Scope and application. This section establishes conditions for initial and continuing authority to claim Federal financial participation (FFP) for the costs of the planning, development, acquisition, installation and implementation of Information System (IS) equipment and services used in the administration of the Supplemental Nutrition Assistance Program (SNAP) and as prescribed by appropriate Food and Nutrition Service (FNS) directives and guidance (i.e., FNS Handbook 901, OMB Circulars, etc.).

Definitions. As used in this section:

Acquisition means obtaining supplies or services through a purchase or lease, regardless of whether the supplies or services are already in existence or must be developed, created or evaluated.

Advance Planning Document for project planning or Planning APD (APD or PAPD) means a brief written plan of action that requests FFP to accomplish the planning activities necessary for a State agency to determine the need for, feasibility of, projected costs and benefits of an IS equipment or services acquisition, plan the acquisition of IS equipment and/or services, and to acquire information necessary to prepare an Implementation APD.

Advance Planning Document Update (APDU) means a document submitted annually (Annual APDU) by the State agency to report the status of project activities and expenditures in relation to the approved Planning APD or Implementation APD; or on an as needed basis (As Needed APDU) to request funding approval for project continuation when significant project changes occur or are anticipated.

Commercial Off-the-Shelf (COTS) means proprietary software products that are ready-made and available for sale to the general public at established catalog or market prices in which the software vendor is not positioned as the sole implementer or integrator of the product.

Enhancement means modifications which change the functions of software and hardware beyond their original purposes, not just to correct errors or deficiencies which may have been present in the software or hardware, or to improve the operational performance of the software or hardware. Software enhancements that substantially increase risk or cost or functionality will require submission of an IAPD or an As Needed IAPDU.

Implementation Advance Planning Document or Implementation APD (IAPD) means a written plan of action requesting FFP to acquire and implement information system (IS) services and/or equipment. The Implementation APD includes the design, development, testing and implementation phases of the project.

Information System (IS) means a combination of hardware and software, data and telecommunications that performs specific functions to support the State agency, or other Federal, State or local organization.

Project means a related set of information technology related tasks, undertaken by a State, to improve the efficiency, economy and effectiveness of administration and/or operation of its human services programs. A project may also be a less comprehensive activity such as office automation, enhancements to an existing system, or an upgrade of computer hardware.

Request for Proposal (RFP) means the document used for public solicitations of competitive proposals from qualified sources as outlined in § 277.14(g)(3).

Requirements for FNS prior approval of IS projects—(1) General prior approval requirements. The State agency shall request prior FNS approval by submitting the Planning APD, the Implementation APD, an APD Update, the draft acquisition instrument, and/or the justification for the sole source acquisition if applicable, as specified in paragraph (c)(2) of this section. A State agency must obtain written approval from FNS to receive FFP of any of the following activities:

When it plans a project to enhance or replace its IS that it anticipates will have total project costs in Federal and State funds of $6 million or more.

Any IS competitive acquisition that costs $6 million or more in Federal and State funds.

When the State agency plans to acquire IS equipment or services non-competitively from a nongovernmental source, and the total State and Federal cost is more than $1 million.

For the acquisition of IS equipment or services to be utilized in an Electronic Benefit Transfer (EBT) system regardless of the cost of the acquisition in accordance with § 274.12 (EBT issuance system approval standards).

Specific prior approval requirements. (i) For IS projects which require prior approval, as specified in paragraph (c)(1) of this section, the State agency shall obtain the prior written approval of FNS for:

Conducting planning activities, entering into contractual agreements or making any other commitment for acquiring the necessary planning services;

Conducting design, development, testing or implementation activities, entering into contractual agreements or making any other commitment for the acquisition of IS equipment or services.

For IS equipment and services acquisitions requiring prior approval as specified in paragraph (c)(1) of this section, prior approval of the following documents associated with such acquisitions is also required:

Requests for Proposals (RFPs). Unless specifically exempted by FNS, the State agency shall obtain prior written approval of the RFP before the RFP may be released. However, RFPs for acquisitions estimated to cost less than $6 million or competitive procurements from non-governmental sources and that are an integral part of the approved APD, need not receive prior approval from FNS. The State agency shall submit a written request to get prior written approval to acquire IS equipment or services non-competitively from a nongovernmental source when the total State and Federal cost is $1 million or more. State agencies shall submit RFPs under this threshold amount on an exception basis. The State agency shall obtain prior written approval from FNS for RFPs which are associated with an EBT system regardless of the cost.

Contracts. All contracts must be submitted to FNS. Unless specifically exempted by FNS, the State agency shall obtain prior written approval before the contract may be signed by the State agency. However, contracts for competitive procurements costing less than $6 million and for noncompetitive acquisitions from nongovernmental sources costing less than $1 million and that are an integral part of the approved APD need not be submitted to FNS. State agencies shall submit contracts under this threshold amount on an exception basis. The State agency shall obtain prior written approval from FNS for contracts which are associated with an EBT system regardless of the cost.

Contract amendments. All contract amendments must be submitted to FNS. Unless specifically exempted by FNS, the State agency shall obtain prior written approval from FNS of any contract amendments which cumulatively exceed 20 percent of the base contract costs before being signed by the State agency. The State agency shall obtain prior written approval from FNS for contracts which are associated with an EBT system regardless of the cost.

Procurement requirements. (A) Procurements of IS equipment and services are subject to § 277.14 (procurement standards) regardless of any conditions for prior approval contained in this section, except the requirements of § 277.14(b)(1) and (b)(2) regarding review of proposed contracts. Those procurement standards include a requirement for maximum practical open and free competition regardless of whether the procurement is formally advertised or negotiated.

The standards prescribed by § 277.14, as well as the requirement for prior approval in this paragraph (c), apply to IS services and equipment acquired primarily to support SNAP regardless of the acquiring entity.

The competitive procurement policy prescribed by § 277.14 shall be applicable except for IS services provided by the agency itself, or by other State or local agencies.

The State agency must obtain prior written approval from FNS, as specified in paragraphs (c)(2)(i) and (c)(2)(ii) of this section, to claim and receive reimbursement for the associated costs of the IS acquisition.

Document submission requirements. (i) For IS projects requiring prior approval as specified in paragraphs (c)(1) and (c)(2) of this section, the State agency shall submit the following documents to FNS for approval:

Planning APD as described in paragraph (d)(1) of this section.

Implementation APD as described in paragraph (d)(2) of this section.

Annual APDU as described in paragraph (d)(3) of this section. The Annual APDU shall be submitted to FNS 60 days prior to the expiration of the FFP approval, unless the submission date is specifically altered by FNS. In years where an As Needed APDU is required, as described in paragraph (c)(3)(i)(D) of this section, FNS may waive or modify the requirement to submit the annual APDU.

As Needed APDU as described in paragraph (d)(4) of this section. As Needed APDU are required to obtain a commitment of FFP whenever significant project changes occur. Significant project changes are defined as changes in cost, schedule, scope or strategy which exceed FNS-defined thresholds or triggers. Without such approval, the State agency is at risk for funding of project activities which are not in compliance with the terms and conditions of the approved APD and subsequently approved APDU until such time as approval is specifically granted by FNS.

Acquisition documents as described in § 277.14(g).

Emergency Acquisition Requests as described in paragraph (i) of this section.

The State agency must obtain prior FNS approval of the documents specified in paragraph (c)(3)(i) of this section in order to claim and receive reimbursement for the associated costs of the IS acquisition.

Approval by the State agency. Approval by the State agency is required for all documents and acquisitions specified in § 277.18 prior to submission for FNS approval. However, the State agency may delegate approval authority to any subordinate entity for those acquisitions of IS equipment and services not requiring prior approval by FNS.

Prompt action on requests for prior approval. FNS will reply promptly to State agency requests for prior approval. If FNS has not provided written approval, disapproval or a request for additional information within 60 days of FNS' acknowledgment of receipt of the State agency's request, the request will be deemed to have provisionally met the prior approval requirement in this paragraph (c). However, provisional approval will not exempt a State agency from having to meet all other Federal requirements which pertain to the acquisition of IS equipment and services. Such requirements remain subject to Federal audit and review.

APD content requirements—(1) Planning APD (PAPD). The PAPD is a written plan of action to acquire proposed services or equipment and to perform necessary activities to investigate the feasibility, system alternatives, requirements and resources needed to replace, modify or upgrade the State agency's IS. The PAPD shall contain adequate documentation to demonstrate the need to undertake a planning process, as well as a thorough description of the proposed planning activities, and estimated costs and timeline, as specified by FNS in Handbook 901.

Implementation APD (IAPD). The IAPD is a written plan of action to acquire the proposed IS services or equipment and to perform necessary activities to design, develop, acquire, install, test, and implement the new IS. The IAPD shall contain detailed documentation of planning and preparedness for the proposed project, as enumerated by FNS in Handbook 901, demonstrating the feasibility of the project, thorough analysis of system requirements and design, a rigorous management approach, stewardship of federal funds, a realistic schedule and budget, and preliminary plans for key project phases.

Annual APDU content requirements. The Annual APDU is a yearly update to ongoing IS projects when planning or implementation activities occur. The Annual APDU shall contain documentation on the project activity status and a description of major tasks, milestones, budget and any changes, as specified by FNS in Handbook 901.

As Needed APDU content requirements. The As Needed APDU document shall contain the items as defined in paragraph (c)(3)(i)(D) of this section with emphasis on the area(s) where changes have occurred or are anticipated that triggered the submission of the APDU, as detailed by FNS in Handbook 901.

Service agreements. The State agency shall execute service agreements when IS services are to be provided by a State central IT facility or another State or local agency. Service Agreement means the document signed by the State or local agency and the State or local central IT facility whenever an IT facility provides IT services to the State or local agency. Service agreements shall:

Identify the IS services that will be provided;

Include a schedule of rates for each identified IS service, and a certification that these rates apply equally to all users;

Include a description of the method(s) of accounting for the services rendered under the agreement and computing services charges;

Include assurances that services provided will be timely and satisfactory;

Include assurances that information in the IS as well as access, use and disposal of IS data will be safeguarded in accordance with provisions of § 272.1(c) (disclosure) and § 277.13 (property);

Require the provider to obtain prior approval from FNS pursuant to paragraph (c)(1) of this section for IS equipment and IS services that are acquired from commercial sources primarily to support federally aided public assistance programs and require the provider to comply with § 277.14 (procurement standards) for procurements related to the service agreement. IS equipment and services are considered to be primarily acquired to support federally aided public assistance programs when the Programs may reasonably be expected to either be billed for more than 50 percent of the total charges made to all users of the IS equipment and services during the time period covered by the service agreement, or directly charged for the total cost of the purchase or lease of IS equipment or services;

Include the beginning and ending dates of the period of time covered by the service agreement; and

Include a schedule of expected total charges to the Program for the period of the service agreement.

State Agency Maintenance of Service Agreements. The State agency shall maintain a copy of each service agreement in its files for Federal review upon request.

Conditions for receiving Federal financial participation (FFP)—(1) A State agency may receive FFP at the 50 percent reimbursement rate for the costs of planning, design, development or installation of IS and information retrieval systems if the proposed system will:

Assist the State agency in meeting the requirements of the Food and Nutrition Act of 2008, as amended;

Meet the Automation of Data Processing/Computerization of Information Systems Model Plan program standards specified in § 272.10(b)(1) through (b)(3) of this chapter, except the requirements in § 272.10(b)(2)(vi), (b)(2)(vii), and (b)(3)(ix) of this chapter to eventually transmit data directly to FNS;

Be likely to provide more efficient and effective administration of the program; and

Be compatible with such other systems utilized in the administration of other State agency programs including the program of Temporary Assistance for Needy Families (TANF).

State agencies seeking FFP for the planning, design, development or installation of IS shall develop State wide systems which are integrated with TANF. In cases where a State agency can demonstrate that a local, dedicated, or single function (issuance or certification only) system will provide for more efficient and effective administration of the program, FNS may grant an exception to the State wide integrated requirement. These exceptions will be based on an assessment of the proposed system's ability to meet the State agency's need for automation. Systems funded as exceptions to this rule, however, should be capable to the extent necessary, of an automated data exchange with the State agency system used to administer TANF. In no circumstances will funding be available for systems which duplicate other State agency systems, whether presently operational or planned for future development.

Basis for continued Federal financial participation (FFP)—(1) FNS will continue FFP at the levels approved in the Planning APD and the Implementation APD provided that project development proceeds in accordance with the conditions and terms of the approved APD and that IS resources are used for the purposes authorized. FNS will use the APDU to monitor IS project development. The submission of the Update as prescribed in § 277.18(d) for the duration of project development is a condition for continued FFP. In addition, periodic onsite reviews of IS project development and State and local agency IS operations may be conducted by or for FNS to assure compliance with approved APDs, proper use of IS resources, and the adequacy of State or local agency IS operations.

Pre-implementation. The State agency must demonstrate through thorough testing that the system meets all program functional and performance requirements. FNS may require a pre-implementation review of the system to validate system functionality prior to State agency testing.

Testing. The State agency must provide a complete test plan prior to the start of the testing phase. The State agency must provide documentation to FNS of the results of User Acceptance Testing (UAT) before the system is piloted in a production environment. FNS concurrence to advance from testing to pilot is a condition for continued FFP. All aspects of program eligibility must be tested to ensure that the system makes accurate eligibility determinations in accordance with federal statutes and regulations and approved State policies, and that system functionality meets the required functional specifications. The State agency shall describe how all system testing will be conducted and the resources to be utilized in order to verify the system complies with SNAP requirements, system design specifications, and performance standards including responsiveness, usability, capacity and security. Testing includes but is not limited to unit testing, integration testing, performance testing, end-to-end testing, UAT and regression testing. During UAT detailed scripts covering all areas of program functionality shall be used so that any errors identified can be replicated, corrected and re-tested. At a minimum, the Test Plan shall address:

The types of testing to be performed;

The organization of the test team and associated responsibilities;

Test database generation;

Test case development;

Test schedule;

Documentation of test results;

Acceptance testing, to include functional requirements testing, error condition handling and destructive testing, security testing, recovery testing, controls testing, stress and throughput performance testing, and regression testing; and

The decision criteria, including specific test results which must be met before the State may exit the testing phase, the roles or titles of the individuals responsible for verifying that these criteria have been met, and the sign-off process which will document that the criteria have been met.

FNS may require any or all of these tests to be repeated in instances where significant modifications are made to the system after these tests are initially completed or if problems that surfaced during initial testing warrant a retest. FNS reserves the right to participate and conduct independent testing, as necessary, during UAT and at appropriate times during system design, development, implementation and operations.

Pilot. Prior to statewide rollout of the system there must be a test of the fully operational system in a live production environment. Pilots must operate until a state of routine operation is reached with the full caseload in the pilot area. The design of this pilot shall provide an opportunity to test all components of the system as well as the data conversion process and system performance. The duration of the pilot must be for a sufficient period of time to thoroughly evaluate the system (usually a minimum duration of three months). The State agency must provide documentation to FNS of the pilot evaluation. FNS approval to implement the system more broadly is a condition for continued FFP.

Post-implementation Review. After the system is fully implemented, FNS may conduct a review to validate that program policy is correctly applied, whether project goals and objectives were met, that IS equipment and services are being properly used and accurate inventory records exist, and the actual costs of the project.

Disallowance of Federal financial participation (FFP). If FNS finds that any acquisition approved under the provisions of paragraph (c) of this section fails to comply with the criteria, requirements and other undertakings described in the approved or modified APD, payment of FFP may be suspended or may be disallowed in whole or in part.

Emergency acquisition requirements. The State agency may request FFP for the costs of IS equipment and services acquired to meet emergency situations in which the State agency can demonstrate to FNS an immediate need to acquire IS equipment or services in order to continue operation of SNAP; and the State agency can clearly document that the need could not have been anticipated or planned for and precludes the State from following the prior approval requirements of paragraph (c) of this section. FNS may provide FFP in emergency situations if the following conditions are met:

The State agency must submit a written request to FNS prior to the acquisition of any IS equipment or services. The written request shall include:

A brief description of the IS equipment and/or services to be acquired and an estimate of their costs;

A brief description of the circumstances which result in the State agency's need to proceed with the acquisition prior to fulfilling approval requirements at paragraph (c) of this section; and

A description of the adverse impact which would result if the State agency does not immediately acquire the IS equipment and/or services.

Upon receipt of a written request for emergency acquisition FNS shall provide a written response to the State agency within 14 days. The FNS response shall:

Inform the State agency that the request has been disapproved and the reason for disapproval; or,

FNS recognizes that an emergency situation exists and grants conditional approval pending receipt of the State agency's formal submission of the IAPD information specified at paragraph (d)(2) of this section within 90 days from the date of the State agency's initial written request.

If FNS approves the request submitted under paragraph (i)(1) of this section, FFP will be available from the date the State agency acquires the IS equipment and services.

If the complete IAPD submission required by paragraph (d)(2) of this section is not received by FNS within 90 days from the date of the initial written request, costs may be subject to disallowance.

General cost requirements—(1) Cost determination. Actual costs must be determined in compliance with 2 CFR part 200, subpart E and USDA implementing regulations 2 CFR part 400 and part 415 and an FNS approved budget, and must be reconcilable with the approved FNS funding level. A State agency shall not claim reimbursement for costs charged to any other Federal program or uses of IS systems for purposes not connected with SNAP. The approved APD cost allocation plan includes the methods which will be used to identify and classify costs to be claimed. This methodology must be submitted to FNS as part of the request for FNS approval of funding as required in paragraph (d) of this section. Operational costs are to be allocated based on the statewide cost allocation plan rather than the APD cost plan. Approved cost allocation plans for ongoing operational costs shall not apply to IS system development costs under this section unless documentation required under paragraph (c) of this section is submitted to and approvals are obtained from FNS. Any APD-related costs approved by FNS shall be excluded in determining the State agency's administrative costs under any other section of this part.

Cost identification for purposes of FFP claims. State agencies shall assign and claim the costs incurred under an approved APD in accordance with the following criteria:

Development costs. Using its normal departmental accounting system, in accordance with the cost principles set forth in 2 CFR part 200, subpart E and USDA implementing regulations 2 CFR part 400 and part 415, the State agency shall specifically identify what items of costs constitute development costs, assign these costs to specific project cost centers, and distribute these costs to funding sources based on the specific identification, assignment and distribution outlined in the approved APD. The methods for distributing costs set forth in the APD should provide for assigning identifiable costs, to the extent practicable, directly to program/functions. The State agency shall amend the cost allocation plan required by § 277.9 (administrative cost principles) to include the approved APD methodology for the identification, assignment and distribution of the development costs.

Operational costs. Costs incurred for the operation of an IS shall be identified and assigned by the State agency to funding sources in accordance with the approved cost allocation plan required by § 277.9 (administrative cost principles).

Service agreement costs. States that operate a central data processing facility shall use their approved central service cost allocation plan required by 2 CFR part 200, subpart E and USDA implementing regulations 2 CFR part 400 and part 415 to identify and assign costs incurred under service agreements with the State agency. The State agency shall then distribute these costs to funding sources in accordance with paragraphs (j)(2)(i) and (ii) of this section.

Capital expenditures. The State agency shall charge the costs of IT equipment having unit acquisition costs or total aggregate costs, at the time of acquisition, of more than $25,000 by means of depreciation or use allowance, unless a waiver is specifically granted by FNS. If the equipment acquisition is part of an APD that is subject to the prior approval requirements of paragraph (c)(2) of this section, the State agency may submit the waiver request as part of the APD.

Claiming costs. Prior to claiming funding under this section the State agency shall have complied with the requirements for obtaining approval and prior approval of paragraph (c) of this section.

Budget authority. FNS approval of requests for funding shall provide notification to the State agency of the budget authority and dollar limitations under which such funding may be claimed. FNS shall provide this amount as a total authorization for such funding which may not be exceeded unless amended by FNS. FNS's determination of the amount of this authorization shall be based on the budget submitted by the State agency. Activities not included in the approved budget, as well as continuation of approved activities beyond scheduled deadlines in the approved plan, shall require FNS approval of an As Needed APD Update as prescribed in paragraphs (c)(3)(i)(D) and (d)(4) of this section, including an amended State budget. Requests to amend the budget authorization approved by FNS shall be submitted to FNS prior to claiming such expenses.

Access to the system and records. Access to the system in all aspects, including but not limited to design, development, and operation, including work performed by any source, and including cost records of contractors and subcontractors, shall be made available by the State agency to FNS or its authorized representatives at intervals as are deemed necessary by FNS, in order to determine whether the conditions for approval are being met and to determine the efficiency, economy and effectiveness of the system. Failure to provide full access to all parts of the system may result in suspension and/or termination of SNAP funds for the costs of the system and its operation.

Ownership rights—(1) Software. (i) The State or local government shall include a clause in all procurement instruments which provides that the State or local government shall have all ownership rights in any software or modifications thereof and associated documentation designed, developed or installed with FFP under this section.

FNS reserves a royalty-free, nonexclusive, and irrevocable license to reproduce, publish or otherwise use and to authorize others to use for Federal Government purposes, such software, modifications and documentation.

Proprietary operating/vendor software packages which meet the definition of COTS at paragraph (b) of this section shall not be subject to the ownership provisions in paragraphs (l)(1)(i) and (l)(1)(ii) of this section. FFP is not available for development costs for proprietary application software developed specifically for SNAP.

Information Systems equipment. The policies and procedures governing title, use and disposition of property purchased with FFP, which appear at § 277.13 (Property) are applicable to IS equipment.

Information system security requirements and review process—(1) Information system security requirements. State and local agencies are responsible for the security of all IS projects under development, and operational systems involved in the administration of SNAP. State and local agencies shall determine appropriate IS security requirements based on recognized industry standards or compliance with standards governing security of Federal information systems and information processing.

Information security program. State agencies shall implement and maintain a comprehensive Security Program for IS and installations involved in the administration of the SNAP. Security Programs shall include the following components:

Determination and implementation of appropriate security requirements as prescribed in paragraph (m)(1) of this section.

Establishment of a security plan and, as appropriate, policies and procedures to address the following areas of IS security:

Physical security of IS resources;

Equipment security to protect equipment from theft and unauthorized use;

Software and data security;

Telecommunications security;

Personnel security;

Contingency plans to meet critical processing needs in the event of short- or long-term interruption of service;

Emergency preparedness; and

Designation of an Agency IS Security Manager.

Periodic risk analyses. State agencies shall establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. In addition, risk analyses shall be performed whenever significant system changes occur.

IS security reviews. State agencies shall review the security of IS involved in the administration of SNAP on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security, operating procedures and personnel practices. State agencies shall maintain reports of their biennial IS security reviews, together with pertinent supporting documentation, for Federal review upon request.

Applicability. The security requirements of this section apply to all IS systems used by State and local governments to administer SNAP.