J-5_Indistry_Studies_IDES_and_PKI_07_Dec_29_2016__2_.pdf

USCG HEAVY POLAR ICEBREAKER

INTEGRATED DIGITAL ENVIRONMENT SITE (IDES)

ACCESS AND PUBLIC KEY INFRASTRUCTURE (PKI)/

INFORMATION ASSURANCE (IA) AWARNESS

TRAINING ATTRIBUTES

FOR INDUSTRY STUDIES

ATTACHMENT J-5

Prepared by:

COMMANDANT (CG-9326)

UNITED STATES COAST GUARD STOP 7800

2703 MARTIN LUTHER KING JR AVE SE

WASHINGTON DC 20593-7800

Distribution Statement A: Approved for public release; distribution is unlimited

USCG Heavy Polar Icebreaker Industry Studies Contract Data Requirement List

See Restrictions on Title Page IS IDES and PKI

This page intentionally left blank.

IS IDES and PKI See Restrictions on Title Page

1.0 Limited Access/Export Controlled Attachments to RFP

The Draft Heavy Polar Icebreaker System Specification, Attachment J-1, is subject to Export Control limitations or has otherwise restricted distribution, and has been deemed "limited access" and "export controlled" within the FedBizOpps.gov (FBO) system. Vendors will require an "explicit access" grant by the USCG in order to view the documents via the FBO system.

In order to access this document, vendors must be certified as a US or Canadian contractor by the Joint Certification Program (JCP) administered by the Defense Logistic Information Service (DLIS). Instructions and procedures for being certified by JCP can be found at http://www.dlis.dla.mil/jcp/. Only those vendors that have current certification by JCP will be able to be granted explicit access to these packages by the USCG.

Upon JCP certification verification the vendor will be provided access to slected sections of the Draft Heavy Polar Icebreaker Systems Specification via the ARMDEC SAFE file exchange system ( https://safe.amrdec.army.mil/safe/).

2.0 Integrated Digital Environment Site (IDES) Access

The Contractor will provide data products to the Government via the IDES, located at https://pmses.navy.mil.

2.1 Requesting an IDES Account

a. All IDES users must have a Public Key Infrastructure (PKI) certificate, and have completed annual

Information Assurance (IA) Awareness Training and System Authorization Access Request Navy (SAAR_N) documentation before access will be granted.

b. The IA certificate and SAAR_N form will be uploaded to the IDES by the new user during the process to establish the account.

c. Contact IDES staff at the Program Management System-Extranet Site (PMS-ES) Help Desk at 1-800- 292-7178 to identify the project New Account Sponsor who will be initiating your account; then,

d. Contact the project New Account Sponsor via email providing the required data to initialize your account, including:

• First Name

• Middle Initial c. Last Name

• Email Address

• Organization (e.g. company name)

• Organization Code (if applicable)

Note: the above information must match the information on an existing PKI certificate, or the information used to establish a PKI certificate.

3.0 Department of Defense (DoD) PKI External Certificate Authority (ECA) Certificate Process

For users who do not have a DoD PKI ECA Certificate, the following guidance is provided to help explain the Certificate Ordering Process. This guidance is not intended to substitute for the procedures established by the individual ECA activities who administer PKI ECA Certificates for DoD.

3.1 Purchasing an ECA Certificate

To purchase an ECA Certificate, a person must be one of the following:

• Employee of an organization conducting business with a United States (U.S.) government agency.

• Employee of a state or local government conducting business with another U.S. government agency.

• Employee of a foreign government or organization conducting business with a U.S. government agency.

• Individual who needs to communicate securely with a U.S. government agency.

See Restrictions on Title Page IS IDES and PKI

3.2 Certificate Ordering Process

The Certificate Ordering Process is comprised of three main steps: Online Application, Identity Verification, and Secure Online Certificate Delivery. During all three steps, users will need to work with the Local Registration Authority (LRA) who may also be referred to as a Trusted Agent (TA), and is an employee of the user’s organization who manages ECA Certificate enrollments. For faster issuance of an ECA Certificate, the LRA or TA should ensure that the user’s enrollment information is valid and accurate. The LRA or TA may assume the role of the notary in notarizing the ECA application form. In the event that the user’s company or place of employment does not have a LRA or TA, the user may use a Notary Public who is an employee with the user’s company.

3.2.1 Online Application

Each certificate requester must perform the online application for themselves by accessing one of three ECA websites and complying with their application requirements for certificate ordering. The type of PKI certificate (soft [electronic] or hard card) is an important consideration since it concerns portability of the certificate from one personal computer to another.

Note: A user must use the same work station for the online application process and when retrieving the certificate.

3.2.2 Identity Verification for Citizens of the U.S., Great Britain, Canada, Australia and New Zealand

Citizens of the U.S., Great Britain, Canada, Australia and New Zealand will need to present the following to a Notary Public (if a user is being processed outside the U.S., see a U.S. Consular Notary), or an authorized LRA/TA:

a. Request form generated during the online application process containing the user’s request ID

b. Two forms of photo identification:

• One must be a valid, current, official government ID such as a passport, driver's license or government-issued photo identity card or badge

• The second can be a photo identity card or badge officially issued by a company or institution Note: A Proof of Organizational Affiliation letter does NOT replace one of the required photo IDs.

c. Proof of Nationality

• Non-U.S. Citizens must submit a photocopy of a passport from their country of Citizenship

(or Nationality)

• U.S. citizens may submit a photocopy of either: passport, birth certificate, Certificate of

Naturalization, Certificates of Citizenship, FS-240 Consular Report or DS-1350 Certification or Report of Birth

d. Form of Payment (Purchase Order Number, Check, Credit Card)

e. Proof of Organizational Affiliation

• If a company issued ID was submitted as one of two forms of photo identification, it will also work as Proof of Organizational Affiliation

• If a user is not submitting a copy of a company issued ID, they will need to submit a letter on company letterhead signed by a Duly Authorized Company Representative stating that they are an employee of that organization

Note: Citizens of other countries are subject to separate processing procedures for identity verification.

3.2.3 Secure Online Certificate Delivery

The applicant will receive a Certificate Issuance Notification email. The email will explain how to import, test and backup the certificate depending on whether the user is procuring a soft certificate (electronic) or hard card PKI ECA certificate. A user must use the same work station for the online application process and when retrieving the certificate.

3.3 ECAs in the United States

There are three ECAs in the U.S. Information pertaining to each ECA is provided below:

a. Operations Research Consultants (ORC), Inc. in Fairfax, VA, http://www.orc.com

• Help Desk online 24/7 (ecahelp@orc.com) or an ORC Service Rep 0730-1930 (Eastern Time) 1-800-816-5546.

b. Identity Trust in Salt Lake City, UT, http://www.idenTrust.com

• Help Desk online 0100-1800 (Mountain Time (MT)) (helpdesk@identrust.com) or an IdenTrust Service

Rep 1800-0100 (MT), U.S. 1-888-882-1104.

c. VeriSign, Inc. in Mountain View, CA, http://www.verisign.com,

• Help Desk: Installation Questions: eca-support@verisign.com; Enrollment Questions: eca-authentication@verisign.com; Phone: 1-866-202-5570 or 650-426-3896 (local).

4.0 Annual Information Assurance (IA) Awareness Training

In addition to acquiring a PKI certificate, users are required to complete the Annual IA Awareness Training and a SAAR_N form.

Upon entering the New User Invitation page, the user can access the links for the IA Awareness Training and SAAR_N form through the Training and documentation link. For additional information, see:

Appendix A: Information Assurance Awareness Training Guidance

Appendix B: System Authorization Access Request Navy (SAAR_N) Instructions

Users who have already taken the annual IA Awareness Training within 12 months of this account request can upload their IA Awareness Certificate of completion to their IDES once they receive their new account invitation.

Once the IDES account request has been approved, users will receive an email from “PMS-ESnotifier@navy.mil” indicating that the account has been created. Once notification is received that the account has been created, use Internet Explorer to navigate to https://pmses.navy.mil to access the IDES.

Should you have problems with access, contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178.

See Restrictions on Title Page APPENDIX A

Information Assurance (IA) Training (Cyber Awareness Challenge)

This course is available on the Information Assurance Support Environment (IASE) and Navy Knowledge Online (NKO) websites. NKO requires a Common Access Card (CAC). IASE does not.

Before beginning, check IASE’s troubleshooting guide to ensure that your browser is configured correctly so you’ll be able to print the certificate when you’ve completed the training:

http://iase.disa.mil/eta/troubleshoot-guide.html

The training link is http://iase.disa.mil/eta/ for Cyber Awareness Challenge for Federal, Department of Defense (DoD), and Intelligence Community Employees. Course catalog title is DOD Cyber Awareness Challenge V2.

Course number is DOD-IAA-V12.0 34.

As soon as you complete the training, you should see the following screen. Type your name in the field and click Print Certificate. Do not close this window until you’ve printed your certificate.

You can print the certificate to Adobe PDF (or other PDF writer) and sign it using your CAC/PKI, or print a hard copy, sign it and scan it. The certificate must be signed. The PDF can then be uploaded to the IDES under ‘My Account.’

See the SAAR-N help document (Appendix B) for help with that.

If you completed the training on IASE, but didn’t get a certificate: Before starting over, try using the ‘Continue Current’ vs ‘Launch New’ link. If it shows all your trophies and score, you should be able to retake one task to get the above screen again.

Please contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178 for assistance.

See Restrictions on Title Page APPENDIX B

Block-by-Block help with the SAAR_N

Block Form Field Selection or Instructions Type of Request Initial Date Current date. Click in the field and a calendar will open.

System Name PMS-ES (copy/paste) Location DISA DECC Mechanicsburg PA (copy/paste) PART I (to be completed by requester)

1. Name Fill out your Last, First, Middle Initial

2. Organization Your company or activity

3. Office Symbol/Department Enter your code or leave blank if none. On the IDES, you can click ‘My Account’ to see how your Organization and Department are currently identified (as Activity and Org/Code).

4. Phone Enter your commercial (work) number.

If you’re seated in a government bldg you might also have a Defense Switched Network (DSN) number, or you can leave it blank.

5. Official E-Mail Address The e-mail address used for your CAC/PKI certificate. It’s shown in your IDES ‘My Account’ screen. Don’t change it in ‘My Account,’ by the way, or you won’t be able to log into the IDES.

6. Job Title and Grade/Rank Contractors can just enter their job title

7. Official Mailing Address Work address

8. Citizenship US, Foreign National, Local National, or Other (specify)

9. Designation of Person Pick one

10. IA Training Requirements Check the box and enter the completion date from your certificate. If you haven’t completed the training, see the IA help file.

PART II – Endorsement of access by information owner, user supervisor or government sponsor

11. Justification for Access State the reason you require access to PMS-ES files, or enter the following: Access to PMS-ES is required to satisfy project work assignments for the PMS (Program Offices) ship design program.

12. Type of Access Required Authorized 12a. Date Signed Leave blank

13. User Requires Access To Unclassified

14. Verification of Need to Know Check the box. This is your supervisor (Block 16) certifying that you need access to the PMS-ES IDES.

14a. Access Expiration Date Government personnel leave this field blank.

Subcontractors should include their own company name and the prime contractor’s company name, the contract number and expiration date

15- 16b.

Supervisor info and signature

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

Blocks 15-16b to be completed by your company supervisor.

WARNING: After signing Block 16a, Blocks 11-16b can no longer be edited, so ensure they are filled out completely.

17- 17b.

Information Owner/OPR Info and Signature

Leave blank

See Restrictions on Title Page APPENDIX B

Block Form Field Selection or Instructions 18- 21.

IAM or Appointee Info and Signature

Leave blank

22. User Agreement The list of provisions you are agreeing to by submitting this form.

23. Name Your name, same as Block 1.

24. User Signature

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

WARNING: After signing Block 24, Blocks 1-10 can no longer be edited, so ensure they are filled out completely.

Insert your CAC/PKI and click in the field to sign.

If you can’t sign digitally, send the form to your security officer to fill out Part III next, then print and sign/date when you get it back.

25. Date Signed Automatically fills in if you sign digitally PART III – Security Manager Validates the Background Investigation or Clearance

Information 26- 30.

Security Clearance info and Security Manager signature

To be filled out by your department or company security officer, or whoever would normally submit a Visit Authorization Request (VAR) for you through Joint Personnel Adjudication System (JPAS). The IDES help desk does not have access to your JPAS information and they will reject your SAAR_N if this section is left incomplete

PART IV – Completion by Authorized Staff Preparing Account Information 31- 33b.

IDES Account Management info and signatures

Leave blank

Please contact the help desk at 1-800-292-7178 for assistance.