Skip to content
FedXchange
Menu

Enterprise Architecture Procedure

Use this free template to write your agency's Enterprise Architecture Procedure. It maps to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, and it sits with the Program Management (PM) family. This copy follows the High baseline with the High Value Asset (HVA) overlay from the Cybersecurity and Infrastructure Security Agency (CISA). It names 20 controls and leaves 4 values for your agency to fill in. It calls the agency that adopts it "the Organization", and it names each person by role and each tool by its function. It cites 7 federal sources.

Approved by: Chief Information Officer (CIO); Chief Information Security Officer (CISO), concurring

From the document: The Chief Architect, the Chief Information Security Officer (CISO), the Senior Agency Official for Privacy (SAOP), the Chief Data Officer (CDO), System Owners, and program offices use this procedure. It covers every system and IT service the policy covers.

Download

Downloads need a free FedXchange account. Sign in, and the download starts.

Controls covered

  • AU-06
  • CA-05
  • CA-06
  • CM-03
  • CM-06
  • CM-08
  • IA-02
  • PL-02
  • PL-08
  • PM-03
  • PM-05
  • PM-06
  • PM-07
  • PT-02
  • SA-04
  • SA-08
  • SA-09
  • SA-17
  • SA-22
  • SR-05

Every Program Management (PM) template

The text of the Enterprise Architecture Procedure

Approval #

The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.

Role Name Signature
Chief Information Officer (CIO)
Chief Information Security Officer (CISO), concurring

Revision History #

Date Version Description Reviewer
2026-10-31 1.0 Initial issuance [Reviewer name]

Review cycle: Every year under the Policy and Procedure Management Policy, and within 90 days after the Office of Management and Budget (OMB) changes the enterprise architecture rules in Circular A-130.

Mandate. The Chief Information Officer (CIO) issues this procedure to carry out the Enterprise Architecture Policy. OMB Circular A-130 requires an enterprise architecture (EA) with a baseline architecture, a target architecture, and a transition plan (OMB Circular A-130, §5(a)(2)). The Clinger-Cohen Act makes the CIO responsible for a sound, secure, and integrated information technology (IT) architecture (40 U.S.C. § 11315(b)(2)). The steps carry out National Institute of Standards and Technology (NIST) SP 800-53 controls PM-07 and PL-08, and SA-17 for High-impact systems and High Value Assets (HVAs).

1. Purpose and Scope #

The Chief Architect, the Chief Information Security Officer (CISO), the Senior Agency Official for Privacy (SAOP), the Chief Data Officer (CDO), System Owners, and program offices use this procedure. It covers every system and IT service the policy covers. Each step names the actor, the tool, the evidence the actor keeps, and the controls the step supports. The CIO sets each value below before the first use.

Value Setting What it controls
Architecture review window [Assignment: organization-defined architecture review window in business days — to be defined] The Architecture Review Board decides on a complete review request within this many business days.
Longest waiver term [Assignment: organization-defined longest architecture waiver term in months — to be defined] A waiver from an architecture standard ends after this many months unless the CIO renews it.
Sunset notice period [Assignment: organization-defined sunset notice period in months — to be defined] The Chief Architect announces a retirement date at least this many months before it.
Yearly update month [Assignment: organization-defined month of the yearly architecture update — to be defined] The CIO approves the updated current architecture, target architecture, and transition plan in this month each year.

Evidence: the approved policy, with every value set, in the policy library.

2. Maintaining the Architecture Repository #

Entry criteria: The CIO approves the policy, or a review, change, or retirement changes the architecture.

Exit criteria: The repository matches the system inventory, and each change has a version entry.

Step and actor Action Tool Evidence Controls
1. Chief Architect Keep one architecture repository with a folder for each layer and each view: current, target, and transition. The document management system Repository index PM-07
2. Chief Architect Link each system in the repository to its record in the system inventory and the asset inventory. The asset inventory tool Inventory links PM-05, CM-08
3. Chief Architect For each system and external service, record the owner, the information types, the security category, and the services it depends on. The document management system System profile PM-07, PL-08
4. CDO Record each authoritative data source, data standard, and data flow. Mark each flow that carries personally identifiable information (PII). The document management system Data layer PM-07, PT-02
5. Enterprise Security Architect Record the trust zones, shared security services, and common controls each system inherits. The document management system Security layer PL-08, PM-07
6. Chief Architect After each approved review, change, or retirement, update the repository within 10 business days and record the version. The document management system Version history PM-07

Evidence: the repository index, inventory links, system profiles, data and security layers, and the version history.

3. Yearly Current, Target, and Transition Plan Update #

Entry criteria: The Chief Architect starts the data call three months before the yearly update month.

Exit criteria: The CIO signs the three views, and the Investment Review Board has the transition plan.

Step and actor Action Tool Evidence Controls
1. Chief Architect Each year, ask each program office, the CISO, the SAOP, and the CDO for changes to their layers and plans. The document management system Data call PM-07
2. Chief Architect Update the current architecture from the repository, the system inventory, and the asset inventory. The document management system Current architecture PM-07, PM-05
3. Chief Architect Update the target architecture to match the Information Resources Management (IRM) Strategic Plan, the zero trust goals, and mission changes. The document management system Target architecture PM-07
4. CISO Rate each pillar of the Zero Trust Maturity Model. Set the next maturity stage for each pillar. The document management system Maturity rating PM-07, SA-08
5. Chief Architect Write the transition plan: each gap, the project that closes it, the owner, the date, and the systems to retire. The document management system Transition plan PM-07, SA-22
6. Architecture Review Board Review the three views and recommend them to the CIO. The document management system Board minutes PM-07
7. CIO Approve the three views in the yearly update month. Send the transition plan to the Investment Review Board for funding decisions. The document management system Signed approval PM-07, PM-03

Evidence: the data call, the three approved views, the zero trust maturity ratings, the board minutes, and the CIO’s signed approval.

4. Architecture Review of New Requests and Investments #

Entry criteria: A program office or System Owner proposes a new investment, a major change, or a new cloud service.

Exit criteria: The board approves, approves with conditions, or denies the request, and the Investment Review Board and the Change Control Board have the decision.

The requester attaches these inputs to each request:

  • The mission need, the business functions it supports, and the expected users.
  • The proposed solution, the products it uses, and the systems it connects to.
  • The information types, the security category, and any PII.
  • The estimated cost and the date the program office needs it.

The board judges each request on these criteria:

Criterion Question the board answers
Mission fit Does the request support a function in the business layer and a goal in the IRM Strategic Plan?
Reuse Does the Organization already have a system, service, or license that meets the need?
Data Does the request use authoritative data sources and data standards?
Technology standards Does the request use approved products? Does it add a contained or sunset product?
Security and zero trust Does the design fit the trust zones, identity, logging, and encryption in the security architecture? Does it move the zero trust target forward?
Privacy Does the design limit PII to what the mission needs?
Transition plan Does the request fit the transition plan, or does the plan need to change?

The board decides one of four outcomes: approve, approve with conditions, deny, or approve with a waiver.

Step and actor Action Tool Evidence Controls
1. Program Office or System Owner Submit a review request for a new investment, a major change, or a new cloud service. Attach the inputs listed above. The ticketing system Review request PM-07
2. Chief Architect Check the request for the required inputs within five business days. Return an incomplete request with the missing items. The ticketing system Completeness check PM-07
3. Chief Architect Search the repository and the asset inventory for a system or service the Organization already has that meets the need. The asset inventory tool Reuse check PM-07, CM-08
4. Enterprise Security Architect Review fit with the security architecture, trust zones, identity, logging, encryption, and zero trust goals. The document management system Security review PL-08, SA-08
5. SAOP’s delegate and CDO’s delegate Review new or changed flows of PII, data stores, and data sharing. The document management system Privacy and data review PM-07, PT-02
6. Architecture Review Board Score the request against each criterion in the table above. Decide within the architecture review window. The document management system Scoring sheet and decision PM-07
7. Chief Architect Send the decision to the requester, the Investment Review Board, and the Change Control Board. Record any conditions as tracked actions. The ticketing system Decision notice PM-07, CM-03

Evidence: the review request, completeness check, reuse check, security, privacy, and data reviews, scoring sheet, and the decision notice.

Waivers #

Entry criteria: A request or system cannot meet an architecture standard.

Exit criteria: The CIO or the board grants or denies the waiver, and a granted waiver has an end date and a plan to conform.

Step and actor Action Tool Evidence Controls
1. System Owner Request the waiver. Name the standard, the reason, the risk, the end date, and the plan to conform. The ticketing system Waiver request PM-07
2. Enterprise Security Architect When the waiver affects security or privacy, assess the risk and get the concurrence of the CISO or the SAOP. The document management system Risk statement and concurrence PL-08
3. Architecture Review Board or CIO Grant or deny the waiver. The board may grant a waiver up to the longest waiver term. Only the CIO may grant a longer one or renew one. The document management system Signed waiver PM-07
4. System Owner Record a security or privacy waiver as a risk in the System Security and Privacy Plan (SSPP), with a plan of action and milestones (POA&M) item when the CISO requires one. The governance, risk, and compliance (GRC) system SSPP entry and POA&M item PL-02, CA-05
5. Chief Architect Each quarter, list waivers that end within 90 days. Notify each System Owner. The document management system Waiver report PM-07

Evidence: the waiver request, the risk statement and concurrence, the signed waiver, the SSPP entry, and the quarterly waiver report.

5. Technology Standards Life Cycle #

The Chief Architect gives each product and standard in the technical reference model one of these statuses.

Status What it means
Proposed A product or standard someone asked to add. Offices must not buy or deploy it yet.
Approved Offices may buy and deploy it for any system.
Contained Offices may keep and support current uses. A new use needs a waiver.
Sunset The Organization will retire it by a set date. Each System Owner who uses it keeps a migration plan.
Retired The Organization no longer uses it. The System Owner removes it from every system and the inventory.
Prohibited A law, a federal exclusion order, or a Cybersecurity and Infrastructure Security Agency (CISA) directive bars it, or the CIO bars it for risk. Offices must not buy or use it.

Entry criteria: Someone proposes a product, a vendor announces an end of support, or a law, order, or directive bars a product.

Exit criteria: The technical reference model shows the new status, and each affected System Owner has the notice.

Step and actor Action Tool Evidence Controls
1. Any employee or System Owner Propose a product or standard for the technical reference model. State the need and the products it would replace. The ticketing system Proposal PM-07
2. Chief Architect Check the product for vendor support dates, Federal Risk and Authorization Management Program (FedRAMP) authorization where it is a cloud service, and overlap with approved products. The document management system Product review PM-07, SA-22
3. CISO Check the product for supply chain risk under the Supply Chain Risk Management Policy, and for secure configuration guidance. The document management system Security review SR-05, CM-06
4. Architecture Review Board Recommend a status: approved, contained, or denied. The document management system Recommendation PM-07
5. CIO Approve the status. The Chief Architect publishes the change in the technical reference model. The document management system Updated model PM-07
6. Chief Architect Each quarter, mark as sunset each product that its vendor will stop supporting within the sunset notice period. Set the retirement date and notify each System Owner. The asset inventory tool Sunset notice SA-22, CM-08
7. System Owner Write a migration plan for each sunset product within 60 days of notice. Remove the product by the retirement date. The document management system Migration plan SA-22
8. Chief Architect Mark a removed product as retired. Mark a product barred by law, order, or directive as prohibited within one business day of the notice. The document management system Status change PM-07, SR-05

Evidence: each proposal and product review, the security review, the CIO’s approval, the sunset notices, the migration plans, and the status history.

6. Alignment Checks for Cloud Services and Software as a Service #

The Program Office completes these checks before it buys any cloud service or software as a service (SaaS). The IT Governance and Investment Management Procedure gives the purchase steps that follow.

Entry criteria: A program office plans to buy or renew a cloud service.

Exit criteria: The board decides, and the repository records the service’s trust zone and shared services.

Step and actor Action Tool Evidence Controls
1. Program Office Before buying a cloud service or SaaS, submit a review request, including for a purchase card buy. The ticketing system Review request PM-07, SA-09
2. Chief Architect Check whether an approved cloud service already meets the need. The document management system Reuse check PM-07
3. Enterprise Security Architect Decide whether the planned use is in FedRAMP scope, as “Using FedRAMP and FedRAMP 20x Authorized Cloud Services” in the Assessment, Authorization, and Monitoring Procedure describes. Record the finding. The document management system Scope finding SA-09, CA-06
4. Enterprise Security Architect When the use is in scope, confirm the service’s FedRAMP authorization and impact level match the security category of the information it will hold. The document management system Authorization check SA-09, CA-06
5. Enterprise Security Architect Confirm the service uses the Organization’s identity provider with phishing-resistant sign-in, and sends logs to the Organization. The document management system Identity and logging check IA-02, AU-06
6. CDO and SAOP’s delegate Confirm where the data will live, how it leaves the service at contract end, and whether PII is involved. The document management system Data and privacy check PM-07, PT-02
7. Architecture Review Board Decide on the request and record the trust zone and shared services the service will use. The document management system Decision and placement PM-07, PL-08

Evidence: the review request, the reuse check, the scope finding, the authorization, identity, logging, data, and privacy checks, and the decision with the service’s placement.

7. System Security Architecture and Developer Design Review #

Entry criteria: A system enters authorization, a major change starts, or a developer reaches the design milestone.

Exit criteria: The SSPP matches the approved architecture, and the CISO has decided any departure.

Step and actor Action Tool Evidence Controls
1. System Owner Draft the system’s security and privacy architecture with the SSPP. Show the trust zones, data flows, external services, and inherited controls. The GRC system System architecture PL-08
2. Enterprise Security Architect Place the system in the EA during authorization, in Risk Management Framework (RMF) task P-16. Record the cloud and shared services it uses. The document management system Placement record PM-07, PL-08
3. Contracting Officer For each High-impact system and each HVA, and for development the CISO names, put the architecture and design deliverables in the contract. The document management system Contract clause SA-17, SA-04
4. Information System Security Officer (ISSO) Review the developer’s design specification and architecture against the security architecture. Return gaps to the developer through the System Owner. The GRC system Design review record SA-17, SA-08
5. CISO Decide on any design that departs from the security architecture. Record the decision and its risk. The GRC system CISO decision SA-17, PL-08
6. System Owner Review the system architecture at least every year and after each major change. Carry approved changes into the SSPP. The GRC system Review record and SSPP update PL-08, PL-02

Evidence: the system architecture, the placement record, the contract clauses, the design review records, the CISO’s decisions, and the SSPP updates.

8. Reporting and Measures #

The Chief Architect reports these measures each quarter. The CIO sets the target for each one each year.

Measure How the Chief Architect computes it
Systems placed in the EA Systems with a current placement record, divided by systems in the inventory
Investments reviewed before selection New investments the board reviewed before the select decision, divided by all new investments
Reviews decided on time Reviews decided within the review window, divided by all reviews decided
Sunset products past their date Count of sunset products still in use after the retirement date
Expired waivers Count of waivers past their end date that the CIO has not renewed
Zero trust maturity The current maturity stage of each pillar of the Zero Trust Maturity Model

Entry criteria: A quarter ends, or the yearly update month starts.

Exit criteria: The CIO has the measures report, and each gap from the self-assessment has an owner and a date.

Step and actor Action Tool Evidence Controls
1. Chief Architect Each quarter, compute the measures in the table above from the repository and the review log. The document management system Measures report PM-07, PM-06
2. Chief Architect Brief the CIO and the Investment Review Board on the measures and on reviews that missed the review window. The document management system Briefing record PM-07
3. CIO Each year, assess the EA program against the seven maturity stages in GAO-10-846G. Record an action, owner, and date for each gap. The document management system Self-assessment and action plan PM-07
4. CISO Give the zero trust maturity ratings to the CIO for the yearly update and for federal reporting when OMB or CISA asks. The document management system Maturity ratings PM-07, PM-06

Evidence: the quarterly measures reports, the briefing records, the yearly self-assessment and action plan, and the maturity ratings.

9. Records #

Record Owner Where kept
Architecture repository and its version history Chief Architect The document management system
Current architecture, target architecture, and transition plan Chief Architect The document management system
Review requests and decision notices Chief Architect The ticketing system and the document management system
Board agendas, minutes, scoring sheets, and waivers Chief Architect The document management system
Technical reference model and its status history Chief Architect The document management system
System architectures, design reviews, and CISO decisions System Owner The GRC system
Measures reports and self-assessments Chief Architect The document management system

The Chief Architect keeps these records for the periods in National Archives and Records Administration (NARA) General Records Schedule 3.1, which includes target IT architecture reports.

Evidence: the records listed here, kept in the places listed.

10. References #

These are the sources this document cites, with a link to each official text.

Sources on the governance tracker

The FedXchange governance tracker follows each source this document cites and records each change to it.

Related templates

Change history

  1. : First published in the library. Template version 783d0494946e.