RESERVE BANK INFORMATION AND TRANSFER SYSTEM. Technical and Operational Frequently Asked Questions

Transcription

1 RESERVE BANK INFORMATION AND TRANSFER SYSTEM Technical and Operational Frequently Asked Questions April 2006

2 Technical and Operational FAQs 1 Introduction Background Phased Introduction Document audience and purpose Technical Requirements Minimum PC system requirements Software required to access RITS What if I accidentally download a newer version of JRE? Browser security permissions Check your set up with the Testcard Can I access RITS via thin client installations? Login to RITS Connection to RITS How do I access the new RITS User Interface? Can we continue using our existing Austraclear leased line? We currently connect via dial-up modem Can we continue to use a dial-up connection? What sort of response times should I expect? I am getting slow response times. What could be the cause? Will access to RITS be available via the Internet? Secure Access to RITS How will the new interface affect the system s security? How will access to RITS change? What is the DN or Distinguished Name of a RITS Certificate? What is a RITS Token? How do I get a RITS digital certificate and access to RITS? Can I have more than one logon? How do I get a certificate with no Internet or external access? Will Test Certificates be issued for access to RITS Pre-Production? Can I store my RITS digital certificate on my PC? Can the token store my Austraclear certificate? Can copies of users RITS certificates be stored for business resumption purposes? I have lost/damaged my token; can I still access RITS? Can I share a token with another user? Can more than one token be used on a single PC at the same time? How often do I have to renew my certificate? I have forgotten my Token Codeword? I have lost my token I left my token at home, can I still access RITS? Do I have to take my token with me if I leave my PC to get a cup of coffee or go to lunch? If I insert my token when the PC is locked I am asked to enter a PIN Do I have to enter my token codeword each time I authorise a payment? How do I remove certificates from my token? Can I re-use a token for a new user? What should I do if someone is going on extended leave, and a new person is filling in? What should I do when someone leaves the organisation or no longer requires access to RITS? Can I remove my token from my PC once I ve logged on to RITS? Do I have to re-enter my RITS password and my token PIN when my RITS session times out? What happens if someone accesses my RITS session while I m away from my PC and authorises a payment that settles??... 14

3 4.29 I can t login even though there has been no change in my login details since my last login I can t login to RITS from someone else s PC RITS Functionality Are there any other system changes to RITS? Can my password administrator still do the same things? How do I get a new user set up? How can a user s profile be changed? Is there any change to the Disaster Recovery arrangements for RITS of which I need to be aware? More information on RITS functionality Will we have access to the same branches? Migration When do we move to the new System? When will the new Interface be available? What are the arrangements for a testing period? Can I logon via both old and new interfaces? How do members migrate?... 17

4 Introduction 1 INTRODUCTION 1.1 Background Banks and other Exchange Settlement Account Holders use the Reserve Bank Information and Transfer System (RITS) to monitor and manage credit and liquidity arising from their interbank settlement activities. The RITS User Interface Project will redevelop the user interface for online (terminal) access to RITS. In doing so, the system architecture of RITS is being changed significantly to include web and application servers, and improved security via a Public Key Infrastructure utilising digital certificates contained on USB port security tokens. The ability to access RITS via the Internet will also be introduced. 1.2 Phased Introduction The new interface is being delivered in two phases: Phase 1 functionality includes the functions for the management of queued transactions; enquiries on settled payments, transactions and cash accounts; cash transfers; new batch functionality; member administration (user roles, passwords, etc); and messages. Phase 2 functionality includes SWIFT AIF message enquiry; evening agreement functionality; unsolicited advice management; access to reports and downloads (although phase 1 includes enhanced print and download functionality in each function); more member administration; and system information functions. 1.3 Document audience and purpose This document is for the information of all RITS Members. Given the significant change to the RITS user interface and the required use of a digital certificate on a USB port security token, with its ancillary desktop software, this document seeks to assist members in their enquiries using the Frequently Asked Questions approach. Clarifications or further questions about the new RITS user interface may be directed to the RITS Help Desk on or to rits@rba.gov.au. April

5 Technical requirements 2 TECHNICAL REQUIREMENTS 2.1 Minimum PC system requirements The minimum system requirements to access the RITS User Interface currently are: Pentium 4 Windows 2000 (Service Pack 4) or Windows XP (Service Pack 1 or Service Pack 2) 1 512MB minimum memory Screen resolution 1024 x 768 USB port These requirements may change over time. See the Technical Information Paper for more details. 2.2 Software required to access RITS The following software required to access RITS is available from the RITS Help Desk on CD with installation scripts or wizards. The software is also available from the internet. Software name Sun Java Runtime Environment (JRE) v1.4.2 Java cryptographic toolkit Safenet driver for RITS Token. Applet download Details RITS requires JRE v1.4.2 and is not currently certified to work with JRE v1.5/5.0. If necessary, because of the requirements of other non-rits applications, different versions of the JRE can co-exist on the one PC. JRA is approximately 15 megabytes. This software includes DLLs for interfacing with the RITS Token drivers. This is approximately 2 megabytes. This will contain drivers and token/certificate management functions. This is up to 14 megabytes. At first use, RITS performs an applet download of approximately 200 kilobytes. This may re-occur periodically at application upgrades. Internet Explorer 6 is the required browser software. Each Member will be responsible for the deployment of this software to appropriate RITS user PCs. More technical information may be found in the Technical Information Paper. 1 Microsoft support for XP Service Pack 1 ends 17 September It is likely that the RBA will withdraw RITS support for it at the same time. April

6 Technical requirements 2.3 What if I accidentally download a newer version of JRE? Accidentally downloading a newer version of Java Runtime Environment can happen because of the temptation to act on a popup prompt from the vendor. RITS may not work with newer versions of JRE. If the wrong version is loaded, the member s technical staff will need to remove the later version and re-install the version specified for RITS. To determine if the incorrect version is installed the user can run the Testcard (see 2.5 below). Contact the RITS Help Desk if problems are still encountered. 2.4 Browser security settings Member browser permissions on user PCs should permit: Javascript; Signed Applets; and Session Cookies. The following settings should be enabled in the Security tab in Internet Explorer Tools/Options: ActiveX controls and plug-ins Run ActiveX controls and plugins Script ActiveX controls marked safe for scripting Downloads File download Scripting Active scripting Members may wish to establish these settings in the Trusted Sites zone and add RITS as a Trusted Site. Different settings could then be established for other zones, allowing, for example, higher security settings for general internet browsing. The status of other Security settings should not impact RITS functionality. Privacy settings must allow RITS UI to use session cookies. For further information on this setting, members should refer to their own IT security officers. April

7 2.5 Browser - advanced Settings Technical and Operational FAQs Technical requirements On the Advanced tab in Internet Options, Use Java 2 v1.4.2_10 for <applet> (requires restart) must be enabled. 2 Tests performed at the RBA using a Microsoft ISA Proxy server showed a significant system performance benefit when Use HTTP 1.1 and Use HTTP 1.1 through proxy connections settings were both enabled. Members should assess whether this is helpful in their own environment. 2.6 Pop-ups Popup blockers such as the one included in the Windows XP Service Pack 2 update (found under Tools->Popup Blocker in Internet Explorer), and third party popup blockers such as Google Toolbar can interfere with the RITS UI login process, and may also interfere with other RITS screens. Most packages allow popup blocking to be disabled for specific sites. However due to the wide variety of blocking software available, the RBA cannot provide specific instructions for doing this for every package available. If you encounter errors such as the ones in Appendix 3, and you have ensured your settings comply with those in this guide, please ensure that popup blocking is not active for the RITS RBA website. If that does not work, try disabling all popup blocking software. See your system administrator if you require further assistance with this. If no popup blocking software is active and your software is configured as indicated in this guide, then contact the RITS help desk. 2.7 Check your set up with the Testcard A Testcard has been developed which, when run, will verify that the mandatory software and environment requirements are in place to access RITS. This is available on CD from the RITS Help Desk, via a link from the RITS Logon screen and via the internet. This should prove a useful tool allowing members to target and fix any setup problems. See the Guide to Connectivity Testing for more information. 2.8 Can I access RITS via thin client installations? The Reserve Bank is not intending to provide Member support for thin client installations such as Citrix and Windows Terminal Server. A number of issues arise, including the need to ensure that the client/server connection is encrypted to preserve the integrity of the signing and the privacy of each user s Token Codeword (RITS Tokens may not be shared). Refer to the Technical Information Paper, for further details. 2.9 Login to RITS When accessing RITS via the SFE Network (ANNI) or via the Internet, each user will require a desktop shortcut/link and/or entry in Favourites containing the RITS Launch Page. 2 The exact version referred to in this option changes to reflect the local installation. April

8 Technical requirements This Launch Page will enable access to both Production and Pre-Production systems. The link will find the active RITS system regardless of where it is operating (eg, primary site or backup site). See the next chapter for more information on connectivity to RITS. April

9 Connection to RITS 3 CONNECTION TO RITS 3.1 How do I access the new RITS User Interface? Network access to RITS will be available by: SFE Network (ANNI) as now. Leased line only; no internet access for the main connection to RITS; and Internet. This new access method replaces dial-up and is available for use by members under certain conditions Refer to Information Paper #3 for more details. As noted in section 2.7, for one or both of the network options, members technical staff will need to provide each RITS user with a desktop link/favourites to the RITS Launch Page. Members accessing RITS via the Internet will use a web address that resolves to a public Internet IP using DNS. Members accessing RITS via the SFE Network (ANNI) will use a web address that corresponds to one of the following: a name that is resolved to the IP address of the RITS server by the Member s internal DNS (or use of SFE s ANNI DNS service if appropriate) or alternative name resolution mechanism such as host files; or a name that is resolved to a private IP address by the Member s internal DNS or alternative name resolution mechanism, and subsequently converted to the target server address by Network Address Translation (NAT). 3.2 Can we continue using our existing Austraclear leased line? Yes, access to RITS under the new interface will continue across the SFE Network (ANNI). Some bandwidth upgrades are underway. It is encouraged you continue with your leased line connection. Refer to Information Paper #3 for more details. 3.3 We currently connect via dial-up modem The Reserve Bank has decided to provide access to the new RITS user interface via the Internet instead of the dial-up connections that are mainly used by small institutions. Use of the Internet will involve strict security controls, and will be subject to certain restrictions, particularly for institutions that may use it as their only means of connecting to RITS. Dial up access will remain available until migration to the new interface is complete for all members. 3.4 Can we continue to use a dial-up connection? A dial-up connection will not work when accessing the new RITS user interface. You should plan access via the SFE network or via the Internet. Rollout of access to the new RITS user interface is planned from mid Dial up access to the old RITS interface will continue to be provided until all functionality is migrated to the new interface. April

10 3.5 What sort of response times should I expect? Technical and Operational FAQs Connection to RITS On average, response times should be in the range of 3 to 5 seconds. Response times will vary based on other activity within your internal network, your PC configuration, other activity on your PC and your network connection to RITS (which is shared with Austraclear). For example, if other users within your organisation are logging onto the Austraclear system, then you should expect some slower than normal response times on RITS. Similarly, if there are a larger than normal number of users accessing both RITS and Austraclear, this may cause congestion on the network, and impact on response times. 3.6 I am getting slow response times. What could be the cause? There are a couple of things you should check before contacting the RITS Help Desk: Do you have the recommended Internet Proxy settings within Internet Explorer? Refer Section 2.4 and 2.5. Is there something running on your PC that is slowing it down? Are there other users logging onto the Austraclear system at the time that you are running slow? Are other internal applications running slower than normal? 3.7 Will access to RITS be available via the Internet? Yes. However, for large and medium sized organisations the current SFE Network (ANNI) access must be used for RITS Production access to the Primary and Secondary Sites. Internet access may be used by these members in a contingency, including for access from outside the office or at home. April

11 Secure access 4 SECURE ACCESS TO RITS 4.1 How will the new interface affect the system s security? The RBA has decided to introduce digital certificates to enhance the security of RITS in line with best practice overseas and domestically. For the protection of RITS Members and the RBA, and consistent with the critical importance of RITS to the financial system, the use of digital certificates stored in hardware will provide an extremely strong level of user authentication, transaction integrity and improved protection from repudiation. Confidentiality of all information in transit between the RBA and RITS users will be ensured through the use of SSL technology. 4.2 How will access to RITS change? In the old RITS interface, users entered a company logon and password, and a personal logon and password. To access RITS in the new user interface, users will: Insert their personal RITS Token into the USB port of their PC; Select the desktop link or Favourite to RITS and enter their personal logon and password; Select their RITS Certificate stored on the RITS Token and enter the Token Codeword, known only to the user. If all is correct, access will be made available. 4.3 What is the DN or Distinguished Name of a RITS Certificate? The Distinguished Name of a RITS Certificate uniquely describes each RITS user by the following features: First Name; Last Name; address; and Australian Business Number of the member. 4.4 What is a RITS Token? The RITS Token is a SafeNet Rainbow ikey 2032 security token. It is an EAL2 government rated security device that performs cryptographic functions such as public key pair generation, digital signature generation, unwrapping of session encryption keys, user authentication, symmetric encryption/decryption and on-line authentication (mutual challenge/response). The ikey 2032 generates the private/public key pairs on the token, and allows the import of an existing digital ID onto the token eg an SFE Certificate. However, the token does not release the private key or allow it to be exported for external cryptographic operations, and it cannot be viewed. April

12 Secure access In the model of something you have and something you know, the token represents something the user has. Users should: keep their RITS token in their possession and/or secure at all times; and keep secret the Token Codeword used to access the certificate/s on the token, and not disclose the token codeword to anybody else, or write the Token Codeword. 4.5 How do I get a RITS digital certificate and access to RITS? The following activities are undertaken to set up a RITS user: Request access: Members must set out each user s details in a User Access Request Form signed by RITS Authorised Signatories, and provide it to the RITS Help Desk. Format token: Obtained from the RITS Help Desk, the member s RITS Password/Certificate Administrator will provide the user with a RITS Token. The user must format their token to prepare it for use with RITS, and to set a Token Codeword known only to them. Insert the token into the USB port of the PC and access Token Administration at the RITS login page and select "Format Token". Receive Pre-enrolment The RITS Help Desk will pre-enrol the user in RITS. An will be automatically sent to each user containing certificate enrolment instructions and the Private Reference Code which is part one of a two part secret required for enrolment. Receive Secret Password from your Password Administrator: The RITS Help Desk will telephone the member s RITS Password/Certificate Administrator and provide the Secret Password - which is part two of the two part secret required for enrolment. The password administrator will notify the Secret Password to the end user, together with the personal User ID to be used eg WPAC2003. Enrol for a RITS Certificate: Once the user has both the and the Secret Password provided to them by their RITS Password/Certificate Administrator, the user can enrol for their RITS Certificate by inserting their RITS Token into their PC and clicking the link in the . Internet access is required to enrol. The following enrolment details are required: first name; last name; address; the Private Reference Code from the ; and the Secret Password provided by their Password Administrator. Activate your certificate in RITS: After being notified of a successful enrolment, and prior to logging on, you must activate your new certificate in RITS. The user should go to the RITS "Token Administration screen" and obtain the Activation Code for the newly created RITS certificate and pass it to the RITS user with the Certificate Activation role. This person will select your name in the menu option called "User Privileges" and enter the Activation Code. NB. If access is required to both RITS Production and RITS Pre-Production, then the Activation Code must be entered in both. For test only users, the Activation Code should not be entered in Production. April

13 Secure access Login to RITS: The user should insert their RITS Token into their PC, then click on the link to RITS and enter: User ID: The Password Administrator will notify the User ID to the user. Password: First time users must use the Secret Password obtained from your Password Administrator and used to enrol for your certificate. Users will be forced to reset the password at first use. Users re-enrolling prior to certificate expiry should enter their existing password. Select Certificate: The user must select the RITS Certificate for the RITS membership to be accessed. Token Codeword: The user must enter the Token Codeword set when the Token was formatted. 4.6 Can I have more than one logon? A user is not permitted to have multiple RITS User IDs within one membership. However, users of two or more RITS members may have more than one logon. 4.7 How do I get a certificate with no Internet or external access? Users need external access and Internet access to enrol for a RITS Certificate. If a user does not have Internet access on their desktop, they should enrol from another PC with Internet access. If RITS users do not have external access they should contact the RITS Help Desk. Once enrolled, Internet access to RITS is not required for users accessing via ANNI. However, external access is required for individual users to receive advance notice of expiry of their RITS Certificate, and to be notified if their certificate has been revoked. Additionally, in order to ensure that no staff member has access problems and to maintain suitable access for credit and liquidity management, RITS Password/Certificate Administrators need external access to receive advance notice of certificate expiry for their staff. They will also receive notification of certificate revocations of staff. The RBA very strongly recommends that RITS users have their own address to receive security information as part of the certificate enrolment procedure. These procedures are designed to ensure that only the authorised user may enrol for the certificate issued in their name. The use of shared addresses by a member may weaken the very high security built into RITS certificate issuance procedures, by exposing them to a greater risk of internal malpractice, with resulting unauthorised issuance and use of certificates. It also means that a user may not receive certificate expiry reminder s. Where a member s internal policies or environment do not allow each RITS user to have an individual address, the RBA will require a written acknowledgement from that Member (signed by RITS authorised signatories), that they will not provide all users with individual addresses, and will rely on other internal security controls. These might, for example, involve the following: that the Password Administrators will have their own individual addresses to receive notice of revocation s, and expiry s; the owner of the shared address will not be a RITS user given the role of Password Administration; April

14 Secure access that users will format their own tokens and set a Token Codeword known only to themselves; each individual RITS user will enrol (i.e. receive certificate) via the internet. This should not be done by any other person. 4.8 Will Test Certificates be issued for access to RITS Pre-Production? No, there will be no test certificates. The RITS Production Certificate will be issued from the Production System for access to both the Pre-Production (formerly known as Industry Test) and Production Environments. Members Password/Certificate Administrators are responsible for controlling staff access to RITS Production and Pre-Production environments. To prevent test staff from accessing RITS Production, the Password/Certificate Administrator should: Only enter the Activation Code into the Pre-Production environment. [An Activation entry cannot be undone, so if it is wrong, the certificate must be revoked and the process restarted.] Ensure that the user remains Inactive in the function User Privileges in RITS Production. Ensure that the user is not given any roles in the function User Privileges in RITS Production. The RITS Status and the Certificate Status of each user in both Production and Pre-Production environments are listed on the first page of the function User Privileges. Access is available only to a user with both an Active RITS Status and an Active RITS Certificate. 4.9 Can I store my RITS digital certificate on my PC? No, RITS Certificate must be stored on the RITS Token Can the token store my Austraclear certificate? Yes, it has been proven that SFE Austraclear System certificates can be stored on the token by importing them to the token or at enrolment by inserting the token into the PC and by selecting Datakey as the encryption device. Other certificates would need to be independently tested by each RITS Member. You should note that if you need to reformat your token for any reason (for example, you have forgotten your Token Codeword or made too many attempts at the Token Codeword) all certificates on the token will be deleted. In the case of RITS, the RITS certificate must then be revoked and re-issued. Please contact the SFE for procedures relating to transferring your Austraclear certificate (from your PC) to your token. April

15 Secure access 4.11 Can copies of users RITS certificates be stored for business resumption purposes? No, it is not possible to export digital certificates from the RITS Token. Users should take their RITS Token with them when attending a business recovery site. Otherwise, the user will need to have the existing certificate revoked and request a new certificate to be issued onto another token stored at the backup site I have lost/damaged my token; can I still access RITS? No, if a user has a lost or damaged token, they will be unable to access RITS. The user should arrange for their password administrator or the RITS Help Desk to revoke their certificate and request a new certificate via the standard process Can I share a token with another user? No, each user must obtain an individual token and keep the Token Codeword secret. Sharing the Token Codeword reduces the effectiveness of the RITS security access regime Can more than one token be used on a single PC at the same time? Yes, as long as the PC has sufficient USB ports How often do I have to renew my certificate? RITS certificates expire after approximately 2 years. The timing is staggered to avoid all users of a member expiring on the same day. Users will be advised well in advance that they need to enrol for a new certificate. This requires completion of User Access Request Form. At expiry, certificates are not renewed but rather a new certificate is issued and the old one is revoked I have forgotten my Token Codeword? Forgetting the Token Codeword, and too many tries at the Token Codeword, require the token to be reformatted using the Token Administration link at the RITS login page and the RITS Information Facility web site. This will delete all certificates on the token, and requires the RITS Certificate to be revoked and the user will need to re-enrol for a new certificate using the standard process via the Help Desk I have lost my token The member s Password/Certificate Administrator will need to provide the user with a new RITS Token and revoke the user s RITS Certificate. The user will need to be enrolled for a new certificate by the standard Help Desk process I left my token at home, can I still access RITS? No. You must have your token and a valid certificate to access RITS. The member s Password/Certificate Administrator will need to provide the user with a new RITS Token and revoke the user s RITS Certificate. The user will need to be enrolled for a new certificate by the standard process. April

16 Secure access 4.19 Do I have to take my token with me if I leave my PC to get a cup of coffee or go to lunch? We suggest that you log out of RITS and remove your token upon leaving your desk for short periods. This will prevent anyone from making enquiries and updates under your User ID. If you leave the office, you should take your token with you. In addition to the above, this ensures that you have it with you should you need to go to your institution s backup site in a contingency event and continue access to RITS If I insert my token when the PC is locked I am asked to enter a PIN. This PIN is not required. Click on Cancel and the normal PC unlock request will display (ie, press Ctrl/Alt/Delete to unlock the computer) Do I have to enter my token codeword each time I authorise a payment? No, the Token Codeword only needs to be entered at log in How do I remove certificates from my token? Either delete the individual certificate or reformat the whole token to remove all certificates. This task is performed via the RITS Token Administration link on the RITS login screen Can I re-use a token for a new user? Yes. Existing certificates can be removed or the token reformatted via the RITS Token Administration link on the RITS login screen What should I do if someone is going on extended leave, and a new person is filling in? It is recommended that the absent user be made inactive in RITS and the token either stored securely by the Password Administrator or kept by the user themselves until they return to work (depending on the length of the absence). The relieving officer should have a new user created and enrol them by completing a User Access Request Form and sending it to the RITS Help Desk. A blank token should be issued to the new user What should I do when someone leaves the organisation or no longer requires access to RITS? The Password/Certificate Administrator should re-possess the user s token and reformat it. The user should be deleted from RITS Can I remove my token from my PC once I ve logged on to RITS? No, the token must remain in your PC if you are entering or settling transactions. When you send an update to RITS, it is digitally signed and the digital certificate on the token is accessed to perform this signing. If you are only using enquiry functions, these are not digitally signed, so the token is not needed and could be removed, but this is not a helpful practice. April

17 Secure access 4.27 Do I have to re-enter my RITS password and my token PIN when my RITS session times out? Yes. Username, password and token codeword need to be entered. The timeout period is 15 minutes What happens if someone accesses my RITS session while I m away from my PC and authorises a payment that settles?? The action performed by the interloper would be accepted by RITS as digitally signed by you and is not able to be undone. Each Member is responsible for the RITS activities of their staff and you would be identified as the user who performed the action. This type of problem will be avoided if you remove your token and/or logged out of RITS before leaving your PC I can t login even though there has been no change in my login details since my last login. Have you upgraded your JRE (Java Runtime Environment)? The JRE version over-rides the version which is required to access RITS. This over-ride is a bug that is outstanding with SUN. You should check the version of JRE you have installed (run the Test Card ) and revert to version I can t login to RITS from someone else s PC. When using your own token on someone else s PC there may be problems with your configuration and RITS doesn t recognise you as a valid user. You may get a Certificate not selected error upon login. This can be overcome by making a change to your PC profile on the other PC. This is performed by running the Testcard (available from the RITS logon screen). The Central Signing Interface software will be updated and allow login. April

18 Functionality 5 RITS FUNCTIONALITY 5.1 Are there any other system changes to RITS? There are no changes to the business rules eg to SWIFT processing or settlement rules for the RITS System Queue process. However, the new interface has provided some amalgamation of functions. 5.2 Can my password administrator still do the same things? Member s Password/Certificate Administrators are still responsible for controlling user access to RITS. They can activate and inactivate users, add and deny access to roles, allow users to be authorisers, link and unlink a user to a branch, and reset passwords. In addition, the roles of Activating a Certificate and Revoking a Certificate can be allocated to a Password Administrator, or can be allocated to a separate Certificate Administrator, depending on the security arrangements for your organisation. 5.3 How do I get a new user set up? See section 4.5 of this document How do I get a RITS digital certificate and access to RITS? Also refer to the RITS Access and Security User Guide available from the RITS Information Facility. 5.4 How can a user s profile be changed? Your Password/Certifcate Administrator can alter the profiles of users in terms of activating and inactivating users, adding and denying access to roles, linking and unlinking a user to a branch, and resetting passwords. If a new user takes over an existing user ID this must be arranged with the RITS Help Desk. It will involve revoking the previous user and requesting the setup of a new user for that ID. 5.5 Is there any change to the Disaster Recovery arrangements for RITS of which I need to be aware? Yes, your staff should be set up with a desktop shortcut or Favourite to the RITS Launch Page at all your operating sites. Separate icons for Production and backup RITS access are no longer required. You should arrange for some blank RITS Tokens to be stored at your Business Recovery Site in case staff arrive there in a contingency event without their RITS Tokens. RITS users should be periodically reminded to remember to take their RITS Tokens to your Business Recovery Site. Otherwise, the changes that were made for the new RITS user interface did not affect the core aspects of RITS operations. RITS will continue to operate a Primary and Redundant facility at the Primary Site, and backup facilities at a Secondary Site. April

19 5.6 More information on RITS functionality. Technical and Operational FAQs Functionality Guides to RITS functionality are available at the RITS Information Facility, from the facility inside RITS (via the I icon in the header) and from the internet. 5.7 Will we have access to the same branches? Users will be still able to perform actions on behalf of different branches. However, in the new interface users must be linked to the branch (by the Password/Certificate Administrator or the RITS Help Desk) to perform certain branch functions (cash transfers, manage queued payments at the cash account level, set cash account override statuses, set cash account sublimit and participate in the new batch facility). More information on this can be found in the RITS Information Facility. April

20 Migration 6 MIGRATION 6.1 When do we move to the new System? The underlying system is still the same; the only change is to the interface through which you use it. This means that we don t have a big bang cutover from one system to another. More details are available in Information Paper No When will the new Interface be available? The User Interface will be available for Member trial access during the Pre-Production period in Q2 of Migration windows will be available from Q for access to Production. Members may select when to go live in Production from a specified window. More information about migration arrangements is contained in Information Paper No What are the arrangements for a testing period? Prior to the Production interface being available to Members, connectivity and application verifications will be undertaken by Members. Users will access the Pre - Production Environment (formerly known as Industry Test) to familiarise themselves with the new interface. More details are available in Information Paper No Can I logon via both old and new interfaces? Yes, you can be logged on via both old and new interfaces at the same time. You can also view and update the same data from both interfaces. The old functionality will be turned off once you are happy that your users have migrated to the new functionality successfully. 6.5 How do members migrate? The RBA will make migration windows available during which Members can nominate when they wish to migrate from the current access method to the new RITS User Interface. This migration will take place after each Member completes their Pre-Production verifications. Functionality not delivered in Phase 1 will continue to be accessed via the existing interface until the replacement functionality is rolled out. See Information Paper No 4 for more details. April