DEPARTMENT OF VETERANS AFFAIRS

DEPARTMENT OF VETERANS AFFAIRS Veterans Health Administration OI Home Telehealth Program Configuration Management (CM) Plan Version 2.0 Home Telehealth Configuration Management Plan HOME TELEHEALTH CONFIGURATION MANAGEMENT PLAN REVISION AND HISTORY PAGE Document Version # Revision Date Description of Change Section # / Paragraph # Page # 1.0 Date of the First Published Document This is the initial document that was developed N/A N/A 1.5 8/2005 ATO revision N/A N/A 2.0 6/2006 Grammar Corrections N/A N/A June 2006 i Version 2.0 Home Telehealth Configuration Management Plan HOME TELEHEALTH CONFIGURATION MANAGEMENT PLAN TABLE OF CONTENTS SECTION SCOPE .1-1 1.1 System Overview .1-1 1.2 Document Overview 1-2 1.2.1 Home Telehealth System CM Requirements and TOE 1-2 1.3 Document Organization .1-2 SECTION REFERENCES .2-1 2.1 Introduction 2-1 SECTION HOME TELEHEALTH CM ORGANIZATION 3-1 3.1 Introduction 3-1 3.1.1 Configuration and Change Board Overview 3-1 3.1.2 VHA OI Project Manager for Home Telehealth 3-4 3.1.3 Home Telehealth Vendor/System Team 3-5 3.1.4 Home Telehealth Data Center Representatives 3-5 SECTION CM OVERVIEW 4-1 4.1 Introduction 4-1 4.2 CM Principles Overview 4-1 4.3 CM Defined 4-1 4.4 Configuration Control Defined 4-2 4.5 CM Methodology .4-2 4.6 CM Goals 4-2 SECTION HOME TELEHEALTH SYSTEM CM PLANNING ACTIVITIES 5-1 5.1 CM Planning Activities 5-1 5.1.1 CM Process and Primary Activities 5-1 5.1.2 Develop the CM Plan 5-2 5.1.3 Establish and Maintain CM Libraries 5-2 5.1.4 Perform Configuration Identification Activities 5-2 5.1.5 Perform Configuration Control Activities 5-3 5.1.6 Perform Configuration Status Accounting (CSA) Activities 5-3 SECTION CM PHASING 6-1 6.1 Introduction 6-1 6.2 Project Phases .6-1 6.2.1 Initiation Phase .6-2 June 2006 ii Version 2.0 Home Telehealth Configuration Management Plan 6.2.2 6.2.3 6.2.4 6.2.5 Development/Acquisition Phase 6-2 Implementation Phase 6-3 Operation/Maintenance Phase 6-3 Disposal Phase 6-3 SECTION HOME TELEHEALTH SYSTEM CM DATA MANAGEMENT 7-1 7.1 Introduction 7-1 7.2 Data Management Defined 7-1 7.3 Data Management Activities 7-1 7.3.1 CM Lead Data Management Responsibilities 7-2 7.3.2 Data Distribution Access 7-2 SECTION HOME TELEHEALTH SYSTEM CONFIGURATION IDENTIFICATION 81 8.1 Introduction 8-1 8.2 Configuration Identification Defined 8-1 8.3 Configuration Identification Activities .8-1 8.3.1 Select Controlled Items 8-2 8.3.2 Software Suite Release Numbering 8-4 8.3.3 Document Identification .8-5 8.3.4 SR Preparation and Tracking 8-6 8.4 Establishing Baselines 8-6 8.5 Product Baselines .8-6 SECTION HOME TELEHEALTH SYSTEM SR PROCESS 9-1 9.1 Introduction 9-1 9.2 SR Process Overview 9-1 9.2.1 SIRs 9-1 9.2.2 SCRs .9-1 9.2.3 Preparation and Tracking of Project SRs 9-3 9.2.4 Home Telehealth System Priority Assignment .9-4 9.2.5 SR Status Report 9-5 9.3 Home Telehealth System SR Responsibilities 9-6 SECTION 10 HOME TELEHEALTH SYSTEM PRODUCT LIBRARIES .10-1 10.1 Introduction 10-1 10.2 Product Library 10-1 10.2.1 Electronic Project Library 10-1 June 2006 iii Version 2.0 Home Telehealth Configuration Management Plan APPENDICES A — Abbreviations, Acronyms, and Terms .A-1 C — Home Telehealth System CCB Charter C-1 D — Instructions for Completing the Home Telehealth System Request (SR) Form D-1 E — Reproducible Home Telehealth System Request (SR) Form E-1 F — Home Telehealth System CM Artifacts F-1 EXHIBITS Exhibit 3-1: Exhibit 6-1: Exhibit 6-2: Exhibit 8-1: Exhibit 8-2: Exhibit 8-3: Exhibit 9-1: Exhibit 9-2: Exhibit 9-3: Exhibit 9-4: June 2006 Home Telehealth System CM Organizational Structure .3-4 Five Basic Life Cycle Phases 6-1 Life Cycle Phase Relationship to VA C&A Objectives 6-2 Document Identifier 8-3 Document Identification Number Breakdown 8-5 Documentation Labeling .8-5 Change Control and Variance Process 9-2 SCR Evaluation Form Options 9-3 SR Identifier Control Numbers .9-4 Priority Chart 9-5 iv Version 2.0 Home Telehealth Configuration Management Plan SECTION SCOPE 1.1 System Overview The Home Telehealth systems will be installed and maintained in Department of Veterans Affairs (VA) Information Technology (IT) facilities or IT operations centers that are not open to the general public Telehealth devices will be provisioned by the Home Telehealth Program and distributed to individual care receivers for use in their homes Such devices may be located at private residences and non-VA facilities The Home Telehealth Program support systems will serve as the sole interface between the VA Wide Area Network (WAN) and external (non-VA) public access methods used to transmit data from the patient to the care coordinator The system will be comprised of commercial off the shelf (COTS) components (e.g., hardware and software) specifically designed and configured by the vendor and the VA support staff to meet the VA’s Telehealth functional requirements and VA security requirements VA hosting sites will provide the network infrastructure including, but not limited to: network/DMZ firewalls; intrusion detection systems; VA authentication systems; content filtering, anti-virus and malicious code protections; and other supporting network devices such as routers and switches It is the responsibility of the VA hosting sites to provide and maintain the requisite utility services and environmental systems (e.g., electrical power and air conditioning) The Office of Information (OI) Project Manager for Home Telehealth will coordinate with the COTS vendors to specify and provide to the VA hosting site the details of such support during the site implementation planning phase The OI Project Manager for Home Telehealth will coordinate with the hosting sites to provide training for IT support personnel upon initial installation of new Telehealth server systems Thereafter, the hosting site is responsible to provide the requisite level of refresher training to maintain the proficiency of the IT /support staff Likewise, hosting sites are responsible to ensure new IT support personnel, responsible for the operation and maintenance of Telehealth Servers, have the requisite level of training and expertise Hosting sites are responsible for the physical and personnel security of the IT facility They will ensure that only specifically authorized personnel are allowed physical access to Telehealth servers and support equipment The OI Project Manager for Home Telehealth will provide the details of the specific physical and personnel security requirements requisite to the certification and accreditation of the Telehealth system at each site The OI Project Manager for Home Telehealth will coordinate with the Home Telehealth business organization and IT managers of each hosting site to develop Continuity of Operations (COOP) and Disaster Recovery (DR) Plans for the Telehealth servers, for incorporation into the overall hosting site plans November 2003 Draft 1.0 Home Telehealth Configuration Management Plan 1.2 Document Overview Secure development, deployment, operation, and maintenance of the Home Telehealth System requires adherence to Configuration Management (CM) principles CM ensures that system components—whether hardware or software—are identified and controlled during the day-today operations, provides a standard set of techniques for controlling changes to identified baseline security configurations, and fosters consistency, compatibility, integrity, and security of the Home Telehealth System The CM processes, procedures, and activities described in this document are designed to be repeatable, which means they are established and applied in a controlled and consistent way NOTE: The Home Telehealth System incorporates COTS software and hardware products Henceforth, CM, as defined within the scope of this project and document, is a process that provides the essence to document and control management of Home Telehealth Systems hardware and software changes at specific VA sites where the Home Telehealth Systems is hosted 1.2.1 Home Telehealth System CM Requirements and TOE VA “Guidance for Use of Protection Profiles in the VA Certification and Accreditation”, dated 29 March 2002, VA “Protection Profiles for Sensitive Level Information Systems”, dated 13 November 2001, and VA “Protection Profiles for Sensitive Level Information Systems”, dated 13 November 2001, were used to identity Home Telehealth System’s CM requirements and the Target of Evaluation (TOE) To view the Home Telehealth System’s CM requirements and TOE, refer to Appendix B, Home Telehealth System CM Requirements and TOE 1.3 Document Organization This manual is organized as follows:  Section 1, System Overview of the Home Telehealth System  Section 2, References, lists the documents, guides, and manuals referred to or used to produce this document  Section 3, Home Telehealth System CM Organization, describes the Home Telehealth System CM organization  Section 4, CM Overview, defines CM and describes CM methodology, goals, and the CM and Requirements Management (RM) relationship  Section 5, Home Telehealth System CM Planning Activities, describes the Home Telehealth System CM planning activities  Section 6, CM Phasing, describes the CM project phases November 2003 Draft 1.0 Home Telehealth Configuration Management Plan  Section 7, Home Telehealth System CM Data Management, describes the methods Home Telehealth System uses to meet the project’s CM data requirements Also, it describes the data handling, processing, storage, integrity, transfer, security, and maintenance of CM technical data  Section 8, Home Telehealth System Configuration Identification, describes the methods Home Telehealth System uses to meet the CM Configuration Item (CI) requirements Also, it describes the CI activities, establishing baselines, and Home Telehealth System baselines  Section 9, Home Telehealth System Request (SR) Process, describes the approach used by Home Telehealth System to conduct CM and SR control activities  Section 10, Home Telehealth System Product Libraries, describes the Home Telehealth System product libraries  Appendix A, Abbreviations, Acronyms, and Terms, identifies all abbreviations, acronyms, and terms used in this document  Appendix C, Home Telehealth System CCB Charter, contains a copy of the Home Telehealth System Configuration and Change Board (CCB) charter The charter defines the Home Telehealth System CCB, its mission, activities, membership, roles and responsibilities, activities, and change procedures  Appendix D, Instructions for Completing the Home Telehealth System SR Form, contains the instructions for reporting Home Telehealth System problems, and recommending a change using the Home Telehealth System SR Form  Appendix E, Reproducible Home Telehealth System SR Form, contains the reproducible Home Telehealth System form that is used to report Home Telehealth System problems or recommend a change November 2003 Draft 1.0 Home Telehealth Configuration Management Plan This page intentionally left blank November 2003 Draft 1.0 Home Telehealth Configuration Management Plan SECTION REFERENCES 2.1 Introduction The Home Telehealth System Configuration Management Plan was developed using the following reference documents:  CMU/SEI-93-TR-24, CMU/SEI-93-TR-25, ESC-TR-93-117, Software Engineering Institute (SEI), Carnegie Mellon University, “Capability Maturity Model for Software”, Version 1.1, February 1993  Department of Veterans Affairs, VA Directive and Handbook 6214, “VA Information Technology Security Certification and Accreditation Program (ITSCAP)”, December 2001  Department of Veterans Affairs “Guidance for Use of Protection Profiles in the VA Certification and Accreditation”, 29 March 2002  Department of Veterans Affairs “Protection Profiles for Sensitive Level Information Systems”, 13 November 2001  Department of Veterans Affairs “Protection Profiles for Sensitive Level Information Systems”, 13 November 2001  National Institute of Standards and Technology (NIST) Special Publication 800-12, “An Introduction to Computer Security – The NIST Handbook”, October 1995  NIST Special Publication 800-18, “Guide for Developing Security Plans for Information Technology Systems”, December 1998  NIST Special Publication 800-34, “Contingency Planning Guide for Information Technology Systems”, June 2002 November 2003 Draft 1.0 Home Telehealth Configuration Control Board Charter  Identify Functional Changes—In some cases, the CCB will identify functional changes and initiate the SCR process during the meeting These SCRs occur due to the impact of a presented SCR  Prioritize Functional Changes—Following the vote of the Home Telehealth System CCB membership to accept an SCR, the CCB establishes prioritization in accordance with the Priority Chart contained in the Home Telehealth System Configuration Management Plan  Subject Matter Expert—If any CCB member requests that a subject matter expert attend a CCB meeting for a particular SCR, the CML will invite a subject matter expert to the CCB meeting and place that SCR first on the agenda The subject matter expert attends only the portion of the meeting requiring his or her input  Validate Functional Changes—At the next Home Telehealth CCB meeting, the proposed SCR is presented for a vote of acceptance All voting members are required to vote In the event of a tie, the OI Project Manager for Home Telehealth exercises their voting authority to cast the deciding vote  Manage System Requirement Changes—It is the responsibility of the CML to manage system changes for each Home Telehealth System data center, including the following: Maintaining the official log of SCRs submitted to the Home Telehealth System CCB and the status of the SCRs Coordinating SCRs with the Home Telehealth CCB members Coordinating CCB meetings Forwarding approved SCRs to the Home Telehealth System Team representative(s) Reviewing impact analysis reports provided by the Home Telehealth System Team representative(s) for proposed SCRs and informing the OI Project Manager for Home Telehealth At the end of one year, those SCRs are reevaluated for necessity and reprioritization The CML works with Home Telehealth System Team Vendor Representative(s), the ISO, and Care Coordinator Program Manager to establish change proposed cost and estimated completion time frame Change Procedures In order to recommend approval or disapproval of proposed changes to established baselines, the Home Telehealth System CCB must: Verify the need for the change Determine the type of change to be implemented Evaluate the resulting cost and schedule impact Evaluate the impact upon system interfaces Assess the impact upon quality and reliability Page of Pages Home Telehealth Configuration Control Board Charter The Home Telehealth System CCB evaluation of potential impacts from implementing proposed software-related or hardware-related change requests includes consideration of: Staff resources available versus the estimated workload of the proposed action Estimated additional computing resources required for the design, test, debug, and operation of the modified system Time and cost of updating the associated documentation A vote of the full Home Telehealth System CCB membership is required to approve SCR changes Meeting The Home Telehealth System CCB meets on a monthly basis, or dates otherwise determined by the Chairman Updating the Home Telehealth System CCB Charter Requests for changes to the Home Telehealth System CCB charter are submitted to the CML for scheduling A vote of the full Home Telehealth System CCB membership is required to approve changes The CML provides a copy of the signed charter to members of the Home Telehealth System CCB _ _ OI Project Manager for Home Telehealth Date Signed _ Printed Name NOTE: This original charter is maintained in the Home Telehealth System Configuration Management Plan Page of Pages Home Telehealth Configuration Control Board Charter This page intentionally left blank Page of Pages Home Telehealth Configuration Management Plan APPENDIX D INSTRUCTIONS FOR COMPLETING THE HOME TELEHEALTH SYSTEM REQUEST (SR) FORM D.1 Introduction This section contains the instructions for reporting Home Telehealth System problems or recommending a change using the Home Telehealth System SR Form To obtain a copy of the form, refer to Appendix E, Reproducible Home Telehealth System Request (SR) Form D.2 Home Telehealth System SR Completion Instructions To report a problem or recommend a change, Home Telehealth System Care Coordinators (users) and/or vendor representatives must submit a completed Home Telehealth System SR Form through the proper channels The following table provides instructions for preparation of a Home Telehealth System SR Form The block numbers and headings in the left-hand column (below) are those used to complete the form November 2003 D-1 Draft 1.0 Home Telehealth Configuration Management Plan Item Item # Description Instructions for Completing the Home Telehealth System SR Form NA (Check One) Check the appropriate block in the “(Check One)” box in the upper right-hand corner [System Incident Report (SIR) or System Change Request (SCR)] NA Date Enter date the form was created To Enter mailing address as follows: Primary Home Telehealth System Project address From Enter the mailing address of the originator Include the name of the individual preparing the form, if other than the point of contact in Block 3 Point Of Contact Enter the name, area code, and commercial telephone number of the individual who should be contacted to explain the proposed problem or change Site Priority Site Priority: The originator assigns a priority to each change request; however, the CCB may raise or lower the priority if deemed advisable The priority levels are described below: Site Priority Contd (Continued) Priority 1—Prevents the accomplishment of an operational or mission essential capability and could result in an actual work stoppage for which no work-around exists OR Jeopardizes safety, security, or other requirement designated ‘critical’ OR Will improve accreditation Priority 2—Adversely affects the accomplishment of an operational or mission essential capability and no work-around is known Priority 3—Adversely affects the accomplishment of an operational or mission essential capability but a work-around solution is known OR Will bring the system into compliance with a change directed by policy (Executive, Legislative, Judicial, or other agency) Priority 4—Will reduce or eliminate problems of user inconvenience or annoyance, but does not affect a required operational or mission essential capability OR Result is user/operator inconvenience or annoyance for support personnel, but does not prevent the accomplishment of those responsibilities Priority 5—Will provide minimal enhancement (for example, nice to have) OR Spelling errors OR Other minor problems Component’s Name November 2003 Enter the component’s name EXAMPLE: “AAC Firewall” D-2 Draft 1.0 Home Telehealth Configuration Management Plan Item Item # Description Instructions for Completing the Home Telehealth System SR Form Component’s Enter the software version installed at the time the change was Software Version proposed EXAMPLE: “ORACLE Runtime 7.0.0.1.0” Problem or Enter date when problem occurred or suggestion was made Date Suggestion Date should be all numeric (YYMMDD) Capability Identification Title Problem Change 10 Description of Problem / Change 11 Effect on User or Describe adverse effects or improved characteristics that the proposed Data Center change may have on the field user or data center Include the effects if the proposed change is not made 13 Recommended Solution / Justification Enter the recommended solution and justification to support the proposed change or action taken to resolve the problem 14 Date This block must contain the date signed Use format: YYMMDD 15 Name and Title of Submitting Individual Name and title of the individual submitting the problem or change form 16 Signature Signature of the individual with authority to approve 17 Completed by CCB Members [System Change Request (SCR) Only] Block 17 is completed by the individual CCB members to provide comments about a SCR The block will record comments, date signed, name and title, and signature of the individual reviewing the SCR Enter the affected system capability EXAMPLE: “Registration” of Enter a short descriptive title of the problem or proposed change / EXAMPLE: “Cannot access the patient data” Describe the problem or proposed change in sufficient detail to permit ready identification and evaluation Include copies of output, if applicable Include a listing of all attachments and referenced documents Block 18 is completed Configuration Management Lead(CML) For SCR: After a comments are received from the individual CCB members and a decision (approve or disapprove) has been made by the Configuration Change Board (CCB) For SIR: After the OI Project Manager for Home Telehealth decides on the SIR November 2003 D-3 Draft 1.0 Home Telehealth Configuration Management Plan Item Item # Description Instructions for Completing the Home Telehealth System SR Form 21-22 Completed by the Site or Vendor Either the site or Vendor The block will record comments, date signed, name and title, and signature of the individual reviewing the SIR 23-33 Completed by Site or Vendor The site and/or Vendor complete Blocks 25 thru 35 (for SCRs only) as shown below: 23 Class of SCR Changes in baseline VA Data Center are Class I Changes by the vendor only are Class II Changes that impact multiple vendors and the data center are Class III 24 Justification Code This code is required for all changes Use the following codes: A Record Only B Interface/Viewer Application C Compatibility D Deficiency O Operational or Support P Production Stoppage R Cost Reduction S Security U Upgrade/vendors release V Value Engineering 25 SCR Number Assignment of SCR number 26 Estimated Cost / Savings Enter a dollar estimate of total costs, either increased or decreased, which will result if the change is approved 27 Other Systems Affected Enter “NONE”, or the systems’ names and acronyms to indicate whether there is an interface with other systems If an interface is involved, supply full details in an attachment to the SR form 28 Change Identification Check the appropriate block to indicate the following: FUNCTIONAL —Functional changes affect the functional design, logic, or operation of the system and require changes to functional baseline documentation or to the user manual November 2003 D-4 Draft 1.0 Home Telehealth Configuration Management Plan Item Item # Description Instructions for Completing the Home Telehealth System SR Form MAJOR or MINOR—Major changes are those which impact the VA environment MAINTENANCE—Maintenance changes are associated with the correction of faults in the system MODIFICATION—Modification changes are associated with the revision or alteration of an existing application to provide a new or improved capability 29 Projected Implementation Enter the required/recommended implementation date or change package into which the change will be incorporated 30 Approval Authority Check the appropriate blocks to indicate the following: Check the box for the approval authority for functional changes If it is a site, enter the location (name) of the site Indicate whether APPROVED or DISAPPROVED 31 Date Date signed 32 Name and Title Name and title of approval/disapproval authority 33 Signature Signature of the individual approval/disapproval decision November 2003 D-5 authorized to make the Draft 1.0 Home Telehealth Configuration Management Plan This page is intentionally left blank November 2003 D-6 Draft 1.0 Home Telehealth Configuration Management Plan APPENDIX E REPRODUCIBLE HOME TELEHEALTH SYSTEM REQUEST (SR) FORM E.1 Introduction This section contains the Home Telehealth System Request (SR) Form that is used to report system problems or recommend a change To obtain Home Telehealth System specific instructions for completing the form, refer to Appendix D, Instructions for Completing the Home Telehealth System Request (SR) Form November 2003 E-1 Draft 1.0 Home Telehealth Configuration Management Plan This page intentionally left blank November 2003 E-2 Draft 1.0 Home Telehealth System Request (SR) Form Home Telehealth System SR Form TO: (Check One)  System Incident Report (SIR)  System Change Request (SCR) FROM: Point Of Contact (Name and Telephone Number): Site Priority (Circle One) Priority Priority Priority Component’s Name Priority Priority Component’s SW Version Problem or Suggestion Date (YYMMDD) Capability Identification Title Of Problem/Change 10 DESCRIPTION OF PROBLEM/CHANGE (If additional space is needed, use item 15 / Remarks) 11 EFFECT ON USER or DATA CENTER (If additional space is needed, use Item 15 / Remarks) 13 Recommended Solution/Justification (If additional space is needed, use separate sheet of paper) 14 Date (YYMMDD) 15 Name and Title of Submitting Individual Home Telehealth System SR Form, Nov 2003 Page of Pages 16 Signature COMPLETED BY CCB MEMBERS [System Change Request (SCR) Only] 17 CCB Member Review (Check One and Provide Comment, if Applicable)  Concur  Concur, with recommended modifications Date (YYMMDD)  Non-concur Name and Title  Hold Signature COMPLETED BY CML FOR DOCUMENTING SIR AND SCR ACTION 18 Decision (Check One and Include Comments with Provider’s Name)  Approve  Disapprove Date (YYMMDD) Name and Title Signature COMPLETED BY THE DATA CENTER OR VENDOR OPERATIONAL CENTER [System Incident Reports (SIRs) Only] 19 Action Taken (Check One)  Canceled By Originator  Emergency Problem Report Formalized  Canceled for Insufficient Documentation  Identified As Urgent or Routine  Canceled For Insufficient Identification  Resolved by Site Personnel  Duplicate Of Existing Problem Report: No. _  Resolved by SOC Personnel 20 Date (YYMMDD) 21 Name and Title 22 Signature COMPLETED BY THE DATA CENTER OR VENDOR OPERATIONAL CENTER [System Change Requests (SCRs) Only] 23 CLASS OF SCR (Check One)  I  II 24 JUSTIFICATION CODE 25 SCR NUMBER  III 26 ESTIMATED COSTS/SAVINGS 27 OTHER SYSTEM AFFECTED 28 CHANGE IDENTIFICATION (Check One in Each Column)  FUNCTIONAL/ALLOCATED  MAJOR  MAINTENANCE  TECHNICAL/PRODUCT  MINOR  MODIFICATION November 2003 Draft 1.0 29 PROJECTED IMPLEMENTATION 30 APPROVAL AUTHORITY (Check Agency and Action Taken)  Site (Location: _) 31 Date (YYMMDD)  VHA 32 Name and Title  CC  Approved  Disapproved 33 Signature Home Telehealth System SR Form, Nov 2003 November 2003 Draft 1.0 ... 2001  Department of Veterans Affairs “Guidance for Use of Protection Profiles in the VA Certification and Accreditation”, 29 March 2002  Department of Veterans Affairs “Protection Profiles... Processes of the Capability Maturity Model, Version 1.1, Appendix B, Glossary of Terms.) NIST National Institute of Standards and Technology OCIS Office of Cyber and Information Security OMB Office of. .. Systems”, 13 November 2001  Department of Veterans Affairs “Protection Profiles for Sensitive Level Information Systems”, 13 November 2001  National Institute of Standards and Technology (NIST)