9.4 Develop Migration Plan
All changes in this version
Title changed
Before · SP 800-116
Develop Migration Plan
After · SP 800-116 Rev. 1
Develop Migration Plan
Control changed
Before · SP 800-116
Developing a migration plan requires a vision for PIV-enabled PACS operations. Specifically, a new business process needs to be charted to address the use of PIV credentials. This business process will be dependent on the flexibility available in changing the current environment. Some agencies may be renting spaces where access control is managed by someone else. In the end, however, an agency should have a plan to use the PIV Card. The OMB Circular Number A-11, Part 7, Section 300: Planning, Budgeting, Acquisitions, and Management of Capital Assets establishes policy for the planning, budgeting, acquisition, and management of Federal capital assets, and provides introduction on budget justification and reporting requirements for major IT investments for Federal agencies. OMB Circular A-11 spells out the requirements for supporting several legislative directives including, but not limited to, the Clinger-Cohen Act of 1996, which requires agencies to use a disciplined capital planning and investment control (CPIC) process to acquire, use, maintain and dispose of information technology. In particular, the Clinger-Cohen Act (CCA) specifically instructs the head of each executive agency to establish effective and efficient capital planning processes for selecting, managing, and evaluating the results of all of its major investments in information systems. In migration planning, agencies should first determine the level of identity assurance required to gain access to their resources. Guidelines on determining the level of identity assurance and selecting a corresponding authentication mechanism are provided in Section 7 of this document. Once authentication mechanisms are selected, agencies will need to identify technology gaps in the existing system. The gaps may be in the existing readers, control panels, or PACS servers. Section 8 discusses prominent scenarios and provides recommendations on filling technology gaps. It is recommended that agencies plan to ultimately reach the highest level of authentication assurance that displays all the qualities identified in Section 6.2. For this, guidance is provided in the following section to enable agencies to progress in stages.
After · SP 800-116 Rev. 1
Developing a migration plan requires a vision for PIV-enabled PACS operations. Specifically, a new business process needs to be charted to address the use of PIV credentials. This business process will be dependent on the flexibility available in changing the current environment. Some agencies may be renting spaces where access control is managed by someone else. In the end, however, an agency should have a plan to use the PIV Card. The OMB Circular Number A-11, Part 7, Section 300: Planning, Budgeting, Acquisitions, and Management of Capital Assets establishes policy for the planning, budgeting, acquisition, and management of Federal capital assets, and provides introduction on budget justification and reporting requirements for major IT investments for Federal agencies. OMB Circular A-11 spells out the requirements for supporting several legislative directives including, but not limited to, the Clinger-Cohen Act of 1996, which requires agencies to use a disciplined capital planning and investment control (CPIC) process to acquire, use, maintain and dispose of information technology. In particular, the Clinger-Cohen Act (CCA) specifically instructs the head of each executive agency to establish effective and efficient capital planning processes for selecting, managing, and evaluating the results of all of its major investments in information systems. In migration planning, agencies should first determine the level of identity assurance required to gain access to their resources. Guidelines on determining the level of identity assurance and selecting a corresponding authentication mechanism are provided in Section 7 of this document. Once authentication mechanisms are selected, agencies will need to identify technology gaps in the existing system. The gaps may be in the existing readers, control panels, or PACS servers. Section 8 discusses prominent scenarios and provides recommendations on filling technology gaps. It is recommended that agencies plan to ultimately reach the highest level of authentication assurance that displays all the qualities identified in Section 6.2. For this, guidance is provided in the following section to enable agencies to progress in stages.