Attachment J-7 AFDM IDE 07 September 2021.pdf

AUXILIARY FLOATING DRY DOCK MEDIUM

- REPLACEMENT (AFDM)

Attachment J-7

Integrated Digital Environment Site Access and Public Key Infrastructure/Information

Assurance Awareness Attributes

07 September 2021

Prepared by Naval Sea Systems Command

1333 Isaac Hull Ave. SE Washington Navy Yard, DC 20376-2101

1.0 Integrated Digital Environment Site Access

The Contractor will provide data products to the Government via a SharePoint-based Integrated Digital Environment (IDE), hosted by Naval Systems Engineering Resource Center (NSERC), Dahlgren, VA. https://nserc.nswc.navy.mil/Pages/welcome.aspx

1.1 Requesting an IDE Account

All IDE users must:

a. Have a DoD approved digital identification certificate (Common Access Card (CAC) “email/signature” certificate or commercially-obtained DoD-compliant Public Key Infrastructure (PKI) certificate)

b. Complete annual Information Assurance (IA) Awareness Training. Details are below in Appendix A.

c. Have need-to-know regarding AFDM program information, along with a PMS

325 sponsor’s approval.

d. Agree to maintain an active account, defined as using the system at least once every thirty (30) days. All accounts are disabled after 30 days of inactivity, and removed after forty-five (45) days of inactivity.

e. Provide security clearance and citizenship information for verification/validation, if requested.

f. Be located at either a government site or at a company site that provides a

NAT (single IP address) which is registered with NSERC’s firewall. Sites with IP addresses not recognized by NSERC’s firewall cannot access the IDE. The Firewall Exception Request form is attached. Technical questions regarding the form can be addressed to NSERC’s Help Desk, available at 540-663-4507.

g. Use a company or government VPN when not at a site registered with

NSERC’s firewall or request a Firewall Exception for any other location. This requires a static IP address, not one assigned by an Internet service provider (ISP) using Dynamic Host Configuration Protocol (DHCP).

Instructions for requesting an NSERC account are attached:

a. If a user already has an NSERC account, they must still go through the application process for access to the PMS325 IDE.

b. When a user gets their application-received response from the address

"NSERC Help Desk <dlgr_nswc_nserc@navy.mil>", they must forward it to the following email address for user access tracking: PMS325-Support-

DL@caci.com. When forwarding, include the following in the message body:

• First Name, Middle Initial, Last Name

• Email Address

• Phone Number

• Organization (for example, company name)

• Organization Code, if applicable

2.0 Department of Defense Public Key Infrastructure External Certificate Authority Certificate Process

For users without a Department of Defense (DoD) PKI External Certificate Authority (ECA) Certificate (CAC), the following guidance is provided to help explain the certificate ordering process.

This guidance is not intended to substitute for the procedures established by the individual ECA activities who administer PKI ECA Certificates for DoD.

2.1 Purchasing an External Certificate Authority Certificate

To purchase an ECA Certificate, a person must be one of the following:

Employee of an organization conducting business with a United States (U.S.) government agency.

Employee of a state or local government conducting business with another U.S.

government agency.

Employee of a foreign government or organization conducting business with a U.S.

government agency.

Individual who needs to communicate securely with a U.S. government agency.

2.2 Certificate Ordering Process

The certificate ordering process is comprised of three steps: Online Application, Identity Verification, and Secure Online Certificate Delivery. During all three steps, users will need to work with the Local Registration Authority (LRA) who may also be referred to as a Trusted Agent (TA), and is an employee of the user’s organization who manages ECA Certificate enrollments.

2.2.1 Online Application

Each certificate requester must perform the online application by accessing one of three ECA websites and complying with their application requirements for certificate ordering. The type of PKI certificate (soft [electronic] or hard card) is an important consideration since it concerns portability of the certificate from one personal computer to another.

Note: A user must use the same workstation for the online application process and when retrieving the certificate.

2.2.2 Identity Verification for Citizens of the United States, Great Britain, Canada, Australia, and New Zealand

Citizens of the U.S., Great Britain, Canada, Australia, and New Zealand will need to present the following to a Notary Public (if a user is being processed outside the U.S., see a U.S. Consular Notary), or an authorized LRA/TA:

Request form generated during the online application process containing the user’s request Identification (ID).

Two forms of photo identification:

One must be a valid, current, official government ID such as a passport, driver's license, or government-issued photo identity card or badge.

The second can be a photo identity card or badge officially issued by a company or institution.

Note: A Proof of Organizational Affiliation letter does NOT replace one of the required photo IDs.

Proof of Nationality Non-U.S. Citizens must submit a photocopy of a passport from their country of

Citizenship (or Nationality).

U.S. citizens may submit a photocopy of either: passport, birth certificate, Certificate of Naturalization, Certificate of Citizenship, FS-240 Consular Report of Birth Abroad, or DS-1350 Certification of Report of Birth.

Form of Payment (Purchase Order Number, Check, Credit Card).

Proof of Organizational Affiliation If a company issued ID was submitted as one of two forms of photo identification, it will also work as Proof of Organizational Affiliation.

If a user is not submitting a copy of a company issued ID, they will need to submit a letter on company letterhead signed by a Duly Authorized Company Representative stating that they are an employee of that organization.

Note: Citizens of other countries are subject to separate processing procedures for identity verification. Please contact the NSERC/NEMS helpdesk at DLGR_NSWC_NSERC@navy.mil/ 540 663-4507 or 877-678-6289 if you have questions.

2.2.3 Secure Online Certificate Delivery

The applicant will receive a Certificate Issuance Notification email. The email will explain how to import, test, and backup the certificate depending on whether the user is procuring a soft certificate (electronic) or hard card PKI ECA certificate. A user must use the same work station for the online application process and when retrieving the certificate.

2.3 External Certificate Authorities in the United States

There are three ECAs in the U.S.

a. Operations Research Consultants (ORC), Inc. in Fairfax, VA, http://www.orc.com Help Desk online 24/7 (ecahelp@orc.com) or an ORC Service Rep 0730-1930

(Eastern Time) 1-800-816-5546.

b. Identity Trust in Salt Lake City, UT, http://www.idenTrust.com

Help Desk online 0100-1800 (Mountain Time (MT)) (helpdesk@identrust.com) or an IdenTrust Service Rep 1800-0100 (MT), U.S. 1-888-882-1104.

c. VeriSign, Inc. in Mountain View, CA, http://www.verisign.com, Phone: 1-866-202-5570 or 650-426-3896 (local).

Help Desk: Installation Questions: eca-support@verisign.com

Enrollment Questions: eca-authentication@verisign.com

3.0 Annual Information Assurance Awareness Training and System Authorization Access Request Navy

In addition to acquiring a PKI certificate, users are required to complete annual IA Awareness Training. See Appendix A: Information Assurance Awareness Training Guidance

Users who have already taken the annual IA Awareness Training within 12 months of this account request can email their IA Awareness Certificate of completion to PMS325-IDE_Support_DL@caci.com

Appendix A: Information Assurance (IA) Awareness Training (Cyber Awareness Challenge) Guidance

This course is available on the DoD Cyber Exchange (DCE) Public and Navy Knowledge Online (NKO) websites. NKO requires a Common Access Card (CAC). DCE Public does not.

Before beginning, check DCE’s troubleshooting guide to ensure that your browser is configured correctly so you’ll be able to print the certificate when you’ve finished at https://public.cyber.mil/cyber-training/cybersecurity-training-troubleshooting-guide/

The training link is https://public.cyber.mil/training/cyber-awareness-challenge/ for Cyber Awareness Challenge for Federal, Department of Defense (DoD), and Intelligence Community Employees. The course catalog title is Cyber Awareness Challenge Version 2020; if there is a more recent version, that is also acceptable.

As soon as you complete the training, you should see the following screen. Type your name in the field and click Print Certificate. Do not close this window until you’ve printed your certificate.

You can print the certificate to Adobe PDF (or other PDF writer) and sign it using your CAC/PKI, or print a hard copy, sign it and scan it. The certificate must be signed. The PDF can then be uploaded to the IDE under ‘My Account.’ See the SAAR-N help document for help with that.

If you completed the training on DCE Public, but didn’t get a certificate: Before starting over, try using the ‘Continue Current’ vs ‘Launch New’ link. If it shows all your trophies and score, you should be able to retake one task to get the above screen again.

Please contact PMS325-Support-DL@caci.com if you have questions.