March 2, 2004 1

DEA e-222 Working Group Meeting

March 2, 2004

March 2, 2004 2

Agenda

Phase IV – Reporting CSOS Reporting to Secure ARCOS System

Phase V – Application Auditing

Phase V – Field Investigation

Questions

PHASE Issues & Success Factors

1 – Online Registration

(Use DEA-provided activation

data to obtain a digital

certificate w/ live data)

Technical interoperability

Certificate content review, field length analysis

Certificate portability

Documentation (Complete and easy to use)

2– Application

(Business completes and

submits full CSOS enrollment

application, DEA Adjudicates

app.)

Application ease of use

Consistency with current processes

DEA Adjudication Processes

Organizational oversight of enrollment/termination process

3 – Order Processing

(Business generation,

transmission and processing

of orders)

Standards for digitally signed transactions

Cost

Address Field / Record

Transaction integrity, certificate status, credential checks

4 – Reporting

(Business generation of

periodic CSOS reports)

Frequency

Format

5 – Auditing Ensure that the business is storing order transactions in a

DEA approved manner, and that they can be retrieved.

Proposed Pilot Organization and Scope

March 2, 2004 4

Col. 1 10 11 12 23 31 32 41 50 58 66 70 80 81 92 100101 105

AA9999999PD000543751**000000024BB1100654008538970013120001970022809850000000088 000543751**0000000240985^

Phase IV Reporting - CSOS Transaction Record Format Automated

Reporting Registrant’s DEA Number (1)[5.3.1]

Transaction CodeField (10)[5.4.1]

Action IndicatorField (11)[5.9.1]

NDC Number Field (12)[5.10.1]

QuantityField (23)[5.11.1]

Unit Field (31)[5.12.1]

Associate Reg.Number Field (32)[5.13.1]

Order FormNumber Field (41)[5.14.1]

Transaction Date (50) [5.15.1]

Correction Number Field (58)[5.16.1]

StrengthField (66)Ex: 98.5%[5.17.1]

TransactionIdentifierField (70)[5.18.1]

BLANKin Col. (80)

Note: numbers in brackets [ ] reference the appropriate section in the ARCOS RegistrantHandbook found on the DEA DIVERSION web site at ‘www.deadiversion.usdoj.gov’.

NDC Number Field (81)[5.10.1]

QuantityField (92)[5.11.1]

Unit Field (100)[5.12.1]

StrengthField (101)Ex: 98.5%[5.17.1]

End of CarriageReturn (105)

March 2, 2004 5

CSOS Pilot - Phase IV: Status

Submission of CSOS Transaction Formatted

Records to the secure DEA ARCOS website

Six CSOS participants currently piloting with DEA

ARCOS

CSOS Transaction Formatted Records have been

successfully received by DEA ARCOS

March 2, 2004 6

CSOS Pilot - Phase IV: Status

DEA ARCOS group to provide feedback on participant activity. PEC will forward those reports to the corresponding participants

DEA ARCOS anticipates that the process will remain the same, however there may be interface changes if needed to be more user friendly

Participants that have not begun sending records, please begin posting those records

Participation is still encouraged, send an e-mail to csospilot@pec.com with the following information: Contact Name, Company Name, Address, and Business Phone

Number

March 2, 2004 7

Phase V - CSOS Application Audits

Software Audits Requirement Document Software/System Audit Requirement Checklist

21 CFR

Section

Purchasing System Requirements Meets

1311.60(b)(1) The cryptographic module is FIPS 140-2 validated.

1311.60(b)(2) The digital signature system is FIPS 186-2.

1311.60(b)(2) The hash algorithm is FIPS 180-1 certified (SHA-1).

1311.60(b)(4) System uses either a user ID and password combination or biometric authentication to access the private key.

1311.60(b)(4) Private key activation data is not displayed on the screen when activated.

1311.60(b)(3) The private key is stored encrypted on a FIPS 140-2 validated cryptographic module using a FIPS-approved encryption algorithm.

March 2, 2004 8

Phase V – Field Investigations

7

Validating DEA’s current investigation process

ReconcileReturns

Audit

ClosingInventory

Shipped

Destroyed

Received

Secondary Docs

Primary Docs

Verifications w/Trading partners

InitialInventoryDEA or Corp

Inventory

DEAInventory

Theft orloss

March 2, 2004 9

Phase V – Field Investigations Status

Requirements development with DEA DIs Raw Data Reports User/POA data

Developing a toolkit to evaluate raw signed electronic orders

Perform On-Site Field Investigation with DEA Diversion Investigator Sample signed E-222 Output Data required prior to visit

Volunteers for On-site Field Investigation Send to PEC at csospilot@pec.com

March 2, 2004 10

Questions