November MCES INDUSTRIAL ONLINE REPORTING SYSTEM System Documentation Guide

Transcription

1 Nvember 2015 MCES INDUSTRIAL ONLINE REPORTING SYSTEM System Dcumentatin Guide

2 The Cuncil s missin is t fster efficient and ecnmic grwth fr a prsperus metrplitan regin The Metrplitan Cuncil is the reginal planning rganizatin fr the seven-cunty Twin Cities area. The Cuncil perates the reginal bus and rail system, cllects and treats wastewater, crdinates reginal water resurces, plans and helps fund reginal parks, and administers federal funds that prvide husing pprtunities fr lw- and mderate-incme individuals and families. The 17-member Cuncil bard is appinted by and serves at the pleasure f the gvernr..

3 Table f Cntents 1.0 Purpse f the Dcument Overview f CROMERR Final Rule Applicability f CROMERR Final Rule EPA s Apprval f the MCES Industrial Online Reprting System Overview f the MCES Industrial Online Reprting System Functinalities User Accunt Establishment Prcess Respnsible Official (RO) Accunt Establishment Prcess RO s First Time Lgging int the MCES Industrial Online Reprting System Cnsultant Accunt Establishment Prcess Electrnic Submissin and Revisins Prcesses Electrnic Submissin Prcess Electrnic Submissin Revisin Prcess User Accunt Management Prcesses Limit n Failed Lgin Attempts User Frgets User Name and/r Passwrd User Requests a New PIN User Resets Security Questins RO Accunt Reactivatin Accunt Administratin Prcesses Resetting a User s Passwrd Issue/Re-Issue a PIN t an RO Inactivate a User Accunt Accunt Activatin Prcess Change a User s Accunt Permissins Data Backup, Disaster Recvery and Security Prtectin Data Backup Disaster Recvery Security Prtectin Appendix A.Establish a Permanent Passwrd and PIN Appendix B.Example Challenge Questins and Reset Challenge Questins Appendix C.Example f an Online Data Entry Frm Appendix D.Example f Data Validatin Warnings within an Online Data Entry Frm Appendix E.Example f Data Review f the Frm befre Submissin Appendix F.Example f Certificatin Statement, PIN and Challenge Questin Appendix G.Example f Submissin Cnfirmatin Receipt Appendix H.Example f Submissin Receipt in the MCES Industrial Online Reprting System Appendix I.Example f List f Past Submissins Appendix J.Example f Past Submissin Search Functinality Appendix K.Example f Request t Revise a Submissin Appendix L.Example f Revisin Tracking Appendix M.Changing an RO s Certificatin and Submissin Permissins TOC MCES Industrial Online Reprt System Dcumentatin Guide

4 1.0 Purpse f the Dcument The U.S. Envirnmental Prtectin Agency (EPA) published the Crss-Media Electrnic Reprting Rule (CROMERR): Final Rule fr envirnmental prgrams that EPA has delegated, authrized, r apprved t administer. The rule includes perfrmance standards that a state, tribe, r lcal gvernment shuld meet in rder t implement EPA-authrized prgrams. This rule became effective January 11, Prgrams, including nt nly thse that are actually peratinal at the time the final rule is published, but als thse that are substantially develped must submit an applicatin t demnstrate cmpliance with CROMERR standards by January 13, A summary f the CROMERR Final Rule is presented belw: 1.1 Overview f CROMERR Final Rule Remves all regulatry bstacles t e-reprting under EPA and EPA-authrized prgrams Sets requirements fr electrnic reprting t EPA Requires EPA apprval f mdificatins r revisins t authrized prgrams that allw r wish t allw e-reprting Creates a special, ptinal prcess fr btaining EPA apprval f prgram mdificatins r revisins related t e-reprting Sets mandatry standards fr e-reprting systems perated by authrized prgrams. Des nt set requirements fr e-recrd-keeping Des nt make e-reprting mandatry, but des nt prhibit mandatry e-reprting under ther federal, state, tribe r lcal law 1.2 Applicability f CROMERR Final Rule Final Rule applies t: Persns wh submit reprts r dcuments t EPA t satisfy ther parts f Title 40 States, tribes and lcal gvernments that administer authrized prgrams under Title 40. Final Rule des nt apply t: Dcuments submitted via fax r magnetic r ptical media; Administrative infrmatin exchanged between EPA and states, tribes r lcal gvernments as part f the implementatin f authrized prgrams. 1.3 EPA s Apprval f the MCES Industrial Online Reprting Prgram: 1. MCES s CROMERR Applicatin Package must cntain: Certificatin f sufficient legal authrity t implement electrnic reprting signed by the Metrplitan Cuncil Reginal Administratr; Listing f all electrnic dcument receiving systems being addressed, with a descriptin fr each system that specifies hw the system meets the requirements f Sectin f the rule; Schedule f upgrades fr the systems that have a ptential fr affecting the prgram s cnfrmance; Other infrmatin needed t fully evaluate the applicatin Page - 1 MCES Industrial Online Reprt System Dcumentatin Guide

5 2. EPA Review Prcess will include: Cmpleteness review Determinatin is made within 75 days f applicatin receipt Deficient applicatins may be amended, and determinatin f cmpleteness is made within 30 days f amendment receipt Review t apprve/disapprve Incmplete r deficient applicatins Cmpnents f a cnslidated applicatin, which can be acted n separately, fr example, apprving sme and disapprving thers Cmplete applicatins nt acted n within 180 days are cnsidered autmatically apprved Applicatins fr existing systems nt determined t be cmplete by January 13, 2010, have a 360-day review perid befre being cnsidered autmatically apprved Allws cnslidated applicatins fr multiple prgrams 2.0 Overview f MCES Industrial Online Reprting System Functinalities The MCES Industrial Online Reprting System is a prprietary system (the GvOnline system develped by enftech & Cnsulting, Inc.) that includes multilayered security that addresses the majr facets f applicatin security utlined in CROMERR. This includes Identity Assurance, Authenticatin/Authrizatin, Submissin and Submitter Integrity, and Nn-Repudiatin. The MCES Industrial Online Reprting System, in cnjunctin with sund business practices, prvides a fully CROMERR-cmpliant system. This dcument identifies the technlgies, techniques, and business practices that are included in the MCES Industrial Online Reprting System implementatin that prvide evidence f the system s cmplete cmpliance with the CROMERR Final Rule specificatins. Security in the MCES Industrial Online Reprting System is cntrlled using the fllwing prcesses: User Accunt Establishment Prcess: The prcess in which facilities establish accunts fr themselves fr electrnic submissin by filling ut an nline accunt registratin frm and submitting the MCES Electrnic Signature Agreement (ESA). This phase includes the fllwing aspects: Identity Prfing and Validatin Electrnic Signature Agreement and Issuance Electrnic Reprting, Submissin & Revisin Prcess: The MCES Industrial Online Reprting System prvides a variety f security features during the electrnic submissin prcess. This prcess can be brken dwn int the fllwing aspects: Electrnic Signature Management Transmissin Errr Handling Cpy-f-Recrd (COR) Management User Accunt Management Prcess: The MCES Industrial Online Reprting System prvides functinalities fr users t prtect the security f their accunts. Accunt Administratin Prcess: The MCES Industrial Online Reprting System prvides a security management tl fr MCES staff t manage user accunts if a user s credentials are fund t be r suspected f being cmprmised. Page - 2 MCES Industrial Online Reprt System Dcumentatin Guide

6 MCES Industrial Online Reprting System Data Backup & Disaster Recvery Prcedures: The sectin briefly summarizes the measures enftech & Cnsulting, Inc., has taken t back up the MCES Industrial Online Reprting System database and prtect it frm accidental r disastrus events. Please nte that enftech & Cnsulting, Inc. is prviding hsting services t MCES fr the MCES Industrial Online Reprting System. 2.1 User Accunt Establishment Prcess There are tw types f facility user accunts in the MCES Industrial Online Reprting System: Cnsultant: A Cnsultant is a user wh is able t view, create, edit r delete an unsubmitted permit renewal applicatin r a self-mnitring reprt. Unless a Cnsultant is granted certifier privileges by a facility, a Cnsultant des nt have the right t certify, sign, r submit any permit renewal applicatin r self-mnitring reprt in the MCES Industrial Online Reprting System. Respnsible Official (RO): An RO is a user wh is able t view, create, edit, delete and submit an unsubmitted permit renewal applicatin r a self-mnitring reprt. An RO has the right t certify, sign, and submit a permit renewal applicatin r self-mnitring reprt in the MCES Industrial Online Reprting System. The User Accunt Establishment Prcess is different fr the Respnsible Official (RO) and the Cnsultant accunt types. Please nte that when unsubmitted permit renewal applicatins and selfmnitring reprts are deleted, it nly deletes the cpy that was started. The facility is still required t submit the required submittal by the due date Respnsible Official (RO) Accunt Establishment Prcess The accunt registratin prcess fr an RO is depicted belw. RO Creates Accunt in MCES Industrial Online Reprting System MCES Industrial Online Reprting System Prgram MCES Industrial Online Reprting System Public Prtal MCES Staff 3 Review Registratin & ESA Facility Respnsible Official 4 1 Update Temprary Passwrd t Permanent Passwrd 2 Facility RO fills ut the selfregistratin frm nline: User Inf Facilities Inf Specify User ID (system verifies uniqueness) 5 Security Questins with Answers (frm 20- questin library) Print & Sign ESA and mail it t MCES fr Apprval Mails in MCES Industrial Online Reprting System Agency Prtal 3B ntificatin n signing privilege apprval is sent t the RO s registered address. System issues a Temprary Passwrd t the RO s 3A Ntificatin is sent t RO s registered r mailing address with rejectin reasn Page - 3 MCES Industrial Online Reprt System Dcumentatin Guide

7 The RO s registratin prcess includes the fllwing steps: Step 1: RO Cmpletes the Online Accunt Self- Registratin Frm The RO at the facility visits the MCES Industrial Online Reprt System website and clicks n the Create a new accunt link t cmplete an nline Accunt Self-Registratin Frm, which requires the RO t prvide the fllwing inf: User Infrmatin (first and name, title, address, phne number, user name, etc.) Facility Infrmatin (Business name) Select Accunt Type (Respnsible Official r Cnsultant) Assciate a Facility(ies) and Submittal Types t their Accunt Select and answer five (5) security questins ut f a library f 20 questins When the RO finishes the Online Registratin Frm, the system will send an Accunt Created Acknwledgement t RO s accunt with a temprary passwrd. The RO is required t change the temprary passwrd t a permanent passwrd during the initial lgin t the MCES Industrial Online Reprting System. All passwrds are stred encrypted in the database. Please nte that the registered RO cannt submit any self-mnitring reprts r permit renewal applicatins fr any facility until the RO s Certify & Submit privileges have been apprved and activated by MCES. Step 2: RO Prints, Signs and Submits the MCES Electrnic Signature Agreement (ESA) Each persn wh requests t be an RO must fill ut the MCES Electrnic Signature Agreement (ESA). MCES has the ptin t require that the ESA be signed in the presence f a ntary during accunt establishment. Steps 3A and 3B: MCES Apprves r Denies the Accunt Registratin 1. The RO mails r hand-delivers the cmpleted ESA t MCES. MCES then reviews the accunt infrmatin and the ESA t cnfirm the RO s identity and t verify that they meet EPA s definitin f a signatry authrity. Detailed prcesses include: 2. Verify data using MCES Data Management System: MCES verifies the RO s name, mailing address, address, and ther relevant infrmatin by cmparing the ESA with the infrmatin stred in MCES ipacs (Internet-Based POTW Administratin & Cmpliance System) database. The ipacs database cntains the name, address, and f each facility s signatry authrity, as well as a cpy f the issued permit dcument. 3. Verify signature using past paper submissins: Signature cmparisns are perfrmed by cmparing the ESA with previusly submitted dcuments (fr example, wet-ink, signed self-mnitring reprts r permit renewal applicatins). 4. Verify data during inspectins r site visits: Inspectins and/r site visits by MCES staff may be used t help verify the ESA s authenticity. Verificatin can be supplemented using phne calls if authenticity questins arise. If the RO s accunt registratin applicatin is rejected, the RO will be ntified via r US Mail. Step 4: RO Established Permanent Passwrd and PIN If the RO s accunt registratin applicatin is accepted, the RO s accunt will be activated in the MCES Industrial Online Reprting System. The system then s a temprary passwrd t the RO s address. The RO is required t change their temprary passwrd t a Page - 4 MCES Industrial Online Reprt System Dcumentatin Guide

8 permanent passwrd during the first lg in t the system after accunt activatin by MCES. During this initial lgin, the RO must als establish a signing PIN. The PIN serves as the electrnic signature and is used t bind an electrnic data submissin t a certifier (RO). The PIN is stred encrypted in the database. The PIN is nt visible t MCES staff and cannt be directly changed by facility users r agency staff. If a user lses their PIN, they must send a request fr a new PIN t MCES staff, and a new PIN will be autmatically generated and ed t the RO s address by the MCES Industrial Online Reprting System. An RO is required t submit the fllwing tw (2) frms when enrlling t use the MCES Industrial Online Reprting System: MCES Industrial Online Reprting System Accunt Registratin Frm: This frm lists all facility representatives that are applying fr a user accunt in the MCES Industrial Online Reprting System, and specifies their requested accunt type. Available accunt types are listed as fllws: Respnsible Official (RO): A user with this accunt type can view, prepare, certify, sign and submit self-mnitring reprts and/r permit renewal applicatins. Cnsultant: A user with this accunt type can view and prepare self-mnitring reprts and/r permit renewal applicatins, but cannt certify, sign r submit any electrnic submissins. MCES Electrnic Signature Agreement (ESA): This dcument identifies the Terms and Cnditins f submitting data electrnically fr PIN hlders. The ESA must be cmpleted and signed by each prspective RO. By signing the ESA, the RO acknwledges understanding the fllwing items utlined in the Enrllment Guide: Requirements, terms and cnditins f using the MCES Industrial Online Reprting System; The respnsibilities f MCES and participating facilities during the accunt registratin and data submissin prcesses; The defined grunds fr accunt suspensin and terminatin; The identificatin f prtcl fr changes in accunt type; and The prcedures fr dispute reslutin. MCES has the ptin t require that ESAs be signed in the presence f a ntary during the accunt registratin prcess. While MCES des nt require a ntarized signature at this time, the signed ESA submitted t MCES must be the riginal wet-ink signature versin t be submitted in persn r by US Mail. Therefre, the ESA cannt be ed r faxed RO s First Time Lgging int the MCES Industrial Online Reprting System Establish a Permanent Passwrd: The first time an RO lgs int the MCES Industrial Online Reprting System, the system will frce the user t change their temprary passwrd t a permanent passwrd. This prvides added security benefits by ensuring that: 1. The RO prvided a valid address fr future ntificatins relating t electrnic reprting requirements and submissins. 2. The RO received the temprary passwrd at the address prvided n the ESA. 3. The RO changes the temprary passwrd t a permanent passwrd, thus agreeing t the Terms and Cnditins f the use f the passwrd and PIN. Page - 5 MCES Industrial Online Reprt System Dcumentatin Guide

9 4. The permanent passwrd is nly knwn t the RO. Establish a PIN: Similarly, when the RO is establishing a permanent passwrd, he r she must als establish a signing PIN. The PIN is als saved in the system using encryptin technlgy. This prvides the same added security benefits as indicated abve. Please refer t Appendix A t see a screensht f hw t establish a permanent passwrd and PIN. Answer Five (5) Security Questins: During the accunt registratin prcess, the RO is required t select and answer five (5) ut f 20 security questins. The 20 security questins are listed in Attachment 11 t MCES CROMERR applicatin. The answers t each f the questins shuld be unique and will be stred in the system using encryptin technlgy. Please refer t Appendix B fr the screensht f hw t chse and answer the security questins Cnsultant Accunt Establishment Prcess The accunt registratin prcess fr a Cnsultant is depicted belw. Cnsultant Creates Accunt in MCES Industrial Online Reprting System MCES Industrial Online Reprting System Public Prtal Facility Certifier Facility Nn- Certifier Users Cnsultant 1 Facility Nn-Certifier fills ut the nline self-registratin frm: User Inf: First Name, Last Name, Title, , etc. 2 Facility RO Add nn-certifier user (via address) & assign rle: Preparer Rle t the facility that Certifier has the certificatin authrity 3 A Ntificatin is sent t the nn-certifier nce the assciatin is successfully made Page - 6 MCES Industrial Online Reprt System Dcumentatin Guide

10 Step 1: Cnsultant Cmpletes the Online Accunt Self- Registratin Frm A nn-certifier (Cnsultant) registers fr an Online Accunt Registratin Frm in the MCES Industrial Online Reprting System website by filling ut an nline registratin frm: User Infrmatin (first and name, title, address, phne number, user name, etc.) Facility Infrmatin (Business name) Select Accunt Type (Respnsible Official r Cnsultant) Select and answer five (5) security questins ut f a library f 20 questins When the applicant finishes the Online Accunt Registratin Frm, the MCES Industrial Online Reprting System will send an Accunt Created Acknwledgement t Cnsultant s accunt with a temprary passwrd. The applicant is required t change the temprary passwrd t a permanent ne during the initial lgin t the MCES Industrial Online Reprting System. All passwrds are stred in the system using encryptin technlgy. Step 2: RO Assciates Facilities and Permissins t Cnsultant In rder fr the Cnsultant t view and prepare self-mnitring reprts and/r permit renewal applicatins fr a desired facility, the registered RO f that facility must assciate the Cnsultant s accunt t that facility. The prcedures t assciate a Cnsultant are as fllws: 1. Enter the Manage Cnsultants and Preparers management screen. 2. Enter the address f the Cnsultant. 3. Designate the effective and expiratin dates f the Cnsultant s viewing and preparing permissins. 4. Use the Add Authrizatins buttn t indicate the submittal types and facilities that the Cnsultant shuld be granted Viewer and/r Preparer permissins. Step 3: Cnsultant Is Ntified f Permissins Once cmpleted, the RO can press the Ntify buttn and the MCES Industrial Online Reprting System will send an t the Cnsultant s address ntifying them that their accunt has been activated and that they have been granted viewer and/r preparer privileges t access the facility s submissin requirements. Page - 7 MCES Industrial Online Reprt System Dcumentatin Guide

11 2.2 Electrnic Submissin and Revisin Prcesses The electrnic submissin prcess in the MCES Industrial Online Reprting System is depicted in the flwchart belw: Electrnic Submissin Prcess in MCES Industrial Online Reprting System 1 Lgin MCES Industrial Online Reprting System fr Reprt/ Applicatin Data Entry Facility Users RO: can prepare and submit Cnsultant: prepare nly 4 View past submissins 3 2 MCES Industrial Online Reprting System Public Prtal Fr RO, during the Submissin Step, GvOnline will: Shw a human readable versin f reprt / applicatin Ask RO t check the certificatin statement Ask RO t enter PIN Ask RO t answer ne security questin (randmly selected by the System) MCES Industrial Online Reprting System Prgram Staff MCES Staff Upn successful submissin in MCES Industrial Online Reprting System : Generate a unique Submissin ID fr each submissin Generate a Submissin Receipt A ntificatin is sent t RO s accunt and t MCES Staff s accunt Electrnic Submissins Prcess The electrnic submissin prcess includes the fllwing steps: Step 1: RO Lgs In and Enters Data fr an Electrnic Submissin The Cnsultant r RO prepares the electrnic submissin using nline data entry frms in the MCES Industrial Online Reprting System. A server certificate is lcated n the MCES Industrial Online Reprting System server, which prvides a Secured Scket Layer (SSL) channel f cmmunicatin ver prt 443 t ensure that the data transmissin prcess is secure and cmplete. This helps t ensure that Internet cmmunicatins cannt be viewed by a third party. Please refer t Appendix C fr a screensht f an example f an nline data entry frm in the MCES Industrial Online Reprting System. When the Cnsultant r RO is entering data int an nline frm, the system cnducts validatin checks. If the value entered by the user fails the assciated validatin criteria r if data in a required field is missing, the system will display an errr message n the nline frm. Please see Appendix D fr a screensht f data validatin warnings. Page - 8 MCES Industrial Online Reprt System Dcumentatin Guide

12 After the data entry is cmplete, bth the Cnsultant and RO can review it in a human readable frmat prir t the certificatin and submissin prcess. Please see Appendix E fr a screensht f the data review prcess prir t submissin. Step 2: RO Cmpletes Certificatin and Submissin Prcesses During the certificatin and submissin prcess, the MCES Industrial Online Reprting System displays a certificatin statement that the RO must read. The RO certifies that they have read the statement by clicking a checkbx next t the certificatin statement. Please see Appendix F fr a screensht f the certificatin and submissin prcess. Next, the RO cmpletes the fllwing actins: The RO enters their signing PIN. The MCES Industrial Online Reprting System validates the PIN by cmparing the user-entered PIN with the encrypted PIN stred in the system. The RO answers a randmly selected security questin frm the five- (5) questins that the RO prvided answers fr during the nline accunt registratin prcess. The MCES Industrial Online Reprting System cnfirms the answer by cmparing the user-entered answer with the encrypted answer stred in the system. If after three failed attempts the RO is unable t prvide a valid PIN r answer the security questins crrectly, the system will suspend the RO s certificatin and submissin permissins. In additin, the system will send an Accunt Suspensin t RO s address, as well as the MCES Industrial Online Reprting System Crdinatr s address. After the PIN and answer t security questin pass the system validatin checks, the RO is able t cmplete the electrnic submissin. Step 3: System Sends RO a Submissin Receipt The MCES Industrial Online Reprting System generates a unique Submittal ID fr each submissin that is made using the system. An is sent t the RO ntifying them that the submissin has been successfully received by the MCES Industrial Online Reprting System. Appendix G shws an example ntificatin f successful submissin receipt. Fr each submissin, a receipt is als generated. This receipt is displayed t the user immediately fllwing submissin f the reprt. Appendix H shws an example Submissin Receipt within the MCES Industrial Online Reprting System after a successful submissin. The receipt can then be printed by the RO. The receipt cntains the fllwing infrmatin: Unique Submittal ID Name, address, and cntact infrmatin f submitter (RO) Owner Infrmatin (Facility name and address) Date and time f the submissin The type f frm that was submitted List f all attachments prvided alng with the submissin The certificatin receipt, include a cpy f the certificatin statement, the security questin that was answered and the name f the RO Sender IP address frm which submissin was made In additin t the list abve, the fllwing additinal items are stred tgether with the submissin data in the database: Page - 9 MCES Industrial Online Reprt System Dcumentatin Guide

13 Date and time the PIN was captured Date and time the PIN was verified/apprved A cpy f certificatin statement language Indicatin that the RO agreed t the certificatin statement The submissin receipt, in cnjunctin with the submissin data, serves as the Cpy f Recrd (COR) fr the submissin. After the submissin is validated, it is stred in the MCES Industrial Online Reprting System. When the submissin is stred, a Cyclical Redundancy Checksum (CRC) calculatin is cnducted n the submissin, and the CRC value is stred in the database alng with the submissin. This CRC value represents a binary snapsht f the submissin that is received by MCES, which can be used t detect if the riginal submissin has ever been altered by the system r any ther means. Nte Regarding the Atmic Clck Time: The MCES Industrial Online Reprting System uses atmic clck time servers t establish the critical dates and times related t electrnic submissin and prcessing. This prvides additinal assurance f accurate submittal times independent f ptentially variant server clcks. This feature is imprtant when using submissin date/time as a basis fr cmpliance determinatin f late submittals. Step 4: User Views Past Submissins MCES Industrial Online Reprting System users can review all past submissins made using the system. Please refer t Appendix I and Appendix J fr screenshts f an example list f past submissins and f the past submissin search functinality, respectively. Users can access the COR fr all past submissins, including a cpy f the submissin itself and the related submissin receipt. Each time the submissin file is pened in the MCES Industrial Online Reprting System, the system perfrms the CRC check autmatically t ensure the integrity f the submissin data is being upheld. CRC Check: The user can perfrm a CRC check n the submissin that is currently stred in the MCES Industrial Online Reprting System. This CRC value is cmpared t the CRC value that was determined upn submissin. If the numbers are different, this indicates that the file has been mdified since it was riginally submitted t MCES. This check prvides additinal assurance f file integrity f the submissin. Each time the submissin file is pened in the MCES Industrial Online Reprting System, the system perfrms the CRC check autmatically Electrnic Submissin Revisin Prcess The MCES Industrial Online Reprting System allws users t submit crrectins t previus data submissins by creating a new revisin recrd. T submit a crrectin, the RO needs t submit a revisin reprt, which will be treated as a new COR when cmpleted. In this scenari, the entire histry f the reprt, including the riginal COR and new CORs fr all crrectins are maintained in the database and are retrievable. Please refer t Appendix K and Appendix L fr screenshts f requests t revise a submissin and an example f revisin tracking, respectively. 2.3 User Accunt Management Prcesses Limit n Failed Lgin Attempts The MCES Industrial Online Reprting System limits the failed lgin attempts t ensure user credentials are nt cmprmised. Page - 10 MCES Industrial Online Reprt System Dcumentatin Guide

14 1 The user is prmpted t enter their user name and passwrd when lgging int the MCES Industrial Online Reprting System. 2 If the user name and passwrd entered d nt match with the infrmatin stred in the MCES Industrial Online Reprting System, the system will display a warning message regarding the errr and ptential suspensin after three cnsecutive failed attempts. 3 After three failed attempts, a message appears advising the user that their accunt has been suspended User Frgets User Name and/r Passwrd The MCES Industrial Online Reprting System allws a user t request t retrieve their user name r request a new passwrd if they have frgtten either credential using the fllwing prcess: 1 On the Hmepage, the user clicks n the Frgt yur lgin user name r passwrd? link. 2 On the Frgt Yur Passwrd? screen, the user enters their address. 3 If the prvided address is fund, the system asks the user t answer ne (1) f the five (5) security questins they answered during nline accunt self-registratin. 4 If the security questin is answered crrectly, the system issues a new system-generated temprary passwrd and sends an t the user s address with their user name and temprary passwrd. 5 The user uses their user name and temprary passwrd t lg int the MCES Industrial Online Reprting System. 6 Upn a successful lgin, the user must change the temprary passwrd t a permanent passwrd. 7 The system stres the permanent passwrd using encryptin technlgy. 8 The system saves a lg f all passwrd changes in the database User Requests a New PIN The MCES Industrial Online Reprting System allws an RO t request a new signing PIN based n the fllwing prcess: 1 The RO lgs int the MCES Industrial Online Reprting System using their valid user name and passwrd. 2 In the Passwrd Management screen n the My Accunt tab, the user clicks n the My PIN Infrmatin tab. 3 In the My PIN Infrmatin screen, the user clicks n the Request new PIN buttn t send a request t reset their PIN. 4 Once the PIN is reset, the MCES Industrial Online Reprting System sends an Issue PIN Ntificatin t the RO s address with the new PIN. 5 The RO then shuld update the system-generated PIN t a permanent PIN. 6 The system stres the permanent PIN using encryptin technlgy. 7 The system saves a lg f all PIN changes in the database User Resets Security Questins The MCES Industrial Online Reprting System allws the user t reset their security questins. The prcess is as fllws: Page - 11 MCES Industrial Online Reprt System Dcumentatin Guide

15 1 The RO lgs int the MCES Industrial Online Reprting System using a valid user name and passwrd. 2 On the Security Questins management screen in the My Accunt tab, the user selects five (5) security questins (frm a library f 20) and prvides answers t each f them. 3 The user prvides a reasn fr resetting their security questins. 4 The user clicks the Save buttn t reset the security questins. 5 Once the security questins are reset, the system will stre the answers t the security questins using encryptin technlgy. 6 The system saves a lg f all security questin changes in the database RO Accunt Reactivatin Prcess If the RO s accunt permissins are suspended fr any reasn, the RO must fllw the prcess belw t have their accunt reactivated: 1 The RO requests that their certificatin permissins fr a facility be restred t the MCES Industrial Reprting System by resubmitting the MCES Electrnic Signature Agreement (ESA). 2 Once the ESA is received, MCES reviews the request and cnfirms the signatry authrity f the RO. 3 If MCES apprves the RO s request, MCES will re-activate the RO s certificatin permissins fr the facility. This is cmpleted by changing the signing status f the RO fr the facility frm Pending r Inactive t Active. In additin, the re-submitted ESA will be stred in the MCES Industrial Online Reprting System. Please see Appendix M fr a screensht n hw t cmplete this prcess. 4 The RO lgs int the MCES Industrial Online Reprting System using a valid user name and passwrd. The RO is then able t prepare, certify, sign and submit data electrnically fr the facility. 2.4 Accunt Administratin Prcesses The MCES Industrial Online Reprting System Crdinatr is able t perfrm the fllwing functins t manage user accunts Resetting a User s Passwrd 1 The Crdinatr searches fr the user s accunt in the Agency Prtal f the MCES Industrial Online Reprting System. 2 The Crdinatr clicks n the Reset Passwrd buttn. 3 The MCES Industrial Online Reprting System sends an ntificatin t the user with the new system-generated temprary passwrd. 4 The system lgs each time the Crdinatr resets a user s passwrd in the system. 5 Upn first lgin, the user must change the temprary passwrd t a permanent passwrd. 6 The system saves the permanent passwrd in the system using encryptin technlgy Issue/re-issue PIN t RO 1 The Crdinatr searches fr the RO s accunt in the Agency Prtal f the MCES Industrial Online Reprting System. 2 The Crdinatr clicks n the Issue/Reset PIN buttn. Page - 12 MCES Industrial Online Reprt System Dcumentatin Guide

16 3 The MCES Industrial Online Reprting System sends an ntificatin t the RO with the new system-generated temprary PIN. 4 The system lgs each time the Crdinatr reset an RO s PIN in the system. 5 Upn first lg in, the RO must change the temprary PIN t a permanent PIN. 6 The system saves the permanent PIN in system using encryptin technlgy Inactivate a User Accunt 1 The Crdinatr searches fr the user s accunt in the Agency Prtal f the MCES Industrial Online Reprting System. 2 The Crdinatr clicks n the Accunt Status buttn t change the status frm Active t Inactive. 3 The system lgs each time the Crdinatr changes a user s accunt status in the system. 4 The system sends an t the user t ntify them that their accunt has been inactivated. 5 At the next attempted lg in, the user will nt be able lg int the system Activate a User Accunt 1 The Crdinatr searches fr the user s accunt in the Agency Prtal f the MCES Industrial Online Reprting System. 2 The Crdinatr clicks n the Accunt Status buttn t change the status frm Inactive t Active. 3 The system lgs each time the Crdinatr changes a user s accunt status in the system. 4 The system sends an t the user t ntify them that their accunt has been inactivated. 5 At the next attempted lg in, the user will be able t lg int the system using a valid user name and passwrd Change a User s Accunt Permissins 1 The Crdinatr searches fr the user s accunt in the Agency Prtal f the MCES Industrial Online Reprting System. 2 In the Manage Accunt Type tab, the Crdinatr changes the user s rle accrdingly t ne f the fllwing: a. Cnsultant b. Respnsible Official 3 The system sends an t the user t ntify them that their accunt permissins have been changed. 4 The system lgs each time the Crdinatr changes a user s accunt permissins in the system. 2.5 Data Backup, Disaster Recvery & Security Prtectin Data Backup MCES has tw (2) ways f retaining cpies f electrnic submissins. The first way is at the database level and the secnd way is at the Clud Hsting level by using the envirnment backup prcess. Database Level: Page - 13 MCES Industrial Online Reprt System Dcumentatin Guide

17 Fr each electrnic submissin by a facility, the XML instance files (identified as the Cpy f Recrd) are maintained in the MCES Industrial Online Reprting System database. These files are never deleted frm the system. Per rganizatinal plicy, the MCES Industrial Online Reprting System will stre a minimum f five (5) years f electrnic submissins befre archiving the data. Clud Hsting Level: The system will maintain the COR in the database. This database system is an SQL prductin database envirnment, which is highly redundant. The data is backed up using tw- (2) different backup methds: The first methd is a full database backup which is cmpleted weekly with an incremental backup dne daily. The secnd methd is a full database backup which is archived t a tape backup. These backup tapes are created weekly and are stred ffsite in a secure facility. Data strage is prvided as a directly attached strage array (Hst Bus Adapter HBA, cnnected Data Vault), which is part f the verall database cluster. The database server backup is cnfigured t take frequent prductin SQL Server backups f database server image (frm Active Database Server) with a cmplete database backup frm the Data Vault (Weekly Full and Daily Incremental ), plus a near real-time transactin lg (~5-15 minutes interval) fr the purpse f quickly recvering the faulted database t prevent r minimize any ptential data lss. The primary hsting site is at the enftech Data Center ( There is a minute-by-minute backup service f the systems and databases frm the primary hsting site t the secndary hsting site. If the primary hsting site is nt functinal, the secndary hsting site will autmatically be brught int service within hurs. The tertiary hsting site is lcated several miles away frm the primary and secndary hsting sites. There is a minute-by-minute backup service f the systems and databases frm the enftech headquarters server farm t the tertiary hsting site t guarantee 100% n-lss discvery recvery. The server team maintains a mirrr cpy f current prductin system envirnment n the secndary hsting site in a remte lcatin Disaster Recvery A disaster recvery plan is in place fr the MCES Industrial Online Reprting System: A full database backup is cmpleted weekly. An incremental backup is cmpleted daily. A mirrr cpy f the current prductin system envirnment is kept n the secndary hsting site in a remte lcatin. The applicatins and database servers are failed ver frm the primary hsting site t the secndary hsting site autmatically by pre-cnfiguratin, but it requires hsting center staff t manually cmplete the entire prcess f disaster recvery. Once the actin f failver succeeds, the secndary hsting site will serve as the main hsting site s users can cntinue t use the MCES Industrial Online Reprting System. As sn as the primary hsting site is back up, the reverse replicatin actins will be scheduled and cmpleted. The primary hsting site will be failed ver frm the secndary hsting site. The primary hsting site will then resume peratins as the main hsting site. Page - 14 MCES Industrial Online Reprt System Dcumentatin Guide

18 In the case f catastrphic failures, such as server crashes, fire, etc., the latest tape backup fr the MCES Industrial Online Reprting System can be quickly recvered t resume services within hurs Security Prtectin Hsting services frm enftech prvide strng security prtectin using the fllwing prcesses: 1. Next-Gen Netwrk Firewall Prtectin with Unified Threat Management. Built n the tp-ranking Unified Threat Management platfrm (FrtiNET). Prvides Gateway Anti-Virus, Anti-Spyware, Intrusin Preventin, and Applicatin Intelligence and Cntrl fr intelligent, real-time netwrk security prtectin against the latest blended threats. Mnitrs fr anmalus data, generating alerts if unauthrized data packets are fund. 2. Secure Remte Access Access is limited t nly authrized IT staff using their user name and passwrd. Prvides netwrk authenticatin, grants access and maintains security privileges fr remte cnnectins. 3. Penetratin Testing results and mitigatin Uses third-party penetratin testing services frm Trustwave ( Prvides a scanning reprt mnthly r n demand by Trustwave. 4. Server Security Prtectins: Requires keypad and assigned access cdes t access the server rms. Access t individual databases n thse servers is limited t nly authrized IT staff using their user name and passwrds. Access t the applicatin with SSL (RSA 2048 bit encryptin) security prtectin. Balance traffic lad with Netwrk Lad Balancer (f5) cnnecting Web servers (extendable up-t 32 Web servers), which receives requests frm the external Clients thrugh SSL (RSA 2048 bit encryptin) prtected cmmunicatin channel. Access t hsting servers is allwed t nly a few administratrs r managers including the infrastructure manager, maintenance manager, release manager, and the database administratr. 5. Managed Anti-virus: Uses Firewall native anti-virus prtectin as hardware prtectin mechanism. Uses AVG as sftware anti-virus prtectin mechanisms. Page - 15 MCES Industrial Online Reprt System Dcumentatin Guide

19 Appendix A. Establish a Permanent Passwrd and PIN Appendix B. Example Challenge Questins and Reset Challenge Questins Nte: The abve security questins will be used in the MCES Industrial Online Reprting System. Page - 16 MCES Industrial Online Reprt System Dcumentatin Guide

20 Appendix C. Example f an Online Data Entry Frm Appendix D. Example f Data Validatin Warnings within an Online Data Entry Frm Page - 17 MCES Industrial Online Reprt System Dcumentatin Guide

21 Appendix E. Example f Data Review f the Frm befre Submissin Appendix F. Example Certificatin Statement, PIN and Challenge Questin Page - 18 MCES Industrial Online Reprt System Dcumentatin Guide

22 Appendix G. Example f Submissin Cnfirmatin Receipt Appendix H. Example f Submissin Receipt in the MCES Industrial Online Reprting System Page - 19 MCES Industrial Online Reprt System Dcumentatin Guide

23 Appendix I. Example f List f Past Submissins Appendix J. Example f Past Submissins Search Functinality Page - 20 MCES Industrial Online Reprt System Dcumentatin Guide

24 Appendix K. Example f Request t Revise a Submissin Users may request t revise a submissin made using the MCES Industrial Online Reprting System. The request is sent t their MCES Permit Engineer. The MCES Permit Engineer reviews and decides t apprve r deny the revisin request n the Agency Prtal f the MCES Industrial Online Reprting System. Appendix L. Example f Revisin Tracking Page - 21 MCES Industrial Online Reprt System Dcumentatin Guide

25 Appendix M. Changing an RO s Certify & Sign Permissins Page - 22 MCES Industrial Online Reprt System Dcumentatin Guide

26 390 Rbert Street Nrth Saint Paul, MN TTY metrcuncil.rg Fllw us n: twitter.cm/metcuncilnews facebk.cm/metrplitancuncil yutube.cm/metrplitancuncil