R 080001Z SEP 06
FM CMC WASHINGTON DC(UC)
TO AL MARADMIN(UC)
UNCLASSIFIED//
MARADMIN 425/06
MSGID/GENADMIN/CMC WASHINGTON DC C4//
SUBJ/TRANSITION OF CRYPTOGRAPHIC LOGON (CLO) EXCEPTION ACCOUNT
/MANAGEMENT RESPONSIBILITIES TO COMMAND INFORMATION ASSURANCE
/MANAGERS (IAM)//
REF/A/MSGID:GENADMIN/CMC WASHINGTON DC C4/300733ZMAR2006//
REF/B/MSGID:GENADMIN/MCNOSC/312307ZMAR2006//
REF/C/DESC:MCEN OPERATIONAL ADVISORY 022-06, R311217Z JUL 06/-/-//
NARR/REF A IS MARADMIN 155/06 WHICH PROVIDES MARINE CORPS POLICY
FOR IDENTIFICATION AND AUTHENTICATION TO UNCLASSIFIED USMC
NETWORKS.  REF B IS MCEN OPERATIONAL DIRECTIVE 044-06 WHICH
PROVIDED AMPLIFYING GUIDANCE FOR THE IMPLEMENTATION OF
CRYPTOGRAPHIC LOGIN WITHIN THE MCEN.  REF C IS MCEN OPERATIONAL
ADVISORY 022-06 WHICH PROVIDED NOTIFICATION TO MARINE CORPS
ORGANIZATIONS OF THE INTENT TO CONTINUE GOVERNMENT USE OF THE PKI
EXCEPTION MANAGEMENT TOOL.//
POC/RAY A. LETTEER/GS-15, MCEN DAA/IA DIVISION, C4, HQMC/-
/TEL:703-693-3490/TEL:DSN 223-3490/EMAIL:RAY.LETTEER@USMC.MIL//
GENTEXT/REMARKS/1. PURPOSE.  THE PURPOSE OF THIS MARADMIN IS TO
PROVIDE MARINE CORPS POLICY FOR STEADY STATE CLO EXCEPTION ACCOUNT
MANAGEMENT WITHIN THE USMC NMCI ENVIRONMENT.
2. BACKGROUND.  PER REF A, SOME USMC ACCOUNTS MAY BE IDENTIFIED AS
EXCEPTION ACCOUNTS AND WILL BE EXEMPT FROM CLO ENABLEMENT AND
ENFORCEMENT.  THE EXCEPTION ACCOUNT MANAGEMENT TOOL DEVELOPED BY
EDS TO MANAGE NMCI CLO EXCEPTION ACCOUNTS HAS DIRECT ACCESS TO
ACTIVE DIRECTORY THROUGH A WEB-BASED INTERFACE.  COMMAND PERSONNEL
CURRENTLY USE THIS TOOL TO MODIFY THE CLO EXCEPTION STATUS FOR NMCI
USER ACCOUNTS IN ACTIVE DIRECTORY.  PER REF B, WHEN THE TOOL WAS
INITIALLY IMPLEMENTED, COMMANDS WERE ALLOWED TO DESIGNATE PERSONNEL
TO INTERFACE WITH THE EXCEPTION MANAGEMENT TOOL.  MANY COMMANDS HAVE
DELEGATED THIS RESPONSIBILITY TO THEIR CUSTOMER TECHNICAL
REPRESENTATIVES (CTR).  AS DESCRIBED IN REF C, RESPONSIBILITY FOR
CONTINUED USE OF THE TOOL MUST BE TRANSITIONED TO COMMAND IAMS.    
3.  SCOPE. THIS POLICY APPLIES TO ALL USMC COMMANDS OBTAINING
SERVICES FROM NMCI.
4. POLICY.  DUE TO PERSONNEL SECURITY REQUIREMENTS ASSOCIATED WITH
ACCESS TO ACTIVE DIRECTORY, USMC COMMANDS WILL ASSIGN RESPONSIBILITY
FOR INTERFACING WITH THE CLO EXCEPTION ACCOUNT MANAGEMENT TOOL TO
COMMAND IAMS.
5.  ACTIONS:
(A) HQMC C4 WILL PROVIDE A LIST OF DAA APPOINTED MARINE CORPS IAM
PERSONNEL TO EDS VIA THE MCNOSC NO LATER THAN 13 SEP 06.
(B) EDS WILL GRANT ALL IDENTIFIED IAMS ACCESS TO THE EXCEPTION
ACCOUNT MANAGEMENT TOOL NLT 20 SEP 06.  EACH IAM SHALL BE GRANTED
ENTERPRISE-WIDE RIGHTS, THAT IS, ACCESS TO ALL MARINE CORPS ACTIVE
DIRECTORY FORESTS.
(C) PER DISCUSSION WITH PM NMCI AND EDS, THE VENDOR WILL REMOVE
ACCESS RIGHTS TO THE EXCEPTION MANAGEMENT TOOL FOR ALL PERSONNEL WHO
DO NOT APPEAR ON THE LIST OF DAA APPROVED IAMS NLT 29 SEP 06, BUT NOT
BEFORE 20 SEP 06.  THE MCNOSC WILL PROVIDE EDS WITH A SPREADSHEET
WHICH WILL LIST ALL USMC PERSONNEL FOR WHOM ACCESS TO THE EXCEPTION
ACCOUNT MANAGEMENT TOOL MUST BE REMOVED.
(D) CTRS MUST PROVIDE TRAINING TO IAMS IN MANAGING CLO EXCEPTION
ACCOUNTS, TO INCLUDE TRANSFER OF AND TRAINING ON THE EXCEPTION
ACCOUNT MANAGEMENT SPREADSHEET, AND USE OF THE EXCEPTION ACCOUNT
MANAGEMENT TOOL.
(E) IAMS MUST REVIEW EXCEPTION ACCOUNT MANAGEMENT TOOL TRAINING
LOCATED ON THE NMCI HOMEPORT "IN FOCUS" SECTION, WITH THE ASSISTANCE
OF THE CTRS, IF NECESSARY. 
(F) TRANSFER OF EXCEPTION ACCOUNT MANAGEMENT RESPONSIBILITY FROM USMC
CTRS TO IAMS MUST BE COMPLETE NO LATER THAN 30 SEP 06.
(G) COMMANDERS WILL ENSURE THE IMPLEMENTATION OF THIS POLICY WITHOUT
DELAY AND ENSURE THE INCLUSION OF ITS CONTENT WITHIN RESIDENT
INFORMATION ASSURANCE TRAINING.  COMMANDERS SHALL ENSURE THIS
INFORMATION IS DISSEMINATED THROUGH WIDEST MEANS, INCLUDING POSTING
ON ORGANIZATIONAL BULLETIN BOARDS.
6. TECHNICAL INQUIRIES SHOULD BE DIRECTED TO THE MCNOSC OPERATIONS
CENTER AT DSN 278-5300, COMM 703-784-5300, OR UNCLAS E-MAIL:
SMB USMC MCNOSC COMMAND CENTER@MCNOSC.USMC.MIL.//