EA3 and Common Approach artifacts

EA3 version 2.0 is fully compliant with the Common Approach to Federal Enterprise Architecture and the FEAF-II artifacts.

 EA3 2.0 Common Approach
S-1 Concept Overview Concept Overview
S-2 Strategic Plan Strategic Plan
S-3 Concept of Operations Scenarios Concept of Operations Scenarios
S-4 SWOT Analysis SWOT Analysis
S-5 Performance Measures Scorecard Performance Measures Scorecard
B-1 Business Process Diagram (core) Business Process Diagram (core)
B-1.1 Business Process/Product Matrix
B-2 Business Operating Plan Business Operating Plan
B-2.1 Node Connectivity Diagram
B-3 Business Service Catalog Business Service Catalog
B-4 Organization Chart Organization Chart
B-5 Use Case Narrative and Diagram Use Case Narrative and Diagram
B-6 Business Case / Alternatives Analysis Business Case / Alternatives Analysis
D-1 Logical Data Model (core) Logical Data Model (core)
D-2 Knowledge Management Plan* Knowledge Management Plan*
D-3 Data Quality Plan Data Quality Plan
D-1.1 Information Exchange Matrix
D-4 Data Flow Diagram Data Flow Diagram
D-5 Physical Data Model Physical Data Model
D-6 CRUD Matrix CRUD Matrix
D-7 State-Transition Diagram State-Transition Diagram
D-8 Event Sequence Diagram Event Sequence Diagram
D-9 Data Dictionary Data Dictionary
D-10 Object Library Object Library
A-1 Application Interface Diagram (core) Application Interface Diagram (core)
A-2 Application Communication Diagram Application Communication Diagram
A-2.1 System Data Flow Diagram
A-2.2 System/Operations Matrix
A-3 Application Interface Matrix Application Interface Matrix
A-4 Application Data Exchange Matrix Application Data Exchange Matrix
A-5 Application Service Matrix Application Service Matrix
A-6 Application Performance Matrix Application Performance Matrix
A-7 System/Application Evolution Diagram System/Application Evolution Diagram
A-8 Enterprise Service Bus Diagram Enterprise Service Bus Diagram
A-9 Application Maintenance Procedure Application Maintenance Procedure
A-10 Application Inventory Application Inventory
A-11 Software License Inventory Software License Inventory
I-1 Network Diagram (core) Network Diagram (core)
I-2 Hosting Concept of Operations Hosting Concept of Operations
I-3 Technical Standards Profile Technical Standards Profile
I-4 Technology Forecast Technology Forecast
I-5 Cable Plant Diagram Cable Plant Diagram
I-6 Wireless Connectivity Diagram Wireless Connectivity Diagram
I-7 Rack Elevation Diagrams (front and back) Rack Elevation Diagrams (front and back)
I-8 Data Center/Server Room Diagram Data Center/Server Room Diagram
I-9 Wiring Closet Diagram Wiring Closet Diagram
I-10 Point of Presence Diagram Point of Presence Diagram
I-11 Asset Inventory Asset Inventory
I-12 Facility Blueprints Facility Blueprints
SP-1 Security Controls Catalog (core) Security Controls Catalog (core)
SP-2 Security and Privacy Plan Security and Privacy Plan
SP-3 Certification & Accreditation Documentation Certification & Accreditation Documentation
SP-4 Continuous Monitoring Procedures Continuous Monitoring Procedures
SP-5 Disaster Recovery Plan Disaster Recovery Plan
SP-6 Continuity of Operations Plan Continuity of Operations Plan

Continuity of Operations Plan

ea3-secEA3 artifact SP-6: Continuity of Operations Plan

The Continuity of Operations Plan (COOP) uses a standard format for describing where all or part of the enterprise will relocate to if the normal operating location cannot be occupied for an extended period (more than a few days) due to a natural or man-made event.

The activation of the COOP relocation site may have to be accomplished in the midst of a local or national disaster that makes clarity, brevity, completeness, and flexibility (backups) key to success. The following are some of the recommended elements in a COOP document:

1. COOP Activation. Conditions for Activating the COOP.

2. COOP Roles and Responsibilities. A matrix of the roles and responsibilities (by position) of all personnel throughout the enterprise who are involved in activating the COOP. Alternates are provided for each position.

3. COOP Checklist. A step-by-step checklist of actions for each person participating in the COOP.

4. COOP Relocation Site Map and Directions. How to get to the COOP site from various probable routes.

5. COOP Relocation Site Activation. The process for activating the COOP site, establishing internal/external communications, and reconstituting key enterprise functions at the COOP site.

6. COOP Relocation Site Inventory. An inventory of systems, equipment, and supplies at the COOP relocation site, along with the person(s) responsible for ensuring that the systems are operational and the equipment is present when needed.

7. COOP Relocation Site De-Activation. Procedures for de-activating the COOP site and restoring it to a ‘ready status’ after a real relocation event or training exercise.

Enterprise Functions Have to Relocate

Disaster Recovery Plan

ea3-secEA3 artifact SP-5: Disaster Recovery Plan

The Disaster Recovery Plan is an assessment matrix and set of procedures to handle outages in various business and/or technology capabilities that do not require the enterprise to relocate its operations.  Outages can be caused by natural or man-made events (e.g. fire, flood, power outage).

The activation of the Disaster Recovery Plan may have to be accomplished in the midst of a natural or man-made disaster that makes clarity, brevity, completeness, and flexibility (backups) key to success. The following are some of the recommended elements in a Disaster Recovery Plan:

1. Disaster Recovery Activation. Conditions for Activating the COOP.

2. Recovery Roles and Responsibilities. A matrix of the roles and responsibilities (by position) of all personnel throughout the enterprise who are involved in activating the COOP. Alternates are provided for each position.

3. Disaster Impact and Recovery Assessment. A standard matrix for assessing the type and duration of the outage, as well as the systems and functions throughout the enterprise that are affected. Depending on the type of outage and the projected period of outage (minutes, hours, days), the recovery procedure may differ.

4. Recovery Procedures. The procedures that are used to restore the business and/or system functions that have been disrupted. Examples include:

  • Electrical Outage
  • Air Conditioning/Heating Outage
  • Building Damage (Fire, Flood, Earthquake)
  • Room Damage (Fire, Flood, Earthquake)
  • Virus Infection of Information System(s)
  • Loss of Internal or External Data Communications
  • Loss of Internal or External Telephone Communications

Enterprise Functions Do Not Relocate

Continuous Monitoring Procedures

ea3-secEA3 artifact SP-4: Continuous Monitoring Procedures

Continuous monitoring is the process and technology used to detect compliance and risk issues associated with an organization’s financial and operational environment.

Three operational disciplines:

  • Continuous Audit
  • Continuous Controls Monitoring
  • Continuous Transaction Inspection

Certification & Accreditation

ea3-secEA3 artifact SP-3: Certification & Accreditation Documentation

The System Accreditation Document uses a standard format for evaluating the security status of information systems throughout the enterprise.  There are a number of parts to a system security accreditation as are illustrated in the example.

  1. System Security Plan. This opening section of the System Accreditation Document provides an overview of the business context that the information system operates in, states the current security status of the system (last accreditation), and summarizes the contents and finding of the other accreditation documents.
  2. System Risk Assessment. This section of the document uses a standardized format for showing areas of risk to the information system in the four primary areas security threat areas that are covered in artifact SP-2; physical, data, operational, and personnel. Assigns a level of risk based on the business context for system operations and the type of system data to be protected. Provides security risk remediation strategies (how to avoid a security risk, or deal with it if a problem occurs) for each area of risk that is identified.
  3. System Test and Evaluation. Also called a system ‘penetration test.’ The System Test and Evaluation (ST&E) section of the document provides the results of a live test that attempts to enter the system through other-than-normal log-in procedures, as well as attempts to overwhelm the system (denial of service attack), or infect the system with an active virus, worm, or other type of problematic element that reduces or eliminates information system functionality.
  4. Remediation Plan. This section of the document provides the status of corrective actions taken to fix all of the security risks found during the risk assessment/ST&E.
  5. Approval to Operate. This section of the document is the formal (signed) approval to operate the information system that is provided by the designated person in the enterprise (usually the Chief Information Officer or the IT Security Manager).

Security and Privacy Plan

ea3-secEA3 artifact SP-2: Security Plan

The Security Plan provides both high-level and detailed descriptions of the security program that is in effect throughout the enterprise.  This includes physical, data, personnel, and operational security elements and procedures.

Chapter 11 in Bernard’s book provides additional detail on Security Plans.

  1. Introduction
    • Purpose of the IT Security Program
    • Principles of IT Security
    • Critical Success Factors
    • Intended Outcomes
    • Performance Measures
  2. Policy
    • Executive Guidance
    • Technical Guidance
    • Applicable Law and Regulations
    • Standards
  3. Reporting Requirements
    • IT Security Program Roles and Responsibilities
    • IT Security Program Schedule and Milestones
    • IT Security Incident Reporting
  4. Concept of Operations
    • IT Security Threat Summary
    • IT Security Risk Mitigation
    • Integration with Enterprise Architecture
    • Component/System Security Plans
  5. Security Program Elements
    • Information Security
    • Personnel Security
    • Operational Security
    • Physical Security
  6. Standard Operating Procedures
    • Test and Evaluation
    • Risk Assessment
    • Certification and Accreditation
    • Disaster Recovery/Continuity of Operations
    • Records Protection and Archiving
    • Data Privacy

Security Controls Catalog

ea3-secEA3 artifact SP-1: Security Controls Catalog and Solutions Description

The Security Controls Catalog is

The Security Solutions Description provides a high-level view of how security is provided for selected resources throughout the enterprise.  The solutions cover four dimensions of security: physical, data, personnel, and operations and may include diagrams or matrices.

Operational Security

In the area of operational security, the Security Program should promote the development of standard operating procedures (SOPs) for all EA components that support line of business operations. SOPs should also be developed for recovery from major outages or natural disasters, and for enabling the continuity of operations if all or part of the enterprise becomes disabled.

Data Security

In the area of information security, the Security Program should promote security-conscious designs, information content assurance, source authentication, and data access control. The assessment of types of data being handled for privacy protection concerns should also be done (e.g. customer credit data or employee SSNs).

Personnel Security

In the area of personnel security, the Security Program should promote user authentication and IT security awareness, and new user/recurring training. badges, biometrics, card swipe units, cipher locks, and other methods of combining personnel and physical security solutions should be implemented.

Physical Security

The elements of physical security that should be captured in the EA include protection for the facilities that support IT processing, control of access to IT equipment, networks, and telecommunications rooms, as well as fire protection, media storage, and disaster recovery systems.


Facility Blueprints

ea3-infraEA3 artifact I-12: Facility Blueprints

This artifact is a full set of electronic blueprints for all of the physical buildings and rooms throughout the enterprise.  The blueprints aid in planning and decision-making regarding the placement of workspaces, production facilities, warehouses, networks and other business functions.

Asset Inventory

ea3-infraEA3 artifact I-11: Asset Inventory

The Asset Inventory lists all of the hardware and software on the enterprise’s voice, data, and video networks throughout the enterprise.  The list may include bar code numbers or other unique identifiers.


Capital Equipment Inventory

The Capital Equipment Inventory lists all of the non-information technology capital (depreciable) equipment in each line of business throughout the enterprise.  The list may include bar code numbers or other unique identifiers.


Point of Presence Diagram

ea3-infraEA3 artifact I-10: Point of Presence Diagram

On the Internet, a point-of-presence (POP) is an access point from one place to the rest of the Internet. A POP necessarily has a unique Internet Protocol (IP) address. A POP usually includes routers, digital/analog call aggregators, servers, and frequently frame relays or ATM switches.