The IA Process - Information Assurance Architecture - page 51

IA 2 Process

Discover & Analyze
As-Is

Define & Produce
Transition Artifacts

Preparation to define To-Be

Figure 3.1 iA 2 process.

ments, and enterprise life cycle management (ELCM) phases (see Figure 2.1). Each
view presents a different operational perspective.
he IA 2 Process identifies business and technical risks by applying all relevant
aspects for each IA 2 F view against the IA core principles, as well as any applicable
compliance requirements (which may need to be identified). The following sections
elaborate on each IA 2 Process phase and provide additional details on the use of IA 2
Framework during the IA 2 Process.

3.3.1 Articulate the Intent

3.3.1.1 Define What the Solution Is and What It Is for

here are two parts to the IA 2 P statement of intent. The first part should articulate
whether the IA 2 P is to generate stand-alone IA documents or to augment a business
function, process, workflow, system, or another set of documents. The second part
relates to the project at hand, specifically the IA portion of that project. In terms
of the project, the statement of intent specifies what the project is for and what the
project is; and what the IA is for and what the IA is in relation to the project.
While the project may be to enhance a particular business function, to develop
a product, to develop a system or an application, or to create a business service, the
IA intent will always address a business risk. State the IA intent in terms of what
business risk that IA addresses. In terms of what the solution is, state the intent of
IA as an IA service, an IA mechanism, and the specifics of either or both. Perhaps
the intent is to develop a hardware device or a software application, or to create a
new business function that uses existing people and technology, or a new service
that may be a manual service or a Web service. The intent of IA is not separate from
the intent of the project. The project may create or enhance a product or service.
There are inherent risks of a new product or service. There are inherent risks to
modifying an existing product or service. There are enterprise risks when integrat-