THIS FILE IS MADE AVAILABLE TH RDLIGH THE DEGLASSIFIG ATIGN AND RES EARGH THE BLAEH IS THE LARGEST FREEDGM DF AGTIGGVERNHENT REGDRD ELEARING IN THE THE RESEARCH HERE ARE FDR THE DEGLASSIFIGATIDN GF THDUSANDS DGGUMENTS THRGUGHDUT THE U FDRWARD THIS DDGUMENT TDUR FRIENDS EILJT PLEASE THIS IDENTIFTING IMAGE AT THE TDP IDF THE SD GTHERS MIDRE1 OFFICE OF THE ASSISTANT SECRETARY OF DEFENSE 1400 DEFENSE PENTAGON WASHINGTON DC 20301-1400 PUBLIC AFFAIRS 1 1997 Ref 97-F-0489 Ms Victoria Patten Director Software Marketing Comdisco 'Inc 7500 College Blvd Suite 990 Overland Park KS 66210 Dear Ms Patten This responds to your March 14 1997 Freedom of Information Act request Our March 21 1997 interim response refers The enclosed document is provided as responsive to your request There are no charges for processing this request in this instance Sincerely Passarella Director Freedom of Information and Security Review Enclosure As stated 45100 Continuity Operations Software Evaluation wave 1 mwh rw 23m 5 me ma wzufu-g 2 3 he rmnmaam yaw- 3 111511 qu Hr 7 2-4 - 1 - i rut- v12 411 i tw wmuaumxt u Table of Contents 5 Executive Summary Introduction A 1 Document Overview 1 Project References 1 Project Background 2 Bene ts 2 Summary of Functional Requirements 3 System Summary 5_ Background 5 5 Existing Methods and Procedures 7 Proposed Methods and Procedures 8 Detailed Characteristics 9 Approach 9 Functional Requirements 9 Environment 13 Assumptions and Constraints 13 System Support Organization 13 Equipment 14 Support Software 14 Communications 15 Failure 15 Security 15 System Development Plan - 16 Commercial Off The Shelf COTS Software Vendors and Products 16 Summary Of Evaluation Comparison 1 7 Functional Requirements Matrix 17 Application Issues 18 Implementation Issues 20 Course of Action Rapid Fielding 22 Course of Action Model-Based Development 22 Additional Courses of Action 23 Recommendations 24 Cost Analysis 25 Appendix A Functional Requirements Matrix 1 A-l Appendix B Rating Scales B-l Strohl Systems- v8 0 4 B l COMDISCO - v3 2 0 B-4 SunGard - CBR v2 0 B-7 Recovery Management Inc - REXSYS v4 2 Appendix C Acronyms C-l i This r11 11 as men 111 11 SR 1111c1111110'11l contract - 1912 171111112315 Execu ve Summary The Under Secretary of Defense Policy has tasked the Of ce of Emergency Flaming to lead the continuity of operations project The main goal of this work is to support planning for how the critical principals and staff members prepare for and execute noti cation movement and the resumption of activities at alternate locations in the case of a contingency which makes their primary location untenable To achieve this goal and minimize the cost of the program there must be management processes in use throughout the organization supported by a standard tool set which optimizes the organization and tracking of data assists in the deconfliction of plans minimizes the time required to execute the plan and supports sustaining operations in the event of a continuity of operations contingency OSD has a functional requirement for a management tool that can help the staff meet their goals by serving as a basis for building a mutual understanding and exchanging information between the varied groups involved in continuity of operations planning These stakeholders include the professional continuity of operations planners extra-duty organizational staff planners principals the Crisis Coordination Center and the management and staff responsible for sustaining operations at alternate locations To meet this requirement this report documents the functional requirements and critically reviews the leading commercial software A recommendation on which tool best meets the OSD functional requirements is provided There are a number of available commercial off the shelf emergency management software products which offer the government the potential to quickly irriplement a tool to support its needs without funding a major system development effort Commercial software has the potential to signi cantly reduce the cost of acquiring and implementing a management tool to support the continuity of operations process The Defense Finance and Accounting Service DFAS recently pursued this approach to select and implement software for its own continuity planning efforts This document accomplishes several tasks in preparation for acquisition of a management utility The issues surrounding implementation and application of the management utility are addressed and bounded in terms of time and resources required Alternative approaches to these tasks are proposed The Strohl Systems product is the best of its class It meets all established functional requirements provides a high degree of security and provides the exibility required to meet the emerging needs of the continuity of operations planning community Priced below twenty- ve thousand dollars for a local area network application with unlimited client licenses it meets contracting requirements for a small purchase order lntroductibn Document Overview Project References This document identi es and describes the functional requirements for acquiring a continuity of operations software tool This document is divided into the following areas 0 Section 1 provides an overview of the document and some background on OSD continuity of operations planning and management processes This section summarizes the objectives for the management processes and discusses existing procedures Proposed methods are outlines emphasizing the systems components and architectures required to achieve OSD goals 0 Section 2 provides a description of the objective management utility which is a software tool which assists continuity of operations planners and managers organize track and share their important data and documents Objectives for the software are detailed as are existing and proposed business procedures 0 Section 3 describes the detailed characteristics and performance measures for a continuity of operations management utility 0 Section 4 outlines the operating environment for the'continuity of operations software tool It begins with a review of the baseline assumptions and constraints followed by a summary of the information technology environment which supports continuity of operations planners and managers Systems requirements are also discussed 0 Section 5 provides the reCommended software and discussed application and implementation issues A general cost estimate is included 7 The appendices contain the evaluation and ratings matrices and acronyms listing The OSD Continuity of Operations Plan and related efforts to include this software evaluation study are guided by the following authorities and publications 1 Executive Order E0 12656 Assignment of Emergency Preparedness Responsibilities 2 Directive 3020 26 Continuity of Operations COOP Policy and Planning May 1995 Project Background Benefits 3 Directive Of ce of the Secretary of Defense 1 Continuity of Operations Plan Vanguard U Interim Plan 6 December 1996 i 4 Pentagon Renovation Program Technical Report for Pentagon Renovation Telecommunications Architecture August 1993 5 Decision Support Architecture Implementation Plan 30 Nov 93 6 Software Package Selection and Evaluation David M Clark The Handbook of IS Management 3rd edition 1991 Auerbach Publishers In 1986 developed a series of continuity of operations plans that were designed to enable the U S Government and Departments to conduct operations during an attack against the Continental United States In February of 1995 the Assistant to the President for National Security Affairs forwarded a memorandum to the Secretary of Defense revalidating the requirement to provide Continuity of Operations COOP for the Federal Departments to be able to respond against the more diverse type of threats currently facing the US Government such as the Oklahoma City federal building and New York City World Trade Center bombings The memorandum stated it was the policy of the Administration that continuity of operations plans should address all-hazard emergencies such as natural disasters military attacks terrorist incidents and technological emergencies that threaten the national security As a result is in the process of updating the 1986 continuity of operations plan for OSD and is working towards ensuring that the Pentagon-based headquarterscontinuity of operations plans can operate in an integrated fashion to support the Secretary This effort to evaluate emergency management software directly supports efforts to develop continuity of operations plans for OSD by providing an effective means to manage continuity of operations data and standardize planning efforts throughout OSD - Automated management processes and tools can help the Of ce of Emergency Planning to realize a number of bene ts The bene ts listed below are general in nature and result from implementing a standard automation tool As described in Proposed Methods and Procedures speci c additional functional improvements to the continuity of operations planning process may be developed after the implementation of a tool As appropriate these functional improvements will-be documented in updates to the governing document Directive 3020 26-P Of ce of the Secretary of Defense Continuity of Operations Plan Vanguard U Interim Plan 6 December 1996 Summary of Functional Requirements 3 Improved communication within the COOP community Gaps and con icts within individual plans will be easier to identify and correct 0 Enhanced and simpli ed access to COOP plans by all those who are affected including principals staffers support organizations and the primary and alternate work locations Meets the OSD requirement for community wide continuity of operations plans to enhance interoperability oversight and management in the case of an emergency 0 Enhanced access to accurate reliable and timely information Automated processes provide a standardized format with a uniform level of detail and standard data elements 0 Correlation of multiple types of emergency plans against different contingencies a Reduced cost to implement and sustain the program as measured by the number of people required to develop and maintain continuity plans for all affected organizations The OSD continuity of operations planning requirements are divided into ve groups three of these groups represent user requirements The last two groups represent requirements for the system and the operating environment 0 Assist the various OSD components in plan development and management 0 Support components and speci c organizations such as the COOP Response Cell in executing the OSD plan 0 Support in meeting its continuity of operations training exercise and oversight functions 0 Be interoperable with the major software in use within OSD including Microsoft Of ce and Exchange and Lotus Notes Be capable of cross-platform usage Provide for electronic mail and enterprise-wide messaging using _o Be based on an open systems architecture that does not limit future expansion of the system inEluding developments in software and hardWare System Summary Background Objectives a - It is envisioned that the utility will assist continuity of operations planners to plan for and execute relocation plans during contingencies It is not the primary tool for OSD components to use to execute their mission essential tasks such as to develop policy or prosecute war at their relocation sites Other management systems of ce productivity suites and messaging platforms required to support these tasks need to be available at the relocation sites However data stored in the utility may provide indirect support to executing mission essential tasks The initial use of the management and planning utility is limited to OSD and its component organizations Beyond OSD and its alternate sites a future consideration is to expand implementation of such a software-based system to the Services Joint Staff Defense Agencies and CINCs to support their continuity of operations planning efforts Tools developed for use by continuity planners should t into the longer term strategy that takes advantage of Internet Intranet technology to integrate the community into a virtual of ce As such the selection of emergency management software should be compatible with network throughout the continuity of operations community Continuity of operations planners must prepare for a variety of emergency contingencies Each situation presents a set of challenges which are both common to all contingencies and unique to the speci c challenge The utility should assist planners in executing those tasks which are common to all contingencies taking into account the unique requirements of each emergency situation The utility should assist OSD planners in navigating the requirements and individual decisions of a speci c contingency and accomplishing the following objectives 0 Standardize OSD continuity of operations plans using templates customized to meet the functional requirements and nomenclature 0 Support Speci c continuity of operations planning The utility should support implementing and maintaining Rosters containing key personnel and critical data such as telephone numbers skill areas Military Assistants SOPs and task lists - Staff augmentation requirements and plans Key documents inventories and reference material Transportation plans Reception plans at alternate locations including security accreditation - Required logistics and communications support at relocation facilities Security plans Plans for special support requirements Support OSD continuity of operations plan execution by Providing the capability to merge key data from all OSD plans into asingle database to support COOP Response Cell CRC activities Providing a utility to back up critical continuity of operations databases and information repositories Distributing critical continuity of operations databases and information repositories to relocation sites Enhancing the telephonic and electronic mail noti cation systems Supporting the transportation coordination process Supporting the security coordination process Enhancing the ability of the continuity of operations planning staff to provide ongoing support at the relocation sites Support management and oversight responsibilities through training and exercises designed to validate continuity of operations plans The utility must support the creation of standard and ad hoc reports from both the individual organizations plans and the merged OSD-wide plan Support publication of continuity of operations documents that can be published electronically and in paper format Support the continual process of decon icting OSD continuity of operations plans Enhance the ability of continuity of operations planners to distribute information to speci edindividuals and organizations throughout all phases of the planning and execution process -- - Existing Methods and Procedures - Ensure the OSD plan includes the gontinuity of operations plans for all subordinate organizations including key information such as - Relocation sites - Key personnel and critical contact information Mission-essential functions - Essential logistics and communications requirements at the relocation sites - Transportation plans to and from the relocation sites - Evacuation procedures Training and exercise schedules Alert and noti cation procedures effort to revise the OSD continuity of operations plan comes after a number of years in which diminishing resources and attention towards continuity of operations have had their effect Many ofthe old processes and systems used to support the 1986 plan either no longer exist have atrophied over the years or become obsolete As the new program continues to develop and mature processes and systems that will be required to support Continuity of operations planning and execution are only now being identi ed designed and evaluated In the few cases where processes have been identi ed and are being performed at least to some extent users currently resort to using tools easily available or familiar to support them in performing their tasks However these tools are not necessarily best suited to perform the task Furthermore many processes are not yet developed to the point where integration opportunities can be exploited For example planners use existing word processing tools to develop textual data such as plans However these plans are generally stored at the local user level Others are unable to view or share this information since networking and communications capabilities are not yet incorporated into the process Similarly lists of information that must be maintained such as a relocation roster are maintained using tools of the user s preference The range of formats includes paper lists database or spreadsheet applications Where information must be shared or distributed such as a roster list it is generally done via paper copies over fax machines In some cases the same information is maintained in various formats in different organiZations In short existing methods and procedures are in an evolutionary state What is known is that users require the capability to write and store textual information utilize database technology to store and manipulate data elements and through computer and communication technology be able to Proposed Methods and Procedures integrate people and information across the continuity of operations community As OSD proceeds with its series gr exercises to evaluate the overall plan the methods and procedures will take further shape Any software utility considered to support the process must be exible enough to deal with this changing state Information systems planning is a strategic and disciplined approach to determining the most ef cient and effective means of satisfying an organizations information requirements The traditional approach to this planning is to analyze the mission and function to be performed determine who performs the function identify the information and data required to perform the function and then to de ne the automated processes needed to structure and display the information The methodology used to de ne the functional requirements for the continuity of operations process follows this discipline but stops after the miSsion and functions have been analyzed Completing this task involves de ning what information is necessary how planners will collect the data and how they will share that information This report describes the general bene ts expected to be accrued from the use of an automation tool rather than discreet functional improvements given the insertion of a speci c technology Speci cally de ning how the tool will support the continuity of operations planning process is a dynamic process that will change as functional improvements are identi ed and implemented The implementation of a software tool to assist the planning process and the management of a continuity of operations contingency is one step in the functional improvement process De ning improved methods and procedures will be a result of using the tool not simply the implementation of the automated planning utility Future exercises where continuity of operations planners use the software tool will result in lessons learned which can then be applied as process improvements Rigorously de ning objectives and fu ctional requirements for the software utility will drive the choice of a tool towards an open exible system that enhances the opportunities for future process improvements Most of the vendor products reviewed do not meet these criteria The vendor selection process used here avoids vendor proprietary solutions which limit future enhancements This should ensure the continued viability of the system to meet the dynamic information requirements of OSD Detailed Characteristics 1 Approach Functional Requirements The functional requirements that describe the OSD continuity of Operations software were developed by combining several different perspectives This included evaluating market leading software surveying other federal government implementations of continuity of operations tools and a literature review Software vendors demonstrated their tools and or discussed their business models This process culminated in the realization that the OSD functional requirements are different DFAS or other typical users of this type of software The major differences include OSD focuses on crisis management rather than business recovery Further OSD must selectively manage priorities that ensure the ability to achieve continuity of essential functions 0 OSD planning requirements and formats are unique within the continuity of operations community When a continuity of operations emergency occurs the OSD principals may be anywhere in the world the alternate support locations may vary and the requirements for support may vary Further there is no acceptable down time in providing OSD support to national defense and security processes This immediacy of need and degree of variability sets these requirements apart from other organizations 0 Nomenclature and language differences 0 The OSD environment is multi tiered and mum-organizational Decon iction of plans schedules and assets is a major task 0 The OSD requires the tool to provide information to support decision making in a uid and complex environment This dictates many of the characteristics of a Decision SuppOrt Tool DST as well as an organized and structured planning tool This section describes the various continuity of operations management requirements from the user perspective Users may be continuity planners individuals covered in the plan or other stakeholders in the process or involved in the information stored in the utility While the management utility must operate with many points of data entry there are detailed business rules regarding the visibility of data Organizations may or may not be allowed a view all or part of another organizations plan Regardless of the status of business rules changes in one plarr may require corresponding changes in other organization s plan The utility must allow for this occurrence while maintaining overall security The following paragraphs describe the functional requirements of continuity of operations planners Information Security Security is a signi cant issue throughout the community The utility must operate in a environment and meet the C2 requirements established by the National Security Agency The OSD organization workson a variety of Departmental LANs which are all within a closed system ensuring security User access is password-protected with additional security implemented through workgroup membership Business rules allow or prevent individuals and or Workgroups from accessing different data sets Works with existing office productivity software Continuity of operations planners function within the general environment of the Of ce of the Secretary of Defense Continuity of operations is an additional duty for most planners A management utility that seamlessly integrates with standard of ce productivity software is optimal for these individuals In general Microsoft Of ce is the standard suite of desktop software However there are areas where Lotus products are used and several pockets of Macintosh users The utility must also interface with the non-standard of ce software Windows compatible Most users in OSD are standardized on the Windows interface and many use Windows 95 'However telecomputing users cannot be expected to have state-of the-market automation so the utility must not require system resources greater than a 486 class machine In general OSD users run applications on the desktop machine while the data resides on the server The Local Area Network uses and is migrating from standard class ve cabling to ber optics LANs are multi-segmented using routers - 10 Compatible with existing E-Mailfand wide-area data communications capabilities The utility must be compatible with the various electronic mail packages in use within the Department of Defense Users have many opportunities to share les and documents from continuity of operations planning and generally do so by attaching them to E-Mail messages In addition planners are required to update their plans and databases regularly when there are changes or updates to other plans These updates can best be handled by automating the updating process In the event of an emergency these planners must notify a signi cant number of individuals and locations This can best be achieved through an automated process that uses data stored in the management utility and access to local and long-distance unclassi ed telephone lines electronic-mail and secure telecommunications Flexible database capabilities Continuity of operations planners must maintain lists of many data items Examples of the range of data required to be kept are the names addresses and phone numbers of all individuals who require noti cation in the event of a contingency to the logistical status and inventory of items at alternate locations These data elements must be cross referenced and sorted using simple to complex lters Multiple users must be able to view and update these lists Finally there are many reports both tabular and graphic that must be generated from these lists Supports project management software Executing a continuity plan is a multi-step process that involves many individuals and organizations As such current work ow concepts and utilities can be used to ensure all users are aware of the status of their and other organizations execution of the continuity plan Planners often work from standing Operating procedures SOPs which must be captured in the utility During the execution of an emergency plan these SOPs are used to organize the actions taken to achieve the overall goal of continuity of operations These SOPs are generally templates which can be shared between organizations Supports electronic library capabilities In addition to the data stored in lists continuity planners must maintain many documents that pertain to their organizations These documents range in size from simple one-page information papers to books '11 with embedded graphics Beyond tExt there is'a requirement to store audio and pictures Internet Intranet capabilities Several factors drive the requirement that continuity of Operations planners be able to function in a virtual of ce con guration Telecomputing is increasing throughout the and there is reason to believe that an emergency contingency will occur during normal-duty hours when planners have access to their desktops The plan must be executable at any time of day from any location This drives a requirement for remote access by planners and anyone that needs the information stored in the utility Management and testing By directive the has the requirement to oversee the continuity of operations planning system This is both a policy requirement and an operational requirement the Of ce of Emergency Flaming must develop policies and instructions that govern continuity of operations planning as well as provide the operational capability to execute the process The management utility must support both these functions The utility must have the ability to integrate subordinate organizations plans This supports oversight since it makes plans inspectable Further the management utility must support testing the planning process through actual exercises and simulations 0 Assumptions and Constraints System Support Organization The set of assumptions that apply to the technical implementation of continuity of operations software are generally consistent with the Pentagon renovation plan Since the normal duty location for most continuity of operations planners and individuals affected by the plans is the Pentagon the information technology initiatives in the renovation plan will signi cantly impact on their use of the system The renovation will cause some temporary disruption due to of ce relocations but there are no issues which will require signi cant changes to continuity of operations planning The following assumptions from the Pentagon Renovation Plan illustrate this pomt 0 User access and bandwidth on demand requirements will range from less than 100 to more than 1 Gbps 0 Secret Top Secret and SCI classi ed communications over individual ber optic strands can coexist in the same multi-strand ber optic cable 0 Multi-Level Security MLS will mature as a technology and become an integral element of users future applications systems and networks 0 Value-added applications and services'such as the Defense Messaging I System DMS and of ce automation servers will evolve in the future to be common user services in the Pentagon 0 Technical control facilities command centers and operations centers will be situated in the renovated basement and mezzanine resulting in high concentrations of classi ed telecommunications and requirements in these areas Any software tool implemented by will be supported by the Support Division This organization operates the Network commonly known as the POLYNET This is a secure automated information system that provides the enterprise-wide network architecture for the 1 100-plus staffers The POLYNET operates out of the Operations Control Center OCC and is staffed by a combination of military and civilian employees Pentagon Single Agency Manager employees and contractor support This organization provides full interoperability at the workgroup Equipment Support Software and enterprise level for all OSD users regardless of hardware and software con gurations i The POLYNET decision support infrastructure is capable of facilitating electronic communication both E Mail and le transfer fault tolerance external connectivity and multiple levels of security This is the foundation upon which the OSD user and workgroup tools are built to facilitate decision making and support roles The POLYNET operates a diverse set of hardware to support the range of workgroup and individual user functional requirements In surrunary there are no structural limitations to the choice of a software tool attributable to the on hand equipment in The POLYNET supports end-uses working on the Intel Windows PCs as well as Macintosh and SUN workstations running Unix variants 0 Remote access is achieved through both dial-in using communications servers and access Secure access is achieved through both and Motorola Network Services NES - SIPRNET access is achieved by connection to the secure routers Backbone services are provided by an FDDI ring 0 Optical disk servers provide one type of on-line information repository made up of multiple CD-ROMs A variety of scanners are in use across The POLYNET operates a diverse set of software to support the range of workgroup and individual user functional requirements In summary the selection of COTS software to support continuity of Operations planning will be supportable by the POLYNET At the same time some individual users most likely users with SUN workstations may experience some challenge in using the tool 0 PC-based workgroup LAN connectivity is provided by Novell s Netware 4 1 SUN workgroups use Solaris or the SUN OS Macintosh workgroups are supported with Appleshare NFS The most wide-spread end user office productivity suite is Microsoft Of ce Unfortunately not all COTS end-user applications are interoperable at this time For example Microsoft s word processor Word is interoperable between the Intel-based and Macintosh platforms However Unix users use Aster X 14 Communications Failure Contingencies Security Microsoft Mail is the most common electronic mail product SMTP is used to manage external snail and another third party tool is used to manage messages across the various operating systems is the most common transport protocol 0 Lotus Notes is used for collaborative computing including a message handing system called the Cable Handling and Retrieval System CHAIRS Bandwidth considerations within the physical architecture of the OSD do not limit the choice of a software tool Any organization with a physical port to the classi ed Pentagon backbone can connect to the continuity of operations tool Organizations without a physical connection can access the system through a dial-in connection to the POLYNET Dial-in connectivity also provides access to the database for any user who is temporarily away from their normal duty location This combination of capabilities resolves all known connectivity issues It provides feasible solutions to most communications challenges that may arise The POLYNET has a robust Uninterruptable Power Supply UPS capability which will provide temporary power to maintain information technology capabilities in case of a power outage within the Pentagon All COTS under consideration have strong data back-up procedures built into the systems As the continuity of operations tool develops the database will-be replicated at an alternate site location which will have many if not all of the communications capabilities of the primary srte Inherently continuity of operations software will have a robust failure contingency plan and back up procedures The POLYNET operates as a Department of Defense network All users of the continuity of operations tool must work within the constraints imposed by this level of security This includes but is not limited to security clearances for all users of the system and proper storage of all data storage media 15 System Development Plan Commercial Off The Shelf COTS Software Vendors and Products 97 - The fundamental task of this project is to review the market-leading COTS software available to manage continuity of operations planning and contingencies to determine which best meets the OSD functional requirements The selection of vendors and products has been a two step process initial screening and detailed investigation The initial screening included a wide variety of vendors and products well known to the disaster recovery community The professional journals for this community include Disaster Recovery JourLal and Contingency Flaming and Management These journals the vendor corporate intemet sites and the DFAS software evaluation provided the basis for the initial screening A product of the initial screening was to cut down the list of potential vendors to a manageable few whose probability of meeting OSD functional requirements was high A primary decision variable in this screening was the focus of the vendor Many vendors provide sophisticated tools to evaluate business risk back-up automated information systems or track insurance information These business isSues are considered Business Analysis issues in the disaster recovery community but are not one of functional requirements This focus eliminated many potential vendors and products The detailed investigation including establishment of a relationship with the vendor was limited to the four products cited below The Strohl Systems product is in use at DFAS so it was a logical choice for review An earlier version of REXSYS was also evaluated for DFAS but it did not perform as well as Strohl The other two vendors were not reviewed by however their extensive customer lists and strong market acceptance quali ed them as candidates for the initial screening Each software tool listed below provides a capability to plan for and manage continuity of operations 'contingencies Contact was made with the sales and training departments and software was acquired for evaluation against functional requirements Strohl Systems v8 0 4 0 SunGard s CBR v2 0 Recovery Management s REXSYS v4 2 0 v3 2 0 16 Summary Of Evaluation Comparison Functional Requirements Matrix The exibility of the software tool to meet dynamic requirements has emerged as the most important user-oriented functional requirement for the tool The clear leader in this area is the Strohl Systems product Their product supports generating ad hoc user-de ned reports changing eld names and adding elds in a simple and direct manner No other product comes close to their exibility It is important to note that Strohl s lead in this area is a result of their work with DFAS where there was a similar requirement DFAS selected the Strohl software to manage their continuity of operations plan and then paid Strohl and EDS to heavily modify the product to meet their speci c needs Strohl has leveraged the w0rk done for DFAS into their product providing all users the capability to easily modify the database eld names and reports Other vendors are working on this exibility but none can currently match Strohl 5 capabilities Some vendors such as COMDISCO must migrate from a proprietary database to a more open system to support exibility Others such as REXSYS have a limited database capability and do not consider the exibility issue as great a priority as Strohl Another functional requirement information security is not as high a user priority as the exibility of the database However this is a practical requirement for a network that functions in a environment such as the POLYNET Again Strohl is the market leader While all vendors meet basic security requirements Strohl provides the ability to control the capabilities based on the user s identi cation This additional capability again sets them apart from the other vendors The ability of a user to access the capabilities of the database is based on rights and privileges de ned for the user by the system administrator This capability providesthe administrators the ability to establish or support the business rules inherent in their processes For example if a business rule is that the continuity of operations manager for one organization can view only that organization s plans this can be supported from within the Strohl environment In other vendor packages the system administrator cannot limit a user s access to data stored within the system The functional requirements matrix is contained at Appendix A This is a section of tables which compares how the four leading software vendors have implemented functional requirements As appropriate the methodologies used in this evaluation are described 17 Application lssues The traditional functional process cycle as de ned by Instruction 8020 1 Functional Process Improvement is depicted below De ne Analyze Evaluate Objectives Functional Strategies Proccsses Alternatives Basehnes i New Processes Proposed 3 Implementation Data Systems Changes Execute Approve Plan Given the existing methods and procedures in continuity of operations planning community the implementation of a software tool that automates a great deal of the information gathering and maintenance tasks is appropriate The steps already taken towards this goal include The de nition phase has been completed 0 Functional requirements have been analyzed but work processes have not been described - The proposed methodology to improve continuity of operations planning is to provide a planning and decision support tool Alternatives to the proposed methodology have been considered and rejected 0 The remaining steps developing an implementation plan approving proposed changes to business processes and implementing those changes have yet to be completed Some examples of issues or busineSs rules that should be addressed to de ne the application and how it is used to meet OSD goals and objectives are - How will OSD combine subordinate organizations continuity of operations plans Will they exist as independent plans or 18 will they be combined to support execution control by the 1 How often is the continuity of operations plan published in document format How much of the plan is published versus retained in electronic form - What speci c documents are retained in the electronic library Theoretically the library is a repository of continuity of operations knowledge and should contain issues such as lessons learned from past exercises various plans some Directives and Instructions What other documents should be accessible through the electronic library Should it be a link to databases or le servers for the OSD organizations which deploy to alternative sites to perform continuity of operations functions What reports must be generated by the software tool to meet oversight requirements The incomplete steps are important to a successful implementation They should be completed or at least addressed prior to implementation However there is no reason to delay the insertion of a technology that meets the de ned functional requirements A tool that is exible and is based on an open systems architecture has a high probability of achieving the bene ts described earlier An application development process that takes this fact into account and provides for exibility in the development process is appropriate In this environment an application development process that provides additional capabilities in a staged manner is appropriate In applications development capabilities can be de ned as stand- alone modules which are valuable to the end-users These capabilities can then be prioritized by the functional leaders of the project and sequentially developed and put into use for the users In this manner enhanced capabilities are quickly put to work by the users This supports a dynamic discovery of the correct application of the tool by a joint team of developers and users In addition as applications for the tool are de ned these lessons are captured and business processes can be modi ed If the ultimate objective of the application changes as a result of the lessons learned during the application development process the exible nature of the tool and the development process accommodates these changes The range of issues surrounding how this continuity of operations software tool is applied in OSD can be bounded in terms of time manpower and resources The next section implementation issues addresses this area Implementation issues Emp and the focus of management Overall a general implementation scheme would follow some 9 variation on the steps listed below The available courses of action vary in amount of resources allocatedvto each phase of the implementation plan hasis varies depending on the amount of time and resources available Determine applicationdevelopment strategy and scope of applications In this step application issues and business rules are integrated into the irnplementation plan How userswill use the tool is speci callydescribed Any issues left unresolved from the functional requirements de nition or application development phases must be resolved In addition issues such'as the following are decided Will all user communities receive the tool at one time or will it be deployed one organization at a time Since OSD is a diverse organization the marketing function is completed here to gain support and acceptance of the tool throughout the community How will the dial in capability be implemented Will it be part of initial deployment or will it be a capability to be added later How will initial data entry be accomplished There are many data sources such as personnel lists and security rosters which are available throughOut OSD and can limit the amount of work required to populate the database How will these sources be accessed is there any coordination required with the data set owner can the data be imported directly from the source or is there a requirement to migrate the data from one source to another How will the system administrator function be accomplished Model activities and data The objective of the modeling phase is to build an understanding of the business processes how people work within the processes and how data requirements are met interview users or groups of users and graphically depict the business processes and data requirements and flows The output of this phase is a detailed description of the business processes which technicians use to customize the program and data requirements Acquire software and work technical implementation issues Technical issues such as implementing the server database on the POLYNET implementing dial-in and remote connectivity 20 options and distributing information to users are resolved in this phase Since technical requirements are reflections of functional requirements the challenge in this phase is to implement not decide on the validity of the requirement Once the functional decision has been made it is up to the technicians to implement Customize software Again this is a technical issue and few decisions are required The software will be customized to meet the functional requirements The amount of customization and how the customization is technically deseribed are outputs of decisions made in the implementation phase Changes must be made to the software to meet functional requirements The list below is for example not all inclusive Design ad hoc reports Add or delete elds in databases Change the names of elds in databases Write an OSD-speci c users manual that details the software changes and how they are used to meet the functional requirements 4 Develop a customized training program for OSD users Select and train a systems administrator While the server database will reside within the POLYNET environment actual supervision of the database will reside with the of ce with functional responsibility for the continuity of operations plans This individual will administrate user availability to the system maintain the database and all the data and provide day-to-day sustainment of the software In addition end-user training is often an extra duty for the systems administrator This individual must be highly trained in the software understand the remote access LAN and WAN environments and be knowledgeable of the cOntinuity of operations business process Over the long term this position may or may not require full time manning This depends on the overall success of the program Brief selected end-users on the software tool The process of getting end-users to use the software is essentially a marketing task The focus 'can be on the fact that users are directed to use the tool by management or on how the tool will help users accomplish their work in more effective and ef cient means Test the tool with selected end-users Testing the tool prior to general release is a requirement of quality software development 21 Course of Action Rapid Fielding Course of Action Model-Based Development The objective of this testing is to ensure the customization satis es the general us r community Results of the testing period are incorporated in the ongoing customization Software quality engineering uses a test as you develop approach rather than a separate time period for testing at the conclusion of the development process 0 Train users and begin selected implementation of the tool Training strategies can vary along the same variables as implementation time and user involvement This can be accomplished by a dedicated training period at an off-site location to deskside training by an accomplished user 0 Capture lessons learned throughout the process to facilitate development of additional functional capabilities A quick implementation phase can be accomplished with little or no modeling and customization The focus of the implementation can be on training end-users so management can get the tool into use This approach assumes that the application of the tool the way it will be used is best determined through an on the-job training approach and that users are the best judges of the viability of the software Users judge the output of the system and provide feedback to technicians who change the system Users are not required to understand how the system works just how to work the system and understand the system outputs Techniques which enhance the probability of success for this type of approach are strong help desks to answer user questions at the beginning of the implementation phase and frequent user group meetings to discuss or exchange and weaknesses of the system A drawback to this approach is its heavy reliance on the technicians who customize the software They must work closely with users to understand how to customize the software so users are satis ed with the outputs An opposite approach which re ects a management bias towards a controlled incremental change is to focus the up front effort on modeling continuity of operations activities and data and customizing the software prior to large scale user involvement This approach follows the model- based development theory which believes that quality implementation of software depends on how accurately or completely the developers understand the environment A technique which enhances the probability of success of this approach is that changes to the software are made at the design level rather 22 Additional Courses of Action than the output level In this manner users or functional experts involved in the implementation process can exert greater over the software since their in uence is focused on the design rather than the technical implementation of the software Functional experts in uence the use of the tool at the model level rather than at the output level This reduces the reliance on the technicians to build system outputs rich in information content A drawback of this approach is that it requires more analysis time up front before a tool is generally available to users Additional courses of action can be constructed placing emphasis and allotting time to different phases of the implementation Successful implementations have been achieved with either approach In summary the basic differences between the two implementation courses of action are 0 User involvement Can management afford a high or low degree of user involvement early in the development process The fast approach requires a great deal of interaction between the users and the development team This implies commitment as well as the sacri ce of tirne In the model based approach initial user involvement is limited to a few process experts who help build the model Additional users are added as part time members of the development team when it is time to test the customized software Overall there is a lower commitment of users time in the model-based approach 0 Speed of implementation Do the bene ts of irnmwiate elding of uncustomized software outweigh the time required to model requirements and customize the utility If immediate elding is important development can be iterative customizing the tool to respond to recognized needs The major disadvantage to this approach is that it makes version control very complicated It is very dif cult-to control customization in this approach Users throughout the organization will often have utilities that differ in minor or major ways depending on how uniform the customization process has been applied The products of the implementation phase In the rapid implementation approach speed of deployment to users is more important than documenting the development The product of this approach is' placing the tool in the users hands The speed of this approach increases reliance on the technicians since they are the only ones who really know 23 M a Recommendations how the system works A product of the model-based Epproach is an appropriate level of system documentation This documentation reduces the reliance on the technicians psince a description of how the application functions has been prepared The Strohl Systems product is the clear leader in the evaluation of COTS software for continuity of operations planning The recent changes this company made to their product as a result of lessons learned in the DFAS elding meet the OSD functional requirements Enhancements programmed for release in the next year such as Open Database Connectivity ODBC to enterprise-scale databases like Oracle and direct Internet access indicate that Strohl is moving in the same future direction as OSD The functional requirements evaluation matrix Appendix B shows that Strohl is the clear choice Strohl scored 67 8% on the evaluation while its closest competitor REXSYS scored 43 Using a weighted evaluation scale with possible scores from 1 to 10 Strohl scored a 10 twenty-eight times REXSYS scored a 10 only eighteen times Perhaps most telling of the forty-six items in the functional requirements matrix in Appendix A the Strohl product met all requirements with only three footnotes indicating a less than perfect All three other systems were footnoted regularly and at times were found to be less than satisfactory Strohl was the only product that met all information security requirements The other three systems were not able to establish security levels for each menu item Strohl was able to meet other critical functional requirements such as the ability to modify eld names length and eld type in the database without vendor support The other three products either planned to add these capabilities in the future or had no plans The next section details the cost of acquiring the Strohl system its hardware and sustainment costs and the range of application and implementation costs The model-based development approach is recommended since it implements the planning tool and focuses on the planning and management processes Since existing methods are in an evolutionary state the model- based approach adds value by reviewing processes before automating them Thissupports attaining the oversight goal for continuity of operations software and provides the best approach for attaining the expected bene ts of automating the planning process Bene ts such as improved 24 5 Cost Analysis communication and reduced cost to sustain the program can be achieved by studying and then improving the business processes rather than simply automating them - 0 Hardware no cost Software $23 990 0 Con guration 21 man months 0 Testing and training included in con guration Hardware costs The initial implementation of the software utility will reside leveraged on current automation assets No additional hardware is required In place computers on OSD staffers desktops will support the client application The server database will reside on the POLYNET database servers The details will be worked out during implementation planning There are no anticipated hardware shortfalls or conflicts Software costs Purchase of the Strohl Systems LAN version will cost $23 990 This provides the server database and unlimited client licenses Con guration costs The cost to model the activities and data that make up the continuity of operations business process the customization of the actual software and the scope of the initial operating capability can vary 0 Modeling costs These costs can vary from nothing in rapid elding to a maximum of four man months in the model-based approach 0 Customization costs Rapid elding implies that the software is continually re ned to meet user requirements This requires one to two programmers throughout the life of the project A six month implementation project would then require twelve man months In the model-based approach customization is estimated to require two and one half man months Note Off setting this savings is the time spent modeling the activities and data 0 Con guration management This cost represents the work accomplished to get the management utility loaded with data and running in the hands of the users This task includes importing data from existing systems and data migrating from legacy systems A single man month is required to accomplish this task in either course of action 25 Testing the system The rapid fielding option does not include a speci c period for testing the system Testing s accomplished as changes are made to the system The model-based approach allots a one week period for two people to test the system This adds a half a man month In addition professional standards for software development require that developers test as they build so system testing would not be limited to a formal period under either course of action Training users Both development options must include time for user training This should include a week for actual training as well as time to prepare and time to write documentation This task requires two people full time for a month resulting in a two man month commitment The model- based approach requires only one speci c period of user training since changes to the system are released in a controlled manner In rapid elding since the system is changed on a regular basis the programiners will be required to conduct ad hoc user training on a recurring basis This requirement would be part of their full time duties Documentation is included in the model based approach This approach provides OSD with a specialized users manual and systems documentation Writing these materials requires about a man month of effort The systems engineering documentation that is a result of the modeling effort is included in that cost Rapid elding does not provide systems engineering documentation and does not write a users manual since the software is constantly changing A sample project schedule is included Month 2 Month 4 I Month 6 Month 1 Month 3 Month 5 Up tront analysis Modeling Follow-up Observe exercise Acquire and con gUte sottware Customize sottware Systems training at Strohl Train on Reports Test system Tra'n system adrn nistratots Brie end users Prepare documentation Train and users Ll Capture lessons learned 26 Appendix At Functional Requirements Matrix 5 - Strohl controlled by the Systems Manager and allows users to change their own passwords 6 Provides password security and protection Information Security SunGard REXSYS 1 Contains multiple levels of security 323 3 le i Y2 2 Contains user ID and password capability 3 Enc ts asswords No 4 Provides a minimum length of six No No characters in the password eld 5 Provides the capability to establish No 1 No No security levels for each menu item I No Y3 No Works with existing office productivity software 1 Strohl lConiPAS SunGard reports and report sequences 7 Provides context sensitive help screens 'No Y4 Y5 8 1s exible and easy to use No No No6 9 PC based and menu driven E Utilizes Query By Example QBE I No Y7 No8 11 Provides a comprehensive Operations 335' Poor Poor Manual 12 Uses word processing software for Y9 customization of text les to meet OSD re uirements 13 Allows reports to be recorded in ASCII format for input into word processing or other software packages 14 Contains a comprehensive user report writer to allow for customized reports 5km 15 Allows the user to select from a variety of 1 De ned by plan access and read write read only permissions 2 De ned by plan department and team access 3 Does not prompt users to change own password 4 Poor 5 Poor 6 New more exihle version is in development 7 Via Edit Find 8 Use SQL syntax 9 If text files are attached to a task as a reference 0 Poor Appendix A-l Works with egjsting of ce productivity Strohl 1 SunGard REXSYS software 16 Allows reports to be printed or viewed on 330 the screen 17 Provides for the following functions when reports are viewed on the screen -Scrolling line by-line Scrolling screen-by-screen -Panning left and right _1 lncludes a project management system EXpons to Exports to 1 Limited Exports to 19 Store view and edit key documents in their native format Word Power Point Excel etc Windows compatible Strohl SunGard REXSYS 20 Operates using standard OSD of ce i equipment - 21 15 fully LAN compatible including -Supports multiple concurrent users -Provides record locking -lncludes user specific printer assignments 22 1ncludes backup and restore procedures No No Y12 Compatible with existing e-mail and wide- Strohl SunGard REXSYS area data communications 23 Share and transmit information to OSD COOP planners throughout the OSD community import export 24 Contains data gathering forms that tie to Y13 the detailed exhibits within the Plan 25 Communicate and transfer data to senior leadership at OSD relocation sites as well as other key government agencies 26 Link relocation roster data name and No phone numbers to call notification 35ng systems used to notify relocatees of COOP empathic with plan execution RAMA To use with MS Project additional info must be entered before exporting 2 Uses PKZIP 3 Hardcopy only not electronically 4 Hardcopy only not electronically 5 Must purchase REX Collect to automate data collection process Appendix A-2 Flexible database capabilities Strohl SunGard REXSYS 27 Modify eld names without vendor Limit 1 mm support 28 Modify eld length without vendor No No No support 29 Add and or delete elds without vendor No No No support a 30 Ability to mark elds as required No No16 No 31 Provides database management capabilities No 1 deveumem for information best presented in a list format equipment inventories personnel lists vendor lists etc 32 Uses drop down screen for selection of Limit key elds to provide data input ef ciency and data integrity 33 Provides multickey access to database No information and reports 34 Provides memo elds for certain Nol7 database records allowing over 200 lines of text to be added per eld 35 Allows for a multi-tiered organization Y18 Y20 36 Allows the user to nd speci c database No records or browse the contents of all records in table format 37 Allows the user to change the sort No Y21 No22 sequence of records within the database les '6 Required elds are preset by vendor '7 Limited to 200 characters Can insert object doc to desired record 8 Limited '9 Limited 2 Limited 2' Ascending Descending option only 22 Only in custom made DIS buttons Appendix A-3 Flexible database capabilities Strohl SunGard REXSYS 38 Contains a relational database management system thatssupport the generation of many user de ned reports Examples of these report include -OSD Component le -Critical functions le -Personnel le -Security data le -Transportation le -Manifest JEEP le '-Relocation staff le -Alternate relocation site -Alternate site equipment supply requirements le -Emergency Procedures le -Training le -Crisis action procedures le -SOP le -Successor le -Coordination le -Special medical le -Critical documents le -Communication systems le 023 024 No Supports project management software Strohl SunGard REXSYS 39 Provides a time and events schedule Project Management System that describes the various activities necessary to complete the planning process allowing input of responsible party start date targeted completion date and applicable section of the Plan Export hook to any project management software Export to MS Project Export to MS Project Supports electronic library capabilities Strohl SunGard REXSYS 40 Maintains an electronic library of key documents a Does are attached to individual plans Docs are attached to individual plans 3 Database does not have the depth required to support these requirements 4 Appendix A4 Internet Intranet Strohl SunGard REXSYS 41 Ability to link to an Intranet HTML 1 devempme Waring No 1 deveml me prototype for format Corp Management and testing Strohl SunGard REXSYS 42 Provides a exible approach to developing No No25 an effective OSD plan 93 mm 43 Can be expanded to develop an No No26 Limited organization-wide disaster recovery plan 44 Contains exercise schedules Y27 No No Y29 45 Includes testing methods and procedures No No31 No 2 for -Structured Walk-Through Testing -Checklist Testing -Simulation Testing -Integrated Testing -Parallel Testing -Tactical Testing 46 Contains techniques for evaluation results Y33 No No Y34 Completely meet the requirement in all respects 10 points Satis es all but the most minor aspects of the requirement 8 to 9 points Generally satis es the requirement but Fails to meet most major aspects of the requirement 1 to 4 points missing 25 Can export to Access to get required exibility 26 Database may limit exibility 27 Provides guidelines 28 Discusses the importance of this in 29 Covered in the Online Methodology 3 Provides guidelines 3' Discusses the importance of this in the Help les 32 Ibid 33 Provides guidelines 3 Ibid he Help les but does not provide schedules tests but does not provide schedules tests ith some important aspects omitted 5 to 7 points Does not meet the requirement at all that is the process or data structure is completely but you lose the capabilities of the program when you do this Appendix A-S Appendix B Rating Scales Strohl System- v8 0 4 Item Description papContains multiple levels of security Contains user ID and password capability passwords Provides a minimum length of six characters in the password eld Provides the capability to establish security levelsfor each menu item Provides password security and protection controlled by the Systems Manager and allows users to change their own passwords Provides context sensitive help screens Is exible and easy to use PC based and menu driven Utilizes Query By Example QBE Provides a comprehensive Operations Manual Uses word processing software for customization of text les to meet OSD requirements A Allows reports to be recorded in ASCII format for input into word processing or other software packages Contains a comprehensive user report writer to allow for customized reports Allows the user to select from a variety of reports and report sequences Allows reports to by printed or viewed on the screen Provides for the folloWing functions when reports are viewed on the screen -Scrolling line-by- -line -Scrolling screen-by- -screen Includes a project management system Store view and edit key documents in their native format Word Power Point Excel etc Operates using standard OSD of ce equipment Is fully LAN compatible -Supports multiple concurrent users -Provides record locking Includes user speci c printer assignments - Weight Evaluation Score 100 100 100 Appendix B- 1 Item Description Includes backup and restore procedures Shire and transmit information to OSD I COOP planners throughout the OSD community import export Contains data gathering forms that tie to the detailed exhibits within the Plan Communicate and transfer data to senior leadership at OSD relocation sites as well as other key government agencies Link relocation roster data name and phone numbers to call noti cation systems used to notify relocatees of COOP plan execution Modify eld names without vendor support Modify eld length without vendor support Add and or delete elds without vendor support Ability to mark elds as required Provides database management capabilities for information best presented in a list format equipment inventories personnel lists vendor lists etc Uses drop down screen for selection of key elds to provide data input ef ciency and data integrity Provides multi-key access to database information and reports Provides memo elds for certain database records allowing over 200 lines of text to be added per eld Allows for a multi-tiered organization Allows the user to nd speci c database records or browse the contents of all records in table format Allows the user to change the sort sequence of records within the database les Contains a relational database management system that support the generation of many user de ned reports Provides a time and events schedule Project Management System Maintains an electronic library of key documents Ability to link to an Intranet HTML format Weight Evaluation Score 100 100 100 Appendix B- 2 Item Description 42 43 44 45 46 Provides a exible approach to developing an Effective OSD plan a - Can be expanded to develop an - organization-wide disaster recovery plan Contains exercise schedules Includes testing methods and procedures COntains techniques for evaluation results Total Weight Evaluation Score 15 15 15 3 118 Appendix B- 3 COMDISCO - v3 2 0 t - Item Description 1 2 3 4 p Ly n v- Contains multiple levels of security Contains user ID and password capability passwords Provides a minimum length of six characters in the password field Provides the capability to establish security levels for each menu item Provides password security and protection controlled by the Systems Manager and allows users to change their own passwords Provides context sensitive help screens Is exible and easy to use PC based and menu driven Utilizes Query By Example QBE Provides a comprehensive Operations Manual Uses word processing software for customization of text les to meet OSD requirements Allows reports to be recorded in ASCII format for input into word processing or other software packages Contains a comprehensive user report writer to allow for customized reports Allows the user to select from a variety of reports and report sequences Allows reports to by printed or viewed on the screen Provides for the following functions when reports are viewed on the screen -Scrolling line-by-line -Scrolling screen-by-screen - Panning left and right Includes a project management system Store view and edit key documents in their native format Word Power Point Excel etc Weight x Evaluation 10 10 10 9 10 o np go oo 80 100 100 32 Appendix B- 4 Item Description 20 Operates using standard OSD of equipment Is fully LAN compatible -Supports multiple concurrent users -Provides record locking - Includes user speci c printer assignments Includes backup and restore procedures Share and transmit information to OSD COOP planners throughout the OSD community import export Contains data gathering forms that tie to the detailed exhibits within the Plan Communicate and transfer data to senior leadership at OSD relocation sites as well as other key government agencies Link relocation roster data name and phone numbers to call noti cation systems used to notify relocatees of COOP plan execution Modify eld names without vendor support Modify eld length without vendor support Add and or delete elds without vendor support Ability to mark fields as required Provides database management capabilities for information best presented in a list format equipment inventories personnel lists vendor lists etc Uses drop down screen for selection of key elds to provide data input ef ciency and data integrity Provides multi-key access to database information and reports Provides memo elds for certain database records allowing over 200 lines of text to be added per eld Allows for a multi-tiered organization Allows the user to nd Speci c database records or browse the contents of all records in table format Allows the user to change the sort sequence of records within the database les Contains a relational database management system that support the generation of many user de ned r epons Weight Evaluation COO OO 10 ON Score 100 Appendix B- 5 I _t__em Description Provides a time and events schedule Project Management System Maintains an electronic library of key documents Ability to link to an Intranet HTML format Provides a exible approach to developing an effective OSD plan 'Can be expanded to develop an organiz ation- -wide disaster recovery plan Contains exercise schedules Includes testing methods and procedures Contains techniques for evaluation results Total 2 '10 10 Weight Evaluation 2 NO boo 0 00 1 415 Appendix B- 6 SunGard - v2 0 Lem Description I Weight Evaluation Score 1 Contains multiple levels of security 10 7 7O 2 Contains user ID and password capability 10 10 100 - 3 passwords 10 0 4 Provides a minimum length of six characters 9 0 in the password eld 5 Provides the capability to establish security 10 0 levels for each menu item 6 Provides password security and protection 4 2 8 controlled by the Systems Manager and allows users to change their own passwords 7 Provides context sensitive help screens 1 1 8 Is exible and easy to use 1 0 0 9 PC based and menu driven 1 10 10 10 Utilizes Query By Example QBE 9 5 45 11 Provides a comprehensive Operations 10 5 50 Manual 12 Uses word processing software for 10 5 50 customization of text les to meet OSD requirements 13 Allows reports to be recorded in ASCII 10 8 80 format for input into word processing or other software packages 14 Contains a comprehensive user report writer 10 10 100 to allow for customized reports 15 Allows the user to select from a variety of 10 10 100 reports and report sequences l6 Allows reports to by printed or viewed on 4 10 40 the screen 17 Provides for the following functions when 10 10 reports are viewed on the screens-Scrolling line-by-line -Scrolling screen-by screen - Panning left and right 18 Includes a project management system 2 19 Store view and edit key documents in their 10 7 70 native format Word Power Point Excel etc 20 Operates using standard OSD of ce 10 10 100 equipment 21 Is fully LAN compatible -Supports multiple 9 10 90 concurrent users -Provides record locking - Includes user speci c printer assignments 22 Includes backup and restore procedures 4 0 0- Appendix B- 7 Item Description 23 Share and transmit information to OSD CGOP planners throughout the OSD community import export 24 Contains data gathering forms that tie to the detailed exhibits within the Plan 25 Communicate and transfer data to senior leadership at OSD relocation sites as well as other key government agencies 26 Link relocation roster data name and phone numbers to call noti cation systems used to notify relocatees of COOP plan execution 27 Modify eld names without vendor support 28 Modify eld length without vendor support 29 Add and or delete elds without vendor support 30 Ability to mark elds as required 31 Provides database management capabilities for information best presented in a list format equipment inventories personnel lists vendor lists etc 32 Uses drop down screen for selection of key elds to provide data input ef cienCy and data integrity 33 Provides multi-key access to database information and reports 34 Provides memo elds for certain database records allowing over 200 lines of text to be added per eld 35 Allows for a multi-tiered organization 36 Allows the user to nd speci c database I records or browse the contents of all records in table format 37 Allows the user to change the sort sequence of records within the database les 38 Contains a relational database management system that support the generation of many user de ned reports 39 Provides a time and events schedule Project Management System 40 Maintains an electronic library of key documents 41 Ability to link to an Intranet HTML format Weight Evaluation Score 100 Appendix B- 8 Item Description 42 43 44 45 46 Provides a exible approach to developing an effective OSD plan Can be expanded to develop an organization- wide disaster recovery plan Contains exercise schedules Includes testing methods and procedures Contains techniques for evaluation results 0 Total Weight Evaluation 10 9 3 3 0 COO Score 0 0 0 0 1 812 Appendix B- 9 Recovery Management Inc - REXSYS v4 2 Item Qescription Contains multiple levels of security Contains user ID and password capability passwords Provides a minimum length of six characters in the password field Provides the capability to establish security levels for each menu item Provides password security and protection controlled by the Systems Manager and allows users to change their own passwords Providestcontext sensitive help screens Is exible and easy to use PC based and menu driven Utilizes Query By Example QBE Provides a comprehensive Operations Manual Uses word processing software for customization of text les to meet OSD requirements Allows reports to be recorded in ASCII format for input into word processing or other software packages Contains a comprehensive user report writer to allow for customized reports Allows the user to select from a variety of reports and report sequences Allows reports to by printed or viewed on the screen Provides for the following functions when reports are viewed on the screen -chrolling line-by-line -Scrolling screen-by-screen - Panning left and right Includes a project management system Store view and edit key documents in their native format Word Power Point Excel etc Operates using standard OSD of ce equipment Is fully LAN compatible -Supports multiple I concurrent users -Provides record locking Includes user speci c printer assignments Includes backup and restore procedures Op Hp10' '10 Weight Evaluation Score Appendix Item Description Share and transmit information to OSD COOP planners throughout the OSD community import export Contains data gathering forms that tie to the detailed exhibits within the Plan Communicate and transfer data to senior leadershipat OSD relocation sites as well as other key government agencies Link relocation roster data name and phone numbers to call noti cation systems used to notify relocatees of COOP plan execution Modify eld names without vendor support Modify eld length withoUt vendor support Add and or delete elds without vendor support Ability to mark fields as required Provides database management capabilities for information best presented in a list format equipment inventories personnel lists vendor lists etc Uses drop down screen for selection of key elds to provide data input ef ciency and data integrity Provides multi-key access to database information and reports Provides memo elds for certain database records allowing over 200 lines of text to be added per eld Allows for a multi-tiered organization Allows the user to nd speci c database records or browse the contents of all records in table format Allows the user to change the sort sequence of records within the database les Contains a relational database management system that support the generation of many user de ned reports Provides a time and events schedule Project Management System Maintains an electronic library of key documents Ability to link to an Intranet HTML format Provides a exible approach to developing an effective OSD plan We'ght Evaluation Score Appendix B-ll It_e_m Description 43 Can be expanded to develop an organization- Qvide disasterrecovery plan 44 Contains exercise schedules 45 Includes testing methods and procedures 46 Contains techniques for evaluation results Total WW 2 7 2 Weight Evaluation 9 Score 18 @033 1 977 Appendix B-12 Appendix C Acronyms CHAIRS a COOP COTS CRC DFAS DST BO FDDI LAN NES occ OSD POLYNET SMTP sop UPS Cable Handling and Retrieval System Continuity of Operations Commercial off the shelf COOP Response Cell Defense Finance and Accounting Service Defense Messaging Service Department of Defense Decision Support Tool Executive Orders Fiber Optic Backbone Local Area Network Network Services Operations Control Center Of ce of the Secretary of Defense Policy LAN Network Simple Mail Transfer Protocol Standing Operating Procedure Of ce of the Undersecretary of DefenSe Policy Transmission Control Protocol Internet Protocol Uninterruptable Power Supply Appendix C-