project’s schedule, cost, or scope baselines, or a change to project deliverables (see Rule 74-1.006, F.A.C. - Monitoring and Controlling).
	4	3	2	1
Quality Management Plan	Required - Document the processes and procedures for ensuring quality planning, quality assurance, and quality control are all conducted.		Required - Document any method(s) for ensuring customer acceptance of the product or service.
	4	3	2	1
Deliverable Acceptance Plan	Required - Document each deliverable, the acceptance criteria for each deliverable, and the deliverable acceptance process (including roles and responsibilities).		Required - List the deliverables and the person(s) responsible for approving deliverables.
	4	3	2	1
Risk Management Plan	Required - Document the process for the descriptive identification (listing), evaluation (probability and impact), prioritization, and response to risks (specified mitigation strategies for each risk), as well as the nature of any time sensitivity to risks that may impact the project. Identify the roles and responsibilities of individuals assigned to risks. Identify and document the process to be used for tracking, periodic review, and update of Risks (see Rule 74-1.006, F.A.C. - Monitoring and Controlling).			Required - Describe the method for monitoring and controlling risk.
	4	3	2	1
Issue Management Plan	Required - Document the process for (and the documentation of) the identification, evaluation, prioritization, management, and resolution to issues impacting the project. Identify and document the process to be used for tracking, periodic review, and update of Issues (see Rule 74-1.006, F.A.C. - Monitoring and Controlling). Identify the roles and responsibilities of project staff.			Required - Describe the method for monitoring and addressing issues.
	4	3	2	1
Procurement Management Plan	Required - If procurement is required by the project, document any products or services needed, identify the specific products and services to be purchased, along with the appropriate purchasing methods, rules, and statutes affecting these activities.		Required - List any procurements required for the project.
	4	3	2	1
Organizational Change Management Plan	Required - Assess and document the impact of delivering the project’s products to the user organization and individual users; the readiness of the user organization and individual users to accept those changes; and identify, describe, and plan the action necessary to facilitate those changes.		Required - Document the impact of delivering the projects products to the user organization and the individual users.	Recommended – Document the impact of delivering the projects products to the user organization and the individual users.
	4	3	2	1
Florida Cybersecurity Standards	Required – Compliance with Rule Chapter 74-2, F.A.C.
	4	3	2	1
Requirements Traceability Matrix (RTM)	Required - Prepare a document (usually a table) that links high-level design and requirements with detailed requirements, detailed design, test plan, and test cases. The RTM ensures that all requirements are identified and correctly linked (from high-level to detailed and technical levels) throughout the project.			Required - Document Requirements.
Planning Gate R&C Assessment	Required

 

 

PLANNING PHASE		Risk & Complexity Category
Documentation or Activity	Requirements	4	3	2	1
Project Scope and Objectives	Clearly delineate the project scope, specifically what is in scope and what is out of scope. Include objectives, deliverables, assumptions, and constraints. This will determine scope baselines and variances. Discuss how the project scope and objectives trace back through the Project Charter to initial project documents such as the Schedule IV-B.	Required	Required	Required	Preparation of a formal Scope and Objectives document is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Work Breakdown Structure (WBS)	The hierarchical and incremental decomposition of the project into phases, deliverables, and work packages. Identifies all the tasks required to deliver the total scope of work to produce each deliverable. Tasks must be decomposed into subtasks until they can be estimated, observed, and evaluated.	Required	Recommended	Not Required	Not Required
Project Organizational and Governance Structure	A representation of the project from an organizational perspective. Include an organization chart with stakeholder and governance structures identified. Include a detailed description of the project and the Agency’s governance process with roles, responsibilities, and approval authorities identified for project documents or artifacts, including any processes for final product acceptance. Include reporting and escalation parameters for variances in schedule, cost, and scope.	Required	Required	Preparation of an Organizational & Governance Structure document is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.	Preparation of an Organizational & Governance Structure document is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Resource Plan	Document the resources required to complete the project and how these resources will be acquired. For personnel – identify project roles, skills, number, and resource type required, and specify the method(s) for acquiring new personnel or incorporating and backfilling the current responsibilities of existing personnel. For equipment or materials- identify types, quantities, and purpose, and specify the method(s) for acquiring equipment or materials.	Required	Required	Preparation of a Resource Plan document is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.	Preparation of a Resource Plan document is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Project Schedule	Develop and maintain a schedule that is: fully task, resource, and cost loaded; identifies the total scope of work; base-lined and updated with project progress; and contains the information necessary to provide earned value analysis and support schedule and cost performance index (SPI and CPI) variance analysis and reporting. The Project Schedule must be updated and the Agency must track and report schedule status in their Project Status Report (see rule 74-1.006, F.A.C. - Monitoring and Controlling for status report requirements and a detailed description of SPI and CPI).	Required The Agency will update the schedule weekly.	Required The Agency will update the schedule weekly.	Develop, baseline and maintain a schedule that identifies the total scope of work, assigned resources, and task completion dates. The schedule must be updated weekly. The Agency must track and report schedule status in their Project Status Report (See 74-1.006, F.A.C. - Monitoring and Controlling for status report requirements).	Develop, baseline and maintain a schedule that identifies the total scope of work, assigned resources, and task completion dates. The schedule must be updated bi-weekly. The Agency must track and report schedule status in their Project Status Report (See 74-1.006, F.A.C. - Monitoring and Controlling for status report requirements).
Project Budget	Develop and maintain a Project Budget, which must include specific fiscal year cost totals over the life of the project and the overall total cost of the project. Also include a description of the funding source(s) for the Project and a breakdown of the Project costs by major expense categories.	Required	Required	Required	Required
Project Spending Plan	Develop and maintain a Project Spending Plan, which, as a component of the Project Budget, must include monthly budgeted and actual costs for Other Personal Services (OPS) staff, contractors, deliverables, major project tasks, hardware, Commercial off-the-shelf (COTS) software, miscellaneous equipment, and other costs for each fiscal year.	Required	Required	Preparation of a Project Spending Plan is not required; however, the Agency must include summary spending plan information in the Project Plan Summary with detail required for the Project Status Report (See 74-1.006, F.A.C. - Monitoring and Controlling for detailed requirements for the project status report).	Preparation of a Project Spending Plan is not required; however, the Agency must include summary spending plan information in the Project Plan Summary with detail required for the Project Status Report (See 74-1.006, F.A.C. - Monitoring and Controlling for detailed requirements for the project status report).
Communications Plan	Identify the project information requirements of stakeholders and detail what, when, and how information will be collected and reported. This will include the responsibility, frequency, format, and distribution method for meeting summaries, project status reports, project governance meetings, and stakeholder communications, including reporting variances in schedule, cost, or scope and emerging risks or issues. Include documentation for Decision Tracking and Action Item Tracking (see Rule 74-1.006, F.A.C. - Monitoring and Controlling).	Required	Required	Required	Preparation of a Communication Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Change Management Plan	Document the change control process and documentation involved in identifying, escalating, approving, and managing project change requests related to the project’s schedule, cost, or scope baselines, or a change to project deliverables (see Rule 74-1.006, F.A.C. - Monitoring and Controlling). Include a summary of the change governance framework (see Organizational & Governance Structure above).	Required	Required	Required	Preparation of a Change Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Quality Management Plan	Document the processes and procedures for ensuring quality planning, quality assurance, and quality control are all conducted.	Required	Required	Preparation of a Quality Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.	Preparation of a Quality Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Deliverable Acceptance Plan	Document each deliverable, the acceptance criteria for each deliverable, and the deliverable acceptance process.	Required	Required	Required	Preparation of a Deliverable Acceptance Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary
Risk Management Plan	Document the process for the descriptive identification (listing), evaluation (probability and impact), prioritization, and response to risks (specified mitigation strategies for each risk), as well as the nature of any time sensitivity to risks that may impact the project. Identify the roles and responsibilities of project staff assigned to risks. Identify and document the process to be used for tracking, periodic review, and update of Risks (see Rule 74-1.006, F.A.C. - Monitoring and Controlling).	Required	Required	Required	Preparation of a Risk Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary. In addition, Agencies must track risks and report their status in the Project Status Report (See 74-1.006, F.A.C. - Monitoring and Controlling for detailed requirements)
Issue Management Plan	Document the process for (and the documentation of) the identification, evaluation, prioritization, management, and response to issues impacting the project. Identify and document the process to be used for tracking, periodic review, and update of Issues (see Rule 74-1.006, F.A.C. - Monitoring and Controlling). Identify the roles and responsibilities of project staff.	Required	Required	Required	Preparation of an Issue Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary. In addition, Agencies must track issues and report their status in the Project Status Report (See 74-1.006, F.A.C. - Monitoring and Controlling for detailed requirements).
Procurement Management Plan	If procurement is required by the project, document any products or services needed, identify the necessary products and services to be purchased, along with the appropriate purchasing methods, rules, and statutes affecting these activities.	Required	Required	Required	Preparation of a Procurement Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
Organizational Change Management Plan	Assess and document the impact of delivering the project’s products to the user organization and individual users; the readiness of the user organization and individual users to accept those changes; and identify, describe, and plan the action necessary to facilitate those changes.	Required	Required	Preparation of an Organizational Change Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.	Preparation of an Organizational Change Management Plan is not required; however, the Agency must include a summary of planning in this area in the Project Plan Summary.
System Security Plan	See Rule Chapter 71A-1, F.A.C. - Florida Information Technology Resource Security Policies and Standards for requirements for System Security Planning.	Required	Required	Required	Required
Requirements Traceability Matrix (RTM)	Prepare a document (usually a table) that links high-level design and requirements with detailed requirements, detailed design, test plan, and test cases. The RTM ensures that all requirements are identified and correctly linked (from high-level to detailed and technical levels) throughout the project.	Required	Required	Required	Not Required
Project Plan Summary	A document providing an overview of the planning for the management of the project that addresses all of the aforementioned documents and activities.	Not Required	Not Required	Required	Required

 

(3)(4) No change.

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.0041, 282.0051, FS. History-New 7-16-15. Amended             .

 

74-1.005 Execution.

(1) through (2) No change.

(3) All changes to the approved and baselined Project Management Plan (project schedule, cost, or scope) must follow the Agency’s project change control and governance processes.

 

EXECUTION PHASE - Requirements by Risk & Complexity Category

	4	3	2	1
Operations and Maintenance (O&M) Plan	Required - Develop an O&M Plan prior to the scheduled completion of the project’s Execution phase. Obtain concurrence from financial, information technology, and operational managers on their readiness to support the system from a budgetary, staffing, technology, and operational perspective after go-live.			Recommended

	4	3	2	1
Project Management Plans	Required - As necessary, update Project Management Plan documents.

 

 

EXECUTION PHASE		Risk & Complexity Category
Documentation or Activity	Requirements	4	3	2	1
Project Schedule	Execute and update the approved project schedule with actual work effort and project progress (tasks, milestones, and deliverables completed) to track Schedule Performance Index (SPI) and Cost Performance Index (CPI).	Required   The Agency will update the schedule weekly.	Required   The Agency will update the schedule weekly.	Execute and update the project schedule with actual work effort and project progress (tasks, milestones, and deliverables completed) weekly.	Execute and update the project schedule to track actual work effort and project progress (tasks, milestones, and deliverables completed) bi-weekly.
Project Spending Plan	Maintain the Project Spending Plan and include Spending Plan data in the Monthly Project Status Report (see 74-1.006, F.A.C. - Monitoring and Controlling for status report requirements).	Required	Required	Not Required	Not Required
Procurement Management Plan	If procurement is required, the Agency will conduct procurements as documented in the approved Procurement Management Plan.	Required	Required	Required	Conduct procurements as documented in the Project Plan Summary.
Quality Management Plan	Perform quality assurance activities as specified in the approved Quality Management Plan.	Required	Required	Perform quality assurance activities outlined in the Project Plan Summary.	Perform quality assurance activities outlined in the Project Plan Summary.
Communications Plan	Manage project communications as specified in the approved Communications Plan.	Required	Required	Required	Manage communications and stakeholder needs as outlined in the Project Plan Summary.
	Provide project status reports as required in this Rule. (see 74-1.006, F.A.C. - Monitoring and Controlling for status report requirements) Facilitate communications within the project team and with the project sponsor and stakeholders.	Required	Required	Required	Required
Deliverable Acceptance Plan	Execute the Deliverable Acceptance Plan.	Required	Required	Required	Document deliverable acceptance in accordance with deliverable acceptance processes, criteria, and the project governance process outlined in the Project Plan Summary.
Organizational Change Management Plan	Execute the Organizational Change Management Plan.	Required	Required	Facilitate organizational change management as outlined in the Project Plan Summary.	Facilitate organizational change management as outlined in the Plan Summary.
Operations and Maintenance (O&M) Plan	Develop an O&M Plan prior to the scheduled completion of the project’s Execution phase. Obtain concurrence from financial, information technology, and operational managers on their readiness to support the system from a budgetary, staffing, technology, and operational perspective after go-live.	Required	Required	Required	Required

 

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.0041, 282.0051, FS. History-New 7-16-15. Amended             .

 

74-1.006 Monitoring and Controlling.

(1) Project Monitoring and Controlling spans all phases of the project and involves the regular review of project status in order to identify variances from approved baselined project schedule, cost, and scope. In addition, all project management plan components developed pursuant to 74-1.004 Planning must be monitored, controlled and maintained.

(2) No change.

(3) The following matrix details Monitoring and Controlling documentation and activities required for the project based on the project’s R&C Category.

 

MONITORING AND CONTROLLING - Requirements by Risk & Complexity Category
	4	3	2	1
Monitor and Control Project Change	Required - Follow the change control process(es) documented in the Change Management Plan. Complete an Event-Driven Risk & Complexity (R&C) Assessment for significant change requests (see 74-1.002, F.A.C. - Risk and Complexity Assessment). This assessment will confirm or adjust the project’s cumulative risk and complexity levels and R&C Category, and assist the Agency in determining whether changes to any project management plan documents and baselines are needed. Maintain a change tracking log that includes change description, project impact (scope, schedule, and cost), owner, and status.  This log is used to track, enter, review, analyze, approve, update, and report on project changes.

	4	3	2	1
Monitor and Control Project Schedule	Required - Update the schedule at least weekly to reflect actual progress toward completion of scheduled tasks, milestones, and deliverables.		Required - Update the schedule at least biweekly to reflect actual progress toward completion of scheduled tasks, milestones, and deliverables.
	Required - Use SPI to assess schedule variance. If SPI analysis indicates a trend towards a variance equal to or greater than 10% (SPI score ≤ 0.90 or ≥ 1.10), communicate the variance explanation to the project’s key stakeholder(s).		Required - Evaluate the baselined schedule against current progress. 1. Identify overdue tasks and compute the percentage of late tasks related to total tasks to date (Number of Overdue Tasks / Number of Total Tasks). 2. If this analysis indicates a trend towards a variance, equal to or greater than 10%, communicate the variance explanation to the project’s key stakeholders.
	4	3	2	1
Monitor and Control Project Cost	Required - Monitor project costs monthly to identify both positive and negative variances between planned and actual expenditures.    1. Compare baselined planned expenditures to actual expenditures captured in the spending plan or the budget.    2. Identify the difference in baselined planned and actual expenditures and compute the percentage of cost variance for the period (Cost Variance / Total Planned Cost).    3. If there is a variance (positive or negative) equal to or greater than 10%, communicate the variance explanation to the project’s key stakeholder(s).
	Required - Use CPI to assess cost variance. If the CPI analysis indicates a trend towards a variance equal to or greater than 10% (CPI score ≤ 0.90 or ≥ 1.10), communicate the variance explanation to the project stakeholders.		Not Required
	4	3	2	1
Monitor and Control Project Scope	Required - Monitor project scope, and manage changes to the original and agreed-upon scope as documented in the approved project planning documents.			Required - Monitor project scope and document changes.
	4	3	2	1
Monitor and Control Project Quality	Required - Monitor and Control quality as documented in the Quality Management Plan.
	4	3	2	1
Monitor and Control Project Risks	Required - Monitor and control risks as documented in the approved Risk Management Plan. Perform risk reassessments to identify new risks, reassess current risks, escalate risks to issues, and close outdated risks. Maintain a risk tracking log that includes risk description, owner, response / mitigation strategy, as well as risk probability, impact (or criticality), and tolerance. This log is used to track, enter, review, analyze, update, monitor, and report on risks.			Required – Monitor, document, and address risks.
	4	3	2	1
Monitor and Control Project Issues	Required - Monitor and control issues as documented in the approved Issue Management Plan.   Review issues to identify new issues, reassess current issues, and close resolved issues.   Maintain an issue tracking log, which includes Issue description, owner, status, and priority. This log is used to track, enter, review, analyze, update, monitor, and report on issues.			Required - Monitor, document, and resolve issues.
	4	3	2	1
Decision Tracking	Required - Maintain a decision tracking log that includes decision description, approval authority, date, project impact (scope, schedule, and cost), and status. This log is used to track, enter, review, analyze, update, monitor, and report on decisions.		Recommended
	4	3	2	1
Action Item Tracking	Required - Maintain an action item log that includes Action Item description, owner, dates assigned and due, priority, and status. This log is used to track, enter, review, analyze, update, monitor, and report on action items.		Recommended
	4	3	2	1
Florida Cybersecurity Standards	Required – Monitor and control project compliance with Rule Chapter 74-2, F.A.C.
	4	3	2	1
Requirements Traceability Matrix (RTM)	Required - Review and amend the RTM to capture progressive detail of requirements linkage throughout the project. This matrix is used to document and link requirements from their origin to the deliverables that satisfy them.			Required - Update requirements documentation as necessary.
	4	3	2	1
Lessons Learned	Required - Capture lessons learned from project team and stakeholders throughout the project.

 

MONITORING AND CONTROLLING PHASE		Risk & Complexity Category
Documentation or Activity	Requirements	4	3	2	1
Monitor and Control Project Schedule	Update the schedule to reflect actual progress toward completion of scheduled tasks, milestones, and deliverables.	The Agency will update the schedule weekly.	The Agency will update the schedule weekly.	The Agency will update the schedule weekly.	The Agency will update the schedule bi-weekly.
	Use SPI to assess schedule variance. If SPI analysis indicates a trend towards a variance equal to or greater than 10% (SPI score ≤ 0.90 or ≥ 1.10), communicate the variance explanation to the project stakeholders.	Required	Required	Not Required	Not Required
	Evaluate the baselined schedule against current progress. 1. Identify overdue tasks and compute the percentage of late tasks related to total tasks to date (Number of Overdue Tasks / Number of Total Tasks). 2. If this analysis indicates a trend towards a variance, equal to or greater than 10%, communicate the variance explanation to the project stakeholders.	Not Required	Not Required	Required	Required
	If the schedule requires revision, follow the project change control process and the governance process.	Required	Required	Required	Required
Monitor and Control Project Cost	Monitor project costs at least monthly to identify both positive and negative variances between planned and actual expenditures. Compare planned costs to actual costs captured in the spend plan or the budget. Identify the difference in planned and actual costs and compute the percentage of cost variance for the period (Cost Variance / Total Planned Cost). If there is a variance (positive or negative) equal to or greater than 10%, communicate the variance explanation to the project stakeholders.	Required	Required	Required	Required
	Use CPI to assess cost variance. If the CPI analysis indicates a trend towards a variance equal to or greater than 10% (CPI score ≤ 0.90 or ≥ 1.10), communicate the variance explanation to the project stakeholders.	Required	Required	Not Required	Not Required
	If the budget requires revision, follow the approved project change control process and governance process.	Required	Required	Required	Required
Monitor and Control Project Scope	Monitor project status and product scope, and manage changes to the original and agreed-upon scope as documented in the approved project planning documents. If the scope requires revision, follow the approved project change control and governance processes.	Required	Required	Required	Required
Monitor and Control Project Quality	Control quality as documented in the Quality Management Plan or the Project Plan Summary.	Required	Required	Required	Required
Monitor and Control Project Change	Follow the change control process(es) documented in the Change Management Plan or the Project Plan Summary. Complete an Event-Driven Risk & Complexity (R&C) Assessment for significant change requests (see 74-1.002, F.A.C. - Risk and Complexity Assessment). This assessment will confirm or adjust the project’s cumulative risk and complexity levels and R&C Category, and assist the Agency in determining whether changes to any project management plan documents and baselines are needed. If changes to any project plans, documents, or baselines are needed, follow the approved project change control process and governance processes. When proposing substantial project change requests for governance approval, the request must include the results of the Event-Driven R&C Assessment. Maintain a Change tracking log that includes Change description, project impact (scope, schedule, and cost), owner, and status. This log is used to track, enter, review, analyze, update, monitor, and report on project changes.	Required	Required	Required	Required
Monitor and Control Project Procurement	If procurement is required, control procurements as documented in the approved Procurement Management Plan or the Project Plan Summary.	Required	Required	Required	Required
Monitor and Control Project Risks	Control risks as documented in the approved Risk Management Plan or Project Plan Summary. Perform risk reassessments to identify new risks, reassess current risks, escalate risks to issues, and close outdated risks. Maintain a risk tracking log that includes risk description, owner, response / mitigation strategy, as well as risk probability, impact (or criticality), and tolerance. This log is used to track, enter, review, analyze, update, monitor, and report on risks.	Required	Required	Required	Required
Monitor and Control Project Issues	Control issues as documented in the approved Issue Management Plan or Project Plan Summary. Review issues to identify new issues, reassess current issues, and close resolved issues. Maintain an issue tracking log, which includes Issue description, owner, status, and priority. This log is used to track, enter, review, analyze, update, monitor, and report on issues.	Required	Required	Required	Required
Decision Tracking	Maintain a decision tracking log that includes decision description, approval authority, date, project impact (scope, schedule, and cost), and status. This log is used to track, enter, review, analyze, update, monitor, and report on decisions.	Required	Required	Required	Recommended
Action Item Tracking	Maintain an action item log that includes Action Item description, owner, dates assigned and due, priority, and status. This log is used to track, enter, review, analyze, update, monitor, and report on action items.	Required	Required	Required	Recommended
Requirements Traceability Matrix (RTM)	Review and amend the RTM to capture progressive detail of requirements linkage throughout the project. This matrix is used to document and link requirements from their origin to the deliverables that satisfy them.	Required	Required	Required	Recommended
Lessons Learned	Capture lessons learned from project team and stakeholders throughout the project.	Required	Required	Recommended	Recommended

 

(4) The Agency will report project status based on the project’s R&C Category at least monthly. Form AST-F-0505B, Project Status Report (07/16 15), is hereby incorporated by reference in this Rule. Form AST-F-0505B can be found on the AST website at: http://www.ast.myflorida.com/. Status reports will include:

 

PROJECT STATUS REPORT – Requirements by Risk & Complexity Category
	4	3	2	1
Section 1 – Project Status Overview	A.   Overview of Project Progress.
	B.   Overall Status
	C.   Schedule Performance Index (SPI) Cost Performance Index (CPI)		Not Required
	4	3	2	1
Section 2 – Project Progress	A.  Project Milestones, Deliverables & Major Tasks			Not Required
	B. Scope Changes			Summarize in Section 1B Only
	4	3	2	1
Section 3 – Project Issues and Risks	A. Project Issues			Summarize in Section 1B Only
	B.    Project Risks			Summarize in Section 1B Only
	4	3	2	1
Section 4 – Project Spending Plan	A.   Identify Baselined Planned Expenditures vs. Actual Expenditures			Not Required
	B.  Major Project Expenditures			Not Required
	Attach current project spend plan		Not Required

 

MONITORING AND CONTROLLING PHASE		Risk & Complexity Category
Documentation	Requirements	4	3	2	1
Interim Project Status Report	Sections 1, 2, 3, and 5 of the Project Status Report Form	Bi-weekly	Bi-weekly	Recommended	Recommended
Monthly Project Status Report	All Sections of the Project Status Report Form	Monthly	Monthly	Monthly	Monthly
Sections	Items Required	4	3	2	1
Section 1 – Project Status Overview	A. Overview of Project Progress.	Required	Required	Required	Required
	B. Schedule Performance Index (SPI) Cost Performance Index (CPI)	Required	Required	Not Required	Not Required
	C. Overall Status	Required	Required	Required	Required
Section 2 – Project Progress	A. Project Milestones & Deliverables	Required	Required	Required	Required
	B. Major Project Tasks & Activities	Required	Required	Required	Not Required
	C. Reports & System Interfaces	Required	Required	Not Required	Not Required
	D. Scope Changes	Required	Required	Required	Required
Section 3 – Project Issues and Risks	A. Project Issues	Required	Required	Required	Required
	B. Project Risks	Required	Required	Required	Required
Section 4 – Project Spend Plan	Attach current project spend plan to Status Report	Required	Required	Not Required	Not Required
	A. Major Project Costs	Required	Required	Required	Required
	B. Identify Planned Cost vs. Actual Cost by Category	Required	Required	Not Required	Not Required
Section 5 – Project Summary	Scope Statement, Project Objectives, Benefits	Required	Required	Required	Required

 

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.0041, 282.0051, FS. History-New 7-16-15. Amended             .

 

74-1.007 Closeout.

(1) through (2) No change.

(3) Specific document templates are not prescribed – any project documentation that contains the information specified in the requirements below is acceptable.

 

CLOSEOUT PHASE – Requirements by Risk & Complexity Category
	4	3	2	1
Project Closeout Report (PCR)	Required - Document the project’s accomplishments against the project budget, scope, schedule, and performance baselines. Include a discussion of the lessons learned compiled by the project team and stakeholders. The PCR must be completed as defined in the project schedule.		Required - Document the project’s accomplishments against the project budget, scope, and schedule. Include a discussion of the lessons learned.
	4	3	2	1
Post Implementation Review (PIR) Report	Required - Evaluate and document whether the products or services delivered by the project meet the Agency’s business objectives, and provide the expected results and benefits as documented in the Initiation and Planning phases. Validate the cost benefit analysis and projected return on investment analysis. This analysis should be performed six months to one year after the product or service has been implemented, or as otherwise defined in the Project Charter.		Not Required

 

CLOSEOUT PHASE		Risk & Complexity Category
Documentation or Activity	Requirements	4	3	2	1
Lessons Learned	Identify and document final lessons learned with project team and stakeholders.	Required	Required	Required	Required
Project Closeout Report (PCR)	Document the project’s accomplishments against the project budget, scope, schedule, and performance baselines. Include a discussion of the lessons learned compiled by the project team and stakeholders. The PCR must be completed as defined in the project schedule.	Required	Required	Required	Required
Post Implementation Review (PIR) Report	Evaluate and document whether the products or services delivered by the project meet the Agency’s business objectives, and provide the expected results and benefits as documented in the Initiation and Planning phases. Validate the cost benefit analysis and projected return on investment analysis. This analysis should be performed six months to one year after the product or service has been implemented, or as otherwise defined in the Project Charter.	Required	Required	Required	Not Required

 

(4) through (5) No change.

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.0041, 282.0051, FS. History-New 7-16-15. Amended             .

 

74-1.009 Agency for State Technology (AST) Oversight.

(1) through (2) No change.

(3) Agencies will participate and assist AST in oversight of a project as follows:

(a) The Agency will provide access to all required documentation as defined within this rule to AST upon initiation of AST Oversight.

(b) The Agency and AST will assess schedule, cost, and scope variance based on the defined, documented, and approved Project Management Plan, budget, and the baselined schedule and spending plan. cooperate to establish agreed-upon project oversight parameters (including schedule, cost, and scope) that will serve as the basis against which all project variances will be measured.

1. The project oversight parameters must be reviewed and approved by the Agency Project Sponsor (or designee), the Agency Project Manager, and the AST Project Assurance Manager within 15 business days of the beginning of AST project oversight.

2. The project oversight parameters may be revised during the life of the project based upon completion of the Agency’s formal change control and governance process. Revision to the parameters must be reviewed and approved by the Agency Project Sponsor (or designee), the Agency Project Manager, and the AST Project Assurance Manager.

(b) The Agency will provide the project’s Risk Management Plan to AST within 15 business days of the approval of the project oversight parameters. AST will review the plan and provide comment(s) to the Agency within 15 business days.

(c) thorugh (d) No change.

(4)(e) AST will review and document the project’s progress on a monthly basis. The purpose of the review is to determine trends in schedule, cost, and scope variances, (using the project oversight parameters approved project management plan along with other project baseline and actual documentation) and assess project risk and issuesmanagement practices. AST will further examine projects trending out of variance, review its findings with the Agency, and, if necessary, make recommendations for corrective action(s).

1. If the monthly review indicates that the project exceeds acceptable variance ranges (see 74-1.006 Monitoring and Controlling for definition of acceptable variance ranges) in schedule, cost, or scope, AST will perform a diagnostic risk assessment, which will result in preliminary findings and recommendations for project corrective action.

2. The Agency will respond in writing to AST’s findings and recommendations within 5 business days of receipt of the findings. This response will include a corrective action plan for bringing the project back within acceptable variance ranges.

3. AST will review the preliminary findings, recommendations, and corrective action plan with the Agency.

4. AST will finalize the monthly review document (including a summary of the risk assessment, recommendations and the corrective action plan) for review by the Agency and AST management.

(5)(4) AST will report quarterly to the Executive Office of the Governor, the President of the Senate, and the Speaker of the House of Representatives on any information technology project that AST identifies as high-risk due to the project exceeding acceptable variance ranges (pursuant to Section 282.0051 (4), F.S.).

The quarterly report will follow the same process and format as the monthly review. Following the same process as the monthly review described in (3)(e) above, Tthe quarterly report will include a discussion of the risk assessment, including fiscal risks associated with proceeding to the next stage of the project, and a recommendation for corrective actions required, up to and including suspension or termination of the project. Agencies will review and acknowledge the quarterly report (or provide feedback or response) in writing to AST within 5 business days. 

(6)(5) Any project meeting the criteria for AST oversight must adhere to the requirements of a Risk and Complexity (R&C) Category 4 project.

(7)(6) The Agency must use a PMP® Certified Project Manager for any project meeting the criteria for AST oversight. The PMP® Certified Project Manager must oversee the entire project scope. If the Agency designates a PMP® Certified third party or vendor Pproject Mmanager, the Agency must also designate an Agency employee in a Project Manager role that is ultimately responsible for the ensuring compliance with the rule and the successuful execution of the entire project effort. The designated Agency project manager and that will serves as the primary point of contact for AST.

(8)(7) Independent Verification and Validation (IV&V) must be employed throughout the project lifecycle for any project that meets the criteria for AST oversight. The Agency will purchase IV&V services in compliance with section 287.056, F.S., or procure such services in a manner consistent with Florida procurement laws. The Agency will collaborate with AST when creating solicitations and contracts for IV&V services, and when identifying the amount of funding to be requested for IV&V as part of the project’s Legislative Budget Request (LBR). IV&V contract deliverables, including invoices, will be provided to AST at or around the time they are delivered by the IV&V vendor to the agency.

Rulemaking Authority 282.0051(18), FS. Law Implemented 282.0041, 282.0051, FS. History-New 7-16-15. Amended             .

 

NAME OF PERSON ORIGINATING PROPOSED RULE: Tara Kyvik, Chief Planning Officer

NAME OF AGENCY HEAD WHO APPROVED THE PROPOSED RULE: Jason Allison, Executive Director

DATE PROPOSED RULE APPROVED BY AGENCY HEAD: April 8, 2016

DATE NOTICE OF PROPOSED RULE DEVELOPMENT PUBLISHED IN FAR: February 29, 2016