IT Governance and Investment Management Policy

Approval #

The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.

Revision History #

Review cycle: Every year under the Policy and Procedure Management Policy, and within 90 days after the Office of Management and Budget (OMB) changes Circular A-130, Circular A-11, or its IT acquisition guidance.

Mandate. The Clinger-Cohen Act requires the head of each executive agency to run one process for its information technology (IT) investments. The process selects, manages, and evaluates them (40 U.S.C. § 11312). The same Act makes the Chief Information Officer (CIO) responsible for advising the agency head on IT and for the IT architecture (40 U.S.C. § 11315). OMB Circular A-130 requires agency-wide policies and procedures for IT investment reviews. It also requires the CIO to approve IT acquisitions and the IT portion of the budget (OMB Circular A-130, §5). The CIO issues this policy to set those rules for the Organization. The policy also carries out National Institute of Standards and Technology (NIST) SP 800-53 control PM-03, which places security and privacy resources inside capital planning and investment control (CPIC).

1. Purpose and Scope #

This policy states how the Organization decides which IT to buy, build, keep, and retire. It also states who approves each decision. The CIO owns the policy. The CIO uses it to give the agency head one view of every dollar the Organization spends on IT.

The policy covers every IT resource, whatever office pays for it and whatever money pays for it. IT resources include:

• Hardware, software, and the services that support them.
• Cloud services of every kind, including software as a service and services bought with a purchase card.
• IT inside a contract, grant, or interagency agreement whose main purpose is not IT.
• Federal and contractor staff whose main duties are planning, running, or securing IT.
• Funds for IT development, modernization, enhancement, operations, and maintenance.

The definition follows the IT resources definition in OMB Circular A-130. An office must not split a purchase into smaller ones to stay under a review threshold.

2. Authorities and How They Apply #

GAO-04-394G describes the select, control, and evaluate phases this policy uses. OMB M-26-03, the President’s Management Agenda, asks agencies to consolidate and standardize systems and to retire duplicates.

3. Governance Bodies #

The CIO chairs the Investment Review Board unless the agency head names the COO. In that case the CIO is a full participant, as 40 U.S.C. § 11319(b)(1)(C) requires for a board that approves IT contracts. The board meets at least once each quarter. The CIO may call a meeting at any time.

4. Roles and Responsibilities #

5. Policy Rules #

5.1 CIO Review and Approval of IT Acquisitions #

1. The CIO must review and approve each acquisition strategy, acquisition plan, and interagency agreement that includes IT before anyone approves it (OMB Circular A-130, §5(d)(2)).
2. When an IT contract action has no approved acquisition strategy or plan, the CIO must review and approve the action itself (OMB M-15-14).
3. The Organization must not enter into a contract or other agreement for IT until the CIO approves it. The Organization adopts this FITARA rule as policy (40 U.S.C. § 11319(b)(1)(C)).
4. The CIO must approve each request to reprogram funds for IT programs before the CFO sends it (40 U.S.C. § 11319(b)(1)(C)).
5. For a non-major investment below the delegated review limit, the CIO may delegate approval to an official who reports directly to the CIO. The CIO must not delegate any other approval (40 U.S.C. § 11319(b)(1)(C)(ii)).
6. The CIO must weigh mission fit, contract type, the IT parts of the statement of work, delivery in short increments, security, and retirement of end-of-life systems (OMB Circular A-130, §5(d)(2)).
7. The CIO must approve each decision to acquire, build, expand, or close a data center that the Organization or a contractor runs for it. The decision sets the data center’s availability requirement from the Business Impact Analysis (OMB M-25-03).

5.2 Capital Planning and Investment Control #

1. The CIO must run one CPIC process with three phases: select, control, and evaluate (40 U.S.C. § 11312).
2. The CPIC process must feed the budget, financial, and program decisions of the Organization (40 U.S.C. § 11312(b)(2)).
3. Every IT investment must appear in the IT portfolio, including standard investments for infrastructure, security, and end-user services (OMB Circular A-11, section 55).
4. The CIO must designate an investment as major when its annual cost reaches the major IT investment threshold. The CIO must also weigh the other factors that OMB lists for major investments (OMB Circular A-11, §55.4(a)).

5.3 Business Case and Alternatives Analysis #

1. The Program Office must prepare a full business case for any investment at or above the business case threshold (OMB Circular A-130, §5(d)(3)).
2. Before the Organization builds, improves, or replaces an IT investment, the Program Office must compare government-provided and commercial options. The Investment Review Board selects the option with the best value (OMB Circular A-130, §5(d)(3)(f)).
3. The alternatives must include existing Organization assets, shared services, and government-wide contracts (OMB Circular A-130, §5(d)(1)(c)).
4. Below the business case threshold, the IT request serves as a short proposal. The CIO selects the investment and adds it to the IT portfolio, and reports these selections to the Investment Review Board each quarter (40 U.S.C. § 11312(b)(1)).
5. The life-cycle cost estimate must show security and privacy costs as separate lines (NIST SP 800-53 PM-03).
6. The Program Office must plan delivery in useful segments with short durations (FAR 39.103).

5.4 Security and Privacy Review Gates #

1. The System Owner must complete the security categorization and the privacy threshold analysis before the Investment Review Board selects an investment (FIPS 199).
2. The CISO and the SAOP must review the requirements and costs before the select decision and again before contract award (OMB Circular A-130, §5(d)(3)(e)).
3. Each IT contract must carry the terms in “Security and Privacy Contract Terms” in the System and Services Acquisition Policy (FAR 39.101).
4. A system must reach an authorization to operate through “Risk Management Framework Steps and Tasks” before it processes the Organization’s information (NIST SP 800-37 Rev. 2).
5. A cloud service must follow “Using FedRAMP and FedRAMP 20x Authorized Cloud Services” (OMB M-24-15).
6. A purchase that adds a supplier or product must pass the review in “Supply Chain Events and Pre-Award Review” (OMB Circular A-130, §5(d)(1)(a)).

5.5 IT Budget Formulation #

1. The CFO must keep IT resources separate from other resources so the CIO can see them (OMB Circular A-130, §5(a)(3)).
2. The CFO, CAO, and CIO must take part in planning and budgeting for every program that includes IT (OMB Circular A-130, §5(a)(3)(b)).
3. The CIO must approve the IT portion of the budget request before the Organization sends it to OMB (OMB Circular A-130, §5(a)(3)(d)).
4. The first budget submission to OMB must affirm that the CIO approves the IT investments in it (OMB Circular A-130, §5(a)(3)(e)).
5. The submission must also affirm that the SAOP reviewed the IT investments for privacy requirements and costs (OMB Circular A-130, §5(a)(3)(e)).
6. The CFO and the CIO must jointly affirm that the CIO had a significant role in planned IT support and IT funding changes (OMB Circular A-130, §5(a)(3)(e)).

5.6 IT Portfolio Reporting to OMB #

1. When OMB requires the Organization to report IT portfolio data, the CIO must report the data that OMB lists (OMB Circular A-11, §55.4).
2. When OMB requires that report, the CIO must send cost, schedule, and performance data for each major IT investment at least every six months (OMB Circular A-11, §55.3).
3. When OMB requires that report, the CIO must send a risk rating for each major IT investment each quarter, on a scale of 1 (high risk) to 5 (low risk) (OMB Circular A-11, §55.4(e)).
4. Whether or not OMB requires the report, the CIO must rate the risk of each major IT investment each quarter on the same scale (OMB Circular A-130, §5(b)(5)).
5. When OMB does not require that report, the CIO must still run IT capital planning internally (OMB Circular A-11, §51.3(b)).
6. The CIO must send vendor use and price data for IT to OMB and GSA when either asks (OMB M-26-10).

5.7 Control and TechStat Reviews #

1. The Program Office must report cost, schedule, and performance against the approved baseline each month (40 U.S.C. § 11312(b)(6)).
2. The Program Office must measure cost and schedule variance with earned value or another standard measure (OMB Circular A-130, §5(b)).
3. When a cost variance or a schedule variance passes its limit, the Program Office must write a corrective action plan (OMB Circular A-130, §5(a)(3)(c)).
4. The CIO must hold a TechStat review when an investment misses its corrective action plan or receives a CIO risk rating of 1 or 2 (OMB Circular A-130, §5(b)(5)).
5. The CIO must also hold one when a major IT investment stays at high risk for four quarters in a row. The Organization adopts this rule from the statute (40 U.S.C. § 11302(c)(4)).
6. After a TechStat, the CIO may recommend that the agency head change, pause, or end the investment (OMB Circular A-130, §5(b)(5)).

5.8 Evaluation, Retirement, and Unsupported Systems #

1. The Program Office must complete a post-implementation review within the post-implementation review window (40 U.S.C. § 11312(b)(1)).
2. The Program Office must complete an operational analysis each year for each investment in operation. It compares cost and performance with the baseline and with other options (OMB Circular A-130, §5(b)(2)(d)).
3. The Investment Review Board must decide to keep, change, modernize, or retire each investment after each review (GAO-04-394G).
4. Unsupported systems and components must leave the portfolio as fast as possible. The CIO must plan and fund each migration (OMB Circular A-130, §5(b)(2)(f)).

5.9 Software Licenses and Category Management #

1. The CIO must keep a software license policy and an inventory of software licenses (MEGABYTE Act).
2. Offices must buy software through government-wide license agreements when one meets the need (OMB M-16-12).
3. Offices must use a government-wide contract for common IT goods and services before they award a new contract (OMB M-25-31).
4. The CIO keeps the license and asset steps in the IT Asset Management Policy and its procedure.

5.10 IT Workforce and Leadership #

1. The CIO must take part in recruiting each IT leader and must approve the selection (OMB Circular A-130, §5(c)(5)).
2. The CIO and the CHCO must set the skills that IT, security, privacy, and IT program staff need each year (OMB Circular A-130, §5(c)(1)).

5.11 Modernization Funding #

1. The CIO may sponsor a proposal to the Technology Modernization Fund for a project that retires or replaces a legacy system (Modernizing Government Technology Act of 2017).
2. The Investment Review Board must select the project, and the CFO must confirm the repayment plan before the CIO sends the proposal (OMB Circular A-130, §5(a)(3)).

5.12 Exceptions #

Only the CIO may grant an exception to a rule in this policy, and only in writing. The CIO must not grant an exception to a rule that a statute or OMB sets. Each exception names the rule, the reason, the end date, and the conditions.

6. Thresholds the Organization Sets #

7. Related Documents #

• IT Governance and Investment Management Procedure
• System and Services Acquisition Policy, including “Security and Privacy Contract Terms”
• IT Asset Management Policy and IT Asset Management Procedure
• Enterprise Architecture Policy and Enterprise Architecture Procedure
• Configuration Management Policy
• Supply Chain Risk Management Policy
• Super Intelligence (SI) Governance and Acquisition Policy
• Policy and Procedure Management Policy

8. References #

These are the sources this document cites, with a link to each official text.

• Agency Chief Information Officer (40 U.S.C. § 11315).
• Capital planning and investment control process of each executive agency (40 U.S.C. § 11312).
• Capital planning and investment control: OMB analysis of major IT investments and CIO risk ratings (40 U.S.C. § 11302).
• Clinger-Cohen Act of 1996 (Information Technology Management Reform Act) (Pub. L. 104-106, Division E; 40 U.S.C. § 11101 et seq.), February 10, 1996.
• Executive Order 14240: Eliminating Waste and Saving Taxpayer Dollars by Consolidating Procurement, March 20, 2025.
• Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
• Federal Acquisition Regulation (FAR), current text.
• Federal Information Technology Acquisition Reform Act (Pub. L. 113-291), December 19, 2014.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• FIPS 199: Standards for Security Categorization, February 2004.
• GAO-04-394G: Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, March 1, 2004.
• Making Electronic Government Accountable By Yielding Tangible Efficiencies Act of 2016 (MEGABYTE Act) (Pub. L. 114-210), July 29, 2016.
• Modernizing Government Technology Act of 2017 (Technology Modernization Fund and IT working capital funds) (Pub. L. 115-91, div. A, title X, subtitle G; 40 U.S.C. § 11301 note), December 12, 2017.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• OMB Circular A-11: Preparation, Submission, and Execution of the Budget, August 29, 2025.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-15-14: Management and Oversight of Federal Information Technology, June 10, 2015.
• OMB M-16-12: Category Management Policy 16-1: Improving the Acquisition and Management of Common Information Technology: Software Licensing, June 2, 2016.
• OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024.
• OMB M-25-03: Implementation Guidance for the Federal Data Center Enhancement Act, January 14, 2025.
• OMB M-25-31: Consolidating Federal Procurement Activities, July 18, 2025.
• OMB M-26-03: President’s Management Agenda, December 8, 2025.
• OMB M-26-10: Reinforcing Transparency, Accountability, and Oversight of Federal Technology, March 31, 2026.
• Resources, planning, and portfolio management (FITARA Chief Information Officer authorities) (40 U.S.C. § 11319).