Customs Declaration Processing System Detailed User and ...

DETAILED USER & TECHNICAL REQUIREMENTS FOR CDPS
AND USE-CASE MODELS
Ref: PHASE V
Number
SR-0045
SR-0050
SR-0060
SR-0070
Description
• When challenged to do so by CDPS, IT users must confirm their identity;
• Each CDPS workstation within a country should have a unique identity. This
identity should be authenticated before an IT user is invited to complete the
user authentication process;
• Traders who use a DTI interface must first identify and authenticate
themselves to CDOS just as Customs Officers do. Any new declarations they
present or changes they make to existing ones must be attributable to them;
• Precautions must be taken to ensure that it is not possible to eavesdrop on the
user authentication dialogue between a workstation and the server such that
an adversary could use the information to masquerade as an IT user;
• Precautions should be taken to restrict the use of a Direct Trader Input (DTI)
or CDPS workstation to only the person who has logged on;
• Logical access controls should exist to ensure that Traders using DTI
workstations can only access information related to them or their Principals;
• IT users must have completed appropriate training before they are granted
access to any CDPS resource.
• The system should be able to restrict the visibility of registered customs
declarations. The declarations should be visible only to the customs offices
to which they refer. A customs officer can see only the declarations that are
assigned to him/her.
• There should be at least one user in every customs office which has the right
to see all the declarations concerning the office and assign them to the other
customs officers in his/her location.
• If necessary a customs office may send a request to see a declaration which
is not originally assigned to that office. The request is sent to the office
where the declaration was originally lodged and it contains the MRN
(Movement Reference Number) of the declaration. The declaration will
become visible to the requesting customs office only if the request is
approved by a user with special privileges (coordinator) in the addressed
office (office of lodgment).
• An external user can preview, modify, and cancel the declarations that are
lodged from his user account only, or from users that represent the same
operator (juridical person).
If DTI facility is implemented, logical Access Control must be set up so that
Customs Officers can logon from a DTI Trader Workstation but with restricted
functionality only.
Access Control Lists must be implemented up to application level in order to
provide to Customs Officers read-access to any movement and full access to
those movements and reference information in accordance with the MCA access
policy for which they are authorised.
The use of magnetic or optic media should be controlled or prevented e.g. by
storing the users’ credentials, and by checking them online when such media are
used.
Page 141/276