Attachment 0024 TAVC Portal Access Addendum (1).pdf
PDF 204 KB Posted
- Attached to
- FIRE CONTROL RADAR (FCR)
- Solicitation number
- W58RGZ-26-R-0004
About this file
This is an addendum to the LMP TAV-C Portal End User Access Procedures issued by AMC DCS G3, Supply Requirements Division, effective October 15, 2020.
The document addresses a procedural problem discovered during implementation of the Total Asset Visibility-Contractor (TAV-C) capability within the Logistics Modernization Platform (LMP). The original access procedures required contractors to submit a DD Form 2875 System Authorization Access Request (SAAR) along with an External Certification Authority (ECA) certificate, but this approach was determined inappropriate because ECA certification does not require a security clearance and therefore has no corresponding entry in JPAS for validation. The addendum establishes revised interim procedures to maintain an auditable user access process while accommodating the ECA certification model. Contractor responsibilities include submitting an application packet containing: (1) the user's ECA form, (2) a Memorandum for Record on company letterhead signed by the contractor's Security Manager or an individual with Company Equity Ownership attesting to witnessed documentation during notarization, (3) cyber security training certificate completion from the authorized training portal, and (4) a signed Acceptable Use Policy (AUP). All documents must be provided electronically to the appropriate Government Point of Contact before LMP access is granted. LCMC responsibilities include appointing a government POC for LMP access and oversight, evaluating contractor access control procedures for effectiveness and accuracy, maintaining records of accepted certificates and expiration dates, and establishing procedures to ensure ongoing certificate validity. This interim guidance remains in effect until the next release of the portal user access guide and was designed to enable completion of pending contracts before year-end.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ADDENDUM TO APPENDIX A, THE LMP TAV-C PORTAL END USER ACCESS
PROCEDURES AND AMC OPORD, FRAGO 2, 19-220
To avoid excessive contract modification costs, it was decided in the development of Total Asset Visibility-Contractor (TAV-C) capability in LMP to require all new relevant contracts or new orders to it to be used rather than modify existing contracts. In a step to make participation in Army support more attractive, the decision was made to use the DoD approved External Certification Authority (ECA) certification in lieu of a full security clearance for TAV-C portal users.
TAV-C completed development and post go-live support period on 23 June 2020 with no contracts being processed. The first contracts are now beginning to be finalized and a problem as been found.
Problem.
Procedures developed for contractors’ access requests mirrored those for Army employees. As currently written, the applications require IA training, a signed Acceptable Use Policy (AUP) statement, and the ECA certificate to be provided with a DD Form 2875 System Authorization Access Request (SAAR). It has been determined the use of the SAAR form is not applicable since the ECA certificate process does not require a security clearance so there is no entry in JPAS for a security manager to validate.
Upon further review, G-2/6 determined the ECA certificate was sufficient for portal users, but the use of the SAAR is inappropriate for requests from ECA certified individuals. In order to have an auditable user access process to LMP, it will be necessary to still have a standard account access process across AMC.
Remediation.
Contractor Responsibility. The application packet shall consist of the 1) user’s ECA form, 2) Memorandum for Record on company letterhead paper signed by the contractor Security Manager or an individual with Company Equity Ownership attesting that all documentation needed to complete the ECA Digital Certificate Forms Packet was witnessed at the time of Notarization. 3) completion of cyber security training as evidenced by copy of training certificate. 4) signed AUP. An electronic copy of all the documents listed in this section shall be provided to the appropriate Government Point of Contact before LMP access can be granted.
The applicant can take the cyber security training at (https://public.cyber.mil/training/.
A blank AUP will be provided and can be manually signed and scanned..
LCMC Responsibility. Appoint a government POC for LMP access and oversight. To ensure validity over time, the requiring activity will evaluate the efficacy of the contractor’s TAV-C portal access control procedures for effectiveness, accuracy and the upkeep of their TAV-C access files. Maintain records of certificates accepted and their expiration date and establish procedures to ensure certificates are maintained as current and valid by the contractor.
AMC DCS G3, Supply Requirements Division is publishing this memorandum as an addendum to the LMP TAV-C Portal User Access Procedures and FRAGO 2, AMC OPORD 19-229 to provide interim guidance until revisions to the user’s guide and other related documents to the established solution can be accomplished per recommendations by the G-2/6 within the LCMC and ACC activities processing these contracts. This addendum can be used to enable the https://public.cyber.mil/training/ completion of pending contracts before year-end and will remain in effect until next release of the portal user access guide. Please insert a copy of this addendum in to the user’s guide.
10/15/2020
X Daniel C. Parker, PhD
DR. DANIEL C. PARKER
Chief, AMC G3 Supply Requirements Division
Signed by: PARKER.DANIEL.C.1171814622
File details come from the government source that posted it. Updated .