6003-4 Information Systems Account Management

Cadets and Junior Canadian Rangers Group Order (CJCR Gp O)

1. Identification

Date of Issue: 2022-10-17

Date of Verification: N/A

Application: This is an order that applies to members of the Canadian Armed Forces and a directive that applies to Civilian Instructors and employees of the Department of National Defence employed within the Cadets and Junior Canadian Rangers.

Supersession: N/A

Approval Authority: This order is issued under the authority of the Comd CJCR.

Office of Primary Interest (OPI): CJCR DCOS IM/IT

Enquiries: CJCR HQ J6

2. Abbreviations​​

Abbreviation	Complete Word or Phrase
ADM(IM)	Assistant Deputy Minister (Information Management)
CoC	Chain of Command
CTC	Cadet Training Centre
D365	Defence 365
DFC	Defense Form Catalogue
DWAN	Defense Wide Area Network
ISSO	Information System Security Officer
NES	Non-Effective Strength
NOI	Notice of Intent
OA	Operational Authority
RS	Reliability Screening
SA	Security Authority
SOS	Struck Off Strength
TA	Technical Authority
USS	Unit Security Supervisor

3. Definitions

Cadet365

Is the Office 365 tenant for the CJCR specifically, which allows all cadets, CAF members, and Civilian Instructors to collaborate and communicate together, while giving access to specific information systems, such as SharePoint online, CCO Net email, etc.

CCO Net

Is the CJCR primary network and holds specific CJCR applications and information systems, such as Fortress.

Cloud accounts

A user identity to access hardware and software resources that an organization offers to its employees or customers in the form of on-demand remote services. (ex. D365 and Cadet365 accounts)

Collaboration Systems

Applications/Platforms that help run a business on a day-to-day basis using real-time data in order to two or more people or organization work together collaboratively in order to realize or achieve a goal. (ex. TEAMs/Channels/Chats inside an Office 365 tenant)

Defense365

A Microsoft Office 365 platform, for the Defense Team.

Information Systems

The set of integrated technical means which provides the organized collection, manipulation, storage, retrieval, display and dissemination of information to support the requirements of decision-makers at any level.

IT Security Event

An IT security event is any potential compromise to the confidentiality, integrity, or availability of a corporate asset or information.

Network accounts

A user identify to access interconnected information and communications technology and, in particular, the software, devices and infrastructure to support the interconnections.

Operational Authority

Authority assigned to a person to define requirements and operating principles, set standards and accept risk within their area of responsibility.

Security Authority

Authority assigned to a person to identify risk, to provide advice and standards for endorsement by the operational authority and technical authority, and to monitor compliance within their area of responsibility.

Technical Authority

The person who has the authority to set technical specifications and standards, manage configurations, provide technical advice and monitor compliance within their area of responsibility.

4. Policy

Context

• 4.1 Accessing network and cloud accounts, as well as various information and collaboration systems, is a key component of working efficiently. Granting and removing access to network and cloud accounts is integral to keeping information safe and in the hands of authorized personnel.
• 4.2 CJCR personnel may be granted access to various networks and cloud accounts based on their roles and responsibilities within CJCR. This includes:
  1. Cadet365;
  2. CCO Net;
  3. DWAN; and
  4. D365.
• 4.3 This Gp O must be read in conjunction with Gp Order 3004-1, Allocation of Information Technology Resources.

Authority

• 4.4 ADM (IM) is the technical authority over the DWAN and the SA over all DND/CAF networks and IT resources including DWAN and D365.
• 4.5 Comd CJCR, as the OA, is responsible for the acceptable use of all networks utilized by CJCR personnel as well as the enforcement of DND/CAF IT security policies and directives.
• 4.6 DCOS IM/IT is the TA for the CCO Net and Cadet365. 

Policy 

• 4.7 Users must only have access to the system networks and cloud platforms that are required to perform their duties. Users will not be granted access to or retain access to system networks and cloud platforms when not required. Access and permissions are based on position, employment, and unit, and must be adjusted when personnel changes occur.
• 4.8 In order to gain access to any system or network outlined above, users must hold an RS at a minimum.
• 4.9 Noncompliance with policies, directives, and guidelines may result in an account suspension or the loss of account access.
• 4.10 Users who are involved in an IT Security Event, may see their account suspended, without notice, until an investigation is completed.
• 4.11 Users who are undergoing administrative action may have their account access suspended.

5. Types of Network Accounts

CCO Net and Cadet365

• 5.1 Cadet365 is available within Canada. Access may be granted outside Canada under certain conditions if supported by the individual’s CoC.

Cadets

• 5.2 Cadets will not be granted a CCO Net account except when required to fulfill an in-person staff cadet position at a CTC. In such circumstances, the staff cadet may obtain a CCO Net account in order to access specific resources, such as Fortress, as part of their assigned tasks.
• 5.3 In accordance with CCO Net Security Orders, Staff Cadet CCO Net accounts will be removed at the conclusion of the CTC period.
• 5.4 Cadets do not require an RS to access or obtain a CCO Net or Cadet365 account.
• 5.5 Cadets will be provided a Cadet365 account upon registration in Fortress. The corps/squadron staff is responsible to provide each cadet with their credentials, including username and password once accounts are created.
• 5.6 Cadet365 accounts will immediately be disabled once a cadet is marked SOS in Fortress. Additionally, corps/squadron personnel should remove Cadet365 access for all inactive cadets. 

CAF Members and DND Employees

• 5.7 COATS members are eligible to obtain access to CCO Net and Cadet365 upon completion of an RS and enrolment to the CAF or upon Component Transfer to COATS.
• 5.8 An Access Control Form must be completed and submitted to the IT SMC in order to obtain account credentials.
• 5.9 In accordance with CCO Net Security Orders, access to CCO Net and Cadet365 accounts will be removed when a COATS member is declared NES or upon submission of a Notice of Intent to release.
• 5.10 All Regular Force and Primary Reserve members and DND employees employed within CJCR are eligible for a CCO Net and Cadet365 account upon joining the RCSU/CJCR HQ.
• 5.11 In accordance with CCO Net Security Orders, access to CCO Net and Cadet365 accounts will be removed upon a member or employee’s departure from the unit. 

Civilian Instructors

• 5.12 Civilian Instructors are eligible to obtain a CCO Net and Cadet365 account for the period covered by their Regional Employment Agreement or Cadet Training Centre Employment Agreement.
• 5.13 In accordance with CCO Net Security Orders, access to CCO Net and Cadet365 will be removed upon expiration of the applicable employment agreement.

CJCR Volunteers

• 5.14 Regular Force and Primary Reserve members who are CJCR Volunteers, may be granted access to CCO Net and Cadet365 as required.
• 5.15 CJCR Volunteers, who do not have an RS, may be granted limited access to CCO Net and Cadet365 in order to perform specific tasks at the corps/squadron.
• 5.16 In order to grant limited access, the OA and the SA must be satisfied that appropriate conditions have been put in place by the TA, in order to manage and monitor the CJCR Volunteer’s access to CCO Net and Cadet365.
• 5.17 In accordance with CCO Net Security Orders, access to CCO Net and Cadet365 accounts will be removed when a CJCR Volunteer ceases to volunteer with the corps/squadron.

DWAN and D365

• 5.18 Access to DWAN and D365 accounts is limited to RCSU/CJCR HQ Class “B” personnel. In specific circumstances, DWAN and D365 accounts may be approved for Class “A” personnel as required by RCSUs/CJCR HQ, and in accordance with Gp Order 6002-1, Allocation of Information Technology Resources.
• 5.19 Access to DWAN and D365 is granted upon commencement of a period of Class “B” reserve service of 90 or more consecutive days with an RCSU/CJCR HQ, and will be removed or transferred upon departure from the RCSU/CJCR HQ.

6. Roles and responsibilities

• 6.1 The following table describes the roles and responsibilities of the various stakeholders involved in the management of access to information systems:

Roles	Responsible to...
User	Read and understand applicable policies, orders and directives. Advise their CoC in a change of duty status. Advise their CoC of any security incidents or if they are in possession of an account other than their own. Advise the CoC of intent to travel if there is a requirement to access to cloud accounts.
Supervisor	Inform relevant authorities of any changes in personnel and duty status. Verify that all personnel meet requirements to obtain and maintain access to networks and cloud accounts.
USS	Validate applicant security clearance if required.
ISSO	Verify that users satisfy all requirements prior to obtaining network or cloud accounts.
IT SMC	Create user accounts.  Transmit, in a secure fashion, account credentials to the user.  Manage list of authorized access to Cadet365 for users travelling outside of Canada and authorized countries
Unit (HR/Admin/Corps/ Squadron CO)	Advise relevant authorities of any changes in status of personnel.  Responsible to contact CoC for the creation/suspension/deletion of relevant accounts.
Information System local administrator (e.g. Fortress administrator)	Review user roles and permissions for current, incoming, and outgoing personnel, based on specific requests from the CoC.
Collaboration System local administrator (e.g. TEAM owner)	Review user roles and permissions for current, incoming and outgoing personnel, based on specific requests from the CoC.

7. Publication

Frequency of Publication

• 7.1 Annual or more frequent review and updates, as required.

Errors/Omissions or Suggestions

• 7.2 Users of CJCR Gp Orders are encouraged to identify any errors, omissions or suggested orders to the attention of CJCR HQ J1 Policy.

8. References

Source References 

• DAOD 6000-0, Information Management and Information Technology
• DAOD 6001-0, Information Management
• Directive on Service and Digital
• Policy on Service and Digital 

Related References

• CJCR Gp Order 3004-1, Allocation of Information Technology Resources