8.8 - Exhibit D Attachment, FRM-0496- Account Authorization.pdf

THIS FORM CONTAINS PII WHEN COMPLETED

Company Form

FRM-0496 ACCOUNT AUTHORIZATION REQUEST

7/6/2023 Rev. 11

Please send form encrypted via e-mail to IAM@nv.doe.gov for existing/new MSTS employees.

For sub-contractors send to CIRT@nv.doe.gov

Computer Access Request New Request Change to Existing Account Requester’s Last Name First Name MI Employee Number:

Telephone Dept./Org. Location U.S. Citizen Yes No

Company Name: (If non-MSTS, will require MSTS Point-of-Contact) If not full-time, expected termination date

Security Question: (Ex: First Car) THIS IS A REQUIRED FIELD Security Answer: (Ex: Toyota Rav4) THIS IS A REQUIRED FIELD

Computer System Requesting Access to: Privileged Account

Purpose of Account:

Is Training Required: If Yes, Trainer’s Signature Yes No

Subcontractor or Consultant Yes No If no only Page 1 is required. If yes fill out page 2 of this form also.

Please Read & Sign I understand that this request is for the use of government owned computer systems and resources. I understand that the use of these computing resources is restricted to official work only and that any personal or non-official work performed by myself on any government-owned computer system is prohibited and may be cause for disciplinary action.

I understand that I have a responsibility to protect all sensitive information which I create, process, or store and that such information is not to be released to unauthorized persons whether intentionally or not.

I understand that any files or records in my user accounts and other work that I perform on a government-owned computer may be monitored, audited, and reviewed by authorized persons without my prior consent or knowledge.

I understand that I may be given access to confidential or proprietary business, technical, or financial information belonging to the government, third parties, or MSTS. I will treat such information as confidential and agree not to appropriate such information for my own use or to disclose such information to third parties unless specifically authorized by MSTS in writing. All MSTS or government provided data, including without limitation, designs, processes, drawings, specifications, reports, schedules, statements of work, and any data developed or generated under this work is sensitive information. I will not discuss, divulge, or disclose any such information or data to any person or entity except those persons directly concerned with the performance of the work.

User Signature: Date:

Supervisor/MSTS POC Name: (Please Print) Signature: Date:

ADMINISTRATOR USE ONLY BELOW THIS LINE

User Name: Installed:

User Object ID: Removed:

mailto:IAM@nv.doe.gov mailto:CIRT@nv.doe.gov

Company Form

FRM-0496 ACCOUNT AUTHORIZATION REQUEST

7/6/2023 Rev. 11

Page 2 is only required for “Third Party” access.

The following requirements apply to any subcontractor, consultant, vendor, or business partner (hereinafter referred to as “THIRD PARTY”) accessing the U.S. Department of Energy/National Nuclear Security Administration (DOE/NNSA) information systems or network resources. For further information, reference company directives CD- 5500.018, “Information Technology General Use,” CD-5000.031, “Information Technology System and Computing Services Access,” and CD-2300.001, “Security Directive.”

1. In accordance with CD-5000.031, any third party that requires access to Nevada National Security Site (NNSS) information systems or network (other than the Internet only Virtual Local Area Network (VLAN)), must complete 1S00W180, “Cyber Security Annual Refresher.” No generic accounts will be authorized. Any elevated access account must be approved by Cyber Security prior to being created and will require completion of 1S00W900, “Privileged Account User Training (WBT).”

2. Non-DOE/NNSA devices brought onsite (including computers, tablets, and smart phones) must meet the criteria established by the Electronic Devices Acceptable Use Policy for the type of area they are entering.

3. Non-DOE/NNSA owned computers or other electronic devices are prohibited from connecting to the NNSS network but may connect to the Internet only VLAN. All computers connecting to the Internet only VLAN are required to register via the registration page. The use of hotspots is not authorized without approval from Cyber Security. The point-of-contact for the third party is required to ensure compliance.

4. Non-DOE/NNSA external storage devices (e.g., USB thumb drives, CDs, or DVDs) are not allowed to be connected or otherwise introduced to NNSS computers or devices. If third party data resides on one of these devices and is needed for NNSS information systems, the data must first be scanned and if free of malware, transferred by IT Service Desk personnel to a shared network location.

5. In accordance with CD-2300.001, any digital device introduced to any DOE/NNSA property is subject to search. IT and/or Cyber Security may perform scans on any digital device brought onto government property at any time and for any reason. Failure to allow IT or Cyber Security to perform security assessments or scans on a digital device will result in the immediate removal of the device from government property.

NOTICE TO THIRD PARTY USERS

By accessing any network or information system operated by the NNSS, you will be connecting to U.S. Federal Government property. All access must be for authorized use only and all users (both authorized and unauthorized) have no explicit or implicit expectation of privacy. Any or all uses of a system connected to a government network or information system may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed. By using or connecting to an information system or network, you are agreeing and consenting to such interception, monitoring, recording, copying, auditing, inspection, and disclosure. Unauthorized or improper use may result in administrative disciplinary action and civil and criminal penalties. By signing below, you are acknowledging understanding of this notice and the requirements listed above.

Name of Third Party: Cell Phone Number:

U.S. Citizen Yes: ☐ No: ☐ If No, specify country of citizenship:

NFO Employee: Yes: ☐ No: ☐ MSTS STR:

Signature: Date:

Company Represented:

Dates Access is Requested For (no longer than 1 year): through

Third Party will be performing work for which MSTS Accounting Org (ex: 2H50):

Cyber Security Use Only Date Received: Reviewed by: