How to Complete a MARMS Assessment. User s Guide v.0.1, 2018

Transcription

1 How to Complete a MARMS Assessment User s Guide v.0.1,

2 Introduction This User s Guide is intended to provide users with a step by step tutorial on recording an assessment using the MARMS tool Other functionality of the tool is provided in other User s Guides, found in the references and materials section of the tool as well as at the website listed at the end of this lesson 2

3 Learning Objectives Terminal Learning Objective After completing this lesson, the student will be able to describe how to operate the MARMS tool IOT complete an assessment. Enabling Learning Objectives 1. Open the MARMS Tool 2. Find selected references 3. Identify the action buttons and functions within the tool 4. Describe how to create an assessment 5. Identify the process steps 6. Describe how to conduct an assessment 7. Describe the administrative tools for assessment management 3

4 Getting Started 1. Navigate via SIPRNET to: The screen at right will appear. 2. Enter your SIPRNET address in the first box in the Login window. 3. Enter password. [New users receive a temporary password via , enter that password, or, the password you selected during initial login] 4. Check the box acknowledging the Terms of Use. 5. Click Login. Note: failure to check this box will cause all fields to clear and you will have to re-type both address and password 4

5 Navigating the Home Page The home page includes a set of activity buttons and a grid below the buttons. The grid displays Assessments in the upper portion, and Open Actions in the lower portion, which automatically populate as assessments are created and saved. Activity Buttons; the number will vary based on the user s role(s). Display of started/completed assessments here; will populate as new assessments are generated. Action pull down menu; change password and log out here. Note: for Assessment Managers, a third, middle section is viewable that displays projected assessments for up to 12 months. Open Actions to be completed here. 5

6 Creating a New Assessment To create a new assessment, click on the green start button. A new page will open that allows the user to name the assessment and identify the unit node. Click here. Select the assessment objective Mission Assurance. Click continue to move to the next step. Name the assessment here; it is recommended that the name include a date for tracking purposes. Highlight unit hierarchy location here. 6

7 Creating a New Assessment (cont d) After clicking continue, the next screen to appear is dependent on previous MARMS experience/contact. A first time user, with no connection to previously created assessments, will be taken directly to the Describe the organization page (see page 9). Other users will see one of the option pages shown below. Copying or inheriting reduces the amount of data entry required for recurring assessments and will be available to any user after the first assessment or template has been built. This page will display if a template has been created for them. This page will display if users have created at least one previous assessment; if they had an assessment shared with them, or, ownership of an assessment transferred to them. NOTE: Copying or inheriting is the recommended method once an assessment or template has been completed, IOT reduce repetitive data input. 7

8 Creating a New Assessment (cont d) 3. For a return user, options include starting a new assessment from scratch, copying an existing assessment, or inheriting a template. The second and third options reduce data entry requirements because data is prepopulated from the existing assessment or template. If Copy from an existing assessment is selected, all available assessments will appear. If Start an assessment from scratch is selected, a clean slate will open on the Describe the organization page. Note: Until Templates have been created, you will not be presented with the option to use one. Highlight the assessment to be copied and double click. 8

9 Creating a New Assessment (cont d) 4. For a first time assessment, this page will automatically appear. For all other users, it will appear after the Copy/Inherit Options discussed above. The assessment has been created, when this page appears. This is also the first step in conducting the assessment; the following page illustrates the full process. A Banner announces that the assessment has been created. 9

10 The Assessment Process: IAW DoDD * the method for conducting an assessment is illustrated in the process model shown below. Profile Organization Scope Assessment Identify Assets Characterize Threats Conduct Assessment Complete Assessment The first five steps present question sets to be answered with regard to the unit/organization to be assessed. The final step locks the assessment. This view shows a disk at the lower right of each phase, indicating status of that step each subsequent step is locked until the previous step is completed. A completed step will be indicated by a check mark (this can be seen on page 26). *risk assessment. A systematic examination of risk using disciplined processes, methods, and tools. A risk assessment provides an environment for decision makers to evaluate and prioritize risks continuously and to recommend strategies to remediate or mitigate those risks. (DoDD Mission Assurance, November 29, 2016) 10

11 Conducting an Assessment 1. The description of the organization is the first step in conducting the assessment. It characterizes certain aspects of the unit that will scope the assessment. Questions with an asterisk (*) require an answer to continue. Questions will consider mission, location, and other data that will shape the benchmark data later in the assessment; will include pulldown choices or fill in the blank as required. Location type indicates whether the asset is fixed, moveable, or mobile. Each item has an information bubble. Mouse over the bubble to open a text box description to assist the user. 11

12 Conducting an Assessment (cont d) 2. The description of the operating environment is the second step in conducting the assessment. Questions use a pulldown yes/no selection. Beginning with this step, all highlighted questions must be answered. Click continued when all required questions are answered. --Select-- --Select-- Select each highlighted question pulldown and click yes or no. Some items are grayed out and will only be highlighted when a preceding question is answered yes. 12

13 Conducting an Assessment (cont d) 3a. The next step is to characterize critical assets. The page format changes from pulldown answers to yes/no button answers within a grid framework. Before going to the questions, it will be useful to look at some features of the grid framework. Below are the sorting, tracking, and filtering tools. Double click column headers to display an up and down arrow. Use this to sort according to the convention for the selected column, e.g., all Yes on top. Keeps track of progress here. Can filter by groups to differentiate distinct asset categories. Filter boxes; type in a term to filter by the selected column. 13

14 Conducting an Assessment (cont d) 3b. Shown here are more functions, including an information panel on each asset row that provides Q&A to help determine if an asset should be selected. Also shown are tool icons found at the bottom of the page. Double clicking anywhere in a row will open an info panel with details of what it is, exploitability, & specific critical info to help determine applicability. Reload Grid Data Open (same as double clicking on selected row) Export to Excel 14

15 Conducting an Assessment (cont d) 3c. Returning from functional features to the questions, this step contains a series of questions on the characterization of critical assets. Click Yes, or, No for each asset listed. Yes/no buttons for each asset. Selecting Yes opens a set of questions with pulldown menu answers Choose an answer from the pulldown menu. Answer all questions and click Submit. 15

16 Conducting an Assessment (cont d) 3d. Each affirmative response, and associated pull down answers, will cause the calculation of a criticality value for that asset. When all questions have been answered, this section is complete. Click continue to move to the next step of the process. If an asset determination requires explanation, add a comment using the Add/View Comment button. 18 of 18 complete; click continue. Criticality rating; will apply to future risk calculations within the program. 16

17 Conducting an Assessment (cont d) 4. The next step is to characterize threats. This page follows the same grid format as the previous, Assets, page. It will follow the same process, however, the question set for Yes answers is different as shown below. If the user only has a few threats, answer those Yes and then use the Answer No to All Unanswered button to answer all remaining questions. Status tracker; when all complete; click continue. Threat rating; will apply to future risk calculations within the program. Pulldown answers, as before; submit when complete. 17

18 Conducting an Assessment (cont d) 5a. The next step is to conduct the assessment. To begin, if the benchmark list is greater than 50, go to the bottom of the grid and expand it to allow all questions to be viewed on one page. This allows faster progression through the list without page advancing; will ease keeping track of progress. --Select-- --Select-- Select a number higher that the question total shown. 18

19 Conducting an Assessment (cont d) 5b. Once again, functionally, this page follows the same grid format as the previous pages. However, there are several key differences. The list of available benchmarks is based on how the previous sections have been answered. It will follow the same process, but, the answer options are different and the number of questions to answer is dependent on how selected questions are answered. Shown here, are parent-child questions, i.e., if a certain question (parent) is answered Yes a number of subordinate (child) questions become available. Parent Children A Yes answer will make the three succeeding questions required. 19

20 Conducting an Assessment (cont d) 5c. The introduction of children questions also changes the tracking feature. There are two different numbers indicated, required and total. The former indicates questions that must be answered and the latter is the total possible. As parent questions are answered yes, the required number will increase by the number of additional child questions now added to the required list. Must answer. Total, including all children questions. 20

21 Conducting an Assessment (cont d) 5d. Another difference is there are now three response options: 1. Yes, 2. No, 3. N/A. Clicking N/A automatically opens a dialog box for an explanation. Description of why benchmark does not apply. 21

22 Conducting an Assessment (cont d) 5e. When answering Yes, or, NO, no dialog box appears, but, a comment/ finding/observation may be appropriate, particularly for a NO response. In these cases, click the Add/View Comment button to open a new dialog box. Add appropriate comments, and click Save to close the dialog box and return to the question grid. Select Add/View Comment Detail the reason for assessing a No. Save when complete. An icon will appear in the comment column when the comment has been saved. 22

23 Conducting an Assessment (cont d) 5f. While completing this portion of the assessment it is also useful to recall the assisting tools that were mentioned previously, particularly the countermeasure details dialog box. For any question requiring clarification, double click to open an explanation of the question. Why is this important? The ATO is responsible for the oversight and implementation of their commander s AT program and for developing and implementing the FPCON measures requirements prescribed in DoDI O How do I check this? Review appointing order. Commanders will designate in writing a commissioned officer, non-commissioned officer, or civilian employee who has completed the appropriate training requirements to serve as the ATO or AT representative. A text box will appear with information on the topic to assist the user in determining applicability. Reference(s): DoDI O , vol 1& 2, DoD ATO Guide Double click anywhere in row. Close when complete. 23

24 Conducting an Assessment (cont d) 5g. When all questions have been answered this portion is complete, and the assessment is ready to be finalized. Click continue to move on to finalize the assessment. 310 of 310 complete; click continue. 24

25 Conducting an Assessment (cont d) 6. The final step in the assessment process is to finish and lock the assessment. Click on the Finish and Lock icon to accomplish this. Click here to complete and lock the assessment. The Assessment is now complete and will appear as Read Only. 25

26 Completed Assessment After clicking Finish and Lock, the screen below will open. The next steps shown continue the Risk Management process. These are described in another User s Guide. Assessment Administration will be discussed in the next few slides. Continuing steps of the Risk Management process. Assessment Administrative Actions 26

27 Administrative Tools The eight tools listed below are not integral to the conduct of an assessment, but are useful for managing administrative aspects of an assessment. The following pages will describe each of them. 27

28 Administrative Tools: Open for Editing This feature allows users to return back to an assessment, which had previously been marked as Read Only. This allows edits to be made to an assessment. Here, view only. Click here, to unlock an assessment. Caution should be used in editing so that accurate assessment data is not lost in the editing process. Here, add/edit. Click here, to enter the assessment to edit reported data. The process is the same for any edits as was true for the original input. Before locking, and when opened for editing, Manage POCs appears. When locked, View POCs appears. POCs can only be added, edited, and deleted when in Manage POCs. 28

29 Administrative Tools: Manage POCs This feature allows users to add points of contact to the assessment file. Initially, only the owner of the assessment can be found in the POC list. However, users may wish to add relevant POC, e.g, fire marshal, unit security manager, et.al. These are filter fields, not data entry boxes. Name of assessor, any added POCs will display here also. Click Add New Entry to enter other POC data for this assessment. To add an individual, required fields are name, phone, and . It is also recommended that the Title/Job Function be included. 29

30 Administrative Tools: Rename The Rename feature allows users to change the name of an assessment. Click Rename, enter the new name in the box provided, then click OK to save the change. Delta Troop 30 May 18 Type the new name in the text box, then click OK. 30

31 Administrative Tools: Share this Assessment Selecting Share This Assessment allows users to give other MARMS users access to an assessment. Allow others to read, edit, and/or conduct analysis depending on the privileges selected. User can designate permission for others to access an assessment. Pulldown menus allow selection of permissions. Read Only privileges allow another user to view the assessment. Read/Write privileges allow another user to view and edit the assessment. 31

32 Administrative Tools: Change Owner The Change Owner feature allows the current owner to transfer ownership of the assessment to any EPRM user in that subscriber account. Once changed, the original owner no longer has any access to the assessment. Once you click the Change button the new owner will be notified by and you will no longer have access to the assessment. Select a new owner for an assessment from a pulldown menu of other users on the subscriber account. 32

33 Administrative Tools: Delete [an Assessment] Selecting the Delete feature allows permanent deletion of an assessment. Once the assessment has been deleted it will not be recoverable. Click Delete. A pop-up box will appear to confirm deletion of the assessment. Click Yes, the assessment will be deleted; you will be returned to the EPRM home page. Click yes to confirm deletion and return to EPRM home page. 33

34 Administrative Tools: File/Image Upload The File/Image Upload feature allows users to attach supporting documents and pictures to an assessment. Click File/Image Upload to open an upload page that allows file upload and attached file management. Manage current attachments here. Note that max file size is 10MB. Browse for desired file. Once selected, click upload to add/attach file. When all files have been added click Back to Assessment. 34

35 Administrative Tools: Reports The Reports feature allows you to generate reports of the assessment information in Excel, Word, or PowerPoint. Click Reports to open a listing of available reports. Available Word, Excel and PowerPoint files. Both Back and Continue will return to the Assessment page. Each hotlink will open the report as described. 35

36 Administrative Tools: View POCs View POCs is similar to the Manage POCs feature discussed above, but here it is Read Only. Selecting View POCs allows users to view the point of contact information associated with an assessment, but no editing or additions can be done. Note this is Read Only. Details for all POCs. 36

37 Conclusion This concludes the User s Guide for conducting an assessment. See the other guides available for further information on other aspects of the MARMS tool. Below is some additional information WRT the program: Accessing the system: (SIPRNET) Help: For assistance and for any questions, please EPRMhelp@alionscience.com or call Eastern time Resources: User guides, videos & other materials are available on the EPRMHelp page: 37