Attachment 1 GACA - GSA Affiliated Customer Accounts May 2014.docx

Sensitive Security Information For Official Use Only U.S. General Services Administration GSA Office of the Chief Information Officer www.gsa.gov

Google Drive™ and Google Sites™ provide GSA employees a way to create, edit and share work from anywhere. Real-time collaboration can now be accomplished not only with other GSA employees, but also their customers and business partners. The collaborative data stored on the Google Drive™ and Google Sites™ systems are compliant to the Federal Information Processing Standard (FIPS) 140-2. This standard ensures that access to and transmission of the files on these systems is via a secure web page that requires the TLS 1.0 encryption standard at minimum. The GSA has provided a mechanism to ensure that customers and partners of GSA can access this information via a Gmail account. Although anyone can create the Gmail account, the account must be created with the string beginning “GSA.” (the letters G S A and a period), and must have two factor authentication turned on.

Applicability - This process applies to those customer agencies and civilian partners that have not incorporated the use of Google Apps for Government or Google Apps Premier into their workplace. As these agencies and civilian partners already have Google accounts as part of their environment, this process is not required for sharing information with GSA and information can be shared with them using the same processes for sharing information within GSA, using their applicable Google accounts.

To create a Gmail account, go to http://mail.google.com/mail/signup, Complete the questionnaire, which includes the First and Last Name of the intended user, the logon name, which must start with “GSA.” (the letters G S A and a period), a simple password (which will be changed for a PIN later), and a recovery email address. Submit the request and accept the Terms of Service by clicking on “I accept”.

Once the “GSA.” account is setup, the Gmail users can enable two-factor authentication by going to their Account Settings; reached via the pull down menu linked to their email address as shown at right.

Once on the “Google accounts” page, click on the “Using 2-Step Verification” link in the “Security” section. This one time process will walk the Gmail user through the creation of the two factor authentication setup. The process is easy, only requires a cell phone that can receive simple messages, and only takes 10-15 minutes to complete. Note that the “Google Authenticator” application is available for Android, iOS, and BlackBerry so most any smart phone can be turned into a token-generating device.

The OCIO Security Staff will monitor all shared Google Sites™ and Google Drive™, notifying GSA users of non-compliance with this process. Once notified, if the share is reported to be with a user that maintains an account with a Google Apps for Government or Google Apps Premier, no further action will be required.

Last Printed: June 20, 2011 Page 2 of 2 For Official Use Only image2.png image1.png image3.png