J-5 T-AGOS(X) IDES Access and PKIIA Awareness Attributes.docx

T-AGOS(X) Auxiliary General Ocean Surveillance Ship

Integrated Digital Environment Site Access and Public Key Infrastructure/Information Assurance Awareness Attributes

12 November 2019

Prepared by Naval Sea Systems Command 1333 Isaac Hull Ave. SE Washington Navy Yard, DC 20376-2101

Attachment J-5 T-AGOS(X) IDE/PKI Information Assurance Awareness Attributes

1.0 Integrated Digital Environment Site Access

The Contractor will provide data products to the Government via the Integrated Digital Environment Site (IDES).

1.1 Requesting an IDES Account

0. All IDES users must have a Public Key Infrastructure (PKI) certificate, and have completed annual Information Assurance (IA) Awareness Training and System Authorization Access Request Navy (SAAR_N) documentation before access will be granted.

0. The IA certificate and SAAR_N form will be uploaded to the IDES by the new user during the process to establish the account.

0. Contact IDES staff at the Program Management System-Extranet Site (PMS-ES) Help Desk at 1-800-292-7178 to identify the project New Account Sponsor who will be initiating your account; then,

0. Contact the project New Account Sponsor via email providing the required data to initialize your account, including:

a. First Name

b. Middle Initial

c. Last Name

d. Email Address

e. Organization (e.g. company name)

f. Organization Code (if applicable)

Note: the above information must match the information on an existing PKI certificate, or the information used to establish a PKI certificate.

2.0 Department of Defense Public Key Infrastructure External Certificate Authority Certificate Process

For users without a Department of Defense (DoD) PKI External Certificate Authority (ECA) Certificate, the following guidance is provided to help explain the certificate ordering process. This guidance is not intended to substitute for the procedures established by the individual ECA activities who administer PKI ECA Certificates for DoD.

2.1 Purchasing an External Certificate Authority Certificate

To purchase an ECA Certificate, a person must be one of the following:

· Employee of an organization conducting business with a United States (U.S.) government agency.

· Employee of a state or local government conducting business with another U.S. government agency.

· Employee of a foreign government or organization conducting business with a U.S. government agency.

· Individual who needs to communicate securely with a U.S. government agency.

2.2 Certificate Ordering Process

The certificate ordering process is comprised of three steps: Online Application, Identity Verification, and Secure Online Certificate Delivery. During all three steps, users will need to work with the Local Registration Authority (LRA) who may also be referred to as a Trusted Agent (TA), and is an employee of the user’s organization who manages ECA Certificate enrollments.

2.2.1 Online Application

Each certificate requester must perform the online application by accessing one of three ECA websites and complying with their application requirements for certificate ordering. The type of PKI certificate (soft [electronic] or hard card) is an important consideration since it concerns portability of the certificate from one personal computer to another.

Note: A user must use the same work station for the online application process and when retrieving the certificate.

2.2.2 Identity Verification for Citizens of the United States, Great Britain, Canada, Australia, and New Zealand

Citizens of the U.S., Great Britain, Canada, Australia, and New Zealand will need to present the following to a Notary Public (if a user is being processed outside the U.S., see a U.S. Consular Notary), or an authorized LRA/TA:

a. Request form generated during the online application process containing the user’s request Identification (ID).

b. Two forms of photo identification:

· One must be a valid, current, official government ID such as a passport, driver's license, or government-issued photo identity card or badge.

· The second can be a photo identity card or badge officially issued by a company or institution.

Note: A Proof of Organizational Affiliation letter does NOT replace one of the required photo IDs.

c. Proof of Nationality

· Non-U.S. Citizens must submit a photocopy of a passport from their country of Citizenship (or Nationality).

· U.S. citizens may submit a photocopy of either: passport, birth certificate, Certificate of Naturalization, Certificate of Citizenship, FS-240 Consular Report of Birth Abroad, or DS-1350 Certification of Report of Birth.

· If a company issued ID was submitted as one of two forms of photo identification, it will also work as Proof of Organizational Affiliation

· If a user is not submitting a copy of a company issued ID, they will need to submit a letter on company letterhead signed by a Duly Authorized Company Representative stating that they are an employee of that organization Note: Citizens of other countries are subject to separate processing procedures for identity verification. Contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178 for assistance.

2.2.3 Secure Online Certificate Delivery

The applicant will receive a Certificate Issuance Notification email. The email will explain how to import, test, and backup the certificate depending on whether the user is procuring a soft certificate (electronic) or hard card PKI ECA certificate. A user must use the same work station for the online application process and when retrieving the certificate.

2.3 External Certificate Authorities in the United States

There are three ECAs in the U.S.

a. Operations Research Consultants (ORC), Inc. in Fairfax, VA, http://www.orc.com

· Help Desk online 24/7 (ecahelp@orc.com) or an ORC Service Rep 0730-1930 (Eastern Time) 1-800-816-5546.

b. Identity Trust in Salt Lake City, UT, http://www.idenTrust.com

· Help Desk online 0100-1800 (Mountain Time (MT)) (helpdesk@identrust.com) or an IdenTrust Service Rep 1800-0100 (MT), U.S. 1-888-882-1104.

c. VeriSign, Inc. in Mountain View, CA, http://www.verisign.com, Phone: 1-866-202-5570 or 650-426-3896 (local).

· Help Desk: Installation Questions: eca-support@verisign.com Enrollment Questions: eca-authentication@verisign.com

3.0 Annual Information Assurance Awareness Training and System Authorization Access Request Navy

In addition to acquiring a PKI certificate, users are required to complete annual IA Awareness Training and a SAAR_N form.

Upon entering the New User Invitation page, the user can access the links for the IA Awareness Training and SAAR_N form through the Training and documentation link. For additional information, see:

Appendix A: Information Assurance Awareness Training Guidance

Appendix B: System Authorization Access Request Navy (SAAR_N) Instructions

Users who have already taken the annual IA Awareness Training within 12 months of this account request can upload their IA Awareness Certificate of completion to their IDES once they receive their new account invitation.

Once the IDES account request has been approved, users will receive an email from “PMS-ESnotifier@navy.mil” indicating that the account has been created. Once notification is received that the account has been created, use Internet Explorer to navigate to https://pmses.navy.mil to access the IDES.

Should you have problems with access, contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178.

Block-by-Block help with the SAAR_N

PART I (to be completed by requester)

If you’re seated in a government bldg you might also have a Defense Switched Network (DSN) number, or you can leave it blank.

PART II – Endorsement of access by information owner, user supervisor or government sponsor

Subcontractors should include their own company name and the prime contractor’s company name, the contract number and expiration date (e.g., ICI Services (CSC subcontractor), XXXXXXXXXX-XXXX, 9/1/2015).

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

Blocks 15-16b to be completed by your company supervisor.

WARNING: After signing Block 16a, Blocks 11-16b can no longer be edited, so ensure they are filled out completely.

18-21.

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

WARNING: After signing Block 24, Blocks 1-10 can no longer be edited, so ensure they are filled out completely. Insert your CAC/PKI and click in the field to sign.

If you can’t sign digitally, send the form to your security officer to fill out Part III next, then print and sign/date when you get it back.

PART III – Security Manager Validates the Background Investigation or Clearance Information

To be filled out by your department or company security officer, or whoever would normally submit a Visit Authorization Request (VAR) for you through Joint Personnel Adjudication System (JPAS). The IDES help desk does not have access to your JPAS information and they will reject your SAAR_N if this section is left incomplete

PART IV – Completion by Authorized Staff Preparing Account Information

Please contact the help desk at 1-800-292-7178 for assistance.

Information Assurance (IA) Training (Cyber Awareness Challenge)

This course is available on the DoD Cyber Exchange and TWMS websites. TWMS requires a CAC, the DoD Cyber Exchange does not.

To access the DoD Cyber Exchange visit https://public.cyber.mil/training/

To navigate to the Cyber Awareness Challenge page, visit https://public.cyber.mil/training/cyber-awareness-challenge-2019/

When ready, click “launch” and a new window will open. You can Start a New Session, the full program will take approximately 1 hour. For best functionality, it is suggested that you use this on a computer with either updated Windows or Mac operating systems.

As soon as you complete the training, you should see the following screen. Type your name in the field and click Print Certificate. Do not close this window until you’ve printed your certificate.

You can print the certificate to Adobe PDF (or other PDF writer) and sign it using your CAC/PKI, or print a hard copy, sign it and scan it. It does have to be signed. The PDF can then be uploaded to the IDE under ‘My Account.’ See the SAAR-N help document for help with that.

If you completed the training on IASE, but didn’t get a certificate: Before starting over, try using the ‘Continue Current’ vs ‘Launch New’ link. If it shows all your trophies and score, you should be able to retake one task to get the above screen again. I retook the last task to get this screen shot.

Please contact the help desk, 800-292-7178, if you still have questions.

image1.png