Ministry of Panchayati Raj e-PRI Study Project - Phase IV ... · e-PRI Study Project - Phase IV Detailed Project Report ... e-PRI Study Project (Phase IV) Detailed Project Report

e-PRI Study Project (Phase IV) Detailed Project Report – Uttarakhand

Ministry of Panchayati Raj

e-PRI Study Project - Phase IV

Detailed Project Report for

Panchayati Raj Institutions

in State of Uttarakhand

By

National Informatics Centre Services Inc. March, 2010

e-PRI Study Project (Phase IV) Detailed Project Report - Uttarakhand

National Informatics Centre Services Inc. Page 2 of 194

Confidentiality Statement

This report is intended solely for the information and use of the Ministry of Panchayati Raj, Government of India, State Panchayati Raj Department, Government of Uttarakhand, National Informatics Centre and should not be used, circulated, quoted or otherwise referred to for any other purpose by any institution or individual other than the Ministry, State PR department and National Informatics Centre, nor included or referred to in whole or in part in any document without the prior consent of National Informatics Centre Services Inc. or the Ministry.



Acknowledgment

The ePRI Mission Mode Project holds great promise for the rural masses as it aims at streamlining the delivery of government services to them through Panchayats. This is a one of its kind nation-wide IT initiative initiated by Ministry of Panchayati Raj, Government of India (GoI). Being a part of this endeavor to computerize the Panchayati Raj Institutions has been an enriching experience for the entire e-PRI team.

On behalf of National Informatics Centre Services Inc. (NICSI), we would like to express our gratitude towards the Central Line Ministries, State Government officials, the State Panchayati Raj department, the officials and stakeholders at various levels of PRIs, for their kind support and guidance during the course of study.

We would like to extend special thanks to Shri. A.N.P. Sinha, Secretary, MoPR for his continued support and thought leadership in defining the vision and objectives for this study.

Also we are thankful to Shri. D.K. Jain, Joint Secretary, MoPR, for providing continuous guidance and support in formulating the contours of the project and intervening at crucial times to iron out issues faced by us during the process of interactions with various government officials.

Our sincere thanks to Dr. B.K. Gairola, Director General, NIC for providing opportunity to participate in this unique initiative with potentially far reaching impact, for sharing his vision and insights on empowerment of Panchayati Raj Institutions through computerization and also for providing his valuable guidance and directions to the team for effectively executing the project.

Our special thanks to Mr. D.C. Misra, Senior Technical Director, and Ms Rama Hariharan, Technical Director, NIC in setting overall guidelines and roadmap for project execution, in thrashing out critical issues faced by the field teams, in ensuring support from NIC state and District officials and in proactively addressing the issues to ensure timely execution at each step of the project.

The availability of right infrastructure is one of the critical elements in smooth execution of a project and we would like to extend our thanks to Ms. Junu Kailay, MD, NICSI who ensured a smooth take off for the project.

The constant guidance and coordination support extended by the State Informatics Officers of NIC state units and the various District Informatics Officers of NIC District units was a considerable enabler for the state team as it helped us to complete the state and district level study and carry out extensive interactions with senior officials in the state and districts within the stipulated time.

Last but not the least; we take this opportunity to thank all the members of the central team, consisting of Ms. Anjali Dhingra, Technical Director, NIC, Shri. Adesh Gupta, Senior Systems Analyst, NIC, Ms. Meghna Shrimali, Principal Consultant, Mr. Anand Dubey, Senior Consultant, Mr. Ashish Nasa, Senior Consultant, Ms. Barkha Shah, Senior Consultant and Ms. Seela Swain,



Senior Consultant who have admirably rendered their responsibilities with team spirit throughout the execution and management of this huge study project.

The involvement and support of all these senior officials has enabled us to understand the expectations of the project clearly. This will go a long way in defining the overall success of the project

ePRI Project - Uttarakhand Team

SIO Dr. Shukla Tech. Head Mr. Rajesh Goyal

DIO Ratan Singh SME, Mr. SD Bahuguna (ex-DPRO)

Pr. Consultant(s) Hitesh Bhayana Sr. Consultant(s) Nitin Chandrakar Sr. Consultant(s) Ravi Thatavarthy



Table of Content 1 EXECUTIVE SUMMARY ................................................................................................................... 8

2 PROJECT BACKGROUND .............................................................................................................. 11

3 APPROACH AND METHODOLOGY ............................................................................................... 18

4 ASSUMPTIONS / PRE REQUISITES .............................................................................................. 21

5 REQUIREMENTS FOR E-PRI APPLICATION DEVELOPMENT ..................................................... 24

6 REQUIREMENTS FOR ICT AND CONNECTIVITY ......................................................................... 76

7 CAPACITY BUILDING REQUIREMENTS ....................................................................................... 82

8 CHANGE MANAGEMENT REQUIREMENTS ................................................................................. 96

9 IMPLEMENTATION STRATEGY ................................................................................................... 107

10 PROGRAM MANAGEMENT STRUCTURE ................................................................................... 118

11 FINANCIAL SOLUTION ................................................................................................................. 146

12 RECOMMENDATION AND CONCLUSION ................................................................................... 152

13 WAY FORWARD ........................................................................................................................... 153

ANNEXURE I – GLOSSARY .................................................................................................................. 154

ANNEXURE II – DETAIL COSTING TABLE ........................................................................................... 155

ANNEXURE III – ENVISAGED SCENARIO POST IMPLEMENTATION OF EPRI ................................. 164

ANNEXURE IV – COMPONENTS OF THE LOGICAL ARCHITECTURE .............................................. 168

ANNEXURE V – COMPONENTS OF THE LOGICAL ARCHITECTURE ............................................... 192

ANNEXURE VI – POWER BACKUP OPTIONS ..................................................................................... 194



List of Tables

Table 1: User Groups of e-PRI ................................................................................................... 29 Table 2: Functionalities of GUI Layer components ..................................................................... 34 Table 3: Functionalities of G2G Applications .............................................................................. 39 Table 4: Functionalities of G2C Support components ................................................................ 51 Table 5: Functionalities of support Modules ............................................................................... 55 Table 6: Functionalities of support components ......................................................................... 56 Table 7: Functionalities of Application Security Components ..................................................... 59 Table 8: Training Requirement at PRIs ....................................................................................... 86 Table 9: UIRD Extension Training Centre ................................................................................... 93 Table 10: Monitoring related Communication Plan ..................................................................... 97 Table 11: Sensitization related Communication Plan ............................................................... 103 Table 12: Implementation Plan ................................................................................................. 111 Table 13: Details of State Level Review Meeting ..................................................................... 132 Table 14: State Level Field Monitoring Component .................................................................. 133 Table 15: Monitoring reports ..................................................................................................... 134 Table 16:- Bill of Material (PMU) ............................................................................................... 135 Table 17: Risk Impact & Mitigation ........................................................................................... 136 Table 18: Risk Priority ............................................................................................................... 144 Table 19: Total Head wise e-PRI Expenses ............................................................................. 146 Table 20: Channel wise G2C component users ....................................................................... 170 Table 21: e-PRI Communication Media .................................................................................... 172



List of Figures

Figure 1: Project Approach ......................................................................................................... 18 Figure 2: Approach and Methodology for DPR ........................................................................... 20 Figure 3: e-PRI Logical Architecture ........................................................................................... 27 Figure 4: e-PRI Application Architecture ..................................................................................... 33 Figure 5 - Information Security Architecture ............................................................................... 74 Figure 6: e-PRI Deployment Architecture ................................................................................... 77 Figure 7: e-PRI Network Architecture ......................................................................................... 79 Figure 8: Implementation Phases ............................................................................................. 114 Figure 9: Central Level Body for e-PRI MMP implementation .................................................. 120 Figure 10: CPMU structure ....................................................................................................... 122 Figure 11: Programme Governance Structure at State Level ................................................... 125 Figure 12: SPMC structure ....................................................................................................... 127 Figure 13: District PMC Structure ............................................................................................. 130 Figure 14: DPMC Organization Chart ....................................................................................... 130 Figure 15: Risk Area Rating ...................................................................................................... 143 Figure 16: Total Head wise breakup of e-PRI Costing .............................................................. 147



1 Executive Summary The Ministry of Panchayati Raj (MoPR), as part of its mandated responsibility to strengthen the Panchayati Raj Institutions (PRIs) across the country, is keen to introduce e-Governance in all the PRIs of the country. The e-PRI Mission Mode project is a project of immense stature initiated by MoPR in association with National Informatics Centre (NIC) The needs of PRIs and citizens vary from state to state, due to variations in level of governance in PRIs and ICT readiness of states and PRIs. The e-PRI MMP was therefore, preceded by a comprehensive study to assess the current information and services needs of citizens, PRIs and other stakeholders (ISNA), identify the scope for re-engineering various functions and services carried out by PRIs, (BPR) culminating in the cost estimate for implementing the recommendations in a state wise Detailed Project Report (DPR). In Uttarakhand, the study was conducted at 3 level of PRIs i.e in Chamoli Zilla Panchayat (ZP), Joshimath Block Panchayat (BP) and Badagaon Gram Panchayat (GP). Intent of DPR - The DPR serves as the roadmap for operationalization of the e-PRI MMP in Uttarakhand. It provides details of the estimated cost for implementing the MMP in Uttarakhand, which includes ICT infrastructure requirements, state-specific software Applications, customization of centrally developed Applications, data digitization requirements, project management cost etc. The implementation plan for a period of 3 years is also provided. The DPR also proposes the Project Management and Monitoring structure for supervising the implementation.

Proposed Implementation Plan – Implementation of the ePRI project in the State of Uttarkhand is proposed to be undertaken in a Service Procurement Model (SPM) whereby a Service Procurement Agency (SPA) would be selected through a competitive and transparent bidding process. The SPA would provide the required ICT Infrastructure as well as provide trained computer literate manpower. The SPA would be provided adequate monthly service charges, as defined through the bidding process, to carry out the desired tasks. The implementation would be spread over a period of 3 years and would comprise of the following phases:

• RFP Phase – In this phase the RFP template provided by the MoPR will be customised to reflect the State-specific requirements. The outcome of this phase would be the selection of the Implementation Agency (IA).

• Deployment Phase – This phase would comprise installation and commissioning of the hardware at all the PRIs as well as augmentation of ICT infrastructure at the State Data Centre or the NIC Data Centre for hosting the State-specific software applications, which will be developed at State level. Certain core common software applications have also been identified, which would be developed centrally by NIC and customised for each State.



Trainings will be provided on the usage of these software applications and one trained computer literate Panchayat Level Operator (PLO) will be provisioned at each PRI for backlog data entry and provision of services, both G2C and G2G, on an ongoing basis.

• Operations and Maintenance Phase – The manpower provisioned for data entry would continue providing operational support for a period of three years, during which the Panchayat officials / members are expected to enhance their skill sets and become sufficiently able to use computers including the various software applications.

To implement this project across the State in time-bound and effective manner the following 3-tier project management structure is proposed: 1. Central Level Body – Headed by Secretary, MoPR 2. State Level Body – Headed by Principal Secretary, PR Department, Uttarakhand 3. District Level Body – Headed by CEO, ZP of the respective districts The State level body would be supported by a Project Management Unit (PMU) for monitoring the implementation and operations of the project. To ensure robust monitoring a Block Support Group (BSG), comprising of one resource at each block, is also envisaged. These resources would monitor the project activities at all PRIs in their assigned blocks and provide inputs to the PMU for monitoring Uttarakhand state cost estimates - The total ePRI project cost for the State of Uttarakhand is estimated at Rs. I88.44 cr, which includes costs for ICT (Rs 159.08 cr. approximately), Training (Rs 16.93 cr. approximately), IEC (Rs 1.64 cr. approximately), Project Management Unit (Rs 6.09 cr. approximately) at the state level and Block Support Group (Rs. 4.69 cr.) at block level. The ICT cost estimates include: a) Costs for provision of ICT infrastructure to the PRIs at the State/ZP/BP/GP level as well

as to the data centre and the Project Management Unit. b) Cost of Application development- This includes cost of development of modules at the

State, customization cost of modules developed at the Centre and cost of integration of existing PRI applications and their customization.

c) Cost for trained PLO to be deployed at all GP, BP and ZP (Rs. 94.57 cr. approximately)

Considering the above costs, the average monthly service charges for a ZP would be Rs 9061.79, BP would be Rs 6793.31 and for a GP Rs 5556.31 approximately. However, the actual payouts would be considerably reduced owing to the local market dynamics realized through the competitive bidding process. The suggested implementation strategy and estimated costs provided in this report have been calculated on certain underlying assumptions, both, common across the states and specific to the state of Uttarakhand. Some key common assumptions include: • Using NICSI empanelment rates for costing • The implementation will start within one year of the release of this report



• The civil infrastructure requirements of the PRIs, if any, will be funded by other sources such as NREGS, BRGF, RGSY, Finance commission grants etc.

• Provision for training to be made with respect to the ePRI application only Pre-requisites and assumptions specific to Uttarakhand include: • e-PRI MMP will leverage existing technology infrastructure projects (SWAN, SDC, SSDG,

etc) and physical infrastructure where available. Likewise, the laptops, desktops, UPS, printers and internet connections that currently exist will be leveraged by the e-PRI MMP. Such inclusions / exclusions have been factored into the DPR costing

• In order for the team’s recommendations to hold good, there are certain legal changes that have been identified. These have to be perused by the State PR Department and promulgated prior to the e-PRI MMP implementation and roll out.

• The State shall approve the use of technology advancements such as Digital signatures and pass appropriate amendments to facilitate ICT adoption through e-PRI

Subsequent to the presentation and approval of this document, the cost estimates in the State DPR will be finalized. All the state DPRs would then be consolidated into a National DPR at the central level.



2 Project Background Panchayati Raj Institutions (PRIs) in India are an indigenous concept of local self governance which promotes decentralized governance by participation of the ordinary public in their own governance. This process of democratic decentralization was set in motion with the Constitution (Seventy Third Amendment) Act passed by the Indian Parliament in 1992, which enabled decentralized governance through PRIs in rural areas.

PRIs function at the village, intermediate (Block) and District level. There are approximately 2,34,030 Gram Panchayats at the village level, 6,053 Janpad Panchayats at the Block level and 535 Zila Panchayats at the District level. There are more than 31 lakh elected representatives at all three tiers.

PRIs offer India’s rural villagers an opportunity to participate in village planning processes, to engage with the various developmental schemes being implemented by the Government and to interact with their elected representatives directly to ensure that their interests are being effectively served and their money properly spent.

While local governance through PRIs is an excellent concept but has so far remained in theory, reality has been less positive, as many PRIs have been criticized for poor representation, failure to implement the participatory decisions of their constituencies and mismanagement of funds. In this context, citizen participation in Panchayat institutions is more meaningful when people have the information to make informed choices and to participate in decision-making processes based on facts, not rumours and half-truths.

The PRIs are also saddled with the problems of inadequate capacity vis-à-vis physical and financial resources, technical capabilities and extremely limited computerization. This has limited the usefulness of PRIs as the preferred delivery channel for the schemes of State and Centre as well as for citizen services.

Computerization and IT enablement of government functioning has received a high impetus with the implementation of the National eGovernance Programme of Government of India and various states have realized the importance of eGovernance. This has led to a concerted thrust towards computerizing the functioning of the state line departments in most of the states. The result of this is cognizable and has brought in its wake significant efficiencies in the departmental functioning.

While some computerization efforts for PRIs have been made by NIC over the years; unfortunately, the eGovernance revolution sweeping the country has not touched the PRIs yet in significant measure. The Ministry of Panchayati Raj, Government of India has realized this and decided to take up the computerization of PRIs on a mission mode basis.



The Ministry of Panchayati Raj is mandated to ensure effective local self governance in rural areas and is therefore committed to strengthening the PRIs. To achieve this MoPR in association with NICSI has conceptualized a nation-wide study to take stock of the needs and expectations of various stakeholders from PRIs and also the needs and expectations of PRIs from various stakeholders. This study is expected to result in drafting the requirements of computerization for PRIs across the country and is being undertaken across 27 states within duration of 23 weeks.

This initiative poses unique challenges, as the coverage of the programme is in itself unprecedented not only in India but perhaps globally too. The geographic and demographic coverage of the programme, therefore, makes it a challenging initiative to rollout.

In addition, the level of devolution of powers to PRIs across the country varies depending upon the provisions of the State Panchayati Raj Act and the spirit with which the devolution has been undertaken in a particular State/UT. This implies that the services that could be delivered to the citizens by Village Panchayats in one State/UT could differ from another. Consequently, design of the process re-engineering, computerization and capacity building programme would face significant challenges. This also leads to related challenges around stakeholder’s involvement in the programme.

This project entails carrying out the following three activities: 1. Identification of Information and Services Needs of Stakeholders 2. Process Re-engineering and 3. Preparation of Detailed Project Report for the MMP

The project execution primarily was carried out across the following five tiers: 1. Central Line Ministries level 2. State level 3. Zila Panchayat level 4. Block Panchayat level 5. Village Panchayat level

2.1 Brief Background of PRIs in Uttarakhand Uttarakhand has a three-tier Panchayat structure and comprises of 13 ZPs, 95 BPs and 7541 GPs. Its legal basis is set out on the basis of the Uttar Pradesh Kshetra Panchayat and Zila Panchayat Act of 1961 and the Uttar Pradesh Panchayat Raj Act of 1947, as modified by the Uttarakhand Government under by the Uttar Pradesh Kshetra Panchayat and Zila Panchayat Act (Uttarakhand Adoption and Modification Orders) in October 2001 and in January 2002.



Uttarakhand Government had issued G.O for devolution of 14 subjects under 11 Departments. However, only 3 subjects; rural housing, poverty alleviation and women and child welfare has been devolved while devolution of other subjects are still to be implemented. Activity mapping is not done for the devolved functions.

The PRIs in Uttarakhand currently receives fund from 5 different sources:

1. Central Government (under 12th Finance Commission). 2. 2nd State Finance Commission. 3. Panchayat Vikas Nidhi / fund. 4. MP/MLA Development Fund. 5. Funds for Centrally Sponsored Schemes.

These funds are utilized to implement various schemes and non scheme related activities and development works. Apart from this the tax collected at various level of PRI’s (under section 27, 131 and 119 of PR Act) and donation are also utilized for development activities. Gram Panchayat Vikas Adhikari, Sahiyka/ Karykarti (Bal Vikas, Mahila Vikas) are functionaries devolved at GP level while ADO is functionaries devolved at BP level. No functionaries at ZP level are completely devolved.

The PRI’s at all of the 3 level in Uttarakhand is constituted of 6 Committees namely; Planning and Development Committee, Education Committee, Construction Work Committee, Health Committee, Administrative Committee and Water Management Committee. These Committees are constituted of PRI’s members and are involved in Planning, Implementation and Monitoring of various schemes and non schemes. In some of the schemes and non scheme activities PRI’s has partial or no involvement. The state PR Department is not a member of any state level Committee. Uttarakhand PRI department and study team have identified G2C services for process re-engineering purpose. All of these services were prioritized keeping in mind the perspective of village citizens’ requirements. Existing Services from Gram Panchayats GP 1: Registration of Birth & Death

• Issuance of Birth Certificate. • Issuance of Death Certificate.

GP 2: Family registers updation & issue of its certified copy. • Cancellation of name from Family Register and issue of certificate. • Copy of Family register for obtaining Successor Certificate

GP 3: Forwarding of Ration card Application. GP 4: Updating BPL Family List GP 5: Register complaints/ grievances & redressal



GP 6: Registration of unemployed under NREGA GP 7: Providing Information under RTI Act Existing Services from Zila Panchayats ZP 1: Fees collection from Shop of Mela ZP 2: Tax Collection from Commercial Establishment ZP 3: License Fees for Shop/Industry. Desired Services by Citizens

• Forwarding of application, providing information on Domicile Certificate and its delivery to citizen.

• Forwarding of application, providing information on Income Certificate and its delivery to citizen.

• Forwarding of application, providing information on Caste Certificate and its delivery to citizen.

• Status of Pension Application – Old Age, Widow. • Copy of Land Record.

2.1.1 Summary of ISNA findings The following are the key findings that have been assessed at a part of the ISNA phase. For details please refer to the ISNA report

I. ICT a. Lack of infrastructure like computers, connectivity etc at various levels of PRIs make the

data collection, consolidation and processing cumbersome and time consuming. b. Lack of Automation: Data collection, storage, record keeping is manual across the PRIs

leading to data inconsistency, data duplication, data corruption and lack of data security. c. Content Management: The grassroots level data is sought by various departments for

different purposes. Data inconsistencies are often noticed in data from different departments. Also, every department has data collection, management and coding systems aligned to their specific requirements, which lends the data unusable by other departments.

d. Information dissemination: Lack of an authentic central repository of scheme guidelines, Government Orders (GOs), plans, beneficiaries list, Minutes of Meetings (MoMs) of Gram Sabha, Standing Committees meetings etc, makes information availability a bottleneck in effective functioning.

e. Integrated portals for all schemes/services: Various schemes / services are provided by different line departments. Separate software, user interfaces, menu styles make it difficult for the users to become adept in using the software.

II. Panchayat Functions



a. All internal functions of the PRIs viz. Planning, Accounting etc are manual except for a few schemes like NREGS. This leads to delay in the processes of Planning, Implementation, Monitoring and Accounting across the PRIs.

b. Planning: The data for planning is sought from grassroots. Due to non availability of ICT infrastructure at GP level, the data is provided to BP in handwritten form, leading to excessive paper work and inordinate process delays. Also, the consolidation of data at the Block level is usually done manually lending a high probability of inaccurate data consolidation.

c. Accounting: The accounts of GP are manually maintained in several registers which may be further compiled at Block level. In such cases the probability of manipulation is high, due to high time lag in accounts closing.

d. Integration of PRIs: ZPs in Uttarakhand work as an autonomous body and BP/GP comes under State Govt. This leads to information mismatch and improper monitoring. ZP does not keep track of accounts at BP and GP level. Integration of ZP, BP and GP is required.

e. Monitoring & Reporting: For monitoring purpose, most line departments use manually prepared progress reports, which are prone to calculation and/or data entry errors. Analysis of the manual report is dependent on the skill-sets of the individual reading the report and does not always generate decision making inputs. The utilization of manual reports is limited as they cannot be customized easily. Also, storage and retrieval of these reports is cumbersome and time consuming.

III. Capacity a. Availability of adequate, trained & skilled manpower: Computer literate manpower for

data entry is not readily available at the GP level. At BP & ZP levels too, the available manpower is not adequate to handle the existing workload

IV. Service Delivery a. Easy and Quick service delivery: A clear need for delivery of government service at the

door step of the citizen emerged as a part of the Information & Services Needs assessment exercise.

b. Low reach of service delivery: Citizens need to travel to district/tehsil to avail services. They expect Gram Panchayats to act as ‘Single Window’ for availing any service including those delivered by other Line Departments

c. Service delivery time is required to be defined: Due to lack of specific service levels for most services provided by PRIs, there is little accountability of PRI processing and is highly individual dependent.

d. A grievance handling system: A grievance handling mechanism at GP level was almost non-existent. Adhoc grievance handling by Sarpach / Officials was observed.

e. Low Awareness Level: There is low awareness among citizens regarding schemes & services. Citizens are not fully aware of their entitlements and the responsibilities of the GP towards them.



V. Others a. New PR Act: A new PR act is needed as currently the State has adopted the Uttar Pradesh

PR Act and a separate PR Act for Uttarakhand has not yet been adopted. b. Insufficient Infrastructure: Lack of basic infrastructure such as electricity and furniture at

the GP office. Provisions of funds are required to create proper infrastructure at GP.

2.1.2 Summary of Key BPR recommendations The exhaustive list of recommendations has been provided in BPR report and the Key recommendations of BPR phase have been enlisted below.

I. ICT a. Provision of IT hardware to ZPs, BPs and GPs to enable them to deliver the services b. Providing last mile connectivity to GPs through broadband. c. Physical integration of SWAN with ZP and BP offices. d. Provision of LAN to the ZP and BP offices and hubs at the GP offices e. Digitization of the existing registers and documents / records f. Provision of common, standard and integrated software for correspondence and

communication (emailing and messaging software) amongst all levels of PRIs.

II. Panchayat Functions a. It is recommended that standardized software & formats be used across PRIs for panchayat

functions such as planning, monitoring, implementation & accounting to ensure data consolidation & sharing. Automation of the panchayat functions will make process fast, more accurate and storage and retrieval of reports easy and speedy. Further it will also bring transparency by providing real time data.

b. Computerization of basic PR functions such as automatic generation of PF, Payroll, Monthly MIS reports for fund utilization, revenue collection, No of applications received and ones processed within SLAs etc

c. Create awareness about the importance of participative planning at all the levels. A well structure and PRI-focused awareness campaign should be designed to increase awareness among citizens

III. Capacity a. At least one computer literate manpower to be provisioned on contract, at all three levels of

PRIs. b. IT Training for PRI officials and members to be rolled out on a large scale. c. Basic IT skills to be made a key entry requirement for GP staff.

IV. Service Delivery a. Process – GP Office proposed to be made one stop shop for all G2C services.

Standardization of service delivery processes by using common process components like application verification, application approval, application rejection etc. is proposed to be



introduced. Updating / creation of Citizen charter, Providing acknowledgement receipts, option of printing certificate directly from system in local language and defining escalation matrix

b. Technology – It is proposed to have online applications / service requests / Certificates / Notices / POs; Digitization of key record and registers; Standardization of service request, with a pre printed serial number using Web based software for all services



3 Approach and Methodology

3.1 Overall Approach for ePRI study project A phased approach, dividing the project into four phases, each focusing on different aspects of the ePRI MMP initiative was undertaken. These included assessing requirements, recommending changes and improvements, and defining the rollout strategy and budget for the initiative.

Figure 1: Project Approach

Initiation and Planning phase (Phase I) Focused on setting the tone for execution of the project. The key outcomes of this phase were identification of stakeholders, finalization of the consultation mechanism with the stakeholders, and common templates for data gathering and deliverables. Information and Services Needs assessment phase (Phase II) involved interaction with the identified stakeholders. This phase resulted in forming an understanding of the information needs of stakeholders. The citizen centric services that are currently being delivered through PRIs and the services that are expected to be delivered through PRIs were also identified and studied. The Process Re-engineering phase (Phase III), entailed in-depth analysis of the identified services and the administrative framework associated with PRIs. This analysis led to the identification of key gaps in the current processes and the creation of a BPR framework. This framework was designed to be customizable for every state/UT to address state-specific requirements, while also taking into cognizance the similarities existing across the country. Eventually a To-Be scenario encompassing PRI internal automation, citizen service delivery and internal functions of Planning, Monitoring, Implementation and Accounting was defined.



The current phase, namely DPR preparation (Phase IV), is the eventual outcome of the study which defines the plan for implementation of ePRI MMP in each State/UT. The DPR primarily defines the ICT requirements across the three tiers of PRIs, the manpower and training requirements and the roll-out strategy along with the overall program governance and management structure. The budgetary requirements for this project have also been estimated. 3.2 Approach for DPR In order to arrive at a budget and implementation plan for implementing the recommendations made in the BPR, the BPR recommendations were translated into requirements. For each requirement, the associated costs were determined. Subsequently, a program management structure at the central, state and district level was designed, to supervise and co-ordinate the rollout over 3 years. An implementation plan was also defined for implementing the recommendations over 3 years in different phases. The key recommendations made in the BPR phase involved the following aspects: • Improvements in internal functions of PRIs viz. Planning, Monitoring, Implementation and

Accounting • IT applications for supporting the above internal functions and services • Service delivery mechanism to be followed for the re-engineered processes • ICT infrastructure required to support the above recommendations • Manpower and skills required for implementing the above recommendations • Requisite legal changes needed to implement the Envisaged Scenario These recommendations were translated into requirements and budgetary estimates as illustrated in the following figure.



Figure 2: Approach and Methodology for DPR

Ph a se III – BPR

Civ il In fra st ru ct u re Re q u ire m e n t s

En v isa g e d (T o -Be ) S ce n a rioS e rv ice D e liv e ry

In t e rn a l Fu n ct io n s

BPR Fra m e w o rk

Ph a se IV – D PR

Lo g ica l A rch it e ct u re

e PRIA p p lica t io n

A cce ss Ch a n n e ls

Ex t e rn a l In t e rfa ce s

U se rs

A p p lica t io n A rch it e ct u re

A p p lica t io n M o d u le s

S u p p o rt Fu n ct io n s

Co m m o n Co m p o n e n t s

H ig h Le v e l FR S

T e ch n o lo g y S o lu t io n

D e p lo y m e n t A rch it e ct u re

D a t a b a se A rch it e ct u re

S e cu rit y A rch it e ct u re

Pro g ra m M a n a g e m e n t

G o v e rn a n ce S t ru ct u re

C h a n g e M a n a g e m e n t

Im p le m e n t a t io n S t ra t e g y

Ca p a cit y B u ild in g

Pro je ct C o st

C iv il In fra st ru ct u re Re q u ire m e n t s

Ph a se III – BPR

Civ il In fra st ru ct u re Re q u ire m e n t s

En v isa g e d (T o -Be ) S ce n a rioS e rv ice D e liv e ry

In t e rn a l Fu n ct io n s

BPR Fra m e w o rk

Ph a se IV – D PR

Lo g ica l A rch it e ct u re

e PRIA p p lica t io n

A cce ss Ch a n n e ls

Ex t e rn a l In t e rfa ce s

U se rs

A p p lica t io n A rch it e ct u re

A p p lica t io n M o d u le s

S u p p o rt Fu n ct io n s

Co m m o n Co m p o n e n t s

H ig h Le v e l FR S

T e ch n o lo g y S o lu t io n

D e p lo y m e n t A rch it e ct u reD e p lo y m e n t A rch it e ct u re





Pro g ra m M a n a g e m e n t

G o v e rn a n ce S t ru ct u re

C h a n g e M a n a g e m e n t

Im p le m e n t a t io n S t ra t e g y

Ca p a cit y B u ild in g

Pro je ct C o st

C iv il In fra st ru ct u re Re q u ire m e n t s

The step-wise approach used for determining the requirements is detailed below:

Step 1: Translate automation recommendations into function solution and technical solution.

The technical solution consists of applications to be developed, databases to be deployed and related content management aspects. The associated budgetary estimates were also computed.

Step 2: Translate computerization recommendations into ICT requirements – This includes

defining the requirements and budget for ICT hardware, networking infrastructure and infrastructure for deployment in data centre.

Step 3: Translate capacity gaps into manpower requirements and training requirements for

PRI functionaries and elected representatives and the associated budget. Step 4: Design plan for awareness and communication about ePRI MMP to PRI officials,

elected representatives and rural citizens Step 5: Define strategy for implementation of ePRI MMP in the States/UTs over 3 years. This

includes a phased implementation plan with specific timelines and deliverables for each phase.

This enabled defining the total state-wise outlay for implementation of ePRI MMP. The following sections of the report explore the various aspects mentioned above in greater detail.



4 Assumptions / Pre requisites This section lists the assumptions and pre-requisites for e-PRI. These have been considered in the overall solution definition for e-PRI.

4.1 Assumptions The key assumptions made in preparation of the DPR are as given below:

Manpower

• As a part of the study, the teams have identified the gaps in the sanctioned posts versus the occupied posts with intent to know the capacity gap in day-to-day government functioning of the Panchayati Raj Department. The State DPRs will not budget for the addressing this gap. The DPRs will only budget for sourcing computer literate Panchayat Level Operators.

Training

• Although team has proposed various trainings related to soft skills, behavioral skills, Project Management etc but DPR shall only budget for ICT based trainings to Elected members & PRI officials

• Training for PRI officials & Elected Members - To be trained on basic ICT skills, common applications and state specific applications.

Application Development

• Application preparation (from URS phase to maintenance phase) for the most common applications will be done centrally. The associated budget will be added to the National DPR. It will also necessitate the need for State specific applications. The State specific applications need to be developed by the State, hosted and managed by them

• All state-specific applications should include multi-lingual support. As per the guidelines under e-PRI EFC Note, all applications developed under e-PRI (whether central or state-specific) should be unicode enabled and should be developed in open source software.

• If some applications have already been developed by the State, then e-PRI state DPRs will also budget for integration with these existing applications.

Hosting, Network & ICT

• Application management (hosting) – This will be done centrally for common applications. For applications that are specific to a particular state, the hosting will be done at the state level. The associated budget will be added to the State DPRs. Therefore, assuming that almost all states will have such specific requirements, we will need to budget for hosting infrastructure at each state



• It shall be assumed that an operational data centre will be existing in the State. This DPR will not budget for building a data centre.

• For budgeting for server requirements, NICSI central empanelment rates will be used. Only if NICSI central empanelment rates are not available for a particular aspect, then the market rate can be used.

• As we are assuming that there will already be a data centre in the State (SDC or NIC), this DPR does not budget for firewall, intrusion protection system etc., as they would already be installed in the data centre. Only the following aspects will be accounted for:

o Servers

o Storage space (SAN)

o Backup

o Hosting charges (assume NIC charges)

• Hosting of Databases - For common databases, the database design, development, and hosting will be done centrally by NIC. However, on completion, NIC will only act as the caretaker of the database and state will have complete ownership of the database. Accordingly, all charges related to common state-specific databases will not be added to state DPRs.

• The DPR shall include cost for security audit of applications

• Mail Server – This DPR assumes NICemail. The cost for additional mail servers, if any, will be added centrally and not in the state-specific DPRs.

• This DPR budgets for computerizing all 3 levels of PRIs. However, this is also dependent on the specific inputs provided by the State PR Department.

Civil Infrastructure

• In view of the existing initiatives like RG Seva Kendra etc. which are already in the process of providing civil infrastructure to PRIs, the e-PRI DPRs will not budget for civil infrastructure or office furniture in the GPs.

Budgeting

• The budgeting horizon considered for the DPR is a period of 3 years. The operating costs beyond this time period have not been factored.

• In order to budget for hardware, application preparation and management, sourcing manpower, and training, the central NICSI empanelment rates will be considered. These common rates will be used by all state teams to budget for the state requirements for hardware, applications, manpower and training.



Legal

• It is assumed that the spirit of democratic decentralization will not get diluted by any steps either at the Centre or at the State level. In this regard the 73rd Amendment and its enforcement is expected to get a fillip in the years to come. Hence investment in e-PRI MMP will bear benefits beyond the initial 4-5 years.

Others

• e-PRI MMP will leverage existing technology infrastructure projects (SWAN, SDC, SSDG, etc) and physical infrastructure where available. Likewise, the laptops, desktops, UPS, printers and internet connections that currently exist will be leveraged by the e-PRI MMP. Such inclusions / exclusions have been factored into the DPR costing.

4.2 Pre-requisites

This section lists the key pre-requisites that need to be in place for this DPR to hold good.

Manpower and Capacity Building

• The DPR mandates certain governance structures which need to be put in place for the implementation and rollout of the e-PRI MMP. This is a pre-requisite for the successful implementation of the e-PRI MMP.

Legal / Regulatory

• The legal changes recommended in the State BPR reports, have to be necessary perused by the State PR Department and promulgated prior to the e-PRI MMP implementation and roll out.

• The State shall approve the use of technology advancements such as Digital signatures and pass appropriate amendments to facilitate ICT adoption through e-PRI.



5 Requirements for e-PRI Application Development

5.1 Envisaged Scenario

The BPR framework proposed (please refer BPR Vol 1 report) would result in overall improvement and enablement of PRIs institution to take up duties and functions as charted under the 73rd Amendment of the Constitution of India. The basic premise of bringing in local self governance through the PRI institution which are enabled and capacitated through tools required for discharge of their roles and responsibilities could be achieved through the proposed BPR solution. Further, the proposed e-PRI BPR framework when implemented would translate into improved functioning of Panchayat Raj Institution both in the external – citizen centric function and internal – government functions of the PRIs.

5.1.1 Government to Government Function The proposed BPR solution has resulted in highly integrated ‘Government to Government’ services of Planning, Implementation, Monitoring and Accounting across all levels of PRI institution – District level, Block level and Village level institution. It aims at providing a common solution with defined workflows and functionalities resulting in high work integration for achieving overall work outcome. This would also help in high data integrity, access of information, tracking of work progress, monitoring and reporting functions, etc. During the assessment phase, it was observed that all the three levels of PRIs are participating together for successful completion of Planning, Implementation, Monitoring and Accounting functions. The functions of PRIs are either flowing from a ‘Bottom up’ or a ‘Top down’ for successful completion. The datasets relating to the above mentioned functions are moving along the workflow on which other tiers of PRIs are acting upon. The current solution, in a way, attempts to integrate the overall function from all perspective using IT technology thus enabling the ‘end to end’ automated system with respect to Planning, Implementation, Monitoring and Accounting functions of the PRIs. A high level representation of workflow for Planning, Implementation, Monitoring and Accounting across all levels of PRI institution resulting from current BPR solution showing the interaction as well as flow of the work across all the tiers of PRIs is given below –

This section details the envisaged scenario (for both G2G & G2C services) and the Application Logical Architecture derived from the functional solution proposed in BPR phase. Further it explains the modules that will form the part do application architecture. It also detail out sub-components of logical architecture, which includes access channels, security framework etc. The section will have impact on total project cost in terms of ICT Infrastructure, application development and data digitization. The overall cost for implementing the proposed e-PRI application in Uttarakhand is estimated at Rs.0.84Cr





For detailed explanation of the envisaged scenario presented above please refer to Annexure II

5.1.2 Government to Citizen Functions The proposed BPR solution has provided a high citizen centric interface for availing government services at their doorstep. In the solution, the entire service lifecycle has been logically divided in 3 distinct phases – service request submission, service processing and service delivery. Various options could be utilized by the citizen as per their convenience to make service request thereby eliminating the need of physically visiting government departments. Further, a ‘window’ to have access to information on their service request has been embedded in the system where the citizens are continuously updated on the status of their service request. The service delivery against the service request has also been streamlines to provide options to the citizen to receive the output.

For detailed explanation of the envisaged scenario presented above please refer to Annexure II



5.2 Logical Architecture Logical Architecture of the e-PRI System presents a high level view of all the components that shall be included as a part of e-PRI System. The interactions between these components and with other components of the e-PRI application have been presented in the figure below.

Figure 3: e-PRI Logical Architecture

The above architecture is developed based on the BPR Framework as explained in BPR report. It would contain following components.

• Delivery Channel and Access Points: This component will cater to ensure smooth and secure access to the e-PRI System. It will include the various user groups that can access the e-PRI System. It also caters to the Access points or locations from where the



user groups can access the e-PRI System. It will also dwell on how these sub-components will interact with each other and the next layer to provide a secured service delivery to the users.

• Applications: This layer describes the internal structure of the e-PRI System. It caters to the Business Logic of the e-PRI System. It will focus on various core components required to deliver services as well as to carry out Internal PRI functions, the service delivery components that will interact with the Delivery channels, other support components that will facilitate execution of core functions and the workflow components that will interact with the next layer in the Architecture.

• Middleware: These are the components that will facilitate interaction between the Application layer and the e-PRI databases. These will act like a bridge between these two layers. These are also the components that will facilitate interaction between two different applications that may be a part of the e-PRI System as a whole, but are developed using different technologies.

• Databases: This layer acts as the storage layer for the e-PRI System. It ensures data are stored in standard and reusable formats and are readily accessible to authorized users as and when required. This layer will not only describe what data is stored in the e-PRI System, but will also describe how each database shall interact with the other in order to ensure smooth service delivery and efficient functioning of core PRI functions. This layer shall allow authorized users to Create, Update, Modify, Delete and Read data as and when required. It will also ensure that while these activities are being performed data security and data redundancy are being taken care of. It will also ensure that history of all database transactions is being maintained.

• System Software: This layer refers to the Operating systems and the utility programs that manage computer resources in the e-PRI System. This layer shall describe the various system software, that would be required to run the e-PRI System as a one system rather than as disparate systems.

• Hardware Infrastructure and Networking: This layer will act as the backbone of the entire e-PRI System. It will focus on all the hardware components required to run the e-PRI System. It will also talk about the locations where these hardware components will reside in the state and how they will interact with each other from their respective locations. It will also focus on various security components that will be installed at different locations in order to ensure maximum information security for the e-PRI System. This layer will also deal with how this layer will leverage other MMP projects in order to implement the e-PRI System in a comprehensive and efficient manner.

The main objective of this layer is to facilitate users to get easy access to data and the e-PRI Applications. The key objectives would be



• Providing users access to application and data regardless of location, access and delivery channels

• Providing users a single interface to different interoperable applications and modules

• Providing users with a common look and feel by re-using applications wherever possible

• Cater to the special needs of villagers where literacy rates are not very high, and citizens need assistance in availing services

Benefits to be accrued with this architecture

• 24/7 Access: Current system of e-PRI does not support high availability of services. In future as villages develop, this architecture will therefore ensure that citizens are able to avail services beyond office hours

• Improved and faster business transactions: Current system involves substantial manual intervention and lot of paper-work. With this architecture, application processing will be mostly online and faster.

• Better access to services: having access to all government services through a single window will ensure that citizens can interact with the PRIs in a timely manner.

• Sharing infrastructure and Software Services: This Architecture would help PRIs avoid the “Silo” approach to IT provision where separate software, hardware and infrastructure is procured and delivered to support individual channels.

• Lowering overall costs: overall cost of providing services is reduced due to shared infrastructure.

Detailed explanation of the all the major components of the logical architecture are presented in Annexure III

5.2.1 User Groups

The users who will interact with the e-PRI system to use various Applications are defined below:

The user groups that would be using or accessing the e-PRI System have been classified under the six stakeholder groups

Table 1: User Groups of e-PRI Sr User Group Purpose

1. Visionaries/ Sponsors These are government functionaries who would be envisioning the ICT and Developmental needs of the state. These would include functionaries like the Administrator, PR Secretary, Collectors, Deputy Collectors, and Secretaries of line departments and the DPRO – Zila Panchayat. This user group would mainly use the e-PRI application for following purpose

• To have an overview of the social needs and issues



Sr User Group Purpose prevailing at the grass root level

• Analyze needs and finalize developmental projects for the State

• Monitor both physical and social progress of the State as a whole

• Monitor Financial progress based on the funds allocated under various schemes

This user group will basically review the analytical reports generated by the e-PRI System and use them for the purpose of planning and budgeting as well as for approving plans.

2. Guide Posts/ Steering Committees

These are government functionaries who would enable plan execution and steer programs. These would include functionaries like the members of the District Planning Committees like the Block Development Officers, DPRO-Zila Panchayat, Secretary – IT, NIC DIOs, SIO, and Gram Panchayat Secretaries. They would use the e-PRI application for the following purpose:

• Analyze needs and prioritize projects identified at the GP and ZP Level.

• Prepare perspective plans and annual developmental plans at the District level.

• Approve procurement of services / products • Monitor and Audit funds expended on the

implementation of projects at the GP and ZP Level • Monitor physical and social progress at the ZP and GP

Level This user group will access plans submitted by the GPs and ZPs and consolidate them to identify and steer developmental projects. They will also access data submitted by the implementation agencies on the physical progress of the program/ schemes being implemented at the ZP and GP level. They will also define procedures and policies to be followed by the PRI functionaries.

3. Service Delivery Owners/ Project Managers

These are government functionaries with managerial and domain specific know-how to articulate and manage programs. These would include functionaries like Gram Panchayat Secretaries, Block Development Officers, ANMs and Karykarti etc. These would be using the e-PRI System for the following purpose:



Sr User Group Purpose • Create and manage content on procedures rules, SLAs

on the e-PRI system • Schedule meetings and manage MOMs • Manage overall service delivery at the respective GP

and ZP Offices • Plan, monitor and control projects approved under

various schemes and programs • Implement and manage projects at the Grass Root level • Manage transaction with vendors and service providers • Consolidate grass root data and prepare reports on

needs and issues This user group will mostly be the creators of data in the e-PRI System. They will manage and review data at the Grass root level as well as ensure that it is being stored in a re-usable format.

4. Service Delivery Machinery/ Back Office users

This group would include functionaries who will execute plans and will be the end users of back-end applications, such as BDOs, Class B & Class C staff reporting to line departments and staff reporting to the DPRO. These would be accessing the e-PRI System for the following purpose:

• Deliver and process applications submitted by the citizens

• Access e-PRI databases and process applications • Feed in data on physical and financial progress of

projects being implemented and monitor them against the project plans

• Create, Update, and Manage grass root data • Create and manage employee data • Define standards formats for data storage and access

rights for other PRI employees This group would basically use the e-PRI System for making online verifications while processing applications as well as updating their comments and providing approval/ rejection

5. Service Delivery end points

These are the citizen facing functionaries who will interface with the citizens in delivering services and use the front end applications. It will include functionaries like Gram Panchayat Secretaries, Zila Panchayat This group will use the e-PRI System for the following purpose:

• Register applications in the e-PRI System



Sr User Group Purpose • Feed in grass root data into the e-PRI system • Access system for getting various information on the

service delivery procedures • Connect to various databases and retrieve information

for the purpose of checking status and verification • Scan and upload documents

This use group will basically perform operations like data entry and verification.

6. Service Consumers These would comprise people who avail government services i.e. citizens. They would access the e-PRI System for following purpose

• Submit feedback on services and needs • Register grievances and issues • Get information on services and procedures • Track status

This user group will only access the system for providing feedback and access information.

Please refer Annexure III for details description of all the other components of above

architecture

5.3 Application Architecture and Functionality This layer talks about the Business Logic required for carrying out the PRI functions both core and service delivery functions. The overall Application Architecture for the e-PRI System is explained in figure below. This Architecture has been developed with the following objectives.

• Provide users with a Single interface for accessing different applications • Re-use existing applications developed by the State or NIC wherever possible. • Use standard and common components for all the services to be delivered by the PRIs • Reduce effort and cost of development through re-use and interoperability

Based on these objectives the application architecture will talk about layers that club common components which can be re-used across services, Core G2C and G2G layers that will provide the Business Logic, Components that will support the other layers as well as the Security layer that will talk about the managing security of data and applications.



Figure 4: e-PRI Application Architecture

• User Access/ GUI Layer: This layer shall act as the Front – end of the e-PRI

Application. Users accessing the e-PRI Application shall connect with the back-end processes and databases through this layer. This layer will provide a Graphical Interface to the user which would be menu driven, form based and more interactive and simple to use. It should be developed keeping in mind the capabilities of various user groups in the Uttarakhand.

Application Architecture User Access/ GUI Layer

Web Based forms

Menu driven components

Interactive GUI for query processing

Alerts & Notification

Service delivery componentsInformation Component

Form Availability

Status tracking

Application receipt

Payment component

Data layer

G2C Databases

PRI Master Database

Line Dept. Databases

G2C Modules

G2G Modules

RTI /Grievance

Ration Card Module

Family Register

Application Delivery

CID Module

Registration of BD

License Module

NREGA Module

Tax/fees Collection

PlanPlus

PRIASoft

HRMS

Project Mgmt.

Training

Asset Tracking

E Procurement

Support components

Content Mgmt.

eMail Mgmt.

SMS gateway

Payment gateway

Support ModulesFile

Management Business

Intelligence

BPL Module

Pension Module

User Access Management

OS Access Management

I/P –O/P Data Validation

Internal Messaging

Access log Management

Source code Management

Remote Access

Application Security

Land Record Module

MIS

Work Flow Management



Functionality of each sub-component is explained in the table below:

Table 2: Functionalities of GUI Layer components Sr Module/Component Functionality User Group 1. Web based forms Since e-PRI application will be a Web

based application, this component shall provide the user with forms that can be accessed through the use of Web browsers. These forms shall provide the user with following functionality

• Allow users to capture data as required

• Communicates with Data validation component to ensure correct and valid data is being entered and to minimize data-entry errors and redundancies

• Pre-populate form fields with data pulled from back-end, or from some internal logic

• Provide facility to collect both online and offline data

• Allow integration of paper based data with online data

• Upload updated forms with no downtime

• Integrate data collected with other core components and databases

All user groups who need to interact with the system for the purpose of data entry except the users from the Service Consumers Group.

2. Menu driven interface

This is a user interface component that allows users to use menus to communicate with the e-PRI system. It is an interface with series of screens which can be navigated by choosing options from lists i.e. menus. Users shall avail following functionalities to communicate with the system

• User shall have a list of items to choose from and can make a selection by highlighting one

• Shall also respond to user event like typing, mouse clicks, etc.

All user groups who need to interact with the system for the purpose of data entry except the users from the Service Consumers Group



Sr Module/Component Functionality User Group wherever required

• Shall also provide users with options other than text lists like, set of pictures, audio menus, or set of animations

• User shall have an option to choose a language for the interface like English or Gujarati.

• The menus should we well categorized so as to make it easier for the user to access the desired information

• Each item on the interface should be attached with a self help tool for indicating the function of that tool

3. Interactive GUI for query processing

This is an extension of the menu driven interface that will allow users to query databases and generate reports in an easier way. Users can avail following facilities

• Create own queries by having a combination of items to view without having to enter SQL commands

• Use pre-de-fined queries for generating standard reports

• Specify formats in which they want to view the data

• Interact with the Business Intelligence component to generate reports


4. Alerts & Notifications This component shall provide the e-PRI users with alerts and notifications on following occasions

• Alerts on violation of data- entry rules

• Alerts in case of any malicious software attacks

• Alerts on status change/ updates




Sr Module/Component Functionality User Group • Notifications on scheduled events • Alerts/ reminders on scheduled

events • Alerts on escalations

5.3.1 G2C and G2G Application Layer

This layer forms the core Business Logic of the e-PRI Application. It defines the applications and supporting capabilities that would manage the processes and information needed to support the Business and performance objectives of the PRIs. This layer shall contain sub-components that support service delivery as well as the Internal PRI Functions. Each component is represented as a module and each module may cater to multiple services or functions. Modules of G2C and G2G have been described in separate boxes. Modules under the G2G section leverage the existing applications that have been developed by NIC. Each module will interact with the database layer for executing functions. Table below describes G2C modules and their required functionality:

Table 11: Functionalities of G2C Applications Module Functionality Users RTI and Grievance Module

The module should have following functionality (i) Form download/Print (ii) Registration of RTI Application (iii) Application approval/rejection (iv) Payment of RTI Fees (v) Reply of RTI (vi) Registration of Grievance (vii) Reply on Grievance

• Shall send automatic email alerts to designated authorities for further processing based on the defined workflow for the service l

• Shall allow user to update comments against the request (viii) Shall maintain history of all the

applications received, registered, processed and rejected

• Citizen • PRI RTI Officer • PRI designated

officer/employee who will reply RTI/Grievance

Ration Card The module should have following functionality • Citizen



Module Functionality Users Module (i) Form download/Print

(ii) Application for new ration card/updation of existing card/reissuance of card

(iii) Verification of Application with other database

(iv) Application approval/rejection (v) Issuance of new card (vi) Updation of database (vii) Information passing to Supply Officer

• PRI designated officer/employee

• District & Block Supply Officer

Family Register Module

The module should have following functionality (i) Form download/Print (ii) Application for certificate (iii) Addition/Cancellation of name from

register (iv) Generating certified copy of family register (v) Application approval/rejection (vi) Generating copy of cancellation certificate (vii) Generating copy family register for

successor certificate

• Citizen • PRI designated

officer/employee

Birth /Death (BD) Registration Module

The module should have following functionality (i) Registration of birth and death (ii) Form download/Print (iii) Application for new Birth /Death certificate (iv) Verification of Application (v) Application approval/rejection (vi) Payment of fees (vii) Issuance of certificate (viii) Updation of database

• Shall retrieve, store or validate data from the Registration of Births and Deaths (RBD) database based on the service requirements

• Shall allow creation of new records in the RBD database based on the service requirements

• Shall allow user to search record based on pre-defined search criteria

• Shall display an error message if records are not


officer/employee



Module Functionality Users found

• Shall automatically populate birth / death certificate in case registration is already done and no approval from GP Secretary is required

• Shall automatically attach authorized digital signatures if records are found for respective service type

(ix) Shall send automatic email alerts to designated authorities for further processing based on the defined workflow for the respective service type

NREGA Module

The module should have following functionality (i) Form download/Print (ii) Application for registration (iii) Verification of detail (iv) Application approval/rejection (v) Registration of applicant (vi) Issue of Job Card


officer/employee

Tax/Fees Collection Module

The module should have following functionality (i) Preparation of tax/fees assessment

list/sheet (ii) Generation of Re-assessment request (iii) Fees/Tax collection (iv) Generation of receipt


officer/employee

License Module

The module should have following functionality (i) Form download/Print (ii) Application for new license (iii) Assessment of license fees (iv) Re-assessment of license fees (v) Application approval/rejection (vi) Payment of fees (vii) Issue of license


officer/employee

BPL Module The module should have following functionality (i) Uploading of notification (ii) Form download/Print


officer/employee



Module Functionality Users (iii) Application for addition of name (iv) Application approval/rejection (v) Preparation and uploading of information

for updation of list (vi) Information on new list

Pension Module

The module should have following functionality (i) Form download/Print (ii) Application for pension (iii) Application approval/rejection (iv) Consolidation of applicant details (v) Information dissemination of pension

status


officer/employee • District Magistrate

Caste/Income/Domicile Certificate Module

The module should have following functionality (i) Form download/Print (ii) Application for certificate (iii) Verification of Application (iv) Application approval/rejection (v) Payment of fees (vi) Issuance of certificate


officer/employee • Tehsildar

Copy of Land Record

The module should have following functionality (i) Form download/Print (ii) Application for certificate (iii) Verification of Application (iv) Application approval/rejection (v) Payment of fees (vi) Print of land record


officer/employee

Table below describes G2G modules and their required functionality:

Table 3: Functionalities of G2G Applications

Module Functionality User Group Planning • Module shall have following features:

- Shall facilitate the PRIs to prepare Perspective and Micro Plans based on analysis of the Grass Root data for simplifying & strengthening Planning process at the Grass root level

- Shall facilitate Need based planning rather than Scheme based planning

• Service Delivery Machinery/ Back Office users

• Service Delivery end points



Module Functionality User Group

- Shall enable convergence of various funds that are available under different schemes for a particular work and also the available local funds (local revenue generated through taxes etc).

- Shall provide well defined & distinct 11 roles of the functionaries involved in Planning process

- Shall use data from the Funds flow database for getting budget allocations

- Shall collate data collected at the grass root level and be able to prepare analytical reports for that can be used for planning

- Shall make use of base data for allowing conscious and concrete decisions

- Base data shall include data on population, land, income sources and so on

- Shall prepare graphical reports to help the Planner as well as the District Planning Committee to take a view of the investment profile of the Plan. This would help in ensuring that the Plan is not unjustifiably skewed in favour of a particular sector

- Shall support other local languages other than the five languages that it currently supports

- Use spatial data for planning by integrating it with the GIS feature

PS: Most of these features are already available in PlanPlus. It is proposed that PRIs should leverage PlanPlus for functions related to planning

Accounting • Module shall have following features: - Allow user to maintain accounts using Cash

based System of Accounting




Module Functionality User Group - Keeping track of Assets & Liabilities - Allowing addition of new Accounts as per the

wish of the department - Maintaining uniform codes for various

categories

- Shall have provision of data capturing at all tiers of PRIs and can be sent through mail, also had feature to keep back-up of the data

- Shall interact with other databases to get transaction information.

- Shall also interact with the Funds Flow Database to check against the Funds allocated and spent for a scheme or project

• Shall maintain standard templates for conducting audits

• Shall send periodic audit alerts before audits

• Integrate with PlanPlus so as to monitor expenses against the budgets allotted

• Shall generate periodic financial statements like Revenue and Expenditure Accounts for PRIs, Assets and Liabilities of PRIs as well Outstanding report (Payables and Receivables)

PS: Most of these features are already available in PRIAsoft. It is proposed that PRIs should leverage PRIAsoft for their accounts maintenance


Financial management System- Budgeting Module

The Module should have following functionalities: (i) Allow user to define various budget heads and

allow grouping of budget heads. Capital Budget and Revenue budget heads should be provided.

(ii) Allow user to see the budget head wise allocation of previous years

(iii) Allow user to define department wise budget heads wise allocations

(iv) Allow user to consolidate budget head wise





Module Functionality User Group allocations

(v) Have hierarchical workflow for approval of budget allocations both within each department and within organization

(vi) System should generate and print budget in the format defined by PRI.

FMS- Procurement Module

(i) Should maintain details of empanelled vendors (ii) Should allow user to raise an indent (iii) Should allow user to approve the indent (iv) Should authorized user to define whether the

indent will be processed through RFQ (Request For Quotation) or TENDER (Request for Proposal)

(v) Should allow user to generate Purchase Order (PO)/ Work Order (WO) in specified format

(vi) Should allow user to track the details of goods/ services delivery status

(vii) Should allow user to generate Goods Receipt Note (GRN)/ Completion Certificate

viii) Should allow user record details of vendor invoices as & when received

(ix) Should allow user track the payment status for the goods received/ services delivered

(x) Should user to approve the invoices (xi) Should allow user from finance department to

process the approved invoices (xii) Should keep track of payments made against

invoices xiii) Fixed assets procured through this module

should automatically be added to the fixed asset register



Asset Management

(i) System should allow user to define the various classification types of assets

(ii) System should allow user to create a look-up list of frequently procured assets

(iii) System should allow user to record details of various procured assets. The details to be recorded include but not limited to: • Nature of assets • Asset Identifier





Module Functionality User Group • Department / people to whom allocated • Cost of assets • Disclosure norms / regulatory compliances as per statutory laws applicable to the entity • Extent of owned, and assets taken on lease / hire purchase • Requirements of insurance company • Location of fixed assets • Maintenance costs

(iv) System should allow user to track the AMC requirement for the asset. System should allow

(v) User to schedule the repair and maintenance for the assets and track insurance requirement of asset.

(vi) System should pick up assets from the procurement management module, along with details such as gross Block, net Block, depreciation calculation etc.

(vii) System should aid in planning of asset purchase by tracking the utile life of assets

viii) Should generate reminders for statutory bill payments at pre-defined time

(ix) Should generate reminders for warranty expiry and AMC renewal

(x) Should generate customized reports as per the requirement of PRI

(xi) System should do calculate of book value of assets after depreciation.

HRMS- Employee Record Module

(i) System should allow users to define different grades of employment

(ii) System should have the facility of classification of employees as: • Permanent • Out-sourced • Contractual Employees

(iii) System should maintain leave chart for the outsourced employees

(iv) System should allow users to define departments





Module Functionality User Group (v) System should be able to record employee

related information including but not limited to: • Personal Details • Name • Nationality/ Caste/ Religion • Domicile as established • Father's Name • Permanent Address • Date of Birth • Place of Birth • Health Certificate •Personal marks of identification • Employee Photograph • Family Details • Professional Details • Educational Qualifications • Special Qualifications • Date of joining PF • PF Account Number • Service Details • Date of Appointment • Place of first Appointment • Capacity on Appointment •Pay and Grade on Appointment • Date of execution of service agreement • Grade details • PRI allocated

(vi) System should generate & record unique Identification number for the employee

(vii) System should allow employees to view their own records

Leave Management Module

(i) System should define multiple sets of leave rules such as eligibility etc. for various grades of employees

(ii) System should able to define multiple leave types: • Casual Leave • Leave on average pay (LAP) • Leave on Half average pay (LHAP) • Maternity Leave





Module Functionality User Group • Study Leave (Non-Gazetted) System should allow user to define comprehensive leave accrual / credit rules in the system • Accrued at the start of the period • Accrued prorated every month • Accrued at the end of the year • Accrual only after certain period of joining • Accrued based on no of days worked • Accrual only for confirmed employees • Facility to credit leave manually

(iii) System should allow users to define a comprehensive set of Leave Encashment rules for each type of leave scenario

(iv) System should allow users to view leaves eligibility and leaves availed

(v) System should allow users to apply for leave under different applicable and eligible categories

(vi) System should allow definition of hierarchical workflows for approval of leaves

(vii) System should record the approval/ rejection of applied leaves and update the employee leave account accordingly

viii) System should allow maintenance of record of unauthorized absence

Loans & Advances

(i) System should have the facility to define multiple types of loans and Advances such as: • 2 Wheeler • Car • House Building • Computer • Festival • From Provident Fund

(ii) System should allow users to define loan eligibility criteria

(iii) System should allow integration with payroll module for the choice of mode of payment

(iv) The system should capture repayment conditions (no. of installments, rate of





Module Functionality User Group installment)

(v) System should allow definition of hierarchical workflows for approval of loans/advances

(vi) System should have integration with employee service records for check of eligibility of loan and loan amount

(vii) System should scrutinize loan applications based on the checks such as available allocation of funds, Basic Pay of individual, duration of service, number of times advance is availed

Non core Benefit Management Module

(i) System should capture the eligibility requirement for availing LTA

(ii) System should calculate employee wise eligibility for LTA

(iii) System should allow user to define the requirement for reimbursement of following (but not limited to):

• Briefcase reimbursements • Cell phone reimbursements • Any other non-core benefits reimbursements

(iv) System should allow user to define the eligibility of medical claims

(v) System should have integration with payroll module for processing of reimbursements

(vi) System should track utilization of LTA and medical claims by employees

(vii) System should allow hierarchical approval to application for non core benefits



Employee Progression Management

(i) Probation & Confirmation, Promotion and transfer

(ii) System should track the probation period for each new incumbent and provide system alerts on probation completion due dates

(iii) System should record/ update the reporting location assigned to the employee

(iv) System should retrieve data from the training module about the trainings earmarked for the employee before confirmation

(v) System should retrieve data about successful





Module Functionality User Group completion of confirmatory training

(vi) System should allow authorized user to increase the duration of probation

(vii) System should record/ update the confirmation date and location of employee

Training & Development

(i) System should support the preparation of yearly (or user defined) training calendar

(ii) System should perform Activity Planning of training

(iii) System should support tracking of training instructors, training facilities, standard equipment required for the training and equipment available at training facilities

(iv) System should allow recording: • Attendance • performance of trainee • feedback on trainers • feedback on course

(v) System should receive “Training Needs Analysis” details from various locations/departments for creating a training plan

(vi) System should maintain training history (both earmarked and attended) of all employees with effective dates

(vii) System should record competencies that employees gain from completing a course and support automatic updating of employee competency inventory



Recruitment Module

(i) System should allow authorized user to collate department wise details of posts in need of recruitment

(ii) System should allow user to define qualification/ requirements for post identified for recruitment

(iii) System should allow users to register applicant and generate registration number

(iv) System should be able to screen applications based on the requirement and the registered applicant details





Module Functionality User Group (v) System should track applications for

recruitment (vi) System should allow users to define

recruitment schedule & define recruitment procedure for the posts

Pension Module

(i) System should allow user to define different elements for payroll generation

(ii) System should allow user to define business logic for compensation for different grades of Employees

(iii) System should be able to taxation rules as part of pay structure

(iv) System should have integration with various modules to retrieve data about the indicative elements listed below: • Pay-scale • Attendance • Leave • Allowances • Quarter usage details • Loans • Advances • PF payout • Increments • Incentives • Gratuity

(v) System should allow user to update details of arrears/ adjustments

(vi) System should calculate tax - payouts for the employees

(vii) System should generate payroll as per the employee compensation eligibility and claims and business logic defined for payroll generation

(viii) System should print payroll in a predefined format

(ix) System should initiate electronic credit of salary or generate funds transfer note for bank as decided by PRI.



(x) System should allow users to define the Rules



Module Functionality User Group for separation – • Retirement • Resignation • Removal/ Dismissal

(xi) System should generate reminders (12 months in advance) for employees due for superannuation

(xii) System should allow users to define checklist of activities required for superannuation cases, such as: Verification of Service Book for period of Qualifying Service • No - Dues verification from payroll data • PF data consolidation from accounts

(xiii) System should send reminders to the concern department/ PRI where the employee is working (3-months in advance)

(xiv) System should determine applicable Pension details for cases based on: • Length of Service • Details of non-qualifying service (if any) • Details of Medical Fitness • Nature of Retirement

(xv) System should have built in capability to incorporate and apply various user-defined formulae for calculation of pensions, depending upon (but not limited to) the following: • Average Emoluments • Net Qualifying Service (length of service less length of non-qualifying service) • Total length of permissible service (33 years)

(xvi) System should have built in capability to incorporate and apply various user-defined formulae for calculation of gratuity, depending upon (but not limited to)the following: • Basic Pay last drawn • Current DA rate • Net Qualifying Service (length of service less length of non-qualifying service) • Emolument



Module Functionality User Group • Calculate Commutation of

(xvii) Pension (advance withdrawal of a specified percentage (40%) of "original pension” within a year of retirement based on (but not limited to) the following: • Basic Pay last drawn • Original Pension (i.e. pension amount before any adjustments like advance withdrawal)

(xviii) System should have built in capability to incorporate and apply various user-defined formulae for calculation of Family Pension, depending upon (but not limited to) the following: • Basic Pay last drawn • Pension

(xix) System should be able to use benefit information and changes in status for retired employees, surviving spouse and dependents as captured in Service Book

(xx) System should Record resignation request of permanent employee based on notice from employee or Appointing Authority

File Management

(i) The File Management will be Computer based system for maintenance of the Personal Registers in a PRI office. Details about Files/Letters received and the stages of processing it undergoes like submission to an officer, letters issued to different offices, replies received in connection with this file from different offices are registered in this register. Software will gathers all the related details from office and consolidates the details.

(ii) Based on this data reports are generated



MIS (i) Provide real time information on the all aspect of service – request, processing, delivery, etc, to the defined actors for the given service

(ii) Progress tracking of work at defined levels on given time referential and help identifying any slack in the same.





Module Functionality User Group (iii) Help to develop mid term correction strategies

by brining out deficiency in any aspect of service delivery

(iv) Generate required report for concerned departments basis physical and financial reporting requirement

5.3.2 G2C Service and support Components Application Layer

This layer will host all the common components that can be used across all services. These will provide the user with a gateway to interact with the Core Business Logic components of the application. Sub components under this layer will mainly focus on the service delivery aspects like registration of applications, status tracking, provision of application forms and provision of service related information. These components will interact with the database layer for storing and retrieving information on services and applications. Service delivery end-points would be the user group who would be using these components on a regular basis.

Table below explains functionality of each component:

Table 4: Functionalities of G2C Support components Sr Module Functionality User Group 1 Information

Component i. Shall allow user to fetch requisite information

regarding G2C Services ii. Shall provide information like:

o Centers for collecting/purchasing application

forms o Procedural information related to service o Service fee o Service levels for the delivery of service o Process to validate authenticity of the certificate o Escalation matrix

iii. Shall allow user to upload and update content on

information pertaining to G2C/ G2B services iv. Shall automatically publish information on the

Panchayat State Portal and the e-PRI application once uploaded

Service Delivery end-points, Service Customers



Sr Module Functionality User Group v. Shall keep track of contents which have not been

updated for a given period. vi. Shall communication with the Alerts & Notification

component and alert the users for updating content which have not been updated for a given period

2 Form Availability Component

i. Shall allow users to fetch requisite Application Forms for all G2C Services

ii. Shall allow user to upload and update standardized application forms pertaining to G2C/ G2B services

iii. Shall automatically publish application forms on the Panchayat State Portal and the e-PRI application once uploaded

iv. Shall keep track of application forms which have not been updated for a given period.

v. Shall communication with the Alerts & Notification component and alert the users for updating application forms which have not been updated for a given period

All users of the e-PRI application

3 Application Receipt Component

vi. Shall allow users to register applications in the e-PRI System by selecting relevant e-forms

vii. Shall communicate with the Data validation component for validating entered data

viii. Shall allow users to scan and upload supporting documents for an application

ix. Shall allow user to take a photo of the applicant and upload it against the application

x. Shall generate Acknowledgement Identification number once the application data has been validated and submitted for registration. This shall act as a proof of submission of documents & act as a Reference number for all further processing / enquiries / escalations. This number can be generated by leveraging the District and Village codes from the National Panchayat Directory and appending service

Service Delivery end-points and Service Consumers



Sr Module Functionality User Group category, Service, service date., and serial number to it

xi. Shall generate an Acknowledgement receipt and allow user to print it so that it can be given to the applicant. This receipt shall contain following details

o Acknowledgement Identification Number

o Applicant details

o Service Type

o Date of Issue

o Payment amount (payment receipt) if payment is accepted at the time of application

o Payment amount due if Payment is deferred.

o Expected date of delivery xii. Shall alert user on the amount to be received for

the service and communicate with the payment component for receiving payment

4 Payment Component

i. Shall allow user to enter payment details against an AIN

ii. Shall allow user to select between options for receiving e-PRI or Line Department payments

iii. Shall allow user to select payment modes like Cash/Cheque/DD

iv. Shall interact with the Accounting system to register e-PRI payments directly into the accounting system

v. Shall populate the acknowledgement receipt with the payment information

Service Delivery end-points and Service Customers



Sr Module Functionality User Group 5 Status

Tracking Component

i. Shall detect status updates whenever status of application is updated

ii. Shall communicate with the Alerts & Notifications component and alert the user whenever there is a status update against an application

iii. Shall check if applicant’s mobile no. has been registered and will communicate with the SMS gateway to send status updates directly to the applicant’s mobile no.

iv. Shall allow user to check status of an application by with the help of AIN. i.e. will fetch the status of the application based on the AIN

v. Shall keep publishing status updates of applications on the Panchayat State Portal


6 Grievance Registration Component

i. Shall allow citizens to register grievances through Help Desks, Self Service kiosks, Panchayat State Portal

ii. Shall generate a grievance tracking number just like the AIN. This number shall act as the reference no. for tracking the status of grievance registered

iii. Shall allow user to track the progress of the grievance registered by entering the grievance no.

iv. Shall communicate with the grievance redressal module for further routing the grievance to appropriate authority

v. Shall communicate with the status tracking component to alert on status updates regarding the progress of grievances


Support Modules: These modules will automate the supporting functions of PRIs and help them in their day-to-day activities. The objective here is to reduce paperwork as much as possible and manage PRI documents and reports in an efficient way such that, their storage and retrieval is also easy. Some of these modules will leverage the applications that are being developed by NIC. Table below explains the functionality of each module under this layer:



Table 5: Functionalities of support Modules Sr Module Functionality User Group

1 File / Record Management

i. Shall allow user to create, store, maintain and retrieve documents.

ii. Shall allow user to track file movements & its status via unique file nos. which would be same as AIN

iii. Shall facilitate in maintaining proposals, contracts, tenders, etc and also to automate the workflows

iv. Shall act as a document management System by assigning a unique file / folder No. for each application that is being processed

v. Shall allow users to organize file in folders for easy retrieval

vi. Shall allow users to protect access to files by setting passwords

vii. Shall allow users to maintain version history viii. Shall allow users to manage documents like

MOMs, Notices, Memos, Government orders, Meeting agendas

All e-PRI users except Service consumers

2 Business Intelligence

This component shall provide feature like i. Providing reports as per requirements ii. Balanced Scorecards iii. Alerts on exceptions iv. Analytical and monitoring based dashboards v. Drilldown across reports for details vi. Collaboration of various data vii. Multi-dimensional charting viii. Real-time data cleansing and modelling for

viewing in a re-usable format

Visionaries/ Sponsors, Steering committees, Service delivery owner and project managers

3 PRI Meetings Management

i. Shall allow user to schedule PRI meetings (Date, time, location and subject)

ii. Shall notify selected (multiple) users when meetings are scheduled

iii. Shall send reminders before the meeting schedule

iv. Shall allow users to book meeting venues online

v. Shall provide users with list on invitees to select from




Sr Module Functionality User Group vi. Shall communicate with File/Record

management module to circulate Moms when they are uploaded (alert attendees when MOMs are uploaded)

vii. Shall allow users to set auto alerts for meetings to be held periodically

4 Knowledge Management

i. Shall allow users to identify, create and re-distribute information on PRIs

ii. Shall allow users to upload and share reference documents, case studies, rule and guidelines

iii. Shall send notifications when new documents are uploaded for sharing

iv. Shall allow users to search information based on subject, keywords, author, department, etc.

v. Shall allow users to have discussion forums vi. Shall allow users to save information based on

category, subject


Support components: Components in this layer will support the backend operations of the PRIs. These would be required for managing content, or the workflow or even user accounts. The Back-end office staff would generally interact with these components so as to simplify working for front-end users. Table below describes each of the support components in detail.

Table 6: Functionalities of support components Sr Module/Component Functionality User Group 1. Content

Management This component should enable the PRIs to manage repositories of unstructured content. It should provide following functionality

• Ability to manage dynamic web site content

• Ability to efficiently manage and search documents in differing digital formats

• Archiving, i.e. ability to store mass digital data for access by various internal and external stakeholders

• Ability to convert paper based

Back end office staff, IT coordinators



Sr Module/Component Functionality User Group documents to digital formats for inclusion within the overall content management solution.

• Control access to data based on user roles

• Manage redundancy and version history

• Ability to dynamically publish stored documents on a website

2. email Management This component shall allow the e-PRI application to send and receive email messages. It should provide users with following functionality

• Draft and send email messages • Manage emails (storage,

signatures) • Search emails by keywords,

subject, sender etc. • Delete and/ or archive emails • Set priorities and rules • Manage contact list and provide

addresses of all the UT employees • Call unread emails • Options to add multiple recipients

and CC and BCC • Allows user to provide permissions

on the sending and receiving emails

• Allows email encryption

All PRI Functionaries

3. SMS Gateway This component will allow the e-PRI Application to communicate with mobile phones by leveraging the wireless and telephony protocols and data formats supported by mobile devices. This component shall have the following functionality

• Identify numbers from stored in the database and send automatic text messages to the mobile device.

This component will automatically triggered by other components of the application



Sr Module/Component Functionality User Group • Ensure that messages are

transmitted in a secure way • Shall provide with delivery and

read acknowledgement facilities • Allow users to define templates for

pre-defined messages and auto – response messages

• Allow users to send SMS to a single number or multiple nos.

• Allow user to add or import contacts

4. Payment gateway This component shall allow users to process payment transactions. It shall have following features

• Supports all transaction types, including authorization

• Allows electronic funds transfer to beneficiary bank accounts

Service delivery owners

5. Workflow management

This component shall automate all the pre-defined procedures or process flows for executing the business logic. This shall have following features

• Review applications/ documents • Edit documents • Update comments and status • Approve or reject documents/

applications • Route applications/ documents to

the next tier in the process • Allow users to digitally sign the

documents • Track and audit applications/

documents and business processes

• Generate notifications and alerts to ensure proper scheduling and task balancing

• Integrate the SLAs in the workflow for managing escalations

Back-office staff



Application Security Components: This layer defines the security components of the e-PRI application. These components would be required to manage secured and authorized access to the application. This layer would also provide application level security in way that the applications functionality is not getting tampered. It considers security for both functional and non-functional components of the Application. Table below describes the functionality of each component

Table 7: Functionalities of Application Security Components Sr Module/Component Functionality User Group 1. User Access

Management This Component shall allow the IT Administrator to create and manage User Accounts. It shall provide the user with following functionality

• Ability to create user accounts and allocate user names and passwords

• Ability to assign role based access rights to the user for accessing the e-PRI Application and databases

• Ability to delete a user profiles • Allows user to create multiple

accounts at a time • Informs user to change password

periodically by sending mail alerts • If Passwords are not changed

periodically allows user to Block/ de-activate accounts

• Allows user to re-activate accounts • Allows user to modify access rights • Allows user to map these user

accounts with their email addresses

• Allows users to change their passwords as and when required.

Back –Office staff, specifically users like System Administrators.

2. OS Access Management

This component should be able to provide security services like user authentication, authorization, configuration settings as well as system wide security permissions. It

Back –Office staff, specifically users like System Administrators



Sr Module/Component Functionality User Group shall provide the user with following functionality

• User Authentication and Authorization mechanisms

• Map the user accounts to the Operating system

• Allow access to resources based on allotted access rights

• Allow user to manage audits and track requests and use of resources

• Allow users to share resources like files, printers and so on but in a secured way when connected on the intranet. This should be done using standard protocols like FTP, SMTP and so on

• Allow user to configure software firewalls for protection against unauthorized access

3. Input/ Output data

validation This component will provide the user with various data validation techniques so as to ensure that whatever data is stored in the system is valid, semantically correct and not redundant. This functionality can be included as a part of the application code. To implement this functionality it is essential that Standard Data formats and data validation procedures be finalized for storage of data in databases. Based on these formats, the validations can be implemented. This component should provide following functionality

• Allow user to enter data in pre-defined formats

All users except Service consumers



Sr Module/Component Functionality User Group • Provide user with guidelines to

enter data in pre-defined formats • Allow user to validate if input data

is following standard formats like date, characters, numbers

• Allow user to validate if input data and number of characters abide by the standards

• Allow users to check if input data is already existing in the databases

• Provide alerts to users if input data does violates standard formats and rules

• Restrict users from saving invalid data to the database.

• Allow users to create, modify and delete data based on the access rights

• Ask for confirmation from the user before saving the data in the database

4. Internal Messaging Integrity

This component shall allow the users to maintain integrity of the contents on which multiple users are working. This content may be a single message, shared content, policies and so on. It should provide following functionality

• Ensure that contents are received exactly the way they were sent, though the formats used for sending and receiving them may be different

• While accessing or writing data to the database, this component shall generate integrity reports that will record every incident along with details like date, time, authorization id, terminal id, Application and so on

Back-office staff like System Administrators will use access this component



Sr Module/Component Functionality User Group 5. Source Code

Management This component would help the users to detect and report vulnerabilities in the applications source code. This component shall have following functionality

• Protect the source code against unauthorized access

• Restrict unauthorized copying and distribution

• Track all vulnerabilities in the code that may cause malfunctioning

• Track existence of other malicious codes


6. Access Log Management

This component shall help back-end users like IT Administrators to maintain a log of all the activities happening on the PRI Network. This component shall provide the following functionality

• Maintain a log of all the users logging into the e-PRI Application with the time, date, access id and location from where they logged in

• Maintain a log of all the activities happening on the e-PRI Application with time, date, user, location, activity

• Maintain a trail of all the activities happening once a user has logged in like modules accessed, databases accessed, reports accessed, data created, deleted or modified

• Maintain a log of all security incidents taking place while a user is logged in

• Maintain a log of all unauthorized users trying to log in

• Generate security incident report as and when required based on the log file




Sr Module/Component Functionality User Group 7. Remote Access

Management This component shall allow e-PRI users to access the e-PRI application from any remote location. This component shall provide following functionality

• Shall allow only authorized user to connect to the e-PRI network through a remote location

• Shall communicate with the User access management component to establish Authentication and Authorization for accessing e-PRI application

• Once remote access is established, it should provide secured transmission of data from the e-PRI application to the user. This shall be done using mechanisms like encryption.

• Shall allow access to the e-PRI network based on access rights only, rest of the network shall be restricted from the user.


5.4 Logical Database architecture

This architecture talks about the various datasets that would be required for the functioning of PRIs. It presents the three datasets that shall be required for implementation of the e-PRI, these are G2G, G2E & G2C datasets. It further describes how these databases/datasets will communicate with each other so as to manage efficient, non redundant and real time transactions. Each of the 3 sub architectures is explained below. Most of the data currently exists manually in the Uttarakhand. It is therefore, important that all this data be digitized for implementing e-PRI.

G2E Information Ecosystem Following table and diagram in the sub section describes the integration, purpose and various stakeholders of the proposed G2E database architecture



Sr. Database Type

Creator Owner User Purpose

a. Core HR data

State PR Dept ZP/BP/GP

State PR Dept.

State All Line Depts. ZP/BP/GP Citizens

It contains two main types of databases: Employee master database Organization structure, hierarchies, positions, transfers and vacancies etc

b. Transaction data

State PR Dept ZP/BP/GP

State PR Dept.

State All Line Depts. ZP/BP/GP Citizens

It will contain the following databases: A database to capture details like Employee salary & benefits, monthly attendance, PF etc Database to capture daily attendance, time-in, time-out, leaves etc A database maintaining a record of qualification and skills of employees, training, performance management and disciplinary data





G2C / G2B service related information exchange ecology Following table and diagram in the sub section describes the integration, purpose and various stakeholders of the proposed G2C database architecture. Sr.

Database Type


1. De Novo model for Citizen UID

− ZP/BP/GP

− State Line Depts. (Respective)

− MMP for Passport, Election ID etc

− MMP for Passport, Election ID etc

− State PR Dept.

− e-PRI application

A database system to identify the citizen uniquely will be based on de-dup check considering ration card / PAN card / Passport / Election ID etc It is a non-debatable fact, that one of the major challenges faced for PRI is ‘data creation’. As such, while the UID initiative is going to be piloted in urban areas to start off, PRIs (through e-PRI) should be leveraged for data creation. This should be looked at as a symbiotic relation, where in both can gain as follows: • UID initiative: Over a

period of 3 years, a de-novo database will be available for rural areas, which can be leveraged when UID initiative will be planned to be implemented in rural areas.

• PRIs: This partnership model can be a source of



Sr.

Database Type


revenue generation. The UID initiative should consider PRIs as a partner is data generation. Hence, deserving revenue can be shared with the PRIs by UID initiative, as in the absence of data; UID initiative may not be able to achieve the desired results.

2. Citizen Master

− ZP/BP/GP

− State PR Dept.

− State PR Dept.

− e-PRI application

− All line depts.

A citizen master will be derived from through the de-novo model. It can be further mapped to biometrics database.

3. Service & Scheme master

− ZP/BP/GP

− All line depts.

− State PR Dept.

− State − All Line

Depts. − ZP/BP/GP − Citizens

The database will contain the information and details as follows: • Guidelines: It will

have various guidelines updated regarding BPL, various schemes etc

• G2C Service Master: It will contain the details of what services have been availed by various citizens/household. This would be helpful in having critical data that will help in taking intelligent



Sr.

Database Type


decisions about which services or schemes need revamp or restructuring based on the local needs.

4. BPL and Beneficiary master

− CEO BP

Revenue Dept. − State − All Line


It will contain the BPL and the identified beneficiary list of various schemes.

5. RTI / Grievances

− Citizens

− State PR Dept.



RTI / Grievances database will gather and maintain information relating to RTI / grievances lodged with departments in regards of services/schemes.

6. Service Transaction Master

− GP − State PR Dept.



Service Transaction Master is the database where various service requests get parked. This database in turn interacts with other databases depending on the type of service request.

7. G2C services related databases

− All Line Depts.

− ZP/BP/GP

− State PR Dept.



These databases are specific to the services requested at the Gram Panchayats and will hold information related to land records, local taxes, birth & death, RTO, licenses, NOCs, utilities related, line dept. related etc.



G2G data & Application interaction system

Following table and diagram in the sub section describes the integration, purpose and various stakeholders of the proposed G2G database architecture. Sr Database Creator Owner User Purpose 1. Planning

& Budgeting database

− Planner − DPC − Administrati

ve approver

DPC − State − All Line

Depts. − ZP/BP/GP

− It will facilitate decentralized planning with a defined planning work flow

− Help in converging rural



Sr Database Creator Owner User Purpose − Work

definer − Scheme

definer

− DPC − Citizens

& urban plans to generate an integrated district plan.

− Supporting need/activity based planning rather than scheme-driven

− Assists in converging flow of funds from different central and state sponsored schemes

− Acting as a decision support tool through the use of supporting GIS and Graphs

2. Citizen needs database

Gram Panchayat

PR Dept. − State − All Line

Depts. − ZP/BP/GP − DPC − Citizens

Various needs of citizen from various levels get collected and parked in this database

3. Project & Project Management database

− Planner − DPC − Administrati

ve approver − Work

definer − Scheme

definer

DPC − State − All Line


Stores unfinished Projects and assist in project management

4. G2G Content Management Database

− All Line Depts.

− ZP/BP/GP



Host various scheme guidelines, previous year plans, tenders, vendor contracts, proposals and empanelment documents

5. e-procurement database

Gram Panchayat


Depts. − ZP/BP/GP

The Register basically maintains that have been purchased by the Panchayats. Other details



Sr Database Creator Owner User Purpose − DPC which are included are the

quantities of the items, price paid, suppliers from which item obtained, the order details and finally the payment details.

6. Assets database

Gram Panchayat

PR Dept. − All Line Depts.

− ZP/BP/GP − DPC

To keep a record of the company assets and their respective values and attributes. It will manage and maintain unique id to assets owned by Panchayats and will be linked to various G2G applications for planning, accounting etc.

7. Grass-root data database

Stats Assistant Statistical officer



Collection of grass-root level data from field at various levels. It hosts various types of spatial and non-spatial data like: − Geographic Details − Demographic Details − Election Details − Education Details − Health Facilities − Drinking Water Facilities − Infrastructure Details − Population details/break-

up − School details etc

8. Fund flow database


Depts. − ZP/BP/GP



− It will facilitate in automating the tracking of Financial progress for Monitoring & Reporting

− Making available information of Fund flow across sectors and schemes / projects to bring in transparency



Sr Database Creator Owner User Purpose and Social accountability. It will also give the details of unused / lapsed funds

− It will also trigger the process of Funds release in time or in-advance

− It would be of great help to support Electronic Funds Transfer mechanisms

9. Accounting and auditing database


Depts. − ZP/BP/GP



− Captures voucher level accounts of Panchayats and generates reports as per their requirements

− Maintains sources of fund information i.e. budget envelope provided by Central and State Govts., local revenues etc.

− Facilitates generation of Scheme-wise expenditure and utilization certificates

− Hosts audit plans, priorities, audit history and audit requirements

10. Sectoral / scheme database

− ZP/BP/GP

State Line Depts. (Respective)



The Physical and Social progress databases will hold the status of physical and social progress (based on social indicators) to periodically monitor the progress.





5.5 Information Security Architecture Information Security is defined as the protection of information from a wide range of threats to ensure business/ service continuity, minimize governmental risk, and maximize return on investment and opportunities. Achieving information security across PRIs can be only accomplished by implementing a consistent architecture and supporting security controls. Selection and implementation of security controls will be critical decisions for protecting the security of PRIs information and information systems. These will be the management, operational, and technical safeguards or countermeasures to protect the confidentiality, integrity, and availability of information systems and its information. Figure below gives a structure of the Information Security Architecture, which shall help PRIs in managing information security across all the layers of the Logical Architecture.

Business Layer Security Components

Information Security Policy

Governance council

Asset tracking &

Management

Physical Security

Human Resource Security

Incident Management

Identity Protection & Management Components

Identity proofing and Vetting

Access Management and Control

Antivirus Protection Application/

OS Layer

Security Assessment & Monitoring Components

PRI Directory Services

PRI Public Key Infrastructure

Security Permissions and Configuration

PRI Event Logging an

d Auditing

Data Layer

Technology/ Network Layer

Data Validation

Anti Spyw

are/ M

alware

Protection

System

files & Source

code Protection

Vulnerab

ility Detection

Firewall/ Routing Service

Encrypted Access to Network (VPN)

Intrusion Detection and Protection

Figure 5 - Information Security Architecture

In considering the protection of information across PRIs, information security is more essential rather than just IT security. Information security for PRIs will consider risk-based approach that considers information not only in traditional technical assets such as computers, but also in assets such as people, which could pose weak points in the organization. The above architecture considers that information resides within people, processes and technology, and therefore focuses on security of each aspect. The objective of this architecture is to



• Facilitate a more consistent, comparable, and repeatable approach for assessing risk, and selecting and specifying security controls for PRI systems

• Provide a recommendation for minimum security controls to be used for the PRI systems

The requirements of the Information Security Architecture applies to all PRI entities and to all information assets owned by them including hardware, software, media, facilities, data, and information stored electronically that may be owned, leased, or otherwise in the custody of PRIs. The above architecture therefore defines mandatory requirement for protecting information and talks about security in terms of Business layer, Identity protection and management as well as Security Assessment and monitoring. Each layer and its sub components are explained in the Annexure III



6 Requirements for ICT and Connectivity

6.1 Deployment Architecture

The deployment architecture mainly emphasizes on the application deployment strategy. This includes the location where application will be installed and how it will be connected to other locations. This also shows the plan of how the application will be connected to other NeGP initiatives like SWAN.

The below plan shows that e-PRI application will be installed at SDC, The data backup will be taken at the identified BCP/DR site. e-PRI Application can be accessed through Internet and SWAN.

Below is the Deployment Architecture of the e-PRI initiative. Central applications will be hosted at the NIC Central Data Center at New Delhi. State applications which are specific to Uttarakhand state will be hosted in the State Data Center. The overall architecture of the application will be a centralized one with hosting maximum numbers of modules in the Central Data Center of NIC. The databases of Central application and that reside in the particular state will be synchronized in real time using the interoperability of SWAN and NICNET.

This section assesses the ICT and connectivity requirements for the implementation of the ePRI application and proposes a deployment architecture with due consideration to factors of scalability, performance, availability, interoperability, security and manageability. In addition, high level network architecture has been proposed for hosting the ePRI application. Further the information security has been dealt with in the section and a four layer (User, Network, Infrastructure and Application layers) security architecture has been detailed. Keeping in mind all these and the ICT requirements at the client sites at the state/district/block/village, an indicative bill of materials has been presented. The overall estimated cost of implementing the technology solution is estimated at Rs. 64.52 Cr. This includes the cost of ICT hardware and networking components required State PR department and PRIs as well as cost of software development and data digitization. Other costs like implementation of PKI are not included as they would be factored in SDC costs



Figure 6: e-PRI Deployment Architecture

Components at SDC: The State Data Center which will be built under the NEGP initiative of Department of IT, Govt. of India will already have the necessary infrastructure components included to host the Mail Messaging, LDAP and various miscellaneous components. Apart from the already present components of State Data Center like Firewall, DMZ switch, SAN Storage, additional Database Server, application Server and Web Server for hosting the e-PRI application at State level has been considered. The Database servers are to be configured in cluster configuration for providing redundancy. The web-server will be installed in the DMZ zone of the Data Center.



SWAN: The state wide Area Network is been installed to provide a vertical connectivity of minimum 2 Mbps from the State HQ NOC to the District level and from District HQ to Block level. SWAN will be used as the main backbone of the connectivity for accessing the application from various offices. District/Block office: The user office of Block and District will access the application using the SWAN. Last mile connectivity to the District/Block office will be provided from the nearest POP of the particular District/Block. Local LAN will be established in the District/Block office for providing the access to all the users. Gram Panchayat: As SWAN will not go to the Gram Panchayat level, the user at the GP level will access the application using Broadband Internet

6.2 Network Architecture

The network architecture emphasizes on the application connectivity plan to external and internal users. This includes the connection to the e-PRI application through SWAN and through internet. It describes on the connectivity speed for each tier of PRI and general users. This also depicts the different network devices present I the network.

In the context of Panchayats, connectivity plays a particularly important role for the following reasons:

i. Connectivity is important if PRls' information and services are to be made available to citizens, State Govt., Union Ministries and other stakeholders on any-time, any-where basis.

ii. Installing software locally at Panchayat level would pose problems in terms of maintenance of both software as well as data entered through the software due to the lack of technical support to PRIs. Web-based software applications reduce these problems by requiring maintenance at the State level or at any place where sufficient technical support is available.

Hence all the Software Applications will be centrally hosted in Data centre and will be accessed through web by PRIs and other stake holders. The PRIs will be interconnected through VPN. All other stakeholder would access the e-PRI through internet gateway. Initially State PR Directorate and every PRI in Uttarakhand are envisaged to be connected securely via an intranet implemented as a virtual private network (VPN). This will be built on SWAN for vertical connectivity and horizontal connectivity. All BPs and ZP will be connected directly through SWAN. To provide connectivity at GPs, BSNL Based broadband service is envisages. PRIs will be connected securely to the intranet, protected by firewalls with Intrusion Prevention Systems. Citizens, Payment Gateway, SMS gateway are envisaged to be



connected to e-PRI over the internet. Of all the identified network segments, State PR Department (or its vendor) will be responsible for security, maintenance and uptime. All the Applications of e-PRI System will be hosted at servers in Data Centre. It is recommended to setup a Disaster Recovery (DR) with N: 1 replication of servers. The DC & DR will be interconnected with Lease lines. It is advisable that DR should be at least 500 Km away from Data Centre location.

The PRIs i.e. State PR dept, ZP and BP will be connected through 2 Mbps line as designated in SWAN for horizontal connectivity. All other state dept up to BP level have same bandwidth of 2 Mbps. Outside Users (Categorised as Service Customers) will be able to access only Panchayat State Portal.

Figure 7: e-PRI Network Architecture



6.3 Bills of Material Sl. Item Units Configuration A Server Hardware 1 Web Server 2 4U RackMouunt Server having Duel Core,

7120M (3GHz, 800 Mhz FSB, 4 MB L3 Cache and 2x 1MB L2 cache or higher processor support for Qued dual core processor,8GB DDR2-400Mhz FB DIMM or higher ECC memory,SVGA video Controller with 16 MB RAM, SAS Raid Controller having 128 MB buffer memory with battery backup and supporting RAID 0, 1 and 5 Dual Gigabit server Ethernet controller with Teaming, load balancing and auto fail over Feature, 5 x146GB SAS HS HDD, IDE DVD ROM Drive, with (N+1)hotswap Redundant Hot Swap Power Supply

2 Application Server 2 --------------do------------------ 3 Database Server 2 Rackmount Server (6U/7U) equiped with

Quad multi core RISC/ EPIC 64 bit, fully binary compatible to 64 & 32-bit Applications processors , 16x2GB DDR2-667 with ECC memory expandable to 192GB, Dual port or higher SAS Controller supporting RAID 0&1, 2x146GB SAS Hot Swap HDD (10K or higher rpm), IDE DVD ROM Drive, Dual port Gigabit server Ethernet controller, One dedicated Ethernet port for OS independent hardware management (Out of Band management). Server Equiped to support clustering of servers under Windows & Linux OS without any additional hardware, virtual media licence, 3 yrs on site comprehansive warranty support. (Note: Sun Server is with built in 2x4Gbps HBA Card)

B System Software

1 Operating System 6

Linux

2 Web / Application Server 2

JBoss

3 Database Server 2

My SQL/Postgre

C Client Site Hardware



Sl. Item Units Configuration 1 Desktop PC 7762 Desktop System with 2.66GHz speed, 3MB-

L2 Cache,1066MHz FSB) or higher processor, 2GB DDR-II 800 MHz or higher Memory, 250GB or higher SATA-II HDD, TCO-03 certified 17'' TFT color monitor, DVD Writer, Gigabit Ethernet Port & 4xUSB, Keyboard & Optical Mouse with Mouse pad, Preloaded OS. & Preloaded Anti Virus S/W with 60 days validity). Complete System with 3 Yr. Warranty on site warranty support.

2 Network Printer 23 UPS 7762 600 VA

4 Laser printer 7758 A4, 8 PPM , 16 MB RAM, 600 x 600 dpi, 150

sheet input tray 125 output tray, USB interface cable and driver software

5 Digital Signature 76646 Document Scanner 7652

D Client Side LAN/WAN

1 LAN Switch 109

2 Installation of Office LAN (CAT 6) at office with 20 user

1

3 Installation of Office LAN (CAT 6) at office with 10 user

108



7 Capacity Building Requirements

Capacity Building broadly has been classified as capacity building related to Human Resources and Capacity building related to enhancement of Skill set. Human Resource is further classified as Existing Posts and Desired posts. On the other hand skill set has been further classified as desired skill set and Training required.

7.1 Capacity Building and Training Strategy Capacity building and training strategy focuses on the humane side of the e-PRI project. The section encompasses skill development methodology, strategy related to manpower and training strategy. These in combination shall ensure that appropriate human resource is available for the execution and later operation of the project.

Skill development methodology

An important component of capacity building is skill set enhancement. Skill set enhancement is a complex exercise to undertake without a proper methodology in place. Various rounds of length training sessions which have already been conducted in the state have not resulted in a success. So as to improve the current skill set of the PRI’s a structured skill set development methodology has been proposed for the Uttarakhand Panchayati Raj Institution. Primarily four factors have been considered for developing skills. All these four factors collectively impact and enhance the skills of an individual. Right mixture of all four factors is imperative in producing the desired results. The following diagram presents the skill development methodology that shall be considered for PRI in Uttarakhand

This section focuses on building capacities and capabilities of PRIs in Uttarakhand. It identifies the manpower requirements and strategies to fulfill them. It also identifies the training requirements and the proposed training plan for building skill sets in the PRIs. Total Cost of expected to be incurred towards trainings and manpower are Rs.16.93 Cr & Rs 94.57 Cr respectively

Skill development methodology



1. Knowledge Transfer: Knowledge Transfer is the first phase of skill development. Skill development exercise can’t be initiated without a proper theoretical knowledge transfer to the individuals. Hence skill development program is only as good as the theory behind it. 2. Practice: Knowledge once transferred gets dormant if not practiced. Some skills development efforts require a few minutes; others take hundreds of hours. Even those with great aptitude blessed with a large dose of talent must practice endlessly to be successful in skill development 3. Motivation: In our methodology, a person serious about skill development must be internally/externally motivated to perfect the skill. It is unrealistic to expect any training session to motivate the apathetic or the lazy to perfect developing a skill. Hence PRI would have to define consequences for desired and the undesired behaviors. 4. Feedback: Skill development requires feedback. There are two ways to get feedback: do it yourself or get others to do it for you. Second type of feedback is more influential and beneficial for enhancing skills. Hence it is imperative for PRI’s to have skilled coaches/trainers who can provide positive and negative feedbacks

7.1.1 Manpower It was observed during the study phase, that PRIs are currently equipped with inadequate manpower to support their operations. There are number of vacant post that needs to be taken into consideration by the PRI and appropriate personnel’s should be deputed/ recruited. However, e-PRI project will only budget for IT skilled manpower at each of ZPs, BPs & GPs. As far as vacant positions of permanent staff are concerned, it would be the discretion of the state to fill the position, our aim was to highlight the areas, which could be the point of concern to strengthen PRIs. (Please refer ISNA & BPR report for details) The IT skilled manpower will be hired on contractual basis and is expected to perform the following three major functions

• MIS preparation • Hardware and Software maintenance • Data Entry and updating

However, as the implementation of the ePRI project in the State is proposed to be undertaken in a Service Procurement Model (SPM), a Service Procurement Agency (SPA) would be responsible to provide one operator and required ICT infrastructure at each level of PRIs.

7.1.2 Training Strategy

Uttarakhand Institute of Rural Development (UIRD), Rudrapur is the primary institute for creating and providing opportunities to develop and upgrade knowledge/skills/attitude and experience on a demand driven basis for promoting the study of rural development and Panchayati Raj in particular & development administration in general. The Uttarakhand



Institute of Rural Development (UIRD) shall be the nodal agency for training of elected Panchayat representatives and Officials. The Training will be scheduled and curriculum will be developed in consultation with PR department and UIRD. Three categories of trainings i.e. trainings related to change management, competency building, and soft skills has been proposed for Uttarakhand e-PRI project. It has been envisaged to provide these trainings using combination of both methods, Cognitive Training methods shall be mixed with few of the behavioral training methods to seek the effectiveness of both the type of training methods. So as to ensure effectiveness of these trainings regular module wise tests have been proposed. The following section presents the training strategy for the Uttarakhand PRI’s in detail. Please Note: The following trainings have been proposed to provide all round development and ensure motivation of the workforce, but only trainings related to change management/ICT have been included in budgetary estimates for e-PRI project. The contractual Manpower will be provided & trained by Service Procurement Agency (SPA) and only cot of hiring for contractual manpower is taken in consideration. Also the PRI officials trained during the Project shall be utilized used to provide training to any new Joinee.

7.1.2.1 Training requirements The strategy for training shall focuses on inducing strategic vision development at a senior management level at PRI and the develop skills required by the middle and lower management of PRI. The training and capacity building has been categorized under three categories.

• Category 1: Trainings related to change management • Category 2: PRI Competency Building • Category 3: Soft skill related training

Category 1: Trainings related to change management Change management training program focuses on trainings specifically linked to the implementation of e-PRI system. Five types of training have been identified for the PRI officials and elected member. They are listed below:

1. Change Management & IT Sensitization Training: This training has been envisaged for senior functionaries of PRI who are involved in decision making at the highest level and are expected to drive the initiative in the organization. It basically includes the following: To impart working knowledge and skills related to :

Process Re-engineering Building Technology architecture and standards Program Management



Change Management 2. Basic Computer Awareness Training: Without preliminary operational knowledge of

computers, employees cannot be expected to work in an automated environment. The basic computer training requirement is indispensable in nature for all its employees and elected members at PRI.

3. Role based application Training: This training is suggested for all functionaries at PRI. This training is targeted to make users confident of their roles and functions in proposed system.

4. Training on re-engineered processes: This training is targeted at key functionaries of PRI. This training aims at enlightening key functionaries on re-engineered process, objectives, benefits etc.

Category 2: PRI competency Building Trainings The following list presents the PRI competency building training programs proposed for effective functioning of PRI. • Executive and managerial skills • Functional management area • Financial management • Corporate Governance • Project Management Category 3: Soft skills related training Soft skills related trainings constitute personality development, enhancement of creativity and problem solving techniques, conducting effective gram sabhas, encouraging community participation by all officials and elected members.



7.1.2.2 Training requirements Table 8: Training Requirement at PRIs

TRAININGS State PR Dept Zila Panchayat Level Block Panchayat Level Gram Panchayat Level

Dire

ctor

s

Acco

unts

Offi

cer

Oth

er P

R O

ffici

als

DPR

O

ZP &

oth

er

Elec

ted

Mem

bers

AMA

Acco

unts

Offi

cer

Oth

er P

R O

ffici

als

BP

& ot

her

Elec

ted

Mem

bers

BDO

ADO

(Pan

chay

at)

Oth

er P

R O

ffici

als

Gra

m P

radh

an &

O

ther

Ele

cted

M

embe

rs

Villa

ge C

omm

ittee

M

embe

rs

Gra

m P

anch

ayat

Vi

kas

Adhi

kari

Com

pute

r O

pera

tor

Core Functional Skills Budget Preparation

√ √ √ √ √ √ √ √ √ √ √ √ √ √ √ X

Refresher Course in Accounting

√ √ √ √ X √ √ √ X √ √ √ √ √ √ √

Refresher Course for Decentralized Planning

√ √ √ √ √ √ √ √ √ √ √ √ √ √ √ X

Drafting Government documents such as notice, circulars, General Office Administration

X √ √ √ √ √ √ √ √ √ √ √ √ X √ √

Data Analysis √ √ X √ X √ √ X X √ √ X X X X X

Schemes guidelines and awareness

X √ √ √ √ √ √ √ √ √ √ √ √ √ √ √




Dire

ctor

s

Acco

unts

Offi

cer

Oth

er P

R O

ffici

als

DPR

O

ZP &

oth

er

Elec

ted

Mem

bers

AMA

Acco

unts

Offi

cer

Oth

er P

R O

ffici

als

BP

& ot

her

Elec

ted

Mem

bers

BDO

ADO

(Pan

chay

at)

Oth

er P

R O

ffici

als

Gra

m P

radh

an &

O

ther

Ele

cted

M

embe

rs

Villa

ge C

omm

ittee

M

embe

rs

Gra

m P

anch

ayat

Vi

kas

Adhi

kari

Com

pute

r O

pera

tor

Knowledge about committees and roles of PR officials, Relevant Sections of PR Act, RTI, Citizen Charter

X √ √ √ √ √ √ √ √ √ √ √ √ √ √ X

Technology Related

Basic computer knowledge like MS Office, Using internet, mails

√ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √

Softwares proposed for PR

√ √ √ √ √ √ √ √ √ √ √ √ √ X √ √

Updating data w.r.t. schemes on Panchayat State Portal

√ √ X √ X √ √ X X √ √ X X X √ √

Soft Skills

Conducting Effective Meetings

X √ X √ √ √ √ X √ √ √ X √ √ √ X




Dire

ctor

s

Acco

unts

Offi

cer

Oth

er P

R O

ffici

als

DPR

O

ZP &

oth

er

Elec

ted

Mem

bers

AMA

Acco

unts

Offi

cer

Oth

er P

R O

ffici

als

BP

& ot

her

Elec

ted

Mem

bers

BDO

ADO

(Pan

chay

at)

Oth

er P

R O

ffici

als

Gra

m P

radh

an &

O

ther

Ele

cted

M

embe

rs

Villa

ge C

omm

ittee

M

embe

rs

Gra

m P

anch

ayat

Vi

kas

Adhi

kari

Com

pute

r O

pera

tor

Conducting Effective Gram Sabha

X X X √ X X X X X X √ X √ √ √ X

Encouraging Community Participation

X X X √ √ √ X X √ √ √ X √ √ √ √

Communication skills

X √ √ √ √ √ √ √ √ √ √ √ √ √ √ √



Modes of Training The following modes of trainings are recommended to impart the trainings to the PRIs:

• Centralized Institutional Training A conventional training method, Centralized Institutional Training can only be undertaken for a limited number of elected representatives and officials at the higher levels like Zila Panchayat Chairman, and Chief Development Officers (CDOs) and BDOs.

• Decentralized Institutional Training Decentralized Institutional Training can be undertaken at the regional, District and Block levels provided adequate infrastructure is available in the form of well-funded and well- staffed Training Centres. At present, the regional, District and sub District level presence of UIRDs is woefully inadequate.

• Decentralized ‘Direct’ Training in Cascading campaign Mode Decentralized Direct Training in Cascading Mode has been tried out in Rajasthan and has been found to be effective. It involves organization of a two to three day camp to be held at Block headquarters, where a team of resource persons interacts with a large number of Gram Pradhans and the members and provides them basic inputs to function efficiently as newly elected Panchayat representatives. The process of training is interactive with games and other problem solving methods being used. A cadre of trainers is involved in this process. Block level resource persons are trained by District teams who are in turn trained by state level master trainers. Some of the advantages of this validated model of training include

• High attendance rates, • Heightened motivation • Great team spirit among trainees, positive shift in the mindset of PRI leaders

and officials and learning in a non-threatening, non-intimidating environment. • Such training camps also generate awareness in the rural areas as they have

high visibility. The selection of resource persons has to be done carefully in this case. Transfer/migration of trainers can however affect the entire programme. Moreover training cannot be undertaken during harvesting seasons. In fact, compensation of wage loss should be considered seriously, if Panchayat members and Pradhans are to be involved in training exercises.

• Decentralized SATCOM based Training in Cascading Mode This methodology has been adopted with success mainly in Karnataka. It involves the use of satellite technology and local facilitators to run the programme and facilitate discussion. This mode provides the widest outreach and can help in providing comprehensive training inputs to a large audience. It also has the advantage of ‘bringing reality into the classroom’ without taking the trainees on a study tour. However, it involves a huge cost, is dependent on technology for its success and also requires large infrastructure in terms of local receiving centers. Where the trainee’s learning capacity is limited, a more direct approach



rather than SATCOM may be more appropriate. As of now, only one-way video and two-way audio facilities are available in most states. This rules out face-to-face interaction and limits effectiveness of the programme. It is difficult to retain interest in the transmission for a longer duration. Moreover, the trainee’s availability as a ‘captive’ audience cannot be ensured. In the context of the focus states, the biggest constraints in implementing this methodology are non-availability of continuous power supply and inadequate dedicated phone lines.

• Decentralized Group Training in Cascading Mode This involves training of resource persons as master trainers at state level, District resource persons at District level and local resource persons at local level and their deployment for training and hand holding of Panchayati Raj representatives and officials in planning, implementation and monitoring of development plans. Kerala has successfully pioneered this method and has developed a pool of 700 master trainers. The training occurs in smaller and viable groups and therefore the quality of learning is superior. However, the experience in Kerala was in the context of the larger people’s planning campaign, which was accompanied by social mobilization, civic education and devolution of funds, functions and functionaries on a large scale. This methodology is also dependent on the ready availability of large number of well-educated and motivated personnel as resource persons at various levels. Table below shows the trainings vs the delivery mode that can be adopted to deliver trainings at different levels of PRIs

Trainings Target Audience

AIM Delivery Mode

Type of Training

Core Functional Skills

Budget Preparation

PR Dept, PRI's

To have understanding on role in budget preparation, analysis of past data, availability of resources etc

Instructor Led Centralized Institutional Training

Refresher Course in Accounting

PR Dept, PRI's

To understand accounting concepts and general transactions w.r.t. schemes implemented and services delivered.

Instructor Led

Decentralized ‘Direct’ Training in Cascading campaign Mode

Refresher Course for Decentralized Planning

PR Dept, PRI's

To enhance ability to carryout planning in a systematic and logical manner with community participation.

Instructor Led





AIM Delivery Mode

Type of Training

Drafting Government documents such as notice, circulars, General Office Administration

PR Dept, PRI'sTo draft Government documents such as notices, circular etc

Instructor Led Decentralized Group Training in Cascading Mode

Data Analysis PR Dept, PRI's

To analyse data related to information provided from PRI's and collected from other line departments

Instructor Led Centralized Institutional Training

Schemes guidelines and awareness

PR Dept, PRI's

To have clear understanding on CSS guidelines and its implementation and role of respective officials/member

Instructor Led Decentralized Institutional Training

Knowledge about committees and roles of PR officials, Relevant Sections of PR Act, RTI, Citizen Charter

PR Dept, PRI's

To have understanding on PR Act, officials/members roles and responsibilities, accountability etc

Instructor Led Decentralized Institutional Training

Technology Related

Basic computer knowledge like MS Office, Using internet, mails

PR Dept, PRI's

To improve ability to carry out day to day functioning with the help of computers like sending mails, information's, attaching relevant documents etc

Instructor Led


Software's proposed for PR

PR Dept, PRI's

To carryout regular office activities for planning, accounting, reporting in applications like PlanPlus, PRIAsoft etc

Instructor Led


Updating Panchayat State Portal

PR Dept, PRI's

To update Panchayat State Portal at Gram, Block and Zila Panchayat w.r.t. information's, data, notifications etc

Instructor Led


Soft Skills




AIM Delivery Mode

Type of Training

Conducting Effective Meetings

PR Dept, PRI'sTo conduct regular official meetings effectively.


Conducting Effective Gram Sabha

PR Dept, PRI's

To conduct Gram Sabha effectively by raising GP concerns w.r.t planning, financial information, service delivery, status of last Gram Sabha etc


Encouraging Community Participation

PR Dept, PRI's

Through Gram Sabha or otherwise encourage community participation in scheme implementation and other activities for the benefit of villagers


Communication skills

PR Dept, PRI's

To improve communication skills so as to have effective and clear interactions with officials, citizens and elected members

Instructor Led



7.1.2.3 Training Facilities

The UIRD infrastructure shall be used to impart these training. There are five Regional Institutes for Rural Development (RIRDs) and three District Institutes for Rural Development (DIRDs).

Table 9: UIRD Extension Training Centre

Source: UIRD Website and PR Department, Uttarakhand

7.1.3 Training effectiveness and support

Monitoring and Evaluation of Training Programmes It is particularly difficult to evaluate training programmes since their impact is not immediate and may not be directly visible to the beneficiaries. The following factors need to be considered while evaluating training programmes:

• Timescale- sufficient time has to factor in for the impact of the training inputs to become apparent.

• Contamination effect - Refers to the role of other factors like changes in policies, technologies, systems, managerial style, work culture etc that may also affect the outcomes.

• Management support: Support of key officials for resources, standards/criteria, approval, commitment to accept results of evaluation etc.

Suggestions for monitoring and evaluation

• Structured inbuilt mechanism of monitoring and evaluation of training • Capacity for impact assessment to be developed – involvement of sectoral

functionaries • Build a common network/platform to share the best practices • Create a feedback loop

S No. Name of Extension Training Centre (ETC)

1. ETC Rudrapur, Uddham Singh Nagar 2. ETC Hawalbagh, Almora 3. ETC Pauri 4. ETC Tharkot,Pithoragarh 5. ETC Haridwar 6. ETC Dehradun 7. ETC Gopeshwar (Chamoli) 8. ETC Haldwani



• Feedback for interventions in non-training areas from appropriate authority. • For training interventions, recheck TNA/ Training Design and modify them, if

needed. • Action Learning Project should be a part of the training. • Quality of training should be included in the assessments. • Use of social audit to evaluate training provided to Gram Panchayats • Web based monitoring system • Every training project should have a budget for monitoring and evaluation. M&E

should be part of the project right from inception. • Assess whether the training programme benefits the ultimate beneficiaries. • Informal assessments from peers/colleagues. Documentation of such processes is

important.

Due to geographical differences, a uniform approach to the trainings might not be appropriate. Regional/local centres in the state can be identified that can ensure that all the parameters related to training are adhered to.

• Since there are several agencies-UIRDs, ATIs/IGNOU/Civil society organizations can be involved in providing training to the PRIs, there has to be coordination between these agencies at a policy level.

• The state training institute must undergo a diagnostic review / introspection exercise and identify areas of improvement and arrive at a step-by-step action plan to make this change.

• Reorientation of faculty on aspects of PRIs. – Faculty development is a very important exercise that needs attention.

• Develop a cadre of self driven faculty at UIRD • Systems should be put in place for fostering faculty motivation- either by incentives

or through promotions.

7.2 Bills of Material

Owing to the mammoth structure of the PRIs, it may not be possible, imparting training to every PRI member. As discussed above on the virtue of past experiences, cascading mode of training has been recommended. Based on the above recommendations Bill of material detailing the number of participants to be trained at each level of PRI is given below. The total participants that are required to be trained have been distributed on an year-wise basis. Officials No of training days

per PRI officials Members No of training days

per Member ZP 6 12 2 6 BP 3 12 1 6 GP 1 12 1 6



• Zila and Janpad Panchayat: 75% of total participants would be department officials

and 25% of the total participants would be elected members

• Gram Panchayat: Out of the total participants 50% shall be officials and rest 50% shall be elected members.

Total PRI Officials & Elected Member to be trained

PRI Officials To

Be Trained (Number)

Participants To Be Trained (Number)

Level Year 1 Year 2 Year 3 ZP 78 30 24 24BP 285 96 96 93GP 7541 2514 2514 2513

Total Cost 114027840

PRI Members To

Be Trained (Number)


Level Year 1 Year 2 Year 3 ZP 26 10 8 8BP 95 32 32 31GP 7541 2514 2514 2513

Total Cost 55271448

Also as part of the capacity building, contractual manpower has to be deployed at each tier of the PRI the table below presents the BOM for the contractual manpower deployed at each tier, Gram, Janpad and Zila panchayat.

Description Number Number of Manpower at each ZP

1

Number of Manpower at each BP

1

Number of Manpower at each GP

1



8 Change Management Requirements

The Program Management Unit defined in section 10 would have one change management consultant who would guide and prepare the necessary road map. The following subsection would focus on:

• Understanding the stakeholder who would be impacted by implementation of business process re-engineering framework

• Developing effective awareness and communication plan

8.1.1 Mapping the entire critical stakeholder community

Stakeholder Impact

Rating Influence Rating

Involvement Rating

Communication Channel

Owner

Citizen High Low Medium In Gram Sabha, notice boards, announcements, Audio visuals

Gram Pradhan and GPDO

PRI’s High High High Letters, emails, meetings, trainings

Project Manager

Line department Low Low Medium Letters and emails Secretary PR

State PR department

Medium High High Meetings and emails Project Manager

Implementation vendor

Low High High Meetings, mails, letters

Project Manager

This section describes the strategy and roadmap for Change management to ensure smooth transitioning from the current state to the desired level. The objective is to highlight certain activities that shall be required for smooth transition and would be imperative for successful implementation of the e-PRI project. The overall cost of Change management in Uttarakhand which includes cost for Information, Education and Communication is estimated at Rs. 1.64 Cr.



8.1.2 Information, Education & Communication (IEC) Plan

Communication plan The vision of communication plan is that keep stakeholders informed as state go along implementing and operating the e-PRI project. The communication plan described in this section has been categorized under two main sub heads, Monitoring related and sensitization related communication plan. Monitoring related plan focuses on communication that shall be required to be sent out to different stakeholders primarily officials and Implementation vendor for better monition the e-PRI project, on the other hand sensitization related plan deals with communications that shall be sent out with an objective to inform and sensitize the stakeholders towards the change foreseen by implementing the proposed system. Monitoring related Communication plan

Table 10: Monitoring related Communication Plan

Name/Nature of Communication

From To Content Provided by

Frequency Format Used

Delivery Media Remarks

State PR department Urgent Issues Project

Manager - SPMU

Secretary PR and Commissioner

Project Managers- SPMU and Team Manager

As needed Any Verbal, E-mail, Memos The Project Manager will collect the issue and add an entry in the Issues Log.

Issues Updates/ Resolutions

Secretary PR

Project Manager - SPMU

Secretary PR As needed - Verbal, E-mail, Memos The Project Manager will update the Issues Log.







Status Report Project Manager - SPMU


Team Manager, Team members

Weekly Status Report form

E-mail or Shared Storage

The Project Manager will pull information gathered from the program status reports.

Special Presentation or Meetings for Updating Principal Secretary

Project Manager – SPMU

Principal Secretary

Program Manager – SPMU

As needed - Meeting/Presentation

Change Request Project Managers - SPMU

Secretary PR Project Managers - SPMU with help of Team Manager

As needed Standard Change Request form

E-mail These change requests will be submitted to the Secretary PR, discussed at the weekly Status meetings

PRI Project updates Project

Manager - SPMU

PRI Project Managers- SPMU, Team Manager and Members

(1) Weekly (via the Project Status Report) (2) As needed (via Project Manager)

(1) Project Status Report form (2) Stakeholder Meeting Minutes document

(1) E-mail (2) Meeting Minutes







(3) As needed (via Stakeholder Meeting minutes)

Issue Items Status / Updates / Resolution

Project Managers- SPMU

PRI’s Project Managers- SPMU, Project Team Members

(1) Weekly (via the Project Status Report) (2) As needed

(1) Project Status Report form

(1) E-mail (1) If the status/update/resolution is received through the Project Status Report, the Project Manager will enter it into Project log. Status/updates will be submitted as “Responses” to a main-topic record in Project Log. If a resolution is received the project manager will enter the resolution in the log and close out the issue/action item.

Change Requests Project Managers- SPMU

PRI Project Managers- SPMU and

As needed - E-mail Providing Information for the changes proposed







approved by Secretary

Sign Off for deliverables/ Completion of a phase

Project Manager- SPMU

PRI Team Manager

As Needed Sign off Email

Line departments New Issues/Action Items

Line department


Stakeholders As Needed Letter, fax, e-mail

Issues/Action Items Status, Updates, Resolutions


Line department

Team Manager

As-Needed - E-Mail/ Fax/ Letter

Phase Completion report


Line department

Project Managers – SPMU

Phase Completion

- E-Mail/ Fax/ Letter On successful completion of phase

Implementation Vendor Change Request Team

Manager Project Manager - SPMU

Team Manager and Team Members

As Needed Change Request Form

E-Mail These change requests will be submitted to the Project Manager, discussed at the weekly Status meetings

Work Package Project Team Manager Project On initiation Work e-Mail







Manager - SPMU

Manager – SPMU

of completion of a Work package

Package

Issue Team Manager


Team Members

As Needed Issue report e-Mail

Weekly Status Team Manager


Team Manager

Weekly Status Report

e-Mail

Sensitization related Communication plan Sensitization related communication plan focuses on informing the citizens and the officials about the change that shall be brought up by implementing the e-PRI system. It regards to citizen, it is imperative to win their confidence for the new system and processes. Citizen centric communication has been designed for addressing some of the key concerns that shall be faced by citizens. Due to introduction of radically changed processes and systems, citizens may have the following concerns:-

• Information dissemination on e-PRI system • Ease of accessibility of the system • Reliability of the system • Availability of the system



On the other hand, another perspective to the Sensitization related communication plan is towards Officials of PRI and State PR department. Having a number of years of experience of implementing ICT related initiatives in Public sector organizations and Government bodies; it has been observed that Officials/employees at times resist the change. There are number of well known reasons which include vested interest, loss of authority, fear of the unknown, reluctance to make the effort involved, upsetting a well established routine, fear of failure, lack of conviction in the change causes, lack of proper communication, etc. Hence it is very important to acknowledge these feelings and address them through continuous interaction & strategized communication plan, rather than withholding information or not acknowledging employee reactions, fears, and doubts. It is also important to remember that apart from managing resistance from the employees, it has to be ensured that the citizens have access to undisrupted services in the new system and framework. Keeping the above issues at focus, creating awareness among the employees about the new system is of prime importance. The table below briefly describes the sensitization related communication plan.



Table 11: Sensitization related Communication Plan



Launch of Communication

Frequency Delivery Media Remarks

State PR department Orientation towards leading change

Third party Vendor


Third party vendor

Prior to Starting of the project

Once Workshop The workshop shall address the issues related to change management and how lead a change

e-PRI Information Digest


Officials of State PR department

Change management expert and Team Manager

Starting of the project

Monthly e-PRI Monthly periodical( magazine)

This shall be printed till the Go-Live of all three Waves(phases) and if found effective shall be continued (as required)

Citizens Information dissemination about e-PRI

Project Manager –SPMU

Citizen Change Management expert –

15 days Go-Live of Phase

- Advertisement in local newspaper

Advertisement for a period of 3 months







project

SPMU and team manager

Permanent Go-Live of Phase

- Hoardings to be displayed on Gram Panchayat Bhawan

- Display on notice board/Posters

1 month Month Prior to Go-Live of a phase

- Radio telecast

For a period of 3 months, telecast should focus on informing citizens about the benefits and ease the system shall provide and how can the citizen avail services

15 days Go-Live of Phase

- Announcement in villages through duggie

For a period of 3 months

Addition/Change of services

Project Manager -

Citizen Change Management

- As Needed - Notice board of GP







SPMU expert – SPMU and team manager

PRI Information on provision of new services

Secretary PR department

PRI Project Managers, Team Manager and Members

Provision of New service

Once Government Order and website

The same GO shall be uploaded on website

Information Digest about e-PRI


Officials and employees

Change management expert and Team Manager

Starting of the project

Monthly e-PRI Monthly periodical( magazine)

This shall be printed till the Go-Live of all three Waves(phases) and if found effective shall be continued (as required)

Change Champions

Secretary PR department

PRI Project Managers and approved by Secretary

Start of Implementation of a Phase

Quarterly Awards to be provided to nominated Change Champions

These shall be printed in the monthly periodical published to be







distributed to officials

Initiating the change


PRI Project manager

Start of Implementation of a Phase

Quarterly Workshop District wise workshop.

Line departments Informing about e-PRI project and devolved services

Secretary PR

Line Department

Change Management expert-SPMU

Kick off of implementation

- Government Order

Government Order for the e-PRI to be provided to line department

Launch of e-PRI Project Manager – SPMU

Line department

Team Manager

2 months prior to Go-Live

- Letter

• The team manager mentioned above is corresponding to the Implementation Vendor/ Implementation agency that shall

be engaged for implementing the project.



9 Implementation strategy This section elaborates on the implementation strategy to be adopted for the Rollout of e-PRI MMP in Uttarakhand. It covers the important aspects like key considerations for implementation and implementation plan with timelines. Key Considerations for Implementation

While considering phasing of the implementation, it is important to identify the factors that influence the phasing strategy and accordingly define the phases. In this section, the key parameters considered by the team have been discussed. The key considerations to be undertaken while implementing e-PRI MMP in Uttarakhand are enlisted below:

1. Guidance, ownership and support from leadership: Uttarakhand, being a new state, proper guidance and support from leadership is immensely important for the successful implementation of e-PRI project. Capacity building of the PRI members, both elected representatives and government officials, at the District, Block and Gram level is one of the major components in the project. Thus, it becomes imperative for both the elected members as well as the government employees to provide their assistance in computerisation of the PRI offices and delivery of the citizen services through electronic mode. Effective coordination among the elected representatives and the government employees is essential for smooth functioning of the system.

2. Successful and timely implementation of State Data Centre: State data centre (SDC) has been identified as one of the important element of the core infrastructure for supporting e-Governance initiatives of NeGP. Under NeGP, it is proposed to create state data centres for the states to consolidate services, applications and infrastructure to provide efficient electronic delivery of G2G, G2C and G2B services. State data centre is envisaged to act as a mediator and convergence point between open unsecured public domain and sensitive government environment. It would enable various state departments to host their services / applications on a common infrastructure leading to ease of integration and efficient management, ensuring that computing resources and the support connectivity infrastructure (either through SWAN or NICNET or ISPs) would adequately and optimally be used. The Uttarakhand Government is in process of finalizing implementation plan and other aspects for setting up centralized Data Centre for hosting state Government Department specific Applications and it is expected to be operational by the end of 2010 or early part of 2011. Majorly, the SDC would function as a central repository of government data, secured store-house of information, information and service portal for citizens and disaster recovery centre for confidential information in the



state. Thus, it can be concluded that the successful and in-time establishment of the SDC would provide a strong platform for the implementation of e-PRI MMP in Uttarakhand.

3. Ease of implementation: In Uttarakhand, because of geographical constraints and hilly terrain, it would be difficult to launch the project at one go all across the state. Moreover in State, there are 13 District Panchayats, 95 Block Panchayat and 7541 Gram Panchayats. Thus computerisation of PRI offices at the District, Block and Gram level is required to be done in phases. In order to ease the implementation process, in the first phase, the project should be launched at all the Districts and Block Panchayats where the local government as well as the citizens are proactive in their approach. Also selection is done for 1474 Gram Panchayats of four districts Dehradun, Haridwar, Nainital and Udham Singh Nagar. Due to plain region of the State, the connectivity, infrastructure and quality of resource will be better. Proximity to State capital is another reason for selection of these GPs for initial implementation. The awareness level of the people in these GP would be more than any other District in the state which would in turn smoothen the implementation of the project.

4. Level of expenditure while implementation: In Uttarakhand, the District and Block Panchayat offices are already provided with hardware and basic software applications. However, connectivity is one of the issues which need immediate attention of the central and the state government. Due to lack of internet connectivity and skilled manpower, in most of the District and Block Panchayat offices, the IT assets are not utilized optimally. Thus, at the District and the Block level, implementation of the project could be done only by providing connectivity (either through SWAN or ISPs) and by providing technical manpower. Thus computerisation of the ZP and BP office would become cost effective to certain extent. Thus it would be feasible to take up the computerisation of the ZP and BP office at the first phase of the project implementation.

5. Third party interventions: The most important factor influencing the implementation is the proposed business model for the project. The most rationale business model for implementation of the project is the involvement of the private agency along with the government machinery. The private agency could play a pivotal role in daily functioning of the newly introduced computerised setup. The private entity would be able to provide technical assistance to the PRI officials in their day to day functioning. Moreover, the technical staffs at the ZP, BP and GP offices could be hired on contract from a private agency for the first five years of project implementation. The private entity could also provide their assistance in capacity building of the in-service PRI employees and could organise periodic training programmes on usage of computers and other software applications. This would, in turn, minimise the total project cost.



6. Awareness among citizens about the new system: One of the major target groups of e-PRI project is the citizens. e-PRI project aims to re-engineer the delivery mechanism of the citizen services provided by the PRIs. Post implementation key services identified during the study phase such as birth, death and marriage registration and issuance of certificates, provision of work under NREGA, provision of financial assistance for construction of houses or toilets, etc are envisaged to be delivered through electronic mode. This would enhance the transparency and accountability of the government machineries towards the citizens. However, dissemination of awareness among citizens would play an important role in successful implementation of the project. Thus, at the preparatory phase of the project implementation, awareness level of the citizens is required to be addressed by the state PR department.

7. Proximity to State Capital

To begin with e-PRI MMP’s implementation / pilot implementation may be appropriately anchored in Districts that are closer to the State Capital if the State sees advantage of supervision and guidance from the State PR Department. Logistics associated with implementation is perhaps easier in Districts that are closer to the State capital.

On the contrary, e-PRI MMP may serve Government and Citizen needs of Districts that are remote and away from the State capital. This view gains credence in States where the Government functionaries are well aware of e-Governance and the State PR department does not see any risk in choosing Districts that are distant from the State capital for implementation.

Based on which of these two views gains more weightage, the implementation phases could be defined.

8. Terrain related challenges and Infrastructure availability

While implementing e-PRI MMP, it is important to understand that terrain of Districts and Civil & IT infrastructure availability plays a vital role. Implementing the MMP is Districts that are easily accessible may be easier and quicker compared to choosing those that are inaccessible. Plains and valleys may be easier compared to choosing hilly terrain. Likewise, Districts that have good Civil and IT Infrastructure will be easier to implement the MMP since the State can leverage the existing infrastructure instead of investing time & money in creation of infrastructure. Quiet often choosing the ‘low hanging fruits’ first (i.e., Districts that have ready infrastructure) will facilitate quicker adoption and easier replication.



9. Status of Capacities in the State

Districts which have adequate human resource capacity and skill set pertaining to PR Governance could be chosen over ones which do not have the Capacities. This is vital parameter for the success of the e-PRI implementation.

9.1 Project Phasing (Time Schedule)

Implementation of e-PRI for Uttarakhand has been envisaged through coordinated efforts between Centre and States for the roll out of e-PRI. This approach advocates laying down the common guidelines and project artifacts (e.g. RFP), along with a robust monitoring and implementation structure at the Center and anchoring the project implementation at the State. The project will be executed in a Service Procurement Model (SPM), where a Service Agency(ies) (SA) will be selected through a competitive bidding process by the States. The implementation plan is divided into the Preparatory Phase, RFP phase, Deployment phase, Operations & Maintenance and Ongoing Project Management. The deployment is based on assumption that on an average 45-50 PRI sites go up in a day to complete the deployment phase in 6 months duration. The State may decide to engage multiple SA, region-wise or district-wise depending on local suitability and the size of implementation as per the number of PRIs in the state to follow the implementation plan proposed. The phases and activities to be undertaken during implementation have been presented in the project plan below.



Table 12: Implementation Plan

Sn Tasks 1 2 3 4 5 6 7 8 9 10

11

12

13

14 to

48

A Preparatory Phase Formation of CPMC by MoPR in consultation with CLMs and NIC Visioning workshop for CPMC by MoPR

Directing the state governments to form SPMC comprising of SLD and NIC representatives

State-level visioning workshops in states (also involving CEO ZPs) Formation of CPMU to assist the CPMC Selection from empanelled agencies for formation of SPMU Formation of SPMU to assist the SPMC

Directing the 13 Districts to form DPMC (headed by CEO, ZP) comprising of SLD and NIC representatives

District-level visioning workshops in 13 districts B RFP Phase

Preparation, Approval & Release of Model RFP including SLA at central level

State-wise prioritization of services to be rolled out and issue of necessary GOs

Data gathering by SPMU for finalization of BOM based on inputs by DP/BP/GP

Customization of Model RFP at state and approval by SPMC

Release of RFP, Pre-bid, corrigendum & proposal submission by Service Agency

Techno-commercial evaluation, selection of service agency, negotiations & contract signing

Timeline (in months)



Sn Tasks 1 2 3 4 5 6 7 8 9 10

11

12

13

14 to

48

District-level kick-off meetings in 13 districts with vendor Finalization of implementation plan with vendor

C Deployment phase ICT Hardware Site survey for the user level hardware and Network installation Preliminary inspection of hardware and network components

Network and hardware Installation and commissioning at data

centre Network & hardware Installation & commissioning at PRD Network & hardware Installation & commissioning a ZP Network & hardware Installation & commissioning at BP Network & hardware Installation & commissioning at GP

Acceptance tests for the network and hardware by Panchayat

Secretary, EO-BP, CEO-ZP Onsite inspection

Data Entry Mapping of Data, data entry and validation ePRI application development Preparation of SRS, Design documents and test plans Software development / customization / integration Installation and Configuration of software User Acceptance Testing for state-specific applications Manpower and Training Deployment of manpower at locations Preparation of state-specific training plan and approval Imparting training as per training plan Training Completion report, feedback and sign offs



Sn Tasks 1 2 3 4 5 6 7 8 9 10

11

12

13

14 to

48

D Operations and Maintenance Provide ongoing support E Ongoing project management Sustenance Effort Project Evaluation



Key activities covered in the implementation plan have been described below with the list of

deliverables that shall be provided by the Implementation at the time of Implementation.

Figure 8: Implementation Phases

No. Area Scope of work a. Setting up of Program

Management Committees & PMU ( Central &State) PS: Refer section 10 for detail roles & responsibilities of Program management Unit

The preparatory phase beings with the setting up of committees of all three levels Central, State, District. These shall committees shall perform their roles in implementation of e-PRI. Deliverable

• Minutes of Meeting and finalized list of officials

b. Preparation, Approval & Release of RFP for Implementation Partner

Model RFP (Request for Proposal) for the selection of implementation vendor shall be prepared at the central level and would be provided to the State for customization and release by SPMC or whichever agency authorized for such task. RFP shall include all major tasks to be performed by the implementation vendor like training, data digitization, supply and installation of Hardware and network equipment, customization and development of application and manage IT services. Deliverable

• Request for Proposal

c. Evaluation and Selection of Implementation Partner

Various agencies shall bid for the RFP released by SPMC. These bidders shall provide response to the RFP which shall be evaluated by the evaluation committee/SMPC. Finally the successful bidder shall be awarded the contract. Deliverable

• Successful bidder

• Awarding contract and Contract Signing

d. Onsite assessment by Implementation vendor

The Implementation vendor must clearly understand e-PRI’s requirements and propose solution. He must study the ICT infrastructure needs for e-PRI project and gather the detailed requirement, understand the setup and perform the gap analysis (if required) with the proposed solution as given in RFP. Deliverables:

• Inception report • Sign off

e. Preparation of FRS( Functional

The selected Implementation Vendor shall prepare the Functional Requirement of the application; these



No. Area Scope of work Requirement Study) and SRS(System Requirement Study )

functional requirements shall be vetted by the SPMU. On approval of the FRS the vendor shall proceed to prepare the System Requirement Specifications. Deliverables:

• Functional Requirement Specification • System Requirement Specification • Sign off

f. Solution Design and Solution Architecture

The vendor shall perform the following tasks: 1. Design of Application 2. Design of Workflow with well defined business rule

for the application 3. Design of Data Center 4. Design of LAN and Internet connectivity as per

requirement with proper documentation. 5. Design of Application Architecture 6. Design of Network & Security Architecture 7. Data Digitisation and migration methodology. 8. Design of Overall IT Infrastructure 9. Design of Logical and Deployment Architecture 10. Design of Integrations methodology 11. Design of Quality Assurance Plan & Methodology 12. Design reports as required by SPMU

Deliverables:

• Final Bill of Material (BOM) for Solution Implementation

• System Design, solution design and Architecture Document

• All Policy, Plan & Methodology Documents • Sign off

g. Application Development

The selected Implementation Vendor shall develop e-PRI system based on the specifications finalized through the System Requirement Specifications and Solution design. Deliverables:

• Delivery of e-PRI Software by the Implementation vendor, Licenses, Operational/Technical manuals, library files, setup programs etc.

• Sign off h. Procurement,

Installation, Setup of Hardware and Network Equipment

Implementation vendor shall be required to undertake all the necessary installation of DC. Installation shall mean, to install and configure / integrate every component and subsystem component, required for functioning of the e-PRI system Procurement of infrastructure/facilities as proposed by the implementation vendor in the Bill of Material (BOM) as per the requirements of new system Deliverables:

• IT infrastructure required for new proposed



No. Area Scope of work solution/system.

• Infrastructure Delivery Certificates. • Sign off

i. Data Digitization & Migration

Implementation vendor with assistance of PRI’s, would collect data in paper or electronic form and would digitize it in the required manner for storage and retrieval by the system. The implementation vendor shall be responsible for master data creation. Collection and entry of various historical data for creating Knowledge Data base for trend analysis, Decision support system and faster retrieval with document searching facilities. Deliverables:

• Meta Data & Master Data creation • Data digitization and migration completion • sign Off

j. Comprehensive Training and Change Management

Implementation vendor shall impart training to relevant stakeholders and shall undertake Change Management interventions as identified during the previous stages and improvements thereupon. Implementation vendor shall be required to train the officials as per the indicative training plan by SPMU to enable them to effectively operate the system. Also the Implementation vendor would deploy a single resource for data entry related tasks at all the three levels of PRI. Deliverables:

• Training Plan & training strategy • Undertake Change Management and training

interventions as per training plan approved by SPMU

• Training outcomes monitoring • Documentation such as Training material, User

Manuals, Maintenance Manuals, etc on 1:1 basis. • Sign off

k. Over all Testing and UAT

The Implementation vendor shall design Test plan and Cases for the solution testing which will need to be approved by the SPMU. The Implementation vendor shall perform the testing of the solution based on the approved test plan, document the results and shall fix the bugs found during the testing to the satisfaction of the SPMU. The implementation vendor shall arrange the equipment for testing. The test environment should match the roll-out environment as closely as possible. SPMU will sign-off on the testing environment. Following shall be the Scope of testing

1. All levels of testing will be conducted at the installation site.

2. Testing must demonstrate that the new systems satisfy the operational and technical performance



No. Area Scope of work criteria.

3. It shall be Vendor’s responsibility during the tests to evaluate and recommend any further changes to the infrastructure & application

4. The Implementation Vendor must outline the methodology that will be used for testing.

5. The Implementation Vendor must define the various levels or types of testing that will be performed.

6. The Implementation Vendor must provide necessary checklist/documentation that will be required for testing.

7. The Implementation Vendor must describe how the testing methodologies will conform to requirements.

8. The UAT shall be conducted with the real data. Deliverables:

• Testing approach, Plan and Test Cases. • Documentation on the results of the software

testing • Error free e-PRI system • Testing of IT infrastructure solution. • Signoff

l. Solution Implementation (Go Live)

Implementation vendor shall be responsible for implementation of the e-PRI system and overall system integration. Deliverables:

• Completion of Solution Implementation • All the relevant documents related to

Implementation. • Demonstration of few sample transaction of

various departments on Live environment • Sign off



10 Program Management Structure

The design and implementation of ePRI MMP is a complex exercise under the federal

structure which involves formulation of detailed scope and project plan with necessary

commonalties at the National level while allowing adequate scope for interplay of local

variations, rules, procedures and implementation at the State level.

Some of the key issues that need to be addressed are:

Clear Roles and Responsibilities

Implementation Structure

Reach till the grass root level

Participation till Grass root level

PRIs function at the village, intermediate (block) and district level. There are approximately

2,34,030 Gram Panchayats at the village level, 6053 Janpad Panchayats at the block level

and 535 Zilla Panchayats at the district level. There are more than 31 lakhs elected

representatives at all three tiers.

Given the enormity and complexity of the project, the implementation of the same requires

a robust and still flexible project governance and management structure. The objective of

project management is ensuring the implementation of the project as per the defined

requirements, timelines, deliverables and budget. The project monitoring teams will be

This section provides details of the project management structure that needs to be constituted to implement the ePRI project in the state. The details of the various committees to be formed at the Centre/ State/ District level, their composition and the roles & responsibilities are detailed out in this section. The State Project Management Committee (SPMC) and the State Project Management Unit (SPMU) at the State the District Project Management Committee (DPMC) at the district and Block Support Group (BSG) at block will be responsible for implementation & Monitoring of the project across the state, under the guidance and supervision from the Central Project Management Committee (CPMC) & Central Project Management Unit (CPMU) at the central level. The total ePRI PMU at the state level and BSG at block level are Rs 6.09 Cr & Rs 4.69 Cr respectively



responsible for managing the overall project execution by the selected Service agency(ies)

and ensuring that key objectives of the project are met and issues are highlighted in a

timely manner.

It is proposed to have well defined governance structure at Centre i.e. the Program review

board with representatives from MoPR and each State. Further, it is proposed that Project

Management Unit (PMU) to be designed and set up at two critical levels of project

implementation namely at the centre – MoPR – and at the state – State PR.

It is imperative to have participation from all the key stakeholders viz MoPR, NIC, DIT and

key Central Line Ministries at the Central level. Entire project implementation will be led by

the center and states have to be key participants in this Endeavour. Unlike other MMPs,

ePRI MMP program governance structure will have participation till the grass root level i.e.

the Gram Panchayats, which can be made possible by involving the Districts and blocks in

the implementation process. Hence a three tier structure is proposed for program

governance of ePRI MMP implementation:

Central Level Body – Headed by Program Review Board (PRB)

State Level Body – Headed by State Programme Management Committee

District Level Body – District Programme Management Committee

Sections below detail out the structure, roles and responsibilities of each of the above

mentioned level of program management structure proposed.

10.1 Project Management & Governance Structure at Centre

The project governance structure provides a framework for the operations to support the

MoPR and State PR for various activities and options relevant to successful

implementation of the ePRI MMP, right from project conceptualization stage to complete

roll out phase.

The Governance Structure for project at Centre would be a three layered structure as

illustrated in the figure below. The first layer would consist of a Program Review Board.

The second layer would consist of key committees to act as advisory committees to the

PRB on various aspects such as Technical, Functional, eGov Standards and Change



management and the third one consisting of Central Programme Management Unit

(CPMU).

Figure 9: Central Level Body for e-PRI MMP Implementation

• Programme Review Board (PRB) - It is proposed to setup Programme Review Board to advise the government and monitor the progress of the overall programme. The board will have representation from all states and NIC under the coverage of e-PRI MMP. This will be chaired by Secretary, MoPR, GoI and convened by the Mission director / JS, e-PRI.

• Sub-Committees - As part of the PRB, it is proposed to setup the following sub-committees to manage the respective areas. These committees will have representation from a few states:

o Technical and Standards Specification Committee – This will also include members of technical institutions. Its responsibilities will include:

Scan emerging technology scenarios

Provide & finalize technical specifications, keeping in mind the cost and sustainability issues, so that the same could be adopted in proposed software



It will also include domain experts and members of academia (NIRB, IIPA etc.) engaged in study and research on matters relating Panchayati Raj and local governance. Its responsibilities will include:

• Ensure adoption of the prevailing suitable standards

• Develop domain specific standards if any

o Domain Advisory Committee - Its responsibilities will include provide domain expertise in the following areas:

PlanPlus

ActionSoft

National Panchayat Directory (NPD)

PRIAsoft

ServicePlus

Profiler

Taxation

National Panchayt Portal (NPP)

• Central Programme Management Unit (PMU) - It is proposed to setup Central Programme Management Unit, headed by Mission Director i.e. JS, MoPR, to manage the future action plan on the e-PRI MMP including software development, deployment, operationalization and change management. The constituents of PMU will include:

o Officials from NIC and MoPR

o Contract / Consulting staff

o Support staff

Structure of CPMU for Implementation of ePRI MMP: Structure of CPMU for Implementation of ePRI MMP: The team of Central Programme Management would comprise of 13 personnel, primarily to focus on co-coordinating the whole project at the India level with all the States. The Central Programme Management Unit (CPMU) would timely avail the inputs provided by the State project management units (SPMU) and the State representatives.

• Project Leader - 1, NIC

• Project Manager – 1 PC

• Technology Consultant - 1 (SC)

• Capacity Building Consultant - 1 (SC)



• Bid Process Expert – 1 (PC)

• State Project Coordinators – 9 (9 SCs – 1 each for minimum 4-5 implementation sites)

Figure 10: CPMU structure

The CPMU’s primary responsibilities will include: The broad responsibilities include timely completion of the project, Quality of deliverables, SLA Monitoring mechanism, Risk Assessment Framework, Monitoring and Evaluation mechanism and the Methodology and framework for reporting. The detailed responsibilities of the Central PMU would include, but not be limited to, the following:

• Execute the guidelines finalized by the PRB

• Execute the decisions finalized/approved by MoPR

• Analyze proposals on ePRI received from states.

• Manage coordination between the sub-committees and the PRB

• Provide support to the sub-committees and the PRB.

• Oversee day-to-day functioning and

• Manage overall coordination and liaisoning with states



• Preparation of Project Plan with detailed activities and timelines in consultation with Service Agency (ies)

• Validation of Design formats prepared by Service Agency (ies) for data exchange between centre and state, to meet the MIS requirements of MoPR

• Monitoring of Project Implementation in terms of managing the Project timelines, Quality of deliverables by close coordination with both Central implementation agency (NIC) and State Service Agencies.

• Ensuring Strategic control of the project with Centre

• Working on the regular inputs provided by the State PMUs

• Designing Model RFP for the States to customize according to the state specific requirements

• Appraisal of DPRs, RFPs received from the states based on the detailed guidelines, SLA s issued by the MoPR from time to time

• Guiding and assisting the Bid Process Management for the MoPR and State PR departments for selection of Service agency(ies).

• Ensuring the incorporation of open standards for interoperability, seamless data transfer between State and Centre in the recommended solutions as per the E-Governance standards.

• Coordination and Liasoning by State Project Coordinator with various State PMUs.

• Resolve the issues raised by the SPMU on the implementation issues like SLA, technology, standards and domain issues etc.

• Setting Guidelines for SPMU to Review / monitor the progress implementations by the the State agency

• Assist to approve release of funds to the states for the project and their utilization.

• Guiding and assisting the SPMU on maintaining quality and on time delivery / closure of milestones of the Project by State Service Agencies.

• Design parameters, metrics and methodology for collecting actual hardware and other supporting infrastructure requirement at the 3 tiers of PRIs for the states.

• Designing the MIS reporting & monitoring frameworks for the project

• Issue identification, tracking, escalation and resolution management between Centre, SPMU and state Service agencies in all aspects including customization of core application , data exchange and interoperability between Centre and States



• Coordination with different stakeholders and agencies and ensuring common understanding of issues between stakeholders

• Tracking timelines vis-à-vis the project plan and taking necessary action in case of slippages in coordination with SPMUs

• Validate the various training plans developed by Service Agency(ies) in coordination with SPMUs

• Monitor implementation of training plan in coordination with SPMUs

• Vetting of reports and deliverables of the State IA through respective SPMUs

• Supporting the MoPR in selection of an agency for conducting 3rd party Audits of the ePRI MMP, as required under the RFP.

• Maintenance of central repositories / tools for best practices, knowledge sharing

• Validate the Exit plan for the various Service agency (ies)

• Develop detailed Exit plan for the CPMU at the end of contract period

• Capacity Building and Knowledge transfer to the MoPR as per the Exit plan

10.2 Programme Management and Governance Structure at State

The State Governance structure would have three layers as shown in figure below. An Apex State Programme Management Committee (SPMC) for guidance and direction headed by the Chief Secretary PR of the state, second level i.e. the State Project e-Mission team headed by Principal Secretary PR , and the third layer consisting of State Programme Management Unit (SPMU)



Figure 11: Programme Governance Structure at State Level

10.2.1 Constitution of the Governance entities at State Level State Programme Management Committee:

• Chief Secretary

• Principal Secretary (In charge of the PR Department)

• Representative of Finance Department

• HODs of identified SLDs Department

• State IT Secretary

• NIC Representative

• Internal domain specialist (full-time)

• Representative of State DIT

• Representative from NIC – (SIO / SIO coordinator)



• Representatives from 3-4 District Programme Management Committees on Rotation basis

• Technical & Change Management Experts - Internal / Hired from industry and reputed institutions

• Any other person deemed fit by the Secretary

Role of State Programme Management Committee at the State level:

• Overall guidance

• Decisions on Policy matters

• Approval of all deliverables by various agencies/groups

• Financial Powers as per delegation

• Selection of Service agency / ies at the State

• Monitoring and quality audit of activities performed by service agency at the State

• Review of FRS at State level

• Monitor implementation of BPR and Change management

• Exercise Strategic Control

• Ensure certification from Certifying agency on application developed before full State level roll-out

• Ongoing support and guidance to SPMU

Structure of State PMU for Implementation of ePRI MMP

• Project Manager- 1 (PC)

• Technology Consultant- 1 (SC)

• Capacity Building Consultant- 1 (SC)

• Bid Process Expert - 1 (PC – Part time)

• Zonal Coordinators (1 SC and 1 JC, each, for a zone of 5 districts)



Figure 12: SPMC structure

Role of State PMU The broad responsibilities include timely completion of the project, Quality of deliverables, SLA Monitoring mechanism, Risk Assessment Framework, Monitoring and Evaluation mechanism and the Methodology and Framework for reporting. The detailed responsibilities of the State PMU would include, but not be limited to, the following:

• Design parameters, metrics and methodology for determining the actual requirements before project commencement

• Designing the MIS reporting & monitoring frameworks for the project

• Assist the SPMC in selection of service agency / ies at the State

o Customizing the Model RFP

o Bid Process Management for the State PR for selection of State Service Agency

Pre-bid conference

Techno commercial evaluation



o Negotiation and contract finalization

• Preparation of Project Plan with detailed activities and timelines in consultation with State Service agency (SIA).

• Review of FRS

• Assist the SPMC in identifying areas of customization needed in the core applications. Monitor the customization of core applications by SIA.

• Validate the IT security/Business Continuity Plan developed by IA and monitor its implementation

• Monitoring of Project Implementation in terms of managing the Project timelines, Quality of deliverables by close coordination with State Implementation Agencies

• Tracking timelines vis-à-vis the project plan and taking necessary action in case of slippages

• Assist the SPMC in prioritizing the legal changes required for implementing the reengineered processes.

• Validate Training Plan developed by Service Agency

• Monitor implementation of process changes. Assist SPMC in issue of GOs for institutionalizing the changes

• Monitor the imparting of training till GP level by SIA.

• Vetting of all progress reports and deliverables of the SIA

• Providing the required inputs to the Central PMU on regular basis

• Serve as secretariat for SPMC for the Project

• Ensure certification from Certifying agency on application developed before full State level roll-out

• Impact assessment after project go live with respect to evaluation parameters gathered during the baseline survey

• Defining detailed Exit plan for the PMU at the end of contract period

o Ensuring knowledge transfer to the SPMC as per the Exit plan

The Zonal Coordinators will have overall responsibility for the implementation of the project in districts and is accountable to SPMC and Project Manager, SPMU. The responsibilities of the Zonal Coordinators will be:

• Implementation of direction received from SPMC and Project Manager, SPMU



• Project implementation in the respective district

• Providing directions and guidance to Block Support Group and PRIs

• Liasoning and Coordinating with the relevant officers at district level

• Enabling full knowledge and systematic application guidance to the implementation agency team in the initial stages and the testing and approval of the deliverables at the intermediate stage and finally the monitoring and analysis of reports for their respective districts as well as centrally for the entire state, to assist the SPMU and SPMC.

• Orienting the stakeholders on the structure and methodologies of project implementation and usage by conducting periodic workshops to discuss progress on the project and to identify and solve emerging problems

• Enabling effective transfer of knowledge and lessons learnt to the people involved in the project

• Address concerns / enquiries / complaints referred to the SPMU by stakeholders for their respective districts under the Zone

• Implementing procedures developed by SPMU to regularly monitor the performance of the project, and preparing regular monitoring reports based upon information submitted by the Block Support Group and the various service agencies

• Guiding Block Support Group to prepare progress reports on a regular basis and collating the same at SPMU level for their respective districts

• Coordination with the other Zonal Coordinators to ensure effective knowledge transfer/ adherence to common guidelines and adoption of best practices across all the districts

• Enabling regular monitoring through visits by block support groups to various PRIs under the blocks and escalating concerns if any.

• Enabling effective adherence of of SLAs by Service Agencies by setting common standards / reports to and guiding block support groups to monitor the same for their respective PRIs under the block.

• Monitoring Training Plan and adherence to the same by coordinating and liasoning with the various stakeholders and service agency

Enabling adherence to the Exit plan by the service agency with help from block support group at the end of the Contract. A District Programme Management Committee (DPMC) will be constituted at each District level headed by the Chairman ZP of the district, for guidance and direction to the the Block Development Officers of the respective blocks who will work in close coordination with the



Block support group for monitoring the implementation of the project in the Gram Panchayats under the respective blocks.

Figure 13: District PMC Structure

DPMC will have responsibility of District wide successful implementation of the project. The structure of DPMC is shown below with the help of following organization chart.

Figure 14: DPMC Organization Chart



DPMC will be headed by Chief Executive Officer, ZP. DPMC should have District Officials of line departments who are implementing their schemes through PRIs; DIO, NIC for technical support; 3-4 BDOs on rotation basis; representative from 3-4 GPs on rotation and if required, locally recognized activist working for improvement of PRIs system in the district. The DPMC has the responsibility for overall implementation of policy directives of SPMC, guidance and coordination for all project activities related to ePRI. The DPMC will play a key role in implementation of project and the systemic reform that the project will initiate. The DPMC will monitor the district wide ePRI project implementation at district level by coordinating with the BDOs and the Block Support Group. DPMC will have following role and responsibilities.

• Implementing the direction received from SPMC

• Guiding the work of the BDO and Block Support Group

• Reviewing implementation progress periodically

• Considering recommendations put forward by BDOs

The DPMC is proposed to meet at least monthly although ad-hoc meetings may be convened by the Chairperson based on needs. Block Support Group at all the blocks will have the responsibility of providing the necessary support to the BDO, DIO and assisting the Zonal Coordinators of various districts at the SPMU level. The responsibilities of the Block support group will be:

• Implementation of direction received from Zonal coordinators at SPMU

• Project implementation in the respective PRIs under the block

• Liasoning and Coordinating with the relevant officers at block level

• Assisting the Zonal Coordinators to collect the actual requirement of hardware for the PRIs at Block and below level.

• Liasoning and Coordinating with Service Agency contact person at Block level and below.

• Regular Monitoring and reporting on the actual status of implementation, hardware deployment, training etc.

• Enabling adherence to timelines and project plan by effective coordination

• Surprise visits to various PRIs under the block to check the actual implementation status and validate the status reported by the Service agency.



10.3 Monitoring and Evaluation Structure

The Monitoring and evaluation mechanism is indispensable for successful implementation

of such a large scale project. A standard approach is required to minimize the risk and

deviation of the project from timeline and scope. Three tier structures have been proposed

for monitoring the project as explained under above section. The various reports along

with frequency and content is shown below.

Details of State Level Review Meeting

Table 13: Details of State Level Review Meeting SPMC and SPMU should also conduct the field visit to assess the project progress and gaps in implementation. State level filed monitoring components are shown below. Sr. Details Monitoring Aspects Participants1 Monthly Progress Review

Meeting • Deviation from Project Plan

• Key issues in implementation of Project plan

• District specific challenges

• Strategic decision required by SMPC

•

SPMC, SPMU and respective DPMC representatives

2 Quarterly Progress Review Meeting • Strategic decision from

SPMC

• Review of Monthly progress meeting of SPMU

• Financial and physical progress of the project

• Support and guidance required from CPMU

SPMC and SPMU

3 Half Yearly Progress Review Meeting • Key challenges for

implementation of the project

SPMC and SPMU



• Revision of project plan if required

• Changes in SPMU structure/ staff

Table 14: State Level Field Monitoring Component SR. DETAILS COVERAGE ASPECTS TO BE

COVERED ACTIVITIES

A State Committee Surprise Inspections A PRI • Resources

provided to PRIs • Functioning of

PRIs • PRI elected

member satisfaction

• Citizen satisfaction

• Compliance report from e-PRI portal

• Grievance from e-PRI portal

• PRI home page at PRI portal

• Interviews and interactions

• Inspection of documents

B SPMU 1 Monthly Field

Monitoring Plan 5 District 10 BP 10 VP

• Installation/ functioning of ICT hardware

• Installation/ functioning of networking/ connectivity

• Installation/ functioning of e-PRI application

• Functioning of DPMC and Block Support Group

• Implementation of Training Plan

• On spot verification of all the aspects and filling up these details in portal in detailed format developed by CPMU



SR. DETAILS COVERAGE ASPECTS TO BE COVERED

ACTIVITIES

• Key issues hindering implementation

• Best Practices The various reports from SPMU to CPMU will be required for enabling regular monitoring by CPMU of the project. The trigger will be generated to CPMU if SPMU has not submitted the report on time. The CPMU is responsible for reminding the SPMU for submission of report on time and presenting the multiple default case to CPMC.

Table 15: Monitoring reports SR. NAME OF THE REPORT INFORMATION CONTENT 1 Monthly Physical Progress

Report • Schemes and service implemented from PRIs • Installation/ functioning of ICT hardware • Installation/ functioning of networking/

connectivity • Installation/ functioning of ePRI application • Functioning of DPMC and Block Support Group • Implementation of Training Plan • Financial and resource requirement for the

respective state 2 Monthly Financial Progress

Report • Ratio of Utilization reports from e-PRI system

and manual submission • Total number of SoR from e-PRI system • Fund utilization status of schemes and e-PRI

project 3 Half Yearly Progress Report –

Financial & Physical • Regularity of physical and financial reports from

District • Quality of data available in reports • Deficiency in reporting

4 Quarterly Hardware Installation report

• Issues in functioning of ICT hardware • Issues in functioning of networking/ connectivity • Issues in e-PRI application

5 Quarterly CBT report • Number of people trained in a quarter • Type of the training and batch size



SR. NAME OF THE REPORT INFORMATION CONTENT • Utilization of fund and future requirement • Estimated number of people to be trained • Specific training requirements from SPMU

6 Quarterly Networking report • Connectivity mapping with required and existing • Approximate uptime of the network • Issues in functioning of networking/ connectivity

7 Monthly application development report

• Average uptime of the e-PRI application • Extent of usage of e-PRI application • Bugs/ improvement areas in ePRI application • Additional requirement in e-PRI application

8 Monthly implementing agency performance report

• Compliance of SLAs related to ICT hardware, networking, e-PRI application and CMT.

All the reports will be posted using web forms available under MIS and KPIs module of the ePRI application. The Block reports will be sent through BDOs and DPMCs after their review and then collated at Zonal Coordinator level at SPMU level. Zonal Coordinator will be responsible for collation of block reports sending it to Project Manager, SPMU. However, if there is administrative dependency and the delay is because of non responsiveness of the person out of the control of Zonal Coordinator or Block Support group; the Zonal Coordinator, Block support group and the BDO should be highlight such case to DPMC and same should be reflected in the MIS reports.

The same set of the collated report will also be required from SPMU to CPMU with status of their respective States

10.4 Bills of Material The bill of material presented below refers to the program structure created for effective monitoring and executing control over the implementation. The structure shall be active at State and District level with the below mentioned positions.

Table 16:- Bill of Material (PMU) Sr Position Principal

Con Senior

Con Junior

Con State

1. Project Manager 1

2. Technology Expert 1



Sr Position Principal Con

Senior Con

Junior Con

3. Change Management & Capacity Building Expert

1

4. Bid Process Expert(part time) 1

5. Zonal Coordinator team ( 1 per 5 districts) 3 3

Also a District Programme Management Committee (DPMC) will be constituted at each District level headed by the Chairman ZP of the district, for guidance and direction to the the Block Development Officers of the respective blocks who will work in close coordination with the Block support group for monitoring the implementation of the project in the Gram Panchayats under the respective blocks. Hence one BSG would be provided to each block during the implementation of the project.

10.5 Risk mitigation strategy Based on the interaction of the study team at State and Districts, the risks identified have been mentioned below.

Table 17: Risk Impact & Mitigation

Sr.

Risk Area

Risk Impact Probability Risk Score

Risk Area Score

Risk Mitigating Factors

1 External

Environmental & Social threats like floods, earth quake, landslides, strikes, Terror groups may also lead to a risk of service unavailability.

5 4 20

11.00

Disaster recovery strategies can be developed based on the criticality of the service delivery.

Conflicts with existing State & NeGP initiatives (such as e-District, CSC, State initiatives) could arise if the expectations and

3 2 6

A very robust Communication Strategy has to be articulated and implemented even before piloting / rolling out e-PRI so that



Sr.

Risk Area


Risk Area Score


objectives of e-PRI are not propagated appropriately to all interested parties, such as CSC operators, State NIC units, State Dept. of IT, State PR & RD Depts., etc.

all such fears are allayed / addressed in advance. This would pave way for smooth implementation

Lack of funds to implement and to sustain the project.

3 3 9

1. Suitable business model is proposed. 2. PR Department may take prior approval for getting operating cost included as part of their budget.

Lack of Political will & Administrative Lethargy: Political leadership support & Administration's motivation are very critical to make this project a success.

3 3 9

Project driven, monitored and tracked by key government official / authority would lead to a focused approach to achieve the desired outcomes. Co-opting elected representatives into the initiative



Sr.

Risk Area


Risk Area Score


and offering a perspective of the citizen-centricity / goodwill generated by e-PRI would act as prime motivators for fostering political will. Getting National Consensus on the MMP from all political parties could also help. Civil society needs to be made aware of the advantages from the e-PRI MMP so that they can exert pressure for a healthy adoption of the MMP. This can address issues such as political pressures, administrative lethargy, etc

2 People

Capacity related Risks - Lack of skilled manpower could be a significant risk to the successful

4 3 12 12.00

Appropriate trainings can be imparted to all the concerned PRI officials.



Sr.

Risk Area


Risk Area Score


implementation of the project.

Resistance from employees - Existing staff may resist the use of new technology because of fear of extra work load, more transparent and accountable systems. This threat will lead to a risk of delayed service delivery.

4 3 12

1. Building awareness among the employees to change the perception about the technology usage. 2. Proper change management can be adopted for smooth transaction. 3. Offering a perspective on 'what is in it for me' is also vital to get an appreciation / buy-in from employees for need for change

3 Process & Legal

Lack of Activity mapping may prove to be an impediment in delivering G2C, G2B & G2G services.

3 3 9

7.33

A mandate from MoPR to States to undertake detailed Activity Mapping exercise should be issued

Owing to legal provisions such as need for Affidavits for certain key G2C

3 3 9

Promulgating a National level policy on the use of Affidavits and such similar



Sr.

Risk Area


Risk Area Score


Services, there could be issues in adopting e-PRI G2C service components

documents needs to be articulated so that G2C services are smoother to implement and both Citizens and Govt. functionaries are not hassled with bureaucratic hurdles.

Ineffective Devolution may result in barrier to the PRI empowerment.

2 2 4

A mandate from State PR department should be issued to ensure the planned devolution by respective departments.

4 Project

Lack of vision and strategy for adoption of e-PRI MMP at the State level could lead to inadequate emphasis and poor adoption

3 3 9 9.00

Build the e-Governance strategy within a wider Good governance strategy and a Citizen Centric strategy so that chances of political buy-in and administrative facilitation are higher



Sr.

Risk Area


Risk Area Score


Improper rollout/change management: Ineffective transition from existing process and techniques to new application may lead to employee and citizen dissatisfaction

4 3 12

A Phased roll out based on the pilot implementation can be planned. The mantra of 'Think Big, Act Small, Scale Fast' must be adopted

Failure in managing costs, quality, scope & schedule could lead to failure of the e-PRI Programme at the State Level

3 2 6

The implementation agency should implement a robust programme management framework. This should be closely monitored by a State Level Agency that would play the role of Program Sponsor (such as State e-Gov Agency)

Project implementation may get delayed due to non performance of implementing agency/ non

3 3 9

Termination/Penalty clauses should be part of contract between MoPR / State PR Dept and implementing



Sr.

Risk Area


Risk Area Score


adherence to the planned schedule.

agency.

5 Technology

Connectivity and Infrastructure related risks: Inadequate connectivity and electricity availability will lead to service interruption.

4 4 16

11.50

1. Alternate electricity resources - solar energy equipment, generator backups may be used. 2. The connectivity to the GPs is envisaged to be given through SWAN. However, other options can also be explored (VSAT, BSNL Broadband, etc).

Data loss or corruption of data during migration to the e-PRI systems or while e-PRI application is in operation

2 3 6

Adequate backup policy, failover systems and subscription to multiple networks.

Integration issues - Lack of integration with existing ICT initiatives at the State & Central level owing to poor solution

4 2 8

Solution design should accommodate existing ICT infrastructure and factor in ongoing dependent initiatives



Sr.

Risk Area


Risk Area Score


design and / or technical incompatibilities

Maintenance - Immediate support may not be available at GP level, Hilly terrain or other remote areas. This may result in to the service disruption

4 4 16

1. Appropriate back up system to be kept in place to mitigate such type of risks.2. Appropriate support clause may be incorporated in the contract while purchasing the H/W or S/W components.

The above details can be better understood with this graphical representation.

Figure 15: Risk Area Rating



The risks identified have been rated for Impact (I) and Probability (P) on a scale of 1 to 5 (5 = Very High to 1 – Very Low). Risk Rating = Impact * Probability The above dashboard facilitates in prioritizing the efforts of State and Central Governments to successfully achieve the objectives of e-PRI.

Table 18: Risk Priority Sr. Risk Area Priority 2 People 1 4 Technology 2 5 External 3 1 Project 4 3 Process & Legal 5 As such the dashboard not only clearly brings out the priority based on the individual risk area ratings. It can be further be drilled down into the individual risks from the table to be exactly able to identify the concern areas and take the remediating measures accordingly and achieve risk management swiftly. Priority 1: Risk Area: People From the matrix above, it can be understood that within the risk area of Capacity, Lack of skilled manpower could be a significant risk to the successful implementation of the project. Priority 2: Risk Area: Technology Within risk area of Technology, risks related to Connectivity & Infrastructure and Maintenance should be remediated for successful implementation of the project.

Priority 3: Risk Area: External The table brings out clearly that within the risk area External, the three main priority risks are:

• Conflicts with existing State & NeGP initiatives (such as e-District, CSC, State initiatives)

• Environmental & Social threats like floods, strikes, border issues may also lead to a risk of service unavailability.

• Lack of Political will & Administrative Lethargy



Priority 4: Risk Area: Project The table clearly suggests that within the risk area of Project, the two main priority risks are:

• Improper rollout/change management: Ineffective transition from existing process and techniques to new application may lead to employee and citizen dissatisfaction

• Failure in managing costs, quality, scope & schedule could lead to failure of the e-PRI Programme at the State Level

Priority 5: Risk Area: Process & Legal Within this risk area of, risks related to lack of Activity mapping may prove to be an impediment in delivering G2C, G2B & G2G services.

• It should be noted that Risk Area Mapping reflecting in the graph only intends to prioritize the efforts of various stakeholders. It does not at any point suggest that priority 4 or 5 risk areas area need not be addressed.



11 Financial Solution

11.1 Project Costing

The e-PRI project implementation in the state of Uttarakhand is estimated to cost about Rs 188.44 crores including the cost of provisioning the ICT infrastructure, Training, Manpower, Project management units, Block support group and Information Education &communication cost. The major assumptions on for financial estimation are listed in Annexure II Over all Head Wise Break up Implementing e-PRI project in Uttarakhand would incur a total cost of Rs. 188.44 cr. This includes costs related to ICT (Rs. 64.52 cr), deputing IT trained manpower at each level of PRI (Rs. 94.57 cr), training of officials and PRI members (Rs. 16.93 cr), providing block support group (Rs. 4.69 cr), establishment of Program Management unit (Rs. 6.09 cr) and finally towards Information Education and Communication - IEC ( Rs. 1.64 cr). The table and graph below presents a brief snapshot of head-wise break up of total cost that shall be incurred in implementing e-PRI project in Uttarakhand.

Table 19: Total Head wise e-PRI Expenses

Headwise Estimated Cost for UT (is Rs Cr) No Head Cost

1 ICT 64.522 Manpower 94.573 Training 16.934 BSG 4.695 Program Management Unit 6.096 IEC 1.64

Total 188.44

This section provides the financial requirement for the roll out of e-PRI MMP in Uttarakhand. It details out the total project cost as well as head-wise & year-wise cost break up of e-PRI solution proposed to be implemented in Uttarakhand. The total cost of implementing e-PRI Project is Rs. 188.44 crore



Out of the total budgetary estimate of INR 188.44 Crores, 34% of the cost is expected to ICT, While 51% of the cost is estimated for Manpower who will operate this new ICT. The graph below presents the percentage wise distribution of the total budgetary estimate.

Figure 16: Total Head wise breakup of e-PRI Costing

The costing of individual components can be referred to in Annexure II

Year Wise Break up The total cost of the project has been distributed in four years basis the implementation plan provided in section 9. The table below presents the overview of the year wise breakup of the total cost that shall be incurred during implementation of e-PRI project.

Yearly Cost - UT (in Cr.) No Year Cost

1 Year 1 22.21

2 Year 2 59.67

2 Year 3 62.79

3 Year 4 43.77

Total 188.44



Out of total Cost estimate 12 % will be expected to occur in 1st year of Implementation while 2nd, 3rd and 4th will have share of ~ 32, 33 and 23 % respectively Yearly – Head wise breakup Broadly the cost estimates have been categorized under State ICT cost, Payout to Service Agency (PRIs ICT & Manpower), Training related cost, cost related to BSG, Program Management Unit and IEC. The following table depicts the yearly cost estimates against each of the cost heads. Year wise breakup is as following:

No Items Year 1 Year 2 Year 3 Year 4 Total 1 State ICT Cost 1.75 0.80 0.87 0.47 3.89

2 Payout (PRIs ICT + Manpower) 13.76 49.72 52.46 39.25 155.20

3 Training 2.82 5.64 5.64 2.82 16.93 4 BSG 0.40 1.48 1.60 1.22 4.69 5 Program Management Unit 1.84 2.03 2.23 0.00 6.09 6 IEC 1.64 0.00 0.00 0.00 1.64

Total ePRI Project Cost 22.21 59.67 62.79 43.77 188.44

• Year 1

Year 1 would be stone setting year for the project. Project will be kicked off with constitution of various committees and State Program Management Unit. It can be inferred from the graph that 62% of the total cost incurred during Year 1 shall be towards deployment of ICT & IT trained manpower at each tier of PRIs in terms of payout to the PRIs. The first 5 months as per the suggested implementation, the RFP will be floated to select the implementation agency and the deployment of the IT Hardware and IT manpower will begin from the 6th month of Year 1. Thus deployment of hardware and manpower at all PRIs will be incremental over later 7 months of the year 1 and hence the payout will be incremental in year 1 as well, which will depend upon the number of sites



deployed in that manner. The lump sum IEC cost is provisioned in Year 1 only and may be utilized by state across across 3 years to generate awareness amongst the citizens and PRIs

• Year 2, Year 3 and Year 4

As per the implementation plan, the deployment of IT Hardware and IT trained manpower will happen incrementally in 7 months of the 1st year itself. Year 2 and 3 will see full-fledged operation and maintenance support of ePRI system at all PRIs, thus the payout to service agency for hardware and manpower will be larger as compared to year 1. As the provision for IT manpower is made for 3 years or 36 months for each PRI site, hence in year 4 the IT manpower support will end incrementally at PRIs after first 6 months of full support. The cost incurred during these years would be heavily constituted of IT skilled manpower deployed at each tier of PRIs, who will be responsible for rendering the services as per the SLA defined. As seen in the graphs for year 2, 3 and 4, the ICT and IT manpower payout is the larger cost head. PMU will also continue to provide its services for the duration of 36 months (3 years) during the ePRI project implementation. Training cost is budgeted for 36 months staring 6th month of year 1 till year 4. Capex for setting up training infrastructure is included in year 1 itself.



Monthly Payouts to Service Agency The project will be executed in a Service Procurement Model (SPM), where a Service Agency(ies) (SA) will be selected through a competitive bidding process by the Uttarakhand State Government. The State may decide to engage multiple SA, region-wise or district-wise depending on local suitability. Since Uttarakhand is a large state with difficult terrain it is advisable to engage multiple vendor rather than single vendor. Once the contract with the SA is finalized a detailed implementation plan will be prepared by the SA in consultation with the SPMC. The roll-out, in State, is expected to take 6 months time during which the SA will commission computers at all GPs / BPs/ZPs in the State and also provide trained manpower for providing services to the GPs / BPs/ZPs. Once the services start at any GP / BP/ZP the SA will be provided a monthly payout for a period of 3 years as per the following table: Year 1 Year 2 Year 3 Year 4 ZP 8397.13 8817.37 9271.24 9761.41BP 6381.71 6641.96 6923.02 7226.57GP 5119.41 5395.65 5693.99 6016.21

The above monthly payouts have been calculated by assimilation of monthly cost incurred to SA on following components:

• CAPEX: This includes the cost of ICT infrastructure commissioned at each tier of PRIs

• OPEX: This includes the cost of maintenance of ICT infrastructure

• IT Trained Manpower: This includes the cost of IT trained manpower deployed by SA for providing services to ZP/BP/GP

The table below detailed out the monthly cost estimation considered for the calculation of payouts.



Yr1 Yr2 Yr3 Yr4

CAPEX (Monthly)

ZP 3144.07 3144.07 3144.07 3144.07BP 3128.66 3128.66 3128.66 3128.66GP 1666.35 1666.35 1666.35 1666.35

OPEX (Monthly)

ZP 253.05 273.30 295.16 318.77BP 253.05 273.30 295.16 318.77GP 453.05 489.30 528.44 570.72

Manpower ZP 5000 5400 5832 6298.56BP 3000 3240 3499.2 3779.136GP 3000 3240 3499.2 3779.136

Annual Payouts

ZP 382069.35 1375510.18 1446312.94 1078635.78BP 2121919.23 7571830.15 7892242.94 5835454.54GP 135119053.03 488263224.70 515260956.72 385629776.01

Total Payout 137623041.61 497210565.03 524599512.60 392543866.32



12 Recommendation and Conclusion

• Create awareness about the importance of participative planning at all the levels. • Integrate all the proposed G2G applications like Planplus, PRIASoft, etc. • Digitize all Registers in phases and Standardize all forms and applications. • Build capacity of the Grass root committees by giving them awareness related

training on the domains for which they are responsible and making them accountable.

• Use EFT for fund flow. • Fill all the sanctioned vacant posts. • Hire staff with mandatory knowledge of computer. • Focus on IT Based training for officials and elected members Limited skilled

manpower and inadequate technical knowledge of computers among the work force

• Expanding and modernizing government’s technical and general training infrastructure and providing facilities for IT training through the resources and expertise of the private sector

• The time taken for physical verification needs to be cut down through the use of database. Database should be created so that the physical verification can be eliminated by matching the details provided with the information stored in the database.

• The redundant and non-value added activities should be eliminated through Process Re-Engineering and the relevant legal changes should be made to carry out these processes in a more efficient and streamlined manner

• Adequate Hardware with AMC to be provided • Define owners of grass root datasets and get rid of duplication of effort for

gathering data and record keeping • Wherever subjects have been completely devolved to PRIs, devolve functionaries

completely. Example: post of ANM should be handover to PRI • The power situation in rural India is characterized by low and inconsistent power

supply. In a scenario where it is envisaged that all Panchayats would be computerized, it becomes imperative to give due diligence to sources of power. While the mandate of ePRI project does not include provision of power, some alternatives and associated costs have been evaluated and are mentioned in Annexure VI



13 Way Forward This e-PRI Study project, which is a precursor to the e-PRI MMP, was initiated with a comprehensive study to assess the current information and services needs of citizens, PRI and other stakeholders. This study lead to the identification of the information and services needs of various stakeholders, scope for re-engineering various functions and services carried out by PRIs, formulation of detailed roadmap for the transformation of Panchayati Raj system from existing state to e-PRI in Uttarakhand. The key activities in the DPR phase included:

• estimating ICT requirements, • defining strategy for roll-out, • defining project management structure, • defining monitoring and evaluation structure, • defining communication plan, • defining change management strategy.

This phase focused on defining these components along with the associated outlays. The implementation plan, detailing out the activities to be undertaken for project implementation is charted out and the financial model for executing the e-PRI MMP in Uttarakhand is also defined. This phase has resulted in head-wise cost breakup of the e-PRI MMP in the State, which will be further aggregated with similar cost break up from a similar study being parallely conducted in other states to arrive at a nation-wide cost for executing the e-PRI MMP across the country. As a next step, the aggregated National Detailed Project Report along with the Expenditure Finance Committee (EFC) note will be submitted by Ministry of Panchayati Raj to the Cabinet for approval.



Annexure I – Glossary List of Abbreviations

ADO Assistant Development Officer AMA Apper Mukh Adhikari BDO Block Development Officer BP Block Panchayat

CDO Chief Development Officer CSC Common Service Centre CSS Centrally Sponsored Schemes

CLM Central Level Ministry DDO District Development Officer DIT Department of Information Technology

DPRO District Panchayati Raj Officer GO Government Order

GP Gram Panchayat GPDO Gram Panchayat Development Officer GPVA Gram Panchayat Vikas Adhikari

I&S Information and Services ICT Information Communication and Technology

MMM Mission Mode Project MoPR Ministry of Panchayati Raj PPP Public Private Partnership SCA Service Center Agency SDC State Data Centre

SWAN State Wide Area Network ZP Zila Panchayat



Annexure II – Detail Costing Table

Assumptions S No.

Assumption / Standards used in respective areas Value (If applicable)

A ICT Infrastructure

A.1 Cumulative Security Audit cost for all state modules (INR) 200000

A.2 The PCs at GP level have been estimated at the NICSI empanelled rates and intrernet connectivity charges have been estimated @ 200 per month per GP. However, the PCs with internet connectivity may also be procured from the vendors under agreement with BSNL under USO fund Subsidy.

A.3 States have been divided into two categories. Large States - 10,000 system users and above is large state and Small States - below 10,000 system users is small state

A.4 No of users are as per the no of PC proposed e.g. if there is 1 PC proposed at GP then no of users at GP = 1* total no of GPs

A.5 Internet connectivity charges have been budgeted for only GPs as the ZPs and BPs are assumed to be connected through a Government Network like SWAN, NICNET etc. If provision for extension of SWAN upto GP level exists, then the horizontal connectivity for that must be costed for and the internet connectivity charges at the GP level can be removed.

A.6 Open Source solutions are being proposed for all system software. Hence, there will be no CAPEX; only annual support cost will be budgeted for.

A.7 Maintenance cost of hardware is included in the Warranty support of 3 years.

A.8 SWAN charges and connectivity need not to be taken as State directly is considering the same for all the departments

A.9 SWAN shall be provided till the offices, hence only internal office network and peripherals have been accounted for

B Training

B.1 Training Costs are budget only for IT training

B.2 Training costs are averaged for all participant irrespective of location at which they are trained



S No.


B.3 No of Training days for PRI officials are assumed is to be 12 days in 3 years 12

B.4 No of Training days for elected members are assumed is to be 6 days in 3 years

6

C Contractual Manpower C.1 One Contractual resource at each PRI level is provisioned through

e-PRI 1 at each PRI level

C.2 Man Month Rate of Contractual Resource with Basic IT skill set at

I GP Level : INR Per Month 3000

II BP Level : INR Per Month 3000

III ZP Level : INR Per Month 5000

C.3 The Manpower is being provisioned for a period of 3 years

D PMU

D.1 Civil Infrastructure (Rent, Electricity, support infrastructure etc) for PMU is not provisioned through ePRI and the state PR department is expected to provision for the same. That Implies No CAPEX cost for PMU is provisioned through ePRI.

D.2 Computing devices (Laptops etc) for External Consultants in PMU will be provisioned by Empanelled agency themselves and not through ePRI

D.3 OPE is have been provisioned @ 15% of the PMU Cost

D.4 Other Administrative Expenses are considered as 1% PMU Cost

D.5 1 Document Scanner, 1 Network Printer is provisioned at each State PMU and District PMU

D.6 10% increase in the PMU External Consultant rates every year

D.7 The PMU cost is being budgeted for a period of 3 years irrespective of the project implementation plan as it is the handholding supporting being provided to the State.

E Application Software

E.1 As a standard each module can be developed by 2 S/w developers in 3 months timeframe which implies development effort of 6 man months per module. This would include the entire development activity pertaining to the module including development of Admin modules for database management.



S No.


E.2 Effort of integration of modules developed at State with central modules will be included in the development effort of 6 months as above

E.3 Customization Effort for central modules at state level is 1 resource for 3 months

E.4 Customization Effort of 3 months for central modules at state level will also include effort for integration of state specific modules with Central modules

Detail ICT & Manpower Costing Sheet

Base Data for Bill of Material and Costing Inflation Rate 8%Total Number of Districts PRI Departments in State 13Total Number of Zila Parishad in State 13Total Number of Block Panchayat in State 95Total Number of Village Panchayat in State 7541Maintenance cost for ePRI Application 22%

State Level ICT Cost CAPEX

Data Centre Costs Hardware Unit Cost Number Total Web Server 366025 2 732050Application Server 366025 2 732050Database Server 1768000 2 3536000Total Server Side ICT Infrastructure Cost 5,000,100

State Site IT Infrastructure Costs Application Software Cost Application Development Cost 8193300Security Audit Cost 200000

Sub-Total 8393300

Hardware Unit Cost Number Total

PC / Thin Client

Panchayati Raj Department 31243 5 156215

Directorate of Panchayati Raj 31243 0 0



Network Printer Panchayati Raj Department 40000 1 40000Directorate of Panchayati Raj 40000 0 0

State ePRI Project Management Unit 40000 1 40000

UPS (600VA)

Panchayati Raj Department 7000 5 35000Directorate of Panchayati Raj 7000 0 0Laser printer Panchayati Raj Department 14400 1 14400Directorate of Panchayati Raj 14400 0 0Finger Print Scanner Panchayati Raj Department 20000 0 0Directorate of Panchayati Raj 20000 0 0Digital Signature Panchayati Raj Department 555 2 1110Directorate of Panchayati Raj 555 0 0Document Scanner Panchayati Raj Department 6000 1 6000Directorate of Panchayati Raj 6000 0 0State ePRI Project Management Unit 6000 1 6000Sub-Total 298725 Networking cost Unit Cost # of Sites Total Connectivity with SWAN (Horizontal Connectivity) 1000 1 1000Office LAN (CAT6) at office with 20 user 40000 1 40000Office LAN (CAT6) at office with 10 user 25000 0 0LAN Switch 30000 1 30000Sub-Total 71000Total State Site IT Infrastructure Cost 8763025Total CAPEX at State Level 13,763,125

OPEX

Heads Annual CostYear 1 (6 months) Year 2 Year 3 Year 4 (6

months) Post implementation support for ePRI application

1802526901263 1946728.08 2102466.326 1135331.816

Support cost for OS, Database & Application Servers software

20100001005000 2170800 2344464 1266010.56

Hosting Charges for Servers (Large States)

2375250 1187625 2565270 2770491.6 1496065.464

SAN (Large State) 509600 254800 550368 594397.44 320974.6176Tape Backup (Large 50000 25000 54000 58320 31492.8



State) Miscellaneous (5% of CAPEX) 688156.25 344078.125 743208.75 802665.45 433439.343

Total 7435532.25 3717766.125 8030374.83 8672804.816 4683314.601Total OPEX at State Level 25104260.37

District Level ICT Cost CAPEX

District Site IT Infrastructure Costs Hardware Unit Cost # Per Site Total PC / Thin Client District PRI department 31243 0 0Zilla Parishad 31243 2 812318Block PRI 31243 2 5936170Village PRI 31243 1 235603463ePRI District PMU 31243 0 0Network Printer District PRI department 40000 0 0Zilla Parishad 40000 0 0Block PRI 40000 0 0Village PRI 40000 0 0ePRI District PMU 40000 0 0UPS District PRI department 7000 0 0Zilla Parishad 7000 2 182000Block PRI 7000 2 1330000Village PRI 7000 1 52787000Laser printer District PRI department 14400 0 0Zilla Parishad 14400 2 374400Block PRI 14400 2 2736000Village PRI 14400 1 108590400ePRI District PMU 14400 0 0Finger Print Scanner District PRI department 20000 0 0Zilla Parishad 20000 0 0Block PRI 20000 0 0Village PRI 20000 0 0Digital Signature District PRI department 555 0 0Zilla Parishad 555 2 14430Block PRI 555 1 52725Village PRI 555 1 4185255Document Scanner District PRI department 6000 0 0Zilla Parishad 6000 1 78000



Block PRI 6000 1 570000Village PRI 6000 1 45246000ePRI District PMU 6000 0 0Sub-Total 458498161 Networking cost Cost per site Total Sites Connectivity with SWAN (Horizontal Connectivity) 1000 108 108000Office LAN (CAT6) at office with 20 user 40000 0 0Office LAN (CAT6) at office with 10 user 25000 108 2700000LAN Switch 30000 108 3240000Hub 1000 0 0Sub-Total 6048000

Total for all District Site ICT CAPEX Infrastructure Cost 464,546,161

OPEX

Heads Annual Cost Year 1 Year 2 Year 3 Internet Connectivity Charges at GP = ( No. of computers at GP X 200 per month X 12)

18098400 18098400 19546272 21109974

Miscellaneous (5% of CAPEX) 23227308 23227308 25085493 27092332Total 41325708 41325708 44631765 48202306 Total OPEX for District sites 134159778.6 Total State Level ePRI ICT Infrastructure Cost for three years 38,867,385Total District ePRI ICT Infrastructure Cost for three years 598,705,940

Detail Cost Sheet for Training

The table below presents the cost details of PRI officials to be trained for e-PRI implementation. PRI

Officials To Be

Trained (Number)


Cost (INR)

Level Total Year 1 Year 2 Year 3 Year 1 Year 2 Year 3 ZP 78 30 24 24 399960 345600 373248BP 285 96 96 93 1279872 1382400 1446336GP 7541 2514 2514 2513 33516648 36201600 39082176

Total Cost 114027840 35196480 37929600 40901760

The table below presents the cost details of PRI members to be trained for e-PRI implementation.



PRI

Members To Be

Trained (Number)


Cost (INR)

Level Total Year 1 Year 2 Year 3 Year 1 Year 2 Year 3 ZP 26 10 8 8 66660 57600 62208BP 95 32 32 31 213312 230400 241056GP 7541 2514 2514 2513 16758324 18100800 19541088

Total Cost 55271448 17038296 18388800 19844352 Manpower Yr1 Yr2 Yr3 Yr4 Cost for 1 manpower at each site ZP 5000 5400 5832 6298.56

BP 3000 3240 3499.2 3779.136 GP 3000 3240 3499.2 3779.136

Total Manpower cost for State 8.04 29.77 32.15 24.60 Detail Cost Sheet for Information, Education & Communication' (IEC) IEC for the country 500000000Number of GPs in Country 229645Per GP IEC cost 2177.273618Number of GPs in Uttarakhand 7541IEC cost for UT 16418820.35

Details of Costing for PMU Following is the details of Manpower to be deployed at State and District PMU:

OPEX Manpower Cost

ePRI PMU Durations (Months) 36Inflation Rate 8%Total Number of Districts in State 13Principal Consultant 200200Senior Consultant 145200Junior Consultant 115500Support Staff 5000

Stat

e

Permanent (100% Availability)

No. of Resources

Man-Month Cost Year 1 Year 2 Year 3

Project Manager, Pr. Consultant 1 2402400 2642640 2906904CM and CB expert Sr. consultant 1 1742400 1916640 2108304Technology Expert Sr. consultant 1 1742400 1916640 2108304Project Coordinator, Sr. Consultant 3 5227200 5749920 6324912Project Coordinator, Jr. Consultant 3 4158000 4573800 5031180



Support staffs 2 120000 132000 145200

Total Cost for Permanent Resources 153924001693164

0 18624804

Temporary (20% Availability) No. of Resources

Man-Month Cost Year 1 Year 2 Year 3

Bid Process Expert, Pr. Consultant 1 480480 528528 581381Total Cost for Temporary Resources 480480 528528 581381

State level ePRI PMU cost 158728801746016

8 19206185

Total State ePRI PMU Manpower Cost (In Rs.) 158728801746016

8 19206185Operational Cost

Stat

e Heads Year 1 Year 2 Year 3 OPEs 2380932 2619025 2880928Other Administrative expenses @ 1% 158729 174602 192062Total State Level Operational Cost for PMU 2539661 2793627 3072990

Total State ePRI PMU Operational Cost 2478159 2539661 2793627

Total State ePRI PMU Cost for three years 60945510

Block Support Group

Software Application Cost

Base Data for Costing Blended Man-month Cost for Development 190000 Man Month Cost for Customization 34700 Development Effort per module (manmonth) 6 Customisation Effort for modules developed centrally (manmonth) 3 Total Number of Modules to be developed at State (Category D) 6 Total Number of Modules to be customised at State (Category C) 13 Development Cost 6840000 Customisation Cost 1353300 Total Software Application Cost 8193300 No Module Name Category

1 Panchayat State Portal D

Sites (Number) Deployment Months 6

BP 95 Yr1 Yr2 Yr3 Yr4

Per Month 12000 12960 13996.8 15116.544

Yr1 Yr2 Yr3 Yr4 Total BSG 3990000.00 14774400.00 15956352.00 12206609.28



2 RTI and Grievance Module C 3 Ration Card Module C 4 Family Register Module D 5 Birth /Death (BD) Registration Module C 6 NREGA Module C 7 Tax/Fees Collection Module D 8 License Module C 9 BPL Module D

10 Caste/Income/Domicile Certificate Module C 11 Planning and Budgeting C 12 Fund Flow and Implementation C 13 Monitoring & Reporting C 14 Accounting & Auditing C 15 File Management C 16 Fund/ Financial Management C 17 Human Resource Management D 18 Training C 19 Database Admin Module D



Annexure III – Envisaged Scenario Post Implementation of ePRI

This section describes the envisaged scenario post implementation of ePRI in Uttarakhand. It

talks about how the G2G and G2C areas will function once ePRI is implemented in

Uttarakhand.

G2G Internal functions

• Planning & Budgeting: As depicted in the above diagram, planning exercise will start

from the Grass root level. It will include the concept of micro planning, Perspective planning as well as Annual Developmental Plans. As per this process, citizens can provide their feedback, or register their issues at the respective Gram Panchayat offices either through the Grievance Redressal System or through Gram Sabha. All issues submitted by the citizens shall get stored in the ePRI System in respective databases. GP Secretaries shall use this data to understand and prioritize the issues prevailing in their respective villages. Based on this prioritization GP Secretaries will identify projects and prepare a Developmental Plan for the village. These will be further discussed in the Gram Sabhas and finalized. All the finalized GP Plans shall be saved in the ePRI System. The Block



Panchayat shall refer these GP Plans from the ePRI System to prioritize projects at the BP level and prepare BP Plans. Finalized BP Plans will again be stored in the ePRI System. The District Panchayat follows the same process as Block Panchayats. However, it has dual role to play, namely, as Panchayats in its own right and as a facilitator for BPs & GPs. In states with strong DP, it with will also provide the secretarial support for the District Planning Committee (DPC). The DPC will refer these DP Plans and aim for Sectoral convergence to prepare the Annual Plans. Annual Plans shall also be saved in the ePRI System. The DPC shall also articulate a District Vision and prepare Perspective Plans. These will be saved in the ePRI System as well and can be referred by the DP, BP and GPs for preparing their respective plans. State Administration shall also inform the PRIs about the Panchayat Window in the Panchayat Budget for helping them prepare their plans. Once all plans and projects have been approved, they will published to the respective offices through the ePRI System and further used for the purpose of monitoring.

• Funds Flow and Implementation: Once plans have been approved and funds have been received by the State Administration, they will transfer the funds via EFT/ DD to the respective offices at the GP, BP and DP level. These funds shall get accounted under respective heads and respective offices will be informed on the same. Based on funds received and projects approved DP and GP offices shall procure services/ products and ensure implementation of projects through respective implementation agencies. Based on the funds expended GP, BP and DP offices shall submit their respective Utilization Certificates through the ePRI System. Unutilized funds shall automatically get accounted and would be transferred to the State administration.

• Accounting and Auditing: All transactions happening at the GP,BP or DP level for procurement of services/ products shall be entered in the ePRI System by the respective PRI Offices. These would basically include all voucher entries. However, GP, BP and DP offices shall also keep updating the financial progress on the funds being expended under respective heads. The State Administration and refer to periodic and Annual Financial Statements of the PRIs. Information can be viewed GP, BP and DP wise. Results of financial shall be further shared by the GPs with the citizens during Gram Sabhas.

• Monitoring and Reporting: Based on the projects being implemented, the implementing agency shall keep updating its physical progress in the ePRI System. This can be further monitored against the respective plans which have been finalized for each GP, BP and DP. Grass Root functionaries shall also update the data on social progress happening within the village based on the implementation of developmental projects. DPCs can also monitor the physical and social progress against the plans. Report on the physical and social progress happening in the village will be shared with the villagers during Gram Sabhas. Every data on physical and Social Progress shall be stored in the ePRI System for future reference. Feedback given by the citizens in Gram Sabhas shall also be saved in the ePRI system and can be further used for the Planning.



G2C – Service Delivery Figure below gives a snapshot of how services will be delivered post implementation of ePRI

System. It focuses on the three main aspects of service delivery i.e. Application Submission,

Application Processing and Service Delivery.

Rural Citizen

`Data Digitization

Physical Submission

Physical Submission

`Online Information &

Form Availability

Pay to

$

Online Payment

ePRI Application

Workflow Management

VerificationForm

Availbility

Information Dessimination

Payment

Database

Online Verification

Physical Verification

Line DepartmentsZP BP GP Manual Submission

Processing Unit

Final Approving Authority

GP Office

Service Kiosk

`

Online Through E-mail

Rural Citizen

Personal Collection

Document Printing

GP Office

Document Printing

Service Kiosk

Personal Collection

APPLICATION DELIVERYPhysical

Submission to GP / Kiosk

`Data Digitization

`Data Digitization

APPLICATION SUBMISSION APPLICATION PROCESSING APPLICATION DELIVERY

• Application Submission: Post implementation of ePRI, citizens shall submit all applications at their respective GP Offices. The operators at the GP Office or Service kiosks shall accept the applications and verify them for ensuring all supporting documents have been submitted. Post successful verification, operator shall register the application in the ePRI System and scan and upload required documents against it. e-PRI System shall issue an Application Tracking Number (ATN) and allow operator to print the Acknowledgement Receipt. This Acknowledgement Receipt shall include the ATN, Date of receipt and expected date of delivery, Payment received and payment due. On receipt of payment, operator shall update payment details against ATN as well as make voucher



entries in the Accounting System. Moreover, for the case, application is submitted at Service kiosks, the operator will deliver the application docket to the GP office.

• If citizen wants to make an online application, then he registers as an authentic user at e-PRI application, opens the service specific module, selects required service and fills online the application form, attaches the required supporting documents as specified for the service after scanning it, makes online payment (if required for the service) through payment gateway and receives a system generated acknowledgement number for reference.

• Application Processing: Once application has been registered, the ePRI System shall send an electronic mail alert to the respective officials in GP/BP/DP Office with instructions for processing the same. Incase if application is to be processed by the Line department, the operator will deliver the application docket to the respective office. On receiving the application docket and mail alert the respective officers shall process the application. During processing the officer may conduct a physical verification and update his comments against the ATN using his Digital Signature. They may also do an online verification using the various ePRI Databases and update their comments against the ATN using their Digital Signatures. On every status update the ePRI System shall inform the applicant directly if his mobile no. is available or inform the operator to inform the applicant about the applications status. All applications shall be approved or rejected by the respective officers using their Digital Signatures.

• Service Delivery: If application is being processed by the line department and it has been approved, the Line departments shall print the documents, endorse it and deliver it to the respective GP Office. On receipt of these documents from the line department, operator shall update the status against ATN and inform the applicant to collect the documents. Incase if application is processed by the GP Office, the ePRI System shall inform the operator to print the document and issue it to the citizen on approval. On receiving intimation the citizen shall visit the respective GP Office, make payment if required and collect the document from the operator.



Customer

Customers literacy to use devices for accessing channels

Access DevicesCommunication

MediaServicesAccess Channels

Capability of channels to use media and provide services

Annexure IV – Components of the Logical Architecture

Access Layer Architecture This layer will manage all the user interactions with the e-PRI System and facilitate delivery and management of PRI services and processes from all other layers to the end users. End user interactions will be achieved via Access devices and Access/Delivery Channels. Access devices will provide a means to users to communicate with the e-PRI Application while Access/Delivery Channels will provide mechanisms for the e-PRI Application and PRIs to deliver services to the end users or customers. Figure below gives a snapshot of the Access Layer Architecture.

The above figure describes how different users/ customers will use various devices to connect to the access/ delivery channels, which in turn will connect to the communication media to provide government services. Sections below will detail out each component in the above architecture. Customers Please refer section 5.2 for detail description on Customers/Users for the proposed ePRI applications



Access Devices

These are the mediums that the above mentioned user groups will use the access the e-PRI System. The proposed access devices are explained below:

• Desktops/ Laptops: These would be mainly used by the government functionaries from the first five categories as mentioned above. Selected PRI functionaries specifically those approving authorities who need frequent travels, will be provided with laptops (if required). Other grass root functionaries, back-end staff and computer operators shall be provided with desktops for accessing the e-PRI Application. Each user shall have their own instance of the Application and will be allowed to log in using their login IDs and Passwords. This Application will allow the users to navigate through the e-PRI web - content published on the PRI network through a Web Browser. All PRI officials will have to use a Standard Web Browser like Internet Explorer or Mozilla Firefox to access the e-PRI System in order to avoid discrepancies in the functioning of the application

• Telephone/Mobile: These devices would be used mainly to access information through the helpdesk and to track status through SMS. Service Consumer i.e. Citizen shall use this device to get information on services, status on applications or register grievances.

Access/ Delivery Channels

These are access points and mechanisms through which the user groups can access the e-PRI Application. The proposed access channels for the state are as follows:

• PRI Single Window Systems (SWS): These will be located at every GP, BP and ZP Office. All users in the Services consumer group shall avail government services through this channel. Citizens need travel places for availing services. For any government service irrespective of the department which provides it, citizens shall submit their applications through this channel and get their service delivery also through this channel. This channel will act like a One-Stop-Shop for all the services.

• Web: This is the access channel that the government functionaries will use to access the e-PRI Application. As mentioned above each functionary will be accessing the Application through laptops/ desktops. All interactions between departments internal or external to PRIs shall happen through the web.

• Panchayat State Portal: Initially the purpose of this access channel will be to provide information on the PRIs, including their functions, projects, procedures, citizen charters, social progress and physical progress and so on. Later, based on the development in the state this can be extended to provide web services. This will further



enable the citizens to avail government services anywhere anytime. This Panchayat State Portal can be accessed from any computer having an internet connection.

• Helpdesk: This delivery channel will also be used by the citizens for getting information on services, application status, and procedures and even for registering complaints. Access to this channel will be through a toll-free number, which the citizens can call anytime

Table below explains which channels will be used for accessing the e-PRI Application G2C functions

Table 20: Channel wise G2C component users

G2C Component Activity User Group Access Channel Application Submission

Obtaining procedural information on Services

Service Consumer

PRI SWS

Panchayat State Portal Help Desk

All other User groups

Web Panchayat State Portal

Obtain Application Forms Service Consumers

PRI SWS

Panchayat State Portal

All other User groups

Web

Panchayat State Portal

Registration of Application Service Consumers

PRI SWS

Service delivery end-points

Web

Make / Collect requisite payment

Service Consumers

PRI SWS


Web

Issue Application Tracking Number (ATN)

Service Consumers

PRI SWS


Web



G2C Component Activity User Group Access Channel Forwarding application docket to concerned dept. for processing


Web Manually

Application Processing

Receiving application form Service delivery end-points

Web

Service Delivery Machinery

Web

Manually Application Processing (Documents verification, physical verification, etc.)

Service delivery Machinery / Back-office users

Web

Manually

Service Delivery Owners

Web

Manually Endorsing of service output Service Delivery

Owners / Project Managers (at PRI)

Web

Service Delivery Owners / Project Managers (at Line departments)

Manually

Printing, preparing processed application

Service delivery Machinery / Back-office users

Web

Delivery of processed application to SWS-GP thru e-PRI Application

Service Delivery Owners / Project Managers (PRIs)

Web

Service Delivery Owners / Project Managers (Line departments)

Manually

Service Delivery Informing applicant about application status


Web

Service consumers

SMS PRI SWS

Help desk Collect processed application Service

Consumers PRI SWS



G2C Component Activity User Group Access Channel Update status against ATN Service delivery

end-points Web

Communication Media

These are mediums that the PRI functionaries will use to provide end-to-end service delivery to the citizens. Table below describes how each media will facilitate users to access channels.

Table 21: e-PRI Communication Media Sr Communication

Media Description User groups

1. Web This is the online media used to establish communication between different PRI offices. All registration, verifications and approval shall be done through this media.

All user groups except service consumers shall communicate using this media

2. email This is also a form of online media with limited functionalities. This media would be used for establishing communication between PRI functionaries and other government functionaries external to the PRIs like Line Departments, Administration etc. This would be mainly to share documents or instructions or alerts.

All user groups except service consumers shall communicate using this media

3. SMS This a telephony media and will have one way communication i.e. between from the PRI Application to the citizens. This media would be used to intimate citizens on the status of their applications.

Used mainly by Service Consumers

4. Physical Presence This would be required for submitting applications, getting services delivered, physical verifications as well as conducting meetings

All user groups will use this media wherever and whenever required

5. CD/DVD These are mostly used as storage media. Specifically when large data

This media would be mostly used by user



Sr Communication Media

Description User groups

needs to be transferred between PRI and other non-PRI functionaries these media would be used. These would be applicable till such time an integrated Enterprise Architecture is established in the state

groups other than service consumers for the purpose of data exchange.

Service types

The entire Access Layer Architecture should be able to support four types of services. • Informational Services: Intended to provide any information that falls under the PRI

perspective. It would include RTI services, Information on service rules, procedures, SLA, Status tracking, etc.

• Transactional Services: Intended to provide all the G2C and G2B services. These would include all kind of transactions like Payments, Application submissions and service delivery, Application processing and also other inter-governmental transactions

• Interactive services: Intended to facilitate interaction between different user groups. These would include communication of government orders, memos and notices, email alerts, meeting schedule, discussion forums, etc.

• Data sharing services: Intended to share data across PRIs and with other departments. These would include online verification with common databases, sharing of statistical information as well as reports, etc.

This Access Layer Architecture would require user’s literacy to use access devices for

accessing channels and leverage on the capability of the access channels to use the

right communication media to provide services.

Application Architecture

The e-PRI application shall perform both functions core and service delivery. The overall Application Architecture for the e-PRI System is explained in section 5.3.

Database Architecture

Database architecture is presented in detail in section 6.



Information Security Architecture

This section details out the function of each sub-component of the Information Security

Architect as explained in section 5.5

Figure below gives a structure of the Information Security Architecture, which shall help PRIs

in managing information security across all the layers of the Logical Architecture.

Business Layer Security Components

Information Security Policy

Governance council

Asset tracking &

Management

Physical Security

Human Resource Security

Incident Management

Identity Protection & Management Components

Identity proofing and Vetting

Access Management and Control

Antivirus Protection Application/

OS Layer

Security Assessment & Monitoring Components

PRI Directory Services

PRI Public Key Infrastructure

Security Permissions and Configuration

PRI Event Logging an

d Auditing

Data Layer

Technology/ Network Layer

Data Validation

Anti Spyw

are/ M

alware

Protection

System

files & Source

code Protection

Vulnerab

ility Detection

Firewall/ Routing Service

Encrypted Access to Network (VPN)

Intrusion Detection and Protection

Business Layer Security Components Business layer forms the crux of PRIs and is the governing layer for all PRI functions and activities. It is at this layer where information is created and owned. It is therefore important that Information security starts right from this layer. This layer would mainly involve non-technology assets like people and processes. To ensure security from these two perspectives following security components are mandatory.

• Governance council: This is a specific group of functionaries responsible for developing consistent, cohesive polices, processes and decisions regarding information security. To the form this



council, the State Project Management Unit and the District Project management Unit structures can be leveraged.

• Formation of Information Security Policy Recognizing the ever-changing environment in which PRI functionaries work it is essential that PRIs along with the IT department needs to develop a comprehensive Information Security Policy, to be adopted across the PRIs. This policy shall guide the PRI functionaries in protecting information owned by them and ensuring that it is being used in the right way. It is essential that this policy should focus on following points

o End-user acceptable use: This shall concentrate on use of resources like email, internet, intranet, data encryption, security and use of portable devices as well as external users

o Administrator acceptable use: This shall concentrate on use of IT resources by Administrators as well as describe the auditing and monitoring procedures

o Information security: This would focus on standards like data encryption, and electronic digital signatures

o Information privacy: This would focus on designating Information privacy officers, performing data privacy impact assessment, data categorization, user access controls and maintenance of access logs

o Information sharing/ transmission over the internet: This shall focus on information sharing standards to be adopted across other government entities. Some recommended standards are given below

For sensitive transactions like sharing of personal data cryptographic mechanisms should be used.

Commercial transactions over the Internet shall deploy HTTPS using standards like SSL version 3 or TLS version 1.0 or version 1.1

HTTPS is the secure version of HTTP (Hyper Text Transfer Protocol) over Secure Socket Layer (SSL). This standard provides authenticated and encrypted communication. Transport Layer Security (TSL) and SSL are cryptographic protocols that provide secured communications on the internet for data transfer as well as enable operation on HTTPS.

For secured electronic email is required, S/MIME (Secured Multi-purpose Internet Mail Extensions) standards should be used for secure transmission, storage and authentication. S/MIME is a standard for public key encryption and signing of email encapsulated in MIME formats.



It is essential that while implementing ePRI the Service Delivery Managers and PRI authorities develop a comprehensive Information Security Policy to be used across PRIs. This is because with the advent of technology resources that ePRI will bring in it is necessary that all functionaries irrespective of their knowledge in ICT should be aware on acceptable use of PRI information and resources. They should also be aware that any breach in the policy shall risk smooth functioning of PRIs.

• Asset tracking & Management Implementing ePRI will require procurement of various IT assets. It is therefore essential that following policies be defined and implemented as a part of the ePRI

o Asset procurement: Policies and procedures for procuring IT and information assets should be defined and include things like Asset request and approval procedures, Asset procurement procedures, as well as standards on procurement modes. This will also include procedures on allotment of barcodes for procured assets and mapping each asset to the right department

o Asset Allocation: This shall include policies and procedures on asset allocation to a functionary in PRI. Asset allocation should strictly be role based and policies on acceptable use should be strictly adhered. This will include mapping of Asset barcodes to the functionary to which it has been allotted

o Asset tracking: This shall focus on tracking which IT or Information Asset has been allotted to which PRI functionary. This is very important from the PRI point of view as some functionaries shall be allotted mobile devices like laptops. In case if these functionaries travel outside the PRI network, it is important to keep track and locate the device through which they are accessing the PRI network. This will also help in secured Remote Access Management in the PRI network.

o Asset Maintenance and repair: This should take care of all the maintenance and repair requirements of all the IT Assets.

• Physical security: Protecting IT and Information Assets physically is equally important. There are many external people visiting PRI offices like Vendors, Contractors, Citizens, Consultants, etc. It is therefore, necessary that these people have a restricted access to PRIs IT and Information Assets. It is therefore proposed that following be implemented for managing physical security

o Critical or sensitive information processing facilities like data centers should be housed in secure areas, protected by defined security perimeters, with appropriate security barriers and entry controls to physically protect them from unauthorized access, damage and interference.



o Such facilities should have physical access points and individuals should be allowed access only on successful verification of access authorization.

o Fire extinguishers with water suppression systems should be used to save electronic components from damage.

o Physical access devices like key-lock combinations, card readers etc. should be used to restrict access to such facilities. Such key-lock combinations should be changed periodically or when keys are lost or when functionaries transferred or terminated.

• Human Resource Security: This is to sensitize all PRI functionaries and applicable government authorities, contractors and third party organizations with access to sensitive information with the information security policies and procedures. It is necessary that these security measures be adhered by every PRI employee prior to employment, during employment as well as through termination, retirement or transfer. Some of these security measures include

o Understanding the Security policies and responsibilities towards maintaining information security during the tenure of employment

o Defining access rights and providing access devices based on the functionaries role during employment.

o Adapting and adhering to the user acceptance policies as well as other information security and sharing policies during employment

o Informing on loss of security devices as well as ensuring that printed information is not left unattended.

o Handing over all allotted PRI IT and information assets back to the respective authorities before transfer, termination or retirement.

o Ensuring that all access passwords and key codes have been changed to prevent unauthorized access post transfer, termination or retirement

• Incident Management This relates to timely communication of information security events and weaknesses. Incidents may be result of failures or errors in IT Infrastructure. This would include policies and procedures to report a security incident. This component is very important to ensure continuity of services in the PRI network. This would require the PRIs to

o Develop responsibilities and procedures for reporting security incidents. o Define what kind of security incidents can be reported o Ensure incidents are detected and recorded on time o These are further classified and investigated and diagnosed



o Ensure that the incident is resolved and closed to maintain business continuity

Incidents could be of various types like phishing, malicious code attacks, website compromise and propagation of malware as well as network scanning and probing. These kind of attacks if not detected, reported and handled on time would pose problems on PRIs information security and disrupt functioning of PRIs thus, interrupting service delivery to citizens. Incident management holds more importance in the PRI perspective as the no. of incidents being reported in the government networks in India has been increasing every year. This can be substantiated with the Annual Incident management reports1 published by CERT. According to this report a total of 2565 incidents have been reported in the year 2008. It is therefore necessary that a comprehensive Incident Management procedure be implemented for ePRI.

Identity Protection and Access Management Components Identity management deals with identifying individuals within the PRIs and assigning a unique identity to each one of them based on the roles they play within PRI. Each identity shall be assigned varied access rights based on the Roles and Responsibilities. Based on these access rights each PRI functionary will be allowed access to the PRI IT and Information Assets. These components will therefore, enable more secure, identity based access to the ePRI System within the PRI network from any location or device. It will ensure that this anywhere access is protected and integrated with other security components. Benefits of implementing Identity Protection and Access Management components

• Help protect PRI assets from misuse through user provisioning • Provide more appropriate and secure access to PRI IT and Information assets through

strong authentication • Simply user account management through delegated self-service capabilities • Help reduce costs with centralized, automated identity and access management.

It is proposed that IAPM architecture should be centralized to manage authorization services for all PRI levels. These authorization services shall be valid across all the layers of the Logical Architecture. Each component of IAPM and standards to be used are explained below:

• Access Management and Control This component/ software shall administer authentication and authorization processes within the ePRI System. Following activities should be implemented under this component

1 CERT is the Indian Computer Emergency Response Team formed under the Department of Information Technology (GOI). This team is responsible for reporting, analyzing and resolving security incidents arising in the Governmental networks in India. The Annual Incident Management Report can be viewed on the CERT website www.cert-in.org



o Conduct User Access Management: This activity shall deal with registering users, assigning privileges and managing user passwords.

- Conduct User Registration: To implement this formal user registration and registration cancellation procedures need to be in place for granting and revoking access to IT and Information Assets of PRI. These procedures should include

a) Assigning unique user ids to enable users to be linked to and to be held responsible for their actions

b) Group ids shall be permitted wherever necessary for operational reasons and these need to be approved and documented

c) Before assigning user ids a check is necessary that user has authorization from the system owner (ePRI System owner at the UT level) for the use of ePRI System or service. A separate approval for the access rights from the CEO- ZP should be made mandatory

d) A check to ensure that level of access granted is appropriate for the Role

e) Giving users a written statement of their rights and requiring users to sign them indicating that they understand the conditions of access

f) Ensuring that access is not provided until authorization procedures have been completed

g) Maintaining records of all persons registered to use the system h) Immediately removing or blocking access rights of users who

have changed roles/ terminated/ retired i) Ensuring redundant user ids are not be issued and blocking

them if they have been issued. - Conduct Privilege Management and access control: This will control and

restrict the allocation of user privileges to access the ePRI System. Following procedures and guideline should be developed for controlling access

a) Controlling access to system utilities by use of identification, authentication and authorization and segregating system utilities from other application software. Limiting access to system utilities to minimum authorized users, limiting duration of availability of system utilities as well as logging all use of system utilities are some of the other access control mechanisms that need to be implemented.



b) Controlling access to ePRI application: Once users successfully log-in to the ePRI Application, it is very important that the visible information on the user’s terminal does not go unattended for a long time as this would be window for security threat. It is therefore recommended that user sessions should be automatically terminated after a specific period of inactivity. Not only should sessions be timed-out but network connections should also be terminated after a specific period of inactivity so as to prevent intrusion into other parts of the network

- Conduct User Password Management: For password management multi-factor authentication will be used. Standards recommended for ePRI are

a) Bio-metric technologies like fingerprint verification, signature verification and use of hardware tokens like smart cards.

b) It is recommended that Bio-metric technology can follow standard data formats and guidelines provided by NIST Special Publication 500-271. It provides standard data formats for interchange of fingerprints, facial and other bio-metric information. These standards can be viewed at http://fingerprint.nist.gov/standard/Approved-Std-20070427.pdf

- Develop password use policy: This policy should stress formats for creating passwords, methods for keeping them confidential, changing passwords at regular intervals and using different password for different ids.

- Enforcing password change and securing passwords: The IAM software should enforce the user to change password after first log-on and periodically after that. This can be done by temporarily blocking the user account if passwords are not changed after a specified period. Protecting passwords from unauthorized disclosures and modifications is equally important. Prohibiting passwords from being displayed when entered, prohibit password re-use for a specified period and restrict their lifetime are some of the password management mechanisms to be carried out under IAM

• Security Permissions and Configuration Setting security permissions for each user is one of the essential activities for implementing security. Configuring security permissions on the ePRI System at every layer including applications, database and networks is mandatory. While assigning access rights it necessary to perform following



o Establishing appropriate division of responsibilities and separating duties as needed to eliminate conflicts of interests. It is therefore required to divide mission oriented functions and system information functions among different individuals

o Based on these division of responsibilities access permissions should be assigned to users so as to define which user can access which devices, applications, databases, information and network components.

o It is also important that security permissions be configured in the applications itself during development. For e.g. Applications developed using .NET Framework have a code access security mechanism that helps applications have limited access to protected resources and operations. Such mechanisms can be configured during application development itself.

o Since ePRI is going to be a web based application it would be more susceptible to vulnerabilities like XSS (Cross Site Scripting) where malicious attackers can inject client side scripts into web pages so that they can bypass access controls. For e.g. if proper security permissions are not configured into the application, malicious attackers can bypass access controls on ePRI applications and change critical information like Budget envelop, or Accounting entries. It is therefore important to configure access permissions within the application itself. Techniques like content filtering can be used to avoid such vulnerabilities. For e.g. If JavaScript is used for developing web pages JavaScript escaping mechanisms can be used, or HTML numeric entity coding can be used.

o Other techniques disabling client-side script on the web-browsers or tying session cookies to IP address of the user who originally logged in will help avoid vulnerabilities to some extent.

• Identity Proofing and Vetting Identity vetting is the process used to establish identity of the user to whom the credential was issued. This component outlines the procedure of validating and verifying user’s identity for the purpose of establishing credentials. ePRI System shall such components that will

- Identify and authenticate specific devices and users before establishing a connection

- While establishing connections from remote locations, encryptions and decryption of user credentials like user name and passwords.

- User can also be provided with digital credentials like smart cards for identity vetting and proofing. For creating digital credentials users should provide their



physical characteristics like finger prints which can be stored on smart cards. Smart card readers shall be installed at various locations, based on which access can be allowed if fingerprint data on smart cards matches the once stored on database against the user credentials.

- Defining secure log-on procedures: limiting no. of consecutive invalid access attempts is very important. This should be done by locking the account for a defined period until released by the administrator

- Before the user enter his credentials, ePRI System should mandatorily display access terms and conditions to user and access should be allowed only if the user agrees to accept the terms and conditions.

• PRI Directory Services The IAM solution must incorporate directory services as a repository to store identity data of PRI users (User profiles, user account data, desktop logins, roles and entitlements) and make this information available to multiple functions inside and outside IAM. Information stored under this directory shall be used for the purpose of authentication and authorization and allowing access to ePRI System. It is recommended that these directory services should be compatible with standards like LDAP or X.500. X.500 is a series of networking standards covering electronic directory services while LDAP (Lightweight Directory Access Protocol) is an application protocol for querying and modifying directory services running over TCP/IP.

• PRI Public Key Infrastructure Public Key Infrastructure is a technology that helps ensure secure electronic communication by incorporating digital signatures and encryption technology. PKI will allow PRIs to provide coordinated and consistent security services like authentication, confidentiality, non-repudiation and integrity of transmitted as well as stored data. Typically a PKI for PRIs shall include following components to supply required key and certificate management services.

o Certification Authority (CA): An entity that issues digital certificates and generate public keys for the certificates. It is a trusted third party, which provides key management services. PRIs need to hire a third party CA for implementing the PKI and ensure that the CA works with the context of an overall Certificate Policy which needs to be defined by the PRIs

o Registration Authority (RA): An authority in the PRI network that verifies user request for Digital Certificates and informs the CA to issue it. Registration Authority plays an important role in PKI because all other security functions are



built on the assumption that the registered user was sufficiently positively identified. This is more critical for provision of non-repudiation. Typical areas that fall within the remit of RA include setting security permissions for user certificates, event logging and auditing, assessing security vulnerabilities, and issuing / revoking public keys. PRIs need to assign a Registration Authority within the PRI system who shall approve issuing of Digital certificates

o Public Keys and private keys: A public key is a value provided by the CA as an encryption key that, combined with a private key can be used to effectively encrypt messages and digital signatures. On approval these keys become the certificates and digital signatures

o Certificate Repository: This is a database of all the certificates issued. The PRI directory services can be used here as a certificate repository so that it becomes easy and cost effective to map digital certificates to respective user profiles

Apart from implementation of the above components it is important that the PKI also takes care of the following:

o Certificate Revocation: It is important that certificates once issued are revoked on termination/ transfer/ retirement of employees

o Key Back-up and recovery: maintaining back-up is equally important to ensure that issued keys are not lost

o Management of key histories: this includes maintaining information on which keys have been issued to which user and the activities performed by the user using the digital certificates issued.

Standards recommended for implementing PKI are given below: o Public key certificates can be based on the X.509 Standard which is an ITU

(International Telecommunication Union) standard for PKI. This standard includes standard formats for public key certificates and a certification path validation algorithm.

o Certificate repositories as mentioned can leverage the PRI directory services and the standards thereof.

o RSA algorithms can be used for Public Key Cryptography and generating Digital signatures.

It should be noted that Implementing PKI for PRIs in Uttarakhand would require additional cost and time. It is therefore recommended that PKI implementation should be taken at the UT level rather than at the PRI level. This would help in reducing overall cost of implementation for ePRI. • PRI Event logging and Auditing



This infrastructure would provide capability to control and filter all information available from operating systems and applications to help system administrators track system activities and provide user accountabilities for events. Coupled with Digital Signatures, auditing and logging a strong authentication audit capability providing non-repudiation services as well as providing legal accountability for user actions. PRI event logging and auditing would focus on

o Detecting attacks and unauthorized intrusions into systems and networks o Supporting evidence needed to take action against offender o Providing awareness of the volumes and nature of attacks

Preparing audit logs for the ePRI System shall require o The PRI Authorities to define which specific system components should carry

out auditing activities. For e.g. auditing should be carried out whenever a user tries to log-in to the ePRI network, or in to the ePRI application and so on

o Based on a risk assessment exercise, it is also important to decide which events require auditing on a continuous basis and which events require auditing in response to a specific situation. For. e.g. Events which create update or delete critical data from databases like Planning or Accounts database, should be continuously audited. While events where a user tries to log-in to the ePRI Application with unsuccessful attempts should be audited whenever there is a single unsuccessful attempt to log-in through a user id. These should be defined in a way that they support after-the-fact investigations of security incidents.

o The event logging component should have a capability to compile all the audit records from all the components in a system wide (logical or physical), time co-related audit trail as well as manage them centrally

o The audit record should capture information on what events occurred, sources of event as well as the outcome of events. For each event, the audit record should have following contents

a. Data and time of event b. Component name (Software, hardware. Network, etc) where the event

occurred c. Type of event d. Subject identity e. Outcome (Success or failure) f. User information (information of the user who was logged in when the

event occurred) g. Location (if the event was triggered from a specific identifiable location)



o This event log component shall also communicate with other Security Assessment and monitoring components to log details about event detected by them. It will thus, help the PRIs to have a centrally managed audit trail for all kind of events.

Security Assessment and Monitoring Components Implementing and configuring security controls into the ePRI System is important. But what is more important is to continuously assess and monitor if these security controls are able to manage know vulnerabilities and avoid potential risks. It is therefore, necessary to implement these components into the ePRI System. These components will not only help assess the capability of security controls to avoid potential risks, but also help in detecting new vulnerabilities and attacks. This will help PRIs take proactive steps to avoid new vulnerabilities in future. The Security Assessment and Monitoring components that PRIs should implement are explained below.

• Anti-virus Protection/ Antispyware/ Malware Protection These are software programs that detect, prevent, and remove malware, including computer viruses, worms and Trojan horses. They also prevent and remove adware, spyware and other forms of malware. Malwares like spyware can easily get into the user’s computer and subsequently into the ePRI system even without the users knowledge. If spywares are not detected and removed they can cause serious effects like network traffic, unwanted CPU activity, crashing systems. Some malwares can even spy on user accounts and leak critical user information including access rights. This may further may the ePRI System more accessible to attackers. It is therefore essential that a comprehensive antivirus/ antispyware program be implemented within the PRIs. This would require the PRIs

o Define a Malware protection policy that enforces all users to - scan external media before connecting it to the PRI network - scan email attachments or compressed files before opening them - block sending or receiving of certain file types via email - restricting the use of unnecessary software that are not needed and

may contain vulnerabilities. - Requiring systems to be kept up to date with latest patches installed - Restricting use of removable media while on PRI network - Specifying which type of mobile code can be used from trusted

sources o Installation of Antivirus / antispyware software with following capabilities

- Scanning critical system component such as startup files and boot records



- Monitoring real-time activities to check for suspicious activities - Monitoring behavior of applications like web browsers, email clients - Scanning files for known viruses on local drives - Identifying common types of malware like viruses, Trojan horses,

worms, malicious mobile codes, blended threats, spyware, cookies as well as keystroke loggers and backdoors

- Disinfecting files, i.e. removing malware from files or quarantining files.

- Preventing several methods of spyware installation like blocking pop-up ads, tracking cookies, browser hijacking and browser plug-in installations.

o Updating the Anti-virus software with latest signature to improve malware detection and prevention. For ePRI system it is recommended that the anti-virus software should be managed in a centralized way. All testing, approving, delivering signature and software updates should be done centrally

o Other protection mechanisms that can be used are configuring the applications by disabling unneeded features like

- Blocking suspicious email attachments (e.g. with extensions like .vbs, .pif)

- Filtering spam which is used for phishing and spyware delivery - Filtering website content which block suspicious website and

undesired file type - Limiting Mobile Code execution - Restricting web-browser cookies - Blocking web-browser pop-up windows - Preventing software installation within web-browsers - Preventing automatic loading of email messages - Restricting use of macros

Standards recommended by NIST for malware protection can be referred while implementing anti-virus/ antispyware applications. These can be found at http://csrc.nist.gov/publications/nistpubs/800-83/SP800-83.pdf .

• Data Validation This is to restrict input and output data entries to the ePRI system. This component will ensure that

o Only authorized personnel are allowed to enter data into the ePRI system. These restrictions should extend beyond typical access control rights.



o In case of errors in the data entry error messages should be generated and visible only to the authorized personnel. These error messages will provide useful information without revealing information that can be exploited. Sensitive information will not be listed in error logs.

o All inputs will be checked for accuracy, completeness and validity as close to the point of origin as possible before saving them to the ePRI databases.

o All data validations checks shall be done based on the Rules defined for valid syntax like character set, length, numerical content, acceptable values and so on.

o Inputs passed to interpreters shall be pre-screened to ensure that the content is not unintentionally interpreted as commands

o All output data is also retained as per the policy and operational requirements defined by ePRI.

• System files and source code protection This includes ensuring security of data in both testing environment as well as in operational environment. Following actions should be taken in respective environments

o Testing environment: Test data should be selected carefully and protected and controlled and care should be taken that operational databases containing personal information or sensitive information should not be used for testing purposes. Even if they are being used then all sensitive contents should be removed or modified beyond recognition before use. While using operational data in testing environment following care should be taken

- All access control procedures which are applicable for operational applications should also be applicable for test applications

- Separate authorization should be enforced every time operational data is copied into test environment

- Once tests are completed all operational information should be erased from the test environment

- Copying and use of operational information should be logged to provide and audit trail

o Operational environment: It is critical to avoid risk of information leakage and following care should be taken

- All outbound media and communications should be scanned before connecting to the PRI networks

- Monitoring of resource usage in the ePRI network as well as users and system activities



- Implementing techniques for masking and modulating communications to reduce likely hood of third party being able to deduce information

- Access to system file and source code should also be restricted.

• Vulnerability management These components will help PRIs in assessing vulnerabilities in the ePRI system. Key functions that this system should offer are

• Conducting filtered scans on the ePRI network to detect vulnerabilities to potential attackers and internal users. This system should provide both external and internal scanning of PRI assets as well as track individual assets, device criticality, and assignment of owners.

• Conducting unfiltered scans: these would mostly deal with detecting software vulnerabilities which may arise from deficiencies in the design of ePRI application or mistakes in its implementation. These would help detect vulnerabilities like Buffer Overflows, Format String bugs, Integer overflows in the applications, or vulnerabilities that would block availability of system service, or vulnerabilities that would allow attackers to break into weak links and escalate their privileges.

• Conduct Penetration testing: where tests are conducted using manual methods and scanners and are more focused towards breaking security controls configured in the system. These tests will help analyze the capability of security controls implemented into the system

• Conducting remediation: through Patch management for vulnerabilities identified as well as base lining the security configurations and ensuring that vulnerabilities comply to these baseline configurations. It should also provide a tool for policy-based workflow management and remediation tracking

• Provide comprehensive and customizable reporting for multi-scan, group based scan as well as compliance reporting

• Firewall/ Routing services Firewall or routing services are systems which filter inbound and outbound traffic to and fro the ePRI network. They are designed to block unauthorized access while permitting authorized communications. These will be required to block unauthorized users from accessing the PRI network through the internet or un-trusted network. These can be dedicated appliances or software running on computers placed between protected and un-protected networks for inspecting network traffic passing through it and deny or permit passage based on set of rules.



It is recommended that ePRI systems should

o Dedicated proxy servers with Boundary Routers: These firewalls are more flexible and have good filtering speed as well as retain proxy control of traffic. They are capable of blocking Denial-of-service attacks, filter unwanted protocols and perform simple access control. Boundary routers will be implemented generally at the boundaries of network connections and further connected to dedicated proxy servers. For e.g. in the ePRI system HTTP proxy server should be connected behind the boundary router, Users will therefore need to connect to this proxy in order to connect to the ePRI web server. Use of dedicated proxy servers will help PRIs in prevent attacks like XSS, scanning and removing viruses as well as malware injected through web page scripting.

o Host based firewall: These firewalls are available in the operating system itself. These should be implemented for the ePRI servers (like application servers and database servers)

o Personal firewall: These should be installed on the laptops/ desktops of all PRI functionaries accessing the PRI network.

o Personal firewall appliances: these should be run on specialized hardware like cable modem WAN routing, LAN routing, Network hub, Network Switch, etc.

While implementing firewall standards and guideline published by NIST can be used. These can be found at http://csrc.nist.gov/publications/nistpubs/800-41/sp800-41.pdf • Encrypted Access to Network (VPN)

Virtual Private Networks (VPN) are networks that will provide an encrypted access to the ePRI network via the Internet or other non-trusted networks thus, ensuring that the remote access is secure. By implementing VPN for remote access within the ePRI network, all remote access sessions will be encrypted to protect confidentiality. VPNs will allow PRIs to establish usage restrictions and implementation guidance for wireless technologies as well as document, monitor and control wireless access to PRI information systems.

Standard mechanisms like IPSEC with a minimum of 128-bit keys for symmetric encryptions can be used for VPN tunnelling for remote access. IPSEC (IP Security) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and/or encrypting each IP packet in a data stream. It also includes protocol for cryptographic key establishments.

The above cryptographic mechanism can also be combined with passwords and bio-metric authentication. Such mechanisms can also be implemented in devices like firewalls and access gateways.



• Intrusion Detection and Protection These are systems that will help PRIs in monitoring events occurring in the ePRI System or ePRI Networks and analyzing them for possible incidents which could be violations or imminent threats of violation of security policies, or acceptable use policies or standard security practices and stop detected possible incidents. This system will focus on identifying possible incidents, logging information about them, attempting to stop them and reporting them. Considering the network architecture designed for ePRI in Uttarakhand following IDPS systems should be implemented.

o Network based IDPS – This system will monitor the network traffic on the ePRI network and analyze the network and application protocol activity to identify suspicious activities. This system shall be implemented near the border firewall or routers, near VPN servers as well as near remote access servers.

o Wireless IDPS – This system will monitor the network traffic on wireless networks like those between Uttarakhandand analyze it to identify the suspicious activities involving wireless networking protocols. This should be deployed at locations within a range of wireless networks between GP Offices and PoPs where a wireless connection is established

o Network Behavior analysis – This system examines network traffic to identify threats that generate unusual traffic flows, Distributed Denial of Service attacks (DDoS)2, certain forms of malware and policy violations (e.g. client’s system network providing services to other systems). This system should be deployed within the intranet at GP Offices as well between office connected via leased lines

o Host based – This system monitors characteristic of a single host and the events occurring within that host for suspicious activities. For e.g. This system monitor the system log, application activity, database access and modifications as well as changes to system configurations. This system should be deployed on all critical ePRI servers like ePRI database and application servers as well as the Directory services servers

IDPS components implemented for ePRI should perform following key functions o Identify security policy problems by duplicating firewall rule sets and sending

alerts when it detects that network traffic that should have been blocked by the firewall has not been blocked due to an error in the firewall configuration

2 DDoS or Distributed Denial of Service attack is an attempt to make a computer resource unavailable to its intended users by saturating the target network with unauthorized external requests. Thus, with these attacks PRIs can face problems like a Web page from the ePRI application being temporarily unavailable.



o Log information about detected threats so as to educate the PRI management about the threats they are facing. This information should be further sent to centralized Event logging and auditing components

o Notify system administrators through emails, messages, SNMP traps, etc whenever a potential threat is detected

o Produce reports on all events detected and summarize the potential threats o If possible intrusions are detected, the IDPS should respond either terminating

network connections or user sessions that are being used for attacks, or block access to the ePRI system from the offending user account/ IP address. Thus, like previously explained, if an offended user is trying to change the Budget envelop in PlanPlus, then the IDPS can detect so and terminate the user session before any such modifications are affected.

o In some cases the IDPS should also be able to change content by replacing malicious portions to make it benign.

For implementing IDPS following infrastructure will be required o Sensor or Agent which monitor and analyze activity in Network, wireless or

NBA systems, Agents are typically used in Host based systems o Management server is a centralized device that receives information from the

sensors and manages them. They can also analyze events detected by the sensors

o Database servers are used as a repository for event information sensors, agents or management servers

o Console, which is a program that provides interface for activities like configuring sensors, monitoring and analysis

While implementing the IDPS systems in the ePRI networks, guidelines provided by National Institute of Standards and Technologies can be referred. These guidelines give a detailed explanation on how each system should be implemented and at which points in the network. These guidelines can be found at http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf .



Annexure V – Components of the Logical Architecture Component Specification Unit Charges

Laser Printer A4, 8 PPM , 16 MB RAM, 600 x 600 dpi, 150

sheet input tray 125 output tray, USB interface

cable and driver software

14,400

Web Server 4U RackMouunt Server having Duel Core,

7120M (3GHz, 800 Mhz FSB, 4 MB L3 Cache

and 2x 1MB L2 cache or higher processor

support for Qued dual core processor,8GB

DDR2-400Mhz FB DIMM or higher ECC

memory,SVGA video Controller with 16 MB

RAM, SAS Raid Controller having 128 MB buffer

memory with battery backup and supporting

RAID 0, 1 and 5 Dual Gigabit server Ethernet

controller with Teaming, load balancing and auto

fail over Feature, 5 x146GB SAS HS HDD, IDE

DVD ROM Drive, with (N+1)hotswap Redundant

Hot Swap Power Supply

366025

Application Server -------------------------Do-------------------------- 366025

Data Base Server Rackmount Server (6U/7U) equiped with Quad

multi core RISC/ EPIC 64 bit, fully binary

compatible to 64 & 32-bit Applications processors

, 16x2GB DDR2-667 with ECC memory

expandable to 192GB, Dual port or higher SAS

Controller supporting RAID 0&1, 2x146GB SAS

Hot Swap HDD (10K or higher rpm), IDE DVD

ROM Drive, Dual port Gigabit server Ethernet

controller, One dedicated Ethernet port for OS

independent hardware management (Out of

Band management). Server Equiped to support

clustering of servers under Windows & Linux OS

without any additional hardware, virtual media

licence, 3 yrs on site comprehansive warranty

1768000



Component Specification Unit Charges support. (Note: Sun Server is with built in

2x4Gbps HBA Card

Personal Computer

Desktop System with Processor (2.66GHz

speed, 3MB-L2 Cache,1066MHz FSB) or higher

processor, 2GB DDR-II 800 MHz or higher

Memory, 250GB or higher SATA-II HDD, TCO-03

certified 17'' TFT color monitor, DVD Writer,

Gigabit Ethernet Port & 4xUSB, Keyboard &

Optical Mouse with Mouse pad, Preloaded

Windows Vista Business Edt. & Preloaded Anti

Virus S/W with 60 days validity). Complete

System with 3 Yr. Warranty on site warranty

support.

31243

Switch AL2012C41 - Ethernet Switch 425-24T with 24

10/100 BaseTX plus 2 combo 10/100/1000/SFP

uplink ports plus 2 in-built stacking ports with

5yrs warranty

37672



Annexure VI – Power Backup Options Since most of the Gram Panchayats across the country face acute power shortage, it is important that adequate power backup is provisioned to ensure smooth operations at the Gram Panchayat. The following three alternatives can be explored depending upon the need and feasibility.

• Inverter

• A typical 1200VA inverter can operate 1 fan, 1 tube light and 1 PC • Considering the need for 8 hours backup, two inverter batteries would be required for

the above load • Cost – Rs. 25,000 approximately per GP • Operational Expenses – Battery water

This option is most suitable in situations where power supply is available for 8-10 hours every day as the inverter battery would need power supply for charging

• GenSet

• A typical 1200VA genset can operate 1 fan, 1 tube light and 1 PC • Cost – Rs. 30,000 approximately per GP • Operational Expenses – Rs. 12 – 15 per hour.

This option is feasible in most situations, except in far flung areas where availability of fuel is limited.

• Solar Photo Voltaic Cells

• Off the grid lighting concept based on solar photovoltaic technology is also an upcoming alternative. While the upfront investment is significantly higher than the other alternatives, the operational expenses are negligible. It has been tested in the state of Rajasthan has across all 9168 GPs.

• Cost - Rs 3.10 lakhs per GP. This includes 5 years maintenance. • Operational Expenses – Battery water

In Rajasthan, this option has been implemented in a Service Procurement Model, whereby the service providing agency shall be paid, based on the number of hours for which electricity is provided. This eliminates the drawback of high upfront investment. Hence, this delivers the maximum value for money.