Attachment_9_RDTE_SOP_SCMS.docx

SCMS Non-Navy RDT&E Network SOP

Special Communications Mission Solutions Division Code 4.11.4

Non-Navy Research, Development, Test and Evaluation Network Standard Operating Procedures (Contractual Document Version)

23 August 2017 Version 10

TABLE OF CONTENTS

INTRODUCTION

All personnel using and having user accounts on the Special Communications Mission Solutions (SCMS) Division Non-Navy Research Development Test and Evaluation (RDT&E) Network must conform to Standard Operating Procedures (SOP). This helps to ensure that network\user hardware\software is compatible which allows for efficient troubleshooting and proper use of assets. This SOP pertains to Government Funded Equipment (GFE) and Contractor Funded Equipment (CFE) connecting to the SCMS RDT&E Network only.

Computers in the Division’s buildings that are not connected to the SCMS RDT&E Network will not be supported by the SCMS LAN Team and are not governed by this SOP. This SOP in conjunction with a Concept of Operations (CONOPS) and System Security Plan (SSP) shall serve as the governing documents for the SCMS RDT&E Network. This is a dynamic document in which input from the end user is solicited to ensure that efficient, secure network operation is provided to SCMS users. For brevity, the SCMS Non-Navy RDT&E Network will be referred to as ‘the network’ from this point forward in this document.

NETWORK

SCMS LAN Team

The SCMS LAN Team is available to provide technical support to personnel using the network. They use a variety of management tools to ensure network assets are being utilized efficiently, as well as, provide network administration, security and auditing. Network security includes workstation hardware and software inventory, file sharing, file permissions, file ownership, audit system, event log management, web monitoring, and appropriate asset utilization by user.

Government LAN Team Lead

The government employee in charge of the SCMS LAN is provided upon award.

Requesting Technical Support - LAN Trouble Reports

To request technical support from the LAN team you must submit a Trouble Report using the web-based form on the Intranet (provided upon award). This includes, but is not limited to, requests for setting-up new workstations, installing software/hardware, printer problems and toner, connectivity problems, new user account requests and email/distribution group updates. From the main Atlas homepage, click the LAN Trouble Report button.

Use this process to initiate trouble reports so that proper tracking, assignment and resolution of your problem are accomplished. Upon submitting a trouble report, a tracking number will automatically be assigned and the LAN Team will receive notification. Use this number when referencing the trouble report.

A history of all trouble reports submitted is maintained on the Intranet. This allows the user to view the status of their trouble reports by simply clicking on the trouble report number. Do not submit a new report to inquire about the status of a previous trouble report. The user may e-mail the member of the LAN Team that their trouble report has been assigned to for status inquiries. If the LAN Team member assigned to the trouble report must access the user’s desktop remotely, the user will be notified before the action occurs.

LAN Trouble Reports will remain “active” while the issue is being worked by the LAN Team. A LAN Team member may “defer” the ticket if they are waiting on a form(s), information, or equipment/material that is needed to complete the ticket. Deferred tickets will be updated on a weekly basis to provide users with status updates. If the LAN Team member is waiting on a form(s) and/or information from the user they will make every attempt to contact the user. If the user does not provide the form(s) and/or information within 30 days of the ticket initiation date, then the LAN Team member will close the ticket and the user will have to create a new Trouble Report once they have received the form(s) and/or information.

For all NMCI account, asset or printer issues, submit a SCMS LAN Trouble Report. If you have already contacted the NMCI Help Desk, and have been issued a ticket number, provide that ticket number in the SCMS LAN Trouble Report.

Printers

All printers must be connected to the network for management by the LAN Team. Locally attached printers are prohibited on the network.

Requests for service or toner must be made by submitting a trouble report.

The LAN Team maintains a list of standard printers that are authorized for use on the network. If a project is considering purchasing a printer to be connected in their project lab, they must first contact the LAN Team for approval to ensure that is an acceptable make and model. Failure to do so will result in the printer not being connected to the network.

After Hours Support

The LAN Team is available for support during the following core business hours:

Any project requiring after-hours or weekend network support must coordinate in advance with the government LAN Team lead.

Navy Marine Corps Intranet (NMCI) Equipment

The LAN Team is only responsible for installing KVM switches to connect NMCI computers and providing toner for NMCI printers. For all other issues concerning NMCI Equipment contact the NMCI Call Center.

STANDARD ARCHITECTURE (HARDWARE/SOFTWARE)

In order to maintain compatibility using SCMS’s available resources, a standard architecture has been established. The standard architecture is a minimum, and must be used when ordering new computers. Additional hardware/software can be ordered as needed, but must be Windows 10 Enterprise Edition 64 bit compatible and must conform to the specifications outlined in this document. Internet support from the manufacturer of the hardware and software must be available.

Workstation/Desktop

· Processor: 64-bit processor (Intel Core i7 or better recommended)

· Hardware-assisted virtualization capable (i.e. Intel VT or AMD-V)

· Hardware-enforced Data Execution Prevention (DEP) must be available and enabled

· RAM: 4 GB (8 GB+ or better recommended)

· Hard drive: 500 GB 7200 RPM SATA

· Video Card: Integrated HD graphics (DVI)

· Optical Drive: DVD-ROM/CD Writer

· Monitor: Capable of 1920 x 1080 or higher resolution

· 100/1000 Integrated Network Card

· USB Keyboard

· USB mouse

· CAC Reader – can be integrated into the keyboard or an external USB reader

· Windows 10 Enterprise Edition 64 bit

· Microsoft Office Professional Plus 2013 or Microsoft Office Professional Plus 2016 (32bit only)

· Anti-virus (Government Site license)

· ActivCard CAC Reader software (6.2)

Portables

Portables are to be used for remote/web access only. The use of laptops and docking stations on the network is prohibited.

· Processor: 64-bit processor (Intel Core i7 or better recommended)

· Hardware-assisted virtualization capable (i.e. Intel VT or AMD-V)

· Hardware-enforced Data Execution Prevention (DEP) must be available and enabled

· RAM: 4 GB (8 GB+ or better recommended)

· Hard drive: 500 GB 7200 RPM SATA

· Video Card: Integrated Intel graphics

· Optical Drive: 8X CD/DVD Writer

· Display: Capable of 1366 X 768 or higher resolution

· 100/1000 Integrated Network Card

· Wireless: Wireless b/g/n compatible

· Windows 10 Enterprise Edition 64 bit

· Microsoft Office Professional Plus 2013 or Microsoft Office Professional Plus 2016 (32bit only)

· Anti-virus (Government Site license)

· ActivCard CAC Reader software (Government Only)

Smart-phones

Only government approved BlackBerry smart-phones are allowed to connect to the SCMS Blackberry server. The BlackBerry must be government or contractor procured to specifically support a SCMS project. All personally owned smart-phones are prohibited from connecting to the network.

The SCMS LAN does not support any other smart-phone or tablet.

LICENSING

Workstation\Portable

SCMS provides the licensing to cover certain software applications running on the network servers. SCMS will provide the following software for the client workstations:

· Antivirus software

· Adobe Acrobat Reader

· Flash Player

· ActivCard CAC Reader software (Government Only)

· Windows Media Player

· Citrix

· Sun Java

The SCMS LAN Team is not responsible for maintaining the software or licenses for contractor or project assets.

It is the responsibility of the end user to provide legally licensed copies of any other software that is to be installed on their workstations. This includes the media any required license key/serial number. In the case of a site license, the user must have a copy of the site license, as well as, the number assigned from the site license allotment.

Responsibility for Providing License

Adobe Acrobat

Microsoft Visio

Microsoft Project

Before the software can be allowed on the network, the government LAN Team lead and the Information Assurance Security Manager (IASM) must approve it for installation. Some common examples of software that is the responsibility of the end user to license are:

· Operating System (Windows 10 Enterprise Edition 64 bit )

· Microsoft Office Professional Plus 2013 or Microsoft Office Professional Plus 2016 (32bit only)

· Microsoft Project 2013

· Microsoft Visio 2013

· Adobe Acrobat 11 or newer

· Adobe PhotoShop CS5 or newer

· AutoCAD

· Winzip

Shareware\Freeware

Only approved shareware/freeware is authorized on the network. The government LAN Team lead and the Information Assurance Officer (IAO) maintain a list of approved shareware/freeware.

NEW WORKSTATIONS

Orders for new workstations and laptops (GFE/CFE) connecting to the network must conform to the above standards for hardware and software. Also, approval for procurement must be obtained from the government LAN Team lead prior to ordering.

Please ensure that all new workstation requests have been checked against the Windows 10 Enterprise Edition 64 bit Hardware Compatibility List prior to requesting approval. When the new workstation arrives please submit a trouble report to temporarily transfer equipment to the network team for initial system set-up and installation on the network.

Government workstations must be tagged with an SCMS inventory tag and/or a Naval Air Warfare Center Aircraft Division (NAWCAD) project tag.

Government Only, if a new NMCI asset is required, submit a SCMS LAN Trouble Report, requesting an asset. If a laptop is required, a justification letter from your supervisor is required stating the reason why a laptop is needed.

NEW HARDWARE PERIPHERALS AND SOFTWARE

New hardware peripherals and software to be installed on a workstation connecting to the SCMS network must be listed on the Windows 10 Enterprise Edition 64 bit Compatibility List and receive approval from the LAN Team lead prior to ordering. Please submit a trouble report when new peripherals arrive for installation by the LAN Team. A network administrator will install hardware and software, ensuring proper licensing has been obtained and compatibility with the network. All additional hardware and software considered essential to project operations will need to be submitted to the LAN Team for testing and evaluation. Once tested and approved it will be installed. No personal software or hardware will be installed on any workstation connected to the network.

PROPERTY TAGGING AND APPROVAL

All property must be tagged as NAWCAD, NAWCAD project, SCMS and/or CFE assets. All CFE equipment must have Contract Officer Representative (COR) approval prior to connecting to the network. No personally owned computers are allowed to attach to the network. If any equipment is in need of tagging, contact the following:

The point of contact (POC) will be provided upon award.

NETWORK ACCOUNTS

A user account is required in order to gain access to resources on the network, including file shares, printers and the Intranet. All requests to add a new user account or to remove an existing user account must be made via a SCMS LAN Trouble Report. This request can only be made by SCMS government personnel.

New User Accounts

A user must have a SAAR-N form signed by the SCMS government LAN Lead and on file at NAVAIR before an SCMS account can be requested. In addition, the user must have a certificate showing they have completed the DoD Cyber Awareness Training.Requests for new user accounts. The request should also detail any other privileges required by the new employee, such as access to project shares or email distribution group membership.

Inactive Accounts

User accounts that have not been logged on to for 30 days will be disabled. You must contact the LAN Team in order to have your account re-enabled.

Removal of Accounts

Government Competency Leads and Contractor Leads will submit a trouble report to notify the LAN Team when their personnel are leaving. The LAN Team will disable the departing user’s account on their last day of employment. The Leads may also designate that the departing user’s files and email be transferred to a designated person. The account will remain disabled for 30 days before it is permanently deleted.

The LAN Team is required to closely monitor account activity and ensure that inactive accounts are removed in a timely manner.

User accounts that have been inactive for 60 days are permanently deleted by the LAN Team.

E-Mail Addresses

Users who will work onsite in a Division building will be provided a SCMS e-mail address.

Users who work offsite will not be provided a SCMS e-mail address unless there is a documented need for it.

Autoforwarding e-mail is prohibited on DoD networks. The SCMS LAN Team will not forward your SCMS e-mail to any another e-mail address.

Network and Phone Jacks

SCMS will ensure that all phone and network jack connections adhere to the following naming convention: Distant end number, rack number, patch panel number, and port number.

Printers

The network printers are named based on location using the following standard naming convention:

(Building number)_(room number)_(printer model)

COMMON ACCESS CARD (CAC) LOGON

A DoD CAC is required to logon to SCMS workstations and also remotely to the network using the VPN. You should not allow another user to logon using your CAC under any circumstances. You should not leave your CAC unattended in a workstation at any time.

INTERNET ACCESS, USAGE AND MONITORING

Computers on the network are prohibited from using phone lines to dial-up to another Internet service provider. SCMS utilizes Internet monitoring software to verify appropriate Internet usage (appropriate use of the Internet is defined in the CONOPS or SSP). SCMS network users will not attempt to load mobile code such as Java applets and ActiveX not expressly authorized for use. Gambling and the access and/or storage of pornographic material are prohibited.

BACKUPS

Network

All network servers, applications and files are backed up on a daily basis. This will ensure that applications and files on all SCMS servers can be fully restored in case of hardware failure. Your work related data should be stored on a shared drive, such as your personal G: drive or the X: drive. The files saved to these drives are automatically backed up.

Workstations

The user is responsible for regularly backing-up files on their workstation to CDs or DVDs. The LAN Team will not attempt to recover non-work related data stored on your workstation.

Previous Versions

The LAN Team has implemented a feature that creates snapshots of the network drives at different times during the day. You can use this feature to recover files that may have been previously deleted. To do so, right click a network folder then select Properties. Click the Previous Versions tab to display a list of available folders with their timestamp. Click the View button to view the contents of the selected folder.

NETWORK DRIVES

End users can store their work related documents on the network drives. These network drives are backed-up nightly by the LAN Team. Each user has a G: drive as their personal home directory. No other user has access to your G: drive. The X: (Projects) and the K: (Common) drives allow project teams to create folders for sharing their project-related documents.

Current Network Drive Mappings and Location

Inappropriate Files

The network drives are not to be used to store personal files or any other non-work related documents. The LAN Team performs regular scans of the network drives for inappropriate files and will remove them as discovered. The LAN Team will be implementing restrictions on the type of files that can be stored on the network. If you wish to keep these types of files you should store them on the C: drive of your workstation. Examples of inappropriate files and documents include:

· Music files (MP3, WMA, WAV)

· Video Files (WMV, AVI, MOV)

· Personal pictures

· Contractor - proposals, personnel reports, assessments, resumes

· Non-work related emails stored in PST files

· Personal files – taxes, bank statements

Restricting Directories

Sub-directories on the X: (Projects) drive may be restricted so that they are only accessible by project team members. A trouble report must be submitted by the project’s government representative to request access to or creation of a restricted directory. The trouble report must include a list of personnel with the degree of accessibility (i.e., read, modify, view etc.). Users will not be provided with “Full Control” permissions on any network drive. Permissions will not be set on any network drives, directories, or files by anyone but the LAN Team.

E-MAIL

Microsoft Exchange is the e-mail system for SCMS. MS Outlook is the client software utilized to access e-mail. All changes to the Global Address List must be requested by a government representative via a trouble report.

E-mail is for government business only. Global messages to all building personnel should be used on a limited basis. The allocation of mail storage for each user is limited to 400 MB. Once 350 MB are used, the user will receive a warning email. After the 400 MB limit has been reached the user will no longer be able to send or receive emails.

Personal Folders (PST)

Email containing work related data can be archived to Personal Folder (PST) files on the user’s PST directory (P: drive). These PST files are to be limited to a size of 500MB or less. PST files stored on network drives should not be password protected. If a user chooses to password protect a PST file stored on a network drive, the LAN Team will not be responsible for recovering its password or data.

Emails containing non-work related data are not to be archived to PST files on the network drives. If you wish to archive non-worked related data, it must be stored in a separate PST file on the user’s local C: drive in a folder labeled "Mail". These PST files will not be included in the network backup schedule, and it is the user’s responsibility to back up this data onto removable media, such as CDs. Loss of personal data is not the responsibility of SCMS, and the LAN Team will not attempt to recover such data from non-network resources.

Outlook Web Access

Network users may access their email via the SCMS webmail site at

Provided after award

REMOTE ACCESS

VPN access is available to users with high-speed Internet connections using the SCMS Network Access Page at

Provided after award

This website is restricted and it requires that you connect using your CAC card. You must have a signed Remote Access User agreement on file with the SCMS LAN Team.

In addition, you must have antivirus software installed on the computer that is connecting to the VPN. The virus definition must be updated and a full computer scan must have been completed within the last seven days. If your computer does not meet these criteria then it will not be allowed to connect to the VPN.

EXCESS EQUIPMENT

Equipment no longer required by a user should be donated to the network. The LAN Team lead will determine if the equipment can be beneficial for use on the network.

NETWORK DIAGRAM

Various diagrams of the network are located in the LAN Team room.

SECURITY

Network security is covered in SCMS’s CONOPS and SSP. Below are some key security items, but the SCMS CONOPS and SSP are the security-governing documents.

Accreditation

A designated approving authority accredits the SCMS RDT&E Network.

Reporting Suspected Violations

Report suspected network security or misuse to SCMS’s IASO, Alternate Information Assurance Security Officer (AIASO) or IASM. The IASM, AISM, or NSO will report the incident to proper authorities within the chain of command.

IAO/IASM Point of Contact provided upon award.

Network Ports / Connection Approval

All workstations connecting to the SCMS LAN must go through a connection approval process. Under no circumstance should a user disconnect a workstation from the network or attempt to reconnect a workstation to the network.

Screen Savers

Screen savers have been enabled on all computers connecting to the network. They will auto-lock after five minutes of inactivity.

DOD Banner

The DOD banner must appear at login on every computer attaching to the network. Submit a trouble report if your computer does not display the DOD Banner at logon.

Any security violations or attempt will be reported.

image1.png