Attachment 0010_LMP_Portal_User_Access_Procedures.pdf

LMP’s TAV-C capability extends Army asset visibility to contractor locations, improves the Army’s view of government assets, and supports Army Readiness.

15 November 2019

Logistics Modernization Program (LMP)

Total Asset Visibility – Contractor (TAV-C) Portal End User Access Procedures

LMP TAV-C Portal End User Access Procedures

Table of Contents Introduction

Purpose Statement

TAV-C Portal End User Access Process Flow

TAV-C Portal End User Access Process Steps

Appendix A – Instructions for Online DoD ECA Soft Certificate (IdenTrust)

For Example Only

Instructions for DoD ECA Certificate Application (IdenTrust)

• The production inactivity lockout period is 35 days - If a TAV-C Portal User does not transaction in the TAV-C portal within 35 days, their Production account will become locked, which would prohibit them from using the TAVC portal transactions. 6

Help Resources from IdenTrust

Appendix B – TAV-C Portal User Role to Training Course Matrix

Appendix C – DoD ECA Forms Packet

Appendix D – Acronym List

Introduction Logistics Modernization Program’s (LMP) Total Asset Visibility – Contractor (TAV-C) capability was developed to resolve audit findings related to the management of Army property. TAV-C capability extends asset visibility into contractor locations through improved record-keeping and provides more accurate records and reports associated with this Government property. Use of TAV-C functionality by contractors is mandatory for Army Working Capital Fund managed property in the possession of contractors. This solution contributes to the management of assets supporting global equipment Readiness through LMP.

Contractors using the TAV-C Portal to input information into LMP will comply with the access processes described in this guide to establish and maintain user accounts, complete access processes, as well as Department of Defense (DoD) approved authentication, to receive access to this capability. The approved authentication is achieved one of two ways: with a Common Access Card (CAC) or via a DoD External Certification Authority (ECA) issued certificate. The DoD ECA program supports the issuance of DoD-approved certificates to industry partners and other external entities and organizations. The ECA program is designed to provide the mechanism for these entities to securely communicate with the DoD and authenticate to DoD information systems.1

Purpose Statement The purpose of this document is to provide an understanding of the process for gaining access to the LMP TAV-C Portal solution for TAV-C Portal Contractors. The TAV-C Portal Contractors include:

1) Stock, Store and Issue Contractor Portal Users, and

2) Vendor Proof of Delivery Contractor Portal Users

Please note that the DoD ECA process described in this document uses examples of DoD ECA issued certificates through IdenTrust. IdenTrust, WidePoint (formerly ORC) and other DOD ECA providers are available on the Internet.

1 https://www.identrust.com/certificates/dod-eca-programs

It is recommended Contractors carefully review this document and consider the amount of time needed to establish and maintain user security credentials, complete mandatory systems access training, apply for access to the system, and complete task specific user training.

–– Until these requirements are satisfied, portal access will not be granted. ––

Refer to Appendix B for a list of user functional training courses and refer to the solicitation to verify the TAV-C functions needed for the effort.

https://www.identrust.com/certificates/dod-eca-programs

TAV-C Portal End User Access Process Flow

TAV-C Portal End User Access Process Steps

• In accordance with AMC Operations Order 19-229, dated 111810Z Sep 2019, this guide establishes procedures and guidance for users to gain access to the TAV-C Portal.

• The Contracting Officer (KO) works with the requiring organization to establish a Contract Officer’s Representative (COR).

• The designated COR informs the TAV-C Portal contractor of these procedures and requirements and assists end users with gaining access to the TAV-C Portal.

The COR reviews and approves the establishment of LMP end user accounts supporting TAV-C Portal processes. The COR functions as the Contractor’s point of contact for LMP systems issues.

• The COR works with the designated Command UAM Administrator to identify TAV-C Portal Functional Security Roles required by the contractor.

The following key requirements must be met by the TAV-C Portal end user to receive access. This section will review these requirements in greater detail.

☐ Information Assurance / Cyber Awareness (IA/CA) Training ☐ DD 2875 – System Authorization Access Request (SAAR) ☐ Approved DoD Authentication: Common Access Card (CAC) or DoD External

Certification Authority (ECA) issued certificate ☐ TAV-C Portal Functional Training

Information Assurance / Cyber Awareness (IA/CA) Training– Note the # refers to the process flow on page 3

• #5, TAV-C Portal end user will complete the IA/CA Training Course IA/CA training must be completed prior to submitting the DD 2875 System Authorization Access Request (SAAR) – (see step #6) to produce certificates for the COR.

IA/CA training can be accessed at:

o For CAC-enabled users: https://cs.signal.army.mil o For Non-CAC enabled users: https://public.cyber.mil/training/cyber-awareness-challenge-2019/ Steps 6-11 are needed to complete a DD 2875 – System Authorization Access Request

(SAAR)

• #6, TAV-C Portal end user completes blocks 1 through 16A of the SAAR and submit to the COR.

• #7, COR completes blocks 17-20B and submits to responsible Information Assurance (IA) Officer.

• #8, IA Officer completes blocks 22-25 and submits to the responsible Security Manager.

• #9, Responsible Security Manager completes blocks 28-32 & submits to the

COR.

• #10, COR provides a copy of the completed SAAR form to the UAM for auditability purposes.

• #11, Site UAMs receive the completed SAAR form and add it to the user’s LMP account once the account is created (step #16).

Approved DoD Authentication

• #4, COR verifies a DoD External Certification Authority (ECA) issued certificate is required and is available from on-line providers.

• #12, If the TAV-C Portal end user has a DoD CAC or ECA, skip step 12 for completing the DoD ECA Soft Certificate procurement process

• #13, TAV-C Portal end user completes the DoD ECA Soft Certificate procurement process through an issuing company (the example contained in this document comes from the IdenTrust2 website and is for reference only).

o Follow instructions on the Contractor’s selected DoD ECA provider website o Must be completed within 30 days from the date of the signature on the forms packet (instructions provided within the forms packet) o TAV-C Portal end user will be notified by the issuing company that their DoD

ECA Soft Certificate is available for retrieval, upon completion of forms processing o TAV-C Portal end user downloads DoD ECA Soft Certificate to their certificate store This may require Administrator permissions on the personal computer

(PC), therefore the end user may need to contact their local IT support.

DoD policy states that the user must enable strong encryption of their certificates. Password protection is required and begins when obtaining the certificate from the DoD ECA vendor.

It is recommended users complete the “Friendly Name” field with their ECA Provider for their certificate (otherwise, this will be left blank).

• #14-16, TAV-C Portal end user provides required information to the COR to be communicated to the site’s responsible UAM for account creation and record keeping, (i.e.: public key from soft certificate or digital signature, DD2875, etc.).

The UAM will verify CAC users have an existing DISA account, and non-CAC users have a valid DoD ECA certificate (Public Key).

Additional Prerequisite Access Requirements

• #17, Responsible UAM grants the TAV-C Portal end user a “universal role” to allow access to the TAV-C Training Library via the TAV-C Portal

• #18-19, All TAV-C Portal end users must complete the appropriate introductory TAV-C web-based training course. Refer to Appendix B (TAV-C Portal User Role to Training Course Matrix) for further guidance.

• #18-19, TAV-C Portal end users must successfully complete the associated functional training courses for the Portal access that they are requesting prior to that access being provided

2 https://www.identrust.com/ o Approved authentication (via CAC or ECA) must be obtained to access the TAV-C Portal Training Material on the Portal page o Refer to the TAV-C Portal User Role to Training Course Matrix

• #20-21, Organizations will follow their documented policy for assigning FSRs to Portal end users. Steps 20-21 will be completed by the requiring activity.

Responsibility of Certificate Holders and User Accounts

• Organization User Account Managers (UAM) will conduct the required annual account review required for TAV-C Portal end users.

• Organization UAMs will establish procedures for users who have TAV-C Portal access to ensure they are the correct users and maintain security accreditations.

• Changes to Vendor End User Accounts o Organization UAMs will work with the COR to establish processes and procedures to manage TAV-C user account changes, deletions, and resolve inactivations.

o Organization UAMs are responsible for notifying the COR if any TAV-C Portal user no longer requires an account.

• Inactivity Lockouts:

o Production inactivity lockout period is 35 days - If a TAV-C Portal User does not conduct transactions in the TAV-C portal within more than 35 days, their Production account will become locked prohibiting them from using the TAV-C portal for transactions.

o Account inactivity: Should a TAV-C Portal User not log-in to the portal within 45 days The account will be completely locked out and the LMP account will need to be reestablished.

Appendix A – Instructions for Online DoD ECA Soft Certificate

(IdenTrust)

For Example Only

Instructions for DoD ECA Certificate Application (IdenTrust) Follow these steps to apply for the DoD ECA Soft Certificate through IdenTrust’ s online application.

IMPORTANT NOTES:

When applying for an ECA certificate, when prompted, the Program is referring to “LMP – Logistics Modernization Program”.

The Organization Affiliation refers to the vendor / company you work for.

Upon submission of the application, you will be prompted to download the DoD ECA Forms Packet;

follow these steps:

1. Verify information on page 3 of the forms packet

2. Fill out Part 2 on Page 6 (i.e.: a passport and driver’s license are commonly used)

3. If you have more than one citizenship you have to assert on Page 7

4. Receive notarization on page 6, and page 7 if applicable

5. Send the completed, notarized forms packet to your Organization Officer (a

Vendor point of contact) to be signed

6. Return the completed, signed, notarized forms packet back to IdenTrust immediately Reminder, all processing steps must be completed within 30 days of the forms packet being signed.

Help Resources from IdenTrust IdenTrust offers a large library of help support documents and articles on their website, some topics include:

1. How to Digitally Sign Documents

2. Import and Export a Software Certificate

3. Manage My DoD ECA Certificates

4. Manage My TLS/SSL Certificates

5. Renew, Replace or Initiate a Key Recovery

6. Sign and Encrypt Email Communications

7. Policies – Current and Archived

8. DoD ECA Certificate Fact Sheet

9. DoD ECA Identity Verification Requirements

10. FAQs for ECA

Slide1

Slide2

Slide3

Slide4

Slide5

Slide6

Slide7

Slide8

Slide9

Slide10

Slide11

Slide12

Slide13

Slide14

Slide15

Slide16

Slide17

Slide18

Slide19

Slide20

Slide21

Slide22

Slide23

Slide24

Slide25

Slide26

Slide27

Slide28

Slide29

Appendix B – TAV-C Portal User Role to Training Course Matrix

Appendix C – DoD ECA Forms Packet

ECA-Digital-Certific ate-Forms-Packet-20

Appendix D – Acronym List

Acronym Name

ACC Army Contracting Command

AMC Army Materiel Command

CA Cyber Awareness

CAC Common access card

COR Contracting Officer’s Representative

DoD Department of Defense

ECA External Certification Authority

FSR Functional Security Roles

HQ Headquarters

IA Information Assurance

SAAR System Authorization Access Request

TAV-C Total Asset Visibility – Contractor

UAM User Account Manager