Loading...
HomeMy WebLinkAboutNC0047384_Pretreatment_CROMERR_Application_20240304r City of Greensboro 64�,J North Carolina March 4, 2024 Mr. Michael Montebello, Branch Chief NC DEQ DWR NPDES Permitting 1617 Mail Service Center Ralegih, NC 27699-1617 Mr. Montebello, Water Resources Department EMAIL TRANSMITTAL [Michael.Montebello@deq.nc.gov] The City of Greensboro Industrial Waste Section is requesting an Industrial Pretreatment Program modification authorizing the City to received reports electronically for its Industrial Waste Pretreatment Program. We will be using SwiftComply's pretreatment software as a CROMMER COTS solution that meets technical CROMERR requirements predominantly through use of the EPA's Shared CROMERR Services. As prescribed by the EPA guidance for POTW Pretreatment Program CROMERR applications, the CROMERR Checklist has been completed and the EPA Office of Environmental Information CROMERR team has been copied. They should provide feedback over the content and completeness of the package. In preparing the application materials, other programs' approaches were reviewed and their models for CROMERR approval were followed for the City's Industrial Waste Pretreatment Program. Included for your review are the following attachments: • CROMERR System Checklist — GreensboroNC • CROMERR Application o CROMERR Application Cover Sheet a Legal Authority o Electronic Signature Agreement (ESA) o Registration Process Workflow o Signature Submission Process Workflow o System Overview a Screen Images o Confirmation Receipt If you have any questions or need any additional information to approve this request, please contact the undersigned. Sinc rely, Amy Va oski Pretreatment Coordinator (336) 433-7227 Amy.Varinoski@greensboro-nc.gov Alicia Goots Superintendent of Laboratory & Pretreatment Services (336) 373-3284 Alicia.Goots@Rreensboro-nc.gov cc: EPA Office of Environmental Information [CROMERR@epa.gov] PO Box 3136 Greensboro, NC 27402-3136 > www.greensboro-nc.gov 336-373-CITY (2489) , TTY # 333-6930 640 CROMERR Application Cover Sheet Agency type: M Local Government Agency — Publicly Owned Treatment Works Please do not use arrnnvms when rmmnlefina this fnrm Primary Application Contact First Name: Last Name: Position: Agency: Amy Varinoski Utilities Pretreatment Coordinator City of Greensboro Water Resources Mailing Address: E-mail: Primary Work Phone: City of Greensboro Water Resources 2350 Huffine Mill Road McLeansville, NC 27301 amy.varinoski(a�greensboro 336-580-8247 -nc.gov Fax: Secondary Work Phone: 336-433-7227 Secondary Application Contact First Name: Last Name: Position: Agency: Alicia Goots Superintendent of Laboratory and Pretreatment Services City of Greensboro Water Resources Mailing Address: E-mail: Primary Work Phone: City of Greensboro Water Resources 2350 Huffine Mill Road McLeansville, NC 27301 alicia.goots(a)greensboro- 336-373-3284 nc.gov Fax: Secondary Work Phone: May we share any components of your application for instructive/informative purposes? ❑ Yes ❑ Yes, with limitations M No If you selected `yes, with limitations EPA will contact you to discuss those limitations This application includes (Check all that apply): M CROMERR System Checklist (02-CROMERR System Checklist— GreensboroNC) ❑ No system checklist, but description of how this system complies with relevant CROMERR requirements ❑ Schedule of planned upgrades or changes to this system M Other attachments (Please list here or in a separate document): • 03-Attachment 1 Legal Authority • 04-Attachment 2 Electronic Signature Agreement (ESA) • 05-Attachment 3 Registration Process Workflow • 06-Attachment 4 Signature Submission Process Workflow • 07-Attachment 5 System Overview • 08-Attachment 6 Screen Images • 09-Attachment 7 Confirmation Receipt 01-CROMERR Application Cover Sheet GreensboroNC 1 of 3 Updated: 9/1/2023 For states, tribes and local governments (must select one of the following):8 ® Signed legal certification is attached er ferthGGMiRg by moil ❑ Approved CROMERR legal certification already on file with EPA Brief overview of system System name: SwiftComply Pretreatment IU Portal City of Greensboro Water Resources (Greensboro) manages the industrial pretreatment program and is implementing SwiftComply's Pretreatment Compliance Solution which includes an IU Portal providing ability for permitted industrial users to sign and electronically submit self -monitoring reports permit applications and other program related communications. CROMMER approval is required for Greensboro's program in order to fully implement the SwiftComply IU portal portion of the solution. The system will connect to Shared CROMERR Services developer APIs to provide all technical CROMERR requirements though using existing Shared CROMERR Services technology including authentication, user management, signature and Copy of Record (COR) and messaging. All systems (check all that apply): ® Collects CROMERR priority report(s) ® Collects report(s) requiring signature ® Uses an electronic signature EPA -authorized program systems only (check all that apply): ® Uses an off -the -shelf product* ® Uses all Shared CROMERR Services ❑ with minor customizations or ® with no customizations* ❑ Uses some Shared CROMERR Services *Note: SwiftComply is a new off -the -shelf product and uses Shared CROMERR Services for Messaging, Authentication, Signature and COR and User Management. Identity Proofing will be performed manually using the attached ESA and will mirror our existing (physical) process to obtaining official facility signatories. EPA systems only (check all that apply): ❑ Uses only out -of -the -box CDX CROMERR components ❑ with minor customizations or ❑ with no customizations ❑ Uses significantly customized CDX CROMERR functionality Number of systems addressed in this application: 1 We do not recommend more than one system per application unless those systems work together to provide a complete CROMERR solution 01-CROMERR Application Cover Sheet GreensboroNC 2 of 3 Updated: 9/1/2023 For States, Tribes and Local Governments Only This application requests modification/revision of the following authorized program(s) under 40 CFR: Detailed regulatory report lists are not required Requesting CROMERR approval for reporting does not obligate a program or agency to collect electronically under that program. If the system's initial reporting may be expanded, we recommend selecting all possible authorized programs from the list below. Unless otherwise requested, applicants are approved for all possible reporting under an authorized program. Air ❑ 52: Approval and Promulgation of Implementation Plans (SIP/Clean Air Act Title II) Reporting under CFR 50-52 ❑ 60: Standards of Performance for New Stationary Sources (NSPS/CAR/Clean Air Act Title III) Reporting under CFR 60 & 65 ❑ 62: Approval and Promulgation of State Plans for Designated Facilities and Pollutants (NSPS/Clean Air Act Title III - Hospital/Medical) Reporting under CFR 62 ❑ 63: National Emission Standards for Hazardous Air Pollutants for Source Categories (NESHAP MACT/Clean Air Act Title III) Reporting under CFR 61, 63 & 65 ❑ 70: State Operating Permit Programs (Clean Air Act Title V) Reporting under CFR 64 & 70 ❑ 71: Federal Operating Permit Programs (Clean Air Act Title V) Reporting under CFR 64 & 71 Water ❑ 123: EPA -Administered Permit Programs: the National Pollutant Discharge Elimination System (NPDES) Reporting under CFR 122 & 125 ❑ 142: National Primary Drinking Water Regulations Implementation (NPDWR) Reporting under CFR 141 ❑ 145: State Underground Injection Control Programs (UIC) Reporting under CRF 144 & 146 ❑ 233: "404" State Program Regulations (Ocean Dumping) Reporting under CFR 233 ® 403: General Pretreatment Regulations for Existing and New Sources of Pollution Reporting under CFR 403-471 ❑ 501: State Sludge Management Program Regulations Reporting under CFR 501 & 503 Waste ❑ 239: Requirements for State Permit Program Determination of Adequacy (RCRA Subtitle C) Reporting under CFR 240-259 ❑ 271: Requirements for Authorization of State Hazardous Waste Programs (RCRA Subtitle C) Reporting under CFR 260-270, 272-279 ❑ 281: Technical Standards and Corrective Action Requirements for Owners and Operators of Underground Storage Tanks (UST) Reporting under CFR 280 Chemicals ❑ 745: Lead -based Paint Poisoning Prevention in Certain Residential Structures (FLPP/RRP) Reporting under CFR 745 ❑ 763: Asbestos Reporting under CFR 763 Special Cases ❑ 65: Consolidated Federal Air Rule (CAR/Clean Air Act Title III) Reporting under CFR 65 ❑ 69: Special Exemptions from Requirements of the Clean Air Act (Clean Air Act Title V) Reporting under CFR 70 ❑ 132: Great Lakes Water Quality Standards (WQS) Reporting under CFR 130-132 ❑ 162: State Registration of Pesticide Products Reporting under CFR 162-169 ❑ Emergency Planning and Community Right -to -Know Act (SARA Title III/CRTK) Reporting under EPCRA Sections 302-304, 311-313 ❑ Other: 01-CROMERR Application Cover Sheet GreensboroNC 3 of 3 Updated: 9/1/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Item SwiftComply Pretreatment IU Portal for City of Greensboro, NC Water Resources using Shared CROMERR Services development APIs for some functionality CROMERR System Checklist Registration (e-signature cases only) 1. Identity -proofing of registrant Business Practices: City of Greensboro, NC Water Resources (Greensboro) requires all registrants to complete an electronic signature agreement (ESA) as part of the account creation process. Only signatories will be able to sign and submit reports, there will be no other CROMERR related user levels. The registrant requests an account verbally or is notified by Greensboro as part of their Permit Application or during a physical Site Inspection. The registrant will sign the ESA, witnessed by a facility (industry) officer and be validated by Greensboro Staff by confirming signature against a State ID card, driver's license or US Passport. The registrant may fill out the paperwork at Greensboro's utility office or during a physical site inspection, the wet -ink signature ESA will be hand delivered. If the account is satisfactory, the registrant will then be provided access to complete CROMERR registration, linking to the Shared CROMERR Services (SCS) User Management through the SwiftComply Pretreatment IU Portal. The registrant will already have a SwiftComply IU portal account which is administered by Greensboro. This local application user (LAU), the SwiftComply software user, is apart from the CROMERR Registration and subsequent credentials required for the signatory. The signatory will connect to SCS User Registration through their SwiftComply LAU. The account setup process (password, challenge questions, and contact information) relies on SCS APIs. Once the CROMERR credentials are set up and approved by Greensboro, a signatory user will have access to features that allow signing, report submission and repudiation. 1. A "Subscriber Agreement" and physical validation process. Greensboro will expand its existing practice of managing valid industrial user (facility) signatories for physical paper submission to help satisfy identity -proofing of registrants for use with the SwiftComply Pretreatment IU Portal. Prior to being provided an option for online signatory registration within the system, the user must physically register as a signatory, the user is required to provide a handwritten, wet -ink signature on a paper -based Electronic Signature Agreement (ESA) to designated Greensboro staff to be able to certify and submit any application in the SwiftComply IU Portal. This registration must be presented in person and validated by Greensboro either at Greensboro or at the SIU's facility while being inspected by Greensboro. The Subscriber Agreement must be witnessed and signed by an officer of the facility or be accompanied by a letter certifying that the applicant is a valid employee or legal representative of the facility. A physical copy of the witnessed ESA and any accompanying certification of employment will be maintained on file by Greensboro. During periodic inspections, minimally one per year, Greensboro staff will confirm the continued status of the authorized facility representative who signed the ESA. Should the signatory reside out of town and cannot be physically present, a notarized witness to the signature shall be required. 2. SCS Registration: After Greensboro receives the completed ESA, a Greensboro Admin user will enable the signatory's SwiftComply LAU to have access to register for their signatory credentials. This will allow the signatory to complete their CROMERR signatory credentials. After completion of the registration process, the signatory and the Greensboro Admin will receive a notice. Greensboro Admin will connect to CROMERR User 02-CROMERR System Checklist-GreensboroNC 1 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Registration (e-signature cases only) Management to update the signatory's user status to approved. This status may be maintained and changed by the Greensboro Admin. To clarify further, there are two options planned for collecting wet signature ESA's. In cases where the industry has delegated signatory authority as described in 40 CFR 403.12(I), there is already a delegation letter on file for each industrial user signatory designee certifying them as the signatory for said industrial user. Greensboro will collect ESAs for each of these existing signatories to supplement their records and support CROMERR requirements. Two options are proposed, if a letter is not on file or the signatory is new or changes, a new letter will be required. 1. Physical (in -person) validation option for the Electronic Signature Agreement (ESA). The ESA, on Greensboro letterhead, will be physically presented to the signatory during a site inspection or other site visit by Greensboro staff. As outlined in the above response: "...the user must physically register as a signatory, the user is required to provide a handwritten, wet -ink signature on a paper -based Electronic Signature Agreement (ESA) to a designated Greensboro staff member." This registration must be presented in person and validated by Greensboro either at Greensboro or at the industry's facility while being inspected by Greensboro. The Subscriber Agreement must be signed by an officer of the facility or be accompanied by a letter certifying that the applicant is a delegated signatory or legal representative of the facility. 2. Notarized Company Letter (remote) validation. In cases where an in -person meeting is not possible, the ESA, on Greensboro letterhead, will be signed by the industry signatory and must also be notarized. The original hard copy, notarized ESA with wet ink signature shall be delivered to Greensboro prior to the industry being allowed to register to use the SwiftComply portal and SCS. In cases where the signatory does not meet the authority requirements of 40 CFR 403.12(I), a letter delegating authority to the signatory shall also be required. Other actions/steps may be taken by Greensboro staff to validate these individuals as official representatives of an industry as outlined in narratives below (sections 1 b, 2, 3 and 4) System Functions: 1. a link to connect to Shared CROMERR Services User Management utility for Registration: a. enter challenge questions/answers and provide password b. follow-up actions after registration and approval of signatory user status by Greensboro Admin Supporting Documentation (list attachments): • 04-Attachment 2 Electronic Signature Agreement (ESA) • 05-Attachment 3 Registration Process Workflow la. (priority reports only) Identity -proofing before accepting e-signatures Business Practices: Login credentials are required by a signatory for both the Local Application Users (LAU) to the SwiftComply Solution and to the SCS Signature and Copy of Record (COR) Service before signatory can enter or submit data. Registrants are not provided access to SCS registration prior to a completed ESA being received and validated by Greensboro. 02-CROMERR System Checklist-GreensboroNC 2 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Registration (e-signature cases only) System Functions: None. Supporting Documentation (list attachments): • 05-Attachment 3 Registration Process Workflow 1 b. (priority reports only) Identity -proofing method (See 1 bi, 1 bii, and 1 b-alt) 1 bi. (priority reports only) Verification by attestation of disinterested individuals Business Practices: SCS maintains authorized signatory credentials, they are not stored in the local application user's (LAU) account in SwiftComply. A signatory must also have secure account access to the SwiftComply Pretreatment IU Portal. Only Permitted Industrial Users or facilities approved by Greensboro have access to the SwiftComply application. ESA receipt and system admin approval is required before access is created to register to SCS and subsequent subscriber user status must be updated by a Greensboro Admin to sign and submit an electronic report. The only method to create and receive an approved ESA for identity proofing is on paper with witnessed wet -ink signature. Wet -ink signature: Greensboro staff will be present during the completion of the ESA and signature process. The completion of these documents will also be witnessed by an industrial facility officer or properly delegated representative. In cases where an in -person meeting is not possible, the ESA, on Greensboro letterhead, will be signed by the industry signatory and must also be notarized. Other due diligence may include performing actions such as verification phone calls or emails to both the industry and/or other industrial facility staff as well as periodic physical confirmation of the signatory's continued employment during facility inspections performed by Greensboro. System Functions: None Supporting Documentation (list attachments): • 05-Attachment 3 Registration Process Workflow 1 bii. (priority reports only) Information or objects of independent origin Business Practices: Please see 1 bi. System Functions: Please see 1 bi. Supporting Documentation (list attachments): Please see 1 bi. lb-alt. (priority reports only) Subscriber agreement alternative 02-CROMERR System Checklist-GreensboroNC 3 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Registration (e-signature cases only) Business Practices: Please see 1 bi. System Functions: Please see 1 bi. Supporting Documentation (list attachments): Please see 1 bi. 2. Determination of registrant's signing authority Business Practices: Greensboro's existing Sewer Use Ordinance for their pretreatment program provides for use of a legal Permit Document and identification of valid facility/industrial user signatories. This is currently performed to document, validate and keep on file, proof of a valid facility signatory for priority 1 reports (self -monitoring reports) which are currently physically submitted to Greensboro by industries. The existing process is being expanded to include adoption of the ESA for each signatory. The ESA must be physically signed by an officer or delegated representative of the facility in the presence of a Greensboro staff member who can witness the signing and request confirming identification. The ESA contains rule and statutory citations providing authority for Greensboro to accept digital signatures. In addition, the certification language will be presented to the signatory during the signature process for any report signed and submitted. The Permit to Discharge Wastewater and periodic compliance inspections provide the ability and opportunity to continually verify a signatory's credentials. If findings indicate the customer's account isn't appropriately maintained or valid, access to the SwiftComply Pretreatment IU Portal will be locked until identified deficiencies are addressed. System Functions: Signatory must certify acceptance and validity of the electronic signature process each time they sign and submit a report during the signature and submit process, through the IU Portal using SCS. Supporting Documentation (list attachments): • 04-Attachment 2 Electronic Signature Agreement (ESA) • 05-Attachment 3 Registration Process Workflow 3. Issuance (or registration) of a signing credential in a way that protects it from compromise Business Practices: Greensboro's approach allows access to their SwiftComply Pretreatment IU Portal only to Permitted Industrial Users or validated facilities as allowed by their Sewer Use Ordinance. A signatory is only granted access to the registration process after being validated through the ESA process and being allowed access to register to SCS by a Greensboro admin user. After completing the SCS registration which provides the signatory with credentials to sign and submit a report electronically, they must also have their system status changed to approved by a Greensboro admin user, so there are five layers of protection 1 Permitted Industrial User 2 02-CROMERR System Checklist-GreensboroNC 4 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Registration (e-signature cases only) Access to SwiftComply Pretreatment IU Portal, 3) ESA validation, 4) Access to Register as a SCS Signatory, 5) Approval by system admin to sign/submit. The SwiftComply application "user/pwd" is separate from SCS and is not used for SCS API registration service or signatory service. The SwiftComply application's user/credential management does not meet the requirements of CROMERR. However, an IU user must have a SwiftComply account to access a link to register with SCS or sign/submit a report which can be done after they have fully registered through the SCS CROMERR registration process. Greensboro admin user will be able to enable/disable access to registration and subsequently enable/disable access to sign/submit reports through the SwiftComply application user management (settings). The user registration process and the signature process will rely on the SCS APIs. The CROMERR signatory credentials, security and process are completely separate from SwiftComply application credentials process. Users simply will have access to a url/link to either register or sign/submit through SwiftComply. SwiftComply is used to create the SMR report (COR) that is to be reviewed, signed, and submitted. High Level Order of process: User Setup 1) Greensboro creates a SwiftComply IU User 2) SwiftComply IU User establishes SwiftComply user credentials 3) ESA is completed by IU and confirmed by Greensboro. 4) Greensboro enables SCS registration link inside SwiftComply application for ESA IU user 5) SwiftComply IU User, clicks registration and goes through SCS registration process 6) Signatory is now registered with unique, separate credentials for SCS 7) Greensboro enables report submission link for Signatory in SwiftComply application Recurring Process 8) SwiftComply IU User prepares SMR report for Sign/Submit 9) Signatory can begin report submission process, click link, signs into SCS 10) Signatory reviews SMR Report, chooses to sign, presented with certifications 11) Signatory goes through Signatory process in SCS The SwiftComply application logon credentials are not used in the signature process. However, users must be logged into SwiftComply Pretreatment IU Portal and be granted access to begin any SCS processes. System Functions: 1. Signatory must be a Permitted User and be provided access credentials to SwiftComply solution 2. Signatory must be provided access by system admin to register through SCS for signatory credentials 3. Signatory must complete registration process through SCS (relies on SCS APIs): a. Must follow all rules for username/password security required by SCS b. Must fill out knowledge base challenge questions and present answers as outlined by SCS System Admin must approve status change for signatory Supporting Documentation (list attachments): • 05-Attachment 3 Registration Process Workflow 02-CROMERR System Checklist-GreensboroNC 5 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Registration (e-signature cases only) 4. Electronic signature agreement Business Practices: Greensboro will complete the verification process in person for an employee of a permitted industrial user or facility connected to the city sewer. The registrant cannot initiate credential setup for the CROMERR Sign/Submit process until they have completed the ESA process and been enabled to allow access to the SCS registration by a City Admin user. Greensboro is required to perform at a minimum, one inspection annually at each permitted industrial user but may make additional site visits if necessary. During the facility inspection process the employment and signatory status of the ESA/Signatory will be audited and confirmed. All records related to the ESA and any documents indicating the authority of the user to sign documents will be stored in a locked vault in the administration office at Greensboro. All records related to the ESA and signature authority will be stored for a minimum of five years after the deactivation of the signature device. System Functions: No access to register as a signatory is granted without an ESA. Supporting Documentation (list attachments): • 04-Attachment 2 Electronic Signature Agreement (ESA) Updated CROMERR System Checklist Signature Process (e-signature cases only) 5. Binding of signatures to document content Business Practices: SwiftComply's Pretreatment Solution IU Portal will use the Shared CROMERR Services for Signature and Copy of Record (COR). The IU Portal combines and zips all files and supplies a single record to be included as COR. Username, password, challenge question, challenge question answer, and date/time of submittal (relies on SCS APIs) will be combined to create the validation key by SCS. After the COR has been signed and submitted, the IU Portal will subsequently retrieve the key file and link to validate, retrieve or repudiate the COR from the shared service and email confirmation to both to the signatory and the Greensboro Admin. Greensboro will maintain a log of the COR submission within SwiftComply's Pretreatment Solution and in addition provide a link to the SCS for COR access (Download COR service). All submitted reports/documents will remain accessible to the signatory in the IU portal and by download as COR through SCS. Greensboro will utilize the repudiation shared service in the event a stored document is repudiated by a customer, this is system configurable but is established to allow for timely processing of electronically received compliance data. System Functions: Each report/document submitted will use this same process flow: • The signatory signs into the SwiftComply Pretreatment IU Portal. • The signatory selects report to submit and clicks the submit button. 02-CROMERR System Checklist-GreensboroNC 6 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Process (e-signature cases only) • The signatory is presented summary data view of the data they are about to sign and list of attachments/files and given an opportunity to go backwards or link to make corrections. • The signatory clicks the Next button • The signatory reads the certification statement for the e-signature process • The signatory selects the checkbox next to the certification statement indicating they agree. • The signatory then will answer one randomly selected challenge question. • The signatory then is prompted for password and clicks the continue button. • The IU Portal will verify all signature credentials • If signatory answers the challenge question incorrectly, • The 1st failure is logged • Signatory may try again (a new question/answers) until account is locked • If the number of failed answers hits 3x, the account is changed to locked status • The IU Portal will submit, to the shared CROMERR service, the COR file and signature credentials. • The IU Portal will retrieve the hash and COR from the SCS service for storage in SCS. • The IU Portal will retain all submitted reports in a human readable format as it was submitted. • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. • The IU Portal will send an email notice to the Greensboro Admin with a link and validation key for the submitted COR. Human Readable Copy of Record (COR) • The COR will consist of a zip file of all data and attachment files submitted. Data will be in either a pdf or csv format. All attached documents shall be retained in their native format. o All data submitted, e.g., analytical results of sampling activities, effluent flow meter data, pdf files, As files will be accessible in the SwiftComply IU portal in their submitted form but locked from editing. • The entirety of the zip/COR file will also be available to the Signatory user. • Included in the document is: o Any data given to the agency as part of the report submittal Including any system configured electronic certifications that may be added in addition to certifying/agreeing to the e-signature process. o The username of the person that submitted o The date and time of submittal Signature Credential • Username and password used • Challenge question asked and answered • Date and Time of the submittal Email Confirmation Upon Submittal • Upon a successful submittal, an email is sent to the Signatory that, at a minimum, will contain: o A brief acknowledgement that the agency received the submittal o Link(s) to download a copy of the COR, validate or repudiate the submitted report. 02-CROMERR System Checklist-GreensboroNC 7 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Process (e-signature cases only) Supporting Documentation (list attachments): • 06-Attachment 4 Signature —Submission Process Workflow 6. Opportunity to review document content Business Practices: The signatory or other local application user of the IU Portal may prepare the report and data for the sign/submit process, however, only the signatory has access to proceed and complete the process. 1. Review of the report package, data and files to be submitted is available throughout the data entry or report draft process. For Pretreatment, submission of a reporting package typically contains one or more data sets of analytical sampling results, effluent flow readings, required documents and certification statements. This is considered a single `report package' and is signed/submitted together at one time. The system may also be used to sign and submit a single file or other required form (e.g., Permit renewal application form) 2. When clicking the link to continue to sign/submit process a review screen is presented with a summary of all data and a list of attached files. The user may click and review details of any item or go back and see all the data still in edit mode prior to continuing. The goal here is to summarize the content of the report for quick or optionally further detailed review before signing and submitting the report package. System Functions: Each report/document submitted will use this same process flow: • The signatory selects the report (package) to submit and clicks the submit button. • The signatory is presented with a summary data view of the data they are about to sign and a list of attachments/files and given an opportunity to go backwards or link to make corrections. • The signatory clicks the Next button or Cancel to return and make edits • If continuing, the signatory reads the certification statement for the e-signature process • The signatory selects the checkbox next to the certification statement indicating they agree confirming that this report may no longer be edited in the future (without going thru repudiation). • The signatory then will answer one randomly selected challenge question. • The signatory then is prompted for password and clicks the continue button. • The IU Portal will verify all signature credentials • If signatory answers the challenge question incorrectly, • The 1st failure is logged • Signatory may try again (a new question/answers) until account is locked • If the number of failed answers hits 3x, the account is changed to locked status • The IU Portal will submit, to the shared CROMERR service, the COR file and signature credentials. • The IU Portal will retrieve the hash and COR from the SCS service for storage in SCS. • The IU Portal will retain all submitted reports in a human readable format as it was submitted. • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. 02-CROMERR System Checklist-GreensboroNC 8 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Process (e-signature cases only) Human Readable Copy of Record (COR) • The COR will consist of a zip file of all data and attachment files submitted. Data will be in either a pdf or csv format. All documents attached shall be retained in their native format. o All data submitted, e.g., analytical results of sampling activities, effluent flow meter data, pdf files, As files will be accessible in the SwiftComply IU portal in their submitted form but locked from editing o The entirety of the zip/COR file will also be available to the Signatory user. • Included in the document is: o Any data given to the agency as part of the report submittal • Including any system configured electronic certifications that may be added in addition to certifying/agreeing to the e-signature process. o The username of the person that submitted o The date and time of submittal Supporting Documentation (list attachments): • 06-Attachment 4 Signature —Submission Process Workflow 7. Opportunity to review certification statements and warnings Business Practices: The IU Portal provides the e-signature certification statement prior to signature. Each file type or report type to be submitted can have additional certifications configured to be presented and electronically signed. These will appear on the same screen. Some certifications can be optional, but if required, the check box must be selected before the signature process can continue. The certification statement is included on the COR. Each business process implemented (priority and non- priority reports alike) will have the ability to have their own system admin configured certification statement and be changeable over time. The "08-Attachment 6 Screen Images" is an example of the screens and process, which can be configured to display any (required) statements including multiple statements that the signatory must attest to and (e-sign) sign before proceeding. The two certification statements currently planned are as follows (these can be edited or added to as required): (1) 1 agree that the use of my electronic signature device (Username and Challenge Question/Answer) shall serve as a legally enforceable signature in the same manner as an original signature on a paper document pursuant to the provisions of the State's relevant regulations and requirements. I will be held legally bound, obligated, and responsible for my use of my electronic signature as I would be by using my hand-written signature in submitting an electronic document to the SwiftComply Pretreatment Solution. (2) 1 certify under penalty of law that I have personally examined and am familiar with the information submitted to the Greensboro and I believe that the information is true, accurate and complete. I am aware that there are significant penalties for submitting false information, including the possibility of fine and imprisonment. 02-CROMERR System Checklist-GreensboroNC 9 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Process (e-signature cases only) System Functions: Certification statements are managed through code tables so that what is seen on the screen is always in sync with what gets presented on the signature page during preview of the data for the COR. Supporting Documentation (list attachments): • 04-Attachment 2 Electronic Signature Agreement (ESA) Updated • 08-Attachment 6 Screen Images CROMERR System Checklist Submission Process 8. Transmission error checking and documentation Business Practices: All sessions (transmissions) use the latest Secure Sockets Protocol (SSL) protecting the process from data loss or attacks during transmission. SwiftComply's solution is SOC2-Typell certified. https://secureframe.com/blog/soc-2-type-ii For transmission errors that can happen during the submission process, the user is presented with an instant response error report that displays the system couldn't process the report submission, the status is returned to pending and remains unsigned/unsubmitted and can still be edited. An email notice will also be sent to the signatory user. The user will be prompted to attempt the submission again and if continued transmission errors occur to contacts stem support for diagnosis. System Functions: Each report/document submitted will use this same process flow: • The signatory then is prompted for password and clicks the continue button. • The IU Portal will verify all signature credentials • If signatory answers the challenge question incorrectly, • The 1st failure is logged • Signatory may try again (a new question/answers) until account is locked • If the number of failed answers hits 3x, the account is changed to locked status • The IU Portal will submit, to the shared CROMERR service, the COR file and signature credentials. • The IU Portal will retrieve the hash and COR from the SCS service for storage in SCS. • The IU Portal will retain all submitted reports in a human readable format as it was submitted. • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. • The IU Portal will send an email notice to the Greensboro Admin with a link and validation key for the submitted COR. Failure: SCS API times out, does not return a response or is rejected, an error message will appear on screen and email notice is sent to the signatory user and system admin with the error message information. 02-CROMERR System Checklist-GreensboroNC 10 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Submission Process Supporting Documentation (list attachments): • 06-Attachment 4 Signature —Submission Process Workflow 9. Opportunity to review copy of record (See 9a through 9c) 9a. Notification that copy of record is available Business Practices: After the user receives (successful) confirmation of submission, 1. An email notice will be received with validation key and links to download COR, validate or repudiate 2. The submitted report remains (locked from edit/delete) in the original system used to gather and submit the report. Its status will be Submitted but remains fully viewable. 3. The Greensboro System Admin will also receive an email notice and be provided the opportunity to download the COR. System Functions: Submission Receipt • The IU Portal will retain all submitted reports in a human readable format as it was submitted. • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. • The IU Portal will send an email notice to the Greensboro Admin with a link and validation key for the submitted COR. Human Readable Copy of Record (COR) • The COR will consist of a zip file of all data and attachment files submitted. Data will be in either a pdf or csv format. All documents attached shall be retained in their native format. • All data submitted, e.g., analytical results of sampling activities, effluent flow meter data, pdf files, As files will be accessible in the SwiftComply IU portal in their submitted form but locked from editing o The entirety of the zip/COR file will also be available to the Signatory user. • Included in the document is: o Any data given to the agency as part of the report submittal Including any system configured electronic certifications that may be added in addition to certifying/agreeing to the e-signature process. o The username of the person that submitted o The date and time of submittal Supporting Documentation (list attachments): None. 9b. Creation of copy of record in a human -readable format Business Practices: See 9a. 02-CROMERR System Checklist-GreensboroNC 11 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Submission Process System Functions: See 9a. Supporting Documentation (list attachments): • 10-COR Example 9c. Providing the copy of record Business Practices: See 9a. System Functions: See 9a. Supporting Documentation (list attachments): • 10-COR Example. 10. Procedures to address submitter/signatory repudiation of a copy of record Business Practices: The IU Portal will have an option to initiate repudiation of a submitted report (COR). The submitter may initiate this from their confirmation email link or from a link on the report record in the IU Portal. The COR will remain in SCS with a status updated to Repudiated and that status is also reflected on the original data record within the IU Portal Application. The repudiated record will remain locked, however, if the submitter desires to edit and resubmit the information, it may be copied into a new report record for edit, review to be signed and submitted. This does not reflect itself as the same record that was repudiated, however, as a new record. Repudiation does not require Greensboro system admin review; however, the Greensboro Admin user will be notified via email receipt that the previous submitted report was repudiated. Greensboro will provide for repudiation in compliance with CROMERR. This shall not limit Greensboro's ability or authority to take enforcement against any user as outlined in an industrial user's permit or as allowed by applicable laws and/or regulations. System Functions: • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. • The IU Portal will send an email notice to the Greensboro Admin with link and validation key for the submitted COR. • Should the user initiate the repudiation, they will proceed through the signatory process, confirm desire to complete the repudiation and securely sign the confirmation to initiate the process. • The submitter and Greensboro System Admin will both receive notice of repudiation. 02-CROMERR System Checklist-GreensboroNC 12 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Submission Process The original record status will change from submitted to repudiated. It will remain locked from edit/delete and may not be resubmitted. It may be copied, edited and resubmitted as a new report. Supporting Documentation (list attachments): • 06-Attachment 4 Signature —Submission Process Workflow 11. Procedures to flag accidental submissions Business Practices: The submission of reports is a multi -step approach minimizing the risk for accidental submittals. The signatory must check the certification box, type in a challenge question answer, and click on a submit button for the submittal to move forward. Accidental submittal becomes the responsibility of the signatory who is incumbent to repudiate the report and contact Greensboro to determine any outlying business or regulatory consequences. System Functions: Accidental submittals are handled thru the same process as repudiation. There is no functionality designed to allow for Greensboro Admin users to change the status of a Submitted Report. The only report status exposed to Greensboro will be Submitted or Repudiated. • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. • The IU Portal will send an email notice to the Greensboro Admin with a link and validation key for the submitted COR. • Should the user initiate the repudiation, they will proceed through the signatory process, confirm desire to complete the repudiation and securely sign the confirmation to initiate the process. • The submitter and Greensboro System Admin will both receive notice of repudiation. • The original record status will change from submitted to repudiated. It will remain locked from edit/delete and may not be resubmitted. It may be copied, edited and resubmitted as a new report. Supporting Documentation (list attachments): • 06-Attachment 4 Signature —Submission Process Workflow 12. (e-signature cases only) Automatic acknowledgment of submission Business Practices: After each submittal, there is an onscreen confirmation and an email is sent to the signatory user and to the Greensboro Admin user that contains an acknowledgement of submittal, validation key and links to take further action should they be needed for repudiation, validation or download of COR. Should the submission fail, the confirmation notice on screen and automated email will reflect that status and direct the user to attempt resubmission if due to transmission error. System Functions: The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. 02-CROMERR System Checklist-GreensboroNC 13 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Submission Process • The IU Portal will send an email notice to the Greensboro Admin with a link and validation key for the submitted COR. • Should the user initiate the repudiation, they will proceed through the signatory process, confirm desire to complete the repudiation and securely sign the confirmation to initiate the process. • The submitter and Greensboro System Admin will both receive notice of repudiation. • The original record status will change from submitted to repudiated. It will remain locked from edit/delete and may not be resubmitted. It may be copied, edited and resubmitted as a new report. The automatic acknowledgement of receipt message will be sent to the signatory's (the registrants) email. It will include the submitter's name, title of report (SMR package and compliance period) submitted, date and time of submission, attached zip file of the COR and instructions on how to validate or get a copy of the COR. A url/link to validate or download the COR will be provided. The receipt message will also contain the COR validation key. Instructions for questions, contact information to report spurious activity or a compromise, and for repudiation will also be provided. Supporting Documentation (list attachments): • 09-Attachment 7 Confirmation Receipt CROMERR System Checklist Signature Validation (e-signature cases only) 13. Credential validation (See 13a through 13c) 13a. Determination that credential is authentic Business Practices: A signatory user must have user/pwd credentials that will be validated on login to the SwiftComply Pretreatment IU portal and subsequently pass password + knowledge base questions to connect to the signature process and to confirm/sign/submit a report. Final validation will be through user input and submitted to the SCS service for user validation. System Functions: • The signatory signs into the SwiftComply Pretreatment IU Portal. • The signatory selects the report to submit and clicks the submit button. • The signatory is presented with a summary data view of the data they are about to sign and list of attachments/files and given an opportunity to go backwards or link to make corrections. • The signatory clicks the Next button • The signatory reads the certification statement for the e-signature process • The signatory selects the checkbox next to the certification statement indicating they agree. • The signatory then will answer one randomly selected challenge question. • The signatory then is prompted for password and clicks the continue button. • The IU Portal will verify all signature credentials o If signatory answers the challenge question incorrectly, The 1st failure is logged Signatory may try again (a new question/answers) until account is locked 02-CROMERR System Checklist-GreensboroNC 14 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Validation (e-signature cases only) • If the number of failed answers hits 3x, the account is changed to locked status The IU Portal will submit, to the shared CROMERR service, the COR file and signature credentials. The SwiftComply Pretreatment IU Portal application logon credentials are not used in the registration or signature process. However, users must be logged into the IU Portal and be granted access to begin any SCS processes. The SCS registration and signatory credentials are maintained through use of the SCS process and are not directly tied in any way to the SwiftComply Pretreatment IU Portal Credentials. Greensboro admin users can enable/disable access to the SCS Registration and Signatory process url/link to a SwiftComply user. Supporting Documentation (list attachments): None. 13b. Determination of credential ownership Business Practices: After validation of the signatory through the ESA process and registration of the signatory using the SCS services, (relies on SCS APIs) the user is required to maintain the signature device as username, password, challenge questions/answers. This is combined with the user being required to maintain their username/password to the SwiftComply Pretreatment IU Portal. No other devices are used. Should a disinterested party gain access, Greensboro will lock the account and proceed with revalidation of the signatory user. When knowledge base questions are provided, the user will have 3 attempts, each a new question to complete the process. The system will not provide additional attempts nor a 2-2-1 process (first question twice, second question twice, third question once) for the challenge questions. System Functions: IU Portal Login: 1. User is presented with two fields a. Username: plain text not masked b. Password: masked 2. When the user clicks the login button, the system passes the information to the identity server (IS) to confirm or reject. If rejected, the user is presented with an error message and given an opportunity to retry. After 3 failed attempts, the system is locked and the user must contact the Greensboro Admin user or SwiftComply support for password reset (after lock). The SwiftComply application logon credentials, its lockout and reset process are not used in the SCS processes. These are separate credentials. SwiftComply only provides links to access/login/call SCS processes. Account locking for SCS access is managed through use of the SCS API services. Greensboro admin users will be provided a link to the SCS services to view account security questions/answers and to unlock an account. Greensboro will not have any access to view 02-CROMERR System Checklist-GreensboroNC 15 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Validation (e-signature cases only) login or signatory challenge questions/answers. These will be provided through use of SCS API services. Signature/Submittal: 1. User is presented with a checkbox and a field a. Checkbox: associated with the certification statement(s) b. These may be required or optional, all required checkboxes must be checked to proceed. 2. When the user selects submit, the application checks: a. It will then pass the question number and answer provided to the IS service to determine if the question -and -answer match. If the answer is not correct, the user is presented with an error message and allowed to retry with another randomly selected challenge question. After 3 failed attempts, the account is placed in locked status. Supporting Documentation (list attachments): None. 13c. Determination that credential is not compromised Business Practices: All login attempts are logged. If repeated single attempt failed login attempts are made a notice is issued to the Greensboro Admin User as suspected spurious activity. Greensboro Inspectors will include signatory validation review as part of their periodic onsite inspection process when visiting facility/industrial user locations throughout the year. System Functions: Provide log of all attempted logins, I address, date/time and reason for failure Supporting Documentation (list attachments): None 14. Signatory authorization Business Practices: The subscriber agreement explicitly authorizes the individual to submit legally binding reports by the facility/industry official. It is the responsibility of the authorizing facility/industry official to assign the correct individual to submit reports and notify Greensboro of any change in relationship of the individual with the entity. Greensboro will also verify the registrant's signing authority during ongoing on -site inspections. The appropriate industry official as described in 40 CFR 403.12 may revoke the delegated authority and the ESA at any time by submitting a wet ink signed hard copy request letter on company letter head to Greensboro. System Functions: Relies on SCS APIs. Should there be a request to revoke a signatory user's access or privileges 1) Greensboro will change the status of the user to deny system access 2) Greensboro will contact the source of the request to confirm validity 3) An email notice will be issued to the signatory user's email address regarding the change in status. 02-CROMERR System Checklist-GreensboroNC 16 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Validation (e-signature cases only) Supporting Documentation (list attachments): None 15. Procedures to flag spurious credential use Business Practices: The Greensboro Admin user will periodically review the results of the logged connection attempts and filter for failed attempts, to perform fraud analysis and determine if an account has been compromised. If it is determined that a compromise has occurred, the affected account will be locked, preventing the user from system access. The user will be contacted to address the situation. System Functions: The IU Portal logs details and transaction events at standard syslog levels (such as alert, warning, normal, debug, etc) to assist researching or troubleshooting technical and process issues (including fraud analysis as needed). All IP address, user, date/time and connection status are logged for login attempts. System log files are read only and may not be edited or deleted. Greensboro Admin users can flag a user account is locked to prevent spurious use while researching the issue. Supporting Documentation (list attachments): None 16. Procedures to revoke/reject compromised credentials Business Practices: Greensboro Admin users have the ability to lock any user account that is requested, suspected, or determined to be compromised. Immediately when placed in locked status, the user account cannot be accessed. This lock is permanent in the sense the account will remain locked until such time as Greensboro manually unlocks the account. The person with the account will receive direct communication from Greensboro staff, either before, during, or immediately after locking as part of the research and review process. Greensboro will work with the signatory user to determine which submittals look to be spurious and which are not. Those suspected to be spurious will follow the report specific process for flagging the records as inactive and not to be used with compliance data until the situation is resolved. This status will also reflect in the IU Portal for all Local Application Users of the IU portal. This status can only be changed or updated by Greensboro. All COR that are marked as spurious will still be available to the customer in IU portal, however, the status change will also be reflected. 02-CROMERR System Checklist-GreensboroNC 17 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Signature Validation (e-signature cases only) System Functions: • Greensboro Admin User will inactivate account access (lock account) • Notice will be submitted via email to the locked user • Other steps require manual communication and interaction to proceed Supporting Documentation (list attachments): none 17. Confirmation of signature binding to document content Business Practices: Signatory users will receive email notification of each report submission including confirmation of signature binding to document content including validation key. System Functions: Each report/document submitted will use this same process flow: • The signatory signs into the SwiftComply Pretreatment IU Portal. • The signatory selects the report to submit and clicks the submit button. • The signatory is presented with a summary data view of the data they are about to sign and list of attachments/files and given an opportunity to go backwards or link to make corrections. • The signatory clicks the Next button • The signatory reads the certification statement for the e-signature process • The signatory selects the checkbox next to the certification statement indicating they agree. • The signatory then will answer one randomly selected challenge question. • The signatory then is prompted for password and clicks the continue button. o Any data given to the agency as part of the report submittal Including any system configured electronic certifications that may be added in addition to certifying/agreeing to the e-signature process. o The username of the person that submitted o The date and time of submittal Username, password, challenge question, challenge question answer, and date/time of submittal will be combined to create the validation key by SCS. Supporting Documentation (list attachments): • 06-Attachment 4 Signature —Submission Process Workflow CROMERR System Checklist Copy of Record 18. Creation of copy of record (See 18a through 18e) 18a. True and correct copy of document received Business Practices: All successful submissions that are signed and not repudiated will indicate that a true and correct copy of the document has been submitted. This will be provided in an email 02-CROMERR System Checklist-GreensboroNC 18 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Copy of Record confirmation to the signatory user with options to validate, repudiate and download the COR for confirmation. System Functions: Submission Receipt • The IU Portal will retain all submitted reports in a human readable format as it was submitted. • The IU Portal will also send a confirmation receipt email to the signatory's email address about the success (or failure) of the process. The email will contain links to retrieve, validate or repudiate the COR. • The IU Portal will send an email notice to the Greensboro Admin with a link and validation key for the submitted COR. Human Readable Copy of Record (COR) • The COR will consist of a zip file of all data and attachment files submitted. Data will be in either a pdf of csv format. All documents attached shall be retained in their native format. o All data submitted, e.g., analytical results of sampling activities, effluent flow meter data, pdf files, As files will be accessible in the SwiftComply IU portal in their submitted form but locked from editing. o The entirety of the zip/COR file will also be available to the Signatory user. • Included in the document is: o Any data given to the agency as part of the report submittal Including any system configured electronic certifications that may be added in addition to certifying/agreeing to the e-signature process. o The username of the person that submitted o The date and time of submittal Supporting Documentation (list attachments): None 18b. Inclusion of electronic signatures Business Practices: SwiftComply's Pretreatment Solution IU Portal will use the Shared CROMERR Services for Signature and Copy of Record (COR). The IU Portal combines and zip all files and supplies a single record to be included as COR. Username, password, challenge question, challenge question answer, and date/time of submission will be combined to create the validation key by SCS. After the COR has been signed and submitted, the IU Portal will subsequently retrieve the key file and link to validate, retrieve or repudiate the COR from the shared service and email confirmation to both the signatory and the Greensboro Admin including the validation key. System Functions: Signature Credential • Username and password used • Challenge question asked and answered • Date and Time of the submittal Email Confirmation Upon Submittal • Upon a successful submittal, an email is sent to the Signatory that, at a minimum, will contain: o A brief acknowledgement that the agency received the submittal 02-CROMERR System Checklist-GreensboroNC 19 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Copy of Record o Link(s) to download a copy of the COR, validate or repudiate the submitted report. Supporting Documentation (list attachments): None 18c. Inclusion of date and time of receipt Business Practices: SwiftComply's Pretreatment Solution IU Portal will use the Shared CROMERR Services for Signature and Copy of Record (COR). The IU Portal combines and zip all files and supplies a single record to be included as COR. Username, password, challenge question, challenge question answer, and date/time of submittal will be combined to create the validation key by SCS. After the COR has been signed and submitted, the IU Portal will subsequently retrieve the key file and link to validate, retrieve or repudiate the COR from the shared service and email confirmation to both the signatory and the Greensboro Admin including the validation key. System Functions: Signature Credential • Username and password used • Challenge question asked and answered • Date and Time of the submittal Email Confirmation Upon Submittal Upon a successful submittal, an email is sent to the Signatory that, at a minimum, will contain: • A brief acknowledgement that the agency received the submittal • Link(s) to download a copy of the COR, validate or repudiate the submitted report. Supporting Documentation (list attachments): None 18d. Inclusion of other information necessary to record meaning of document Business Practices: SwifitComply's Pretreatment IU Portal is designed to provide compliance data, inspections permitting data, requirements, notices and communications for permitted industrial users of Greensboro's Pretreatment Program. The context, instructions, permit, training videos and general reason for submitting a "document" is about understanding what the information is that is required to be submitted. It is not expected to approve a signatory user who does not understand the meaning of data and documents required to be submitted. System Functions: Does not apply Supporting Documentation (list attachments): None 02-CROMERR System Checklist-GreensboroNC 20 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Copy of Record 18e. Ability to be viewed in human -readable format Business Practices: SwiftComply's Pretreatment Solution IU Portal will use the Shared CROMERR Services for Signature and Copy of Record (COR). The IU Portal combines and zip all files and supplies a single record to be included as COR. Username, password, challenge question, challenge question answer, and date/time of submittal will be combined to create the validation key by SCS. After the COR has been signed and submitted, the IU Portal will subsequently retrieve the key file and link to validate, retrieve or repudiate the COR from the shared service and email confirmation to both the signatory and the Greensboro Admin including the validation key. System Functions: Human Readable Copy of Record (COR) • The COR will consist of a zip file of all data and attachment files submitted. Data will be in either a pdf of csv format. All documents attached shall be retained in their native format. o All data submitted, e.g., analytical results of sampling activities, effluent flow meter data, pdf files, As files will be accessible in the SwiftComply IU portal in their submitted form but locked from editing o The entirety of the zip/COR file will also be available to the Signatory user. • Included in the document is: o Any data given to the agency as part of the report submittal Including any system configured electronic certifications that may be added in addition to certifying/agreeing to the e-signature process. o The username of the person that submitted o The date and time of submittal Supporting Documentation (list attachments): • 10-COR Example. 19. Timely availability of copy of record as needed Business Practices: All successful submissions that are signed and not repudiated will indicate that a true and correct copy of the document has been submitted. This will be provided in an email confirmation to the signatory user with options to validate, repudiate and download the COR for confirmation. All COR files may be obtained by link through email or the IU Portal application. If SCS are operating the timely availability of the record is instantaneous. System Functions: Relies on SCS APIs Supporting Documentation (list attachments): None 02-CROMERR System Checklist-GreensboroNC 21 of 22 Updated: 1/10/2023 Agency: City of Greensboro, NC System: SwiftComply Pretreatment Date: 1/10/2024 Water Resources CROMERR System Checklist Copy of Record 20. Maintenance of copy of record Business Practices: All successful submissions that are signed and not repudiated will indicate that a true and correct copy of record has been submitted. This will be provided in an email confirmation to the signatory user with options to validate, repudiate and download the COR for confirmation. All COR files are maintained in the SCS platform space. SCS will store the official CORs. System Functions: Relies on SCS APIs Supporting Documentation (list attachments): None 02-CROMERR System Checklist-GreensboroNC 22 of 22 Updated: 1/10/2023 GREENSBORO NORTH CAROLINA OFFICE OF THE CITY ATTORNEY January 10, 2024 Mr. Michael Montebello NC Division of Water Resources Water Quality Permitting Section — NPDES 1617 Mail Service Center Raleigh, NC. 27699-1617 Re: Local Legal Certification for eSignature and eReporting for Greensboro, NC To Whom It May Concern, I, Tony Baker, am the Chief Deputy City Attorney for the City of Greensboro. I possess the authority to represent Greensboro Water Resources, a department of the City of Greensboro, through this certification document. The City of Greensboro Rules and Regulations for the Operation of the Water and Water System, Section K: Sewer User and Pretreatment Ordinance, Article I, Section 4 (by definition of Pretreatment Program and Pretreatment Requirement) authorizes Greensboro Water Resources to develop procedures for receipt of electronic reports in compliance with 40 CFR Part 3. I hereby certify that Greensboro Water Resources has no lawfully enacted or promulgated statutes, ordinances or regulations that impede the implementation of the electronic reporting component of its authorized programs consistent with 40 Code of Federal Regulations § 3.2000 and with this application. Chief D puty City Attorney t'. B 3136 ensboro, NC 27402-3136 (desk) 336-373-7797 (cell) 336-701-2289 SUBSCRIBER AGREEMENT FOR SUBMITTING DATA ELECTRONICALLY Provided for acceptance of the electronic signature credential issued by the City of Greensboro Water GREEN580R0 Services Department (Greensboro) to sign electronic reports submitted to Greensboro's SwiftComply WATER RESOURCES Pretreatment Solution. Permit #: Permittee: Located: (1) understand and agree to submit self -monitoring data required by Permit To Discharge Wastewater Under The Industrial Pretreatment Program, referenced above, through electronic format, and I agree that the use of my electronic signature device (Username and Challenge Question/Answer) shall serve as a legally enforceable signature in the some manner as an original signature on a paper document pursuant to the provisions of the State's relevant regulations and requirements. I will be held legally bound, obligated, and responsible for my use of my electronic signature as I would be by using my hand-written signature in submitting an electronic document to the SwiftComply Pretreatment Solution. (2) agree to protect my Online electronic signature credential, consisting of my password and answers to my security questions, from use by anyone except me and to change them if they become known to anyone but me. Specifically, I agree to maintain the secrecy of my electronic signature credential; I will not divulge or delegate my electronic signature credential to any other individual; I will not store my electronic signature credential in an unprotected location; and I will not allow my electronic signature credential to be written into computer scripts to achieve automated login. (3) Agree not to attempt to use or create automated log -in scripts using my e-signature credentials. (4) Agree to report to Greensboro within 24 hours of discovery, any evidence of loss, theft or other compromise of my electronic signature. (5) Agree to notify Greensboro if I cease to represent the regulated entity specified above as signatory of that organization's electronic submissions to the SwiftComply solution as soon as this change in relationship occurs and to sign a surrender certification at that time. (6) 1 certify under penalty of law that I have personally examined and am familiar with the information submitted to the Greensboro and I believe that the information is true, accurate and complete. I am aware that there are significant penalties for submitting false information, including the possibility of fine and imprisonment. Signatory Name: Title: Email: Signature: Date: Authorization by immediate supervisor or witnessing official: I individual named above works at/for company's behalf. Witness Name: acknowledge that the and is authorized to submit documents on the Signature: Title: Date: ATTACHMENT 3 - Registration SwiftComply IU Portal Process Workflow Provides facility signatory with ESA Signatory, fills out agreement, witnessed by Facility Officer and confirmed by Pretreatment Staff LAU Pretreatment Admin securely files ESA and enables signatory's LAU access to CROMERR Registration Process LAU Signatory clicks CROMERR Registration Button to initiate Process if SwiftComply calls SCS UserManagmentService, Authenticate (service) Signatory is walked through SCS process: I CreateBaseUser GetEligibleQuestions CreateUser i Authenticate User I UpdateUserinformation CreateActivity SenclMessage LAU — Facility Signatory, LAU — Pretreatment Admin Receive Confirmation Notice of Registration Legend OFacility Signatory User OSwiftComply IU Portal / Local Application User (LAU) i Shared CROMERR Services (SCS) OPretreatment Admin User LAU — Pretreatment Admin Connects to SCS UserManagmentService Authenticate (service) AuthenticateUser f- - - ` - - - - - - - - - - - - - I Update Status of Registered Facility Signatory to Approved ChangeUserStatus LAU — Facility Signatory, LAU — Pretreatment Admin Receive Confirmation Notice of Approval LAU Signatory may now manage CROMERR Knowledge Base Answers and PWD LAU — Pretreatment may now force password reset of LAU Signatory and change that user's CROMERR Registration Status END 05-Attachment 3 Registration Process Workflow 1 of 1 Updated: 09/06/2023 ATTACHMENT 5 - Signature SwiftComply IU Portal Process Workflow Report is Ready to Sign/Submit Signatory Logs into IU Portal and select Report to Submit Signatory confirms data for submission, agrees to e-signature certification clicks continue SwiftComply presents a read only verification page of the Reports selected for signing i--———————---—————————— i Signatory answers the randomly selected challenge question on file ' Yes Correctly `� No answered? No Display Error Message ' Failed after 3x? Yes Account is Locked and Administrator and Submitter are notified via email END Legend • Facility Signatory User OSwiftComply IU Portal / Local Application User (LAU) Shared CROMERR Services (SCS) OPretreatment Admin User IU Portal generates a Copy of Record (COR) calls SCS Service SCS generates hashed values binding the signature to COR passes back i response/validation key SignAndStoreCor ---------------------- IU Portal displays success/failure and Human Readable Format of submitted data to user IU Portal emails notice to the signatory and System Admin of COR creation with submission validation and links to download/validate/ repudiate --——— — — — — li Optional: ValidateCor DownloadCor i RepudiateCor i i --------------------- I END 06-Attachment 4 Signature Process Workflow 1 of 1 Updated: 09/06/2023 Pretreatment Why SwiftComply? Our team focuses on providing efficient business tools for all stakeholders who interact with our regulatory agencies. It is your data and your responsibility to provide interaction and interact to meet your local requirements so you should have the right tools to do the job. Q Industrial User Portal Industrial users are asked to provide a signficant investment to meet local regulatory requirements for sewer use. Permits, inspections and self -monitoring are critical to maintain compliance. Having access to data supporting these ativities promotes good stewardship and compliance with your permit. Utilize dashboard driven technology allowing users to import, enter and submit sampling analysis and report files online. Receive notices and be ability to view inspection results, permit requirements & your agency's sampling data for your industry. Q Modern, user-friendly software We designed SwiftComply to put hours back in your day. Automate reports, reminders, and notifications, and set up CROMERR compliant electronic self -monitoring data submission and permit management to make the best use of your time and resources. hello aoswiftcomply.com Attachment 6 Screen Images SwiftComply IU Portal Preparing an SMR Report for Submittal (3 screens) lu Pofr al .. } U Do,ral 0 Topps Metal Finishing - New Record Which record type would you create? MonitoringlReporting lm Othercompliancedocumenl Do you want to complete a form or upload a document? BComplete a Form D Topps Metal Finishing - SMR OR Im Upload Uocumenl Please attach all needed docurnentsto the form Q SELF -MONITORING REPORT IRpproved excel or .csv format) A Lab Report A Chain of Custody Typo File 14e 08-Attachment 6 Screen Images 1 of 5 Updated: 11/14/2022 `x ty > lu Portal 0 * I Alfred Souza ® v 0 Topps Metal Finishing - 5MR Please attach all needed documents to the form Q SELF -MONITORING REPORT (Only .csv forrnatl Q Lap Report IS Chain of Custody Tg. File N— 5MRjDAIA M S.Pnia csr 0 Lao weport 7. I,"Tepplpdt rya Ckein yr Cualody l.up Topps LoLpM "M Preparing an Permit Application for Submittal (6 screens) t, tY ) lu Portal 0 Topps Metal Finishing - New Record Which record type would you create? aMorntoring f Reporting 0 * I Alfred u9IRa ® v 10Or heir compllamedocumenl Do you want to complete a form or Upload a docurnerit? Complete aform QR 11M uploadoocurnenl Which template would you like to use? Permit Rene* 1 AppGcai ion w 08-Attachment 6 Screen Images 2 of 5 Updated: 11/14/2022 .f.1::1 r % IIJ Portal A ilk „f• p > IIJ Portal D Topps Metal Finishing - Permit Renewal Application v 3 4 e—.— SW o —nt Permit Explratioo Date: Permit number: 09123/2022 C 1458 Official Name of Applicant: Facility Name: IF Ben Topps Metal Finishing Facility Address: 6391 Elgin St. Celina, Delaware 10299 ® t)se this same address For Mailing Mailing Address: 6391 Elgin St. Cenne, Delaware 10299 Aulhorl=e0 Signatory Alternative Aulhorlled Signatory: ,e Jerome Bell .47 Darrell Steward CEO President of Sales • 1 122131 555 -0109 •1 (2191 555-011 i D Topps Metal Finishing - Permit Renewal Application 0 * I Alfred Souza ® v 3 4 Have the treatment or gi5posal methods employed, as Indicated in previous discharge permit applications, been altered In any way since [he last permit applications was submitted? Q Yes O No Have the uantity or qual of wastes discharged as indicated in Prevlous discharge permit applications, be@n Signi}iGantly Ghan9 in Since the 1a5t @pplicdti9n aws SV4mtll@p5 C) Yes O No Gescrlptlon of current or ptanneo activitles that may require permit changes: tcneck all that appro Gpnslru4[ign• inslalldlign qr m4piftg9tgn 4f wagt@ C4�I@Ctign, tie@Im@nt qr plgpgg@I faCllitlgg operaiian Of ngw waste "lrection, Treatment & disposal faciliies New smxels) of wastewaler to he discharged la the putilic 5CW2r Other: Back 08-Attachment 6 Screen Images 3 of 5 Updated: 11/14/2022 OOM PLY ) IU Porlal � 0 * I Alfred Souza Q - SOCWLY IU Porlal 0 Topps Metal Finishing - Permit Renewal Application +L nuxn oxume i Lr av end Please attach an explanation or proposal for any changes in operations or waste quantity or quality below F ft Marne 0 * I AI}100 Sov.7A a - 0 Topps Metal Finishing - Permit Renewal Application IWO _0 4 Please attach an explanation or proposal for any changes in operations or waste quantity or quality below file roam. ! Frplanarign pM f, Prop osel.pa! LosJnp Cakwa�ions:is 08-Attachment 6 Screen Images 4 of 5 Updated: 11/14/2022 a Topps Metal Finishing - Permil Renewal AppliCstlon Wg if y %m data a mered drA tip Me dotvnem 4uW1111 Info WA vrrr �ae�h j* Wr F 50 Psmmirado— eml EVnSL[dffNk balayme IMO rM..+rond- jW*rf Md ab +1 12M b5s. Ma rota a.rvrr nw.i cF�p* 14s 0-d" r 4-If -1 ---m dii-M-40 ei n i 4 1 ,w„d kum ■ +e-nrtWrmmCWf OA1#SJ#Q## rsafr f� TOM KANJI F-thAg laerAM—: 6391 Elyn 5t Caima, Diiim f 1G204 airy rrf—bod a�rrs WiM1Yr }Fin0 Pmak arrt al !!Lmm *1121M) S•bt14 CW"WM pe—m A"OMr-W mgw%p— W •OmiAru~. mLmlw6m or rnodH cabm aP xasty oote[C-on, troWmant or il,MmeM Oecilibn * Qi;WVM4n0'FM1Yr'wNWCiwSW.ngoo 4nriX6%, W44dri44 A11mhW Dopxmma FI.FA— c�purua+ps r k��Yw�-4ry�u rti n 141 iD 1 humW catrfx Chat the r�onnatm contmi ed M Iris opp4catms is Info- end co-ect to the Ue71 of rrM 6 end ID" nark 08-Attachment 6 Screen Images 5 of 5 Updated: 11/14/2022 CONFIRMATION RECEIPT Greensboro Water Resources SwiftComply Demo Greensboro Water Resources<pretreatmentnotifications@greensboro-nc.gov > To Frank Johnson <frank.johnson@permittedindustry.com> Frank Johnson, have been identified by the Greensboro Water Resources pretreatment program as the official signatory for the Permitted Industry who signed and submitted the following compliance report. Qtrly SMR Jan 1 — March 31, 2023 confirmed received: March 2, 2023 10:53:03 a.m. Validation key: 83074f4a276d716112a5cfc3ee84eada Please keep a copy of this email receipt as proof of confirmation of your report submission. A copy of the submitted report is attached to this email for your records. You may also use the link provided below to download a copy of the submitted report or to validate the submission. If you have submitted this report in error or would like to retract the submission, please use the link below to recall (repudiate) the submitted report. rnCity of Greensboro Water Resources 2350 Huffine Mill Road, McLeansville, NC 27301 Office: (336) 433-7227 GREENSBORO www.greensboro-nc.gov WATER RESOURCES You are receiving this message because you signed and submitted pretreatment compliance report through your IU Portal entered into the greensboronc.swiftcomply. com software by the Greensboro pretreatment program for a Permitted Industrial User you are affiliated with. Please note that if this message was received in error or you suspect suspicious activity or you did not send then report please contact the Greensboro representative immediately. pretreatment(a-)greensboro-NC.gov City of Greensboro, NC COPY OF RECORD SemiAnnual SMR Local Pollutant Allocation (LPAD) Period: 07/01/2023—12/31/2023 Company Name: Procter & Gamble Submitted Date: January 8, 202411:23:00 Permit Number: P031 Submitted By: Michael McCleary Address: 6200 Bryan Park Road, Brown Summit, NC 27214 Title: Plant Manager Samples Sample Point P031-01 Analyte Result Unit Collection Start Collection End Collect Method Analysis Method Analysis Date MDL TSS 280 mg/L 10/30/23 09:00 10/31/23 09:40 Comp 1 SM 2540D 11/7/23 2.5 Zn, T 1.41 mg/L 10/30/23 09:00 10/31/23 09:40 Comp 200.7 11/8/23 0.010 Sample Point P031-02 Analyte Result Unit Collection Start Collection End Collect Method Analysis Method Analysis Date MDL TSS 20 mg/L 10/30/23 09:00 10/31/23 10:00 Comp 1 SM 2540D 11/7/23 2.5 Zn, T 8.97 mg/L 10/30/23 09:00 10/31/23 10:00 Comp 200.7 11/9/23 0.010 Compliance Certifications None Signatory Certifications (1) 1 agree that the use of my electronic signature device shall serve as a legally enforceable signature in the same manner as an original signature on a paper document pursuant to the provisions of the State's relevant regulations and requirements. I will be held legally bound, obligated, and responsible for my use of my electronic signature as I would be by using my hand-written signature in submitting an electronic document to the SwiftComply Pretreatment Solution. (2) 1 certify under penalty of law that this document and all attachments were prepared under my direction or supervision in accordance with a system designed to assure that qualified personnel properly gather and evaluate the information submitted. Based on my inquiry of the person or persons who manage the system, or those persons directly responsible for gathering the information, the information submitted is, to the best of my knowledge and belief, accurate and complete. I am an authorized representative of the user and am authorized to execute this certification on behalf of the user. I am aware that there are significant penalties for submitting false information in violations of this certification, including the possibility of fines and/or imprisonment. Michael McCleary 1/8/2024 Attachments LaKertification.pdf FieldCOCRecord.pdf Procter & Gamble 1 of 3 Submission: January 8, 2024 11:23:00 City of Greensboro, NC COPY OF RECORD Meritech, Inc. Environmental Laboratory Laboratory certiflration No-165 RECEIVED JAN 0 8 2024 IN DUSTR!-A L WA ATE CITY OF { -� 7- -: N5 F30R0 Contact: April Haley Report Date-, 11/10/23 Client: Procter & Gamble Project: 4Q Zn/1'SS 6200 Cryan Park Road P.0 #- 80046 12 5.4 1 Brown Summit, NC 27214 Date Sam p]e Rtvd; 111212023 MeritechWork Order # 110223150 Sample: P031•01Composite 10130-31/23 purameter ResiulS Analyd l} 13eporLineIjinil M902d Torn] Suspended Solids 2t30 MR j L 11 17 j23 Z-S mg/ L S%11 2 540 D zinc-, total 1.41 mg/L 11/13/23 0.010 FnWL EPA 200.7 Meriterh Work0rder# 110223151 Sample; P031.02 Composite 10/M-31123 Total Suspended Stshds 20 mg/L 11/7/23 Z.5 mg{L SM 25+40 D Zinc,taral 0,97 rig/l. 11/9/23 L1.0111 Mg/L EPANO-7 l hereby rer ajty that ! have reviewed and approve these doCa- Labor arary RepresentaUw 64Z Tarnca Road. Reidsville, North Carnlltia 27320 to l , (33 b) 3 4 2 -4748 lax, (3 36)342.15 22 Procter & Gamble 2 of 3 Submission: January 8, 2024 11:23:00 City of Greensboro, NC COPY OF RECORD Chain of Custody Record (COC) +fir NPDES#: Client: l hr -Y•h�� --- Phone: r�� ,T4 �tf 6191 Address: &r �c.,_LArk Fax: N I � Email: Mkt4,'Ae Z - y (7 l�,m Project: `I& -2., / TSS`` P O•#= N 9 6 )2531 A� t)e� Turn Around Time' Attention: 7 'RUSH work needs pnarapproval, How would you like your re art sent? F �� - Std (lo d3v5) � s 74 48 Hr., Circle all that apply: Entail (prrterrtdj Fax, Mail r ER I TE H f INC. ENVIRONMENTAL LABORATORIES 542 Tamco Rd. Phone: 336-342-4748 Reidsville NC .273z4 Fax: 336-342-1522 4i��cAv,f Email: info }meritec�tlabs.com www.meritechiabs.com Sample Location and/or ID # Sampling Dates & Times Person Taking Sample (SignfPrinq: Lab Use Only Start End °�'° ? Grab? Ji of cant, Test(s) Required Un Ice? Yes !Flo pH OK? Cl00 Date Time date Time t S Tful ill r61 040o Erg/3l 23 000 [. 21 'TS5 4 ; C Temperature Upon Re-ceipt , Method of Shipment: p "* Dechlorination c0.5 nt of Ammonia Cyanide, Phenol and TKN samples must he done in the field Erior to reservation- Comments: fl s.0A, ice. �b �Glr �f Compositor# Ijus # UPS U Fed Ex Are these results for regulatory purposes? Yes N, _ Report results in: mglL & -ZAg ugf L 36 Hand Delivery Relinquished by. , t Dateli_2-£3 throe-16 ") - Received by. Date: Time: 1 «� Other Relinquished by Date: Time., Recrived by Date_ Time: Receiv a t S ifr Relinquished by Date; Titre Procter & Gamble 3 of 3 Submission: January 8, 2024 11:23:00