Financial Assistance
Communication Liaison Policy Release:
2006 - 1
To: Bureau/Office Financial Assistance Communication Liaisons
Subject: Implementation of
Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common
Identification Standard for Federal Employees and Financial Assistance Awardees
1. Purpose: This policy release
establishes procedures for standard implementation of HSPD-12 in Department of
the Interior financial assistance (i.e., grants and cooperative agreements).
2. Effective Date: Upon signature.
3. Expiration Date: Upon issuance of
applicable Office of Management and Budget policy coverage.
4. Background and Explanation:
HSPD-12, issued on
Not every financial assistance
recipient and subrecipient (hereafter, “recipient”) employee will need PIV
credentials. There are two categories of
recipient personnel who will be subject to the background investigations:
• Those who need routine and regular unsupervised
access to a Federally controlled facility for more than 180 days;
• Those who need unsupervised access to a
Federally controlled Level 3 or 4 information system.
Physical Access. A “Federally
controlled facility” is federally owned or leased space, whether for single or
multi-tenant occupancy, all or any portion of which is under the jurisdiction,
custody or control of DOI. If a
building is shared with non-government tenants, only access to the Federal area
is controlled. The requirements for recipient
credentialing apply even if there is no guard, card reader, or other physical
control at the entrance to the office.
The 180 calendar day period begins on the first day of the individual’s
affiliation with DOI (in this case, the date that grant or cooperative
agreement performance actually begins rather than the grant or cooperative
agreement award date) and ends exactly 180 days later, regardless of the number
of times the recipient actually accessed a building or IT system.
Logical Access. An “information
technology system” is defined in the Federal Information Security Management
Act of 2002 (44 U.S.C. §3503(8)). Use of
an information system by a recipient or contractor on behalf of an agency is
defined in 44 U.S.C. §3544(a)(1)(A). If
a recipient needs any amount of unsupervised access to a DOI IT system,
HSPD-12 compliant credentials must be issued regardless of the duration of
access. The credentialing requirement
applies whether the recipient accesses the IT system from the premises of a DOI
facility, from their own facility, through the Internet, or by any other
means.
Uncredentialed Recipients. Recipients who do
not fit into one of the above two categories will be treated as visitors. These persons must access the facility via a
screening system, display a temporary/visitor badge at all times, and be
escorted at all times. Normally, persons
working exclusively outside on the grounds of federally controlled facilities
need not receive background investigations.
Special Cases. The preceding
paragraphs describe the minimum requirements.
Depending on risk, increased application of HSPD-12 will be appropriate
in some cases, depending on the nature of the grant/cooperative agreement. If higher level security, such as Secret or
Top Secret, is needed, other clearances can be added to the HSPD-12 requirements.
Verification Process. To the extent
possible, HSPD-12 clearance of recipient personnel will be handled through the
same clearance procedures as for Department of the Interior employees. The process has two steps: a National Agency
Check (NAC) and a NAC with Written Inquiries (NACI). After the individual applies for a PIV
credential, a NAC will be processed. If
this does not reveal any unfavorable information, a PIV credential will be
issued; this should take about one week. Simultaneously, a NACI will also be
initiated, with adjudication taking about six months. If the adjudication is favorable, nothing
more needs to be done. If the
adjudication is unfavorable, the PIV credentials will be revoked.
Should a recipient’s PIV credentials
be declined or revoked, the grant/cooperative agreement administration team
must take some action to accommodate this in the grant/cooperative agreement. For example, it may be possible to arrange
off-site performance or some other accommodation. In any case, the administering office must
work together with the sponsor, i.e., program office, security personnel, and
the recipient to address this situation promptly.
All PIV credentials will
automatically have a five year expiration, except for foreign nationals. Foreign nationals’ cards may be issued for
five years, unless that date would extend past the expiration date of their
work permit or visa. Governmentwide, the
HSPD-12 clearance process for foreign nationals has not been finalized
yet. Please be aware that there may be
extra delay in obtaining verification for these individuals, especially during
the early months of implementation.
If recipient personnel have
already been investigated by another agency through OPM, the results of a prior
HSPD-12 (or higher) clearance will be accepted by DOI upon receipt of
appropriate verification.
Procedures. Early coordination
with program officials is recommended in order to avoid delays in
grant/cooperative agreement start-up. Recipients
who already have badges may continue to use them until they expire. However, there will be (at least) a week
delay for individuals who start unsupervised physical or logical access for the
first time on or after October 27.
For now, the background
investigations must be paid for by the Government. A source of funding has not been clearly
defined, but it appears likely that the sponsoring program will bear the
cost. Some program offices may not be
aware of this yet. They should be
referred to the Bureau’s budget office for further guidance. We recommend that grant/cooperative agreement
applications address limiting the number of recipient employees who will be
investigated.
DOI grant/cooperative agreement office
personnel will have additional duties, which should be reflected in the
application process. DOI personnel will
act as sponsors for recipient personnel.
In this capacity, they will be responsible for ascertaining the risk
level for the position, including credentialing requirements in the
grant/cooperative agreement descriptions, validating individuals’ need for a
PIV credential, facilitating the badging process, and ensuring that credentials
are renewed and rescinded in a timely manner.
It is the DOI grant/cooperative agreement office’s responsibility to
make sure that recipients’ credentials are returned to the Government at the
end of the grant/cooperative agreement or whenever a recipient employee’s
affiliation with DOI ends.
Model Special Terms and
Conditions language is attached. The
language may be modified to suit circumstances, except that the flow down
requirement must be included. It should
be used in all grants and cooperative agreements where the terms require subrecipient
personnel to have unsupervised access to a Federally controlled facility for
more than 180 days or unsupervised access to a Federally controlled Level 3 or
4 information system.
In addition to new grants and
cooperative agreements, HSPD-12 requirements must be added to some grants and
cooperative agreements awarded prior to this policy release’s issuance. Current grants or cooperative agreements that
require recipient personnel to have physical and/or logical access as described
above must be amended to include the PIV requirements before expiration when
the grant/cooperative agreement extends past the expiration date of their
current credentials. Grants or
cooperative agreements that do not currently require recipient personnel to
have physical and/or logical access as described above must be modified to
include the HSPD-12 requirements if circumstances change such that recipient
physical or logical access is newly required.
5. Action Required:
Coordinate with DOI
grant\cooperative agreement offices to ensure that the new procedures are
followed and that grant or cooperative agreement work is not delayed. Starting immediately, insert language
substantially similar to the attached model language in applications that
require recipient personnel to have physical or logical access as described
above. At the earliest opportunity, but
no later than exercise of an amendment, amend applicable grants and cooperative
agreements to include the new model language.
Distribute this policy release as widely as possible within your
bureau/office grants and cooperative agreements community.
6. Additional Information: If you have
questions about this matter, please contact Kate Oliver at (202) 208-3345 or
kate_oliver@ios.doi.gov.
//s//
Debra
E. Sonderman, Director
Office
of Acquisition and Property Management
Attachment
Attachment
Model HSPD-12 Grant/Cooperative Agreement
Language
Recipient/Subrecipient
Personnel Security and Suitability Requirements
Performance of this grant/cooperative
agreement requires recipient/subrecipient personnel to have a Federal
government-issued personal identification card before being allowed
unsupervised access to a DOI [facility and/or information system]. _________________________ [to be completed by
bureau/office, e.g., designated grants/cooperative agreement administrator]
will be the sponsoring official, and will make the arrangements for personal
identify verification and card issuance.
At least two weeks before start
of grant/cooperative agreement performance, the recipient will identify all recipient
and subrecipient personnel who will require [physical and/or logical] access
for performance of work under this grant/cooperative agreement. The recipient and subrecipient must make their
personnel available at the place and time specified by the __________________________[title
to be completed by the bureau/office] in order to initiate screening and
background investigations. The following
forms, or their equivalent, may be used to initiate the credentialing process:
•
OPM Standard Form 85 or 85P
• OF 306
• Fingerprint card (local
procedures may require the fingerprinting to be done at a police station; in
this case, any charges are to be borne by the recipient or subrecipient, as applicable)
•
Release to Obtain Credit Information
•
PIV card application (web-based)
Recipient and subrecipient employees
are required to give, and to authorize others to give, full, frank, and
truthful answers to relevant and material questions needed to reach a
suitability determination. Refusal or
failure to furnish or authorize provision of information may constitute grounds
for denial or revocation of credentials.
Government personnel may contact the recipient or subrecipient personnel
being screened or investigated in person, by telephone or in writing, and the recipient
agrees to make them available for such contact.
Alternatively, if an individual
has already been credentialed by another agency through OPM, and that
credential has not yet expired, further clearance may not be necessary. Provide the sponsoring office with
documentation that supports the individual’s status.
During performance of the grant/cooperative
agreement, the recipient will keep the _____________________________[title to
be completed by the bureau/office] apprised of changes in personnel to ensure
that performance is not delayed by compliance with credentialing
processes. Cards that have been lost,
damaged, or stolen must be reported to the ___________________________________[title
to be completed by the bureau/office] and Issuing Office within 24 hours. Replacement will be at the recipient’s
expense. If reissuance of expired credentials is
needed, it will be coordinated through the _____________________________________[
title to be completed by the bureau/office].
At the end of grant/cooperative
agreement’s performance, or when a recipient/subrecipient employee is no longer
working under this grant/cooperative agreement, the recipient will ensure that
all identification cards are returned to the ___________________________________
[title to be completed by the
bureau/office].
Before starting work under this agreement,
a National Agency Check (NAC) will be conducted to verify the identity of the
individual applying for clearance. Upon
successful completion of the NAC process, an identification card will be issued
and access granted.
Simultaneously, a NAC with
Inquiries (NACI) will be initiated to determine the individual’s suitability
for the position. If the NACI
adjudication is favorable, nothing more needs to be done. If the adjudication is unfavorable, the
credentials will be revoked. In the
event of a disagreement between the recipient and the Government concerning the
suitability of an individual to perform work under this grant/cooperative
agreement, DOI shall have the right of final determination.
This requirement must be incorporated into any sub-grants/cooperative agreements that require subrecipient personnel to have unsupervised access to a Federally controlled facility for more than 180 calendar days or unsupervised access to a Federally controlled Level 3 or 4 information system.