C-5 OSD SOPs.pdf

Introduction

This document contains 13 documents that are representative of the several hundred SOPs that we operate under. The Government does not intend to make all SOPs available. However, the last pages of this document list most (not all) of the SOPs that a winning vendor will have to comply with per paragraph 3.9 of the draft Task 1 PWS which states, “The contractor shall follow current Government approved standard operating procedures (SOPs) until revised SOPs are coordinated and approved.” The

13 documents have been sanitized so they may have partial, missing, and/or scrambled tables, charts, text, etc. Also note that not all of these SOPs may be appropriate for Task 1.

Enterprise and Distributed Service

Desk Standard Operating Procedure:

MS Exchange Mailbox Management

Revision History

Release Number

Date Revision Description Revised By

0.1 02/04/2010 Initial document creation

0.2 02/11/2010 Technical Interchange Meeting comments incorporation

0.3 02/15/2010 Peer Review comments incorporation

0.4 02/15/2010 Technical edit

0.5 02/18/2010 Updating mailbox limits table

0.6 02/22/2010 Updates to Section 5.0 to reference Design and Operations documents

0.7 02/26/2010 Incorporation of peer review comments

0.8 03/26/2010 Incorporation of additional peer review comments

Table of Contents

1.0 INTRODUCTION

1.1 Purpose, Scope, and Objectives

1.2 Audience

1.3 Contacts

1.4 Conventions, References, and Standards

1.5 Procedure Maintenance

2.0 APPLICABILITY AND RESPONSIBILITIES

2.1 Considerations

2.2 Roles and Responsibilities

3.0 PROCEDURES............................................................................................................................I

3.1 Mailbox Storage Limitations .................................................................................................i

3.2 After Hours Support ...............................................................................................................ii

3.3 ITM Coordination ..................................................................................................................ii

3.4 Mailbox Maintenance ............................................................................................................ii

3.5 PST File Policy ......................................................................................................................iii

4.0 ADMINISTRATION ...................................................................................................................IV

4.1 Design Decisions ...................................................................................................................iv

4.2 Mailbox Store Policy Properties ............................................................................................iv

5.0 MAILBOX CONFIGURATION .................................................................................................IV

5.1 Standard Mailbox Settings .....................................................................................................iv

5.2 Enhanced Mailbox Settings ...................................................................................................iv

5.3 Exception Mailbox Settings ...................................................................................................v

6.0 ACRONYMS ...............................................................................................................................VI

List of Figures

FIGURE 4-1: MAILBOX STORE POLICY PROPERTIES ....................................................................... IV

List of Tables

TABLE 1-1: CONTACTS

TABLE 2-1: ROLES AND RESPONSIBILITIES

TABLE 3-1: MAILBOX STORAGE LIMITATIONS ................................................................................. I

TABLE 3-2: MAILBOX MAINTENANCE PROCEDURES ....................................................................... II

TABLE 6-1: ACRONYMS AND DEFINITIONS ..................................................................................... VI

1.0 INTRODUCTION

1.1 Purpose, Scope, and Objectives

The Enterprise and Distributed Service Desk (EDSD) Microsoft (MS) Exchange Mailbox Management

Standard Operating Procedure (SOP) defines the XXX mailbox storage limitations, the types of mailboxes, and mailbox configuration guidelines. This SOP defines detailed policies and procedures including:

XXX mailbox storage limitations

After Hours Support

Information Technology Manager (ITM) coordination

Mailbox Maintenance

Administration

Mailbox Configuration

1.2 Audience

The EDSD MS Exchange Mailbox Management SOP is intended for use by Enterprise and Distributed

Service Desk (EDSD) Technicians, Accounts Management Teams, and the XXX Messaging Team.

Additionally, XXX Component ITM mailbox management roles and responsibilities are defined within this

SOP.

1.3 Contacts

Table 1-1 identifies points of contact (POCs) with knowledge regarding information in this SOP and the

EDSD Accounts Management Process. The contact lists are maintained and published via the XXX

Portal.

Table 1-1: Contacts

POC Contact Information

Enterprise Service Desk

Distributed Service Desk Managers and Leads

XXX Component ITMs

1.4 Conventions, References, and Standards

This SOP acknowledges referenced product names and documents copyrighted, trademarked, registered trademarked, or service marked by their respective companies:

Enterprise and Distributed Service Desk (EDSD) Accounts Management Standard

Operating Procedure

XXX MS Exchange 2007 Consolidated Design Document and Operations Guide

XXX Managing Outlook Mailboxes Quick Reference Guide

XXX SOP Peer Review Checklist and Findings Log

1.5 Procedure Maintenance

The Director, XXX, Operations Division, is responsible for the maintenance of the EDSD MS Exchange

Mailbox Management SOP. XXX Component ITMs, Service Desk Managers, and other staff may submit

SOP change requests and recommendations using the XXX SOP Peer Review Checklist and Findings Log.

2.0 APPLICABILITY AND RESPONSIBILITIES

2.1 Considerations

The following considerations are applicable to the EDSD MS Exchange Mailbox Management SOP:

ITM approval is required for a user to be granted Enhanced mailbox settings

ITM, then XXX Operations Senior Management approval is required for a user to be granted Exception mailbox settings.

2.2 Roles and Responsibilities

Table 2-1 lists the roles and responsibilities of the stakeholders involved in MS Exchange Mailbox

Management.

Table 2-1: Roles and Responsibilities

Role Responsibilities

XXX Messaging Team Implement mailbox storage limitation policies

Manage modification of Active Directory (AD) accounts to implement Enhanced and Exception mailbox storage limitations

Support Service Desk with mailbox limit modifications

Monitor and report XXX user mailbox sizes

Accounts Management Team Create user mailboxes

Apply XXX mailbox policies

Enterprise Service Desk Advise XXX users of the mailbox storage limitations and the XXX recommended mailbox maintenance procedures

Adjust user mailbox limits

Escalate tickets to the Messaging Team

Notify Component ITMs of users granted Exception mailbox

Distributed Service Desk Advise XXX users of the mailbox storage limitations and the XXX recommended mailbox maintenance procedures

Adjust user mailbox limits

Escalate tickets to the Enterprise Service Desk

XXX Operations Senior Management

Approve Component user requests for Exception mailboxes, after ITM approval

Information Technology Manager (ITM)

Approve Component user requests for Enhanced and Exception mailboxes

Address Component users who repeatedly fail to comply with the mailbox policies

Develop a follow-up procedure to deal with individuals that abuse the mailbox policies

3.0 PROCEDURES

3.1 Mailbox Storage Limitations

XXX has implemented MS Exchange mailbox limitations to standardize mailbox management and reduce the size of user mailboxes. Table 3-1, Mailbox Storage Limitations, defines the three types of mailboxes and the corresponding limitations.

Table 3-1: Mailbox Storage Limitations

Mailbox Type

Description Limit Warnings, Restrictions, and EVault Frequency

Standard A Standard mailbox is configured with a 1 GB storage limit. This setting is enforced by the Information Store Policy depicted in Figure 4-1, Mailbox Store Policy Properties.

Standard mailbox users will receive warning and prohibition messages as detailed in the right-hand column.

1 GB Warning: 90% mailbox capacity reached

(943718 KB)

Prohibit Send: 100% mailbox capacity reached (1048576 KB)

Prohibit Send/Receive: 120% mailbox capacity reached (1258291 KB)

EVault Archival Frequency: Messages older than 45 days

Enhanced An Enhanced mailbox is configured with a 2 GB storage limit. In addition to the default mailbox store policy, an Enhanced mailbox has the ‗enhanced‘ value in the ‗Custom Attribute 5‘ field.

This setting must be assigned manually to the user‘s mail-enabled Active Directory account. Reference Section 5.2, Enhanced Mailbox Settings, for configuration guidelines.

Note: Enhanced users are VIP, SES, Military Flag Officers, or other designated staff who require larger on-line mail storage. Component ITM approval is required.

Enhanced mailbox users will receive detailed in the right-hand column.

2 GB Warning: 90% mailbox capacity reached

(1992294 KB)

Prohibit Send: 100% mailbox capacity reached (2097152 KB)

Prohibit Send/Receive: 120% mailbox capacity reached (2516582 KB)

EVault Archival Frequency: Messages older than 45 days

Exception An Exception mailbox is configured with a 5 BG storage limit. In addition to the default mailbox store policy, an Exception mailbox has the ―exception‖ value in the ‗Custom Attribute 5‘ field.

This setting must be assigned manually

5 GB Warning: 90% mailbox capacity reached

(4718592 KB)

Prohibit Send: 100% mailbox capacity reached (5242880 KB)

Mailbox Type

Description Limit Warnings, Restrictions, and EVault Frequency to the user‘s mail-enabled Active Directory account. Reference Section 5.3, Exception Mailbox Settings, for configuration guidelines.

Note: Exception mailboxes are for use only in extreme circumstances. VIPs are not Exception users by default.

Exception users shall not be published.

Component ITM and XXX Operations Senior Management approval are required.

Exception mailbox users will receive detailed in the right-hand column.

Prohibit Send/Receive: 120% mailbox capacity reached (6291456 KB)

EVault Archival Frequency: Messages older than 45 days

3.2 After Hours Support

The Service Desk automatically increases the size of mailbox for any user who reaches the designated mailbox storage limit during non-standard work hours. The Service Desk Technician will inform the user that the increase is temporary. The user is responsible for reducing the size of his/her mailbox within one week.

The Service Desk reports XXX users for whom mailbox storage limits have been temporarily increased to the XXX Operations Senior Management. XXX Operations Senior Managers provide reports to the respective ITMs for action.

3.3 ITM Coordination

XXX ITMs coordinate with affected individuals to monitor the cleanup of the mailboxes during a one-week period. ITMs address repeat offenders and implement follow-up procedures to deal with those individuals who abuse the XXX mailbox policies.

3.4 Mailbox Maintenance

The Enterprise and Distributed Service Desks will advise XXX users of the mailbox storage limitations and the mailbox maintenance procedures. Table 3-2, Mailbox Maintenance Procedures, provides a high-level overview of XXX recommended mailbox maintenance procedures based on MS best practices.

Table 3-2: Mailbox Maintenance Procedures

Mailbox Attribute Maintenance Procedure

Folder Size Limit Inbox and Sent folders to 2000 items.

Sent Items Folder Regularly delete or archive messages from the Sent folder.

Junk E-mail Folder Periodically review the Junk E-mail folder and delete messages that are not needed.

Deleted Items Folder Do not use the Deleted Items folder to store messages.

Calendar Delete expired Calendar Events and Event attachments.

PST Files Eliminate the use of PST files for message archiving and storage.

EVault Message Archiving EVault for Outlook is configured to auto-archive Outlook messages based on the type of mailbox and message age. Users may manually archive messages to reduce further mailbox size.

Message Stubs Delete older, unneeded EVault stubs from Outlook folders to reduce mailbox size.

The XXX Managing Outlook Mailboxes Quick Reference Guide (i.e., tri-fold) provides detailed mailbox maintenance procedures and EVault message archiving instructions. The tri-fold is accessible to all XXX users:

1. Navigate to the XXX Portal Operations Team Site (

2. Select the Quick Reference Guides link displayed below the PUBLIC Navigation

Links.

3.5 PST File Policy

XXX users should eliminate the use of PST files for message archiving and storage. The XXX PTS policy is

TBD.

4.0 ADMINISTRATION

4.1 Design Decisions

The default policy in MS Exchange implements the Standard mailbox settings. However, as modifications to the user’s AD account are required to implement and manage Enhanced and Exception mailbox settings, the policies are enforced by the Messaging Team.

The Messaging Team utilizes MS Exchange 2007 capabilities to apply Information Store, Server, and

System policies to multiple MS Exchange servers. This enables administrators to configure one set of policies through one interface and apply those policies to multiple Exchange servers.

4.2 Mailbox Store Policy Properties

To locate the Mailbox Store Policy settings within the MS Exchange Systems Manager:

1. Expand XXX (Exchange).

2. Expand Administrative Groups.

3. Expand XXX –CIO.

4. Expand System Policies.

5. Select Mailbox Store Policy.

The directory tree and Mailbox Store Policy Properties window are depicted in Figure 4-1.

Figure 4-1: Mailbox Store Policy Properties

5.0 MAILBOX CONFIGURATION

5.1 Standard Mailbox Settings

The Accounts Management Team is responsible for the creation of Standard mailboxes. The default policy in MS Exchange implements the Standard mailbox settings. These mailbox settings are applied automatically to each newly created mailbox. To verify the Standard mailbox settings are applied via the

MS Exchange Systems Manager:

1. Navigate to the Mailbox Store Policy Properties.

2. Select the Limits (Policy) tab.

Reference Figure 4-1.

5.2 Enhanced Mailbox Settings

The XXX Messaging Team is responsible for implementing and managing Enhanced mailbox settings as modifications to the user’s AD account are required. Enhanced limits are entered individually for mailboxes, and those limits override the default settings in Exchange. The XXX Messaging Team used scripts/spreadsheets to auto-load the Enhanced values. Enhanced mailboxes are managed in accordance with the XXX MS Exchange 2007 Consolidated Design Document and Operations Guide.

5.3 Exception Mailbox Settings

The XXX Messaging Team is responsible for implementing and managing Exception mailbox settings as modifications to the user’s AD account are required. Exception limits are entered individually for mailboxes, and those limits override the default settings in Exchange. The XXX Messaging Team used scripts/spreadsheets to auto-load the Exception values. Exception mailboxes are managed in accordance with the XXX MS Exchange 2007 Consolidated Design Document and Operations Guide.

6.0 ACRONYMS

Table 6-1 lists the definitions of the acronyms and abbreviations used in this document:

Table 6-1: Acronyms and Definitions

Acronym Acronym

AD Active Directory

CIO Chief Information Office/Officer

EDSD Enterprise and Distributed Service Desk

GB Gigabyte

ITM Information Technology Manager

KB Kilobit

MS Microsoft

POC Point of Contact

SOP Standard Operating Procedure

VIP Very Important Person

Desks Standard Operating Procedure:

Information Assurance

Number

Date Revision Description Revised By

0.1 07/28/2009 Initial document

0.2 09/11/2009 Initial review comments incorporated

1.0 09/28/2009 Initial baseline

Information Technology Manager Approvals

1.0 INTRODUCTION

1.1 Purpose, Scope, and Objectives

1.2 Audience

1.3 Contacts

1.4 Conventions, References, and Standards

1.5 Procedure Maintenance

2.0 APPLICABILITY AND RESPONSIBILITIES

2.1 Considerations

2.2 Roles and Responsibilities

3.0 IA REQUEST FORMS AND APPROVALS

4.0 CAC EXCLUSION

4.1 CAC Exclusion Request

4.2 Enabling CAC Exclude

4.3 Disabling of CAC Exclude

5.0 BURN BAG MANAGEMENT

5.1 Burn Bag Use for Classified Material

5.2 Burn Bag Use for Unclassified Material

5.3 Burn Bags User for Hard Drives

5.4 Burn Bag Preparation for Pick-up

5.5 Burn Bag Pick-up Locations and Schedules

6.0 HARD DRIVE DESTRUCTION

7.0 DATA SPILL RESOLUTION

8.0 CROSS DOMAIN DATA TRANSFERS

9.0 DATA REMOVAL

10.0 ACRONYMS .............................................................................................................................I

List of Tables

TABLE 1-1: CONTACTS

TABLE 2-1: ROLES AND RESPONSIBILITIES

TABLE 3-1: IA REQUEST FORMS AND APPROVALS

TABLE 5-1: BURN BAG PICK-UP LOCATIONS AND SCHEDULES

TABLE 6-1: SERVICE DESK DATA SPILL SUPPORT FUNCTIONS

TABLE 7-1: SERVICE DESK DATA TRANSFER FUNCTIONS

TABLE 8-1: SERVICE DESK DATA TRANSFER FUNCTIONS

TABLE 9-1: ACRONYMS AND DEFINITIONS ....................................................................................... I

7.0 INTRODUCTION

7.1 Purpose, Scope, and Objectives

The Enterprise and Distributed Service Desk (EDSD) Information Assurance (IA) Standard Operating

Procedure (SOP) defines Service Desk activities related to the management of security and IA related

Incidents and service Requests. Primary responsibilities for security and IA are delegated to:

XXX CIO, Director, Security for Administration and Personnel Management

XXX CIO, Director, Information Assurance

Component Security and IA Manager

The objectives of this SOP are to define the limited scope of Service Desk security and IA responsibilities and the support functions. This SOP defines procedures for IA activities performed by the EDSDs including:

IA Request Forms and Approvals

Common Access Card (CAC) Exclusion

Burn Bag Management

Hard Drive Destruction

Data Spill Resolution

Cross Domain Data Transfers

Data Removal

7.2 Audience

This SOP is intended for use by EDSDs for execution of Service Desk IA responsibilities and support functions.

7.3 Contacts

Table 1-1 identifies points of contact (POCs) with knowledge regarding information in this document and the EDSD IA Process. The contact lists are maintained and published via the XXX CIO Portal.

Table 7-1: Contacts

Contact Contact Information

Enterprise Service Desk Contacts

XXX Component Information Technology Managers (ITMs)

7.4 Conventions, References, and Standards

trademarked, or service marked by their respective companies:

•Department of Defense (DoD) Directive 5200.1-R, Information Security Program

•DD Form 2843, Classified Material Destruction Record

•DoD Directive 8190.3, Smart Card TechnologyXXX Guidance on Removal of Records

XXX CIO IA Data Spill SOP

XXX CIO User SOP: Data Transfer Procedure

XXX CIO Technician SOP: Data Transfer Procedure

7.5 Procedure Maintenance

The Director, XXX CIO, Operations Division, is responsible for the maintenance of the EDSD IA SOP. XXX

Component Information Technology Managers (ITMs), Service Desk Managers, and other staff may submit SOP change requests and recommendations using the SOP Peer Review Checklist and Findings

Log.

8.0 APPLICABILITY AND RESPONSIBILITIES

8.1 Considerations

The following considerations are applicable to the EDSD IA SOP:

The purpose of this SOP is to provide standardized procedures for the recording and resolution of security and IA related Incidents and Service Requests.

Component ITMs, Security Managers, and Distributed Service Desks may define and implement Service Desk IA procedures in addition to those defined in this SOP; however, adherence to applicable DoD and XXX policies and directives is required.

8.2 Roles and Responsibilities

Table 8-1, lists roles and responsibilities for team personnel tasked with recording and resolving security and IA-related Incidents and Service Requests.

Table 8-1: Roles and Responsibilities

Roles Responsibilities

Service Desk Record and report user security and IA incidents via Remedy Change Requests

Execute data spill resolution support tasks

Coordinate XXX CIO IA approval of request forms

XXX CIO IA Approve user request forms

Direct the Data Spill Response Team (DSRT)

ITM Approve user request forms, as required

Direct Service Desk data spill resolution support tasks

Information Assurance Manager/Information Assurance Officer (IAM/IAO)

Execute data spill resolution support tasks

Communicate data spill resolution support tasks to Service Desks

Data Spill Response Team Execute data spill resolution tasks

Communicate data spill resolution support tasks to Service Desks

9.0 IA REQUEST FORMS AND APPROVALS

Table 3-1 identifies request forms that require XXX CIO IA approval prior to Service Desk request fulfillment. The Service Desk is responsible for informing users of the applicable IA process and approval form as well as coordinating approvals with XXX CIO IA.

Table 9-1: IA Request Forms and Approvals

IA Request Form Purpose Approval Authorities

Account Request Request a network account for new and transferring users.

Component ITM or designee

XXX CIO IA

Auto-Forwarding Request Form

Request forwarding of XXX mail to an outside agency

Component ITM or Security Manager

XXX CIO IA

XXX Proxy Bypass Request access to a website that is blocked by the XXX Proxy

XXX CIO IA

XXX Data Transfer Request Form

Request transfer of data from one network classification to different network classification

XXX CIO IA

XXX CIO Data Transfer Team

Component IA

CAC Exclude Request Form Request user access to XXX network resources without a CAC

Component ITM or Security Manager

XXX CIO IA

Privileged Account Request Request a privileged account (i.e., administrative permissions) to XXX network resources

Deputy Director, Operations, XXX

CIO

Component ITM or Security Manager

XXX CIO IA

Exception Request Form Request exceptions to various IA policies and requirements including Security Technical Implementation Guides (STIG), Communication Tasking Order (CTO), Information Assurance Vulnerability Alerts (IAVA)

XXX CIO IA

XXXNET Removable Media Form

Request activation of CD-ROM drive on a XXXNET workstation

Government Sponsor

XXX CIO IA

Firewall Change Request Request modifications to XXX CIO firewall rules

Organization POC

XXX CIO IA

Blocking of Recreational

Websites Request Form

Request restriction or blocking of non-government and recreational websites (e.g., YouTube or MySpace)

XXX CIO IA

10.0 CAC EXCLUSION

CAC Exclusion allows approved users to access XXX network resources without a CAC. DoD Directive

8190.3, Smart Card Technology, requires the use of smart cards (i.e., CACs). User CAC Exclusion requires

Component ITMs and XXX CIO IA approval and is used on a limited basis.

Note: Users on the CAC Exclude List are unable to digitally sign or read encrypted email messages.

Additionally, some applications (e.g., custom developed or mission applications) are designed to support user authentication and/or single sign-on (SSO) using the CAC. These applications not are accessible to users on the CAC Exclude List.

10.1 CAC Exclusion Request

Component ITMs and XXX CIO IA approval are required for CAC Exclusion Requests.

3. Component ITM submits CAC Exclude Form to the Service Desk.

4. The Service Desk creates a Remedy Change Request for the user and attaches the ITM approved CAC Exclude Form in the attachment field.

5. The Service Desk assigns the Change Request XXX-IA for approval.

6. After approval, XXX-IA assigns the Change Request to XXX-Service Desk.

7. XXX-Service Desk verifies the approval and assigns the Change Request to XXX-

Accounts.

10.2 Enabling CAC Exclude

The Enterprise Accounts Management Team is responsible for enabling CAC Exclusions for approved users.

8. Via ActiveRoles Server (ARS), search for and locate the user account.

9. Select the user account.

10. From Directory Management, select Active Directory.

11. Enter the user‘s last name or login ID.

12. Select the Account tab.

13. Deselect the option ―Smart card is required for interactive logon.‖

14. Select Apply.

15. On the left side of the menu, select Reset Password.

16. Enter a 14 character temporary password.

17. Select the option ―User must change password at next logon‖ (if it applies at this time).

18. Click Apply.

19. Communicate the temporary password to the user.

20. Select the Member Of menu option.

21. Select the Add button.

22. Verify UUU.XXX.mil populates in the Find In field. Enter manually if required.

23. Enter cac-exclude in the Object Name field.

24. Select the Search button.

25. Select the cac-exclude hyperlink. This will add the group to the lower grey field of window.

26. Select the OK button. The Member Of window displays. The cac-exclude group is one of the listed groups.

10.3 Disabling of CAC Exclude

The Enterprise Accounts Management Team is responsible for disabling CAC Exclusions for users.

27. Via ARS, search for and locate the user account.

28. Select the user account.

29. From Directory Management, select Active Directory.

30. Enter the user‘s last name or login ID.

31. Select the Account tab.

32. Select the option ―Smart card is required for interactive logon.‖

33. Select Apply.

34. Select Apply again.

35. Select Member Of menu option.

36. Locate the cac-exclude group. Select the check box next to the cac-exclude group.

37. Select the Remove button.

11.0 BURN BAG MANAGEMENT

Classified material disposition and destruction are completed in accordance with DoD Directive 5200.1-

R, Information Security Program. Classified material that is no longer required for operational purposes shall be disposed of in accordance with the provisions of the Federal Records Act using approved methods and standards. XXX utilizes Burn Bags to prepare and transmit classified material destined for destruction at the Incinerator Plant.

Burn Bags are not to be used for disposal of material that is not sensitive or classified. These materials are to be disposed of via recycling or facility trash services.

11.1 Burn Bag Use for Classified Material

38. Burn Bags must be secured in a GSA approved safe or in an accredited space approved by the XXXXXXXXX (XXXX) for Open Storage at the proper level.

39. Burn Bags must be marked with the following information:

a. Staff member‘s name

b. Address and XXX Component Name

c. Telephone number

d. Highest classification of any material with the bag (e.g., ―Secret‖)

40. Each bag must not be more than half full nor weigh more than ten (10) pounds (lbs).

11.2 Burn Bag Use for Unclassified Material

Burn Bags may be used for the disposition and destruction of unclassified, but sensitive material.

41. Burn Bags must be secured in a GSA approved safe or in an accredited space approved by XXXX for Open Storage at the proper level.

42. Burn Bags must be labeled with the following information:

a. Staff member‘s name

b. Address and XXX Component Name

c. Telephone number

d. Highest classification of any material with the bag (e.g., ―FOUO‖). Note: FOUO is the highest classification that can be used for unclassified, but sensitive material.

43. Each bag must not be more than half full nor weigh more than ten (10) pounds (lbs).

11.3 Burn Bags User for Hard Drives

Burn Bags may be used for the disposition and destruction of hard drives.

44. Hard drives may not be placed in a Burn Bag with any paper material.

45. Hard drives must be stripped of any brackets, rails, screws, and other hardware.

46. Double-up the Burn Bag for added strength.

47. Burn Bags must be labeled with the following information:

a. Highest classification of the hard drives

b. In large type, label the bag with ―HARD DRIVES.‖ This will alert the truck driver to separate this bag from those containing paper materials.

48. Normally five (5), but no more than six (6), computer hard drives should be included in one Burn Bag.

11.4 Burn Bag Preparation for Pick-up

49. Fold the Burn Bag across the top and staple it closed with at least five (5) staples.

50. Verify the Burn Bags do not exceed weight requirements:

a. No more than ten (10) pounds (lbs.) for documents

b. No more that six (6) hard drives

51. Secure classified Burn Bags in the safe until you are ready to transfer the bags to the truck.

52. Complete two (2) copies of the DD Form 2843.

11.5 Burn Bag Pick-up Locations and Schedules

53. Take the Burn Bags and two completed DD Form 2843s to a designated location. Table

5-1 identifies the Burn Bag pick-up locations and schedules.

54. Do not leave Burn Bags unattended.

55. The driver will sign and return one copy of the DD Form 2843. The driver will retain one copy of the DD Form 2843s for records.

56. File the signed DD Form 2843. The forms must be retained for two years.

Table 11-1: Burn Bag Pick-up Locations and Schedules

Location Schedule

12.0 HARD DRIVE DESTRUCTION

Hard Drives up to Top Secret SCI and sensitive (FOUO), items containing Social Security Numbers, (SSNs), and other sensitive personal information will be:

57. Hard Drives will be accounted for in the remarks section of DD Form 2843, ―Classified

Material Destruction Record.‖

58. Hard Drives must be stripped of any brackets, rails, screws, and other hardware prior to turn in.

59. No hard drives will be collected on the daily collection runs.

60. Agencies outside of the abc may turn in hard drives directly to the abc Incinerator on the last ccc of the Month.

61. Hard Drives will be collected on the last ccc of the month from xx. There will be no exceptions.

62. Reference Section 5.3, for burn bag instructions for hard drives.

Any questions or concerns can be addressed to the Central Destruction Facility Manager.

13.0 DATA SPILL RESOLUTION

The XXX CIO IA Data Spill SOP establishes roles and responsibilities as related to data spills. Primary responsibility for investigation and resolution of data spills is delegated to the XXX CIO Data Spill

Response Team (DSRT).

Table 6-1 identifies Service Desk functions required to support reporting and resolution of data spills.

Table 13-1: Service Desk Data Spill Support Functions

Function Description

Record user reports of data spill incidents via a Remedy Change Request.

Initiate a Remedy Change Request

Enter cio-data-spill in the Requestor Login Name field.

Enter the following information in the Description field: POC name, phone number, Agency/Component‘s name, and other useful information that will help the DSRT contact the POC.

Note: Classified information shall not be entered in Remedy.

Any additional information describing the believed information level, circumstances involved, system containing the spill or any other information pertaining to the spill shall be conveyed using secure means (e.g. XXXNET or

XXXNET).

Affected Device or Media Control Initiate positive control of the affected device or media, documenting the Chain of Custody as defined by the XXX CIO IA Data Spill SOP, and ensure the device access and usage are controlled until appropriate Data Spill procedures are completed

Affected Device Disconnection Upon request from XXX CIO IA or the affected user‘s Information Assurance Manager (IAM) or Information Assurance Officer (IAO), disconnect all affected devices from the network.

Affected Device or Media Confiscation Upon request from XXX CIO IA or the affected user‘s IAM/IAO take custody of the subject device or media

Asset Management Facilitate replacement or use of suitable substitute equipment item in situations in where sanitization is not a viable option

14.0 CROSS DOMAIN DATA TRANSFERS

Guidance for cross domain data transfers is defined by the following XXX CIO IA SOPs:

XXX CIO User SOP: Data Transfer Procedure

XXX CIO Technician SOP: Data Transfer Procedure.

These SOPs provide precise guidance to the XXX community for the movement of electronic data from one system, device, or media to another. Table 7-1 identifies Service Desk functions and responsibilities for data transfers.

Table 14-1: Service Desk Data Transfer Functions

Function Description

Inform users of data transfers procedures and requirements

Detailed data transfer procedures are defined in the XXX CIO User SOP: Data Transfer Procedure

Use of USB-thumb drives, floppy drives, flash media, or other re-writeable removable storage devices on DoD systems is prohibited

Users are only authorized to transfer documents between networks of the same classification

Users are responsible for verifying the data classification does not exceed the classification of the target system

All file transfers between networks of different classifications must be submitted to the Component IA using the Data Transfer Request Form

Record user requests for data transfers between networks of different classifications

Create a Remedy Change Request for user requests for data transfers. The following information is required:

Requestor Login Name: <user id>

Requestor Name: <Lastname and Firstname>

Category: IT Services

Type: File Services

Item: Transfer File

Summary: File Transfer from high-to-low network

Group: XXX-IA

Assist or complete data transfers Assist or complete user requests for data transfers in accordance with the XXX CIO Technician SOP: Data Transfer Procedure.

15.0 DATA REMOVAL

XXX has established guidance for the removal of personal data for users departing XXX. Service Desks are responsible for informing users of data removal policies, requirements, and procedures. Table 8-1 identifies Service Desk functions and responsibilities for data removal.

Table 15-1: Service Desk Data Transfer Functions

Function Description

Inform users of data removal policies, requirements, and procedures

Reference the XXX Guidance on Removal of Records for Departing Personnel for Records Management definitions and detailed XXX policy and procedures.

Inform users of Component-specific policies regarding removal of data as some XXX Components impose more stringent policies.

Records include documentary materials, non-record materials, electronic records, and personal files.

All XXX users should ensure that they do not take public property when leaving Government service, but it is especially important that high-ranking officials understand their rights and responsibilities regarding removal of their personal files and non-record materials as well as continued access to records.

Personal files belong to the individual, not the Federal Government. As such, personal files may be removed at any time at the discretion of the user, unless the information contained is classified.

If personal information and Agency business is contained in the same document, a copy must be made of the office records with the personal information redacted. The copy provided to the individual, must have any record material redacted or removed.

Assist users with creation of compact disks (CDs)

Users must send an email to Mr ABC (XXX) requesting authorization to remove a copy of data.

User must forward Mr. abc‘s approval to the Service Desk.

The Service Desk creates a Remedy Change Request with the following Tasks:

- Convert mail inbox to PST and place on users H:\ drive

- Schedule Remote Support Technician to create and deliver CD

16.0 ACRONYMS

Table 4-1 lists the definitions of the acronyms and abbreviations used in this document:

Table 16-1: Acronyms and Definitions

Acronym Acronym

ARS ActiveRoles Server

CAC Common Access Card

CD Compact Disk

CIO Chief Information Office/Officer

CTO Communication Tasking Order

DOD Department of Defense

DSRT Data Spill Response Team

EDSD Enterprise and Distributed Service Desks

FOUO For Official Use Only

IA Information Assurance

IAM Information Assurance Manager

IAO Information Assurance Officer

IAVA Information Assurance Vulnerability Alert

IT Information Technology

ITM Information Technology Manager

XXXX XXXXXXXXXXXX

POC Point of Contact

PST Personal Storage Table

SOP Standard Operating Procedure

SSO Single Sing-on

STIG Security Technical Implementation Guides

Standard Operating Procedure:

Desks Video Teleconferencing

Operations

Number

Date Revision Description Revised By

0.1 07/09/2009 First draft

0.2 07/28/2009 Review and edit

0.3 08/04/2009 Second review and edit

1.0 08/26/2009 Initial baseline

1.1 10/22/2009 Insertion change from Mr ABC

1.2 01/22/2010 Removed Appendix C and inserted into VTC User Guide

1.3 01/27/2010 Added Section 6.0 Standard VTC EndPoint

1.4 02/09/2010 Technical edit

1.5 02/24/2010 Incorporation of peer review comments

1.0 INTRODUCTION

1.1 Purpose, Scope, and Objectives

1.2 Audience

1.3 Contacts

1.4 Conventions, References, and Standards

1.5 Procedure Maintenance

2.0 APPLICABILITY AND RESPONSIBILITIES

2.1 Considerations

2.2 Roles & Responsibilities

3.0 PROCEDURES

3.1 Adding External Remote Site

4.0 MULTI-POINT CONFERENCE SCHEDULING

4.1 Conference Room Reservation for VTC

4.2 Conflicting Conference Room Reservations

5.0 VIRTUAL ROOM NUMBER MANAGEMENT

6.0 VTC PHONE BOOK MAINTENANCE

7.0 STANDARD VTC HARDWARE

7.1 Dual Classification Endpoints

7.2 Standard Endpoint

7.3 Dual Classification Endpoint Deployment

8.0 EQUIPMENT DEPLOYMENT

8.1 Endpoint Configuration

8.2 Endpoint Installation Checklist

8.3 System Testing

8.4 Deployment Documentation

8.5 Training

9.0 VTC EQUIPMENT MAINTENANCE

10.0 MORNING CHECKS

11.0 TELECONFERENCE AND VTC TROUBLESHOOTING

12.0 ACRONYMS

APPENDIX A XXX CONFERENCE ROOMS

APPENDIX B VTC REQUEST FORM .......................................................................................I

List of Tables

TABLE 1-1: CONTACTS

TABLE 2-1: ROLES & RESPONSIBILITIES

TABLE 8-1: XXX VTC CONFIGURATION

TABLE 8-2: SYSTEM TEST PROCEDURE

TABLE 8-3: SYSTEM INFORMATION

TABLE 9-1: VTC EQUIPMENT MAINTENANCE CONTACTS

TABLE 11-1: TELECONFERENCE AND VTC TROUBLESHOOTING

TABLE 12-1: ACRONYMS AND DEFINITIONS

17.0 INTRODUCTION

17.1 Purpose, Scope, and Objectives

The Enterprise and Distributed Service Desk (EDSD) Video Teleconferencing (VTC) Operations Standard

Operating Procedure (SOP) defines procedures used to fulfill VTC requests and manage operations of the VTC system.

This SOP defines procedures performed by the Enterprise VTC Operations Team including:

Multi-Point Conference Scheduling

Virtual Room Number Management

VTC Phone Book Maintenance

VTC Equipment Deployment

VTC Equipment Maintenance

Morning Checks

Teleconference and VTC Troubleshooting

Please reference the VTC User Guide for information about user-specific procedures.

17.2 Audience

The Enterprise VTC Operations Team is the intended audience of this SOP.

17.3 Contacts

Table 1-1 identifies points of contact (POCs) with knowledge regarding information in this document and the Enterprise VTC Operations procedures. The contact lists are maintained and published via the XXX

Portal.

Table 17-1: Contacts

Contact Contact Information

Enterprise Service Desk Contacts

Enterprise VTC Operations

17.4 Conventions, References, and Standards

Copyrighted, trademarked, registered trademarked, or service marked product names mentioned in this document are hereby acknowledged.

Remedy Action Request System v6.3

Information Technology Infrastructure Library (ITIL), Version 3

Short User Manual: Tandberg MXP System – English (June 2006) at • www.ivci.com/pdf/videoconferencing-tandberg-profile-3000-mxp-user-manual.pdf

Procedure Maintenance

The Director, XXX, Network Directorate, Operations Division, is responsible for the maintenance of the

EDSD VTC Operations SOP. XXX Component Information Technology Managers (ITMs), Service Desk and

Help Desk Managers, and other staff may submit SOP change requests and recommendations using the

SOP Peer Review Checklist and Findings Log.

18.0 APPLICABILITY AND RESPONSIBILITIES

18.1 Considerations

The following considerations are applicable to the EDSD VTC SOP and services:

XXX has implemented the Tandberg MXP platform as the standard VTC equipment

Limited support (i.e., connectivity) is provided for Polycom VTC systems used by some

XXX Components

XXX Components and non-XXX organizations are responsible for the management and scheduling of respective conference rooms and non-XXX procured equipment

Appendix A identifies the XXX conference rooms for which the Enterprise VTC

Operations Team provides conference equipment and scheduling support.

The operating hours of the VTC Operations Team are 8AM to 6PM, Monday through

Friday.

18.2 Roles & Responsibilities

Table 18-1 lists the roles and responsibilities of VTC stakeholders.

Table 18-1: Roles & Responsibilities

Role Responsibility

Requestor Complete and submit XXX VTC Request Form

XXX Components Manage conference rooms and non-XXX procured conferencing equipment

VTC Operations Team Manage and monitor conference scheduling Maintain the VTC Phone Book Deploy and configure VTC Equipment Coordinate VTC equipment maintenance Conduct daily system verification testing (i.e., Morning Checks) Provide teleconference and VTC troubleshooting Once the VTC team is notified of a VTC system to be installed, the team informs the customer that the system will need an active port near the location they would want the VTC unit to be informed. (XXXNET or

XXXNET).

When system has been installed, the IP of the system is submitted to Server Ops to be reserved. The IP is also submitted to the XXX Firewall team to add to the "Any Any Rule". This allows the system the ability to connect to systems outside of the XXX Network and outside systems to the customer.

19.0 PROCEDURES

19.1 Adding External Remote Site

The following lists procedural steps in order for users to log on to VTC from external sites.

63. Customer Provides: External Remote Site (s)

Name of the remote site(s)

Points of Contact

64. VTC Team: Call the remote site(s)

c. Exchange VTC Information

IP Addresses (Destination IP address) o Complete ITA Firewall Request Form

Requesting XXX Component:

Requestor Name:

Requestor Title:

Requestor POC Telephone Number:

Requestor POC E-mail Address:

Source IP:

Destination IP:

Source Port:

Destination Port:

Direction of traffic:

Type of Connection:

Description:

Justification:

Proposed Technical Solution by Requestor:

o E.164 Dial Plan Configuration

Production Gatekeeper Cluster

Name of External Remote Gatekeeper

IP Address of External Remote Gatekeeper

Zone of External Remote Gatekeeper

Infrastructure Gatekeeper

Name of External Remote Gatekeeper

IP Address of External Remote Gatekeeper

Zone of External Remote Gatekeeper o Test/Troubleshoot Inbound and Outbound calls to Remote Sites

Point to Point

MCU Connection(s) Inbound and Outbound

Note: Test/Troubleshoot inbound and outbound calls require teleconference call with XXX VTC Team Engineer, XXX ITA Firewall Team Member, Remote Site VTC Engineer and there Firewall Team Personnel.

Once testing is complete and confirmed good connections between local test systems, ITA will set the firewall rules for every device registered in XXX

VTC Enterprise.

65. XXX VTC Global Phonebook

d. Add External Remote Site

e. Set Updated Phonebook to All Enterprise endpoints

66. XXX Scheduler: Add External Remote Site(s)

20.0 MULTI-POINT CONFERENCE SCHEDULING

The Enterprise VTC Operations Team is responsible for scheduling multi-point conferences via the Cisco

Unified Video Conferencing Manager (CUVCM). As specified by the VTC Request Form, the following information is required from the requestor:

Name of the meeting

Hosting conference room

Date and time of the conference

Points of interests connected to the conference

Reference Appendix B, VTC Request Form.

To schedule a multi-point conference:

67. Log in to the CUVCM.

68. Select the Meeting Scheduling icon.

69. Select the Basic tab.

70. Using the VTC Request Form (Appendix B), enter values for the following fields:

Subject

Meeting Type

Start Time

Note: Meeting ID is auto-populated.

Duration

Meeting PIN

Moderator PIN

Note: Recording of meetings is not currently available.

Note: Streaming should be disabled.

Description

71. Select Next.

72. From the Invite tab, select the meeting participants.

73. Select Test. Coordinate with the requestor to resolve scheduling conflicts, as necessary.

74. Select Finish.

The requestor will receive a confirmation e-mail containing the Meeting PIN.

20.1 Conference Room Reservation for VTC

If the requestor has also requested use of an XXX conference room via MS Outlook Calendar, determine

VTC conference room availability. Reply via e-mail with a notice either accepting or declining the reservation.

75. Check the requested conference room‘s Outlook calendar to determine availability.

76. To accept the appointment, edit the appointment request to include:

Conference room name

Date and time of conference

VTC Dial-in number (if required)

77. Click Accept.

78. To decline the appointment, select Decline. Edit the appointment request to include:

A possible alternate

Conference room name

Date and time of conference

79. Click Send.

20.2 Conflicting Conference Room Reservations

The Enterprise VTC Operations Team will determine the priority of conflicting reservations by:

Position of authority

Identifying the earliest reservation date

Coordinating with both requestors to determine priorities and alternatives

21.0 VIRTUAL ROOM NUMBER MANAGEMENT

The Enterprise VTC Operations Team is responsible for managing Virtual Room Numbers used by XXX staff to establish ad-hoc audio or video conferences. To create a Virtual Room Number:

80. Log in to the CUVCM.

81. Via the Scheduler, assign the next available Virtual Room Number.

82. Forward the Virtual Room Number to the requestor via e-mail.

Note: As Virtual Room Numbers are assigned to individuals, the numbers are not published in the VTC Phone Book.

To conduct a VTC:

83. Dial your virtual number from the VTC unit. (Example 6199)

84. Dial your virtual number from the VTC unit.

This begins your meeting, if your participants are dialing in from a VTC on the XXX VTC Network. (This can be identified by the 10 digit number beginning with 100 displayed at the top right of the screen)

Systems not on the network cannot use virtual numbers via VTC.

To conduct an audio conference or join an existing VTC via phone:

85. Dial

86. Once you are prompt for your party‘s extension, dial the virtual room number and #.

87. Customers can also teleconference into VTCs by this method.

22.0 VTC PHONE BOOK MAINTENANCE

The Enterprise VTC Operations Team is responsible for maintenance of the Phone Book. To update the

Phone Book:

88. Log in to the Tandberg Management Suite (TMS).

89. Select the Phone Book icon.

90. Select the Phone Book you want to edit.

91. Select Edit.

92. To add a new contact, select New. Enter the following data:

Name

IP Address

93. Click Save.

94. To update a contact, select Edit. Update the following data:

Name

IP Address

95. Click Save.

Note: For dual classification systems, once switched to either XXXNET or XXXNET, phonebook may need to be broadcast to the endpoint.

23.0 STANDARD VTC HARDWARE

The Tandberg MXP Platform is the standard videoconferencing solution for the XXX VTC Enterprise. The

Tandberg MXP Platform consists of six (6) different models (8000, 6000, 3000, 1700, 1000, and 990).

Because the conference rooms are used for multipurpose PowerPoint Presentations, we add the Natural

Presenter Package (NPP).

23.1 Dual Classification Endpoints

Dual Classification Endpoints require DISA approved switch Ultra-Criticom NIAP IPDC H.323 Switch or the

Ultra- Criticom STS IPDC H.323 NIAP Switch. The Tandberg MXP Platform is the standard videoconferencing solution for the dual classification endpoints.

23.2 Standard Endpoint

Tandberg MXP (NTSC) w/ Natural Presenter Package (NPP)

Tandberg MXP CODEC Platform o 8000 o 6000 o 3000 o 1700 o 1000 o 990

Edge 95

23.3 Dual Classification Endpoint Deployment

Ultra-Criticom IPDC H.323 NIAP Switch o Tandberg MXP(NTSC) w/Natural Presenter Package

Ultra-Criticom STS IPDC H.323 NIAP Switch w/ Tandberg MXP(NTSC) w/Natural Presenter

Package o Credenza - Cherry Wood, Black, or White Oak finish

24.0 EQUIPMENT DEPLOYMENT

The Enterprise VTC Operations Team is responsible for deployment and configuration of VTC equipment in response to Service Requests submitted via Remedy.

24.1 Endpoint Configuration

Table 8-1 identifies the default XXX VTC configuration:

Table 8-1: XXX VTC Configuration

Endpoint Component Yes No Explanation

Far End Camera Control (FEEC) x

Auto Answer x

Lens Cap for 1700 x

Lens Cap for Profile 3000 x System does not come with a Lens Cap

Connect with Microphone on MUTE x

None Default Password x

Hypertext Transfer Protocol (Http): x

Hypertext Transfer Protocol Secure (Https): x

File Transfer Protocol (FTP) x

Internet Protocol (IP) Access Password x

Push to talk MIC x Microphone can be muted via system remote

Telenet Challenge Service x

Simple Network Management Protocol (SNMP) Service x Read Only

H.239 (ITU Standard Dual Video) x

24.2 Endpoint Installation Checklist

96. Define the room Point of Contact (POC) and alternate POC information.

97. Conduct a site survey of the suggested conference room for endpoint installation.

98. Define the conference room telephone number.

99. Schedule a day for system delivery.

100. Schedule the conference room for two days for installation, testing, and training.

101. Unpack VTC equipment and assemble the system. Do not connect to the network until system assembly is completed.

102. Connect the endpoint to the Non-secure Internet Protocol Router Network

(XXXNET).

103. Configure the endpoint:

System Name

System E.164

Gatekeeper (GK) Internet Protocol (IP) address:

Strong Password

No FTP

No Telnet

No Hypertext Transfer Protocol (HTTP)://

Yes Hypertext Transfer Protocol Secure (HTTPS)://

Make sure system is operating on current software revision

24.3 System Testing

To validate system configuration and functionality, conduct system testing as documented in Table 8-2.

Table 8-2: System Test Procedure

Step Result Notes

System Power On/Off Pass Fail

Monitor Power On/Off Pass Fail

System Name Displayed Yes No

System Number Displayed Yes No

Camera Focus Pass Fail

Camera Pan Pass Fail

Camera Tilt Pass Fail

Camera Zoom Pass Fail

Registered to GK Yes No

Directory Loaded Yes No

Dial from Directory Pass Fail

Connect Inbound 384k Standard Definition (SD)

Pass Fail

Connect Outbound 384k

SD

Pass Fail

Connect Inbound 768k Pass Fail

Connect Inbound 2M SD Pass Fail

Connect Outbound 2M SD Pass Fail

Connect Inbound 2M High Pass Fail definition

Connect to MCU SD Pass Fail

Connection MCU High Rate (HR)

Pass Fail

Connect to MCU High Definition (HD)

Pass Fail

24.4 Deployment Documentation

Complete the VTC Deployment Document as depicted in Table 8-3.

Table 8-3: System Information

Data VTC Unit Information

System Name

System Number

Room Telephone Number

Room POC

Room Alt POC

System Manufacturer

System Model

System…