Exhibit 3 GSAAffiliatedCustomerAccounts.pdf

U.S. General Services Administration Office of the GSA IT www.gsa.gov/cio

For Official Use Only

Date: May 1, 2017 Subject: Gmail accounts - GSA Affiliated Customer Accounts (GACA) - for sharing in GSA’s Google Drive and Google Sites

GSA uses Google to provide employees with a way to collaborate in real time, and to create, edit and share work from anywhere. To enable simliar sharing and collaboration in Google with our government customers and business partners, while also ensuring that this shared information is safeguarded and secure, we’ve created a specialized Gmail account process called GACA – short for the GSA Affiliated Customer Accounts (GACA). Collaborative data stored on GSA’s Google Drive and Google Sites systems are compliant to the Federal Information Processing Standard (FIPS) 140-2. This standard ensures that access and transmission occurs via a secure web page using the TLS 1.2 encryption standard.

Applicability – GACA is for those who work for our government customers and business partners who do not use Google in their workplace. Agencies and civilian partners that are using Google in their workplace do not need to create a GACA account. GACA accounts must NOT be used by GSA employees and contractors in lieu of a gsa.gov account.

How to create a GSA Affiliated Customer Account (GACA) in Gmail

The person who will be using the GACA account (the government agency customer or the business partner) must create a Gmail account at http://mail.google.com/mail/signup and follow the process below:

• enter their first name and last name,

• enter their username: must start with “GSA.” then first name, last name -example: GSA.johnsmith@gmail.com (mandatory),

• complete all required fields, accept the Terms of Service and submit the request, and

• set up 2-Step Verification (also known as two-factor authentication) using a smart phone that can receive simple messages (mandatory).

The GSA IT Security Staff continuously monitors all shared files in Google Drive, and sharing in GSA’s Google Sites. If non-compliance with this process is detected, then our staff will notify users of non-compliance with this process. After notification, if the sharing has been determined to be with a user that maintains a G Suite account, no further action will be required.

http://mail.google.com/mail/signup mailto:GSA.johnsmith@gmail.com Heather Bowden - 10PQC InSite: https://insite.gsa.gov/employee-resources/information-technology/do-it-yourself-self-help/google-g-suite-apps/sharing-securely-in-google/gsa-affiliated-customer-account-gaca