J.P. MORGAN CHASE BANK, N.A. 1A - 2015

Home Browse Search

Proposal 'for 'the City of Santa Ana .J.PM0r(;d11 The City will have the ability to designate the rights of each user on the J.P. Morgan ACCESS platform. Products on the portal are designed to accommodate a wide range of security options, including requests for multiple transaction approvals, demands for separate "enter" and "release" functions for users, dual control among users, along with daily or transaction limits. The separation of duties and approval workflows provide mechanisms clients can use to help ensure that no personnel can perform transactions to commit fraud or compromise the integrity of the entitlement data. Client security administrators can assign these specific transaction initiation privileges to users. J.P. Morgan ACCESS security architecture provides authentication as well as authorization to ensure that each User is permitted access to only the applications and functions established and approved for their use. When highly sensitive (value- bearing or administrative) data is being transmitted between the User and J.P. Morgan, additional security in the form of a digital signature is required to ensure integrity. All communications between the User and J.P. Morgan are secured using SSL protected sessions. Basic Authentication / Single sign -an In order to establish a session, the User must supply a valid User ID and Password. This validation is managed by commercially available single sign -on authentication software. Once a User sign -on is complete, entitlements are verified for each User. The User's J.P.' -, Morgan ACCESS screen displays only functions and accounts for - which he or she has been entitled access. RSA SecudDCP* Only certain functions within J.P. Morgan ACCESS will require an additional level of security: Security Administrator functions and Transaction initiation entitlements (Funds Transfer, ACH, and Liquidity modules). In these cases, the User must use their SecurlD device to sign on and release value hearing transactions. The SecurlD RSA token device is a small, hand -held device that generates a six -digit security code every 60 seconds: This is referred to as a "token code ". For these Users, the token code must be supplied with their ID and Password at sign on and again at the point of transaction release. SecurlD technology provides a high level of security by authenticating each user and digitally signing each transaction. All of this is done without the need for locally installed software or hardware. Once a user has received their SecurlD device, the start -up process is quick and easy. 'SecurlD is a registered trademark or trademark of RSA Security Inc. in the United States and/or other countries. Administration The City's security administrators will maintain established authentication IDs and digital signature authority. Additional users can be established and approved using the online entitlement feature. As a standard practice, J.P. Morgan requires two security administrators to be, involved in user setup and maintenance to help clients maintain reasonable audit controls. Additionally, if security administrators are to have product functions, two other security administrators must prepare and approve the product function entitlements. Security administrators cannot request or approve product functions (e.g., cash reporting, wire initiation, eta) for themselves unless an authorized company representative has signed a special waiver. One security administrator establishes users for accounts, services (ACH initiation, wire initiation, balance reporting, etc.) and functions (transaction initiation, transaction approval, release, reporting, etc.), while a different security administrator approves the users for the accounts, services and functions established by the first security administrator. Pane 20