7 CFR 277.18 - Establishment of an Automated Data Processing (ADP) and Information Retrieval System.

prev | next
§ 277.18 Establishment of an Automated Data Processing (ADP) and Information Retrieval System.
(a) Scope and application. This section establishes conditions for initial and continuing authority to claim Federal financial participation (FFP) for the costs of the planning, development, acquisition, installation and implementation of ADP equipment and services used in the administration of the Food Stamp Program. Due to the nature of the procurement of ADP equipment and services, current State agency approved cost allocation plans for ongoing operational costs shall not apply to ADP system development costs under this section unless documentation required under paragraph (c) of this section is submitted to and approvals are obtained from FNS.
(b) Definitions:
Acceptance Documents means written evidence of satisfactory completion of an approved phase of work or contract, and acceptance thereof by the State agency.
Advance Planning Document for Project Implementation or Implementation APD means a written plan of action requesting Federal financial participation (FFP) to acquire and implement ADP services and/or equipment.
Advance Planning Document for Project Planning or Planning APD means a brief written plan of action that requests FFP to accomplish the planning necessary for a State agency to determine the need for and plan the acquisition of ADP equipment and/or services, and to acquire information necessary to prepare an Implementation APD.
Advance Planning Document Update (APDU) means an annual self-certification by the State agency on the status of project development activities and expenditures in relation to the approved Planning APD or Implementation APD. An APDU may also be submitted as needed to request funding approval for project continuation whenever significant project changes occur or are anticipated.
Automated Data Processing or ADP means data processing performed by a system of electronic or electrical machines so interconnected and interacting as to minimize the need for human assistance or intervention.
Automated Data Processing Equipment or hardware means:
(1) Electronic digital computers, regardless of size, capacity, or price, that accept data input, store data, perform calculations, and other processing steps, and prepare information;
(2) All peripheral or auxiliary equipment used in support of electronic digital computers whether selected and acquired with the computer or separately;
(3) Data transmission or communications equipment that is selected and acquired solely or primarily for use with a configuration of ADP equipment which includes an electronic digital computer; and
(4) Data input equipment used to enter directly or indirectly into an electronic digital computer, peripheral or auxiliary equipment, or data transmission, or communication equipment.
Automated Data Processing Services means:
(1) Services to operate ADP equipment, either by private sources, or by employees of the State agency, or by State or local organizations other than the State agency; and/or
(2) Services provided by private sources or by employees of the State agency or by State and local organizations other than the State agency to perform such tasks as feasibility studies, system studies, system design efforts, development of system specifications, system analysis, programming and system implementation. This includes system training, systems development, site preparation, data entry, and personal services related to automated systems development and operations that are specifically identified as part of a Planning APD or Implementation APD.
Data Processing means the preparation of source media containing data or basic elements of information and the use of such source media according to precise rules of procedures to accomplish such operations as classifying, sorting, calculating, summarizing, recording, and transmitting.
Emergency situation means a situation where:
(1) The State agency can demonstrate to FNS an immediate need to acquire ADP equipment or services in order to continue operation of the Food Stamp Program; and
(2) The State agency can clearly document that the need could not have been anticipated or planned for and the need prevents the State from following the prior approval requirements of § 277.18(c).
Feasibility Study means a preliminary study to determine whether it is sufficiently probable that effective and efficient use of ADP equipment or systems would warrant a substantial investment of staff, time, and money being requested, and whether the plan can be accomplished successfully.
Functional Requirements Specification means an initial definition of the proposed system, which documents the goals, objectives, user or programmatic requirements, the operating environment, and the proposed design methodology, e.g., centralized or distributed. This document details what the new system and/or hardware should do, not how it is to do it. The Specification document shall be based upon a clear and accurate description of the functional requirements for the project, and shall not, in competitive procurements, lead to requirements which unduly restrict competition.
General Systems Design means a combination of narrative and diagrams describing the generic architecture of a system as opposed to the detailed architecture of the system. A general systems design may include a systems diagram; narrative identifying overall logic flow and systems functions; a description of equipment needed (including processing, data transmission and storage requirements); a description of other resource requirements which will be necessary to operate the system; a description of system performance requirements; and a description of the environment in which the system will operate, including how the system will function within that environment.
Regular funding or regular FFP rate means any Federal reimbursement rate authorized by § 277.4(b).
Request for Proposal or RFP means the document used for public solicitations of competitive proposals from qualified sources as outlined in § 277.14(g)(3).
Service Agreement means the document, described in § 277.18(f), signed by the State or local agency and the State or local central data processing facility whenever a central data processing facility provides ADP services to the State or local agency.
Software means a set of computer programs, procedures, and associated documentation used to operate the hardware.
System specifications means information about the new ADP systems, such as: Workload descriptions, input data, information to be maintained and processed, data processing techniques, and output data, which is required to determine the ADP equipment and software necessary to implement the system design.
System study means the examination of existing information flow and operational procedures within an organization. The study consists of three basic phases: Data gathering or investigation of the present system and new information requirements; analysis of the data gathered in the investigation; and synthesis, or refitting, of the parts and relationships uncovered through the analysis into an efficient system.
(c) General acquisition requirements—(1) Requirement for prior FNS approval. A State agency shall obtain prior written approval from FNS as specified in paragraph (c)(2) of this section when it plans to acquire ADP equipment or services with proposed FFP that it anticipates will have total acquisition costs of $5 million or more in Federal and State funds. This applies to both competitively bid and sole source acquisitions. A State agency shall also obtain prior written approval from FNS of its justification for a sole source acquisition when it plans to acquire ADP equipment or services non-competitively from a nongovernmental source which has a total State and Federal acquisition cost of more than $1 million but no more than $5 million. The State agency shall request prior FNS approval by submitting the Planning APD, the Implementation APD or the justification for the sole source acquisition signed by the appropriate State official to the FNS Regional Office. However, a State agency shall obtain prior written approval from FNS for the acquisition of ADP equipment or services to be utilized in an EBT system regardless of the cost of the acquisition.
(2) Specific prior approval requirements. (i) For ADP equipment and services acquisitions which require prior approval as specified in paragraph (c)(1) of this section, the State agency shall obtain the prior written approval of FNS for:
(A) The Planning APD prior to entering into contractual agreements or making any other commitment for acquiring the necessary planning services;
(B) The Implementation APD prior to entering into contractual agreements or making any other commitment for the acquisition of ADP equipment or services.
(ii) For ADP equipment and services acquisitions requiring prior approval as specified in paragraph (c)(1) of this section, prior approval of the following documents associated with such acquisitions is also required:
(A) RFP's; unless specifically exempted by FNS, the State agency shall obtain prior written approval of the RFP before the RFP may be released. However, RFPs costing up to $5 million for competitive procurements and up to $1 million for noncompetitive acquisitions from non-governmental sources and which are an integral part of the approved APD need not be submitted to FNS. States will be required to submit RFPs under this threshold amount on an exception basis or if the procurement strategy is not adequately described and justified in an APD. The State agency shall obtain prior written approval from FNS for Request for Proposals which are associated with an EBT system regardless of the cost.
(B) Contracts; unless specifically exempted by FNS, the State agency shall obtain prior written approval before the contract may be signed by the State agency. However, contracts costing up to $5 million for competitive procurements and up to $1 million for noncompetitive acquisitions from nongovernmental sources, and which are an integral part of the approved APD need not be submitted to FNS. States will be required to submit contracts under this threshold amount on an exception basis or if the procurement strategy is not adequately described and justified in an APD. The State agency shall obtain prior written approval from FNS for contracts which are associated with an EBT system regardless of the cost.
(C) Contract amendments; unless specifically exempted by FNS, the State agency shall obtain prior written approval before the contract amendment may be signed by the State agency. However, contract amendments involving cost increases of up to $1 million or time extensions of up to 120 days, and which are an integral part of the approved APD need not be submitted to FNS. States will be required to submit contract amendments under these threshold amounts on an exception basis or if the contract amendment is not adequately described and justified in an APD. Amendments to contracts for EBT systems shall be permitted within the approved funding cap. State agencies shall submit copies of any contract amendments or contract extensions to FNS with an accompanying analysis of the impact the changes would have upon the approved issuance cap.
(iii) The State agency must obtain prior written approval from FNS as specified in paragraphs (c)(2) (i) and (ii) of this section in order to claim and receive reimbursement for the associated costs of the ADP acquisition.
(3) Approval requirements. (i) For ADP equipment and service acquisitions requiring prior approval as specified in paragraph (c)(1) of this section, the State agency shall submit the following documents to FNS for approval:
(A) Feasibility studies, when specifically required by FNS as a condition of approving the Planning APD. When required by FNS for approval, the State agency shall submit the feasibility study no later than 90 days after its completion.
(B) APD Updates, as required by paragraph (e) of this section, on an annual or as needed basis.
(ii) The State agency must obtain FNS approval of the documents specified in paragraph (c)(3)(i) of this section in order to claim and receive reimbursement for the associated costs of the ADP acquisition.
(4) Approval by the State agency. Approval by the State agency is required for all documents specified in this regulation prior to submission for FNS approval. In addition, State agency approval is also required for those acquisitions of ADP equipment and services not requiring prior approval by FNS.
(5) Prompt action on requests for prior approval. FNS will reply promptly to State requests for prior approval. If FNS has not provided written approval, disapproval or a request for additional information within 60 days of FNS' letter acknowledging receipt of the State's request, the request will be deemed to have provisionally met the prior approval requirement in paragraph (c) of this section. However, provisional approval will not exempt a State from having to meet all other Federal requirements which pertain to the acquisition of ADP equipment and services. Such requirements remain subject to Federal audit and review.
(d) APD content requirements—(1) Planning APD. The State agency may request FFP for the costs of determining the need for and planning the acquisition of ADP equipment or services through the submission of the Planning APD. The State agency may request FFP for the costs of planning activities beginning with initial project inception through the performance of necessary systems and alternatives analyses, selection and design, including the completion of a general systems design. The Planning APD shall contain the following information:
(i) The State agency's description of the programmatic and organizational needs and/or problems to be addressed by the proposed ADP acquisition and the specific objectives to be accomplished under the Planning APD;
(ii) The State agency's commitment to complete the following, where appropriate, as part of project planning activities: a functional requirements specification document, feasibility study, alternatives analysis, cost-benefit analysis, and a general system design. If an existing ADP system is to be transferred, the State agency may plan to use the general system design of the transferred system.
(iii) The State agency's description of the organization, required State and contractual resources and availability of those resources, and the assignments of roles and responsibilities for project planning activities. The State agency shall include a description of resources to be procured and procurement methods;
(iv) The State agency's schedule of activities and deliverables during project planning, including a description and schedule of procurement activities to be undertaken in support of the planning project; and
(v) A proposed budget which shall identify costs for project planning activities by Federal fiscal year. The budget shall include an estimate of prospective cost distribution to participating Federal agencies and the method for cost allocation. The State agency shall also include an estimate of the total project costs, including both the cost of the planning project and the cost of any eventual ADP equipment and/or services acquisition, which will be used only for determining whether the threshold of §§ 277.18(c)(1) is met. An estimate of total project cost for an EBT system shall not be required to be incorporated into the Planning APD budget.
(2) Implementation APD. The State agency may request FFP to acquire ADP equipment and services through the submission of the Implementation APD. The State agency may request FFP for the necessary activities to develop, acquire, install and implement the proposed ADP system or acquisition. The Implementation APD shall contain the following information, where appropriate:
(i) The State agency shall complete and submit a functional requirements specification document;
(ii) The State agency shall submit a feasibility study and associated alternatives analyses, which include the transfer or modification of an existing system from a similar State or jurisdiction in the examination of alternatives. State agencies which reject the transfer or modification of an existing system must provide an analysis describing the barriers to system transfer as part of the feasibility study. The analysis of barriers to system transfer shall include a comparison of the costs of overcoming the problem in transferring an operational system to the costs of developing a new system;
(iii) The State agency shall submit the new or transferred general systems design and shall also document the intended approaches, plans and techniques to develop or modify specific aspects of the proposed ADP system or acquisition including hardware, software, telecommunications, system testing, and data security;
(iv) The State agency shall describe the anticipated resource requirements for implementation of the ADP project, the resources planned to be available for the project, and plans for augmenting resources to meet resource requirements;
(v) The State agency shall indicate the principal events and schedule of activities, milestones, and deliverables during implementation of the project;
(vi) The State agency shall submit a proposed budget which identifies costs for intended project development and implementation activities by Federal fiscal year and shall include a consideration of all possible Implementation APD activity costs (e.g., system conversion, computer capacity planning, supplies, training, and miscellaneous ADP expenses). The budget shall contain an estimate of prospective cost distribution and methods for allocating costs to participating Federal agencies;
(vii) The State agency shall document the scope, methodology, evaluation criteria and results of cost-benefit analyses for evaluating the selected design and alternatives. The cost-benefit analysis shall include a statement indicating the period of time the State agency intends to use the proposed equipment or system; and
(viii) The State agency shall describe the security and interface requirements to be employed and the backup and contingency procedures available.
(3) APD Budget. The proposed budget for both the Planning APD and the Implementation APD shall include cost distribution plans containing the bases for proposed rates, both direct and indirect, for costs associated with system planning, development, acquisition or implementation, as appropriate. The budget proposals accompanying the Implementation APD shall also include proposed cost distribution plans and the bases of proposed rates for the operation of the ADP system. The budget activities shall be presented on a Federal fiscal year basis in a clear fashion to associate costs with each planned activity. The budgets must identify all development costs separately from any ongoing operational costs. Costs must be distinguished by developmental projects and developmental time periods. Actual costs claimed must be reconciliable to projected costs as proposed and approved by FNS in the APD.
(e) APD Update—(1) General submission requirements. The State agency shall submit an APD Update for FNS approval for all approved Planning and Implementation APD's when total acquisition costs exceed $5 million. The APD Update shall be submitted to the FNS Regional Office within 90 days after the annual anniversary date of the original APD approval, unless the submission date is specifically altered by FNS.
(2) Content requirements. The APD Update represents a self-certification by the State agency of project status in relation to the provisions of the approved Planning APD and Implementation APD. The Annually Updated APD shall include:
(i) Project activity status. (A) The status of all major tasks and milestones in the approved Planning APD, Implementation APD or previous APD Update's for the past year. The APD Update shall include all major tasks and milestones completed in the past year and degree of completion for unfinished tasks.
(B) The status of all project deliverables completed in the past year and degree of completion for unfinished products.
(C) Reports of past and/or anticipated problems or delays in meeting target dates in the approved Planning APD, Implementation APD or previous APD Update's for the remainder of the project. The Annually Updated APD shall include an explanation of the need to extend any major project target dates.
(ii) Project expenditures. (A) A detailed accounting for all expenditures for project development over the past year.
(B) An explanation of differences between projected expenses in the approved Planning or Implementation APD, or previous APD Update's, and actual expenditures for the past year. If changes in costs are reported, FNS may require the submission of a revised cost-benefit analysis as a condition for approval of the APD Update.
(C) Changes to the allocation basis in the approved APD's cost allocation methodology.
(iii) Changes to the approved APD.
(A) Revised language for all changes to the approved APD or previous APD Updates shall be submitted as part of the APD Update, unless submitted separately by the State agency as the changes occurred throughout the year.
(B) Changes in project management and/or contractor services.
(3) Submission as needed. In addition to the requirement for approval of an APD Update on an annual basis, as specified in paragraph (e)(1) of this section, the State agency may submit an APD Update on a more frequent or as needed basis, in order to obtain a commitment of FFP whenever significant project changes occur. Without such approval, the State agency is at risk for funding of project activities which are not in compliance with the terms and conditions of the approved APD and subsequently approved APD Updates, until such time as approval is specifically granted by FNS. At a minimum, the State agency should consider submission of an APD Update whenever any of the following changes occur or are anticipated:
(i) A significant increase ($1 million or more) in total project costs;
(ii) A significant schedule extension (60 days or more) for major milestones;
(iii) A significant change in procurement approach, and/or scope of procurement activities beyond that approved in the APD;
(iv) A change in system concept, or a change to the scope of the project; or
(v) A change to the approved cost allocation methodology.
(f) Service agreements. The State agency shall execute service agreements when data processing services are to be provided by a State central data processing facility or another State or local agency. Service agreements shall be kept on file by the State agency and be available for Federal review, and shall:
(1) Identify the ADP services that will be provided;
(2) Include, preferably as an amendable attachment, a schedule of charges for each identified ADP service, and a certification that these charges apply equally to all users;
(3) Include a description of the method(s) of accounting for the services rendered under the agreement and computing services charges;
(4) Include assurances that services provided will be timely and satisfactory;
(5) Include assurances that information in the computer system as well as access, use and disposal of ADP data will be safeguarded in accordance with provisions of §§ 272.1(c) and 277.13;
(6) Require the provider to obtain prior approval pursuant to § 277.18(c)(1) from FNS for ADP equipment and ADP services that are acquired from commercial sources primarily to support the Food Stamp Program and requires the provider to comply with § 277.14 for procurements related to the service agreement. ADP equipment and services are considered to be primarily acquired to support the Food Stamp Program when the Program may reasonably be expected to either be billed for more than 50 percent of the total charges made to all users of the ADP equipment and services during the time period covered by the service agreement, or directly charged for the total cost of the purchase or lease of ADP equipment or services;
(7) Include the beginning and ending dates of the period of time covered by the service agreement; and
(8) Include a schedule of expected total charges to the Program for the period of the service agreement.
(g) Conditions for receiving FFP—(1) A State agency may receive FFP at the 50 percent reimbursement rate for the costs of planning, design, development or installation of ADP and information retrieval systems if the proposed system will:
(i) Assist the State agency in meeting the requirements of the Food Stamp Act;
(ii) Meet the program standards specified in § 272.10(b)(1), (b)(2), and (b)(3) of this chapter, except for the requirements in § 272.10(b)(2)(vi), (b)(2)(vii), and (b)(3)(ix) of this chapter to eventually transmit data directly to FCS;
(iii) Be likely to provide more efficient and effective administration of the program; and
(iv) Be compatible with such other systems utilized in the administration of State agency plans under the program of Temporary Assistance for Needy Families (TANF).
(2) State agencies seeking FFP for the planning, design, development or installation of automated data processing and information retrieval systems shall develop Statewide systems which are integrated with TANF. In cases where a State agency can demonstrate that a local, dedicated, or single function (issuance or certification only) system will provide for more efficient and effective administration of the program, FNS may grant an exception to the Statewide integrated requirement. These exceptions will be based on an assessment of the proposed system's ability to meet the State agency's need for automation. Systems funded as exceptions to this rule, however, should be capable to the extent necessary, of an automated data exchange with the State agency system used to administer TANF. In no circumstances will funding be available for systems which duplicate other State agency systems, whether presently operational or planned for future development.
(h) Emergency acquisition requirements. The State agency may request FFP for the costs of ADP equipment and services acquired to meet emergency situations which preclude the State agency from following the prior approval requirements of § 277.18(c). FNS may provide FFP in emergency situations if the following conditions are met:
(1) The State agency must submit a written request to FNS prior to the acquisition of any ADP equipment or services. The written request must be sent by registered mail and shall include:
(i) A brief description of the ADP equipment and/or services to be acquired and an estimate of their costs;
(ii) A brief description of the circumstances which result in the State agency's need to proceed with the acquisition prior to obtaining formal FNS approval; and
(iii) A description of the adverse impact which would result if the State agency does not immediately acquire the ADP equipment and/or services.
(2) Upon receipt of a written request for emergency acquisition FNS shall provide a written response to the State agency within 14 days. The FNS response shall:
(i) Inform the State agency that the request has been disapproved and the reason for disapproval; or,
(ii) Inform the State agency that FNS recognizes that an emergency situation exists and the State agency must submit a formal request for approval by FNS which includes the information specified at § 277.18(d)(2)within 90 days from the date of the State agency's initial written request.
(iii) If FNS approves the request submitted under paragraph (h)(1) of this section, FFP will be available from the date the State agency acquires the ADP equipment and services.
(i) Cost determination and claiming costs—(1) Cost determination. Actual costs must be determined in compliance with an FNS approved budget and appendix A to this part, and must be reconcilable with the FNS funding level. There shall be no payments pursuant to this section to the extent that a State agency is reimbursed for such costs pursuant to any other Federal program or uses ADP systems for purposes not connected with the Food Stamp Program. The State agency approved cost allocation plan must be amended to disclose the methods which will be used to identify and classify costs to be claimed. This methodology must be submitted to FNS as part of the request for FNS approval of funding as required in paragraph (d)(3) of this section. Any costs funded pursuant to these regulations shall be excluded in determining the State agency's administrative costs under any other section of this part.
(2) Cost identification for purposes of FFP claims. State agencies shall assign and claim the costs incurred under an approved APD in accordance with the following criteria:
(i) Development costs. Using its normal departmental accounting system, the State agency shall specifically identify what items of costs constitute development costs, assign these costs to specific project cost centers, and distribute these costs to funding sources based on the specific identification, assignment and distribution outlined in the approved APD. The methods for distributing costs set forth in the APD should provide for assigning identifiable costs, to the extent practicable, directly to program/functions. The State agency shall amend the cost allocation plan required by § 277.9 to include the approved APD methodology for the identification, assignment and distribution of the development costs.
(ii) Operational costs. Costs incurred for the operation of an ADP system shall be identified and assigned by the State agency to funding sources in accordance with the approved cost allocation plan required by § 277.9.
(iii) Service agreement costs. States that operate a central data processing facility shall use their approved central service cost allocation plan required by OMB Circular A-87 to identify and assign costs incurred under service agreements with the State agency. The State agency shall then distribute these costs to funding sources in accordance with paragraphs (i)(2)(i) and (i)(2)(ii) of this section.
(3) Capital expenditures. The State agency shall charge the costs of ADP equipment having unit acquisition costs or total aggregate costs, at the time of acquisition, of more than $25,000 by means of depreciation or use allowance, unless a waiver is specifically granted by FNS. If the equipment acquisition is part of an APD that is subject to the prior approval requirements of paragraph (c)(2) of this section, the State agency may submit the waiver request as part of the APD.
(4) Claiming costs. Prior to claiming funding under this section the State agency shall have complied with the requirements for obtaining approval and prior approval of § 277.18(c).
(5) Budget authority. FNS approval of requests for funding shall provide notification to the State agency of the budget authority and dollar limitations under which such funding may be claimed. FNS shall provide this amount as a total authorization for such funding which may not be exceeded unless amended by FNS. FNS's determination of the amount of this authorization shall be based on the budget submitted by the State agency. Activities not included in the approved budget, as well as continuation of approved activities beyond scheduled deadlines in the approved plan, shall require FNS approval of an amended State budget for payment. Requests to amend the budget authorization approved by FNS shall be submitted to FNS prior to claiming such expenses.
(j) Procurement requirements. (1) Procurements of ADP equipment and services are subject to the procurement standards prescribed by § 277.14 regardless of any conditions for prior approval, except the requirements of § 277.14(b)(1) and (2) regarding review of proposed contracts. Those standards include a requirement for maximum practical open and free competition regardless of whether the procurement is formally advertised or negotiated.
(2) The standards prescribed by § 277.14, as well as the requirement for prior approval, apply to ADP services and equipment acquired by a State or local agency, and the ADP services and equipment acquired by a State or local central data processing facility primarily to support the Food Stamp Program.
(3) The competitive procurement policy prescribed by § 277.14 shall be applicable except for ADP services provided by the agency itself, or by other State or local agencies.
(k) Access to the system and records. Access to the system in all aspects, including but not limited to design, development, and operation, including work performed by any source, and including cost records of contractors and subcontractors, shall be made available by the State agency to FNS or its authorized representatives at intervals as are deemed necessary by FNS, in order to determine whether the conditions for approval are being met and to determine the efficiency, economy and effectiveness of the system. Failure to provide full access by appropriate State and Federal representatives to all parts of the system shall result in suspension and/or termination of Food Stamp Program funds for the costs of the system and its operation.
(l) Ownership rights—(1) Software(i) The State or local government shall include a clause in all procurement instruments which provides that the State or local government shall have all ownership rights in any software or modifications thereof and associated documentation designed, developed or installed with FFP under this section.
(ii) FNS reserves a royalty-free, nonexclusive, and irrevocable license to reproduce, publish, or otherwise use and to authorize others to use for Federal Government purposes, such software, modifications, and documentation.
(iii) Proprietary operating/vendor software packages (e.g., ADABAS or TOTAL) which are provided at established catalog or market prices and sold or leased to the general public shall not be subject to the ownership provisions in paragraphs (l)(1)(i) and (l)(1)(ii) of this section. FFP is not available for proprietary applications software developed specifically for the Food Stamp Program.
(2) Automated data processing equipment. The policies and procedures governing title, use and disposition of property purchased with Food Stamp Program funds, which appear at 7 CFR 277.13 are applicable to automated data processing equipment.
(m) Use of ADP systems. ADP systems designed, developed or installed with FFP shall be used for the period of time specified in the APD, unless FNS determines that a shorter period is justified.
(n) Basis for continued Federal financial participation. FNS will continue FFP at the levels approved in the Planning APD and the Implementation APD provided that project development proceeds in accordance with the conditions and terms of the approved APD and that ADP resources are used for the purposes authorized. FNS will use the APD Update to monitor ADP project development. The submission of the report prescribed in § 277.18(e) for the duration of project development is a condition for continued FFP. In addition, periodic onsite reviews of ADP project development and State and local agency ADP operations may be conducted by or for FNS to assure compliance with approved APD's, proper use of ADP resources, and the adequacy of State or local agency ADP operations.
(o) Disallowance of Federal financial participation. If FNS finds that any ADP acquisition approved under the provisions of § 277.18(c) fails to comply with the criteria, requirements, and other undertakings described in the approved or modified APD, payment of FFP may be disallowed.
(p) ADP system security requirements and review process—(1) ADP system security requirements. State and local agencies are responsible for the security of all ADP projects under development, and operational systems involved in the administration of the Food Stamp Program. State and local agencies shall determine appropriate ADP security requirements based on recognized industry standards or standards governing security of Federal ADP systems and information processing.
(2) ADP security program. State agencies shall implement and maintain a comprehensive ADP Security Program for ADP systems and installations involved in the administration of the Food Stamp Program. ADP Security Programs shall include the following components.
(i) Determination and implementation of appropriate security requirements as prescribed in paragraph (p)(1) of this section.
(ii) Establishment of a security plan and, as appropriate, policies and procedures to address the following areas of ADP security:
(A) Physical security of ADP resources;
(B) Equipment security to protect equipment from theft and unauthorized use;
(C) Software and data security;
(D) Telecommunications security;
(E) Personnel security;
(F) Contingency plans to meet critical processing needs in the event of short- or long-term interruption of service;
(G) Emergency preparedness; and
(H) Designation of an Agency ADP Security Manager.
(iii) Periodic risk analyses. State agencies shall establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. In addition, risk analyses shall be performed whenever significant system changes occur.
(3) ADP system security reviews. State agencies shall review the ADP system security of installations involved in the administration of the Food Stamp Program on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security, operating procedures, and personnel practices. State agencies shall maintain reports of their biennial ADP system security reviews, together with pertinent supporting documentation, for Federal on-site review.
(4) Applicability. The security requirements of this section apply to all ADP systems used by State and local governments to administer the Food Stamp Program.
(5) Costs. Costs incurred for complying with the provisions of paragraphs (p)(1) through (p)(3) of this section are considered regular administrative costs which are funded at the regular FFP level.
[Amdt. 319, 55 FR 4355, Feb. 7, 1990, as amended by Amdt. 345, 57 FR 11259, Apr. 1, 1992; Amdt. 342, 59 FR 2733, Jan. 19, 1994; Amdt. 368, 61 FR 33643, June 28, 1996; Amdt. 385, 65 FR 33440, May 24, 2000]
Beta! The text on the eCFR tab represents the unofficial eCFR text at ecfr.gov.
§ 277.18 State Systems Advance Planning Document (APD) process.

(a) Scope and application. This section establishes conditions for initial and continuing authority to claim Federal financial participation (FFP) for the costs of the planning, development, acquisition, installation and implementation of Information System (IS) equipment and services used in the administration of the Supplemental Nutrition Assistance Program (SNAP) and as prescribed by appropriate Food and Nutrition Service (FNS) directives and guidance (i.e., FNS Handbook 901, OMB Circulars, etc.).

(b) Definitions. As used in this section:

Acquisition means obtaining supplies or services through a purchase or lease, regardless of whether the supplies or services are already in existence or must be developed, created or evaluated.

Advance Planning Document for project planning or Planning APD (APD or PAPD) means a brief written plan of action that requests FFP to accomplish the planning activities necessary for a State agency to determine the need for, feasibility of, projected costs and benefits of an IS equipment or services acquisition, plan the acquisition of IS equipment and/or services, and to acquire information necessary to prepare an Implementation APD.

Advance Planning Document Update (APDU) means a document submitted annually (Annual APDU) by the State agency to report the status of project activities and expenditures in relation to the approved Planning APD or Implementation APD; or on an as needed basis (As Needed APDU) to request funding approval for project continuation when significant project changes occur or are anticipated.

Commercial Off-the-Shelf (COTS) means proprietary software products that are ready-made and available for sale to the general public at established catalog or market prices in which the software vendor is not positioned as the sole implementer or integrator of the product.

Enhancement means modifications which change the functions of software and hardware beyond their original purposes, not just to correct errors or deficiencies which may have been present in the software or hardware, or to improve the operational performance of the software or hardware. Software enhancements that substantially increase risk or cost or functionality will require submission of an IAPD or an As Needed IAPDU.

Implementation Advance Planning Document or Implementation APD (IAPD) means a written plan of action requesting FFP to acquire and implement information system (IS) services and/or equipment. The Implementation APD includes the design, development, testing and implementation phases of the project.

Information System (IS) means a combination of hardware and software, data and telecommunications that performs specific functions to support the State agency, or other Federal, State or local organization.

Project means a related set of information technology related tasks, undertaken by a State, to improve the efficiency, economy and effectiveness of administration and/or operation of its human services programs. A project may also be a less comprehensive activity such as office automation, enhancements to an existing system, or an upgrade of computer hardware.

Request for Proposal (RFP) means the document used for public solicitations of competitive proposals from qualified sources as outlined in § 277.14(g)(3).

(c) Requirements for FNS prior approval of IS projects -

(1) General prior approval requirements. The State agency shall request prior FNS approval by submitting the Planning APD, the Implementation APD, an APD Update, the draft acquisition instrument, and/or the justification for the sole source acquisition if applicable, as specified in paragraph (c)(2) of this section. A State agency must obtain written approval from FNS to receive FFP of any of the following activities:

(i) When it plans a project to enhance or replace its IS that it anticipates will have total project costs in Federal and State funds of $6 million or more.

(ii) Any IS competitive acquisition that costs $6 million or more in Federal and State funds.

(iii) When the State agency plans to acquire IS equipment or services non-competitively from a nongovernmental source, and the total State and Federal cost is more than $1 million.

(iv) For the acquisition of IS equipment or services to be utilized in an Electronic Benefit Transfer (EBT) system regardless of the cost of the acquisition in accordance with § 274.12 (EBT issuance system approval standards).

(2) Specific prior approval requirements.

(i) For IS projects which require prior approval, as specified in paragraph (c)(1) of this section, the State agency shall obtain the prior written approval of FNS for:

(A) Conducting planning activities, entering into contractual agreements or making any other commitment for acquiring the necessary planning services;

(B) Conducting design, development, testing or implementation activities, entering into contractual agreements or making any other commitment for the acquisition of IS equipment or services.

(ii) For IS equipment and services acquisitions requiring prior approval as specified in paragraph (c)(1) of this section, prior approval of the following documents associated with such acquisitions is also required:

(A) Requests for Proposals (RFPs). Unless specifically exempted by FNS, the State agency shall obtain prior written approval of the RFP before the RFP may be released. However, RFPs for acquisitions estimated to cost less than $6 million or competitive procurements from non-governmental sources and that are an integral part of the approved APD, need not receive prior approval from FNS. The State agency shall submit a written request to get prior written approval to acquire IS equipment or services non-competitively from a nongovernmental source when the total State and Federal cost is $1 million or more. State agencies shall submit RFPs under this threshold amount on an exception basis. The State agency shall obtain prior written approval from FNS for RFPs which are associated with an EBT system regardless of the cost.

(B) Contracts. All contracts must be submitted to FNS. Unless specifically exempted by FNS, the State agency shall obtain prior written approval before the contract may be signed by the State agency. However, contracts for competitive procurements costing less than $6 million and for noncompetitive acquisitions from nongovernmental sources costing less than $1 million and that are an integral part of the approved APD need not be submitted to FNS. State agencies shall submit contracts under this threshold amount on an exception basis. The State agency shall obtain prior written approval from FNS for contracts which are associated with an EBT system regardless of the cost.

(C) Contract amendments. All contract amendments must be submitted to FNS. Unless specifically exempted by FNS, the State agency shall obtain prior written approval from FNS of any contract amendments which cumulatively exceed 20 percent of the base contract costs before being signed by the State agency. The State agency shall obtain prior written approval from FNS for contracts which are associated with an EBT system regardless of the cost.

(iii) Procurement requirements.

(A) Procurements of IS equipment and services are subject to § 277.14 (procurement standards) regardless of any conditions for prior approval contained in this section, except the requirements of § 277.14(b)(1) and (b)(2) regarding review of proposed contracts. Those procurement standards include a requirement for maximum practical open and free competition regardless of whether the procurement is formally advertised or negotiated.

(B) The standards prescribed by § 277.14, as well as the requirement for prior approval in this paragraph (c), apply to IS services and equipment acquired primarily to support SNAP regardless of the acquiring entity.

(C) The competitive procurement policy prescribed by § 277.14 shall be applicable except for IS services provided by the agency itself, or by other State or local agencies.

(iv) The State agency must obtain prior written approval from FNS, as specified in paragraphs (c)(2)(i) and (c)(2)(ii) of this section, to claim and receive reimbursement for the associated costs of the IS acquisition.

(3) Document submission requirements.

(i) For IS projects requiring prior approval as specified in paragraphs (c)(1) and (c)(2) of this section, the State agency shall submit the following documents to FNS for approval:

(A) Planning APD as described in paragraph (d)(1) of this section.

(B) Implementation APD as described in paragraph (d)(2) of this section.

(C) Annual APDU as described in paragraph (d)(3) of this section. The Annual APDU shall be submitted to FNS 60 days prior to the expiration of the FFP approval, unless the submission date is specifically altered by FNS. In years where an As Needed APDU is required, as described in paragraph (c)(3)(i)(D) of this section, FNS may waive or modify the requirement to submit the annual APDU.

(D) As Needed APDU as described in paragraph (d)(4) of this section. As Needed APDU are required to obtain a commitment of FFP whenever significant project changes occur. Significant project changes are defined as changes in cost, schedule, scope or strategy which exceed FNS-defined thresholds or triggers. Without such approval, the State agency is at risk for funding of project activities which are not in compliance with the terms and conditions of the approved APD and subsequently approved APDU until such time as approval is specifically granted by FNS.

(E) Acquisition documents as described in § 277.14(g).

(F) Emergency Acquisition Requests as described in paragraph (i) of this section.

(ii) The State agency must obtain prior FNS approval of the documents specified in paragraph (c)(3)(i) of this section in order to claim and receive reimbursement for the associated costs of the IS acquisition.

(4) Approval by the State agency. Approval by the State agency is required for all documents and acquisitions specified in § 277.18 prior to submission for FNS approval. However, the State agency may delegate approval authority to any subordinate entity for those acquisitions of IS equipment and services not requiring prior approval by FNS.

(5) Prompt action on requests for prior approval. FNS will reply promptly to State agency requests for prior approval. If FNS has not provided written approval, disapproval or a request for additional information within 60 days of FNS' acknowledgment of receipt of the State agency's request, the request will be deemed to have provisionally met the prior approval requirement in this paragraph (c). However, provisional approval will not exempt a State agency from having to meet all other Federal requirements which pertain to the acquisition of IS equipment and services. Such requirements remain subject to Federal audit and review.

(d) APD content requirements -

(1) Planning APD (PAPD). The PAPD is a written plan of action to acquire proposed services or equipment and to perform necessary activities to investigate the feasibility, system alternatives, requirements and resources needed to replace, modify or upgrade the State agency's IS. The PAPD shall contain adequate documentation to demonstrate the need to undertake a planning process, as well as a thorough description of the proposed planning activities, and estimated costs and timeline, as specified by FNS in Handbook 901.

(2) Implementation APD (IAPD). The IAPD is a written plan of action to acquire the proposed IS services or equipment and to perform necessary activities to design, develop, acquire, install, test, and implement the new IS. The IAPD shall contain detailed documentation of planning and preparedness for the proposed project, as enumerated by FNS in Handbook 901, demonstrating the feasibility of the project, thorough analysis of system requirements and design, a rigorous management approach, stewardship of federal funds, a realistic schedule and budget, and preliminary plans for key project phases.

(3) Annual APDU content requirements. The Annual APDU is a yearly update to ongoing IS projects when planning or implementation activities occur. The Annual APDU shall contain documentation on the project activity status and a description of major tasks, milestones, budget and any changes, as specified by FNS in Handbook 901.

(4) As Needed APDU content requirements. The As Needed APDU document shall contain the items as defined in paragraph (c)(3)(i)(D) of this section with emphasis on the area(s) where changes have occurred or are anticipated that triggered the submission of the APDU, as detailed by FNS in Handbook 901.

(e) Service agreements. The State agency shall execute service agreements when IS services are to be provided by a State central IT facility or another State or local agency. Service Agreement means the document signed by the State or local agency and the State or local central IT facility whenever an IT facility provides IT services to the State or local agency. Service agreements shall:

(1) Identify the IS services that will be provided;

(2) Include a schedule of rates for each identified IS service, and a certification that these rates apply equally to all users;

(3) Include a description of the method(s) of accounting for the services rendered under the agreement and computing services charges;

(4) Include assurances that services provided will be timely and satisfactory;

(5) Include assurances that information in the IS as well as access, use and disposal of IS data will be safeguarded in accordance with provisions of § 272.1(c) (disclosure) and § 277.13 (property);

(6) Require the provider to obtain prior approval from FNS pursuant to paragraph (c)(1) of this section for IS equipment and IS services that are acquired from commercial sources primarily to support federally aided public assistance programs and require the provider to comply with § 277.14 (procurement standards) for procurements related to the service agreement. IS equipment and services are considered to be primarily acquired to support federally aided public assistance programs when the Programs may reasonably be expected to either be billed for more than 50 percent of the total charges made to all users of the IS equipment and services during the time period covered by the service agreement, or directly charged for the total cost of the purchase or lease of IS equipment or services;

(7) Include the beginning and ending dates of the period of time covered by the service agreement; and

(8) Include a schedule of expected total charges to the Program for the period of the service agreement.

(9) State Agency Maintenance of Service Agreements. The State agency shall maintain a copy of each service agreement in its files for Federal review upon request.

(f) Conditions for receiving Federal financial participation (FFP) - (1) A State agency may receive FFP at the 50 percent reimbursement rate for the costs of planning, design, development or installation of IS and information retrieval systems if the proposed system will:

(i) Assist the State agency in meeting the requirements of the Food and Nutrition Act of 2008, as amended;

(ii) Meet the Automation of Data Processing/Computerization of Information Systems Model Plan program standards specified in § 272.10(b)(1) through (b)(3) of this chapter, except the requirements in § 272.10(b)(2)(vi), (b)(2)(vii), and (b)(3)(ix) of this chapter to eventually transmit data directly to FNS;

(iii) Be likely to provide more efficient and effective administration of the program; and

(iv) Be compatible with such other systems utilized in the administration of other State agency programs including the program of Temporary Assistance for Needy Families (TANF).

(2) State agencies seeking FFP for the planning, design, development or installation of IS shall develop State wide systems which are integrated with TANF. In cases where a State agency can demonstrate that a local, dedicated, or single function (issuance or certification only) system will provide for more efficient and effective administration of the program, FNS may grant an exception to the State wide integrated requirement. These exceptions will be based on an assessment of the proposed system's ability to meet the State agency's need for automation. Systems funded as exceptions to this rule, however, should be capable to the extent necessary, of an automated data exchange with the State agency system used to administer TANF. In no circumstances will funding be available for systems which duplicate other State agency systems, whether presently operational or planned for future development.

(g) Basis for continued Federal financial participation (FFP) - (1) FNS will continue FFP at the levels approved in the Planning APD and the Implementation APD provided that project development proceeds in accordance with the conditions and terms of the approved APD and that IS resources are used for the purposes authorized. FNS will use the APDU to monitor IS project development. The submission of the Update as prescribed in § 277.18(d) for the duration of project development is a condition for continued FFP. In addition, periodic onsite reviews of IS project development and State and local agency IS operations may be conducted by or for FNS to assure compliance with approved APDs, proper use of IS resources, and the adequacy of State or local agency IS operations.

(2) Pre-implementation. The State agency must demonstrate through thorough testing that the system meets all program functional and performance requirements. FNS may require a pre-implementation review of the system to validate system functionality prior to State agency testing.

(i) Testing. The State agency must provide a complete test plan prior to the start of the testing phase. The State agency must provide documentation to FNS of the results of User Acceptance Testing (UAT) before the system is piloted in a production environment. FNS concurrence to advance from testing to pilot is a condition for continued FFP. All aspects of program eligibility must be tested to ensure that the system makes accurate eligibility determinations in accordance with federal statutes and regulations and approved State policies, and that system functionality meets the required functional specifications. The State agency shall describe how all system testing will be conducted and the resources to be utilized in order to verify the system complies with SNAP requirements, system design specifications, and performance standards including responsiveness, usability, capacity and security. Testing includes but is not limited to unit testing, integration testing, performance testing, end-to-end testing, UAT and regression testing. During UAT detailed scripts covering all areas of program functionality shall be used so that any errors identified can be replicated, corrected and re-tested. At a minimum, the Test Plan shall address:

(A) The types of testing to be performed;

(B) The organization of the test team and associated responsibilities;

(C) Test database generation;

(D) Test case development;

(E) Test schedule;

(F) Documentation of test results;

(G) Acceptance testing, to include functional requirements testing, error condition handling and destructive testing, security testing, recovery testing, controls testing, stress and throughput performance testing, and regression testing; and

(H) The decision criteria, including specific test results which must be met before the State may exit the testing phase, the roles or titles of the individuals responsible for verifying that these criteria have been met, and the sign-off process which will document that the criteria have been met.

(I) FNS may require any or all of these tests to be repeated in instances where significant modifications are made to the system after these tests are initially completed or if problems that surfaced during initial testing warrant a retest. FNS reserves the right to participate and conduct independent testing, as necessary, during UAT and at appropriate times during system design, development, implementation and operations.

(ii) Pilot. Prior to statewide rollout of the system there must be a test of the fully operational system in a live production environment. Pilots must operate until a state of routine operation is reached with the full caseload in the pilot area. The design of this pilot shall provide an opportunity to test all components of the system as well as the data conversion process and system performance. The duration of the pilot must be for a sufficient period of time to thoroughly evaluate the system (usually a minimum duration of three months). The State agency must provide documentation to FNS of the pilot evaluation. FNS approval to implement the system more broadly is a condition for continued FFP.

(iii) Post-implementation Review. After the system is fully implemented, FNS may conduct a review to validate that program policy is correctly applied, whether project goals and objectives were met, that IS equipment and services are being properly used and accurate inventory records exist, and the actual costs of the project.

(h) Disallowance of Federal financial participation (FFP). If FNS finds that any acquisition approved under the provisions of paragraph (c) of this section fails to comply with the criteria, requirements and other undertakings described in the approved or modified APD, payment of FFP may be suspended or may be disallowed in whole or in part.

(i) Emergency acquisition requirements. The State agency may request FFP for the costs of IS equipment and services acquired to meet emergency situations in which the State agency can demonstrate to FNS an immediate need to acquire IS equipment or services in order to continue operation of SNAP; and the State agency can clearly document that the need could not have been anticipated or planned for and precludes the State from following the prior approval requirements of paragraph (c) of this section. FNS may provide FFP in emergency situations if the following conditions are met:

(1) The State agency must submit a written request to FNS prior to the acquisition of any IS equipment or services. The written request shall include:

(i) A brief description of the IS equipment and/or services to be acquired and an estimate of their costs;

(ii) A brief description of the circumstances which result in the State agency's need to proceed with the acquisition prior to fulfilling approval requirements at paragraph (c) of this section; and

(iii) A description of the adverse impact which would result if the State agency does not immediately acquire the IS equipment and/or services.

(2) Upon receipt of a written request for emergency acquisition FNS shall provide a written response to the State agency within 14 days. The FNS response shall:

(i) Inform the State agency that the request has been disapproved and the reason for disapproval; or,

(ii) FNS recognizes that an emergency situation exists and grants conditional approval pending receipt of the State agency's formal submission of the IAPD information specified at paragraph (d)(2) of this section within 90 days from the date of the State agency's initial written request.

(iii) If FNS approves the request submitted under paragraph (i)(1) of this section, FFP will be available from the date the State agency acquires the IS equipment and services.

(iv) If the complete IAPD submission required by paragraph (d)(2) of this section is not received by FNS within 90 days from the date of the initial written request, costs may be subject to disallowance.

(j) General cost requirements -

(1) Cost determination. Actual costs must be determined in compliance with OMB Circular A-87 (available on OMB's Web site at http://www.whitehouse.gov/omb/circulars_default/) and an FNS approved budget, and must be reconcilable with the approved FNS funding level. A State agency shall not claim reimbursement for costs charged to any other Federal program or uses of IS systems for purposes not connected with SNAP. The approved APD cost allocation plan includes the methods which will be used to identify and classify costs to be claimed. This methodology must be submitted to FNS as part of the request for FNS approval of funding as required in paragraph (d) of this section. Operational costs are to be allocated based on the statewide cost allocation plan rather than the APD cost plan. Approved cost allocation plans for ongoing operational costs shall not apply to IS system development costs under this section unless documentation required under paragraph (c) of this section is submitted to and approvals are obtained from FNS. Any APD-related costs approved by FNS shall be excluded in determining the State agency's administrative costs under any other section of this part.

(2) Cost identification for purposes of FFP claims. State agencies shall assign and claim the costs incurred under an approved APD in accordance with the following criteria:

(i) Development costs. Using its normal departmental accounting system, in accordance with the cost principles set forth in OMB Circular A-87 (available on OMB's Web site at http://www.whitehouse.gov/omb/circulars_default/), the State agency shall specifically identify what items of costs constitute development costs, assign these costs to specific project cost centers, and distribute these costs to funding sources based on the specific identification, assignment and distribution outlined in the approved APD. The methods for distributing costs set forth in the APD should provide for assigning identifiable costs, to the extent practicable, directly to program/functions. The State agency shall amend the cost allocation plan required by § 277.9 (administrative cost principles) to include the approved APD methodology for the identification, assignment and distribution of the development costs.

(ii) Operational costs. Costs incurred for the operation of an IS shall be identified and assigned by the State agency to funding sources in accordance with the approved cost allocation plan required by § 277.9 (administrative cost principles).

(iii) Service agreement costs. States that operate a central data processing facility shall use their approved central service cost allocation plan required by OMB Circular A-87 (available on OMB's Web site at http://www.whitehouse.gov/omb/circulars_default/) to identify and assign costs incurred under service agreements with the State agency. The State agency shall then distribute these costs to funding sources in accordance with paragraphs (j)(2)(i) and (ii) of this section.

(3) Capital expenditures. The State agency shall charge the costs of IT equipment having unit acquisition costs or total aggregate costs, at the time of acquisition, of more than $25,000 by means of depreciation or use allowance, unless a waiver is specifically granted by FNS. If the equipment acquisition is part of an APD that is subject to the prior approval requirements of paragraph (c)(2) of this section, the State agency may submit the waiver request as part of the APD.

(4) Claiming costs. Prior to claiming funding under this section the State agency shall have complied with the requirements for obtaining approval and prior approval of paragraph (c) of this section.

(5) Budget authority. FNS approval of requests for funding shall provide notification to the State agency of the budget authority and dollar limitations under which such funding may be claimed. FNS shall provide this amount as a total authorization for such funding which may not be exceeded unless amended by FNS. FNS's determination of the amount of this authorization shall be based on the budget submitted by the State agency. Activities not included in the approved budget, as well as continuation of approved activities beyond scheduled deadlines in the approved plan, shall require FNS approval of an As Needed APD Update as prescribed in paragraphs (c)(3)(i)(D) and (d)(4) of this section, including an amended State budget. Requests to amend the budget authorization approved by FNS shall be submitted to FNS prior to claiming such expenses.

(k) Access to the system and records. Access to the system in all aspects, including but not limited to design, development, and operation, including work performed by any source, and including cost records of contractors and subcontractors, shall be made available by the State agency to FNS or its authorized representatives at intervals as are deemed necessary by FNS, in order to determine whether the conditions for approval are being met and to determine the efficiency, economy and effectiveness of the system. Failure to provide full access to all parts of the system may result in suspension and/or termination of SNAP funds for the costs of the system and its operation.

(l) Ownership rights -

(1) Software.

(i) The State or local government shall include a clause in all procurement instruments which provides that the State or local government shall have all ownership rights in any software or modifications thereof and associated documentation designed, developed or installed with FFP under this section.

(ii) FNS reserves a royalty-free, nonexclusive, and irrevocable license to reproduce, publish or otherwise use and to authorize others to use for Federal Government purposes, such software, modifications and documentation.

(iii) Proprietary operating/vendor software packages which meet the definition of COTS at paragraph (b) of this section shall not be subject to the ownership provisions in paragraphs (l)(1)(i) and (l)(1)(ii) of this section. FFP is not available for development costs for proprietary application software developed specifically for SNAP.

(2) Information Systems equipment. The policies and procedures governing title, use and disposition of property purchased with FFP, which appear at § 277.13 (Property) are applicable to IS equipment.

(m) Information system security requirements and review process -

(1) Information system security requirements. State and local agencies are responsible for the security of all IS projects under development, and operational systems involved in the administration of SNAP. State and local agencies shall determine appropriate IS security requirements based on recognized industry standards or compliance with standards governing security of Federal information systems and information processing.

(2) Information security program. State agencies shall implement and maintain a comprehensive Security Program for IS and installations involved in the administration of the SNAP. Security Programs shall include the following components:

(i) Determination and implementation of appropriate security requirements as prescribed in paragraph (m)(1) of this section.

(ii) Establishment of a security plan and, as appropriate, policies and procedures to address the following areas of IS security:

(A) Physical security of IS resources;

(B) Equipment security to protect equipment from theft and unauthorized use;

(C) Software and data security;

(D) Telecommunications security;

(E) Personnel security;

(F) Contingency plans to meet critical processing needs in the event of short- or long-term interruption of service;

(G) Emergency preparedness; and

(H) Designation of an Agency IS Security Manager.

(iii) Periodic risk analyses. State agencies shall establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. In addition, risk analyses shall be performed whenever significant system changes occur.

(3) IS security reviews. State agencies shall review the security of IS involved in the administration of SNAP on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security, operating procedures and personnel practices. State agencies shall maintain reports of their biennial IS security reviews, together with pertinent supporting documentation, for Federal review upon request.

(4) Applicability. The security requirements of this section apply to all IS systems used by State and local governments to administer SNAP.

[79 FR 12, Jan. 2, 2014]

This is a list of United States Code sections, Statutes at Large, Public Laws, and Presidential Documents, which provide rulemaking authority for this CFR Part.

This list is taken from the Parallel Table of Authorities and Rules provided by GPO [Government Printing Office].

It is not guaranteed to be accurate or up-to-date, though we do refresh the database weekly. More limitations on accuracy are described at the GPO site.


United States Code
U.S. Code: Title 7 - AGRICULTURE

§ 2011 - Congressional declaration of policy

§ 2012 - Definitions

§ 2012a - Publicly operated community health centers

§ 2013 - Establishment of supplemental nutrition assistance program

§ 2014 - Eligible households

§ 2015 - Eligibility disqualifications

§ 2016 - Issuance and use of program benefits

§ 2017 - Value of allotment

§ 2018 - Approval of retail food stores and wholesale food concerns

§ 2019 - Redemption of program benefits

§ 2020 - Administration

§ 2021 - Civil penalties and disqualification of retail food stores and wholesale food concerns

§ 2022 - Disposition of claims

§ 2023 - Administrative and judicial review; restoration of rights

§ 2024 - Violations and enforcement

§ 2025 - Administrative cost-sharing and quality control

§ 2026 - Research, demonstration, and evaluations

§ 2027 - Appropriations and allotments

§ 2028 - Consolidated block grants for Puerto Rico and American Samoa

§ 2029 - Workfare

§ 2030 - Repealed. Pub. L. 110–234, title IV, § 4115(b)(14), May 22, 2008, 122 Stat. 1108, and Pub. L. 110–246, § 4(a), title IV, § 4115(b)(14), June 18, 2008, 122 Stat. 1664, 1870

§ 2031 - Minnesota Family Investment Project

§ 2032 - Automated data processing and information retrieval systems

§ 2033 - Repealed. Pub. L. 107–171, title IV, § 4124(b), May 13, 2002, 116 Stat. 326

§ 2034 - Assistance for community food projects

§ 2035 - Simplified supplemental nutrition assistance program

§ 2036 - Availability of commodities for emergency food assistance program