Training for TEAM Local Security Managers The User Management Process Updated 12/09

Page 2FTA Office of Program Management Objectives In order to have a secure overall process for user management in TEAM. We need: –Standard practices –A method to ensure the quality of TEAM user information –Internal controls for staff access and authorization

Page 3FTA Office of Program Management Local Security Manager Responsibilities Setting up user accounts Quarterly monitoring of TEAM users Reset passwords for users assigned by your office Ensure accurate completion, processing, and filing of TEAM user access forms

Page 4FTA Office of Program Management Active Users Cost Center NameCost Center CodeTotal Users Office of Administration (TAD) Office of Chief Counsel (TCC) Office of Congressional Affairs (TCA) Office of Program Management (TPM) Office of Budget Policy (TBP) Office of Research & Innovation (TRI) Office of Civil Rights (TCR) Office of Planning & Environment (TPE) Lower Manhattan Recovery Office (LMRO) Region 1Cambridge MA TRO Region 2 New York NY TRO Region 3 Philadelphia PA TRO Region 4 Atlanta GA TRO Region 5 Chicago IL TRO Region 6 Arlington TX TRO Region 7 Kansas City MO TRO Region 8 Lakewood CO TRO Region 9 Sanfrancisco CA TRO Region 10 Seattle WA TRO Grand Total7623

Page 5FTA Office of Program Management The TEAM User Access Forms Package location: –TEAM Home Page, FTANet, and FTA Public Website –FTA Net: HQ/TEAM%20User%20Access%20Forms%20and%20Instructions.pdfhttp://ftateamweb.fta.dot.gov/static/Guidance- HQ/TEAM%20User%20Access%20Forms%20and%20Instructions.pdf Includes 2 Forms: –Staff/Contractor/Auditor –Grantee/Recipient Includes Complete instructions: –Which form to use –Where completed forms go for processing –What additional documents may be needed –What Authorizations may be necessary

Page 6FTA Office of Program Management Point of Contact In the TEAM User Access Form Instructions Listed on the TEAM Home Page

Page 7FTA Office of Program Management Staff Access All staff access forms to TEAM should be signed by their supervisor Special access to job-specific functions should be signed by a HQ representative for that function ( Authorizations for Special Functions, page 18 ) –Budget Functions –Legal Signoff –Civil Rights Functions –PIN Number for Obligation Activities, Earmark Management, etc –Accounting functions

Page 8FTA Office of Program Management Contractor Access Contractors acting as FTA staff who require access to TEAM MUST be Authorized by their Contracting Program Manager. –Example: Triennial Review Contractor must be Authorized by Triennial Review Program Manager and FTA approving official

Page 9FTA Office of Program Management Auditor Access Auditors who require access to TEAM MUST be Authorized by the FTA Audit Liaison in TBP. This access should be promptly removed when audit activities are complete.

Page 10FTA Office of Program Management Grantee Access Ensure that Grantee are authorized to have the functions that they are requesting Have the grant manager sign off to verify identity Make sure ‘Designation of Signatures’ are on file for users “PINing” on behalf of others in their office. –(See TEAM User Access Forms and Instructions Appendix1)

Page 11FTA Office of Program Management Good Practices I Add notes to the user record to note user record activities, password resets, access changes, etc. Use TEAM to notify user of username and password Username and password are in the same DO NOT a PIN, send it via US Post Office mail address on file, or leave it in a voice mail box with a matching name for the user account

Page 12FTA Office of Program Management Good Practices II DO NOT change address without verifying user identity Attach scanned user access forms to the user record, if possible Do NOT add/modify users without proper documentation Do not reset addresses or passwords without verifying user information If you are not sure about a user ask questions to verify information Verify that recertification is not necessary before attempting to reset password

Page 13FTA Office of Program Management Example: Password Reset If a user calls and asks to reset their password: –Retrieve their user file –Ask them for the last 4 digits of their SSN (or other designated number as recorded on their User form) –Verify their office phone and address –Verify address –Send new password to the address on file in the TEAM record Ensure the person who is calling is the person who should be using the account Ensure that the information remains accurate in TEAM

Page 14FTA Office of Program Management Staff/Contractor/Auditor Form Collect the formCollect the form Verify the information & AuthorizationsVerify the information & Authorizations Multiple Authorizations may be required for special access! LSM signs as FTA Operational ApprovalLSM signs as FTA Operational Approval Process the form in TEAM (Verify & Certify!)Process the form in TEAM (Verify & Certify!) File the form (attach in TEAM, keep on ‘paper’ file until user account is terminated)File the form (attach in TEAM, keep on ‘paper’ file until user account is terminated) Local Security Managers must notify your office Administrative Officer to add new users to OASIS TEAM User Group (Staff only)Local Security Managers must notify your office Administrative Officer to add new users to OASIS TEAM User Group (Staff only)

Page 15FTA Office of Program Management FTA Authorizations Identifies the appropriate individuals that must provide signature to authorize access to special functions One or more FTA authorizations may be required –Attach file with additional authorizing documents as necessary

Page 16FTA Office of Program Management Supervisor Authorization A Supervisor MUST sign to authorize staff access Administrative Officers MUST be notified to add new staff users to the OASIS TEAM User Group This ensures that the Office maintains awareness of system access!

Page 17FTA Office of Program Management Authorization for Special Functions Regular Access - Employee's Supervisor or COTR Special Access Help Desk Functions/Local Security Manager Functions –TEAM Project Manager or Director of Information Technology (TAD) Budget Functions – Director of Financial Systems or Director of Budget (TBP) Earmark Administration Functions –Director of Transit Programs (TPM) Civil Rights Functions –Civil Rights Officer, HQ (TCR) Legal Signoff –Chief Counsel or Deputy Chief Counsel (TCC) FTA Obligation Authority (Award Access and PIN, also listed on pick list for 'Paper' Grants) –Only as indicated in the Federal Transit Administration Delegations of Authority Auditor Access –FTA Audit Liaison (TBP)

Page 18FTA Office of Program Management Grantee Form Collect the formCollect the form Verify the information & AuthorizationsVerify the information & Authorizations Additional documents may be required for special access! LSM signs as FTA Operational ApprovalLSM signs as FTA Operational Approval Process the form in TEAM (Verify & Certify!)Process the form in TEAM (Verify & Certify!) File the form (attach in TEAM, keep on ‘paper’ file until user account is terminated)File the form (attach in TEAM, keep on ‘paper’ file until user account is terminated)

Page 19FTA Office of Program Management Designation of Signature Authority Template available in User Form Instructions (TEAM User Access Forms and Instructions Appendix1) Used to delegate signature or “PIN” authority to someone other than the Official Named on the Resolution Authority

Page 20FTA Office of Program Management Designation of Signature Authority FTA need not obtain a separate legal opinion for authority of the Applicant's CEO to enter his or her on behalf of the Applicant, PROVIDED THAT: 1.The individual seeking TEAM access is the Applicant's CEO, and 2.IF: A.The Applicant's CEO has selected certs and assurances on behalf of the Applicant for the current fiscal year, B.The Applicant's CEO has entered his or her PIN in the TEAM Affirmation of the Applicant, and C.Either: a)The Applicant's attorney has entered his or her PIN in the TEAM Attorney's Affirmation signifying that the Applicant's actions are authorized by law, or b)The Applicant has on file an Affirmation of the Attorney dated during the current fiscal year, and the CEO has entered his or her PIN in the place for the Applicant's Attorney's PIN.

Page 21FTA Office of Program Management Notification of Attorney's Affirmation 1.FTA prefers that the Applicant's Attorney enter his or her own PIN in the Affirmation of Attorney. 2.On the other hand, FTA permits the individual authorized to act on behalf of the Applicant to enter his or her PIN on behalf of the Applicant's Attorney, provided the Applicant has on file a current Affirmation of Attorney pertaining to the Applicant's authority to enter into agreements with FTA, comply with Federal requirements, and acknowledging that statements made by person signing the certs and assurances on behalf of the applicant are correct. (Among other things, this statement implies that only the proper individuals have been authorized to commit an Applicant to comply with FTA’s terms and conditions for assistance.)

Page 22FTA Office of Program Management Authorizing Resolution In general, a public body must have an authorizing resolution from its board of directors or be otherwise properly authorized under state and local law before it can take any action. Consequently, FTA expects the Applicant/Recipient to retain that resolution in its files, but it is desirable for the Applicant/Recipient to scan it and attach it in TEAM.

Page 23FTA Office of Program Management TEAM User Security Screens See the TEAM User Guide located at chapter 10. for detailed walkthroughs of the screens Click “Certify User” to record that an Authorized User Access form is on file

Page 24FTA Office of Program Management User Screens, continued Office or cost centers the user has access to view and/or edit. This cost center is usually associated with the users office. Multiple cost centers can be used if necessary. (depending on Roles/Privileges) Recipient IDs the user has access to view and/or edit (depending on Roles/Privileges)

Page 25FTA Office of Program Management Security Roles / Privileges It is important that you understand these boxes and how to accurately reflect the user’s job function in both the form and the TEAM user account. Security Roles Reference Document located at : /static/Guidance-HQ/ Contact the User, the FTA Authorizer, or the TEAM help desk if you are still uncertain of the type of access they need, or how to assign it in TEAM!

Page 26FTA Office of Program Management Security Roles / Privileges

Page 27FTA Office of Program Management Good Practices If Supplemental Agreement is selected, make sure that the Designated Recipient in the recipient profile is correct (e.g. Recipient who created the profile is 1599 designated recipient cannot be 1599 it must be another recipient ID and make sure the radio button for designated recipient is marked yes.) Make sure the designated recipient id is in the primary Recipients Id and the project recipient is in the Auxiliary ID.

Page 28FTA Office of Program Management Monitoring Users Within 2 weeks after the end of every quarter, TPM (headquarters) will send via an excel file of FTA staff and contractors who use TEAM and the roles they have in TEAM to the Local Security Managers (LSMs). Each LSM will only receive the list of users set up under their cost centers The LSMs will review the files and verify the following: –All users have on file an approved (signed by a supervisor) user access form –The roles approved for the users on the access forms are the same as the roles they currently have in TEAM (as indicated in the excel file) LSMs should suspend TEAM users whose access forms are not on file LSMs should revoke TEAM users who have roles that were not approved on the access forms Each LSM should report their findings back to TPM via within two weeks of getting the excel file of TEAM users. The findings should include the following: –The number of TEAM users suspended for not having TEAM user access forms on file –The number of TEAM users with roles revoked because the roles were not approved on the access forms

Page 29FTA Office of Program Management SUSPENSION OF TEAM USERS If a TEAM user is suspended because of multiple erroneous login attempts, he/she can be reactivated any time without having to go through the approval process again If a TEAM user gets suspended because he/she does not have an approval form on file, then he/she has to fill out the user access form and go through the approval process –Make a comment in the note section of the user’s profile stating why the user has been suspended so that the helpdesk does not un suspend the account in error. All TEAM users who have not accessed TEAM within a year will have their accounts suspended and they will have to go through the approval process again before their accounts can be reactivated. However, users will be notified a month in advance before the suspension of their accounts, so as to give them the opportunity to log into TEAM to avoid being suspended.

Page 30FTA Office of Program Management Questions? Contact the TEAM Help Desk for assistance! Hours of Operation M-F 8:00a.m. to 5:00p.m. (EST) Telephone Number Address

Page 31FTA Office of Program Management Clarifications 1. Local Security Managers will generally process the forms in TEAM for the people that work out of their locality. A local Security Manager has authority to add/modify staff users from authorized forms for other offices to TEAM. In any case, be sure to note where the access forms & supporting documentation is filed if it is not attached to the user record in TEAM. 2. "Grantee User Supervisor" or "FTA Point of Contact" on the User Form From Linda Sorkin: Please have the CEO, board chair or other delegated authority send us a delegation of signature with an org chart stating that any one who is the supervisor for a TEAM user can sign for that person. 3. Access to these TEAM Financial Functions now require Accounting/Budget Signoff –Obligation –Deobligation –FPC Transfer –Accounting Functions –Maintain Funds Control –Approve Advice –Approve Operating Budget

Page 32FTA Office of Program Management Clarifications 4. The Local Security Manager has the authority to “Certify” that an authorized access form or accompanying documentation is on file. In cases where the form and/or accompanying documentation is expected on or about a certain date, and interruption in TEAM access would cause delays in grant processing, it is at the discretion of the Local Security Manager to “certify” users. In any case, be sure to add notes to the User’s record indicating the expected dates of the documentation. 5. For recertification of existing grantee users, the FTA regional knowledge of grantee’s organization may be sufficient basis for accepting the supervisor’s signature. For audit purposes, it would be good to attach a copy of the grantee’s org chart and/or supervisory chain of command to the recipient profile information. That could be done as a matter of routine business after the certification. Of course, if there is any question about the signature authority, the security manager should request the documentation suggested in the guidance provided following the TPM biweekly conference call and now incorporated in the grantee instructions. 6.For certification of new grantee users, the org chart and other evidence of the signature authority should be requested at the time of the initial certification. 7. Pins' should NOT be ed. A paper copy can be mailed to the address on the User Account, or a Voice Mail left to an inbox with a matching first and/or last name.