Skip to content
FedXchange
Menu

IT Governance and Investment Management Procedure

Use this free template to write your agency's IT Governance and Investment Management Procedure. It maps to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, and it sits with the Program Management (PM) family. This copy follows the Low baseline. It names 11 controls and leaves 7 values for your agency to fill in. It calls the agency that adopts it "the Organization", and it names each person by role and each tool by its function. It cites 7 federal sources.

Approved by: Chief Information Officer (CIO); Chief Information Security Officer (CISO), concurring

From the document: The CIO, the Chief Financial Officer (CFO), the Chief Acquisition Officer (CAO), the Chief Operating Officer (COO), and program offices use this procedure. It covers every IT resource the policy covers. Each step names the actor, the tool, the evidence the actor keeps, and the controls the step supports.

Download

Downloads need a free FedXchange account. Sign in, and the download starts.

Controls covered

  • CA-06
  • CM-08
  • MP-06
  • PM-03
  • PM-07
  • PM-09
  • RA-02
  • SA-02
  • SA-04
  • SA-22
  • SR-05

Every Program Management (PM) template

The text of the IT Governance and Investment Management Procedure

Approval #

The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.

Role Name Signature
Chief Information Officer (CIO)
Chief Information Security Officer (CISO), concurring

Revision History #

Date Version Description Reviewer
2026-10-31 1.0 Initial issuance [Reviewer name]

Review cycle: Every year under the Policy and Procedure Management Policy, and within 90 days after the Office of Management and Budget (OMB) changes Circular A-130, Circular A-11, or its IT acquisition guidance.

Mandate. The Chief Information Officer (CIO) issues this procedure to carry out the IT Governance and Investment Management Policy. OMB Circular A-130 requires agency-wide procedures for IT investment reviews and CIO approval of IT acquisitions (OMB Circular A-130, §5). The Clinger-Cohen Act requires a process to select, manage, and evaluate information technology (IT) investments (40 U.S.C. § 11312). The steps also carry out National Institute of Standards and Technology (NIST) SP 800-53 control PM-03 and the Common Baseline of the Federal Information Technology Acquisition Reform Act (FITARA).

1. Purpose and Scope #

The CIO, the Chief Financial Officer (CFO), the Chief Acquisition Officer (CAO), the Chief Operating Officer (COO), and program offices use this procedure. It covers every IT resource the policy covers. Each step names the actor, the tool, the evidence the actor keeps, and the controls the step supports. The CIO sets each threshold below before the first use.

Value Setting What it controls
Business case threshold [Assignment: organization-defined business case threshold in life-cycle dollars — to be defined] An investment or acquisition at or above this total life-cycle cost needs a full business case and alternatives analysis.
Major IT investment threshold [Assignment: organization-defined major IT investment threshold in annual dollars — to be defined] An investment at or above this annual cost is designated major, along with the other factors in OMB Circular A-11, section 55.4(a).
Delegated review limit [Assignment: organization-defined delegated review limit in dollars — to be defined] Below this value, the CIO may let an official who reports directly to the CIO approve an acquisition for a non-major investment.
Cost variance limit [Assignment: organization-defined cost variance limit in percent — to be defined] A cost variance above this percent of the approved baseline starts a corrective action plan.
Schedule variance limit [Assignment: organization-defined schedule variance limit in percent — to be defined] A schedule variance above this percent of the approved baseline starts a corrective action plan.
Post-implementation review window [Assignment: organization-defined post-implementation review window in months — to be defined] The program office completes the post-implementation review within this many months after the investment goes into use.
TechStat window [Assignment: organization-defined TechStat window in calendar days — to be defined] The CIO holds a TechStat session within this many days after a trigger occurs.

Evidence: the approved policy, with every threshold set, in the policy library.

2. Intake of IT Requests #

Step and actor Action Tool Evidence Controls
1. Program Office Submit an IT request for any purchase, renewal, cloud service, or contract that includes IT. Include the mission need, estimated cost, funding source, and desired date. The IT intake system IT request PM-03, SA-02
2. IT Intake Team Check the request within five business days. Classify it as a new investment, a change, a renewal, or a purchase under an existing investment. The IT intake system Intake record PM-03
3. IT Intake Team Search the asset inventory and the software license inventory for something the Organization already owns that meets the need. The asset inventory tool Reuse check CM-08
4. IT Intake Team Review the request with the CISO’s office, the Privacy Officer, the Section 508 Program Manager, IT Operations, and the Application Development Team. Record each reviewer’s requirements and the decision. The IT intake system Stakeholder review SA-04, PM-03
5. IT Intake Team Check whether a government-wide contract or a General Services Administration (GSA) agreement meets the need. Record the vehicle, or the reason none fits. The IT intake system Vehicle check SA-04
6. Architecture Review Board Review supportability: a real need, staff to support it, compliance, compatibility, and support capacity. Return the request with reasons when it fails. The document management system Supportability review PM-07
7. System Owner and Privacy Officer Complete the security categorization and the privacy threshold analysis for any new system, cloud service, or new use of personal information. The governance, risk, and compliance (GRC) system Categorization and threshold analysis RA-02
8. IT Intake Team Route the request. At or above the business case threshold, send it to the business case step. Below it, send a new investment to the CIO for selection. Send any purchase to CIO acquisition review. The IT intake system Routing decision PM-03

Evidence: the IT request, intake record, reuse check, stakeholder review, vehicle check, supportability review, categorization, and routing decision.

3. CIO Acquisition Review #

The Contracting Officer must not approve a plan or award a contract that includes IT until this review is complete (OMB Circular A-130, §5(d)(2)).

Step and actor Action Tool Evidence Controls
1. Contracting Officer Send the acquisition strategy, acquisition plan, interagency agreement, or contract action to the CIO before approval or award. The ticketing system Review package SA-04
2. CIO’s acquisition reviewer Check mission fit, contract type, the IT parts of the statement of work, delivery in short increments, and retirement of end-of-life systems. The ticketing system Review checklist SA-04, SA-22
3. CISO Confirm the contract carries the security and privacy contract terms, and the supply chain review is complete. The document management system Security concurrence SA-04, SR-05
4. Senior Agency Official for Privacy (SAOP) Confirm the privacy clauses and the privacy review when the contract involves personal information. The document management system Privacy concurrence SA-04
5. CIO Approve, approve with conditions, or deny. For a non-major investment below the delegated review limit, the CIO’s direct report may decide. The document management system Signed decision PM-03
6. Contracting Officer File the decision in the contract file. Do not award until the CIO, or the CIO’s authorized direct report, approves. None Contract file SA-04
7. CFO Send any request to reprogram IT funds to the CIO, and send it on only after the CIO approves. The document management system Reprogramming approval PM-03

Evidence: the review package, checklist, security and privacy concurrences, the CIO’s signed decision, and the contract file entry.

4. Investment Proposal and Business Case #

The Program Office completes this step for any investment at or above the business case threshold (OMB Circular A-130, §5(d)(3)).

Step and actor Action Tool Evidence Controls
1. Program Office Draft the business case: need, goals, measures, benefits, risks, and an incremental delivery plan. The document management system Business case PM-03, SA-02
2. Program Office Compare at least three options: reuse, a shared service or government-wide contract, and a commercial or custom solution. Show the life-cycle cost of each. The document management system Alternatives analysis PM-03
3. Program Office and CFO Estimate the life-cycle cost. Show development, operations, security, privacy, and retirement costs as separate lines. The document management system Cost estimate PM-03, SA-02
4. Program Office Classify the costs by the IT towers and cost pools of the Technology Business Management (TBM) taxonomy that OMB Circular A-11 names. The document management system Cost classification PM-03
5. Architecture Review Board Review the preferred option against the enterprise architecture, technical standards, and data standards. The document management system Architecture review PM-07
6. CISO and SAOP Review the security and privacy requirements and costs. Return the case when a cost line is missing. The document management system Security and privacy review PM-03, SA-02

Evidence: the business case, alternatives analysis, cost estimate, cost classification, and the architecture, security, and privacy reviews.

5. Investment Review Board Select Decision #

Step and actor Action Tool Evidence Controls
1. CIO’s portfolio manager Place each complete business case on the next Investment Review Board agenda. Send the papers to members five business days before the meeting. The document management system Agenda and papers PM-03
2. Investment Review Board Score the investment on mission value, cost, risk, architecture fit, security, and privacy. Compare it with the rest of the portfolio. The document management system Scoring sheet PM-03, PM-07
3. Investment Review Board Select, defer, or reject the investment. For a selected investment, approve the cost, schedule, and performance baseline. The document management system Decision memorandum PM-03
4. CIO Designate the investment as major or non-major, using the major IT investment threshold and the factors in OMB Circular A-11, section 55.4(a). The document management system Designation record PM-03
5. CIO’s portfolio manager Add the investment and its baseline to the IT portfolio. The document management system Portfolio entry PM-03
6. CIO For a new investment below the business case threshold, select or reject it from the IT request. Record a cost and schedule baseline, and add it to the portfolio as non-major. The document management system Selection record and portfolio entry PM-03
7. CIO’s portfolio manager List the CIO’s below-threshold selections for the Investment Review Board each quarter. The document management system Quarterly selection list PM-03

Evidence: the agenda, scoring sheet, decision memorandum, designation record, and portfolio entry.

6. Control: Monthly and Quarterly Reviews and TechStat #

A TechStat is a face-to-face, evidence-based review of an investment with the CIO and agency leaders (OMB M-15-14). The CIO holds one when a trigger in the policy occurs.

Step and actor Action Tool Evidence Controls
1. Program Office Report actual cost, schedule, and performance against the baseline by the tenth business day of each month. The document management system Monthly status PM-03
2. CIO’s portfolio manager Compute cost and schedule variance. Flag any variance above the cost or schedule variance limit. The document management system Variance report PM-03
3. Program Office For a flagged investment, write a corrective action plan within 30 days. Send it to the Investment Review Board. The document management system Corrective action plan PM-03
4. CIO Rate each major IT investment each quarter on the 1 to 5 scale. Weigh risk, requirements, contractor oversight, past performance, and staffing. The document management system CIO risk rating PM-03, PM-09
5. Investment Review Board Review the portfolio each quarter. Accept or change each corrective action plan. The document management system Quarterly minutes PM-03
6. CIO Hold a TechStat within the TechStat window after a trigger in the policy occurs. The document management system TechStat notice PM-03
7. CIO After the TechStat, record the actions and owners. Recommend to the agency head any change, pause, or end of the investment. The document management system TechStat record PM-03

Evidence: the monthly status reports, variance reports, corrective action plans, CIO risk ratings, quarterly minutes, and TechStat records.

7. Evaluate: Post-Implementation Review and Retirement #

Step and actor Action Tool Evidence Controls
1. Program Office Complete the post-implementation review within the review window. Compare results with the business case and record lessons learned. The document management system Post-implementation review PM-03
2. Program Office For each investment in operation, complete an operational analysis each year. Compare cost and performance with the baseline and other options. The document management system Operational analysis PM-03, SA-02
3. Investment Review Board Decide to keep, change, modernize, or retire the investment. The document management system Decision memorandum PM-03
4. System Owner For a system to retire, plan the migration, data disposition, and contract close-out. Set an end date. The document management system Retirement plan SA-22
5. System Owner Sanitize media under the Media Protection Policy. Close the system’s authorization record. The GRC system Sanitization and closure records MP-06, CA-06
6. CIO’s portfolio manager Remove the investment, its assets, and its licenses from the portfolio and the inventories. The asset inventory tool Updated inventories CM-08

Evidence: the post-implementation reviews, operational analyses, decision memoranda, retirement plans, sanitization and closure records, and inventory updates.

8. Annual IT Budget Formulation #

The CIO approves the IT portion of the budget request before the Organization sends it to OMB (OMB Circular A-130, §5(a)(3)).

Step and actor Action Tool Evidence Controls
1. CIO Issue the IT budget call when the CFO issues the agency budget call. State the format and the due date. The document management system IT budget call PM-03
2. Program Office Submit IT resource needs for every program that includes IT. Show security and privacy costs as separate lines. The document management system IT resource requests PM-03, SA-02
3. CFO, CAO, and CIO Review the requests together. Keep IT resources separate from other resources. Balance IT investments against other uses of funds. The document management system Review notes PM-03
4. SAOP Review the IT investments for privacy requirements and privacy costs. The document management system Privacy review PM-03
5. CIO Approve the IT portion of the budget request. The document management system Signed approval PM-03
6. CFO and CIO Put the affirmation statements that OMB Circular A-130 requires into the budget justification. Send the request to OMB. None Budget submission PM-03

Evidence: the IT budget call, resource requests, review notes, privacy review, CIO approval, and the budget submission with its affirmation statements.

9. IT Portfolio Reporting to OMB #

OMB Circular A-11, section 55, lists the agencies that report IT portfolio data. OMB may ask any other agency for the same data (OMB Circular A-11, §51.3(b)). The steps that begin “When OMB requires it” apply only then.

Step and actor Action Tool Evidence Controls
1. CIO’s portfolio manager Each fall, confirm with the OMB budget examiner what IT data OMB wants. Record the answer. The document management system OMB instruction PM-03
2. CIO’s portfolio manager When OMB requires it, send cost, schedule, and performance data for each major IT investment at least every six months. None Submission receipt PM-03
3. CIO When OMB requires it, send each CIO risk rating at least once each quarter. None Submission receipt PM-03
4. CIO’s portfolio manager When OMB requires it, send the Budget Accounts Summary and the TBM towers and cost pools. None Submission receipt PM-03
5. CIO and CAO When OMB or GSA asks, send IT vendor use and price data in a machine-readable format. None Data transmittal SA-04

Evidence: the OMB instruction, each submission receipt, and each data transmittal.

10. FITARA Self-Assessment and Scorecard Response #

The Common Baseline binds the agencies named in the Chief Financial Officers Act. The Organization applies it as policy, as OMB M-15-14 encourages.

Step and actor Action Tool Evidence Controls
1. CIO Each year, assess the Organization against the Common Baseline in OMB M-15-14 and this policy. Rate each element as met, partly met, or not met. The document management system Self-assessment PM-03
2. CIO Write an action, an owner, and a due date for each element not met. Brief the Investment Review Board. The document management system Action plan PM-03
3. CIO and COO Review the whole IT portfolio once a year to find duplicates, savings, and systems to consolidate. The document management system Portfolio review PM-03
4. CIO When a FITARA scorecard or an audit grades the Organization, answer each finding within 30 days. Track each action to closure. The document management system Response and tracker PM-03

Evidence: the self-assessment, action plan, portfolio review, and each response with its tracker.

11. Records #

Record Owner Where kept
IT requests, intake records, stakeholder reviews, and routing decisions IT Intake Team The IT intake system
CIO acquisition decisions and reprogramming approvals CIO The document management system and the contract file
Business cases, alternatives analyses, and cost estimates Program Office The document management system
Investment Review Board agendas, minutes, and decisions CIO’s portfolio manager The document management system
Status reports, risk ratings, and TechStat records CIO’s portfolio manager The document management system
Budget submissions and OMB submissions CFO and CIO The document management system
Categorizations, authorizations, and closure records System Owner The GRC system

The CIO keeps these records for the period in National Archives and Records Administration (NARA) General Records Schedule 3.1.

Evidence: the records listed here, kept in the places listed.

12. References #

These are the sources this document cites, with a link to each official text.

Sources on the governance tracker

The FedXchange governance tracker follows each source this document cites and records each change to it.

Related templates

Change history

  1. : First published in the library. Template version 783d0494946e.