Partner Information Manager Supplier Guide October 2017

Size: px

Start display at page:

Download "Partner Information Manager Supplier Guide October 2017"

Annabel Parks
6 years ago
Views:

2 Contents Exostar s Partner Information Manager (PIM)... 2 Cybersecurity Questionnaire... 2 NIST SP Questionnaire... 2 Conflict Minerals Questionnaire... 2 Exostar s Managed Access Gateway (MAG)... 2 Roles within MAG... 3 PIM Access... 3 PIM Roles... 4 PIM Home Dashboard and Viewing Notifications... 5 Alerts... 6 Forms Requests Widget... 7 Forms Summary Widget... 8 Recent Activities Widget... 9 My Organization Widget... 9 Partner Profile User Management Forms Deny Form Sharing Request Accept Form Sharing Request Opt-Out of Form Sharing Request Completing the Conflict Minerals Questionnaire Determining Who Your Organization is Sharing a Request With Assigning Questionnaire Assign a Questionnaire to a User Completing and Updating a Questionnaire Partners Details View Users Profile View Account Settings Scoring Control Score Assessment Capability Levels Notifications Support Copyright 2017 Exostar, LLC All rights reserved. 1

3 Exostar s Partner Information Manager (PIM) Exostar s Partner Information Manager (PIM) is a risk management tool that leverages information from trusted sources to provide a buying partner with a supplier s current and potential risk and impact. PIM allows suppliers to complete a form requested to them by a buyer, and then continue to share that form and form results with additional buyers as requested. This ask once and share model reduces the burden of completing multiple questionnaires. Additionally, PIM provides prime contractors with a consistent set of minimum cyber security expectations for suppliers. Cybersecurity Questionnaire The Cybersecurity Questionnaire was developed to measure a Supplier s cybersecurity capability. The information a supplier partner provides helps them understand their organization s cybersecurity posture. The questionnaire also helps buying partners manage risks with sharing sensitive information. Please visit the Cybersecurity Questionnaire Support page for additional information. NIST SP Questionnaire The Department of Defense (DoD) now requires all its contractors to protect Covered Defense Information (CDI). The department modified its Defense Federal Acquisition Regulation Supplement (DFARS) to address the safeguarding of CDI. The DFARS clause requires covered companies to use the cyber safeguards described by the National Institute of Standards and Technology (NIST) in Special Publication (SP) , which NIST created specifically for commercial companies who do not operate federal information systems, but who receive or create CDI to perform defense contracts. The information a supplier partner provides in the NIST SP questionnaire is used by buying partners to determine a business s security posture with respect to the required NIST security controls. Please visit the NIST SP Questionnaire Support page for FAQs and additional information. Conflict Minerals Questionnaire As a buyer, you may request suppliers complete the Conflict Minerals Questionnaire. The Conflict Minerals Reporting Template is a free, standardized reporting template developed by the Conflict-Free Sourcing Initiative, which facilitates the transfer of information through the supply chain, regarding mineral country of origin and utilized smelters and refiners. The questionnaire is used to determine if suppliers are using smelters recognized by and meeting the CFSI standards. Exostar s Managed Access Gateway (MAG) Exostar s Managed Access Gateway (MAG) is a consolidated portal providing identity and access management as a cloud service for the Aerospace & Defense industries. The PIM application is available through MAG. You are required to have a MAG user account and an approved security Copyright 2017 Exostar, LLC All rights reserved. 2

4 credential to access PIM. Please see the How to Access PIM section in this guide for access instructions and credential requirements. Roles within MAG You can find responsibilities for a MAG Application Administrator in the MAG Application Administrator Quick Reference Guide. If you do not have a MAG user ID, work with your organization s MAG Organization Administrator. You can find responsibilities for a MAG Org Admin in the MAG Organization Administrator Quick Reference Guide. PIM Access A person assigned the PIM App Admin role from your organization will receive an invitation to PIM and the required questionnaires submitted by a buying partner organization. To successfully subscribe your organization to PIM, the App Admin must accept the invitation and the questionnaires. Your MAG Org Admin or your MAG PIM App Admin must accept the PIM Terms and Conditions. Once the Terms and Conditions are accepted, anyone from your organization can request access to the PIM application through their MAG account. If you are unsure on how to use MAG and require assistance, please visit Before accessing the PIM application, log into your MAG account with an approved multi-factor credential such as a Phone-based OTP, OTP Hardware Token with Proofing Upgrade, Federated Identity Service (FIS) Medium Level of Assurance (MLOA) Hardware Certificates, Government- Issued Common Access Cards (CAC), Northrop Grumman OneBadge, NASA PIV Card, or the Enterprise Access Gateway (EAG) solution. To log into MAG with your approved multi-factor credential and access the PIM application, go to You must use Internet Explorer. Once you log into your MAG account with your multi-factor credential, verify the credential strength in the upper right hand corner of your screen. The below example shows the user logged Copyright 2017 Exostar, LLC All rights reserved. 3

5 in with an MLOA Hardware Certificate. If the credential strength says Username and Password, this means you are currently only logged in with username and password and have not logged in with a multi-factor credential. On your Home tab, locate the PIM application, and click Open Application. Note: If you see a different status other than Open Application for PIM, please use the legend or reference the PIM FAQs for assistance. If you see Login Requirements Not Met, you have not logged in with the correct credential strength to access the application. If you do not see PIM on your Home tab view, please contact Exostar Customer Support for assistance at , or create an online support case via PIM Roles If you are an Exostar Managed Access Gateway (MAG) Application Administrator for PIM, the system also designates you as an App Admin within the PIM application. The App Admin role within PIM allows you to manage users of your organization within the application. The App Admin can change a user s role within PIM, deactivate a user s PIM access. You can find additional information about completing these functions in the Manage Users. Copyright 2017 Exostar, LLC All rights reserved. 4

PIM Home Dashboard and Viewing Notifications The Home dashboard contains widgets, which enable you to access information or perform different functions in PIM.

Selecting Home redirects you to your main dashboard. Buying and supplying organizations can both use PIM. When logged into PIM, you will notice you are accessing PIM as a Supplier.

6 PIM Home Dashboard and Viewing Notifications The Home dashboard contains widgets, which enable you to access information or perform different functions in PIM. Widgets are clickable and allow you to obtain additional details. Vertical navigation includes the Home button. This navigation bar displays regardless of where you navigate within the application. Selecting Home redirects you to your main dashboard. Buying and supplying organizations can both use PIM. When logged into PIM, you will notice you are accessing PIM as a Supplier. If you are not subscribed to PIM as a buyer, you will not have any content in the Buyer view, however to change your view, click the Modify button. This redirects you to the Account Settings tab of your User Profile page. Copyright 2017 Exostar, LLC All rights reserved. 5

7 On your User Profile page, go to the Application section, and select the desired view from the Default View dropdown menu. Once you make your selection, click Save Changes at the bottom of the page. Alerts In the header section of your PIM dashboard, there is an alert icon. This icon provides the number of alerts you have to view. If you click the icon, you will see a dropdown of alerts and have the option to View All or Dismiss All. Copyright 2017 Exostar, LLC All rights reserved. 6

If you select View All, you are redirected to a page containing alerts for the last 30 days. You may Dismiss All or Dismiss each single alert one at a time.

8 If you select View All, you are redirected to a page containing alerts for the last 30 days. You may Dismiss All or Dismiss each single alert one at a time. You can manage your alerts via your Account Settings. You can set-up alerts for the following items by choosing Yes or No: Forms Requests Widget This widget shows all form sharing requests, and an App Admin can accept or deny directly from here. A sharing request is when a buyer requests for you to share a form in order to have access to view your form input and scores. The buyer partner organization you do business with must submit an invitation to your company in order to see your questionnaire results. Once you take action by accepting to share or declining to share the form that form no longer displays in the Forms Requests widget, and instead shows in the Forms Summary widget. Copyright 2017 Exostar, LLC All rights reserved. 7

9 To accept a sharing request, click the Share button. In the Confirm pop-up window, click Accept. To deny a sharing request, click the Deny button. In the Confirm pop-up window, you must provide a denial reason, and then click Deny. Forms Summary Widget This widget provides a list of accepted form sharing requests, the form status, percentage complete, and a shared with column. As an App Admin, you also have the option to assign the form to users. If you are assigned to the specific form you may click the Edit icon to go to the Form Details page via this widget. Copyright 2017 Exostar, LLC All rights reserved. 8

To assign a questionnaire from this widget, click the Assign To link. In the pop-up window, select a user from the Users dropdown menu, and click Add. You may add up to four users per form assignment.

Activities include status of your organization s response to an invitation and status of your organization s response to a questionnaire.

10 To assign a questionnaire from this widget, click the Assign To link. In the pop-up window, select a user from the Users dropdown menu, and click Add. You may add up to four users per form assignment. Once you have added the desire user(s) click on the Close button. Recent Activities Widget The Recent Activities widget provides a 30 day timeline of all activities taken place with a buying partner. Activities include status of your organization s response to an invitation and status of your organization s response to a questionnaire. The status of acceptance or opting out of a questionnaire also displays in this widget. This widget is always collapsed, and you can expand by selecting the Expand button to see the five (5) most recent activities or you can select the View All link to view all activities in the last 30 days. My Organization Widget The My Organization widget provides you a snapshot of your organization details. You can view your org name, address, number of buyers, and number of PIM users. Copyright 2017 Exostar, LLC All rights reserved. 9

If you have the App Admin role within PIM, you can manage users associated with your organization via this tab by clicking the Tools icon next to each user.

11 Clicking your organization name or the Buyers section in this widget, redirects you to the Partners tab of your My Organization Profile page. Clicking the Users section in the My Organization widget redirects you to the Users tab on your My Organization Profile page. If you have the App Admin role within PIM, you can manage users associated with your organization via this tab by clicking the Tools icon next to each user. Please see the User Management section for more information. While in the My Organization Profile page, you can select the Summary button located to the right of your organization name. Only an App Admin can add a summary for users to view. Partner Profile While on the My Organization Profile page, clicking a buyer partner name takes you to a buyer partner s profile. The profile provides you additional information such as the buyer partner s Copyright 2017 Exostar, LLC All rights reserved. 10

12 organization address, shared forms, and your organization s score for forms shared with the specific buyer. The map indicates where the buyer partner is located. Selecting the dropdown arrow for the Forms shared with section displays forms shared with the buyer whose profile you are viewing. Note: The Forms shared by section is not viewable from the Supplier view, only from the Buyer view. Clicking the form name under the Forms shared with section will redirect you to the Form Details page. Scores are calculated only after a questionnaire is completed and submitted. You can find Copyright 2017 Exostar, LLC All rights reserved. 11

13 additional information about completing or updating a questionnaire in the Completing and Updating a Questionnaire section. If a PIM App Admin assigned you a questionnaire, you have the ability to complete or edit the questionnaire. User Management If you are the App Admin within the PIM application, you can manage users within the application. Click your organization name under the My Organization widget, then go to the Users tab on your My Organization Profile page. Click the Tools icon next to the user you want to manage. From the User Management window, you can modify a user s role, including your own. If you change a user s role to Standard User, they lose administrative privileges within PIM. If you Copyright 2017 Exostar, LLC All rights reserved. 12

14 deselect the Active checkbox, the user will not have access to PIM after they log into their MAG account. Click Update to save your changes. Forms You can access your forms via the Forms Requests widget on your Home dashboard, or by clicking your organization name in the My Organization widget and going to the Forms tab on you My Organization Profile page. The Forms tab provides a list of all forms within your organization, along with the partner who requested the form, when the form was last updated, the sharing status of the form, and the expiration date. A form is a questionnaire a buyer partner invited your organization to complete. Questionnaires available in PIM are the Conflict Minerals Questionnaire, Cybersecurity Questionnaire, and the NIST SP Shared forms are forms shared by your organization with a buying partner. Clicking a shared form Name allows you to view the Form Details page providing information on how your organization responded to a questionnaire and how your organization scored. Copyright 2017 Exostar, LLC All rights reserved. 13

You can obtain additional information on how your organization answered a specific question for a specific section by clicking the Edit button or the View Form Input button.

15 You can obtain additional information on how your organization answered a specific question for a specific section by clicking the Edit button or the View Form Input button. You can download a blank questionnaire by clicking Reports, then select Blank Form. Additionally, you can obtain a report on how your organization responded by selecting Feedback Report from the Reports dropdown. Deny Form Sharing Request Your PIM App Admin can deny a form sharing request via the Forms tab by clicking the X button next to the form. In the Confirm pop-up window, you must enter a denial reason and click Deny. Accept Form Sharing Request Your PIM App Admin can accept a form sharing request by clicking the Share button next to the form name in the Form Requests widget. Copyright 2017 Exostar, LLC All rights reserved. 14

16 In the Confirm pop-up window, click Accept. When you take action on a form, it displays in your Recent Activities and the Forms Summary widget on your Home dashboard. Opt-Out of Form Sharing Request If your organization shared a form with a buyer partner, PIM App Admins have the ability to optout. If you do not have the role of PIM App Admin, you cannot submit an opt-out request. To optout, the PIM App Admin needs to submit an online request to Exostar. Opting-out discontinues form sharing with the buyer partner organization. The buyer partner organization will no longer have access to that particular form, and you cannot click the form to open. If you are doing business with Lockheed Martin, the opt-out option is unavailable. If you are doing business with Northrup Grumman, the buyer needs to approve your opt-out request. Upon request submission, the system sends an auto-generated with an embedded link, to the address you provide. The PIM App Admin must review and confirm your opt-out request by clicking the embedded URL, which takes them to a page displaying their request information. The PIM App Admin is required to confirm the request via the provided link in order for Exostar to review your case. Once Exostar processes the request to opt-out, the PIM App Admin receives a completion notification via the provided during case submission. No action is required from the supplying organization at this time. It can take up to five business days for Exostar to complete the request, and for the PIM App Admin to receive the notification. If you are Opting Out of sharing a form with NGC your buyer partner will also be required to approve the Opt out request. Copyright 2017 Exostar, LLC All rights reserved. 15

Note: If your organization wants to share an opted-out form with the same buyer, the buying organization is required to submit another Form Sharing request to your organization, and your organization

If you are completing and submitting the Conflict Minerals Questionnaire, you are required to upload the 4.20 version of the form.

17 Note: If your organization wants to share an opted-out form with the same buyer, the buying organization is required to submit another Form Sharing request to your organization, and your organization is required to accept the sharing. Completing the Conflict Minerals Questionnaire Once you select to complete the form, the Welcome page displays. To complete the form, click Continue. If you are completing and submitting the Conflict Minerals Questionnaire, you are required to upload the 4.20 version of the form. Please remember in order to complete any form in PIM, the PIM App Admin must assign the form to you. If you do not have the form, you have the option to download a blank 4.20 version of the Conflict Minerals Form from the Help section in PIM. Copyright 2017 Exostar, LLC All rights reserved. 16

18 When uploading the form, you must name the file CFSI_CMRT 4.20.xlsx or xls. Once you answer the questions, you must upload the completed form. Answer the questions presented on the page and click Next. Note: You cannot delete an uploaded form, however, you can replace an existing form by uploading a new version. When you are ready to submit, enter the submitter s details and click Send Response. You cannot submit the form if you do not enter the submitter s details. Any unsaved changes will not save Copyright 2017 Exostar, LLC All rights reserved. 17

19 and the system will discard the form. If you need to cancel the file you selected, close or cancel from your drive. Determining Who Your Organization is Sharing a Request With Under the Forms Summary widget, go to the Shared with column and click the number of partners next to the form. In the Shared with pop-up window, you can view the Partners and Shared Date. Copyright 2017 Exostar, LLC All rights reserved. 18

20 You can view the status of the questionnaire via the Status column. If the request says Pending, you have not accepted or denied the request yet. If you do not accept the sharing request, the buyer partner cannot see the responses to your questionnaire. Assigning Questionnaire Only users with the PIM App Admin role can assign questionnaires. Assigning a questionnaire to a user allows the user to complete or edit the form. If you complete the invitation for PIM access from your buyer partner, you are required to assign the questionnaire to yourself if you need to complete or edit the form. You can only assign a questionnaire if a buyer partner requested your organization share the form. PIM App Admins can assign a maximum of four users per questionnaire. When a questionnaire is assigned to a user, the user receives a notification and alert. Assign a Questionnaire to a User There are two ways an App Admin can assign a questionnaire to a user: 1. Under the Forms Summary widget. 2. On the Form Details page click the form name, and then the Assign User button. In the pop-up window, select a user from the Users dropdown menu and click Add. Copyright 2017 Exostar, LLC All rights reserved. 19

21 An App Admin can remove a user from a questionnaire by clicking the Remove link, and unlock a user from a questionnaire by clicking the Lock icon. Completing and Updating a Questionnaire Anyone with PIM access can complete questionnaires, however, if you are a standard user, your PIM App Admin must assign the questionnaire to you. You only need to complete questions relevant to your company. You can complete or update questionnaires by clicking the form name from the Forms Summary widget on your Home dashboard, or from the Forms tab on your My Organization Profile page. If another user is working on the form, the system locks the form and you cannot update it. Please see the Assign a Questionnaire to a User section for more information on locked forms. Once the user working on the questionnaire clicks Save & Exit, another assigned user can work on the questionnaire. There are two different options to edit the questionnaire: 1. If you want to edit the entire questionnaire, select Click to Edit. 2. If you want to edit an individual section, click Edit in the specific section. Copyright 2017 Exostar, LLC All rights reserved. 20

The Progress column indicates the status of your questionnaire. Please note there is a guidance section on the right to assist you with questions you may have about the questionnaire.

If you are unsure how to answer a question relevant to your business, please work with your IT Department or the company you are doing business with, as they may better assist you.

22 The Progress column indicates the status of your questionnaire. Please note there is a guidance section on the right to assist you with questions you may have about the questionnaire. Note: Exostar Tier I Support is unable to assist you with providing answers to any questions found on any of the questionnaires. If you are unsure how to answer a question relevant to your business, please work with your IT Department or the company you are doing business with, as they may better assist you. When you are ready to proceed to the next page, or if the question is not relevant to your business, click Next. Note: If you are not ready to proceed to the next page, click Save & Exit. This does not submit your form. Save & Exit retains the information you completed and takes you back to the dashboard. When you select the questionnaire, you are directed to the last page you were on. The system does not save your information if you do not click Save & Exit or Next. As you navigate through the questionnaire, your progress bar status changes. This shows what percentage of the questionnaire you have completed so far. Copyright 2017 Exostar, LLC All rights reserved. 21

Note: In order for the company you are doing business with to see your

23 Enter the name of the person who completed the questionnaire once you are done, then click Send Response. Note: In order for the company you are doing business with to see your questionnaire results, a user with the PIM App Admin role needs to accept a sharing request. Copyright 2017 Exostar, LLC All rights reserved. 22

Once you send a response, you are taken back to the questionnaire, where you have the ability to edit the completed questionnaire, and resubmit for updated scoring.

24 Once you send a response, you are taken back to the questionnaire, where you have the ability to edit the completed questionnaire, and resubmit for updated scoring. Partners Details View Under the My Organization widget, click your org name to redirect to your My Organization Profile page. The Partners tab provides you a list of all partners associated with your organization Copyright 2017 Exostar, LLC All rights reserved. 23

25 and the date you connected with them. It allows you to view partner details. Clicking the partner name redirects you to the Organization Details page of that partner. If you click the form name under the Forms shared with column, you are redirected to the Form Details page. Copyright 2017 Exostar, LLC All rights reserved. 24

26 If you click the Back to Partners link, you are redirected to the Partners tab of your My Organization Profile page. Users Profile View The Users profile view provides a summary view of users associated with your organization. Selecting the user name allows you to view information such as address and phone number. On your My Organization Profile page, go to the Users tab and click the user name you would like to view. Note: If you have an Admin role, you have the ability to manage users within your organization via the Users tab. Please see the User Management section for more information. Copyright 2017 Exostar, LLC All rights reserved. 25

Account Settings On your Home dashboard in the upper right corner, select the dropdown menu next to your name. You can select Contact Information or Account Settings.

27 Account Settings On your Home dashboard in the upper right corner, select the dropdown menu next to your name. You can select Contact Information or Account Settings. Both options redirect to your User Profile, and you can navigate between the two tabs. Under the Settings tab, you can update the Date/Time Format, change your default view under Application, and manage your Alerts and settings. Copyright 2017 Exostar, LLC All rights reserved. 26

You can update your Primary Phone, Secondary Phone, and Email Address under the Contact Information tab. To make any changes, click the Edit button. Complete your changes and click Update to save.

28 You can update your Primary Phone, Secondary Phone, and Address under the Contact Information tab. To make any changes, click the Edit button. Complete your changes and click Update to save. Scoring The Cybersecurity Questionnaire capability score is calculated based upon the responses provided to each control family. A partner supplier is required to implement all control activities contained within a capability level to attain that capability level. Before a partner supplier can meet the next capability level, they are required to have implemented all control activities from the prior control family. Copyright 2017 Exostar, LLC All rights reserved. 27

29 Score Summary allows you to review a summary of your capability results. The overall score is a collection of all capability level scores. Clicking the information icon in the Score Summary field provides you a legend you can use to analyze your results. Copyright 2017 Exostar, LLC All rights reserved. 28

30 When viewing scores for the NIST 800 questionnaire you will be provided with two score bars under the Score Summary section. The first score provides you with the total Implemented and Approved controls over the total number of available controls. The second score bar will indicate the total number of Controls you selected Implemented, Approved, and SSP/ POAM for over the total number of available controls. Each bar will stay red until it has reached a level of 100%. Control Score Assessment You can view further analysis by control family in the Control Score section of a questionnaire. You can see the control score for each individual control family. This is calculated by the Copyright 2017 Exostar, LLC All rights reserved. 29

Capability Levels Capability levels show the number of questions asked, and the number of

31 number of capabilities selected in each control over the total number of capabilities available per control. Capability Levels Capability levels show the number of questions asked, and the number of questions answered. In the illustration below, Capability Level 1 shows 28 questions were asked and 28 questions were answered. Copyright 2017 Exostar, LLC All rights reserved. 30

32 Notifications The following notifications are sent to a PIM App Admins: When a buying organization requests form sharing. Reminder 30 days prior to the expiration of a form you completed. Reminder s to complete a form requested by a buyer partner. When a capability score of less than three is received on a submitted Cybersecurity Questionnaire. The following notifications are sent to a Supplier User: When a form is assigned to you or completed by your PIM App Admin. Support You can find additional information including FAQs, Cybersecurity and NIST SP Questionnaire resources and more at Copyright 2017 Exostar, LLC All rights reserved. 31

Partner Information Manager (PIM)

Partner Information Manager (PIM) User Guide Version 2.1 Exostar, LLC 04/21/2016 Copyright 2015 Exostar LLC. All rights reserved Page 1 Table of Contents PIM User Guide Accessing PIM... 3 Access Requirements...