What Is CPIC and Why Does It Matter?
Capital Planning and Investment Control (CPIC) is the federal government's framework for ensuring that IT investments deliver value, manage risk, and align with agency missions. Mandated by the Clinger-Cohen Act of 1996 and governed by OMB Circular A-130, CPIC applies to every major IT investment across the federal enterprise.
For program managers, CPIC is not optional. If your program's lifecycle cost exceeds your agency's major investment threshold (typically $25 million or more), you will need to prepare and maintain an OMB Exhibit 300, the primary artifact in the CPIC process.
The CPIC Lifecycle: Three Phases
Select Phase
The Select phase is where investment proposals compete for funding. During this phase, you must articulate the business case for your IT investment. Key activities include conducting an alternatives analysis, defining expected outcomes, estimating lifecycle costs, and assessing risks.
The Exhibit 300 submission during the Select phase must demonstrate that your proposed investment aligns with the agency's strategic plan and enterprise architecture, that you have considered alternatives (including commercial off-the-shelf and shared services), and that the investment has a credible cost and schedule baseline.
Control Phase
Once funded, your investment enters the Control phase, which is where most program managers spend the bulk of their CPIC effort. During Control, you must demonstrate ongoing performance through EVM data, operational metrics, and milestone tracking.
OMB and agency CIOs use the IT Dashboard to monitor investments in the Control phase. Your investment's CIO risk rating (a score from 1 to 5) is publicly visible and reflects the CIO's assessment of your program's likelihood of success. A rating of 4 or 5 triggers increased oversight and potential TechStat reviews.
Evaluate Phase
The Evaluate phase assesses whether the investment delivered its intended outcomes. This is the most frequently neglected phase, but it is increasingly important as OMB and Congress push for greater accountability in IT spending. Post-implementation reviews should compare actual outcomes against the business case projections from the Select phase.
Anatomy of the Exhibit 300
The Exhibit 300 is organized into several sections. Understanding each section's purpose helps you prepare a stronger submission.
Section A: Investment Overview. This captures the investment's name, unique investment identifier (UII), lifecycle costs, and alignment with agency strategic goals and the Federal Enterprise Architecture (FEA). Keep this section crisp and aligned with your agency's IT strategic plan.
Section B: Planning and Acquisition. This is the heart of the Exhibit 300. It covers your acquisition strategy, project plan, risk management approach, and performance metrics. For Agile programs, describe your iterative delivery approach and how you measure progress through working software rather than document milestones.
Section C: Spending Plan. A detailed breakout of costs by fiscal year, including development, modernization, enhancement (DME), and operations and maintenance (O&M) categories. Ensure your spending plan aligns with your agency's budget submission.
Section D: Security and Privacy. Document your investment's compliance with FISMA, NIST 800-53 controls, and privacy impact assessments. This section must reference your current Authority to Operate (ATO) or your plan to obtain one.
Practical Tips for Program Managers
Tip 1: Start Early and Iterate
Do not treat the Exhibit 300 as a once-a-year documentation exercise. Maintain a living document that you update quarterly. This reduces the annual submission crunch and keeps your data current for TechStat reviews or ad hoc OMB inquiries.
Tip 2: Align Your Metrics with OMB Priorities
OMB's priorities shift over time. Recent emphasis areas include customer experience (CX) metrics, adoption of shared services, and cloud migration progress. Tailor your performance metrics to reflect these priorities while still capturing program-specific outcomes.
Tip 3: Connect Your EVM Data
If your program uses EVM, ensure your Exhibit 300 cost and schedule data aligns with your EVM reporting. Discrepancies between your Exhibit 300 and your monthly EVM data will trigger questions from oversight bodies.
Tip 4: Engage Your CIO Office Early
Your agency's CIO office reviews and scores every Exhibit 300 submission before it goes to OMB. Build a relationship with the CPIC team. Understand their evaluation criteria. Share drafts early and incorporate feedback before the formal submission deadline.
Tip 5: Tell a Coherent Story
The Exhibit 300 is ultimately a narrative about why your investment matters and how you are managing it responsibly. Reviewers read dozens of these submissions. The ones that stand out tell a clear, coherent story connecting mission need to technical approach to measurable outcomes.
Common Mistakes
Overpromising on benefits. Inflated benefit projections in the Select phase become liabilities in the Evaluate phase. Be realistic.
Neglecting O&M costs. Programs often underestimate steady-state operations costs. Include realistic estimates for infrastructure, licensing, staffing, and technical refresh.
Ignoring the IT Dashboard. Your CIO risk rating is public. Monitor it, understand how it is calculated, and proactively address issues before they become red flags.
Moving Forward
CPIC and the Exhibit 300 process are evolving. The Technology Modernization Fund (TMF), FedRAMP, and zero trust architecture mandates are reshaping how agencies plan and justify IT investments. Program managers who understand these dynamics and can articulate their program's value within this changing landscape will be better positioned for sustained funding and support.
EaseOrigin helps federal program managers navigate CPIC requirements and build compelling investment cases. Whether you are preparing your first Exhibit 300 or recovering from a poor CIO rating, our team brings the experience to guide you through the process.
Tags
EaseOrigin Editorial
EaseOrigin Team
The EaseOrigin editorial team shares insights on federal IT modernization, cloud strategy, cybersecurity, and program delivery drawn from real-world project experience.







