An Authority to Operate (ATO) granted is valid for no more than three years, or when significant changes cause an unacceptable increase in operating risk to the system, whichever comes first, thus triggering the C&A cycle. Moreover, the IPMC process requires that a self-assessment be conducted annually, that any identified security weaknesses are tracked and remediated, and that risk is continually monitored and managed in order to identify and mitigate security risks to an acceptable level.  Disposal measures are required if an application is shut down.  Please see Appendix I for more information.

One  Enterprise Architecture

From a One EA perspective, the PIR provides important feedback to assess not only whether the system continues to be in compliance with the One EA, but also whether in-service experience of the system indicated a need for change in the EA itself. To accomplish this at Milestone 4, PMs must have completed row 6.

Projects that will involve  telecommunications and operations infrastructure should consider the following questions leading up to Milestone IV:

Network Capacity Planning:

▲    Are the entire project’s final network performance requirements fully met?

▲    Are the project’s network scalability requirements scheduled?

The following is a summary listing of the significant project management activities and outputs for Step 5.

▲    Post Implementation Report

▲    Milestone IV Briefing and Decision Memo

▲    Closeout Report

▲    Monthly Performance Reports

The Responsibility Assignment Matrix below is provided as a “best practices” tool that the PM can adapt and fill out for the appropriate tasks and responsibilities of his or her project. For additional guidance, the PM should refer to the appendices of this guide and consult his or her Administration or Staff Office PMO.