The MyCSF Administrator s Tool Guide

The MyCSF Administrator s Tool Guide January 2016

<< Back to Contents 2 Once your account has been configured, you will receive an email from HITRUST that contains information surrounding both your username and subscription. Inside the notification will be a temporary password used to access the HITRUST MyCSF Portal found at https://portal.hitrustalliance.net as well as links to assist you with the Administrator s Tool. The HITRUST MyCSF Portal The MyCSF Portal is the channel for accessing the MyCSF application as well as other HITRUST offerings that require log-in credentials.

Contents Setting Your Password and Security Questions.... 4 Resetting/Changing Your Password.... 6 Creating and Managing Users.... 8 Creating Users... 8 Resetting a User s Password.... 9 Deactivating a User... 9 Creating and Managing Objects.... 10 Creating Assessment Objects.... 10 Assigning Users to an Assessment.... 10 Managing Add-on Modules.... 12 Assigning Users to Add-on Modules.... 12 Add-on Module Role Descriptions.... 13

4 Setting Your Password and Security Questions Click on the above image to view the demonstration video 1. Using an internet browser, navigate to https://portal.hitrustalliance.net. You will be presented a login screen. The username that needs to be input is the email address to which you received the Account Registration alert from HITRUST. This same email also contains the temporary password that needs to be provided in the password field. 2. After successfully authenticating for the first time, the MyCSF Portal will prompt you to set your password. The Temporary Password field is what was entered to access the portal initially. a. The Password Complexity Requirements for the MyCSF Portal are as follows: i. At least eight (8) Characters in Length. ii. Minimum of One (1) Upper-Case Alphabetic Character. (e.g. A,B,C etc ) iii. Minimum of One (1) Lower-Case Alphabetic Character. (e.g. a,b,c etc ) iv. Minimum of One (1) Numerical Value. (e.g. 1,2,3 etc ) v. Minimum of One (1) Non-Alphanumeric Character (e.g.!,@,# etc )

5 3. Following the creation of your new password, you will be mandated to enter a One-Time Passcode (OTP) as part of the two factor authentication process (Note: You will need to request an OTP every ninety (90) days or if you clear your cookies on the browser). Press the navy blue Request OTP Code button. This will trigger an email to be sent to the username that you are attempting to authenticate. Copy the passcode and paste it into the OTP text box. When finished, click the Submit OTP Code button in red. 4. Resultantly, a prompt from the MyCSF Portal will once again be displayed. This message will inform you that you will required to supply security questions for the purpose of automatically resetting your password. Press OK on the alert. 5. The MyCSF Portal will direct you to your user contact page. Near the end of the list of fields is one labeled Password Reset Options with an adjacent blue Edit button. Click the blue hyperlink. 6. You will now be presented a row of preset questions. On the questions you would like to answer, first press the radio button or checkbox to the left of the question. Next, enter your answer to the question in the appropriately titled field. When you have completed the challenge questions that you were wishing to fill out, press the Save button in the top-right of the table and then Close. (Please note that you must enter at least one answer to the challenge question.) 7. There is a button located below the contact information that will return you to the MyCSF Portal landing page. From here, you are able to access MyCSF by clicking the MyCSF logo.

6 Resetting/Changing Your Password Click on the above image to view the demonstration video 1. If you do NOT remember your password and you did NOT set your Challenge Questions, please use the following step: a. Contact our Support Team available at support@hitrustalliance.net, and they will be happy to assist you. 2. If you do NOT remember your password, but you did set your Challenge Questions, please use the following steps: a. Using an internet browser, navigate to https://portal.hitrustalliance.net. On this login screen, click the link contiguous to the Forgot your Password? text. b. Provide the username you use for authenticating to the MyCSF Portal.. Afterwards, press the Next button located on the page. c. One of your previously answered Challenge Questions will appear. Enter the answer identical to how it was originally input. If correct, you will receive a temporary password in an email from HITRUST. Return to the portal by typing https://portal.hitrustalliance.net into your browser s URL bar.

7 d. Log-in using your MyCSF portal username and your temporary password sent to you by HITRUST. e. After successfully authenticating, the MyCSF Portal will prompt you to set your password. The Temporary Password field is what was previously entered prior to this step. i. The Password Complexity Requirements for the MyCSF Portal are as follows: 01. At least eight (8) Characters in Length. 02. Minimum of One (1) Upper-Case Alphabetic Character. (e.g. A,B,C etc ) 03. Minimum of One (1) Lower-Case Alphabetic Character. (e.g. a,b,c etc ) 04. Minimum of One (1) Numerical Value. (e.g. 1,2,3 etc ) 05. Minimum of One (1) Non-Alphanumeric Character (e.g.!,@,# etc ) 3. If you do remember your password and simply wish to change it, please use the following steps: a. Log-in to the MyCSF Portal with your valid username and password. Below the Portal icons, click the link labeled Change Password. b. Once directed to the user contact page, click the Edit button adjacent to the Password field. As you have already provided the correct credentials necessary to access this user contact form, you will not be required to enter your old password. Please update the password you desire, but adhering to our password policy. i. The Password Complexity Requirements for the MyCSF Portal are as follows: 01. At least eight (8) Characters in Length. 02. Minimum of One (1) Upper-Case Alphabetic Character. (e.g. A,B,C etc ) 03. Minimum of One (1) Lower-Case Alphabetic Character. (e.g. a,b,c etc ) 04. Minimum of One (1) Numerical Value. (e.g. 1,2,3 etc ) 05. Minimum of One (1) Non-Alphanumeric Character (e.g.!,@,# etc )

8 The MyCSF Administrator s Tool The Administrator s Tool is a feature of MyCSF that allows the Account Leads to manage the users and assessment objects associated with their subscription seamlessly. It is accessible though the address https://portal.hitrustalliance.net/admintool. You will need to authenticate into the MyCSF Portal to reach this component. Creating and Managing Users Click on the above image to view the demonstration video Creating Users 1. To proceed with registering and provisioning users under your account, go to https://portal.hitrustalliance.net/ admintool. If you are not already logged in, enter your MyCSF Portal credentials. 2. On the MyCSF Administrator s Tool homepage, you will see a menu on the left part of the screen. Place your cursor over the User Management tab and select the Create option that appears. 3. Fill out the necessary information on the resulting page and press the Submit button at the bottom. This user will be sent a notification instructing them on how to access MyCSF. Important: Newly created users do not have any permissions to your account. They will need to be assigned by using the Object Management aspect of the Administrator s Tool (Refer to Assigning Users to an Assessment).

9 Resetting a User s Password 1. Unlike users manufactured through the admin tool, you, as a Customer Lead, have the ability to reset their password effortlessly. Place your cursor over the User Management tab and select the Manage option. Note: The previously discussed methods of resetting a password are also acceptable. 2. Enter the user s email address (this field has autocomplete capabilities which will allow you to find the intended user after entering in only a few characters) and select it from the resulting dropdown. Once they have been chosen, their First and Last Name fields will be populated with their information. 3. Reset their password by clicking the Reset Password button at the bottom of the page. This user will be sent a notification regarding this event including a temporary password for the MyCSF Portal. Deactivating a User 1. In addition to resetting a user s password in the Administrator s Tool, users can also be quickly deactivated if their participation is no longer needed inside MyCSF. Place your cursor over the User Management tab and select the Manage option. 2. Enter the user s email address (this field has autocomplete capabilities which will allow you to find the intended user after entering in only a few characters) and select it from the resulting dropdown. Once they have been chosen, their First and Last Name fields will be populated with their information. 3. In the Status field for this particular user, alter the value to Inactive and press the Update button at the end of the page. You will informed that the account has been updated with an on-screen message.

10 Creating and Managing Objects Click on the above image to view the demonstration video Creating Assessment Objects 1. Before you can commence a CSF assessment in MyCSF, you will need to have an object added to your organization. To do so, hover your cursor over the Object Management tab in the Administrator s Tool and select the Create option. 2. In the Object Name field, enter what you would like the Assessment to be labeled. Click the Submit button when finished. You will be shown confirmation that the Object was successfully created. Note: All Account Leads will be assigned automatically to this object. Assigning Users to an Assessment 1. After creating an Assessment object, the only users who will inherit privileges to them are the Account Leads. You will be responsible for delegating the permissions to the other users as you deem fit. To assign specific assessments, hover your mouse over the Object Management tab and select the Manage option. 2. From the Object Name dropdown, select the Assessment to which you would like to assign permissions. Successively, also choose the User Type that will be allotted to the users picked in the following step. a. Standard User: This user possesses the ability to review and answer all Baseline Requirement Statements under the Assessment.

11 b. Customer Respondent: This user is not granted permission to the Baseline Requirement Statements initially, and as a result, must be assigned by either an Account Lead or Standard User inside of MyCSF. c. Assessor: If this object has been specified by HITRUST as Validated (one completed in accordance with an approved CSF Assessor Firm), you can assign the relevant members of the Assessor firm to perform their duties. With this role, they will be unable to answer the Requirement Statements. 3. After making your User Type selection, you will notice an assignment field will become visible. Clicking the names of those in the Unassigned box will move them to the Assigned bucket which will grant them the role denoted in the User Type dropdown. Moreover, clicking the names in the Assigned box will resultantly remove the role and place them in the Unassigned box.

12 Managing Add-on Modules Click on the above image to view the demonstration video If you have purchased any of the Exception, Incident, or Policy Management modules, the Admin Tool permits you to fully control the role delegation for your Organization s MyCSF users. For more information about these Add-ons, please contact us by emailing sales@hitrustalliance.net. Assigning Users to Add-on Modules 1. Place your cursor over the Module Management tab and select the cascading submenu titled Manage. 2. Your organization s licensed Add-on Modules will be selectable in the Module drop down attribute. Choose from the list the component for which you would like to make adjustments. 3. Another successive field will populate with a value specific to the Module picked in the previous step. Select the user type that you would like to assign to members of your organization. 4. Once finished, a table will become visible that permits you to seamlessly delegate permissions to the registered users in your entity. Click on users in the Unassigned box to assign them the user type defined above. Reversely, click the users in the Assigned box to remove their previously granted role.

13 Add-on Module Role Descriptions Exception: Exception Submitter: This user type is permitted to create exception requests and modify the General Request tab before initiating the approval process. Exception Reviewer: This user type has the ability to rule on the recently submitted Exception Request. Their decision is then communicated to the Exception Manager. Exception Manager: This user type has complete accessibility into all phases of the approval process. Incident: Incident Submitter: This user type is used for the purpose of logging incidents and providing some background information relevant to the event. Incident Reviewer: This user type has full accessibility to all incident workflows EXCEPT they are not permitted to assign other users to the event. Incident Manager: This user type has full accessibility to all Incident workflows. Policy: Policy Reader: This user type is restricted to only viewing the Policies uploaded into MyCSF using the Policy Management module. Policy Manager: This user type is permitted to use all workflows provided with the Policy Management Add-on Module.

855.HITRUST (855.448.7878) www.hitrustalliance.net