NetDMR National Installation. Regulatory Authority User Guide

NetDMR National Installation Regulatory Authority User Guide

Table of Contents Chapter 1. Introduction...1 1.1. Structure of this Guide...1 1.1.1. Organization...1 1.1.2. User Guide Notation and Conventions...1 1.1.2.1. Tips...1 1.2. Background What is the National Installation of NetDMR?...1 1.3. System Requirements...2 1.3.1. Enabling Session Cookies...2 1.4. Types of Users and Their Roles...3 1.5. Security...6 1.5.1. System Access...6 1.5.1.1. System Time-Out...9 1.5.1.2. Logging Out...9 1.5.1.3. Suspect Analysis Log...9 1.6. Look and Feel... 10 1.6.1. General System Navigation... 10 1.6.2. NetDMR Pages... 10 1.6.3. Entry of Data... 12 1.6.3.1. Text Boxes... 12 1.6.3.2. Checkboxes... 12 1.6.3.3. Radio Buttons... 12 1.6.3.4. Pick lists... 12 1.6.3.5. Multi-Select Lists... 13 1.6.3.6. Calendar Icons... 14 1.6.4. Page Types... 14 1.6.4.1. Search Pages... 14 1.6.4.2. List Pages... 15 1.7. Resources for More Information... 16 Chapter 2. Managing Your Account... 17 2.1. Creating an Account... 17 2.1.1. General Information Rules... 20 2.2. Searching for Available Permit Ids... 21 2.3. Requesting View or Edit Access... 22 2.4. Viewing an Account... 23 2.5. Editing an Account... 25 2.5.1. Request Access Rights Change... 27 2.5.2. Security Questions and Answers... 27 2.5.2.1. Reset Security Questions... 27 2.5.3. Change Password... 28 2.5.3.1. Reset Password... 29 2.5.4. Lock Account... 30 2.6. Unlocking Your Account... 30 2.7. Resetting a Password... 31 2.8. Retrieving a Forgotten User Name... 31 2.9. Retrieving a Forgotten Password... 33 2.10. Disabled Accounts... 34 i

Chapter 3. Regulatory Administrators Procedures... 35 3.1. Managing Access Requests... 37 3.1.1. Approve/Deny Signatory Requests... 38 3.1.2. Managing Regulatory User Access Requests... 41 3.1.3. Managing External Permittee and Data Provider User Access Requests... 42 3.2. Managing Your NetDMR Instance... 43 3.2.1. View Instance... 44 3.2.1.1. General Information Details... 44 3.2.1.2. Agency Mappings... 44 3.2.1.3. System Administrators... 44 3.2.1.4. Custom Email Message... 45 3.2.1.5. DMR Submission and Attachment Notifications... 45 3.2.1.6. Custom News and Messages... 45 3.2.2. Edit Instance... 45 3.2.2.1. Editing General Instance Information... 47 3.2.2.2. Editing the Custom Email Message... 47 3.2.2.3. Editing DMR Submission and Attachment Notifications... 47 3.2.2.4. Edit Custom News and Notices... 48 3.3. Manage Agreements... 49 3.4. COR Functionality... 51 3.4.1. Search CORs... 52 3.4.2. Viewing COR Search Results... 54 3.4.3. Refining the COR Search... 54 3.4.4. Performing a New COR Search... 55 3.4.5. Downloading a COR... 55 3.4.6. Viewing a COR... 58 3.4.6.1. Viewing the COR Certification Statement... 59 3.4.6.2. Downloading the COR... 60 3.4.6.3. Viewing the COR Signature... 60 3.4.6.4. Downloading the COR Public Signature Key... 60 3.4.6.5. Verifying the COR Public Signature... 62 3.4.6.6. Returning to the COR Search Results Page... 63 3.5. Repudiating the COR... 63 3.6. Searching and Viewing Permits... 64 3.6.1. Search for Permits... 64 3.6.2. View Permit Details... 65 3.7. Searching for Users... 66 3.7.1. User Search... 66 3.7.2. User Search Results... 67 3.7.3. View User Account Details... 68 3.8. Editing and Managing User Accounts... 70 3.8.1. Edit General User Information... 72 3.8.2. Lock User Account... 73 3.8.3. Unlock User Account... 73 3.8.4. Reset User Password... 73 3.8.5. Reset User Security Questions and Answers... 74 3.8.6. Approve User Access Requests... 75 ii

3.8.7. Deny User Access Requests... 75 3.8.8. Revoke User Access Requests... 75 3.9. View Logs... 75 3.9.1. Viewing Suspect Logs... 75 3.9.2. Viewing Raw Logs... 77 3.10. View Network Activity... 79 3.10.1. View Exchange Network Activity... 80 3.10.2. Request Basic Permit Data Flow... 82 3.10.3. DMR Data Refreshes from ICIS-NPDES... 83 3.10.4. Request DMR Information by Date Range... 83 3.10.5. Request Information for One DMR... 85 3.11. Requesting Access to Partial DMRs... 86 3.11.1. View Partial DMRs... 87 3.12. Validate CORs... 88 Chapter 4. Regulatory View User Procedures... 90 4.1. Searching CORs... 92 4.1.1. Viewing COR Search Results... 93 4.1.2. Refining the COR Search... 93 4.1.3. Performing a New COR Search... 94 4.1.4. Downloading a COR... 94 4.1.5. Viewing a COR... 97 4.1.5.1. Viewing the COR Certification Statement... 97 4.1.5.2. Downloading the COR... 98 4.1.5.3. Viewing the COR Signature... 100 4.1.5.4. Downloading the COR Public Signature Key... 100 4.1.5.5. Returning to the COR Search Results Page... 102 4.2. Search and View Permits... 102 4.3. Search and View Users... 104 4.4. Requesting Partial DMR and Regulatory Administrator Access... 106 4.4.1. Regulatory Administrators Access Requests... 107 4.4.2. Partial DMR Access Request... 108 4.4.3. View Partial DMRs... 109 Appendix A Subscriber Agreement. 110 Appendix B Fraud Analysis. 117 Appendix C Validating CORs with Digital Signatures. 118 Appendix D Agency Maps.. 121 Appendix E Basic Permit and DMR Refresh... 123 Appendix F Job Processing Schedule. 128 Appendix G Troubleshooting Missing DMRs. 129 Appendix H Frequently Asked Questions.... 132 Appendix I Requesting Assistance.. 142 List of Figures iii

Figure 1-1: NetDMR User Categories and Their Roles...5 Figure 1-2: Functions of the Various NetDMR Roles...6 Figure 1-3: NetDMR Welcome Page...7 Figure 1-4: NetDMR Login Page...8 Figure 1-5: NetDMR Permittee User Home Page...8 Figure 1-6: Example of Text Boxes... 12 Figure 1-7: Example of Checkboxes... 12 Figure 1-8: Example of Radio Buttons... 12 Figure 1-9: Example of a Pick list... 13 Figure 1-10: Example of Multi-Select List... 13 Figure 1-11: Calendar Pop-up Window... 14 Figure 1-12: Sample Search Page... 15 Figure 1-13: Sample List Page... 16 Figure 2-1: NetDMR Create Account Page... 18 Figure 2-2: NetDMR Complete Account Creation Process Page... 20 Figure 2-3: New Account Data Checking Rules... 21 Figure 2-4: Request Access to Permits and Associated DMRs Page... 22 Figure 2-5: My Account Page... 24 Figure 2-6: My Account Page... 26 Figure 2-7: Locked Account Notification Page... 30 Figure 2-8: Regulatory Authority Contact Page... 30 Figure 3-1: Regulatory Administrator Home Page... 36 Figure 3-2: View User Account Details Page... 37 Figure 3-3: Process Subscriber Agreement Details Page... 39 Figure 3-4: Manage Instance Page... 43 Figure 3-5: Edit Instance Page... 46 Figure 3-6: COR Search Results Page... 54 Figure 3-7: View COR Details Page... 59 Figure 3-8: Search Permit ID Page... 64 Figure 3-9: View Permit Details Page... 65 Figure 3-10: Search Users Page... 66 Figure 3-11: User Search Results Page... 68 Figure 3-12: View User Account Details Page... 69 Figure 3-13: Edit User Account Page... 71 Figure 3-14: Suspect Logs Page... 76 Figure 3-15: View Raw Logs Page... 78 Figure 3-16: View Network Activity Page... 80 Figure 3-17: Partial DMRs Page... 88 Figure 4-1: Regulatory User Home Page... 91 Figure 4-2: Search CORs Page... 91 Figure 4-3: COR Search Results Page... 93 Figure 4-4: View COR Details Page... 97 Figure 4-5: Search Permt ID Page... 102 Figure 4-6: Search Users Page... 104 Figure 4-7: Internal User Access Page... 107 Figure 4-8: Partial DMRs Page... 109 iv

v

Chapter 1. Introduction 1.1. Structure of this Guide 1.1.1. Organization The intent of this guide is to provide step-by-step instructions, guidance, and pertinent information on how to use the National Installation of NetDMR. This guide addresses the technical basics of administering accounts and providing assistance to permittees and data providers entering data into the National Installation of NetDMR. For the most part, it does not deal with policy regarding what data should be entered in particular circumstances. Descriptions and information are written to provide clarity to the average User, not for regulatory precision. Finally, this guide is not exhaustive. Data elements and other aspects of the system that are reasonably self-explanatory are not discussed. 1.1.2. User Guide Notation and Conventions The bulk of this guide consists of step-by-step guides to performing various tasks. Within each task, steps are enumerated and screen shots are included to illustrate the steps. 1.1.2.1. Tips Throughout the Guide you will find text boxes containing Tips. Tip boxes contain information that should make your job easier. They include ideas for streamlining data entry or information pertaining to particular situations. Tips include ideas for streamlining data entry or information pertaining to particular situations. 1.2. Background What is the National Installation of NetDMR? The National Installation of NetDMR is a web-based application that will allow National Pollutant Discharge Elimination System (NPDES) permittees to electronically submit discharge monitoring reports (DMRs) to EPA s data system for discharge information, the Integrated Compliance Information System (ICIS)-NPDES database. NPDES permits are issued under the authority of the Clean Water Act. The NetDMR application, or installation, resides at CDX and allows each State Agency, Tribe or EPA Regional office to have their own separate working environment, or Instance that can be customized with their own logos, permits, DMRs, new alerts and contact information. NetDMR includes the following key components: Common Functionality: Create an account, request access to a permit and associated DMRs/and copies of record (CORs), edit account information, retrieve a forgotten user name or reset a forgotten password, and unlock a locked account. 1

System Administrator: Configure a NetDMR installation and customize settings for each Instance associated with an installation. Regulatory Administrator: Manage user accounts; set additional customization options for an Instance; approve signatories; and search, view, and download DMRs and CORs submitted for permits administered by the regulatory authority associated with the Instance. Permit Administrator: Manage user read and write access to DMRs for a specific permit. Search Functionality: Search and view permit details. DMR Functionality: Search, view, edit, sign and submit DMRs; import DMR data. COR Functionality: Search, view, and download copies of record for DMRs. Interaction with ICIS: NetDMR retrieves permit and expected DMR data from ICIS and submits reported DMR data to ICIS automatically. Database: Store information needed by NetDMR or generated by NetDMR users. Help System: Provide on-line instruction on how to use specific elements of NetDMR functionality. Descriptions for all key components except the System Administrator are described in subsequent sections of this document. Details on NetDMR functionality available to System Administrator are provided in the NetDMR System Administrator User Guide 1.3. System Requirements The following are the minimum PC requirements to access and use the National Installation of NetDMR: Pentium III/IV or equivalent processor 128 MB RAM (512 MB recommended) Monitor with resolution of at least 800 x 600 Internet access Microsoft Internet Explorer 6.0 or above, with settings: JavaScript enabled Session cookies enabled Pop-up blockers disabled NetDMR was designed for use with Internet Explorer. Unexpected results may occur if any other Web browser is used. 1.3.1. Enabling Session Cookies NetDMR requires that you enable session cookies to function properly. A cookie is a small text file containing information that a Web site copies to your computer. NetDMR will automatically detect whether you have cookies enabled after login and provide instructions on how to enable cookies if needed. All cookies generated by NetDMR are removed once you close your browser. After you enable cookies, log into NetDMR again. The following cookies will be used by NetDMR: 2

JSESSIONIID A number generated by the NetDMR to identify your browser. This cookie is removed once you close your browser and contains no personal identifying information. COOKIETEST A cookie that has the value of 1. This cookie is set only to test that your browser allows cookies. This cookie contains no personal identifying information. To enable cookies using Internet Explorer 6.0 or 7.0: 1. Choose Tools, then Internet Options. 2. Click the Privacy tab. 3. Default setting is medium. Move the slider to determine which setting you prefer. 4. You can also click on Advanced for specialized cookie treatment. 1.4. Types of Users and Their Roles The ability to view and modify data within the National Installation of NetDMR is controlled by the organization a User is affiliated with (a facility, a lab or contractor, a state, an EPA region, or EPA headquarters) and the roles to which a User can be assigned. Regulatory Users are assigned either a Regulatory Administrator role or a Regulatory View role. Figure 1-1 lists the different Roles and User Categories NetDMR offers: Role User Category Functions System Administrator EPA Headquarters Create and manage an installation Create and manage downtimes and settings Create and manage Instances: o Create the first Regulatory Administrators for a new Instance o Manage General Information o Manage Regulatory Administrators requests Regulatory Administrator EPA Region or State (Internal) 3 o Manage Agency Maps Customize an Instance: o Manage some General Information o View System Administrators o Manage Subscriber Agreements o View Agency Maps o Manage e-mail messages o Manage DMR submission and attachment notifications o Manage news and notices Manage Regulatory Administrators, Signatory and Regulatory View requests Create the first Permit Administrator for a new Instance Assist Permit Administrators with

Role User Category Functions managing Permit Administrator, External Permitte and Data Provider Edit and View Requests View permits and users View, validate, download and repudiate CORs Manage user accounts View logs and network activity Request access to View Partially completed DMRs Signatory Permit Administrator Edit Permittee or Facility (External) Permittee or Facility (External) Permittee or Facility (External) Edit Data Provider - Contractor or Lab (External) 4 Request access to view, modify, sign or submit DMRs/CORs for a permit Import DMRs Sign and submit Subscriber Agreements Download blank DMRs Download CORs Manage Permit Administrator, External Permittee and Data Provider Edit and View requests, and Regulatory View Partial DMR Requests to view or modify DMRs and CORs Manage Regulatory View access to partially completed DMRs Request access to view, modify, sign or submit DMRs/CORs for a permit Import DMRs Sign and submit Subscriber Agreements Download blank DMRs Download CORs Request access to view and modify a permit and its DMRs/CORs View users Download blank DMRs Download CORs Request access to view and modify a permit and its DMRs/CORs View users Download blank DMRs Download CORs View EPA Region or State (Internal) Request access to view a permit and its DMRs/CORs Request Regulatory Administrators access View users Download blank DMRs View Permittee or Facility Request access to view a permit and its

Role User Category Functions (External) DMRs/CORs View users Download blank DMRs View Data Provider - Contractor or Lab (External) Request access to view a permit and its DMRs/CORs View users Download blank DMRs Figure 1-1: NetDMR User Categories and Their Roles System Administrator EPA Headquarters staff responsible for configuring and performing routine maintenance on the National NetDMR Installation, establishing state Instances of NetDMR within the National Installation, and creating the first Regulatory Administrators. Regulatory Administrator State and EPA Regional (Regulatory Authority) staff responsible for managing User accounts, customizing their own Instance within the National Installation, approving DMR signatories, and searching, viewing and downloading DMRs and their Copies of Record (CORs) submitted for permits administered by the regulatory authority associated with the Instance, and provide Technical Support of NetDMR for Permittees and Data Providers Permit Administrator Facility or permittee staff responsible for approving all COR and DMR view requests, and DMR edit requests for the Permit. Permit Administrators may edit DMRs only if they have been granted Edit access to a permit. Signatory Facility or permittee staff responsible for signing and submitting DMRs on behalf of an organization. A request for the signatory privilege requires submission of a Subscriber Agreement to the Regulatory Authority that administers a particular NPDES permit Until the first Signatory Privilege is granted for a permit, no accesses or privileges can be requested for that permit by other users. Permitee User Facility or permittee staff responsible for viewing, entering, editing or uploading Discharge Monitoring Reports (DMRs) into a state Instance. Data Provider Contractor or laboratory staff responsible for viewing, entering, editing or uploading Discharge Monitoring Reports (DMRs) into a state Instance. Data Providers are not allowed to sign and submit DMRs or approve access to permits. Figure 1-2 illustrates the functions available to each role within NetDMR. 5

Figure 1-2: Functions of the Various NetDMR Roles 1.5. Security 1.5.1. System Access The National Installation of NetDMR is accessed through a secure web site by navigating to http://www.epa.gov/netdmr. Initially, a map of the United States will be displayed. Click on a blue NetDMR state of interest and click on the Log In hyperlink to enter the NetDMR site. If your permit is with an EPA Region or Tribe click on any blue NetDMR state and click on the Log In hyperlink for that state to enter the NetDMR site. The NetDMR Welcome page will appear and prompt you for your Regulatory Authority (Figure 1-3). 6

Figure 1-3: NetDMR Welcome Page If your permit is administered by a State Environmental Agency or an EPA Region, click on the Select Regulatory Authority pick list and highlight appropriate agency s state name or EPA Region. Click on to proceed to the NetDMR Login page for the NetDMR Instance of the Regulatory Authority you selected from the list box. At the NetDMR Login page shown in Figure 1-3, existing NetDMR users enter their NetDMR User Name and Password as shown in Figure 1-4, then click on. New users must click on to gain access to NetDMR before being able to log into NetDMR. 7

Figure 1-4: NetDMR Login Page You are only permitted one NetDMR login at a time (a single active session). If you attempt to log into NetDMR from the same or more than one computer simultaneously NetDMR will terminate the previous session and establish the most recent login attempt. After a successful login, NetDMR will display the Permittee User, Signatory Administrator, Permit Administrator, Regulatory Administrators or System Administrator home page depending upon your Role and access level. Figure 1-5 is an example of the Permittee User Home page for a Regulatory Authority User with View access. Figure 1-5: NetDMR Permittee User Home Page 8

A list of up to 10 previous logins are always displayed on the right side of each home page. 1.5.1.1. System Time-Out NetDMR will automatically log you out and prompt you to log back in if the page is left idle for 30 minutes. The Session Lockout Timer, which is a countdown from 30 minutes, is displayed at the top right corner of every page. The timer resets to 30 minutes every time you perform an action that refreshes the page (e.g. save, submit, cancel, etc). Once you are logged out you may sign back in immediately. Any unsaved information will be lost. 1.5.1.2. Logging Out Log out of NetDMR by clicking on at the top of any NetDMR page. 1.5.1.3. Suspect Analysis Log The Suspect Analysis log is a tool used by Regulatory Administrators to detect illegal activity to determine if an account has been compromised. If it is determined that a compromising situation has occurred, the affected account will need to be locked to prevent the user from logging into NetDMR until the illegal activity has been addressed and the account is unlocked by a Regulatory Administrator. A Signatory with a locked account will be unable to sign and submit DMRs until a Regulatory Authority Administrator unlocks the account. The NetDMR Suspect Analysis log tracks the following activities within a specified frequency of time: inconsistent login IPs more than 10 originating IPs. overlapping login attempts more than 10 overlapping login attempts in 3 days. overlapping login attempts with different originating IPs more than 5 overlapping login attempts from different IPs within 3 days. irregular DMR submission pattern calculates the mean number of submissions per month and standard deviation, and then flags anything greater than two standard deviations. 9 View the Suspect logs periodically to make sure no illegal activity is occurring for your Instance.

The System Administrator sets the frequency of the suspect analysis log runs for the installation through the settings functionality. The default is set to quarterly. Section 3.9 explains how to generate and view contents of the suspect logs. 1.6. Look and Feel 1.6.1. General System Navigation Hyperlinks take you to a particular page. By convention, hyperlinks are indicated by an arrow or hand icon when hovering your cursor over them. A standard set of hyperlinks are found at the top of all NetDMR pages and customized hyperlinks are sprinkled in the body of certain pages as necessary. Buttons cause the system to perform some action, such as searching, saving, or deleting. Buttons are generally found near the bottom of the page or next to a block of data, and the actions they perform are dependent on information you have entered on the page. 1.6.2. NetDMR Pages The NetDMR Welcome page has hyperlinks at the top that provide answers to Frequently Asked Questions (FAQs) and explain how to get started in NetDMR. The body of the page displays news items and has a drop down list box for choosing a Regulatory Authority interface or NetDMR Instance. The series of hyperlinks on the top of the NetDMR Login page provide answers to Frequently Asked Questions (FAQs), explain how to get started in NetDMR, and provide contact information. In the body of the NetDMR Login page are hyperlinks to register for a new NetDMR account, create a NetDMR account, retrieve a User Name, retrieve a forgotten password, and check if your permit is in NetDMR. You can set up separate accounts in NetDMR for each Regulatory Authority that you have permit(s) on file with. After you have logged in, the NetDMR pages have hyperlinks at the top that return to the main NetDMR home page, navigate to your account, allow you to request access, provide help and display the Logout page. A brief description of each hyperlink is given below. Home This option returns a User or Administrator to the appropriate NetDMR home page from any page within NetDMR. FAQs 10

The FAQ page lists topics of interest to most Users of NetDMR. Click on of questions, and click on to collapse the list. to expand the list Getting Started The Getting Started page displays information Users and Administrations need to know when first starting to use NetDMR. Contact the NetDMR Team This page displays information on whom to contact with NetDMR questions and assistance. Register for a New Account New Users and Administrators must create an account before they can use NetDMR. Clicking on this link presents the page for creating new accounts. Forgot Username? This option presents a page that allows Users and Administrators to retrieve their forgotten NetDMR User Name. New Users should click on the Checking your PERMITID hyperlink to make sure NetDMR stores your permit before clicking on the registration hyperlink. Forgot Password? This option presents a page that allows Users and Administrators to reset a forgotten NetDMR password. Create a NetDMR Account New Users and Administrators must create an account before they can use NetDMR. Clicking on this link presents the page for creating new accounts. Checking Your Permit ID This option allows Users to find out if any of their permits are available within NetDMR for reporting their DMRs. Help This option provides step-by-step instructions and guidance on how to use NetDMR. Logout This option logs a User or Administrator out of NetDMR. To remind you of how you logged into NetDMR, all NetDMR pages display your User ID, your user type and the name and/or logo of the NetDMR Instance you are currently working with in the upper right corner. 11

1.6.3. Entry of Data A variety of tools, including text boxes, radio buttons and pick lists designed for different types of data entry appear throughout NetDMR. These tools are similar to those found on many web pages. The purpose and use of these tools is described below. 1.6.3.1. Text Boxes Text boxes appear as blank rectangles. Examples are shown in Figure 1-6. They allow free entry of letters and/or numbers. All text boxes have a set limit on the number of characters that can be entered. The size of the text box is generally related to the number of characters that may be entered. If you attempt to enter more characters than are allowed, the extra characters will not show up in the text box or be stored in NetDMR. Figure 1-6: Example of Text Boxes 1.6.3.2. Checkboxes Checkboxes appear as small squares. Clicking on a check box toggles the appearance of a check mark. Checkboxes often appear along with groupings of items, such as the months of the year, and allow you to select any number or all of the items. An example of a group of checkboxes is shown in Figure 1-7. Checkboxes are also used to indicate yes or no answers to questions. Figure 1-7: Example of Checkboxes 1.6.3.3. Radio Buttons Radio buttons appear as small circles, typically next to lists of items. An example of a list with radio buttons is shown in Figure 1-8. From any group of items with radio buttons, only one item may be selected. Clicking on a radio button selects that item, and the selection is indicated by a dot in the circle. If a different item in the list had been selected, the dot and the selection are removed from that item. In many cases, once an item is selected, a button elsewhere on the page must then be clicked to execute a particular action (e.g. edit or delete the selected item in the list). Figure 1-8: Example of Radio Buttons 1.6.3.4. Pick lists Pick lists appear similar to text boxes, but with a button with a downward pointing arrow at the right side of the rectangle. Clicking on this button, or in the box, causes a list to appear, from 12

which a single item may be selected. Figure 1-9 shows the Select Regulatory Authority pick list box and the options for the top box displayed after clicking on the arrow button or within the list. The desired text is selected by clicking on it. Figure 1-9: Example of a Pick list The list then disappears and the selected item appears in the text box: 1.6.3.5. Multi-Select Lists Multi-select lists appear as boxes containing a list of items. These lists allow you to select more than one item from the list by holding down the Ctrl key and clicking on the desired item(s). Selected items are marked with dark blue highlighting. An example of a multi-select list with two of the visible items selected is shown in Figure 1-10. Figure 1-10: Example of Multi-Select List Selection of multiple items is controlled through the use of the Ctrl and Shift keys. While holding the Ctrl key, clicking on items in the list toggles their selection. Holding the Shift key while clicking an item will select all items between that item and the previously clicked item (any other items will become unselected). Clicking on an item while holding neither the Ctrl nor Shift key will reset the selection, with only that item now selected. As with pick lists, you can move through the list by using the letter keys. Doing so also resets the selection. 13

1.6.3.6. Calendar Icons NetDMR Regulatory Authority User Guide Calendar icons appear to the right of text boxes for date fields. Dates can be entered either by typing directly into the text box or by clicking and choosing a date from the calendar that is displayed. Figure 1-11 shows the calendar pop-up window that appears after clicking on the calendar icon. Figure 1-11: Calendar Pop-up Window The calendar will appear with the current month and day displayed. Above the calendar are a pick list for choosing a month and a set of right and left arrow buttons. Clicking on will move backward one month. Clicking on moves forward one month. The individual dates are shown as hyperlinks. Clicking on a date will return you to the data entry page with that date entered in the appropriate text box. When typing dates directly into text boxes, they must be entered in the format: mm/dd/yyyy. For example, November 6, 2008 would be entered as 11/06/2008. 1.6.4. Page Types There are three major types of pages in NetDMR: search pages, list pages, and add/edit pages. There are various versions of these pages for the various business areas, but all pages of a given type share a number of features. These common features are described below. 1.6.4.1. Search Pages Search pages are a common starting point for many tasks in NetDMR, allowing you to search for an activity you wish to edit or determine if a particular activity already exists in the system before adding it. Search pages also appear in the sequence of pages you are guided through while adding certain activities. A sample search page is shown in Figure 1-12. 14

Figure 1-12: Sample Search Page Note that fields are organized in groups or related data elements. You may enter information in as many fields across as many groups as you wish. If information is entered in more than one field, NetDMR combines the information with an AND operation. In other words, it will find records that meet all of the criteria you entered. Therefore, the more information you enter, the fewer results you will receive. To search for text that may occur in the middle of the data element, use % at the beginning as a wildcard. For example, entering %ers in the owner s last name field on a search page will return all records where the owner s last name is Peters, Peterson, Anderson, etc. In most cases, you will want to enter as much information as you know about the record you are looking for in order to narrow your search results. In other cases you may want to enter fewer search criteria to cast a broader net. One Instance calling for a more general search is when you are searching to ensure that a record does not already exist before adding it. Search text entered in text boxes can be either full or partial and is not case sensitive. NetDMR will return all records with text that starts with the text entered in the corresponding search field. For example, entering peters in the owner s last name field on a search page will return all records where the owner s last name is Peters, Peterson, Petersen, etc. 1.6.4.2. List Pages List pages are used to display the results of a search. You can choose an item from the displayed list to perform an action on. A sample list page is shown in Figure 1-13. 15

Figure 1-13: Sample List Page Search results are normally presented in a table that lists up to ten records in most cases. If more than 10 records are returned, you can navigate through the list by: Clicking to display the next page of records. Clicking to view the previous page of records. Clicking to display the last 10 records. Clicking to display the first 10 records. Clicking the View All link to show all records in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 records at a time. You can click on any underlined column title to sort the records by that column in ascending or descending order. 1.7. Resources for More Information For more information, contact ICIS User Support by telephone or e-mail at: Phone: 202-564-7756 e-mail: netdmr@epa.gov 16

Chapter 2. Managing Your Account This section provides information on how to manage your NetDMR account. Topics include: Creating an account Searching for available permits Requesting view or edit access Viewing an account Editing an account Unlocking an account Resetting a password Retrieving a forgotten User name Retrieving a forgotten password 2.1. Creating an Account Figure 2-1 shows the NetDMR page for creating a new account. Note that Regulatory Administrators accounts will be set up by the NetDMR System Administrator, and Permit Administrator accounts are established by Regulatory Administrators or other Permit Administrators. 17

Figure 2-1: NetDMR Create Account Page First time users can access the NetDMR Create Account page to create their own accounts by following these steps: 1. From the NetDMR Welcome page, click on the pick list to select the Regulatory Authority for your Permit: 2. Click on. 3. At the NetDMR Login page, click on or. 4. Fill out the required information on the Create a NetDMR Account page: Enter your e-mail address, and re-enter the e-mail address to confirm Choose whether to use your e-mail address as your User name (recommended) or create your own User name and enter that User name Enter your first name Enter your last name Enter your 10 digit telephone number as xxx-xxx-xxxx Enter the name of the organization you 18 Refer to Section 1.4 for a description of NetDMR User Types and the functionality available to them.

are affiliated with Choose your User Type ( Permittee Users are permitted facility staff; Data Provider Users are lab or contractor staff; and Regulatory Users are state, tribe, or EPA staff.) Select 5 or more security questions from the drop down list and enter an answer for each question selected. 5. Click on to process your account request, click on to blank out all fields on this page, or click on to return to the NetDMR Login page. 6. If NetDMR notifies you that data errors were found: Fix the problem indicated in red text next to the field with problems. 7. The Verify NetDMR Account Request page will appear: Confirm that the information is correct on this page, then click on the account or click on to return to the Create New Account page. to establish 8. At the Confirm NetDMR Account Request page click on to finalize the request. 9. A confirmation page will appear. Read the message, then Click on. 10. You will receive an e-mail from NetDMR to the e-mail account you provided requesting you to complete your account which will activate it. Click on the hyperlink provided in this e-mail to open the Complete NetDMR Account Creation Process page shown in Figure 2-2. You have only 60 days from the day you request your account to activate your account. 19

Figure 2-2: NetDMR Complete Account Creation Process Page 11. Answer the security question, create a password for your account, and enter the password a second time. 12. Click on to complete the account creation process and activate your account, or click on to return to the NetDMR Welcome page. 13. If the answer to your secret question is wrong, the password does not meet the rules or the two passwords differ, NetDMR will display an error message indicating what the problem was. 14. Re-enter the correct information and click on to complete the account creation process and activate your account, or click on to return to the NetDMR Welcome page. 15. The NetDMR Account Created page will appear. 16. Click on in the upper left corner or on this page to log into NetDMR. 2.1.1. General Information Rules When entering account information, NetDMR applies data checking rules. A summary of these account rules is provided in Figure 2-3 below. Account Information E-mail address Username First Name Last Name Organization Rules Only letters, numbers, @,., and _ are allowed. Must contain the @ symbol. Must be unique. You must have access to this e-mail account. Only letters, numbers, @,., and _ are allowed. Only letters, numbers, @,., and _ are allowed. Only letters, numbers, @,., and _ are allowed. Only letters, numbers, @,., and _ are allowed. 20

Account Information User Type Telephone Number Security Questions and Answers Rules Permittee User = permitted facility or lab staff Data Provider = organization that provides DMR data to NetDMR Regulatory User = state, tribe, EPA Regional or EPA HQ staff Must be in xxx-xxx-xxxx format. All security questions must be different. All security answers must be different. Security Answers are case sensitive. Choose security answers that are easy to remember as you will need to know them to create an account, edit your account, and retrieve forgotten passwords and User names, and sign DMRs. Figure 2-3: New Account Data Checking Rules 2.2. Searching for Available Permit Ids In order to view or enter DMR data for a permit into the National Installation of NetDMR, the permit must be present within the system. You can check whether any of your permits are available for DMR reporting by following the instructions below. You do not have to create a NetDMR account before you can check on the status of your permits. 1. Click on on the NetDMR Login page. 2. Enter the permit Id to search for: 3. Click on. 4. NetDMR will display a message if the permit does not exist. Reenter the permit ID if it was incorrectly entered or contact the NetDMR Regulatory Administrators for your Regulatory Authority to request the permit be added to NetDMR: 5. If the permit exists in NetDMR, you will see a message telling you it is available for reporting: 21

2.3. Requesting View or Edit Access After a Permittee or Data Provider account has been created, they are able to request access to view permit, DMR and COR information stored within Until the first Signatory NetDMR using the Request Access to Permits and Privilege is granted for a permit, no Associated DMRs page shown in Figure 2-4. Only view/edit access or privileges can be Permittees or Data Providers with an Edit Role may requested for that permit. edit DMRs, only Permittee Users may request a Permit Administrator or Signatory Role and only Permittee Users with a Signatory role may submit DMRs for a permit within NetDMR. Figure 2-4: Request Access to Permits and Associated DMRs Page The steps for a Permittee requesting a view, edit, Permit Administrator or Signatory role for a permit, or a Data Provider requesting a view or edit role for a permit using this page are: 1. Log into NetDMR by selecting the NetDMR Instance, then entering your User ID and password for that Instance. 2. Click on at the top of any NetDMR Home page and the Request Access to Permits and Associated DMRs page will appear. 3. Enter the 9 character Permit Id that you would like to have access to. 4. Click on. 5. If the Permit Id is for a permit that is not stored in NetDMR Instance an error message is displayed. 6. Check to make sure what you entered is a valid Permit ID and re-enter it. If it is a valid Permit ID this message indicates that the permit is not stored in NetDMR. Log out of 22

NetDMR, contact your NetDMR Instance Administrator and have he or she add the permit into NetDMR, then perform the steps above after the NetDMR Instance Administrator notifies you the Permit ID is now in NetDMR. 7. If you have already requested access to this permit NetDMR will display this message on the page. Enter another permit ID that you do not currently have access for. 8. Click in the box next to Roles, then click on View: 9. Click on. 10. If you did not choose a Role an error message is displayed. Repeat steps 6 and 7 above. 11. Check to make sure the request has been added to the Access Requests table at the bottom of the page, then click on. 12. If the wrong Permit ID or Role was selected on this table, click on next to the Permit ID to delete request from this table. 13. Repeat steps 3 11 above for each different Permit ID you need access for. 14. Review the information displayed on the page, then click on. Your view and edit access requests will be forwarded to the appropriate Administrator for approval. NetDMR will send a notification message to the e-mail address associated with your account after the Administrator approves or denies your request. 2.4. Viewing an Account You can access the data that you provided when you created your NetDMR account including your security questions and all permits you have access to by logging into NetDMR and clicking 23

on 2-5. in the upper left corner of the page. The My Account page is shown in Figure Figure 2-5: My Account Page The five security questions you selected when you created your account can be displayed by clicking on in the Selected Security Questions section. The answers to these questions are not displayed but they can be changed when editing your account. You can hide the questions by clicking on. At the bottom of the page is the My Permits section. My Permits includes a list of all permits that a user has requested access to, the access rights and status of the access requests, the date of the request for when an action was taken as well as the ability to print the Subscriber Agreements associated with the permit. Up to ten permits will be displayed by default. If more than 10 permits are associated with your account, you can navigate through the list by: Clicking to display the next page of permits. Clicking to view the previous page of permits. Clicking to display the last 10 permits. Clicking to display the first 10 permits. Clicking the View All link to show all permits in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 permits at a time. 24

You can click on the Permit column title to sort the Permits in ascending or descending order. To view the Subscriber Agreement for a Signatory request listed in this table, click on within the Signatory s row to display the Subscriber Agreement in a separate window. 2.5. Editing an Account All NetDMR Users are able to revise their e-mail address, NetDMR user name, first name, last name, telephone number and organization on the Edit Account page as shown in Figure 2-6. In addition, you can request changes to your permit access rights, modify your security questions and answers, and lock your accounts using the steps that follow. Any changes must be confirmed and saved. 25

Figure 2-6: My Account Page 1. Log into NetDMR and click on in the upper left corner of the page. 2. Click on within the My Account page. 3. Make changes by entering data in any of the General Account Information fields except User Type and Delete Access Rights in the My Permits section, changing security questions and answers, changing your password, or locking your account in the Lock Your Account section (refer to subsections below for details). Although there is a Delete Access Rights column, only a Permit Administrator may delete access rights to their permit(s). 4. Review your changes to confirm they are correct. 26

5. Click on, or click on to cancel changes and return to the My Account page. 6. Answer the Security Question and provide your current password. 2.5.1. Request Access Rights Change You can delete access rights to the permits you currently have access to by clicking on the empty checkboxes in the Delete Access Rights column within the My Permits table next to the permits to delete. Click on a checked box to unselect a permit. Click any underlined column title to sort the permits in ascending or descending order by the information in that column. 2.5.2. Security Questions and Answers You can change your Security Questions and Answers by clicking on to display your security questions or to hide the list of security questions. To change a question, click on the drop down arrow and click on the question. To change an answer, simply type the answer in the box under the question. 2.5.2.1. Reset Security Questions A Regulatory Authority Administrator may have you reset your security questions and answers if they discover your account has been compromised. If this is the case, your account will be suspended and you will receive an email notifying you of the change. If you try to log into NetDMR you will be prompted to reset your password or security questions: Contact your Administrator to get the secret answer to use for resetting your questions, then follow these steps to change your security questions and answers: 1. Click on the hyperlink within your security reset email notification: 2. The Reset Account Credentials page will appear: 27

Type the secret answer provided to you by your Regulatory Administrator into the Enter a temporary question answer box. 3. Select the first question from the Question 1 drop down box and type in an answer for the question. 4. Repeat Step 3 for each of the remaining questions. 5. Click on to save your security questions and answers. 6. If you did not provide the correct answer, select security questions or provide answers an error message will appear: Repeat steps 2 through 5. 7. You will receive confirmation that your security questions have been reset: 8. Click on the here to access the login page hyperlink to log into NetDMR. You will receive an email notifying you that your account has been reset: 2.5.3. Change Password You can change your password by entering a new password and then reentering it in the space provided. Be sure to enter a new password that is not the same as the 10 most recent passwords you ve used. 28

2.5.3.1. Reset Password A Regulatory Authority Administrator may have you reset your password if you are having problems logging in or if they discover your account has been compromised. If this is the case, your account will be suspended and you will receive an email notifying you of the change. If you try to log into NetDMR you will be prompted to reset your password or security questions: Follow these steps to change your password: 1. Click on the hyperlink within your security reset email notification: 2. The Complete NetDMR Password Reset Request page will appear: 3. Type in the secret answer for the question displayed. 4. Enter a new password that is not the same as the previous password. 5. Re-enter the new password. 6. Click on to save your new password. 7. If you did not provide the correct answer to the question or your password is invalid an error message will appear: Repeat steps 3 through 6. 8. You will receive confirmation that your password has been reset: 29

9. Click on the here to access the login page hyperlink to log into NetDMR. 2.5.4. Lock Account If you need to inactivate your account for a period of time you can lock your account by clicking on the empty checkbox in the Lock Your Account section. If you do not want to lock your account and the box is checked, click on the checked box to avoid locking your account. If you lock your account, the next time you attempt to log into the National Instance of NetDMR the Locked Account page will display. Follow these steps to unlock a locked account: 1. Answer the security question that is displayed. 2. Click on. If you respond correctly to the security question you will be directed back to the NetDMR Login page to log into your account. 2.6. Unlocking Your Account If you have locked your account in order to inactivate it for a period of time or a Regulatory Administrator locked your account due to security issues, you will receive an e-mail notifying you that your account is locked. The next time you attempt to log into the National Instance of NetDMR the Locked Account page will display as shown in Figure 2-7. Figure 2-7: Locked Account Notification Page Contact your Regulatory Authority by clicking on and calling the telephone number or sending an e-mail to the address specified in the Regulatory Authority Contact page Figure 2-8. Figure 2-8: Regulatory Authority Contact Page 30

After the Regulatory Authority unlocks your account NetDMR will notify you with an email containing a link. Navigate to the link to display a page confirming your account has been unlocked and follow these steps: 1. Answer the security question that is displayed. 2. Click on. If you respond correctly to the security question you will be directed back to the NetDMR Login page to log into your account. 2.7. Resetting a Password NetDMR passwords expire after 6 months and will display the Expired Password page after you log in with an expired password. Use this page to reset your expired password by: 1. Answering the security question. 2. Entering your current password. 3. Entering a new password twice. 4. Clicking on. Be sure to enter a new password that is not the same as the 10 most recent passwords you ve used. You may also reset your password at any time by using the My Account page. To do this: 1. Log into NetDMR and click on in the upper left corner of the page. 2. Click on within the My Account page. 3. Enter a new password and then reenter it in the spaces provided within the Change Your Password section. 4. The Confirm Account Edits page will appear. Answer the Security Question and provide your old password. 5. Click on to proceed, or click on to cancel changes and return to the My Account page. 6. If the security question answer or old password is incorrect, NetDMR will display the error message shown below. Enter your answer and old password again. 7. If the security answer and old password are correct, NetDMR will display this confirmation message: 2.8. Retrieving a Forgotten User Name If you have forgotten your User Name, follow these steps to recover it: 1. Navigate to the NetDMR Welcome page, select your Regulatory Authority, and click on. 31

2. Click on on the NetDMR Login page. 3. Enter the e-mail address you used to create your NetDMR account in the box provided: 4. Click on to continue, or click on to return to the NetDMR Login page. 5. If you provided an e-mail address that NetDMR does not recognize NetDMR will display a message that your User Name could not be found: Perform steps 3 4 again making sure to use the correct e-mail address for the Regulatory Authority you selected. Otherwise, one of your security questions will be displayed: 6. Answer the security question that is displayed. 7. Click on to continue, or click on to return to the NetDMR Login page. 8. If the answer to your secret question is incorrect, NetDMR will display an error message: Otherwise, NetDMR will display your User Name: 32

2.9. Retrieving a Forgotten Password If you have forgotten your NetDMR password, follow these steps to recover it: 1. Navigate to the NetDMR Welcome page, select your Regulatory Authority, and click on. 2. Click on on the NetDMR Login page 3. Enter the e-mail address you used to create your NetDMR account in the box provided: 4. Click on to continue, or click on to return to the NetDMR Login page. 5. If you provided an e-mail address that NetDMR does not recognize NetDMR will display a message that your e-mail address could not be found: Perform steps 3 4 again making sure to use the correct e-mail address for the Regulatory Authority you selected. Otherwise, one of your security questions will be displayed: 6. Answer the security question that is displayed. 7. Click on to continue, or click on to return to the NetDMR Login page. 8. If the answer to your secret question is incorrect, NetDMR will display an error message: Otherwise, you will receive an e-mail from NetDMR to the e-mail account you provided. Click on the hyperlink provided in this e-mail to access the Complete the NetDMR Password Reset Request page. 9. Answer the security question. 33

10. Enter a new password that is different than the last 10 passwords you specified for your account. 11. Enter the new password again. 12. Click on. 2.10. Disabled Accounts A locked account is different than a disabled account. A user s account is disabled if he/she enters their password incorrectly three times or enters three incorrect responses to security questions. If a user disables their account by entering their password incorrectly three times, the user can enable their account and request a password reset by responding correctly to a security question, then logging into NetDMR. If a user forgets the responses to his/her security question, he/she must contact the Regulatory Administrators directly and request a reset of the security questions. 34

Chapter 3. Regulatory Administrators Procedures Regulatory Administrators manage a single NetDMR Instance containing DMRs for one State agency, one Tribe, or one EPA Region comprising multiple states. A System Administrator must assign one or more Regulatory Administrators for the Instance when it is created, then Regulatory Administrators can approve other new Regulatory Administrators requests from Regulatory Users using the Manage Access Request functionality. Regulatory Administrators are responsible for: managing Regulatory User requests and user accounts assisting Permit Administrators with managing External Permittee and Data Provider User requests requesting basic permit and empty slot DMR requests from ICIS viewing, validating, repudiating and downloading CORS viewing permits, users, suspect and raw logs, network activity requesting access to view partially completed DMRs to assist Permittee and Data Providers as needed. Figure 3-1 shows the Regulatory Administrators Home page. Details for Regulatory Administrators on how to perform tasks using this page are provided in the next sections. 35

Figure 3-1: Regulatory Administrator Home Page Up to ten User Requests will be displayed by default in each of these tables. If more than 10 User Requests are associated with this permit or have pending requests, you can navigate through the list by: Clicking a page number link to go to a specific page of results. Clicking the green forward arrow to display the next page of User Requests. Clicking the green back arrow to view the previous page of User Requests. Clicking the double green forward arrow icon to display the last 10 User Requests. Clicking the double green back arrow icon to display the first 10 User Requests. Clicking the View All link to show all Users in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 Users at a time. You can click any underlined column title to sort the User Requests in ascending or descending order by the information in that column. 36

3.1. Managing Access Requests You can approve or deny NetDMR access requests for your Instance using the Manage Access Requests functionality on the Regulatory Administrators Home page. The types of access requests you can approve or deny include: Signatory Access Requests Regulatory Administrators Access Requests Regulatory User View Access Requests You can also approve or deny Permittee and Data Provider Edit and View requests; however these requests should only be managed if a Permit Administrator asks for your assistance. If a Permittee or Data Provider needs assistance filling out a DMR, you can request Partial DMR access to the DMR from your Request Access page. However, only Permit Administrators may approve partial DMR requests. When managing access requests, details on the User can be viewed on the View User Account Details page shown in Figure 3-2 by clicking on in the View Details column next to the User. Click on to modify the user s account information or click on to return to the Pending Access Requests tables of the Regulatory Administrators Home page. Figure 3-2: View User Account Details Page 37

3.1.1. Approve/Deny Signatory Requests In order to submit DMRs to ICIS using NetDMR, a Permittee must print off the Subscriber Agreement form generated by NetDMR at the time they request a Signatory role for one or more permits, sign the Subscriber Agreement in ink, and mail it to your Agency. You should never approve a Signatory request before you have the requestor s signed Subscriber Agreement. Signatories should not be approved until your Agency has received the Subscriber Agreement. There may be times when you have a change in your Agency s mailing address or the person who should receive Subscriber Agreements at your Agency is reassigned. The System Administrator can make these changes to your Instance so future Subscriber Agreements will display the new mailing information for new Signatory requests in your Instance. If one of your Signatories changes their name they will need to change their name in NetDMR and print off a new Subscriber Agreement with their new name displayed, then sign and mail it into your Agency. Once you have a signed Subscriber Agreement, follow the directions below to approve or deny permit signatory access requests from Permittee and Data Provider users: 1. Log into your NetDMR account as a Regulatory Administrator. The Regulatory Administrators Home page will be displayed with pending Internal and External User Access Requests displayed. If you are already logged in as a Regulatory Administrator and the Access Requests are not displayed, click on under the Manage tab OR Search by Permit ID (See Section 3.6 for instruction of searching permits). 2. Scroll down to the Pending Access Requests External Signatory table at the bottom of the page. 3. Click on in the Respond to Request column next to the desired user. You can click any underlined column title to sort the users in ascending or descending order by the information in that column. The Process Subscriber Agreement page is displayed: 38

4. Enter the Subscriber Agreement Number for this permit and click Submit. The Process Subscriber Agreement Details page (Figure 3-3) is displayed: Figure 3-3: Process Subscriber Agreement Details Page 5. If you would like to view an electronic version of the Subscriber Agreement and Agreement number, click on. Note that the Agreement that you see will differ from the same document signed by the Signatory if you changed any of your Subscriber Agreement contact information for your Instance recently. Because this electronic document may slightly differ from the original and is missing the Signatory s signature it cannot be used as a substitute for the original. 6. Close the Print Subscriber Agreement page by clicking to close the window or tab. 7. On the Process Subscriber Agreement Details page, scroll down to the Signatory Requests table and locate the permit that you would like to approve or deny for this user. To approve signatory access for the user, locate the row for the permit of interest and click on to place a check the box under the Approve column. To deny signatory access for the user, locate the row for the permit of interest and click on to check the box under the Deny column. After denying an access request, you must enter a reason in the text box under the Comment column for that permit. The electronic version of a Subscriber Agreement is not a substitute for the original, signed Subscriber Agreement mailed in by a Signatory. You may enter a comment when approving a request, but you must enter a comment when you deny a request. 39

8. Click on to save your changes, or click on to cancel your changes and return to the Regulatory Administrators Home page. 9. Review your access changes on the Confirm Subscriber Agreement Responses page to verify they are correct: 10. Click on. to save your changes, or click on to cancel your changes and return to the Process Subscriber Agreement Details page. 11. The Subscriber Agreement Confirmation page will appear: 12. You will be returned to the Regulatory Administrators Home page and the Users you approved or denied will no longer appear in the Pending Access Requests External Signatory table. Instead of typing in a Subscriber Agreement Number you can copy it from the electronic version of the requestor s subscriber agreement and paste it into the Subscriber Agreement Number on the Process Subscriber Agreements page. To do this, search for the permit and click on the printer icon in the Subscriber Agreement column of the requestor within the Users and Roles table. The Subscriber Agreement will appear in a separate window with the Subscriber Agreement Number listed in the upper right corner. 40

3.1.2. Managing Regulatory User Access Requests Regulatory User staff at your Agency with a View role may request to become a Regulatory Administrator to your NetDMR Instance. Follow the directions below to approve or deny access requests from your Regulatory Users. 1. Log into your NetDMR account as a Regulatory Administrator. The Regulatory Administrators Home page will be displayed with pending Internal and External User Access Requests displayed. If you are already logged in as a Regulatory Administrator and the Access Requests are not displayed, click on under the Manage tab OR Locate the user of interest in the table (see Section 3.7 for instructions on Searching Users). You can click any underlined column title to sort the users in ascending or descending order by the information in that column. 2. Scroll down to the Pending Access Requests Internal table at the bottom of the page. 3. To approve signatory access for the user, locate the row for the permit of interest and click on to checkmark it under the Approve column. 4. To deny access for the user, locate the row for the permit of interest and click on to checkmark it under the Deny column. After denying an access request, you must enter a reason in the text box under the Comment column for that permit. 5. Click on to save your changes, or You may enter a comment when approving a request, but you must enter a comment when you deny a request. click on to cancel your changes and return to the Regulatory Administrators Home page. 6. Review your access changes on the Confirm Access Requests page to verify they are correct: 7. Click on. to save your changes, or click on to cancel your changes. 8. You will be returned to the Regulatory Administrators Home page and the Users you approved or denied will no longer appear in the Pending Access Requests Internal table. 41

3.1.3. Managing External Permittee and Data Provider User Access Requests If requested by a Permit Administrator, you can approve or deny Permit Administrator role requests, and Permittee and Data Provider Edit or View role requests. Note that these requests should only be managed if a Permit Administrator requests assistance. Follow the directions below to approve or deny Permittee and Data Provider User role access requests: 1. Log into your NetDMR account as a Regulatory Administrator. The Regulatory Administrators Home page will be displayed with pending Internal and External User Access Requests displayed. If you are already logged in as a Regulatory Administrator and the Access Requests are not displayed, click on under the Manage tab OR Search by Permit ID (see Section 3.6 for instructions on searching permits). 2. Scroll down to the Pending Access Requests External table at the bottom of the page. 3. To approve signatory access for the user, locate the row for the permit of interest and click on to checkmark it under the Approve column. 4. To deny access for the user, locate the row for the permit of interest and click on to checkmark it under the Deny column. After denying an access request, you must enter a reason in the text box under the Comment column for that permit. 5. Click on to save your changes, or You may enter a comment when approving a request, but you must enter a comment when you deny a request. click on to cancel your changes and return to the Regulatory Administrators Home page. 6. Review your access changes on the Confirm Access Requests page to verify they are correct: 7. Click on. to save your changes, or click on to cancel your changes. 8. You will be returned to the Regulatory Administrators Home page and the Users you approved or denied will no longer appear in the Pending Access Requests External table. 42

3.2. Managing Your NetDMR Instance You can use the Manage Instance page (Figure 3-4) to view or customize the following settings associated with your Instance: General Information Agency Mappings System Administrator(s) Email Messages DMR Submission and Attachment Notification Recipients News and Notices Figure 3-4: Manage Instance Page 43

3.2.1. View Instance You can view detailed information about your NetDMR Instance by clicking on the Instance option under the Manage menu. The Manage Instance page will display information about your Instance as described in the next subsections. 3.2.1.1. General Information Details The General Information section displays the information that you specified when you created this Instance, including: Instance Name. Time Zone. Number of secret questions a user must answer. Password change frequency requirements. Whether the Instance allows multiple signatory requests in a Subscriber Agreement Whether Permit Administrators are required to have signatory roles for their permits. Current status of the Instance. Postal code to be used for submittals. Instance contact information. 3.2.1.2. Agency Mappings Refer to Appendix D for detailed information on Agency Maps. The Agency Mappings table on the Manage Instance page displays the selected Permit Prefixes and associated Agency Type Codes. Up to six Agency Maps will be displayed by default. If more than six Agency Maps are associated with your Instance, you can navigate through the list by: Clicking to display the next page of Agency Maps. Clicking to view the previous page of Agency Maps. Clicking to display the last 6 Agency Maps. Clicking to display the first 6 Agency Maps. Clicking the View All link to show all Agency Maps in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 6 Agency Maps at a time. You can click the Permit Prefix of Agency type code column title to sort the Agency Mapping rows in ascending or descending order. 3.2.1.3. System Administrators The System Administrators table displays the User Name, Affiliation, Email Address, and Phone Number of each System Administrator. 44

3.2.1.4. Custom Email Message The contents of the message to be appended to all emails sent to accounts by the NetDMR regarding the Instance. 3.2.1.5. DMR Submission and Attachment Notifications A table listing email addresses that are to be sent submission acknowledgements any time a DMR is submitted by NetDMR on behalf of the Instance and whether attachments were included with the DMR. 3.2.1.6. Custom News and Messages A table containing one or more news items displayed on the home page of the Instance. If a recipient is not receiving DMR submission and attachment notifications and their address in this table is accurate, 3.2.2. Edit Instance As a Regulatory Administrator you can set up or change the following settings for your Instance: 45

Figure 3-5: Edit Instance Page Whether Permit Administrators are required to have signatory roles for their permits Email Messages DMR Submission and Attachment Notification Recipients News and Notices To do this, access the Edit Instance page shown in Figure 3-5 by: 1. Logging into your NetDMR account as a Regulatory Administrator. 2. Clicking on Instances under the Manage tab. 3. Clicking on Some Instance settings displayed on the Edit Instance page can only be edited by the System Administrator and are displayed to the Regulatory Administrators for informational purposes. Any changes you make must be confirmed and saved. When all changes have been made, follow these directions to store your edits: 1. Click on to proceed with the changes, or click on to return to the Manage Instance page. 2. Click on to finalize your changes and return to the Manage Instance page with this message: or click on to return to the Manage Instance page. 46

3.2.2.1. Editing General Instance Information In the General Information section, you can modify whether all Permit Administrators must also be Signatories or not. To change this setting: Click on the Are permit administrators required to have signatory roles for their permit? pick list and click on Yes to have NetDMR automatically assign a Signatory role to each Permit Administrator role request that you approve, or click on No to have NetDMR assign only a Permit Administrator role when you approve them. 3.2.2.2. Editing the Custom Email Message NetDMR automatically generates and sends emails to users for a variety of actions, including completing the account creation process, when user access rights are granted or denied, and after requesting to reset a password. You can create a message to append to the end of each email in the Custom Email section. To create this message or edit an existing message, enter the text directly into the box that is provided: For example, you may want to provide more specific contact information in the event of a problem: Please email netdmr@state.gov or call the helpline at 800-555-1234 for assistance. 3.2.2.3. Editing DMR Submission and Attachment Notifications You can specify a set of recipients that will be notified by email each time a DMR is submitted for this Instance and whether attachments were included with the DMR: If one or more emails have already been specified a table will be displayed under this box showing existing addresses. Otherwise, the table will appear after the first new email address is added. 47

To add a recipient to the table, type the email address of the recipient in the Enter another email address box and click on. If the email address already exists it will not be saved and an error message will appear. To remove an email address from the list: 1. Click on in the Delete column of the row for that email address. A confirmation window will appear: 2. Click on to remove the email address, or click on to keep the email recipient in the table. 3.2.2.4. Edit Custom News and Notices You can create one or more News and Notices that will be displayed on the NetDMR Login page for your Instance: If one or more news items or notices have already been specified a table will be displayed under this box showing existing items. Otherwise, the table will appear after the first new item is added. To add a new item, type the text for the news item or notice in the News/Notice box and click on. If the news item already exists it will not be saved and an error message will appear: To change the order of items in the table, click on next to an item to move it under the item below it, or click on next to an item to move it over the item above it. To remove an item from the list: 1. Click on in the Delete column of the row for that item. A confirmation window will appear: 48

2. Click on to remove the item, or click on to keep the item in the table. 3.3. Manage Agreements After you complete your internal review of a hard copy Subscriber Agreement mailed to you by a Signatory, you can approve or deny the Signatory requests using the Manage Agreement functionality. To respond to the signatory requests, follow these steps: 1. Log into your NetDMR account as a Regulatory Administrator. 2. Click on under the Manage tab. The Process Subscriber Agreement page is displayed: 1. Enter the Subscriber Agreement Number on the signatory request you are reviewing. The Subscriber Agreement number can be found in the upper right corner of the agreement. 2. Click on.. 3. If you do not enter the Subscriber Agreement Number or enter an invalid Subscriber Agreement Number, an error message will be displayed: Enter a valid Subscriber Agreement Number. 4. The Process Subscriber Agreement Details page is displayed: 49

13. If you would like to view an electronic version of the Subscriber Agreement and Agreement number, click on. Note that the Agreement that you see will differ from the same document signed by the Signatory if you changed any of your Subscriber Agreement contact information for your Instance recently. Because this electronic document may slightly differ from the original and is missing the Signatory s signature it cannot be used as a substitute for the original. 14. On the Process Subscriber Agreement Details page, scroll down to the Signatory Requests table and locate the permit that you would like to approve or deny for this user. To approve signatory access for the user, locate the row for the permit of interest and click on to place a check the box under the Approve column. To deny signatory access for the user, locate the row for the permit of interest and click on to check the box under the Deny column. After denying an access request, you must enter a reason in the text box under the Comment column for that permit. The electronic version of a Subscriber Agreement is not a substitute for the original, signed Subscriber Agreement mailed in by a Signatory. You may enter a comment when approving a request, but you must enter a comment when you deny a request. 15. Click on to save your changes, or click on to cancel your changes and return to the Regulatory Administrators Home page. 16. Review your access changes on the Confirm Subscriber Agreement Responses page to confirm that they are correct: 50

17. Click on. to save your changes, or click on to cancel your changes and return to the Process Subscriber Agreement Details page. 18. The Subscriber Agreement Confirmation page will appear: 19. You will be returned to the Regulatory Administrators Home page and the Users you approved or denied will no longer appear in the Pending Access Requests External Signatory table. 3.4. COR Functionality All Regulatory Users can search, view, and download CORs. Only Regulatory Administrators can repudiate, validate, and verify the signature for CORs. When a Signatory signs and submits a DMR, NetDMR creates a unique COR for that DMR. The COR is defined in the Cross-Media Electronic Reporting Rule as follows (70 FR 59880 October 13, 2005, specifically Subpart A, Section 3.3): Copy of record means a true and correct copy of an electronic document received by an electronic document receiving system, which copy can be viewed in a human-readable format that clearly and accurately associates all the information provided in the electronic document with descriptions or labeling of the information. A copy of record includes: (1) All electronic signatures contained in or logically associated with that document; (2) The date and time of receipt; and 51

(3) Any other information used to record the meaning of the document or the circumstances of its receipt. Each NetDMR installation has an RSA 1024 bit asymmetric key that is used for digital signatures. NetDMR will use its private key to digitally sign the CORs. The signature will be executed against a message digest created from the COR using the FIPS 140-2 hashing algorithm. For details on this process go to these web sites: Federal Information Processing Standards (FIPS)-approved algorithms for generating Message Digest: http://www.csrc.nist.gov/cryptotoolkit/tkhash.html FIPS-approved algorithms for generating/verifying digital signatures: http://www.csrc.nist.gov/cryptotoolkit/tkdigsigs.html 3.4.1. Search CORs Regulatory Administrators can search, view, download, repudiate and validate CORs by searching on any combination of Permit ID, Monitoring Period End Date Range, Signatory Name and e-mail Address, Facility Name, Permitted Feature Number, Discharge Number, Discharge Description, Confirmation Number, and if the COR has been repudiated. To do this: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators Home page will be displayed. OR While logged into NetDMR, click on in the gray Search tab. 2. The COR Search page will be displayed: 52

Enter data into one or more of the fields on this page using these guidelines: Permit ID Enter all or a portion of the permit ID. For example, entering a permit ID of 'al' would return CORs for all Alabama permits. Signatory First Name Enter all or a portion of the signatory first name. For example, entering a first name of 'jo' would return 'John' and Joanne'. Signatory Last Name Enter all or a portion of the signatory first name. For example, entering a last name of 'mi' would return 'Smith' and Miller'. Facility Name Enter all or a portion of a facility name. For example, entering a co' would return 'Company A' and ABC Incorporated'. Monitoring Period End Date Range - Enter the end date for the monitoring period end date range using the mm/dd/yyyy format or select the appropriate start and end dates from a calendar by clicking the calendar icon next to each text box. Clicking in the Search CORs section will open an expanded Search CORs page and display the following additional search criteria: Signatory User Name Enter all or a portion of the signatory user name. For example, entering a last name of 'mi' would return 'JaneSmith and John.Miller'. Signatory Email Enter all or a portion of a signatory email address. For example, entering a last name of 'mi' would return 'Jane.Smith@FacilityA.com' and John.Miller@FacilityB.com'. Permitted Feature Number Enter all or a portion of a permitted feature number. For example, entering S' would return permitted features S and SUM'. Discharge Number Enter all or a portion of a discharge number. Discharge Description Enter all or a portion of a discharge description. For example, entering a storm' would return 'Storm Water' and Storm Water Action Levels'. Confirmation Number enter the complete submission confirmation number for the DMR/COR you wish to view (NetDMR generates a unique confirmation number for your submission). Include Repudiated CORs? click to check the box if you would like to include repudicated CORS that match your search criteria in your search results. 3. Click on to display the results or to return to the Regulatory Administrators Home page. CORs that match your criteria are displayed on the COR Search Results page: 53

Figure 3-6: COR Search Results Page 3.4.2. Viewing COR Search Results Up to ten CORs will be displayed by default in the COR Search Results page. If more than 10 CORs are returned, you can navigate through the list by: Clicking a page number link to go to a specific page of results. Clicking the green forward arrow to display the next page of CORs. Clicking the green back arrow to view the previous page of CORs. Clicking the double green forward arrow icon to display the last 10 CORs. Clicking the double green back arrow icon to display the first 10 CORs. Clicking the View All link to show all CORs in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 CORs at a time. You can click any underlined column title to sort the CORs in ascending or descending order by the information in that column. 3.4.3. Refining the COR Search If there are more CORs returned than you expected, click on to display a search page where you can narrow your search using Signatory, discharge, confirmation and repudiated COR criteria: 54

3.4.4. Performing a New COR Search To view another set of CORs, click on to display a Search page and re-enter data search using Signatory, discharge, confirmation and repudiated COR criteria: 3.4.5. Downloading a COR The COR generated by NetDMR when a DMR is signed and submitted is a master COR zip file that includes the following: All of the user-provided data for the DMR. The legal certification statement displayed to the user during signing process. The public key certification in the form of Hashes of any files that were attached to the DMR. NetDMR uses FIPS 140-2 to generate all hash values. This is the current approved FIPS certified standard. Metadata about any attached files (e.g., name, type, etc.). 55

A submission receipt, which includes the following: The DMR submission confirmation number The hash of the data document The date and time of the DMR submission Identifying information from the signing account, including: the user s full name, account login, email address, and hashed password (at time of signing), and IP address of the submitting computer. The first step in viewing downloaded CORs is to open the master COR file that you downloaded extract all zipped file contents into a directory of your choosing. Each of these extracted zipped files is a COR. Open one of these files and extract the three main files along with any attachments that were included with the DMR. The three main files are as follows: dmrsubmission.xml this file contains all of the user entered data for the DMR submission. DischargeMonitoringReport.xsl this is a stylesheet that will format the dmrsubmission.xml file to look like the NetDMR DMR View page for easy viewing when viewed in a web browser. submissionreceipt.xml this file documents when the DMR was submitted, by whom, and with what electronic hashing algorithm. It is easy to view the DMR data is to view the dmrsubmission.xml file using a web browser such as Microsoft Internet Explorer or Mozilla Firefox. When opened in this way, the web browser will automatically format the data based on the stylesheet file dischargemonitroingreport.xsl. Note that the web browser will NOT be able to locate the stylesheet if the user does not first unzip all of the contents of the zip file into the same directory. The user may choose to also view the XML data directly in any text editor of their choice. Be sure to extract dmrsubmission.xml and dischargemonitoringreport.xsl from a COR zipped file into the same directory. Any attachments that were uploaded for the DMR prior to signing will also be included in the COR files. These files have the names supplied by the person who uploaded them and can be in almost any format. NetDMR will not convert these files so it is up to the user to figure out how best to work with these files. CORs are downloaded from the COR Search Results page. To download these files: 1. Click on within the row for the COR desired to display a checkmark in the box, then click on. If you did not select a COR, this window will appear to remind you to select a COR: 56

Click on to return to the Search COR Results page and repeat Step 1. 2. You will be prompted to save the CORs as a zipped file: Click on to save the file to a location you designate, or click on to return to the Search COR Results page. 3. The Windows Save As dialog will appear. Click on the Save In drop down box and select a location to save the file into, then click on to save the file to a location you designate, or click on to return to the Search COR Results page. 4. The Download complete dialog will appear. 57

5. Click on to open the zipped COR file, to display the contents of the Folder, or to return to NetDMR. 3.4.6. Viewing a COR CORs can be selected from the CORs Search Results page for viewing. The COR can be downloaded or repudiated, its certification statement can be viewed, its signature can be viewed and verified, and the signature public key can be displayed while viewing it. See Appendix C for details on validating COR signatures. Start by clicking on in the row next to the desired COR and the View COR Details page shown in Figure 3-7 is displayed. 58

Figure 3-7: View COR Details Page 3.4.6.1. Viewing the COR Certification Statement This feature displays the submitter name and user type, permit ID, facility name, permitted feature, discharge number, monitoring period end date, submission date, submission time and the verbage of the certification statement that the Signatory agreed to when signing and submitting the DMR for this COR. View the COR s Certification Statement from the View COR Details page by: 1. Clicking on and the COR Certification Statement page will appear: 2. Click on to return to the View COR page. 59

3.4.6.2. Downloading the COR Refer to Section 3.4.5 for details on how to download and view a COR. 3.4.6.3. Viewing the COR Signature The View COR Signature link allows users to see the digital signature used when the COR was Signed and Submitted. This signature is used in the Validate COR function for Internal Administrators. The COR Signature is a hash value of the COR XML file that is encrypted with the Signing Certificate s Private Key. View the COR s Signature from the View COR Details page by: 1. Clicking on and the COR Signature page will appear: 2. Click on to return to the COR Signature page. 3.4.6.4. Downloading the COR Public Signature Key The COR Signature Public Key is consistent throughout the NetDMR Installation. The COR Signature Public Key is taken from the NetDMR Signing Certificate which can be chosen by a System Administrator on the Edit Settings screen. The COR Signature Public Key is included in the COR Details as a way for the user to download and save the information. The COR Signature Public Key would be used in a situation where the NetDMR Application has become inaccessible or the Signing Certificate used at the time of submission has been removed from the Application. The Public Key could be used with the hashing algorithms to prove a saved COR is the same as the original submission COR. The COR Signature Public Key can also be used to prove which NetDMR installation has submitted a COR. Download the COR s Public Signature Key from the View COR page by: 1. Clicking on. 2. You will be prompted to save the Signature Key as a zipped file: 60

Click on to save the file to a location you designate, or click on to return to the Search COR Results page. 3. The Windows Save As dialog will appear. Click on the Save In drop down box and select a location to save the file into, then click on location you designate, or click on page: to save the file to a to return to the Search COR Results 4. The Download complete dialog will appear. 5. Click on to open the zipped COR file, to display the contents of the Folder, or to return to NetDMR. 61

3.4.6.5. Verifying the COR Public Signature The Verify COR Signature function re-signs the COR being viewed using the NetDMR Signing certificate. This value is then matched against the COR Signature value in the database from the original submission. The signing process takes the COR file being viewed, creates a hash value, encrypts the hash using the private key, and compares the result against the value saved from the original submission; essentially running the Validate COR function with the input being the viewable COR. This function proves to the user that the COR in the original submission is in fact what is being displayed on the screen. Click at the top of the View COR Details page to open the Verify COR Signature page with a message indicating whether the verification was successful and the following information about the COR: Permit ID Monitoring Period End Date Signatory Name Signatory User Name Signatory Email Facility Name Permitted Feature Confirmation Number Verify the COR s Public Signature Key from the View COR Details page by: 1. Clicking on and the Verify COR Signature page will appear: 2. Click on to return to the View COR page. 62

3.4.6.6. Returning to the COR Search Results Page Return to the COR Search Results page by clicking on. 3.5. Repudiating the COR If a signatory contacts you and indicates that he/she has reason to believe their account has been compromised and erroneous and unauthorized DMRs have been submitted on their behalf, you should first lock the users account and then repudiate the CORs for the unauthorized DMRs that were submitted. If a signatory submitted an erroneous DMR and wants to revise it, they should use the Correct DMR functionality instead of the Repudiate functionality - Repudiating the COR removes it from ICIS. Repudiate a COR from the View COR Details page by: 1. Logging into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. 2. Clicking on 3. The Repudiate COR page will appear: 4. Enter the reason for the repudiation in the Comments field. 5. Click on to continue with repudiating the COR, or click on to return to the View COR Details page. 6. An error message will display if nothing was entered into the Comments field: Repeat Steps 3 and 4. 63

7. NetDMR will send a batch file with instructions delete the COR out of ICIS-NPDES and will return you to the View COR Details page. 8. Lock the Signatory s account using the instructions in Section 3.8.2 3.6. Searching and Viewing Permits You can retrieve and view information about a specific permit such as User Roles and Subscriber Agreements from the Regulatory Administrators Home page or from the Search Permit ID page shown in Figure 3-8. Figure 3-8: Search Permit ID Page 3.6.1. Search for Permits Follow these directions to search for a permit from the Regulatory Administrators Home Page. 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators home page will be displayed. Click on in the gray Search tab OR click on in the Search page. 2. Type the nine-digit permit ID, and click on. 3. If the permit is available in NetDMR, the View Permit Details page is displayed. See the next section for instructions on how to use this page, OR If an invalid permit ID is entered or the permit ID is not in NetDMR, the following message will be displayed: Re-enter a valid Permit ID and click on until NetDMR is able to display the permit. 4. When finished viewing the permit, click on to return to the Search Permit ID page. 64

3.6.2. View Permit Details After you search for and NetDMR locates the permit of interest, the View Permit Details page as shown in Figure 3-9 is displayed. Figure 3-9: View Permit Details Page The following information is shown on this page: Permit Details Permit ID Facility Name Permittee Address Users and Roles Table User Name Organization User Type Role Role Status Link to the view details about the user Link to Subscriber Agreement (if applicable) Pending Access Requests External Signatory Table Name User Name Requested Date Link to view details about the user Link to Approve or Deny Request. Note: See Section 3.1.1 for instructions on Approving/Denying Signatory Requests. Pending Access Requests External Table Name User Name User Type 65

Requested Role Approve/Deny Comment Link to view details about the user. Note: See Section 3.1.1 for instructions on Approving/Denying External Permittee and Data Provider Requests. Up to ten users requests will be displayed by default in each of these tables. If more than 10 users are associated with this permit or have pending requests, you can navigate through the list by: Clicking a page number link to go to a specific page of results. Clicking the green forward arrow to display the next page of Users. Clicking the green back arrow to view the previous page of Users. Clicking the double green forward arrow icon to display the last 10 Users. Clicking the double green back arrow icon to display the first 10 Users. Clicking the View All link to show all Users in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 Users at a time. You can click any underlined column title to sort the Users in ascending or descending order by the information in that column. 3.7. Searching for Users You can search for users from the Search Users page shown in Figure 3-10 to view and edit their account information. Figure 3-10: Search Users Page 3.7.1. User Search Follow these directions to search for a user from the Regulatory Administrators Home Page: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators Home page will 66 You can leave Search fields blank to return all users. You can also enter partial information for any criteria. For example, entering a in the User Name criteria would return both AdamSmith and KatieJones@state.xx.us

be displayed. Click on in the gray Search tab OR click on in the Search page. 2. Enter criteria for the user and click search. You can search by: User First Name User Last Name User Name Email Permit ID Facility Name 3. Click on. 4. If the User is found the Search results will be displayed on the User Search Results page. See the next section for instructions on how to utilize the information on this page, OR If a User is not in NetDMR, the following message will be displayed: Re-enter valid data in any of the User search fields and click on until NetDMR is able to display the User. 5. If the list is too large, click on and re-enter the First Name, Last Name, User Name, Email Address, Permit ID or Facility Name, then click on to return less results or click on to return to the User Search Results page. 6. If another search is desired, click on and re-enter the First Name, Last Name, User Name, Email Address, Permit ID or Facility Name, then click on to return less results or click on to return to the User Search Results page. 7. When finished viewing the User information, click on any tab to view that page. 3.7.2. User Search Results The User Search Results page (Figure 3-11) displays a table with the list of roles for each user that match your search criteria. This table includes the following information: 67

This table includes the following information: Figure 3-11: User Search Results Page First Name Last Name User Name Facility Permit ID User Type Access Rights Email Link to View User Details Link to Edit User Details Up to ten User roles will be displayed by default in each of these tables. If more than 10 User roles are associated with this permit or have pending requests, you can navigate through the list by: If the user you are searching for is not displayed in the User Search Results table, you can click on Refine Search or New Search on the upper right. Both links will take you back to the Users Search page where you can refine your search by adding additional search criteria or starting a new search. Clicking a page number link to go to a specific page of results. Clicking the green forward arrow to display the next page of User roles. Clicking the green back arrow to view the previous page of User roles. Clicking the double green forward arrow icon to display the last 10 User roles. Clicking the double green back arrow icon to display the first 10 User roles. Clicking the View All link to show all User roles in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 User roles at a time. You can click any underlined column title to sort the User roles in ascending or descending order by the information in that column. 3.7.3. View User Account Details After locating a user of interest on the User Search Results page, click on of their row to display the View User Account Details page: in the View column 68

Figure 3-12: View User Account Details Page This page displays the following information about the user: General Account Information First Name Last Name User Name Email Telephone Number Organization Type of User 69

Selected Security Questions The five security questions that the user selected when creating his/her account is displayed; however the user s responses to the questions are not displayed Permit and Roles Table Permit ID Facility Name Access Rights Access Status Signatory Role History Table Permit ID Facility Name Change Date Change Type Changed By Comment Up to ten users requests will be displayed by default in each of these tables. If more than 10 users are associated with this permit or have pending requests, you can navigate through the list by: Clicking a page number link to go to a specific page of results. Clicking the green forward arrow to display the next page of Users. Clicking the green back arrow to view the previous page of Users. Clicking the double green forward arrow icon to display the last 10 Users. Clicking the double green back arrow icon to display the first 10 Users. Clicking the View All link to show all Users in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 Users at a time. You can click any underlined column title to sort the Users in ascending or descending order by the information in that column. While on this page, either click on to Edit the User Account information using the instructions in the next section, or click on to return to the User Search Results page. 3.8. Editing and Managing User Accounts You can manage and edit general account information, lock and unlock an account, change security questions and answers, and approve, deny and revoke roles for the users associated with your Instance from the Edit User Account page or the View User Account Details page. 70

Figure 3-13: Edit User Account Page Up to ten permits the User has Roles for will be displayed by default. If more than 10 permits are associated with the User s account, you can navigate through the list by: Clicking the green forward arrow to display the next page of permits. Clicking the green back arrow to view the previous page of permits. Clicking the double green forward arrow icon to display the last 10 permits. Clicking the double green back arrow icon to display the first 10 permits. Clicking the View All link to show all permits in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 permits at a time. You can click on the Permit column title to sort the Permits in ascending or descending order. Access the Edit User Account page shown in Figure 3-13 for a specific user and edit User Information by following these steps: 1. Follow the instructions in Section 3.8 to display the Edit User Account page and click on, 71

OR Follow the instructions in Section 3.7.3 to display the desired User on the View User Account Details page and click on. 2. Edit general user information, lock or unlock the account, reset the password, reset the secret questions and approve, deny or revoke a role as described in the following subsections. 3. After completing your edits, click on to continue, or click on to return to the View User Account Details page. If you enter invalid information, Deny a role without entering a comment, or revoke a role without entering a comment an error message will appear: Fix your errors and click on to continue, or click on to return to the View User Account Details page. 4. Review your changes on the Confirm User Account Changes page to confirm that they are correct: 5. Click on on the Confirm User Account Changes page to finalize your edits, or click on to return to the Edit User Account page. 3.8.1. Edit General User Information You can modify the following information in the General User Account Information section: First Name Last Name User name Email Telephone Number Organization User Type and Regulatory Authority are displayed on this tab for informational purposes only. 72

3.8.2. Lock User Account A locked account is different than a disabled account. A user s account is disabled if he/she enters their password incorrectly three times or enters three incorrect responses to security questions. If a user disables their account by entering their password incorrectly three times, the user can enable their account and request a password reset by responding correctly to a security question. If a user forgets the responses to his/her security question, he/she must contact the Regulatory Administrators directly and request a reset of the security questions. If the current account status is unlocked and you would like to lock it, click on Lock Account field to blank it out. 3.8.3. Unlock User Account If the current account status is locked and you would like to unlock it, click on Unlock Account field to remove the checkmark from it. next to the next to the 3.8.4. Reset User Password You cannot create a password for the user. Instead to reset the User s password, click on to the Reset Account Password field. next NetDMR will send the user an email notifying them of the password reset: When the user clicks on the link in their email they will be taken to the Complete NetDMR Password Reset Request page where they must answer one of their secret questions and enter a new password twice: NetDMR will confirm the password was reset and send the user an email notifying them of the password reset. The user is now ready to log back into NetDMR. 73

3.8.5. Reset User Security Questions and Answers To reset User s Security Questions and Answers, click on the drop down in the Security Questions and Answers section and select Enter a temporary security question answer for the user to force a reset of the security questions from the list and type an answer into the box below. NetDMR will send the user an email notifying them of the security answer reset: You must contact the user by phone an inform him/her of the correct answer. When the user clicks on the link in their email they will be taken to the Reset Account Credentials page where they must provide the answer you provided, select questions and add responses for those questions: 74

NetDMR will confirm the security answers were reset and send the user an email notifying them of the security question reset. The user is now ready to log back into NetDMR. 3.8.6. Approve User Access Requests To approve a pending access request, click on in the Approve column. 3.8.7. Deny User Access Requests To deny a pending access request, click on Comment column. in the Deny column and enter a reason in the 3.8.8. Revoke User Access Requests To revoke access to a permit, click on in the Revoke column and enter a reason for the revocation in the Comment column. 3.9. View Logs Regulatory Authority Administrators should periodically perform a fraud analysis using the logs for their Instance to determine if an account has been compromised. If it is determined that a compromise has occurred, the affected account will need to be locked, preventing the user from signing edmrs, and the user will be contacted to address the situation. See Appendix B for more information on performing fraud analysis. As a Regulatory Administrator, you can access the following logs: Suspect Logs Raw Logs Instructions for viewing these logs are described in detail within the next subsections. 3.9.1. Viewing Suspect Logs The Suspect Analysis process analyzes NetDMR logs such as the login and submission logs to identify irregularities associated with user accounts that may be a trigger for further investigation. 75

Figure 3-14: Suspect Logs Page The irregularities that are flagged include the following: inconsistent login IP addresses, multiple overlapping login attempts, multiple overlapping login attempts from different IP addresses, and irregular submission pattern. The frequency with which the suspect analysis process is run is set by the system administrator, and may be monthly, quarterly, semi-annual, or yearly. Follow these directions to view the contents of a suspect log: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators Home page will be displayed. 2. Click on under the View menu. 3. Click in the drop down box next to Suspect Analysis Run and select a specific date of suspect analysis results to view: 4. Click on. The suspect analysis results are displayed at the bottom of the page and provide the following information: Suspect Analysis Run Date Log Range Analyzed User Name Irregularity Type Description Irregularity Type Description 76

Irregularity Type Inconsistent Login IPs Overlapping Login Attempts Overlapping Login Attempts with Different IPs Irregular Submission Pattern Description User has logged in using more than 10 different IP addresses during the analysis log range. Example: Number of IPs: 32 User had more than 10 overlapping login attempts within a 3 day span. Example: Date and time of first login in span: 08/01/07 2:24 pm. User had more than 5 overlapping login attempts using different IPs within a 3 day span. Example: Date and time of first login in span: 06/01/07 5:25 pm. Example: A higher than anticipated number of DMRs were submitted during the following month(s): January, 2007 (5); March 2007 (10) Up to 10 items in the log will be displayed by default in the Suspect Analysis Log table. If more than 10 items are recorded, you can navigate through the list by: Clicking the page number links to display other pages of 10 items at a time. Clicking the green forward arrow to display the next page of items. Clicking the green back arrow to view the previous page of items. Clicking the double green forward arrow icon to display the last 10 items. Clicking the double green back arrow icon to display the first 10 items. Clicking the View All link to show all items in the table on the same page with the default sort order applied. Clicking the View Partial link to return from the View All display back to viewing 10 items at a time with the default sort order applied. You can click any underlined column title to sort the items in ascending or descending order by the information in that column. 3.9.2. Viewing Raw Logs Raw logs provide access to the logs of the date and time following user activities that are tracked for your NetDMR Instance using the View Raw Logs page (Figure 3-15): Login attempts and results DMR Submissions Attempts to enable an account after being locked out Attempts to enable and expired password Attempts to reset a forgotten password Attempts to retrieve a forgotten username Attempts to edit account information 77

Figure 3-15: View Raw Logs Page Follow these directions to view information contained within one or more raw logs: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators Home page will be displayed. 2. Click on under the View menu. 3. Click on the Log drop down box to select a specific log to view: 4. Select the Date Range Start by clicking on and selecting a date, or enter a date in the box using the following format: mm/dd/yyyy. 5. Select the Date Range End by clicking on and selecting a date, or enter a date in the box using the following format: mm/dd/yyyy. 6. Click on to search for the log and display the results: 78

Any information available for the log you selected is displayed at the bottom of the View Raw Logs page and includes the following: Log selected Date Range selected The Submission logs display includes the following information in a table: Date of DMR Submission User Name Permit ID Permit Feature Number Limit Set Monitoring Period End Date Confirmation Number Indication of whether the submission was repudiated. The display for all other logs includes the following information in a table: Log Date UserID User Name Name IP Address (populated for Login Logs only) Login Result Up to 10 log items will be displayed by default in the table. If more than 10 items are available, you can navigate through the list by: Clicking the page number links to display other pages of 10 items at a time. Clicking the green forward arrow to display the next page of items. Clicking the green back arrow to view the previous page of items. Clicking the double green forward arrow icon to display the last 10 items. Clicking the double green back arrow icon to display the first 10 items. Clicking the View All link to show all items in the table on the same page with the default sort order applied. Clicking the View Partial link to return from the View All display back to viewing 10 items at a time with the default sort order applied. You can click any underlined column title to sort the items in ascending or descending order by the information in that column. 3.10. View Network Activity As a Regulatory Administrator, you can access the View Exchange Network Activity page by clicking on under the View menu. Regulatory Administrators can perform the following using the functionality on this page: 79

View Exchange Network Activity; Request Basic Permit Data Flow; Request DMR Information by Date Range; and Request Information for One DMR. Figure 3-16: View Network Activity Page 3.10.1. View Exchange Network Activity The View Exchange Network Activity table shows the transactions between NetDMR and the Exchange Network Node and displays the following information. NetDMR Activity Type General description of the activity, including: Basic Permit Data Request: retrieves permit identifying information and related dates such as permit ID, permit status, permitted facility name and location information, and permit effective and expiration dates. 80

Empty Slot Data Request: retrieves permitted features, limit sets, parameters, and limits for a DMR. DMR Submission: submits DMR transactions and retrieves and processes error and warning transactions. NetDMR Fields NetDMR ID NetDMR identifier for this transaction. NetDMR Created Date Date and time that the transaction was created. NetDMR Status - Current NetDMR status for the transaction, including: Pending: the transaction has been entered into the NetDMR queue for processing. Node: the transaction has been submitted to the node for processing and a node transaction ID has been returned Failed: the transaction failed. Completed: the transaction was successfully completed. Completed with errors: For DMR Submission transactions only, the DMR was processed but errors or warnings were encountered and returned from ICIS-NPDES. Cancelled: the transaction was submitted but remained pending for 48 hours; the transaction was cancelled. NetDMR Service Name of the Exchange Network service being utilized, including: NetDMR.GetBasicPermitInfo_v1.0: a Basic Permit Data Request. NetDMR.GetScheduledDMRsByDMR_v1.0: a type of Empty Slot Data Request. NetDMR.GetScheduledDMRsByDate_v1.0: a type of Empty Slot Data Request. ICIS-NPDES2: The DMR submission service. Links NetDMR Information: Click on to open a page and view the Agency Mapping requested from ICIS via the Basic Permit or Empty Slot Data Flow service request transaction: NetDMR Result: Click on to download a zipped file and view the XML file containing the results of data from ICIS via the Basic Permit, Empty Slot or DMR Submission service request transaction result file if status is Completed or Completed with Errors/Warnings. 81

NetDMR Log: Click on to open a page to view the log of the progress from ICIS via the Basic Permit, Empty Slot or DMR Submission service requests: Click on to close the NetDMR Information, Result or Log page and return to the View Exchange Network Activity page. Node Fields Node Transaction ID The identifier returned from the node for the service request. Node Transaction Status Current Node status of the request. Node Status Date The last date and time that the Node status was refreshed. Up to 10 Exchange Network transactions will be displayed in the table by default. If more than 10 transactions have occurred, you can navigate through the list by: Clicking the page number links to display other pages of 10 transactions at a time. Clicking the green forward arrow to display the next page of transactions. Clicking the green back arrow to view the previous page of transactions. Clicking the double green forward arrow icon to display the last 10 transactions. Clicking the double green back arrow icon to display the first 10 transactions. Clicking the View All link to show all items in the table on the same page with the default sort order applied. Clicking the View Partial link to return from the View All display back to viewing 10 transactions at a time with the default sort order applied. You can click any underlined column title on the Exchange Network Activity table page to sort the items in ascending or descending order by the information in that column. If you click to view details for a row in a table and then choose to return to the View Exchange Network Activity page, the first page of results will be displayed with the default sort applied. 3.10.2. Request Basic Permit Data Flow When an instance is created, NetDMR requests basic permit information from ICIS-NPDES using the Agency Maps as the selection criteria. After the initial request for Basic Permit occurs, NetDMR will request the data from ICIS-NPDES again every week for each Instance based upon their agency maps. See Appendix E for more information on refreshing permit data. ICIS will process NetDMR requests for permits on a nightly basis. Check NetDMR the next morning for your newly refreshed permits if you 82 requested a refresh of your permits.

Rather than wait one week, Regulatory Administrators are able to refresh basic permit data in NetDMR with ICIS-NPDES data at any time using the View Network Activity page. Follow the directions below to submit a request for NetDMR to refresh updated basic permit data: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators home page will be displayed. 2. Click on under the Vew menu. The View Exchange Network Activity page will be displayed. 3. Scroll down to the Request Basic Permit Data Flow section of the page. 4. Click on. 5. Click on on the Confirm Request for Basic Permit Data Flow page to send the request to ICIS, or click on to return to the View Exchange Network Activity page. 6. A message will appear confirming that your request has been sent to ICIS: ICIS will process your request overnight and return the refreshed data the next morning. 3.10.3. DMR Data Refreshes from ICIS-NPDES When the first Signatory for a permit is approved by a Regulatory Administrator, NetDMR requests one year s worth of anticipated DMRs or empty slot records from ICIS-NPDES. Each month after this, NetDMR requests another 2 month s worth of data to ensure that NetDMR always has at least one year s worth of empty slot records. The selection criteria for DMR data refreshes is based upon the date that the Signatory approval is granted, the monitoring period start date and, in the case of the initial pull, the monitoring period end date. See Appendix E for more information on refreshing DMR data. Rather than wait one month, Regulatory Administrators and Permit Administrators are able to DMR empty slot records in NetDMR with ICIS-NPDES data at any time. Regulatory Adminstrators can use the View Network Activity page using the instructions in Sections 3.10.4 and 3.10.5. Permit Administrators can use the Refresh DMRs hyperlink on the DMR Search Results page. ICIS will process NetDMR requests for DMRs on a nightly basis. Check NetDMR the next morning for your newly refreshed DMRs if you requested a refresh of your DMRs. 3.10.4. Request DMR Information by Date Range Requesting DMR Information by Date Range triggers an Empty Slot Data Flow (ESDF) refresh request to ICIS for a specific permit ID for a specific set of dates. The ESDF retrieves the following information for each DMR: 83

Permit ID Permit Status Code Permittee and Facility Name and Address Major Status Indicator DMR Recipient and Mailing Address State/Region text Permit Dates Original issue date Most recent issue date Effective date Expiration date Federal Grant Indicator Permitted Feature Permitted Feature Identifier, Permitted Feature Type Code Limit Set Designator and Name Monitoring Period Start and End Dates Report Due Date Limit Information Parameter Season Identifier Monitoring Location Type Effluent Trading Partner Indicator Frequency of Analysis Code Sample Type Code Quantity Unit Code Numeric Conditions - statistical basis and limit value for each quantity, loading, quality, or concentration 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators home page will be displayed. 2. Click on under the Vew menu. The View Exchange Network Activity page will be displayed. 3. Scroll down to the Request DMR Information by Date Range section of the page. 4. Click on and select the Monitoring Period Start Date Range or type in the Monitoring Period Start Date Range in this format: mm/dd/yyyy. OR Click on and select the Monitoring Period End Date Range or type in the Monitoring Period End Date Range in this format: mm/dd/yyyy. 5. Enter the Permit(s) of interest (separate each with a comma). 6. Click on. You may only request up to 14 consecutive months of DMRs at a time. 84 You can enter either a Monitoring Period Start Date or End Date range, or you may enter ranges for both dates.

If dates are not entered, dates are missing, or there are no permit IDs an error message will appear: Repeat Steps 4 6 entering a valid start date range, a valid end date range, and one or more permit IDs. 7. Click on on the Confirm Request for DMR Information page to send the request to ICIS, or click on to return to the View Exchange Network Activity page. 8. A message will appear confirming that your request has been sent to ICIS: ICIS will process your request and return the refreshed data the next morning. 3.10.5. Request Information for One DMR Follow the directions below to submit a request for information for one DMR: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. The Regulatory Administrators Home page will be displayed. 2. Click on under the View menu. The View Exchange Network Activity page will be displayed. 3. Scroll down to the Request DMR Information for One DMR section of the page. 4. Enter a valid Permit ID. If an invalid permit ID is entered an error message will appear: Re-enter a valid Permit ID. 5. Click on. 6. NetDMR will retrieve all Permitted Features or outfalls for the permit. Click in the Permitted Feature drop down box and click on the desired Permitted Feature. 7. Click on. 8. NetDMR will retrieve all Limit Sets for the Permitted Feature. Click in the Limit Set drop down box and click on the desired Limit Set. 9. Click on. 10. NetDMR will retrieve all available DMR Monitoring Period End Dates for the Limit Set. Click in the Monitoring Period End Date drop down box and click on the desired selection. 11. Click on. 85

12. The Confirm Request for DMR Information for One DMR page will appear: Click on on the Confirm Request for DMR Information page to send the request to ICIS, or click on to return to the View Exchange Network Activity page. 13. A message will appear confirming that your request has been sent to ICIS: 3.11. Requesting Access to Partial DMRs Regulatory Administrators may request access to view an in-progress DMR in order to assist a permittee having difficulty in completing it. A Permit Administrator of the Instance where the DMR resides is responsible for approving partial DMR access requests. To request access for viewing a DMR in progress: You may only view a partial DMR. Only a Permittee or Data Provider may edit the DMR. 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. 2. Click on the hyperlink at the top of the Regulatory Authority Home page. 3. In the Request Access to Partial DMRs section, enter the Permit ID you would like to access. 4. Click on to check to see if the permit exists in NetDMR. 5. If an invalid permit ID is entered or the permit does not exist in NetDMR an error message will appear: 86

Repeat Steps 3 and 4 using a valid permit ID. 6. Otherwise, NetDMR prompts you for a Permitted Feature. Click in the box next to Permitted Feature, then click on a Permitted Feature Number to select it. 7. Click on to check to see if there are Limit Sets in NetDMR for the Permitted Feature. 8. Click in the box next to Limit Set, then click on a Limit Set Number to select it. 9. Click on to check to see if there are Monitoring Period End Dates for any partial DMRs in NetDMR for the Permitted Feature. 10. Click in the box next to Monitoring Period End Date, then click on an End Date to select it. 11. Click on 12. A new row will appear in the Summary of Access Requests table containing the selected Permit ID, Permitted Feature, Limit Set and Monitoring Period End Date: 13. Repeat Steps 3 11 to add each Partial DMR desired. 14. Click on within a row to remove that partial DMR request from the table. 15. The Confirm Access Requests window will appear: Click on to submit the access request, or click on to return to the Internal User Access page. 16. A message will appear notifying you your request was submitted: A Permit Administrator in charge of the DMR must approve or deny your request. When your request has been approved or denied, you will receive an email notifying you. If your request was denied the reason for denying it will be included in the email. 3.11.1. View Partial DMRs Once you have approval from a Permit Administrator for your partial DMR request, you can view it using the Partial DMRs page shown in Figure 3-17. 87

Figure 3-17: Partial DMRs Page To display this page: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory Administrator account. 2. Click on under the View menu. 3. The Partial DMRs page displays the following for each DMR that you have been granted access to Permit ID Permitted Feature Discharge Number Monitoring Period End Data View DMR 4. Click on to open the desired DMR to display it and be able to talk the Permittee through any steps necessary to fill it out correctly. Note that the DMR displayed will let you enter data into the fields but there are no buttons allowing you to save this data only Permittees or Data Providers can edit DMRs. 3.12. Validate CORs The Validate COR functionality allows Internal Administrators to check if a Copy of Record (COR) provided by a Permittee User matches the corresponding COR stored in NetDMR, or if it has been altered. To validate a COR, you must upload a zip file that contains only a single COR and enter its COR signature. The COR will only be validated if the hash of the COR being uploaded and its COR Signature matches the hash of the original COR and its COR Signature saved in the database. The COR Signature used during the process can be found in the submission acknowledgement email that you received for this DMR submission (or can be retrieved by viewing a COR and clicking on the "View COR Signature" hyperlink). Note that if you downloaded multiple CORs or are using Internet Explorer 6, the individual COR zip files may have been combined into a larger zip. Verify that you are downloading a single COR zip file by checking that the zip file name starts with the Permit ID, followed by permitted feature, and monitoring period end date, followed by other dates. See Appendix C for more details on validating CORs. Follow these steps to Validate the COR: If the Permittee or Data Provider changes the DMR while you are viewing it you must close the DMR and repeat Step 4 to see their changes. 88

1. Login to your NetDMR Regulatory Administrators account. 2. Click on under the Validate menu. The Validate COR page will appear: 3. Click on and navigate to the location where the COR zip that you would like to validate is stored. The Windows dialog box will open: 4. Click on to upload the file, or click on to return to the Validate COR page. 5. If no fields were entered or a file other than a zipped file is uploaded an error message will appear: Repeat Steps 3 and 4 above. 6. Enter the digital signature for that DMR submission. Note: The digital signature is included in the submission acknowledgement email that you received for this DMR submission or can be retrieved by viewing a COR and clicking the View COR Signature. 7. Click on to validate the COR, or click on to cancel to return to the Regulatory Administrators Home page. 8. If an invalid digital signature is entered, an error message will appear: 89

9. NetDMR validates the COR by rehashing the COR zip file you uploaded and comparing the new hash with the hash contained in the signature that you entered. NetDMR then displays a message indicating whether the validation was successful. Chapter 4. Regulatory View User Procedures All Regulatory Users can search, view, and download CORs. Only Regulatory Administrators can repudiate, validate, and verify the signature for CORs. When a Signatory signs and submits a DMR, NetDMR creates a unique COR for that DMR. The COR is defined in the Cross-Media Electronic Reporting Rule as follows (70 FR 59880 October 13, 2005, specifically Subpart A, Section 3.3): Copy of record means a true and correct copy of an electronic document received by an electronic document receiving system, which copy can be viewed in a human-readable format that clearly and accurately associates all the information provided in the electronic document with descriptions or labeling of the information. A copy of record includes: (1) All electronic signatures contained in or logically associated with that document; (2) The date and time of receipt; and (3) Any other information used to record the meaning of the document or the circumstances of its receipt. Each NetDMR installation has an RSA 1024 bit asymmetric key that is used for digital signatures. NetDMR will use its private key to digitally sign the CORs. The signature will be executed against a message digest created from the COR using the FIPS 140-2 hashing algorithm. For details on this process go to these web sites: Federal Information Processing Standards (FIPS)-approved algorithms for generating Message Digest: http://www.csrc.nist.gov/cryptotoolkit/tkhash.html FIPS-approved algorithms for generating/verifying digital signatures: http://www.csrc.nist.gov/cryptotoolkit/tkdigsigs.html Regulatory Users can access CORs, from their home page shown in Figure 4-1, or by clicking on the CORs hyperlink located on the gray Search and View tab to display the Search CORs page shown in Figure 4-2. 90

Figure 4-1: Regulatory User Home Page Regulatory Users can also view Permits, Users, and partial DMRs by clicking on the hyperlinks on the home page or gray Search and View tab. Regulatory Users may not approve Signatory requests and repudiate CORs unless they request to become a Regulatory Administrator. Figure 4-2: Search CORs Page 91

The following subsections describe the steps for performing Regulatory User tasks. 4.1. Searching CORs Regulatory Users can search for and view CORs, view a COR s certification statement or public signature key, and download one or more CORs or the public signature key for a particular COR by searching on any combination of Permit ID, Signatory Name, Facility Name, Monitoring Period Start and End Date Range, Signatory Email Address, Permitted Feature Number, Discharge Number, Discharge Description, Confirmation Number, and CORs that have been repudiated. To do this: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory User account. The Regulatory User Home page will be displayed. OR While logged into NetDMR, click on in the gray Search tab. 2. Enter data into one or more of the fields on the Regulatory User Home page or Search CORs page using these guidelines: Permit ID Enter all or a portion of the permit ID. For example, entering a permit ID of al would return Alabama. Signatory First Name Enter all or a portion of the signatory first name. For example, entering a first name of 'jo' would return 'John' and Joanne'. Signatory Last Name Enter all or a portion of the signatory first name. For example, entering a last name of 'mi' would return 'Smith' and Miller'. Facility Name Enter all or a portion of a facility name. For example, entering a co' would return 'Company A' and ABC Incorporated'. Monitoring Period End Date Range - Enter the start and end dates for the monitoring period end date range using the mm/dd/yyyy format or select the appropriate start and end dates from a calendar by clicking the calendar icon next to each text box. Clicking Advanced Search in the top right corner of the Search CORs tab will open the Search CORs page and display the following additional search criteria: Signatory User Name Enter all or a portion of the signatory user name. For example, entering a last name of 'mi' would return 'JaneSmith and John.Miller'. Signatory Email Enter all or a portion of a signatory email address. For example, entering a last name of 'mi' would return 'Jane.Smith@FacilityA.com' and John.Miller@FacilityB.com'. Permitted Feature Number Enter all or a portion of a permitted feature number. For example, entering S' would return permitted features S and SUM'. Discharge Number Enter all or a portion of a discharge number. Discharge Description Enter all or a portion of a discharge description. For example, entering a storm' would return 'Storm Water' and Storm Water Action Levels' Confirmation Number enter the complete submission confirmation number for the DMR/COR you wish to view (NetDMR generates a unique confirmation number for your submission). 92

Include Repudiated CORs? click to check the box if you would like to include repudicated CORS that match your search criteria in your search results. 3. Click on to display the results or to return to the Regulatory User Home page. CORs that match your criteria are displayed on the COR Search Results page: Figure 4-3: COR Search Results Page 4.1.1. Viewing COR Search Results Up to ten CORs will be displayed by default in the COR Search Results page. If more than 10 CORs are returned, you can navigate through the list by: Clicking a page number link to go to a specific page of results. Clicking the green forward arrow to display the next page of CORs. Clicking the green back arrow to view the previous page of CORs. Clicking the double green forward arrow icon to display the last 10 CORs. Clicking the double green back arrow icon to display the first 10 CORs. Clicking the View All link to show all CORs in the table on the same page. Clicking on the View Partial link to return from the View All display back to viewing 10 CORs at a time. You can click any underlined column title to sort the CORs in ascending or descending order by the information in that column. 4.1.2. Refining the COR Search If there are more CORs returned than you expected, click on to display a search page where you can narrow your search using Signatory, discharge, confirmation and repudiated COR criteria: 93

4.1.3. Performing a New COR Search To view another set of CORs, click on to display a Search page and re-enter data search using Signatory, discharge, confirmation and repudiated COR criteria: 4.1.4. Downloading a COR The COR generated by NetDMR when a DMR is signed and submitted is a master COR zip file that includes the following: All of the user-provided data for the DMR. The legal certification statement displayed to the user during signing process. The public key certification in the form of Hashes of any files that were attached to the DMR. NetDMR uses FIPS 140-2 to generate all hash values. This is the current approved FIPS 140-2 certified standard. Metadata about any attached files (e.g., name, type, etc.). 94

A submission receipt, which includes the following: The DMR submission confirmation number The hash of the data document The date and time of the DMR submission Identifying information from the signing account, including: the user s full name, account login, email address, and hashed password (at time of signing), and IP address of the submitting computer. The first step in viewing downloaded CORs is to open the master COR file that you downloaded extract all zipped file contents into a directory of your choosing. Each of these extracted zipped files is a COR. Open one of these files and extract the three main files along with any attachments that were included with the DMR. The three main files are as follows: dmrsubmission.xml this file contains all of the user entered data for the DMR submission. DischargeMonitoringReport.xsl this is a stylesheet that will format the dmrsubmission.xml file to look like the NetDMR DMR View page for easy viewing when viewed in a web browser. submissionreceipt.xml this file documents when the DMR was submitted, by whom, and with what electronic hashing algorithm. It is easy to view the DMR data is to view the dmrsubmission.xml file using a web browser such as Microsoft Internet Explorer or Mozilla Firefox. When opened in this way, the web browser will Be sure to extract automatically format the data based on the stylesheet dmrsubmission.xml and file dischargemonitoringreport.xsl. Note that the dischargemonitoringreport.xsl from a web browser will NOT be able to locate the COR zipped file into the same stylesheet if the user does not first unzip all of the directory. contents of the zip file into the same directory. The user may choose to also view the XML data directly in any text editor of their choice. Any attachments that were uploaded for the DMR prior to signing will also be included in the COR files. These files have the names supplied by the person who uploaded them and can be in almost any format. NetDMR will not convert these files so it is up to the user to figure out how best to work with these files. CORs are downloaded from the View COR Details page. Do this by: 1. Clicking on 2. You will be prompted to save the CORs as a zipped file: 95

Click on to save the file to a location you designate, or click on to return to the Search COR Results page. 3. The Windows Save As dialog will appear. Click on the Save In drop down box and select a location to save the file into, then click on location you designate, or click on page. to save the file to a to return to the Search COR Results 4. The Download complete dialog will appear: 5. Click on to open the zipped COR file, to display the contents of the Folder, or to return to NetDMR. 96

4.1.5. Viewing a COR A COR can be selected from the CORs Search Results page for viewing. You can view the COR s certification statement, download the COR, view the COR s signature and download the COR s public signature key from this page. Start by clicking on in the row next to the desired COR and the View COR Details page shown in Figure 4-4 is displayed. Figure 4-4: View COR Details Page 4.1.5.1. Viewing the COR Certification Statement View the COR s Certification Statement from the View COR Details page by: 1. Clicking on and the COR Certification Statement page will appear: 97

2. Click on to return to the View COR page. 4.1.5.2. Downloading the COR The COR generated by NetDMR when a DMR is signed and submitted is a master COR zip file that includes the following: All of the user-provided data for the DMR. The legal certification statement displayed to the user during signing process. The public key certification in the form of Hashes of any files that were attached to the DMR. NetDMR uses FIPS 140-2 to generate all hash values. This is the current approved FIPS 140-2 certified standard. Metadata about any attached files (e.g., name, type, etc.). A submission receipt, which includes the following: The DMR submission confirmation number The hash of the data document The date and time of the DMR submission Identifying information from the signing account, including: the user s full name, account login, email address, and hashed password (at time of signing), and IP address of the submitting computer. The first step in viewing downloaded CORs is to open the master COR file that you downloaded extract all zipped file contents into a directory of your choosing. Each of these extracted zipped files is a COR. Open one of these files and extract the three main files along with any attachments that were included with the DMR. The three main files are as follows: dmrsubmission.xml this file contains all of the user entered data for the DMR submission. DischargeMonitoringReport.xsl this is a stylesheet that will format the dmrsubmission.xml file to look like the NetDMR DMR View page for easy viewing when viewed in a web browser. submissionreceipt.xml this file documents when the DMR was submitted, by whom, and with what electronic hashing algorithm. It is easy to view the DMR data is to view the dmrsubmission.xml file using a web browser such as Microsoft Internet Explorer or Mozilla Firefox. When opened in this way, the web browser 98

will automatically format the data based on the stylesheet file dischargemonitoringreport.xsl. Note that the web browser will NOT be able to locate the stylesheet if the user does not first unzip all of the contents of the zip file into the same directory. The user may choose to also view the XML data directly in any text editor of their choice. Be sure to extract dmrsubmission.xml and dischargemonitoringreport.xsl from a COR zipped file into the same directory. Any attachments that were uploaded for the DMR prior to signing will also be included in the COR files. These files have the names supplied by the person who uploaded them and can be in almost any format. NetDMR will not convert these files so it is up to the user to figure out how best to work with these files. CORs are downloaded from the View COR Details page. Do this by: 1. Clicking on 2. You will be prompted to save the CORs as a zipped file: Click on to save the file to a location you designate, or click on to return to the Search COR Results page. 3. The Windows Save As dialog will appear. Click on the Save In drop down box and select a location to save the file into, then click on to save the file to a location you designate, or click on to return to the Search COR Results page. 99

4. The Download complete dialog will appear: 5. Click on to open the zipped COR file, to display the contents of the Folder, or to return to NetDMR. 4.1.5.3. Viewing the COR Signature View the COR s Signature from the View COR Details page by: 1. Clicking on and the COR Signature page will appear: 2. Click on to return to the COR Signature page. 4.1.5.4. Downloading the COR Public Signature Key NetDMR uses asymmetric key cryptography for the digital signatures applied to CORs, This type of cryptography includes both a public key and a private key. NetDMR digitally encrypts and signs the COR with the private key, and decrypts the COR with the public key. Download the COR s Public Signature Key from the View COR page by: 1. Clicking on. 2. You will be prompted to save the Signature Key as a zipped file: 100

Click on to save the file to a location you designate, or click on to return to the Search COR Results page. 3. The Windows Save As dialog will appear. Click on the Save In drop down box and select a location to save the file into, then click on location you designate, or click on page. to save the file to a to return to the Search COR Results 4. The Download complete dialog will appear. 5. Click on to open the zipped COR file, to display the contents of the Folder, or to return to NetDMR. 101

4.1.5.5. Returning to the COR Search Results Page Return to the COR Search Results page by clicking on. 4.2. Search and View Permits Regulatory Users can view all Users having access to one permit along with their roles and Subscriber Agreements by using the Search Permit ID page shown in Figure 4-5. Figure 4-5: Search Permt ID Page The steps for searching permits for user access information are: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory User account. 2. Click on in the Search tab. 3. Enter the complete ID for the permit and click on. 4. If the permit ID is not complete or the permit could not be found in NetDMR an error message appears: Repeat Step 3 using a valid Permit ID. 5. The View Permit Details page will appear, allowing you to view information on Users having access to the permit. 102

6. Click on to display the View User Account page: 103

7. Click on to open a dialog window containing the Permitted Feature ID, Limit Set Designator and Monitoring Period End Date for the Permit s User: Click on to close the dialog window and return to the User Search Results page. 8. Click on to view the Subscriber Agreement for the Signatory Users. 4.3. Search and View Users Regulatory Users can view all permits one User has access to along with that User s roles and Subscriber Agreements for each permit by using the Search Users page shown in Figure 4-6. The electronic version of a Subscriber Agreement is not a substitute for the original, signed Subscriber Agreement mailed in by a Signatory. Figure 4-6: Search Users Page The steps for searching for user access information are: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory User account. 2. Click on in the Search tab. 3. Enter full or partial data into one or more of the fields and click on. 4. If no users could be found in NetDMR an error message appears: 104

Repeat Step 3 using valid data for the desired User(s). 5. The View User Details page will appear, allowing you to view information on User access for one or more permits: 6. Click on to display the View User Account page: 105

7. Click on to open a dialog window containing the Permitted Feature ID, Limit Set Designator and Monitoring Period End Date that the user has access to. Click on to close the dialog window and return to the User Search Results page. 8. Click on to view the Subscriber Agreement for Signatory Users. Note that the Agreement that you see will differ from the same document signed by the Signatory if you changed any of your Subscriber Agreement contact information for your Instance recently. Because this electronic document may slightly differ from the original and is m i s s The electronic version of a Subscriber Agreement is not a substitute for the i original, signed Subscriber Agreement mailed in by a Signatory. n g the Signatory s signature it cannot be used as a substitute for the original. 4.4. Requesting Partial DMR and Regulatory Administrator Access Regulatory Users may request access to view an in-progress DMR in order to assist a permittee having difficulty in completing it. In addition, Regulatory Users may request to be upgraded to a Regulatory Administrator. The Internal User Access Request page (Figure 4-7) is used for 106

requesting this access, and a Permit Administrator for the Instance where the DMR resides is responsible for approving or denying the request. Figure 4-7: Internal User Access Page 4.4.1. Regulatory Administrators Access Requests The steps for requesting access to become a Regulatory Administrator are: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory User account. 2. Click on in the Search tab. 3. Click on next to Request Internal Admin Privilege field to place a checkmark in the box: 4. Click on to submit the request. 5. The Confirm Access Request page will appear. Click on to proceed with the request, or click on to cancel the request and return to the Internal User Access page. 6. A message will appear notifying you that your access request has been submitted: 7. A Regulatory Administrator will approve or deny your request. If your request is approved, you will receive an e-mail stating: The following actions have been taken for your access requests. Role Id: Internal Admin 107

Status: Approved Comment: Release 3 testing. Internal Admin access. Thank you. Otherwise, the Regulatory Administrators will deny your request and you will receive an e-mail with a reason why the request was denied. 4.4.2. Partial DMR Access Request To request access for viewing a DMR in progress: 1. Log into NetDMR selecting the desired Regulatory Authority and using a Regulatory User account. 2. Click on in the Search tab. 3. In the Request Access to Partial DMRs section, enter the Permit ID you would like to access. 4. Click on to check to see if the permit exists in NetDMR. 5. If an invalid permit ID is entered or the permit does not exist in NetDMR an error message will appear: Repeat Steps 3 and 4 using a valid permit ID. 6. Otherwise, NetDMR prompts you for a Permitted Feature. Click in the box next to Permitted Feature, then click on a Permitted Feature Number to select it. 7. Click on to check to see if there are Limit Sets in NetDMR for the Permitted Feature. 8. Click in the box next to Limit Set, then click on a Limit Set Number to select it. 9. Click on to check to see if there are Monitoring Period End Dates for any partial DMRs in NetDMR for the Permitted Feature. 10. Click in the box next to Monitoring Period End Date, then click on an End Date to select it. 11. Click on 12. A new row will appear in the Summary of Access Requests table containing the selected Permit ID, Permitted Feature, Limit Set and Monitoring Period End Date: 13. Repeat Steps 3 11 to add each Partial DMR desired. 14. Click on within a row to remove that partial DMR request from the table. 15. The Confirm Access Request page will appear. Click on to submit the access request, or click on to return to the Internal User Access page. 16. A message will appear notifying you your request was submitted: 108

A Permit Administrator in charge of the DMR must approve or deny your request. When your request has been approved or denied, you will receive an email notifying you. If your request was denied the reason for denying it will be included in the email. 4.4.3. View Partial DMRs Once you have approval from a Permit Administrator for your partial DMR request, you can view it using the Partial DMRs page shown in Figure 4-8. To display this page: Figure 4-8: Partial DMRs Page 1. Login to your NetDMR Regulatory User account. 2. Click on under the View menu. 3. The Partial DMRs page displays the following for each DMR that you have been granted access to: Permit ID Permitted Feature Discharge Number Monitoring Period End Data View DMR 4. Click on to open the desired DMR to display it and be able to talk the Permittee through any steps necessary to fill it out correctly. Note that the DMR displayed will let you enter data into the fields but there are no buttons allowing you to save this data only Permittees or Data Providers can edit DMRs. 109