J-5_NAV_IDE_Site_Access_and_PKI-IA_Awareness_Attributes_.pdf

NOAA AGOR VARIANT (NAV)

Integrated Digital Environment Site (IDE) Access and Public

Key Infrastructure (PKI)/Information Assurance (IA)

Awareness Attributes Attachment J-5

Version 1.0

26 April 2018

Solicitation No. N00024-18-R-2201

DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.

N00024-18-R-2201

Attachment J-5 ii

Table of Contents

1.0 INTEGRATED DIGITAL ENVIRONMENT SITE ACCESS

1.1 Requesting an IDE Account

2.0 DEPARTMENT OF DEFENSE PUBLIC KEY INFRASTRUCTURE EXTERNAL

CERTIFICATE AUTHORITY CERTIFICATE PROCESS

2.1 Purchasing an External Certificate Authority Certificate

2.2 Certificate Ordering Process

2.2.1 ONLINE APPLICATION

2.2.2 Identity Verification for Citizens of the United States, Great Britain, Canada, Australia, and New Zealand

2.2.3 SECURE ONLINE CERTIFICATION DELIVERY

2.3 External Certificate Authorities in the United States

3.0 ANNUAL INFORMATION ASSURANCE AWARENESS TRAINING AND SYSTEM

AUTHORIZATION ACCESS REQUEST NAVY

List of Appendices

Appendix A Information Assurance (IA) Awareness Training (Cyber Awareness Challenge)

Guidance ......................................................................................................................... A-1

Appendix B System Authorization Access Request Navy (SAAR-N) Instructions ........................... B-1

1.0 INTEGRATED DIGITAL ENVIRONMENT SITE ACCESS

The Contractor will provide data products to the Government via the Integrated Digital

Environment (IDE).

1.1 Requesting an IDE Account

A. All IDE users must have a Public Key Infrastructure (PKI) certificate, and have completed annual Information Assurance (IA) Awareness Training and System Authorization Access

Request Navy (SAAR_N) documentation before access will be granted.

B. The IA certificate and SAAR_N form will be uploaded to the IDE by the new user during the process to establish the account.

C. Contact IDE staff at the Program Management System-Extranet Site (PMS-ES) Help Desk at 1-800-292-7178 to identify the project New Account Sponsor who will be initiating your account; then, D. Contact the project New Account Sponsor via email providing the required data to initialize your account, including:

a. First Name

b. Middle Initial

c. Last Name

d. Email Address

e. Organization (e.g. company name)

f. Organization Code (if applicable)

Note: The above information must match the information on an existing PKI certificate, or the information used to establish a PKI certificate.

2.0 DEPARTMENT OF DEFENSE PUBLIC KEY INFRASTRUCTURE EXTERNAL

CERTIFICATE AUTHORITY CERTIFICATE PROCESS

For users without a Department of Defense (DoD) PKI External Certificate Authority (ECA)

Certificate, the following guidance is provided to help explain the certificate ordering process.

This guidance is not intended to substitute for the procedures established by the individual ECA activities who administer PKI ECA Certificates for DoD.

2.1 Purchasing an External Certificate Authority Certificate

To purchase an ECA Certificate, a person must be one of the following:

Employee of an organization conducting business with a United States (U.S.) government agency.

Employee of a state or local government conducting business with another U.S.

government agency.

Employee of a foreign government or organization conducting business with a U.S.

government agency.

Individual who needs to communicate securely with a U.S. government agency.

2.2 Certificate Ordering Process

The certificate ordering process is comprised of three steps: Online Application, Identity

Verification, and Secure Online Certificate Delivery. During all three steps, users will need to work with the Local Registration Authority (LRA) who may also be referred to as a Trusted Agent

(TA), and is an employee of the user’s organization who manages ECA Certificate enrollments.

2.2.1 ONLINE APPLICATION

Each certificate requester must perform the online application by accessing one of three ECA websites and complying with their application requirements for certificate ordering. The type of

PKI certificate (soft [electronic] or hard card) is an important consideration since it concerns portability of the certificate from one personal computer to another.

Note: A user must use the same work station for the online application process and when retrieving the certificate.

2.2.2 Identity Verification for Citizens of the United States, Great Britain, Canada, Australia, and New Zealand

Citizens of the U.S., Great Britain, Canada, Australia, and New Zealand will need to present the following to a Notary Public (if a user is being processed outside the U.S., see a U.S. Consular

Notary), or an authorized LRA/TA:

a. Request form generated during the online application process containing the user’s request

Identification (ID).

b. Two forms of photo identification:

One must be a valid, current, official government ID such as a passport, driver's license, or government-issued photo identity card or badge.

The second can be a photo identity card or badge officially issued by a company or institution.

Note: A Proof of Organizational Affiliation letter does NOT replace one of the required photo IDs.

c. Proof of Nationality

Non-U.S. Citizens must submit a photocopy of a passport from their country of

Citizenship (or Nationality).

U.S. citizens may submit a photocopy of either: passport, birth certificate, Certificate of

Naturalization, Certificate of Citizenship, FS-240 Consular Report of Birth Abroad, or

DS-1350 Certification of Report of Birth.

d. Form of Payment (Purchase Order Number, Check, Credit Card)

e. Proof of Organizational Affiliation

If a company issued ID was submitted as one of two forms of photo identification, it will also work as Proof of Organizational Affiliation.

If a user is not submitting a copy of a company issued ID, they will need to submit a letter on company letterhead signed by a Duly Authorized Company Representative stating that they are an employee of that organization.

Note: Citizens of other countries are subject to separate processing procedures for identity verification. Contact the IDE staff at the PMS-ES Help

Desk at 1-800-292-7178 for assistance.

2.2.3 SECURE ONLINE CERTIFICATION DELIVERY

The applicant will receive a Certificate Issuance Notification email. The email will explain how to import, test, and backup the certificate depending on whether the user is procuring a soft certificate

(electronic) or hard card PKI ECA certificate. A user must use the same work station for the online application process and when retrieving the certificate.

2.3 External Certificate Authorities in the United States

There are three ECAs in the U.S.

a. Operations Research Consultants (ORC), Inc. in Fairfax, VA, http://www.orc.com.

Help Desk online 24/7 (ecahelp@orc.com) or an ORC Service Rep 0730-1930 (Eastern

Time) 1-800-816-5546.

b. Identity Trust in Salt Lake City, UT, http://www.idenTrust.com.

Help Desk online 0100-1800 (Mountain Time (MT)) (helpdesk@identrust.com) or an

IdenTrust Service Rep 1800-0100 (MT), U.S. 1-888-882-1104.

c. VeriSign, Inc. in Mountain View, CA, http://www.verisign.com, Phone: 1-866-202-5570 or 650-426-3896 (local).

Help Desk: Installation Questions: eca-support@verisign.com

Enrollment Questions: eca-authentication@verisign.com http://www.orc.com/ mailto:ecahelp@orc.com http://www.identrust.com/ mailto:helpdesk@identrust.com http://www.verisign.com/ mailto:eca-support@verisign.com mailto:eca-authentication@verisign.com

3.0 ANNUAL INFORMATION ASSURANCE AWARENESS TRAINING AND

SYSTEM AUTHORIZATION ACCESS REQUEST NAVY

In addition to acquiring a PKI certificate, users are required to complete annual IA Awareness

Training and a SAAR_N form.

Upon entering the New User Invitation page, the user can access the links for the IA Awareness

Training and SAAR_N form through the Training and documentation link. For additional information, see:

Appendix A: Information Assurance Awareness Training Guidance

Appendix B: System Authorization Access Request Navy (SAAR_N) Instructions

Users who have already taken the annual IA Awareness Training within 12 months of this account request can upload their IA Awareness Certificate of completion to their IDE once they receive their new account invitation.

Once the IDE account request has been approved, users will receive an email from

“PMS-ESnotifier@navy.mil” indicating that the account has been created. Once notification is received that the account has been created, use Internet Explorer to navigate to https://pmses.navy.mil to access the IDE.

Should you have problems with access, contact the IDE staff at the PMS-ES Help Desk at

1-800-292-7178.

https://pmses.navy.mil/

A-1

Appendix A

Information Assurance (IA) Awareness Training

(Cyber Awareness Challenge) Guidance

This course is available on the Information Assurance Support Environment (IASE) and Navy

Knowledge Online (NKO) websites. NKO requires a Common Access Card (CAC). IASE does not.

Before beginning, check IASE’s troubleshooting guide to ensure that your browser is configured correctly so you’ll be able to print the certificate when you’ve finished at http://iase.disa.mil/eta/troubleshoot-guide.html.

The training link is http://iase.disa.mil/eta/ for Cyber Awareness Challenge for Federal, Department of Defense (DoD), and Intelligence Community Employees. Course catalog title is

DOD Cyber Awareness Challenge V4.

As soon as you complete the training, you should see the following screen. Type your name in the field and click Print Certificate. Do not close this window until you’ve printed your certificate.

You can print the certificate to Adobe PDF (or other PDF writer) and sign it using your CAC/PKI, or print a hard copy, sign it and scan it. The certificate must be signed. The PDF can then be uploaded to the IDE under ‘My Account.’ See the SAAR-N help document for help with that.

http://iase.disa.mil/eta/troubleshoot-guide.html http://iase.disa.mil/eta/

A-2

If you completed the training on lASE, but didn't get a certificate: Before starting over, try using the 'Continue Current' vs 'Launch New' link. If it shows all your trophies and score, you should be able to retake one task to get the above screen again.

Please contact the IDE staff at the PMS-ES Help Desk at 800-292-7178 if you have questions.

B-1

Appendix B

System Authorization Access Request Navy (SAAR-N) Instructions

Block-by-Block help with the SAAR-N

Block Form Field Selection or Instructions

Type of Request Initial

Date Current date. Click in the field and a calendar will open.

System Name PMS-ES (copy/paste)

Location DISA DECC Mechanicsburg PA (copy/paste)

PART I (to be completed by requester)

1. Name Fill out your Last, First, Middle Initial

2. Organization Your company or activity

3. Office Symbol/Department Enter your code or leave blank if none. On the IDE, you can click ‘My Account’ to see how your Organization and

Department are currently identified (as Activity and

Org/Code).

4. Phone Enter your commercial (work) number. If you’re seated in a government bldg you might also have a Defense

Switched Network (DSN) number, or you can leave it blank.

5. Official E-Mail Address The e-mail address used for your CAC/PKI certificate. It’s shown in your IDE ‘My Account’ screen. Don’t change it in ‘My Account,’ by the way, or you won’t be able to log into the IDE.

6. Job Title and Grade/Rank Contractors can just enter their job title.

7. Official Mailing Address Work address

8. Citizenship US, Foreign National, Local National, or Other (specify)

9. Designation of Person Pick one

10. IA Training Requirements Check the box and enter the completion date from your certificate. If you haven’t completed the training, see the

IA help file.

PART II – Endorsement of access by information owner, user supervisor or government sponsor

11. Justification for Access State the reason you require access to PMS-ES files, or enter the following: Access to PMS-ES is required to satisfy project work assignments for the PMS (Program

Offices) ship design program.

12. Type of Access Required Authorized

12a. Date Signed Leave blank

13. User Requires Access To Unclassified

14. Verification of Need to Know Check the box. This is your supervisor (Block 16) certifying that you need access to the PMS- ES IDE.

B-2

Block Form Field Selection or Instructions

14a. Access Expiration Date Government personnel leave this field blank.

Subcontractors should include their own company name and the prime contractor’s company name, the contract number and expiration date (e.g., Prime (XXX subcontractor), XXXXXXXXXX-XXXX, M/D/YYYY).

15-16b. Supervisor info and signature

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

Blocks 15-16b to be completed by your company supervisor.

WARNING: After signing Block 16a, Blocks 11-16b can no longer be edited, so ensure they are filled out completely.

17-17b. Information Owner/OPR Info and Signature

Signature required only if user does not have a security clearance. Contact PMS325 for additional information.

18-21. IAM or Appointee Info and

Signature

Leave blank

22. User Agreement The list of provisions you are agreeing to by submitting this form.

23. Name Your name, same as Block 1.

24. User Signature

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

WARNING: After signing Block 24, Blocks 1-10 can no longer be edited, so ensure they are filled out completely.

Insert your CAC/PKI and click in the field to sign. If you can’t sign digitally, send the form to your security officer to fill out Part III next, then print and sign/date when you get it back.

25. Date Signed Automatically fills in if you sign digitally

PART III – Security Manager Validates the Background Investigation or Clearance Information

26-30. Security Clearance info and

Security Manager signature

To be filled out by your department or company security officer, or whoever would normally submit a Visit

Authorization Request (VAR) for you through Joint

Personnel Adjudication System (JPAS). The IDE help desk does not have access to your JPAS information and they will reject your SAAR_N if this section is left incomplete.

PART IV – Completion by Authorized Staff Preparing Account Information

31-33b. IDE Account Management info and signatures Leave blank

Please contact the IDE staff at the PMS-ES Help Desk at 800-292-7178 if you have questions.