ECAD-1

ECAD-1 Affiliation Display

Overview

To help prevent inadvertent disclosure of controlled information, all contractors are identified by the inclusion of the abbreviation "ctr" and all foreign nationals are identified by the inclusion of their two character country code in: - DoD user e-mail addresses (e.g., john.smith.ctr@army.mil orjohn.smith.uk@army.mil); - DoD user e-mail display names (e.g., John Smith, Contractor <john.smith.ctr@army.mil> or John Smith, United Kingdom <john.smith.uk@army.mil>); and - automated signature blocks (e.g., John Smith, Contractor, J-6K, Joint Staff or John Doe, Australia, LNO, Combatant Command). Contractors who are also foreign nationals are identified as both (e.g.,john.smith.ctr.uk@army.mil). Country codes and guidance regarding their use are in FIPS 10-4.

MAC / CONF	Impact	Subject Area
CLASSIFIED SENSITIVE	Medium	Enclave Computing Environment

Details

Threat
Classified and sensitive information could be disclosed to unauthorized users who do not have proper security clearances and need to know. Proper assignment of user accounts and email addresses will protect classified and sensitive information from unauthorized disclosure, modification, or destruction. This implementation guide is aimed to help system and network managers/administrators implement consistent assignment and maintenance of user profile.

Threat

Classified and sensitive information could be disclosed to unauthorized users who do not have proper security clearances and need to know. Proper assignment of user accounts and email addresses will protect classified and sensitive information from unauthorized disclosure, modification, or destruction. This implementation guide is aimed to help system and network managers/administrators implement consistent assignment and maintenance of user profile.

Guidance
1. Once a user submits a DOD standard or agency’s Access Request Form upon approval of the user’s manager/supervisor, the system/network administrator shall review the user information and determine if the user is a contractor or a foreign national. 2. If the user is a contractor, the system/network administrator, when creating the new user account, shall assign the abbreviation “CTR” to his/her email address (e.g.,john.smith.CTR@army.mil). Configure the email server to display the email address on the screen, such as John Smith, Contractor john.smith.ctr@army.mil 3. If the user is a foreign national, review the country code identified in FIPS 10-4 and include their two character country code in (e.g.,john.smith.uk@army.mil) and configure the email server to display the email address on the screen as John Smith, United Kingdom john.smith.uk@army.mil 4. If the user is both contractor and foreign national, include both information (e.g.,john.smith.ctr.uk@army.mil). 5. The network administrator shall assign names for the automated signature block to include contractor or country name as follows: John Smith, Contractor, J-6K, Joint Staff or John Doe, Australia, LNO, Combatant Command. 6. The network administrator shall test the proper display of the email addresses by sending an initial email to the new user and verify if the email address is shown as described above.

Guidance

1. Once a user submits a DOD standard or agency’s Access Request Form upon approval of the user’s manager/supervisor, the system/network administrator shall review the user information and determine if the user is a contractor or a foreign national.
2. If the user is a contractor, the system/network administrator, when creating the new user account, shall assign the abbreviation “CTR” to his/her email address (e.g.,john.smith.CTR@army.mil). Configure the email server to display the email address on the screen, such as John Smith, Contractor john.smith.ctr@army.mil
3. If the user is a foreign national, review the country code identified in FIPS 10-4 and include their two character country code in (e.g.,john.smith.uk@army.mil) and configure the email server to display the email address on the screen as John Smith, United Kingdom john.smith.uk@army.mil
4. If the user is both contractor and foreign national, include both information (e.g.,john.smith.ctr.uk@army.mil).
5. The network administrator shall assign names for the automated signature block to include contractor or country name as follows: John Smith, Contractor, J-6K, Joint Staff or John Doe, Australia, LNO, Combatant Command.
6. The network administrator shall test the proper display of the email addresses by sending an initial email to the new user and verify if the email address is shown as described above.

References

DoDD 5200-2, DoD Personnel Security Program, 09 April 1999