{"text_format":"1","workbook":"xlsx","n_sheets":10,"sheets":["Table of Contents","Overview","Risk Descriptions","Phase 1","Phase 2","Phase 3","Phase 4","Dashboard","Parameters","Approach"],"not_rendered":{"charts":1,"images":10,"macros":1,"external_links":0,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Table of Contents","index":0,"n_rows":25,"n_cols":3,"rows_kept":25,"cut":false,"hidden":false,"merged":[[16,2,16,3],[22,2,22,3],[13,2,13,3],[1,1,1,18],[3,2,3,3],[6,2,6,4],[9,2,9,4],[14,2,14,18]]}
[]
[null,"Table of Contents"]
[]
[null,"1.","Overview Tab"]
[null,null,"aProvides the migrating agency guidance and instruction on how to utilize and understand the different components inside of the tabs"]
[]
[null,"2.","Risk Descriptions Tab"]
[null,null,"aLists and describes each risk that will be used to evaluate the migrating agencies over each Phase "]
[]
[null,"3.","Phase Tabs (0-4)"]
[null,null,"aLists all Risks being evaluated in each Phase"]
[null,null,"aProvides a place for the migrating agency to conduct a self assessment for each risk, and describe mitigation strategies to the Office of Shared Solutions and Performance Improvement (OSSPI) for any self-assessed Medium or High risks"]
[]
[null,"4.","Dashboard"]
[null,null,"aA central location for the migrating agency to observe assessed Risk for the Phase they are currently in, or the Phase that have selected (0-4).  Also reflects the scope(s) of the Migration, and the Project Size"]
[]
[null,5,"Parameters Tab"]
[null,null,"aLists the project scope(s) that OSSPI has identified for the migration"]
[null,null,"aShows OSSPI's determination of the project's size"]
[null,null,"aShows the weights OSSPI has applied to different risks "]
[null,null,"aProvides a description for the migrating agency of why the weights were applied to certain risks "]
[]
[null,6,"Approach Tab"]
[null,null,"aDescribes the tool's objective"]
[null,null,"aDescribes the sources used to develop the tool"]

{"sheet":"Overview","index":1,"n_rows":317,"n_cols":3,"rows_kept":317,"cut":false,"hidden":false,"merged":[[1,1,1,3],[316,2,316,3],[3,4,3,5],[3,2,3,3],[244,2,244,3],[68,2,68,3],[168,2,168,3]]}
[]
[null,"Directions:  \nAll the information required to navigate the Risk Tool can be found in this tab.\nScroll down to find instructions and descriptions for each tab found in this workbook."]
[]
[null,"Tab:","Risk Descriptions "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Tab:","Phase Tabs 0-4"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Tab:"]
[]
[]
[]
[null,"Tab:"]
[]
[]
[null,"Tab:"]
[]
[]
[null,"Tab:"]
[]
[]
[null,"Tab:"]
[]
[]
[null,"Tab:"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Tab:","Dashboard"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Tab:","Parameters"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"End"]

{"sheet":"Risk Descriptions","index":2,"n_rows":14,"n_cols":5,"rows_kept":14,"cut":false,"hidden":false,"merged":[[0,0,0,1]]}
["*Risks below are not prioritized*",null,"OSSPI Risk List"]
["ID","Risk Type","Risk Description","M3 Artifacts","Key Metrics"]
[1,"Data/Information Risk","Risk(s) associated with the ability to comply with OMB's and OCIO's data requirements.  Information reported must be timely, reliable, and consistent. This includes risk(s) associated with data conversion and data migration, the loss/misuse of data or information, risk of increased burdens on citizens, government employees and systems uses due to data collection requirements if the associated business processes or the investment require access to data from other sources. ","● Business Needs Workbook\n● Conversion Defect Log\n● Data Cleansing Plan\n● Data Conversion Plan\n● Data Governance Model\n● Data Management/Data Quality Approach\n● Gap Analysis Report\n● Master Schedule\n● Mock Conversion Report\n\n\n","● Data quality assessment identifying data concerns completed/updated in Data Cleansing Plan (Phases 1-3)\n● % of Conversion Plan execution (Phase 4)\n● % of Conversion test cases completed (Phase 4)"]
[2,"Cyber Information Security Risk","Risk that could expose the agency to exploitation of vulnerabilities to compromise the confidentiality, integrity, or availability of the information being processed, stored, or transmitted by its information systems. This includes privacy risk(s) for individuals associated with personally identifiable information (PII) and general (i.e. non-sensitive) security risks associated with the investment, such as risk(s) associated with the development of the investment's Security Plan, as well as the commercial feasibility of security requirements. ","● Business capabilities as documented in Operational End State \n● Gap Analysis Report\n● Integrated Master Schedule (IMS)\n● Interface plan\n● Privacy Impact Assessment\n● Target State Systems Environment \n\n\n\n","●  Number of interconnection agreements required (Phases 4)\n●  Number of PII data elements identified in legacy application that must be converted/transferred (Phase 4)\n●  Number of Security GAPS (Phase 3)\n●  Number of Agency specific Security requirements (Phases 2-3)"]
[3,"Financial Risk","Risk(s) that could result in a negative impact to the agency, such as the waste or loss of funds/assets and government-wide costs for a lack of the adoption of standards (e.g. on schedule, without protest). This includes risk(s) associated with an incomplete or inaccurate cost estimate at the start and planning phases of the investment, as well as those associated with the ability of the system to achieve the program's lifecycle cost objectives and estimate assumptions. Also includes risk associated with funding methodology whether being centrally funded by Department through appropriation or funded by individual components via Working Capital Fund (WCF) or other taxing mechanism.  The investment team should have the ability to meet overall cost goals and meet planning, developing, operations, and disposition cost breakdowns within acceptable thresholds. ","● Business Needs Workbook\n● Cost Savings Table\n● Gap Analysis Report\n● Major IT Business Case (MITBC) including LCCE\n● Preliminary Cost/Savings Table\n● Vision and Operational End State\n\n\n\n","●  Schedule Variance (Phases 1-4)\n●  Schedule Variance % (Phases 1-4)\n● Total change from Prior Year Presidential budget (change in dollars) (All Phases)\n● Total change from Prior Year Presidential budget (change in %) (All Phases)\n\n"]
[4,"Acquisition and Procurement Risk","Risk(s) associated with the acquisition of contracts and contract management necessary to support the investment. Addresses the risk in developing the acquisition package and executing successfully. This includes the development of the RFP, the risk of contractor selection, and the risk of contractor protest. This also includes the risk of continuity for the life of the contract and the ability to acquire and manage resources needed to complete the program as planned. This risk includes the ability of supporting contractors to meet the required reports (e.g. Status Reports, Risk Register) and other deliverables on time and of acceptable quality. Considerations include whether the agency has the appropriate level of contractor oversight so that the government effectively monitors, controls, and mitigates risks. Controls should be in place so that adverse contractor performance is identified early and that appropriate risk mitigation measures are implemented successfully. ","● Major IT Business Case (MITBC)\n● Project Business Case\n● Procurement Plan\n● Provider Assessment Report\n● Vision and Operational End State\n\n\n\n","● % of Acquisitions Awarded per IMS award milestone (Phases 1-4)\n●  % of IMS milestone dates met by baseline date  (Phases 1-4)\n●  Number of non-administrative modifications to Contracts and Inter-Agency Agreements (IAA's), (i.e., Contract Revisions [CRs]) (Phases 3-4)"]
[5,"Operational Risk","Risk of direct or indirect loss or other negative effects to the organization due to inadequate or failed internal processes arising from people, systems, or from external events that impact those internal processes, people, or systems. Operational risks can have a direct impact on daily operations of an organization or prevent an organization from accomplishing its objectives (meeting the mission). This involves risk that the investment fails to achieve the agency's strategic goals or in making contributions to them. Risk that the initiative is not based on clearly understood needs or opportunities and is inconsistent with the overall strategies and architectures used by the agency and the Federal government. ","● Baseline Performance and Success Metrics\n● Business Needs Workbook\n● Business Requirements\n● Contingency Plan\n● Go/No-Go Assessment Report\n● Implementation approach / timeline\n● Integrated Contact Center Strategy\n● Major IT Business Case (MITBC)\n● Project Business Case\n● Service Level Agreement (SLA)\n● Target Performance and Success Metrics\n● Target State Concept of Operations\n● Vision and Operational End State\n\n\n\n","● Schedule Variance (Phases 2-4)\n● Schedule Variance % (Phases 2-4)\n● Baseline Performance and Success Metrics available (Phase 1)\n● % of Business Needs available in provider solution versus fit/gaps identified (Phase 2)\n● Number of Agency-unique interfaces identified as complex or highly complex by selected provider (Phase 4)\n"]
[6,"Reputational Risk","Risk(s) Risk that a failure to manage risk, external events, and external media or to fail to fulfill the agency’s role (whether such failure is accurate or perceived) could diminish the stature, credibility\nor effectiveness of the agency. Also associated with the size of the organization that will be affected by the migration. Factors such as geographic distribution of the organization, or whether the migration is intended to move an entire organization or specific components/business units within the organization.  Includes scope of services - system only, services only or both.","● Business Needs Workbook (Customer Profile)\n● Initial Scope of Services\n● Organizational & Change Management Plan\n● Provider Assessment Report\n● Vision and Operational End State\n"]
[7,"Schedule Risk","Risk(s) associated with the adequacy of the time estimated and allocated for the development, production, operations, maintenance, and deployment of the system. Risk areas bearing on schedule risk include: (1) the risk that the schedule estimates and objectives are realistic and reasonable, (2) the risk that project execution will fall short of the schedule objectives as a result of failure to mitigate technical risk(s) and external constraints, and (3) the investment team's ability to meet schedule goals within the acceptable threshold. Risk of missing or incomplete activities, predecessor and successor tasks within the integrated master schedule.","● Fit-Gap Analysis\n● Implementation Approach/Schedule\n● Initial Schedule\n● Integrated Master Schedule\n● RAID Log\n","● Schedule Variance (Phases 1-4)\n● Schedule Variance % (Phases 1-4)\n● Number of baseline modifications (Phases 1-4)"]
[8,"Management Support Risk","Risk(s) associated with the investment having a qualified management and execution team as defined by OMB (see NIST Risk Handout at:http://csrc.nist.gov/roi/wksps0603-notes/Risk-Handout.pdf), as well as the ability to keep turnover at a manageable level. The investment should have appropriate investment management structures, executive management support, governance, clear and defined responsibilities, as well as demonstrated experience in managing investments of similar size and scope. Also assesses the alignment of policy, program, and procurement, along with the agency's succession planning, and the depth of experience of the agency's leadership team.","● Governance Charter\n● HR/Staffing Plan\n● Program Management Plan\n● Risk Management Plan\n● RAID Log","● % of Migration Support Roles not staffed with full time government or contractor FTE (All Phases)\n●  Frequency of Governance meetings and specificity in agenda topics, membership represented and documented decisions (All Phases)\n● % of Senior leadership regularly participating in Governance activities (Phases 1-4)"]
[9,"Feasibility Risk","Risk(s) associated with the insufficient ability to successfully develop and implement the investment within the defined technical scope, cost, schedule parameters, and comply with applicable laws and regulations to successfully meet the performance goals.  Risk can be due to scope, unrealistic goals, unavailable/unproven or immature technology, lack of expertise, underdeveloped concepts, changes in external environment, failing to detect and report unknown activities, and other organizational related factors or requirements.  This includes non-alignment with managing partner line of business standards as defined in the Federal Integrated Business Framework via capabilities, use cases, data standards and performance metrics.","● Business Needs Workbook\n● Gap Analysis Report\n● Interface Strategy\n● Life Cycle Cost Estimate (LCCE)\n● Master Schedule\n● Migration Phase IAA Terms and Conditions\n● RAID Log\n● Scope of Services\n● Target State Concept of Operations\n● Vision and Operational End State","● Services requested outside of standard offering (Phase 3, and Phase 4)\n● Critical GAPS identified during Engagement (Phase 3)\n● Number of critical risks without Mitigation Plan (All phases)\n● Number of Agency-unique interfaces identified as complex or highly complex by selected provider (Phase 4)"]
[10,"Technical Complexity","Risk(s) involving the characteristics that comprise the complexity of the system's migration/modernization and risk(s) associated with the reliance on technical interfaces with other systems (existing or in development). Factors may include whether multiple systems and/or administrative services are migrating in parallel, number of active projects, whether the migration includes transaction processing, platform only, or full-services, and whether the existing system is expiring and migration is moving to a new platform. ","● As-Is Systems Environment\n● Business Needs Workbook\n● Data Governance Model\n● Data Warehouse Design Document\n● Gap Analysis Report\n● Operational End State Vision\n● Project Charter\n● Reports Design Document\n● Requirements Traceability Matrix\n● To-Be Systems Environment\n\n\n","● Number of Agency Interfaces (Phases 2-4)\n● Initial Business Capabilities identified in the Business Needs Workbook (Phase 2)\n● Number of CR's for customization to base software (non-administrative mods) (Phase 3) "]
[11,"Requirements Management Risk","Risk(s) that are associated directly to specific requirements that can have a number of impacts on a project’s cost, schedule, and scope. Requirements management can have an impact on a project’s capacity to deliver on its objectives and in managing changes to the scope of work and process.  Risks factors may include identification of all requirements and ensuring adequacy of risk identification by the functional and technical subject matter experts, and what stakeholders have been engaged and signed off on requirements.   ","● As-Is Systems Environment\n● Business Needs Workbook\n● Change Request Log\n● Governance Charter\n● Operational End State Vision\n● Requirements Management Plan\n● Requirements Traceability Matrix\n● Risk Register\n● Scope of Services\n● Target State Systems Environment\n● Vision and Operational End State\n","● Gaps Identified at conclusion of Engagement Phase (Phase 3) \n● % of Test Cases completed (Phase 4)\n● Number of unique Agency requirements with specific Legislative source (Phase 3)\n● Number of requirements not tracable to a business need (Phase 3)\n● Number of testable requirements that are listed in the RTM, and requirements without the test script mapped (Phase 3)"]
[12,"Organizational and Change Management ","Risk(s) associated with the organizational/agency government-wide cultural resistance to change and standardization.  Risks associated with bypassing, lack of use, or improper use or adherence to new systems and processes due to organizational structure and culture, inadequate training planning.","● As-Is Workforce Documentation\n● Business Process Reengineering Strategy\n● Communications Plan\n● Change Management Plan\n● Master Schedule\n● Migration and O&M Training Needs\n● Operational End State Vision\n● Readiness Assessment\n● Stakeholder Analysis\n● Training Plan\n● Vision and Operational End State\n● Workforce Assessment\n● Workforce Transition Strategy","● Number of Bargaining Unit Employee's impacted by the migration  (All Phases)\n● Size of Organization (All Phases)\n● Number of Locations (All Phases)\n● Number of change management activities (actual) vs. change management activities (planned) for the workforce (Phase 4)\n● Progress against the Training Plan/Tasks (Phase 4)\n● % of Senior leadership regularly participating in Governance activities (Phases 1-4)"]

{"sheet":"Phase 1","index":3,"n_rows":39,"n_cols":12,"rows_kept":39,"cut":false,"hidden":false,"merged":[[5,0,5,3],[5,4,5,11],[1,4,3,7],[1,2,3,2],[4,4,4,7]]}
[]
["Phase 1 ","Cumulative Risk Ratings","Phase 1: Objective is to prepare the migrating organization by defining initial scope of services and customer governance for the modernization effort.",null,"Directions: Agency self-assessment of the migration's risk profile by phase based on OSSPI's priority risk categories and artifacts. Consider risk statement(s) by risk category for each level to determine current risk. "]
["Agency Self -assessment",{"$f":"IFERROR(AVERAGEIF(G8:G19,\">0\",G8:G19),\"\")","v":""}]
["Overall OSSPI Rating",{"$f":"IFERROR(AVERAGEIF(K8:K19,\">0\",K8:K19),\"\")","v":""}]
[null,null,null,null,"Click here to see the Minimum Documentation required for this Phase"]
["Phase 1 Risk Evaluation Criteria",null,null,null,"Assessment"]
["Risk Category","Low ","Medium","High","Agency Rating","Agency Value","Agency Weighted Value","Agency Applied Risk Mitigation Strategy","OSSPI Rating","OSSPI Value","OSSPI Weighted Value","OSSPI Comments"]
["Data/Information Risk","● There are no data quality concerns with legacy data, or identified data quality concerns are unlikely to impact migration \n● Data quality concerns have been identified in the Data Cleansing Plan and cleansing activities are fully reflected in Initial Master Schedule","● Data quality concerns with legacy data that may impact migration are not fully addressed in the Data Cleansing Plan \n● Data quality concerns have been identified in the Data Cleansing Plan, but activities are not fully reflected in Initial Master Schedule ","● Severe data quality concerns with legacy data  that will impact migration are identified in the Data Cleansing Plan\n● Data Quality concerns have been identified in the Data Cleansing Plan, but activities are not identified on Initial Master Schedule\n",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(E8=\"Low\",1,IF(E8=\"Medium\",3,IF(E8=\"High\",5,\"\"))))","v":""},{"$f":"F8*IF(Dashboard!$Q$22=\"Small\",(Parameters!C16),IF(Dashboard!$Q$22=\"Large\",(Parameters!D16)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(I8=\"Low\",1,IF(I8=\"Medium with Accepted Risk Strategy\",2,IF(I8=\"Medium\",3,IF(I8=\"High with Accepted Risk Strategy\",4,IF(I8=\"High\",5,IF(I8=\"N/A\",\"\",\"\")))))))","v":""},{"$f":"(IF(J8=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C16),IF(Dashboard!$Q$22=\"Large\",(Parameters!D16)))*J8))","v":{"$error":"#VALUE!"}}]
["Cyber Information Security Risk","● No unique cyber information security needs identified in Initial Target State Systems Environment or Operational End State.","● Agency identified unique security concerns in Initial Target State Systems Environment or Operational End State.","● Agency identfied unique security concerns in Initial Target State Systems Environment or Operational End State that require secret cleared resources to resolve",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(E9=\"Low\",1,IF(E9=\"Medium\",3,IF(E9=\"High\",5,\"\"))))","v":""},{"$f":"F9*IF(Dashboard!$Q$22=\"Small\",(Parameters!C17),IF(Dashboard!$Q$22=\"Large\",(Parameters!D17)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(I9=\"Low\",1,IF(I9=\"Medium with Accepted Risk Strategy\",2,IF(I9=\"Medium\",3,IF(I9=\"High with Accepted Risk Strategy\",4,IF(I9=\"High\",5,IF(I9=\"N/A\",\"\",\"\")))))))","v":""},{"$f":"(IF(J9=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C17),IF(Dashboard!$Q$22=\"Large\",(Parameters!D17)))*J9))","v":{"$error":"#VALUE!"}}]
["Financial Risk","● LCCE is developed (according to cost management plan) for all future phases \n● Actual spending is being compared with budget and LCCE is adjusted as needed\n● Changes to program costs and actual spending are reported in governance meetings and Status Reports/Dashboards \n ","● LCCE is not fully realistic (according to cost management plan) for all future phases \n● Actual spending is being compared with budget but LCCE is not reflecting appropriate adjustments\n● Some changes to program costs and actual spending are not reported in governance meetings or Status Reports/Dashboards \n ","● LCCE is not realistic (according to cost management plan) based upon comparison to projects with similar size and scope\n● LCCE reflects that actual spending is not being compared with budget\n● Program costs and actual spending are not reported in governance meetings or Status Reports/Dashboards \n ",null,"",{"$f":"F10*IF(Dashboard!$Q$22=\"Small\",(Parameters!C18),IF(Dashboard!$Q$22=\"Large\",(Parameters!D18)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J10=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C18),IF(Dashboard!$Q$22=\"Large\",(Parameters!D18)))*J10))","v":{"$error":"#VALUE!"}}]
["Acquisition and Procurement Risk","● Agency has a realistic Procurement Plan which specifies procurement needs and associated timelines for the program inclusive of required support for program management, change management, business process reengineering, data management, interface development, and integration ","● Agency has a Procurement Plan which is not fully realistic","● Agency has a Procurement Plan which is not realistic\n● Legacy systems contracts expiration dates occur prior to feasible implementation dates identified in the Initial Master Schedule",null,"",{"$f":"F11*IF(Dashboard!$Q$22=\"Small\",(Parameters!C19),IF(Dashboard!$Q$22=\"Large\",(Parameters!D19)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J11=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C19),IF(Dashboard!$Q$22=\"Large\",(Parameters!D19)))*J11))","v":{"$error":"#VALUE!"}}]
["Operational Risk","● No unique requirements identified in Vision and Operational End State or Initial Target State Concept of Operations\n● No mission critical needs identified in Initial Target State Concept of Operations which are outside of typical administrative services offerings (or FIBF business capabilities for the respective Line of Business, if applicable)","● Some non-critical items identified in Initial Target State Concept of Operations are not part of typical administrative services offerings (or FIBF business capabilities for the respective Line of Business, if applicable)","● Unique operational state identified in Vision and Operational End State including critical items that are outside of typical administrative services offerings (or FIBF business capabilities for the respective Line of Business, if applicable)",null,"",{"$f":"F12*IF(Dashboard!$Q$22=\"Small\",(Parameters!C20),IF(Dashboard!$Q$22=\"Large\",(Parameters!D20)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J12=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C20),IF(Dashboard!$Q$22=\"Large\",(Parameters!D20)))*J12))","v":{"$error":"#VALUE!"}}]
["Reputational Risk","● Project is consistent with government wide shared services strategy \n● Initial Scope of Services captured describes a migration with no critical services required from providers ","● Project has some elements that are not consistent with government wide shared service strategy\n● Initial Scope of Services captured describes a migration with critical services required from providers","● Project is not consistent with government wide Shared Services strategy\n● Project size and complexity is known to include multiple forms of oversight\n● Initial Scope of Services captured describes a migration with required services not currently provided by providers\n",null,"",{"$f":"F13*IF(Dashboard!$Q$22=\"Small\",(Parameters!C21),IF(Dashboard!$Q$22=\"Large\",(Parameters!D21)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J13=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C21),IF(Dashboard!$Q$22=\"Large\",(Parameters!D21)))*J13))","v":{"$error":"#VALUE!"}}]
["Schedule Risk","● Agency has an Initial Master Schedule (IMS) that has expected milestones with reasonable timelines \n● Program Management processes are in place to maintain and monitor Schedule\n● The agency demonstrates knowledge incorporated  from prior migrations and/or modernizations of similar scope and investment into its Initial IMS (if applicable)\n","● Some non-critical milestones are missing from the Initial Master Schedule\n● The agency does not demonstrate knowledge incorporated  from prior migrations and/or modernizations of similar scope and investment into its Initial IMS around non critical milestones (if applicable)","● Some critical milestones are missing from the Initial Master Schedule\n● The agency does not demonstrate knowledge incorporated  from prior migrations and/or modernizations of similar scope and investment into its Initial IMS around critical milestones (if applicable)",null,"",{"$f":"F14*IF(Dashboard!$Q$22=\"Small\",(Parameters!C22),IF(Dashboard!$Q$22=\"Large\",(Parameters!D22)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J14=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C22),IF(Dashboard!$Q$22=\"Large\",(Parameters!D22)))*J14))","v":{"$error":"#VALUE!"}}]
["Management Support Risk","● Agency has identified project management team with experience in project of similar size and complexity\n● Agency Leadership is engaged with project\n● Project is an established Agency priority\n● Required resources are staffed, the percentage of time required for each position on the customer migration team is identified\n● Plan is in place to  fill vacant positions\n● Government key personnel positions are identified with adequate succession/contingency plans in the event of key personnel changes\n\n","● Agency identified project management team is not fully experienced in project of similar size and complexity but mitigation strategies acceptable to Agency OCIO are in place\n● Agency leadership supports the project, but is not fully engaged \n● Agency Human Resources/Staffing is not fully realistic for the roles and responsibilities needed for the customer migration team for future project phases\n● Non-critical resources are not staffed, the percentage of time required for each position on the customer migration team are not yet identified\n● Plan in place to fill vacant positions is not fully realistic \n\n","● Agency Resource Management Plan does not demonstrate that the Agency has sufficient Federal resources available to manage project \n● Program lacks effective support and/or governance\n\n\n\n\n\n\n\n\n",null,"",{"$f":"F15*IF(Dashboard!$Q$22=\"Small\",(Parameters!C23),IF(Dashboard!$Q$22=\"Large\",(Parameters!D23)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J15=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C23),IF(Dashboard!$Q$22=\"Large\",(Parameters!D23)))*J15))","v":{"$error":"#VALUE!"}}]
["Feasibility Risk","● Agency Vison and Operational End State, Initial Target State Concept of Operations, LCCE and Initial Master Schedule are consistent with line of business standards and any additions or modifications are applicable to multiple organizations and reasonable expectations of a government-wide solution\n","● Some aspects of Agency Vison and Operational End State, Initial Target State Concept of Operations, LCCE and Initial Master Schedule remain to be defined","● Agency Vison and Operational End State, Initial Target State Concept of Operations, LCCE and Initial Master Schedule are inconsistent with line of business standards and any additions or modifications are not applicable to multiple organizations ",null,"",{"$f":"F16*IF(Dashboard!$Q$22=\"Small\",(Parameters!C24),IF(Dashboard!$Q$22=\"Large\",(Parameters!D24)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J16=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C24),IF(Dashboard!$Q$22=\"Large\",(Parameters!D24)))*J16))","v":{"$error":"#VALUE!"}}]
["Technical Complexity","Not Assessed","Not Assessed","Not Assessed","N/A",{"$f":"IF(OR(B17=\"not assessed\",C17=\"not assessed\",D17=\"not assessed\"),\"N/A\",IF(E17=\"Low\",1,IF(E17=\"Medium\",3,IF(E17=\"High\",5,\"\"))))","v":"N/A"},{"$f":"F17*IF(Dashboard!$Q$22=\"Small\",(Parameters!C25),IF(Dashboard!$Q$22=\"Large\",(Parameters!D25)))","v":{"$error":"#VALUE!"}},null,"N/A",{"$f":"IF(OR(B17=\"not assessed\",C17=\"not assessed\",D17=\"not assessed\"),\"N/A\",IF(I17=\"Low\",1,IF(I17=\"Medium with Accepted Risk Strategy\",2,IF(I17=\"Medium\",3,IF(I17=\"High with Accepted Risk Strategy\",4,IF(I17=\"High\",5,IF(I17=\"N/A\",\"\",\"\")))))))","v":"N/A"},{"$f":"(IF(J17=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C25),IF(Dashboard!$Q$22=\"Large\",(Parameters!D25)))*J17))","v":"N/A"}]
["Requirements Management Risk","● No requirements identified that are outside of scope of Shared Service providers / FIBF business capabilities, if applicable (not all LOBs will have an FIBF at this point in time)\n● Mission critical and must-have requirements are identified citing the regulation or policy source documents \n● Requirements are aligned with the Initial Scope of Services and prioritize mission critical versus nice-to-have requirements against standard requirements","● Non-critical business needs and capabilities have been identified that are outside of scope of Shared Service offerings (or FIBF business capabilities for the respective Line of Business, if applicable)","● Vision and Operational End state is not in line with Shared Service offerings\n● Limited engagement with stakeholder during development of As-Is and Target State Processes, Systems and Operating model\n● Significant Mission critical and must-have business capabilities (citing specific regulation or policy source) have been identified that are outside scope of Shared Service offerings (or FIBF business capabilities for the respective Line of Business, if applicable)",null,null,{"$f":"F18*IF(Dashboard!$Q$22=\"Small\",(Parameters!C26),IF(Dashboard!$Q$22=\"Large\",(Parameters!D26)))","v":0},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J18=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C26),IF(Dashboard!$Q$22=\"Large\",(Parameters!D26)))*J18))","v":0}]
["Organizational and Change Management ","● Project Governance is established \n● Project has assigned resources to lead Workforce, Organization & Stakeholder work stream\n● As-Is Workforce documentation and Change Readiness Assessment are fully developed\n","● Implementation impacts a large organization with significant potential impacts to bargaining unit employee's\n● As-Is Workforce documentation and Change Readiness Assessment are developed but some deficiencies exist with a As-Is Workforce and Workload Documentation, approach for workforce transition planning or Change Readiness ","● Project Governance is not established \n● Project has not assigned resources to lead Workforce, Organization & Stakeholder work stream\n● As-Is Workforce documentation and Change Readiness Assessment do not demonstrate understanding of As-Is workforce\n\n",null,null,{"$f":"F19*IF(Dashboard!$Q$22=\"Small\",(Parameters!C27),IF(Dashboard!$Q$22=\"Large\",(Parameters!D27)))","v":0},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J19=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!C27),IF(Dashboard!$Q$22=\"Large\",(Parameters!D27)))*J19))","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,"Low",null,null,null,"Low"]
[null,null,null,null,"Medium",null,null,null,"Medium with Accepted Risk Strategy"]
[null,null,null,null,"High",null,null,null,"Medium"]
[null,null,null,null,"N/A",null,null,null,"High with Accepted Risk Strategy"]
[null,null,null,null,null,null,null,null,"High"]
[null,null,null,null,null,null,null,null,"N/A"]

{"sheet":"Phase 2","index":4,"n_rows":42,"n_cols":12,"rows_kept":42,"cut":false,"hidden":false,"merged":[[5,0,5,3],[5,4,5,11],[1,4,3,7],[1,2,3,2],[4,4,4,7]]}
[]
["Phase 2 ","Cumulative Risk Ratings","Phase 2:  Objective is to Conduct due diligence to identify and select the provider based on requirements and initial target end state \n",null,"Directions: Agency self-assessment of the migration's risk profile by phase based on OSSPI's priority risk categories and artifacts. Consider risk statement(s) by risk category for each level to determine current risk. "]
["Agency Self Assessment",{"$f":"IFERROR(AVERAGEIF(G8:G19,\">0\",G8:G19),\"\")","v":""}]
["Overall OSSPI Rating",{"$f":"IFERROR(AVERAGEIF(K8:K19,\">0\",K8:K19),\"\")","v":""}]
[null,null,null,null,"Click here to see the Minimum Documentation required for this Phase"]
["Phase 2 Risk Evaluation Criteria",null,null,null,"Assessment"]
["Risk Category","Low ","Medium","High","Agency Rating","Agency Value","Agency Weighted Value","Agency Applied Risk Mitigation Strategy","OSSPI Rating","OSSPI Value","OSSPI Weighted Value","OSSPI Comments"]
["Data/Information Risk","● Updated Data Cleansing Plan addresses data in legacy system with no identified data quality concerns anticipated to impact migration\n● Data quality concerns have been identified, Initial Data Cleansing has begun with future activities fully reflected in Initial Master Schedule\n● Progress on Data Cleansing is Reported in Governance Meetings and Status Reports/Dashboards ","● Updated Data Governance and Data Cleansing Plans have commenced with some minor issues or problems anticipated to impact migration\n● Data Cleansing activity has commenced, but updated Data Cleansing Plan does not fully address data in legacy system or identify data quality concerns anticipated to impact migration\n● Data Cleansing activities are reflected in Initial Master Schedule but  progress on Data Cleansing is not reported in Governance Meetings and Status Reports/Dashboards \n","● Updated Data Governance and Data Cleansing Plan identifies unusual data quality concerns anticipated to impact migration\n● Data Quality concerns have been identified but Data Cleansing Activities are not identified on Initial Master Schedule\n",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(E8=\"Low\",1,IF(E8=\"Medium\",3,IF(E8=\"High\",5,\"\"))))","v":""},{"$f":"F8*IF(Dashboard!$Q$22=\"Small\",(Parameters!E16),IF(Dashboard!$Q$22=\"Large\",(Parameters!F16)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(I8=\"Low\",1,IF(I8=\"Medium with Accepted Risk Strategy\",2,IF(I8=\"Medium\",3,IF(I8=\"High with Accepted Risk Strategy\",4,IF(I8=\"High\",5,IF(I8=\"N/A\",\"\",\"\")))))))","v":""},{"$f":"(IF(J8=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E16),IF(Dashboard!$Q$22=\"Large\",(Parameters!F16)))*J8))","v":{"$error":"#VALUE!"}}]
["Cyber Information Security Risk","● No unique cyber information security risk identified in Initial Target State Systems Environment or Initial Business Requirements ","● Agency identified unique security concerns in  Initial Target State Systems Environment or Initial Business Requirements ","● Agency unique security concerns identified in  Initial Target State Systems Environment or Initial Business Requirements which require secret cleared resources to resolve",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(E9=\"Low\",1,IF(E9=\"Medium\",3,IF(E9=\"High\",5,\"\"))))","v":""},{"$f":"F9*IF(Dashboard!$Q$22=\"Small\",(Parameters!E17),IF(Dashboard!$Q$22=\"Large\",(Parameters!F17)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(I9=\"Low\",1,IF(I9=\"Medium with Accepted Risk Strategy\",2,IF(I9=\"Medium\",3,IF(I9=\"High with Accepted Risk Strategy\",4,IF(I9=\"High\",5,IF(I9=\"N/A\",\"\",\"\")))))))","v":""},{"$f":"(IF(J9=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E17),IF(Dashboard!$Q$22=\"Large\",(Parameters!F17)))*J9))","v":{"$error":"#VALUE!"}}]
["Financial Risk","● LCCE is updated (according to cost management plan) for Engagement, Migration, and O&M costs\n● Actual spending is being compared with budget and LCCE is adjusted as needed\n● Changes to program costs and actual spending are reported in governance meetings and Status Reports/Dashboards \n ","● LCCE is updated (according to cost management plan) for   Engagement, Migration, and O&M costs, but is not fully realistic\n● Actual spending is being compared with budget but  LCCE is not reflecting appropriate adjustments\n● Some Changes to program costs and actual spending are not reported in governance meetings or Status Reports/Dashboards \n ","● LCCE updated (according to cost management plan) for Engagement, Migration, and O&M costs, but costs are not realistic \n● Actual spending is not being compared with budget\n● Program costs and actual spending are not reported in governance meetings or Status Reports/Dashboards ",null,"",{"$f":"F10*IF(Dashboard!$Q$22=\"Small\",(Parameters!E18),IF(Dashboard!$Q$22=\"Large\",(Parameters!F18)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IF(OR(B10=\"not assessed\",C10=\"not assessed\",D10=\"not assessed\"),\"N/A\",IF(I10=\"Low\",1,IF(I10=\"Medium with Accepted Risk Strategy\",2,IF(I10=\"Medium\",3,IF(I10=\"High with Accepted Risk Strategy\",4,IF(I10=\"High\",5,IF(I10=\"N/A\",\"\",\"\")))))))","v":""},{"$f":"(IF(J10=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E18),IF(Dashboard!$Q$22=\"Large\",(Parameters!F18)))*J10))","v":{"$error":"#VALUE!"}}]
["Acquisition and Procurement Risk","● Agency contracts are in place with no critical support contract expiring during implementation","● Agency acquisitions for program management, change management, business process reengineering, data management, interface development, and integration, as defined in the Procurement Plan are not fully on schedule with no current impact to future M3 Phases ","● Procurement Plan identifies procurement risks which could impact future M3 phases \n● Agency legacy systems contract expiration dates occur prior to feasible implementation dates",null,"",{"$f":"F11*IF(Dashboard!$Q$22=\"Small\",(Parameters!E19),IF(Dashboard!$Q$22=\"Large\",(Parameters!F19)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J11=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E19),IF(Dashboard!$Q$22=\"Large\",(Parameters!F19)))*J11))","v":{"$error":"#VALUE!"}}]
["Operational Risk","● No mission critical needs identified in Initial Target State Concept of Operations are outside of typical the administrative services offerings of selected provider","● Some non-critical items identified in Initial Target State Concept of Operations are not part of typical administrative services offerings","● Unique operational state identified in Vision and Operation End State \n● Business Requirements or Target State Concept of Operations are outside of typical administrative services offering",null,"",{"$f":"F12*IF(Dashboard!$Q$22=\"Small\",(Parameters!E20),IF(Dashboard!$Q$22=\"Large\",(Parameters!F20)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J12=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E20),IF(Dashboard!$Q$22=\"Large\",(Parameters!F20)))*J12))","v":{"$error":"#VALUE!"}}]
["Reputational Risk","● Project is consistent with government wide Shared Services strategy \n● Scope of Services captured in Business Needs Workbook describes a migration with no unique mission critical services required from providers  ","● Project has some elements that are not consistent with government wide Shared Service strategy\n● Scope of Services captured in Business Needs Workbook describes a  migration with unique mission critical services required from providers  ","● Project is not consistent with government wide Shared Service strategy\n● Project size and complexity are known to include multiple forms of oversight\n● Scope of Services captured in Business Needs Workbook describes a migration with mission critical services not currently provided by the selected provider \n",null,"",{"$f":"F13*IF(Dashboard!$Q$22=\"Small\",(Parameters!E21),IF(Dashboard!$Q$22=\"Large\",(Parameters!F21)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J13=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E21),IF(Dashboard!$Q$22=\"Large\",(Parameters!F21)))*J13))","v":{"$error":"#VALUE!"}}]
["Schedule Risk","● Agency has an IMS with notional milestones through Phase 3 which identifies Agency resources and has gained concurrence from OSSPI on reasonableness of Agency proposed timelines\n● Program Management processes are in place to maintain and monitor Schedule\n● Provider has high level schedule that aligns to customer defined timeline","● IMS is not updated or shows schedule variance but critical milestones are still achievable\n● PM Processes are in place to maintain and monitor schedule but are not being utilized","● Updated IMS and schedule variance demonstrates some critical milestones are not achievable for future M3 Phases  \n● PM Process has not been defined to monitor and maintain the schedule\n",null,"",{"$f":"F14*IF(Dashboard!$Q$22=\"Small\",(Parameters!E22),IF(Dashboard!$Q$22=\"Large\",(Parameters!F22)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J14=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E22),IF(Dashboard!$Q$22=\"Large\",(Parameters!F22)))*J14))","v":{"$error":"#VALUE!"}}]
["Management Support Risk","● Agency has identified project management team with experience in project of similar size and complexity\n● Agency Leadership is engaged with project\n● Project is an established Agency priority\n● Required resources are staffed, the percentage of time required for each position on the customer migration team is identified\n● Plan is in place to  fill vacant positions\n● RMO's have been actively engaged throughout the process\n","● Agency identified project management team is not fully experienced in project of similar size and complexity but mitigation strategies acceptable to Agency OCIO are in place\n● Agency leadership supports the project, but is not fully engaged \n● Agency Human Resources/Staffing is not fully realistic for the roles and responsibilities needed for the customer migration team for future project phases\n● Non-critical resources are not staffed, the percentage of time required for each position on the customer migration team are not yet identified\n● Plan in place to fill vacant positions is not fully realistic \n● RMO's have been engaged, but absent at some key points in the process\n","● Agency Human Resources/Staffing plan does not demonstrate that the Agency has sufficient Federal resources available to manage project \n● Program lacks effective support and/or governance\n\n\n\n\n\n\n\n\n",null,"",{"$f":"F15*IF(Dashboard!$Q$22=\"Small\",(Parameters!E23),IF(Dashboard!$Q$22=\"Large\",(Parameters!F23)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J15=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E23),IF(Dashboard!$Q$22=\"Large\",(Parameters!F23)))*J15))","v":{"$error":"#VALUE!"}}]
["Feasibility Risk","● Agency Vison and Operational End State, Initial Target State Concept of Operations, LCCE and Initial Master Schedule are consistent with line of business standards and any additions or modifications are applicable to multiple organizations and reasonable expectations of a government-wide solution\n","● Some inconsistencies between the selected Provider Assessment Report and the Agency Vison and Operational End State, Initial Target State Concept of Operations, LCCE and Initial Master Schedule when compared to the line of business standards, additions or modifications are not applicable to multiple organizations ","● Significant inconsistencies with the selected Provider Assessment Report and the Agency Vison and Operational End State, Initial Target State Concept of Operations, LCCE and Initial Master Schedule when compared to the line of business standards, additions or modifications are not applicable to multiple organizations ",null,"",{"$f":"F16*IF(Dashboard!$Q$22=\"Small\",(Parameters!E24),IF(Dashboard!$Q$22=\"Large\",(Parameters!F24)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J16=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E24),IF(Dashboard!$Q$22=\"Large\",(Parameters!F24)))*J16))","v":{"$error":"#VALUE!"}}]
["Technical Complexity","● No requirements identified that are outside of scope of shared service providers / FIBF, if applicable (not all LOBs may have an FIBF at this point in time)\n● As-Is and Target State Processes, Systems and Operating model are defined in Business Needs Workbook and validated with business owners \n● Mission critical and must-have requirements are identified citing the regulation or policy source documents \n● Requirements are aligned with the Initial Scope of Services and prioritized mission critical versus nice-to-have requirements are documented\n● Change control procedures as defined in the Requirements Management Plan are in place","● Non-critical business needs and capabilities have been identified that are outside of scope of Shared Service offerings (or FIBF business capabilities for the respective Line of Business, if applicable)\n● As-Is and Target State Processes, Systems and Operating model are defined in Business Needs Workbook but Agency buy in has not been demonstrated\n● Mission critical and must-have requirements are not yet identified or do not cite the regulation or policy source document\n● Change control procedures as defined in the Requirements Management Plan are not yet in place","● Vision and Operational End state is not in line with Shared Service offerings\n● Limited engagement with stakeholder during development of As-Is and Target State Processes, Systems and Operating model\n● Significant Mission critical and must-have business capabilities (citing specific regulation or policy source) have been identified that are outside scope of Shared Service offerings (or FIBF business capabilities for the respective Line of Business, if applicable)\n● Change control procedures in the Requirements Management Plan are not yet completely defined",null,"",{"$f":"F17*IF(Dashboard!$Q$22=\"Small\",(Parameters!E25),IF(Dashboard!$Q$22=\"Large\",(Parameters!F25)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J17=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E25),IF(Dashboard!$Q$22=\"Large\",(Parameters!F25)))*J17))","v":{"$error":"#VALUE!"}}]
["Requirements Management Risk","● No requirements identified that are outside of scope of shared service providers / FIBF, if applicable (not all LOBs may have an FIBF at this point in time)\n● As-Is and Target State Processes, Systems and Operating model are defined in Business Needs Workbook and validated with business owners \n● Mission critical and must-have requirements are identified citing the regulation or policy source documents \n● Requirements are aligned with the Initial Scope of Services and prioritized mission critical versus nice-to-have requirements are documented\n● Change control procedures as defined in the Requirements Management Plan are in place","● Non-critical items identified in Vision and Operational End Sate that are not part of shared service offering\n● FIBF in place (if applicable), but some key components are missing\n● As-Is and Target State Processes, Systems and Operating model are defined in Business Needs Workbook but Agency buy in has not been demonstrated\n● Mission critical and must-have requirements are not yet identified or do not cite the regulation or policy source document\n● Change control procedures as defined in the Requirements Management Plan are not yet in place","● Vision and Operational End State is not in line with shared service offering\n● Limited engagement with stakeholder during development of As-Is and Target State Processes, Systems and Operating model\n● Significant Mission critical and must-have requirements outside of standard shared service offerings are identified with specific regulation or policy source \n● Change control procedures in the Requirements Management Plan are not yet completely defined",null,"",{"$f":"F18*IF(Dashboard!$Q$22=\"Small\",(Parameters!E26),IF(Dashboard!$Q$22=\"Large\",(Parameters!F26)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J18=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E26),IF(Dashboard!$Q$22=\"Large\",(Parameters!F26)))*J18))","v":{"$error":"#VALUE!"}}]
["Organizational and Change Management ","● Activities related to the Change Management Plan include an updated Communications Plan based on labor relations meetings and are reflected in the governance meetings and Status Reports/Dashboards \n","● Some non critical activities related to the Change Management Plan are not reflected in the governance meetings and Status Reports/Dashboards ","● Some critical activities related to the Change Management Plan are not reflected in the governance meetings and Status Reports/Dashboards \n\n",null,"",{"$f":"F19*IF(Dashboard!$Q$22=\"Small\",(Parameters!E27),IF(Dashboard!$Q$22=\"Large\",(Parameters!F27)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,"",{"$f":"(IF(J19=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!E27),IF(Dashboard!$Q$22=\"Large\",(Parameters!F27)))*J19))","v":{"$error":"#VALUE!"}}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,"Low",null,null,null,"Low"]
[null,null,null,null,"Medium",null,null,null,"Medium with Accepted Risk Strategy"]
[null,null,null,null,"High",null,null,null,"Medium"]
[null,null,null,null,"N/A",null,null,null,"High with Accepted Risk Strategy"]
[null,null,null,null,null,null,null,null,"High"]
[null,null,null,null,null,null,null,null,"N/A"]

{"sheet":"Phase 3","index":5,"n_rows":42,"n_cols":12,"rows_kept":42,"cut":false,"hidden":false,"merged":[[5,0,5,3],[5,4,5,11],[1,4,3,7],[1,2,3,2],[4,4,4,7]]}
[]
["Phase 3 ","Cumulative Risk Ratings","Phase 3:Objective is to conduct detailed planning through a fit-gap analysis and finalize the implementation roadmap",null,"Directions: Agency self-assessment of the migration's risk profile by phase based on OSSPI's priority risk categories and artifacts. Consider risk statement(s) by risk category for each level to determine current risk. "]
["Agency Self-assessment",{"$f":"IFERROR(AVERAGEIF(G8:G19,\">0\",G8:G19),\"\")","v":""}]
["Overall OSSPI Rating",{"$f":"IFERROR(AVERAGEIF(K8:K19,\">0\",K8:K19),\"\")","v":""}]
[null,null,null,null,"Click here to see the Minimum Documentation required for this Phase"]
["Phase 3 Risk Evaluation Criteria",null,null,null,"Assessment"]
["Risk Category","Low ","Medium","High","Agency Rating","Agency Value","Agency Weighted Value","Agency Applied Risk Mitigation Strategy","OSSPI Rating","OSSPI Value","OSSPI Weighted Value","OSSPI Comments"]
["Data/Information Risk","● Data Governance and Data Cleansing Plan reflect updates for activities of the Engagement Phase\n● Data Cleansing plan addresses data in legacy system with no identified data quality concerns anticipated to impact migration\n● Progress on Data Cleansing is Reported in governance meetings and Status Reports/Dashboards \n● Legacy-to-target data mapping activities have begun\n● Success criteria used to measure data quality are established and measurable\n● Data Conversion Plan is realistic","● Data Governance and Data Cleansing plans have been updated to reflect issues identified in the Gap Analysis Report\n● Data Cleansing plan does not fully address data in legacy system or identify data quality concerns anticipated to impact migration\n● Data Cleansing activities are reflected in Initial Master Schedule but progress on Data Cleansing is not Reported in governance meetings and Status Reports/Dashboards \n● Success criteria used to measure data quality are established but no plan in place to measure\n● Data Conversion Plan reflects the conversion of multiple legacy systems","● Unusual data quality concerns identified in Gap Analysis Report\n● Data Cleansing Plans have not been updated to reflect the Gap Analysis Report\n● Data Cleansing activities and Legacy-to-target data mapping activities are not identified on Master Schedule\n● No realistic timeline for future data cleansing activities have been established \n● Success criteria used to measure data quality are not realistic\n● Data Conversion Plan is not realistic based on projects of similar size and scope ",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(E8=\"Low\",1,IF(E8=\"Medium\",3,IF(E8=\"High\",5,\"\"))))","v":""},{"$f":"F8*IF(Dashboard!$Q$22=\"Small\",(Parameters!G16),IF(Dashboard!$Q$22=\"Large\",(Parameters!H16)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J8=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G16),IF(Dashboard!$Q$22=\"Large\",(Parameters!H16)))*J8))","v":0}]
["Cyber Information Security Risk","● No unique cyber information security risk identified in Initial Target State Systems Environment or Initial Business Requirements \n● No unique requirement identified for Agency Side Authority to Operate (ATO)","● Agency identified unique security concerns in Initial Target State Systems Environment or Initial Business Requirements \n● Agency Side Security deliverables required by implementation are outside of customary deliverables for Shared Service Provider","● Agency unique security concerns identified in Initial Target State Systems Environment or Initial Business Requirements which require secret cleared resources to resolve\n● Agency ATO required in addition to Standard Shared Service Provider Security deliverables",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(E9=\"Low\",1,IF(E9=\"Medium\",3,IF(E9=\"High\",5,\"\"))))","v":""},{"$f":"F9*IF(Dashboard!$Q$22=\"Small\",(Parameters!G17),IF(Dashboard!$Q$22=\"Large\",(Parameters!H17)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J9=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G17),IF(Dashboard!$Q$22=\"Large\",(Parameters!H17)))*J9))","v":0}]
["Financial Risk","● LCCE is developed (according to cost management plan) for implementation and O&M phases\n● Actual spending is being compared with budget and LCCE is adjusted as needed\n● Changes to program costs and actual spending are reported in governance meetings and Status Reports/Dashboards \n● Deviation is less than 3% between Planned and Actual Costs","● LCCE is developed (according to cost management plan) for Migration and O&M, but is not fully realistic \n● Actual spending is being compared with budget but LCCE is not reflecting appropriate adjustments\n● Some Changes to program costs and actual spending are not reported in governance meetings or Status Reports/Dashboards \n● Deviation between Planned and Actual Costs of less than 10%","● LCCE is developed (according to cost management plan) for Migration and O&M, but is not realistic\n● Actual spending is not being compared with budget\n● Program costs and actual spending are not reported in governance meetings or Status Reports/Dashboards \n● Deviation between Planned and Actual Costs of more than 10%\n\n",null,"",{"$f":"F10*IF(Dashboard!$Q$22=\"Small\",(Parameters!G18),IF(Dashboard!$Q$22=\"Large\",(Parameters!H18)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J10=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G18),IF(Dashboard!$Q$22=\"Large\",(Parameters!H18)))*J10))","v":0}]
["Acquisition and Procurement Risk","● Agency contracts are in place with no critical support contract expiring during implementation","●Agency acquisitions for program management, change management, business process reengineering, data management, interface development, and integration, as defined in the Procurement Plan are not fully on schedule with no current impact to future M3 Phases ","● Procurement Plan identifies procurement risks which could impact future M3 phases \n● Agency legacy systems contract expiration dates occur prior to feasible implementation dates",null,"",{"$f":"F11*IF(Dashboard!$Q$22=\"Small\",(Parameters!G19),IF(Dashboard!$Q$22=\"Large\",(Parameters!H19)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J11=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G19),IF(Dashboard!$Q$22=\"Large\",(Parameters!H19)))*J11))","v":0}]
["Operational Risk","● Selected Provider has not identified any unique requirements included in the Gap Analysis \n● Gap solutions are identified and impacts to implementation are understood  \n● SLAs for O&M are defined\n● Updated Concept of Operations is validated with stakeholders and includes defined roles and responsibilities for O&M \n● Target State Concept of Operations based on processes to be migrated to the provider and the designed retained organization ","● Some non-critical items identified in Initial Target State Concept of Operations are not part of typical administrative services and remain as gaps\n● SLA's for O&M are defined but workforce transition strategy is not defined\n● Plan in place to validate Concept of Operations with stakeholders ","● Unique operational state identified in Vision and Operation End State does not match the updated Target State Concept of Operations\n● SLA's for O&M are defined, but some critical components appear to be inaccurate or missing\n● No plan in place to validate Concept of Operations with stakeholders \n● Plan in place to validate Concept of Operations lacks critical detail, stakeholder support, or consensus on where the business processes will take place",null,"",{"$f":"F12*IF(Dashboard!$Q$22=\"Small\",(Parameters!G20),IF(Dashboard!$Q$22=\"Large\",(Parameters!H20)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J12=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G20),IF(Dashboard!$Q$22=\"Large\",(Parameters!H20)))*J12))","v":0}]
["Reputational Risk","● Alignment of Scope of Services captured in Business Needs workbook and service by provider offering","● Alignment between scope of services captured in Business Needs workbook and provider services exists for non-mission critical areas","● Project size and complexity is known to include multiple forms of oversight\n● Alignment between scope of services captured in Business Needs workbook and provider services exists for mission critical areas\n",null,"",{"$f":"F13*IF(Dashboard!$Q$22=\"Small\",(Parameters!G21),IF(Dashboard!$Q$22=\"Large\",(Parameters!H21)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J13=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G21),IF(Dashboard!$Q$22=\"Large\",(Parameters!H21)))*J13))","v":0}]
["Schedule Risk","● Agency has an IMS with milestones through Phase 4 which identifies Agency resources and is integrated with provider activities (one schedule with responsibility clearly assigned) predecessor and successor tasks are identified, critical path is apparent\n● Program Management processes are in place to maintain and monitor Schedule\n● IMS demonstrates linkage to FSSP Schedule\n● Migration Approach and IMS based on RTM and timeline requirements \n● Migration Approach includes a release approach based on Fit-Gap Analysis and finalized Scope of Services \n● Plan in place for system decommissioning post migration \n\n\n","● IMS is not updated or shows schedule variance but critical milestones are still achievable\n● Weakness in linkages to predecessor and successor task \n● Critical path is not obvious\n","● Critical milestones are not achievable\n● IMS not aligned between customer and provider\n● Critical path between successors and predecessors has not been identified\n\n\n",null,"",{"$f":"F14*IF(Dashboard!$Q$22=\"Small\",(Parameters!G22),IF(Dashboard!$Q$22=\"Large\",(Parameters!H22)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J14=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G22),IF(Dashboard!$Q$22=\"Large\",(Parameters!H22)))*J14))","v":0}]
["Management Support Risk","● Agency has identified Project Management team with experience in project of similar size and complexity\n● Agency Project Resource Management Plan is in place with all key Federal participants identified\n● Agency Leadership is engaged with project\n● RMO's have been actively engaged throughout the process\n● RAID log that has been updated throughout the project, and shows an understanding of current and long-term risks","● Agency identified project management team is not fully experienced in projects of similar size and complexity with mitigation strategies acceptable to Agency OCIO in place\n● RMO's have been engaged, but absent at some key points\n● RAID log that lacks some non-critical details of migration risks\n● A Program Management Plan lacking some non-substantive details on the management, execution, or control of the project","● Changes in project leadership during project\n● Key Federal/Contract resources may not be available to support project\n● RAID log has not been consistently kept up to date",null,"",{"$f":"F15*IF(Dashboard!$Q$22=\"Small\",(Parameters!G23),IF(Dashboard!$Q$22=\"Large\",(Parameters!H23)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J15=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G23),IF(Dashboard!$Q$22=\"Large\",(Parameters!H23)))*J15))","v":0}]
["Feasibility Risk","● Agency Vison and Operational End State, Target State Concept of Operations, LCCE and Approach/Timeline are aligned with line of business standards and any additions or modifications are applicable to multiple organizations","● Non critical inconsistencies between Agency Vison and Operational End State, Target State Concept of Operations, LCCE and Approach/Timeline when compared with line of business standards and any additions or modifications are not applicable to multiple organizations","● Significant inconsistencies remain with Agency Vison and Operational End State, Target State Concept of Operations, LCCE and Approach/Timeline when compared with line of business standards and any additions or modifications are not applicable to multiple organizations",null,"",{"$f":"F16*IF(Dashboard!$Q$22=\"Small\",(Parameters!G24),IF(Dashboard!$Q$22=\"Large\",(Parameters!H24)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,null,{"$f":"(IF(J16=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G24),IF(Dashboard!$Q$22=\"Large\",(Parameters!H24)))*J16))","v":0}]
["Technical Complexity","● Interfaces are minimal and can be fulfilled with standard Agency Performance Indicators (API) or Service Oriented Architecture (SOA)\n● Selected provider has successfully implemented in similar organization","● Small number of gaps (as determined by service provider) identified for implementation\n● Interfaces need to be addressed during implementation ","● Significant gaps (as determined by service provider)  identified or new capability required for service provider\n● Complex interfaces need to be accommodated and significant investments made for the interface's design and plans",null,"",{"$f":"F17*IF(Dashboard!$Q$22=\"Small\",(Parameters!G25),IF(Dashboard!$Q$22=\"Large\",(Parameters!H25)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IFERROR(IF(OR(B17=\"not assessed\",C17=\"not assessed\",D17=\"not assessed\"),\"N/A\",IF(I17=\"Low\",1,IF(I17=\"Medium with Accepted Risk Strategy\",2,IF(I17=\"Medium\",3,IF(I17=\"High with Accepted Risk Strategy\",4,IF(I17=\"High\",5,\"\")))))),\"\")","v":""},{"$f":"(IF(J17=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G25),IF(Dashboard!$Q$22=\"Large\",(Parameters!H25)))*J17))","v":{"$error":"#VALUE!"}}]
["Requirements Management Risk","● No requirements in RTM identified are outside of scope of Shared Service providers \n● As-Is and Target State Processes, Systems and Operating model are defined in Business Needs Workbook and validated with business owners \n● Mission critical and must-have requirements are identified citing the regulation or policy source documents \n● Requirements are aligned with the Scope of Services and prioritize mission critical versus nice-to-have requirements are documented in RTM\n● Change control procedures as defined in the Requirements Management Plan are in place\n● Frequient engagement with stakeholder for requirements activities","● Gap resolutions for Mission critical and must-have requirements are not yet identified \n● Critical and nice-to-have requirements against standard requirements and provider capability, and capacity are only partially documented in the RTM \n● Change control procedures as defined in the Requirements Management Plan are not always performed or changes not reported in governance meetings\n● Moderate engagement with stakeholder for requirements activities"," ● Limited engagement with stakeholder for requirements activities \n● Significant Mission critical and must-have requirements outside of standard shared service offerings are identified and these requirements are mandated by specific regulation or policy source \n● Change control procedures as defined in the Requirements Management Plan are not followed",null,"",{"$f":"F18*IF(Dashboard!$Q$22=\"Small\",(Parameters!G26),IF(Dashboard!$Q$22=\"Large\",(Parameters!H26)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IFERROR(IF(OR(B18=\"not assessed\",C18=\"not assessed\",D18=\"not assessed\"),\"N/A\",IF(I18=\"Low\",1,IF(I18=\"Medium with Accepted Risk Strategy\",2,IF(I18=\"Medium\",3,IF(I18=\"High with Accepted Risk Strategy\",4,IF(I18=\"High\",5,\"\")))))),\"\")","v":""},{"$f":"(IF(J18=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G26),IF(Dashboard!$Q$22=\"Large\",(Parameters!H26)))*J18))","v":{"$error":"#VALUE!"}}]
["Organizational and Change Management ","● Project Governance is established \n● Detailed design is created for the retained organization \n● Project has assigned resources to lead Workforce, Organization & Stakeholder work stream\n● Business process gaps are identified and broad agreement within Agency on required business process engineering exists \n● Retained workforce training plan developed\n● Change management activities that are planned for the program lifecycle for Business Process Re-engineering, Communications and Workforce Alignment are defined\n\n\n","● Organizational Change Management effort during implementation is not yet defined in Master Schedule\n● Scope of business process impacts not agreed to within customer agency\n\n","● Implementation impacts a large organization with significant potential impacts to bargaining unit employee's and mitigation strategies are not fully in place\n● Scope of business process reengineering not defined and agreed to\n● Retained workforce is not yet understood",null,"",{"$f":"F19*IF(Dashboard!$Q$22=\"Small\",(Parameters!G27),IF(Dashboard!$Q$22=\"Large\",(Parameters!H27)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the dropbdown box>>",null,{"$f":"IFERROR(IF(OR(B19=\"not assessed\",C19=\"not assessed\",D19=\"not assessed\"),\"N/A\",IF(I19=\"Low\",1,IF(I19=\"Medium with Accepted Risk Strategy\",2,IF(I19=\"Medium\",3,IF(I19=\"High with Accepted Risk Strategy\",4,IF(I19=\"High\",5,\"\")))))),\"\")","v":""},{"$f":"(IF(J19=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!G27),IF(Dashboard!$Q$22=\"Large\",(Parameters!H27)))*J19))","v":{"$error":"#VALUE!"}}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,"Low",null,null,null,"Low"]
[null,null,null,null,"Medium",null,null,null,"Medium with Accepted Risk Strategy"]
[null,null,null,null,"High",null,null,null,"Medium"]
[null,null,null,null,"N/A",null,null,null,"High with Accepted Risk Strategy"]
[null,null,null,null,null,null,null,null,"High"]
[null,null,null,null,null,null,null,null,"N/A"]

{"sheet":"Phase 4","index":6,"n_rows":42,"n_cols":12,"rows_kept":42,"cut":false,"hidden":false,"merged":[[1,4,3,7],[5,0,5,3],[5,4,5,11],[1,2,3,2],[4,4,4,7]]}
[]
["Phase 4","Cumulative Risk Ratings","Phase 4Objective is to build, test, and deploy the new system, concept of operations, and workforce design.",null,"Directions: Agency self-assessment of the migration's risk profile by phase based on OSSPI's priority risk categories and artifacts. Consider risk statement(s) by risk category for each level to determine current risk. "]
["Agency Self-assessment",{"$f":"IFERROR(AVERAGEIF(G8:G19,\">0\",G8:G19),\"\")","v":""}]
["Overall OSSPI Rating",{"$f":"IFERROR(AVERAGEIF(K8:K19,\">0\",K8:K19),\"\")","v":""}]
[null,null,null,null,"Click here to see the Minimum Documentation required for this Phase"]
["Phase 4 Risk Evaluation Criteria",null,null,null,"Assessment"]
["Risk Category","Low ","Medium","High","Agency Rating","Agency Value","Agency Weighted Value","Agency Applied Risk Mitigation Strategy","OSSPI Rating","OSSPI Value","OSSPI Weighted Value","OSSPI Comments"]
["Data/Information Risk","● Data migration task in IMS are meeting scheduled dates, or have been successfully completed\n● A thorough and comprehensive Data Conversion Plan exists that demonstrates readiness to securely transfer information from the legacy system over to the new provider \n● Conversion testing has been completed according to Conversion Test Plan, conversion defects acceptable and resolvable after go-live\n\n","● Data migration tasks in IMS are behind scheduled dates but project implementation schedule is not at risk\n● A Data Conversion Plan that demonstrates readiness to securely transfer information from the legacy system over to the new provider, but lacks some non-critical detail\n● Some conversion testing has not been completed according to Conversion Test Plan, but conversion risk has been determined to be acceptable\n","● Data migration task in IMS are behind scheduled dates with impact to project implementation schedule\n● A Data Conversion Plan that lacks some critical details to demonstrate readiness to securely transfer information from the legacy system over to the new provider\n● Conversion test scripts have not all been successfully executed\n",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(E8=\"Low\",1,IF(E8=\"Medium\",3,IF(E8=\"High\",5,\"\"))))","v":""},{"$f":"F8*IF(Dashboard!$Q$22=\"Small\",(Parameters!I16),IF(Dashboard!$Q$22=\"Large\",(Parameters!J16)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,{"$f":"IF(OR(B8=\"not assessed\",C8=\"not assessed\",D8=\"not assessed\"),\"N/A\",IF(I8=\"Low\",1,IF(I8=\"Medium with Accepted Risk Strategy\",2,IF(I8=\"Medium\",3,IF(I8=\"High with Accepted Risk Strategy\",4,IF(I8=\"High\",5,\"\"))))))","v":""},{"$f":"(IF(J8=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I16),IF(Dashboard!$Q$22=\"Large\",(Parameters!J16)))*J8))","v":{"$error":"#VALUE!"}}]
["Cyber Information Security Risk","● Cyber and Information Security task in IMS have met scheduled dates","● Cyber and Information Security tasks in IMS are behind scheduled dates but project implementation schedule is not at risk","● Cyber and Information Security tasks in IMS are behind scheduled dates with impact to project implementation schedule",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(E9=\"Low\",1,IF(E9=\"Medium\",3,IF(E9=\"High\",5,\"\"))))","v":""},{"$f":"F9*IF(Dashboard!$Q$22=\"Small\",(Parameters!I17),IF(Dashboard!$Q$22=\"Large\",(Parameters!J17)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,{"$f":"IF(OR(B9=\"not assessed\",C9=\"not assessed\",D9=\"not assessed\"),\"N/A\",IF(I9=\"Low\",1,IF(I9=\"Medium with Accepted Risk Strategy\",2,IF(I9=\"Medium\",3,IF(I9=\"High with Accepted Risk Strategy\",4,IF(I9=\"High\",5,\"\"))))))","v":""},{"$f":"(IF(J9=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I17),IF(Dashboard!$Q$22=\"Large\",(Parameters!J17)))*J9))","v":{"$error":"#VALUE!"}}]
["Financial Risk","●The LCCE for operations and maintenance is comprehensive and realistic\n","●The LCCE appears to lack some non-critical costs for system operations and maintenance\n'● Actual costs to-date exceeded estimated costs by less than 10%","●The LCCE does not reflect the Agency cost for operations and maintenance as well as legacy system decommissioning\n● Actual costs to-date exceeded estimated costs by more than 10%",null,"",{"$f":"F10*IF(Dashboard!$Q$22=\"Small\",(Parameters!I18),IF(Dashboard!$Q$22=\"Large\",(Parameters!J18)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J10=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I18),IF(Dashboard!$Q$22=\"Large\",(Parameters!J18)))*J10))","v":{"$error":"#VALUE!"}}]
["Acquisition and Procurement Risk","● Required post implementation support contracts are in place with no remaining implementation tasks\n","● Implementation support contracts period of performance do not support all post implementation milestones, but no critical path activities are impacted","● Implementation support contracts period of performance does not correspond to critical tasks in post implementation IMS",null,"",{"$f":"F11*IF(Dashboard!$Q$22=\"Small\",(Parameters!I19),IF(Dashboard!$Q$22=\"Large\",(Parameters!J19)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J11=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I19),IF(Dashboard!$Q$22=\"Large\",(Parameters!J19)))*J11))","v":{"$error":"#VALUE!"}}]
["Operational Risk","● A comprehensive and complete Contingency Plan is in place to mitigate risks in the event of a no-go decision by the customer \n● A comprehensive and complete Go/No-Go Assessment Report has been developed that describes the process for assessing the program's readiness\n● Agency Business Continuity Plan (BCP) is updated to reflect impacts of migration","● Contingency Plan is in place, but lacks certain components and details required to fully demonstrate readiness to mitigate a no-go decision by the customer\n● Go/No-Go Assessment Report is not thorough, or lacks some justifications or action plans for yellow and red Success Criteria\n● Agency Business Continuity Plan (BCP) is not updated to reflect impacts of migration but no critical agency functions are impacted","● Contingency Plan fails to mitigate some major risks of a no-go decision\n● Go/No-Go Assessment Report lacks key justifications and action plans \n● Agency Business Continuity Plan (BCP) is not updated to reflect impacts of migration and critical agency functions are impacted",null,"",{"$f":"F12*IF(Dashboard!$Q$22=\"Small\",(Parameters!I20),IF(Dashboard!$Q$22=\"Large\",(Parameters!J20)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J12=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I20),IF(Dashboard!$Q$22=\"Large\",(Parameters!J20)))*J12))","v":{"$error":"#VALUE!"}}]
["Reputational Risk","● Assessment of financial and schedule risk are both low","● No more than medium risk for financial and schedule risk","● Either financial or schedule risk are determined to be high risk",null,"",{"$f":"F13*IF(Dashboard!$Q$22=\"Small\",(Parameters!I21),IF(Dashboard!$Q$22=\"Large\",(Parameters!J21)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J13=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I21),IF(Dashboard!$Q$22=\"Large\",(Parameters!J21)))*J13))","v":{"$error":"#VALUE!"}}]
["Schedule Risk","● Agency has an IMS with notional milestones through post implementation period which identifies Agency resources and has gained concurrence from OSSPI on reasonableness of Agency proposed timelines\n● Program Management processes are in place to maintain and monitor Schedule\n","● Updated IMS shows schedule variance for milestones agreed to with OSSPI but critical milestones are still achievable\n","● Updated IMS demonstrates schedule variance and critical milestones agreed upon with OSSPI are not achievable\n",null,"",{"$f":"F14*IF(Dashboard!$Q$22=\"Small\",(Parameters!I22),IF(Dashboard!$Q$22=\"Large\",(Parameters!J22)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J14=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I22),IF(Dashboard!$Q$22=\"Large\",(Parameters!J22)))*J14))","v":{"$error":"#VALUE!"}}]
["Management Support Risk","● Agency project management team with experience in project of similar size and complexity in place\n● RMO's have been actively engaged throughout the migration process\n● RAID log that has been updated throughout the migration, and shows an understanding of current and long-term risks\n● An updated Program Management Plan that demonstrates readiness for go-live\n","● Agency identified project management team is not fully experience in project of similar size and complexity with mitigation strategies acceptable to Agency OCIO in place\n● RMO's have been engaged, but absent at some key points in the migration\n● RAID log that lacks some non-critical details of migration risks\n● A Program Management Plan lacking some non-substantive details on the management, execution, or control of potential scenarios with the new system","● Key Federal resources are not available to support project\n● RAID log has not been consistently kept up to date, and does not reflect readiness for a go-live decision\n● A Program Management Plan that lacks important details on the management, execution, or control of potential scenarios with the new system",null,"",{"$f":"F15*IF(Dashboard!$Q$22=\"Small\",(Parameters!I23),IF(Dashboard!$Q$22=\"Large\",(Parameters!J23)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J15=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I23),IF(Dashboard!$Q$22=\"Large\",(Parameters!J23)))*J15))","v":{"$error":"#VALUE!"}}]
["Feasibility Risk","Not assessed","Not assessed","Not assessed","N/A",{"$f":"IF(OR(B16=\"not assessed\",C16=\"not assessed\",D16=\"not assessed\"),\"N/A\",IF(E16=\"Low\",1,IF(E16=\"Medium\",3,IF(E16=\"High\",5,\"\"))))","v":"N/A"},{"$f":"F16*IF(Dashboard!$Q$22=\"Small\",(Parameters!I24),IF(Dashboard!$Q$22=\"Large\",(Parameters!J24)))","v":{"$error":"#VALUE!"}},null,"N/A",{"$f":"IF(OR(B16=\"not assessed\",C16=\"not assessed\",D16=\"not assessed\"),\"N/A\",IF(I16=\"Low\",1,IF(I16=\"Medium with Accepted Risk Strategy\",2,IF(I16=\"Medium\",3,IF(I16=\"High with Accepted Risk Strategy\",4,IF(I16=\"High\",5,\"\"))))))","v":"N/A"},{"$f":"(IF(J16=\"n/a\",\"N/A\",IF(Dashboard!$Q$22=\"Small\",(Parameters!I24),IF(Dashboard!$Q$22=\"Large\",(Parameters!J24)))*J16))","v":"N/A"}]
["Technical Complexity"," ● Tasks in IMS related to post implementation development and gap closure are on schedule"," ● Tasks in IMS related to post implementation development and gap closure are behind with no impact to project go-live"," ● Tasks in IMS related to post implementation development and gap closure are behind with impact to project go-live",null,"",{"$f":"F17*IF(Dashboard!$Q$22=\"Small\",(Parameters!I25),IF(Dashboard!$Q$22=\"Large\",(Parameters!J25)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J17=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I25),IF(Dashboard!$Q$22=\"Large\",(Parameters!J25)))*J17))","v":{"$error":"#VALUE!"}}]
["Requirements Management Risk","● Project Scope fully delivered\n● Requirements Traceability Matrix is updated and reflects a comprehensive understanding and resolution of any gaps that may exist, along with documentation of the requirements and testing that is required for a smooth migration\n","● Some project scope not deliver but all critical business processes deliverables are on schedule\n● Requirements Traceability Matrix is updated and reflects an understanding and resolution of any gaps that may exist, but testing that is required for a smooth migration is either still in progress, or not occurred with all potential users","● Project Scope is not delivered for critical business areas and off schedule for delivery\n● Requirements Traceability Matrix is either not fully updated or reflects some potential oversights in understanding and resolution of any gaps that may exist\n",null,"",{"$f":"F18*IF(Dashboard!$Q$22=\"Small\",(Parameters!I26),IF(Dashboard!$Q$22=\"Large\",(Parameters!J26)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J18=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I26),IF(Dashboard!$Q$22=\"Large\",(Parameters!J26)))*J18))","v":{"$error":"#VALUE!"}}]
["Organizational and Change Management ","● Agency Leadership is engaged with project\n● Agency Leadership supports project\n● Project is an established Agency Priority\n● Project Governance is established \n● Project has assigned sufficient resources to lead Workforce, Organization & Stakeholder work stream\n● Business process gaps are identified and broad agreement within Agency on required business process engineering\n● Change Management Approach is agreed upon, included in IMS and on schedule\n● All necessary training sessions have been planned and scheduled \n\n \n","● Change Management Approach as agreed upon in IMS is behind schedule but scheduled implementation date is not impacted\n● No implementation go-live criteria is at risk \n● A majority of necessary training sessions have been planned and scheduled, but some gaps exist ","● Implementation impacts a large organization with significant potential impacts to bargaining unit employee's\n● Change Management Approach as agreed upon in IMS is behind schedule on critical path activities with impact to scheduled implementation date\n●Significant gaps exist with training sessions that have been planned and scheduled which are required for a successful migration",null,"",{"$f":"F19*IF(Dashboard!$Q$22=\"Small\",(Parameters!I27),IF(Dashboard!$Q$22=\"Large\",(Parameters!J27)))","v":{"$error":"#VALUE!"}},"<<Enter Your agency's Justification or Mitigation Strategies here, and rate yourself to the left with the drop-down box>>",null,"",{"$f":"(IF(J19=\"n/a\",0,IF(Dashboard!$Q$22=\"Small\",(Parameters!I27),IF(Dashboard!$Q$22=\"Large\",(Parameters!J27)))*J19))","v":{"$error":"#VALUE!"}}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,"Low",null,null,null,"Low"]
[null,null,null,null,"Medium",null,null,null,"Medium with Accepted Risk Strategy"]
[null,null,null,null,"High",null,null,null,"Medium"]
[null,null,null,null,"N/A",null,null,null,"High with Accepted Risk Strategy"]
[null,null,null,null,null,null,null,null,"High"]
[null,null,null,null,null,null,null,null,"N/A"]

{"sheet":"Dashboard","index":7,"n_rows":38,"n_cols":21,"rows_kept":38,"cut":false,"hidden":false,"merged":[[7,0,7,14],[27,3,27,5],[26,3,26,5],[25,3,25,5],[9,3,10,6],[10,12,10,13],[24,3,24,5],[15,3,15,7],[37,3,37,5],[36,3,36,5],[35,3,35,5],[34,3,34,5],[33,3,33,5],[32,3,32,5],[31,3,31,5],[30,3,30,5],[28,3,28,5],[29,3,29,5]]}
[]
[]
[]
[]
[]
[]
[]
["Office of Shared Solutions and Performance Improvement\nMigration Risk Profile Assessment "]
[]
[null,null,null,"The Project Size and Project Scope(s) are populated from the ParametersTab to reflect the attributes of the project being assessed in this risk workbook. The Quickscan and Radar Chart below reflect only the OSSPI ratings provided in the assessment of the twelve risks to highlight areas in need of extra attention.\n",null,null,null,null,"Project Type Inputs:"]
[null,null,null,null,null,null,null,null,null,"Project Size",{"$f":"Parameters!D4","v":"Large"},null,"Project Scope\n(All that apply):  "]
[null,null,null,null,null,null,null,null,null,null,null,null,"Acquisitions"]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,"Grants"]
[null,null,null,null,null,null,null,null,null,null,null,null,"Human Resources (including Payroll)"]
[null,null,null,"Cumulative Risk Ratings"]
[null,null,null,null,"Phase 1","Phase 2","Phase 3 ","Phase 4 "]
[null,null,null,"Agency Self-assessment",{"$f":"'Phase 1'!B3","v":""},{"$f":"'Phase 2'!B3","v":""},{"$f":"'Phase 3'!B3","v":""},{"$f":"'Phase 4'!B3","v":""},null,null,null,null,null,null,null,"Small"]
[null,null,null,"Overall OSSPI Rating",{"$f":"'Phase 1'!B4","v":""},{"$f":"'Phase 2'!B4","v":""},{"$f":"'Phase 3'!B4","v":""},{"$f":"'Phase 4'!B4","v":""},null,null,null,null,null,null,null,"Large"]
[null,null,null,null,null,null,null,null,null,null,null,null,"Rating ","Range"]
[null,null,null,null,null,null,null,null,null,null,null,null,"Low",".1 to 2",null,null,{"$f":"\"\"","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,"Medium","2 to 3.5",null,null,{"$f":"K11","v":"Large"}]
[null,null,null,null,null,null,null,null,null,null,null,null,"High","3.5 to 5"]
[null,null,null,null,null,null,null,null,null,null,null,null,"N/A","Not Assessed"]
[null,null,null,"Rating by Risk Category",null,null,"Select Phase below to update ratings and the adjacent Radar Chart"]
[null,null,null,"Quick Scan",null,null,"Phase 1"]
[null,null,null,"Data/Information Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K8,IF($G$26=\"Phase 2\",'Phase 2'!K8,IF($G$26=\"Phase 3\",'Phase 3'!K8,IF($G$26=\"Phase 4\",'Phase 4'!K8, )))))","v":{"$error":"#VALUE!"}}]
[null,null,null,"Cyber Information Security Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K9,IF($G$26=\"Phase 2\",'Phase 2'!K9,IF($G$26=\"Phase 3\",'Phase 3'!K9,IF($G$26=\"Phase 4\",'Phase 4'!K9, IF(G28=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}},null,null,null,null,null,null,null,null,null,"Phase 0"]
[null,null,null,"Financial Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K10,IF($G$26=\"Phase 2\",'Phase 2'!K10,IF($G$26=\"Phase 3\",'Phase 3'!K10,IF($G$26=\"Phase 4\",'Phase 4'!K10, IF(G29=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}},null,null,null,null,null,null,null,null,null,"Phase 1"]
[null,null,null,"Acquisition and Procurement Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K11,IF($G$26=\"Phase 2\",'Phase 2'!K11,IF($G$26=\"Phase 3\",'Phase 3'!K11,IF($G$26=\"Phase 4\",'Phase 4'!K11, IF(G30=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}},null,null,null,null,null,null,null,null,null,"Phase 2",null,null,null,"Low "]
[null,null,null,"Operational Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K12,IF($G$26=\"Phase 2\",'Phase 2'!K12,IF($G$26=\"Phase 3\",'Phase 3'!K12,IF($G$26=\"Phase 4\",'Phase 4'!K12, IF(G31=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}},null,null,null,null,null,null,null,null,null,"Phase 3",null,null,null,"Medium"]
[null,null,null,"Reputational Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K13,IF($G$26=\"Phase 2\",'Phase 2'!K13,IF($G$26=\"Phase 3\",'Phase 3'!K13,IF($G$26=\"Phase 4\",'Phase 4'!K13, IF(G32=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}},null,null,null,null,null,null,null,null,null,"Phase 4",null,null,null,"High"]
[null,null,null,"Schedule Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K14,IF($G$26=\"Phase 2\",'Phase 2'!K14,IF($G$26=\"Phase 3\",'Phase 3'!K14,IF($G$26=\"Phase 4\",'Phase 4'!K14, IF(G33=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}}]
[null,null,null,"Management Support Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K15,IF($G$26=\"Phase 2\",'Phase 2'!K15,IF($G$26=\"Phase 3\",'Phase 3'!K15,IF($G$26=\"Phase 4\",'Phase 4'!K15, IF(G34=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}}]
[null,null,null,"Feasibility Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K16,IF($G$26=\"Phase 2\",'Phase 2'!K16,IF($G$26=\"Phase 3\",'Phase 3'!K16,IF($G$26=\"Phase 4\",'Phase 4'!K16, IF(G35=0,\"N/A\",\"\"))))))","v":{"$error":"#VALUE!"}}]
[null,null,null,"Technical Complexity",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K17,IF($G$26=\"Phase 2\",'Phase 2'!K17,IF($G$26=\"Phase 3\",'Phase 3'!K17,IF($G$26=\"Phase 4\",'Phase 4'!K17, IF(G36=0,\"N/A\",\"\"))))))","v":"N/A"},null,null,null,null,null,null,null,null,null,"N/A"]
[null,null,null,"Requirements Management Risk",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K18,IF($G$26=\"Phase 2\",'Phase 2'!K18,IF($G$26=\"Phase 3\",'Phase 3'!K18,IF($G$26=\"Phase 4\",'Phase 4'!K18, IF(G37=0,\"N/A\",\"\"))))))","v":0}]
[null,null,null,"Organizational and Change Management ",null,null,{"$f":"IF($G$26=\"Phase 0\",#REF!,IF($G$26=\"Phase 1\",'Phase 1'!K19,IF($G$26=\"Phase 2\",'Phase 2'!K19,IF($G$26=\"Phase 3\",'Phase 3'!K19,IF($G$26=\"Phase 4\",'Phase 4'!K19, IF(G38=0,\"N/A\",\"\"))))))","v":0}]

{"sheet":"Parameters","index":8,"n_rows":43,"n_cols":15,"rows_kept":43,"cut":false,"hidden":false,"merged":[[29,1,32,5],[14,8,14,9],[14,2,14,3],[14,4,14,5],[14,6,14,7]]}
[null,"Risk Category Weighting Table - For OSSPI Input Only"]
[null,"Directions: Input weighting value by project size (small, large) as desired. Weighting values will automatically update throughout the workbook. "]
[]
[null,"Project Scope\n(select all that apply):  ","Project Size","Large"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Small","Acquisitions"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Large","Financial Management"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Grants"]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Human Resources"]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Travel"]
[null,null,"Small","Large","Small","Large","Small","Large","Small","Large"]
[null,"Risk Category","Phase 1",null,"Phase 2",null,"Phase 3",null,"Phase 4"]
[null,"Data/Information Risk",1,1,1,1,1,1,1,1]
[null,"Cyber Information Security Risk",1,1,1,1,1,1,1,1]
[null,"Financial Risk",1,1,1,1,1,1,1,1]
[null,"Acquisition and Procurement Risk",1,0.5,1,1,1,1,1,1]
[null,"Operational Risk",1,1,1,0.5,1,1,1,1]
[null,"Reputational Risk",1,1,1,0.5,1,1,1,1]
[null,"Schedule Risk",1,1,1,1,1,0.5,1,1]
[null,"Management Support Risk",1,1,1,1,1,0.5,1,1]
[null,"Feasibility Risk",1,1,1,1,1,1,1,0.5]
[null,"Technical Complexity",1,1,1,1,1,1,1,0.5]
[null,"Requirements Management Risk",1,1,1,1,1,1,1,0.5]
[null,"Organizational and Change Management ",1,1,1,1,1,1,1,0.5]
[]
[]
[null,"USSM Weighting Description for <Insert Migrating Agency Name Here>:"]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Acquisitions"]
[null,"Financial Management"]
[null,"Grants"]
[null,"Human Resources"]
[null,"Travel"]

{"sheet":"Approach","index":9,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[]}
[null,"OSSPI Risk Assessment Approach"]
[null,"OSSPI’s risk assessment objective is to provide for a comprehensive, independent, objective review of project risk at each M3 phase. The risk analysis serves as a standardized risk assessment framework for listing key risk criteria to help agencies better assess and identify risk areas in Shared Services migrations and IT modernization efforts. The criteria document important risk triggers that can help agencies recognize risk factors and properly confront and deal with risk. "]
[null,"I. ERM Playbook\nReviewed the Chief Financial Officers Council (CFOC) and the Performance Improvement Council (PIC) Playbook: Enterprise Risk Management for the U.S. Federal Government. The goal of the ERM playbook is to promote a common understanding of ERM practices in agencies to support effective and efficient mission delivery and decision-making processes. The ERM playbook provides a list of common risk categories and their definitions in Appendix A. The list is a helpful starting point for ensuring that common risk areas are represented in the risk analysis, and serves as a commonality in both risk language and high-level categories for assessing risk between OMB and OSSPI. This is not intended to be a complete list, as the ERM playbook states. "]
[null,"II. Program-Specific Risk Criteria\nAdded significant risk criteria not represented in ERM Playbook through:\n• OMB Risk Areas in other risk documents\n• ERM Playbook’s Key Questions to Help Develop a Risk Profile"]
[null,"III. OSSPI M3 Playbook Requirements/Documentation\nAssessed risk criteria that are embedded in M3 Playbook, integrated language used in the M3 Playbook, and identified where information regarding applicable risk criteria can be found in required M3 documentation. The objective is to provide continuity between the M3 Phases and risk criteria, as well as to help build trust with providers and customers by demonstrating that OSSPI utilizes the required documentation in the M3 process. "]
[null,"IV. Government Accountability Office (GAO) Reports and Recommendations\nReviewed the following GAO reports to identify common trends found by GAO that are frequent triggers for risk in IT projects/management: \n● Agencies Need to Fully Consider Risks When Rating Their Major Investments. Rep. no. GAO-16-494. Washington: GAO, 2016. Print & Web. \n● A Framework for Assessing and Improving Process Maturity. Rep. no. GAO-04-394G. Washington: GAO, 2004. Print & Web. \n● Opportunities Exist to Improve Transparency and Oversight of Investment Risk at Select Agencies. Rep. no. GAO-13-98. Washington: GAO, 2012. Print & Web."]