Department of the Interior Acquisition Policy Release (DIAPR) 2006-03

SUBJECT: Implementation of Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors

1. Purpose:

This policy release establishes procedures for standard implementation of HSPD-12 in DOI contracts.

2. Effective Date:

Upon signature.

3. Expiration Date:

Upon revision of the FAR or DIAR.

4. Background and Explanation:

HSPD-12, issued on August 12, 2004, directs the creation of a new Federal standard for secure and reliable identification issued by Federal agencies to their employees and contractors, including all tiers of subcontractors. Implementation will be in several stages, with the initial phase being put in place on October 27, 2005. This first phase consists of implementation of procedures under which Personal Identity Verification (PIV) credentials such as security badges, building passes, and so forth, will only be issued after the individual’s identity has been independently verified. Later phases will expand coverage to personnel who have already been issued credentials as of October 27, and use of Smart Cards.
Not every contractor and subcontractor (hereafter, “contractor”) employee will need PIV credentials. There are two categories of contractor personnel who will be subject to the background investigations:

• Those who need routine and regular unsupervised access to a Federally controlled facility for more than 180 days;
• Those who need any unsupervised access to a Level 3 or 4 Federally controlled information system.

Physical Access. A “Federally controlled facility” is federally owned or leased space, whether for single or multi-tenant occupancy, all or any portion of which is under the jurisdiction, custody or control of DOI. If a building is shared with non-government tenants, only access to the Federal area is controlled. The requirements for contractor credentialing apply even if there is no guard, card reader, or other physical control at the entrance to the office. The 180 calendar day period begins on the first day of the individual’s affiliation with DOI (in this case, the date that contract performance begins rather than contract award) and ends exactly 180 days later, regardless of the number of times the contractor actually accessed a building or IT system.

Logical Access. An “information technology system” is defined in the Federal Information Security Management Act of 2002 (44 U.S.C. §3503(8)). Use of an information system by a contractor on behalf of an agency is defined in 44 U.S.C. §3544(a)(1)(A). If a contractor needs any amount of unsupervised access to a DOI IT system, HSPD-12 compliant credentials must be issued regardless of the duration of access. The credentialing requirement applies whether the contractor accesses the IT system from the premises of a DOI facility, from their own facility, through the Internet, or by any other means.

Uncredentialed Contractors. Contractors who do not fit into one of the above two categories will be treated as visitors. This group includes temporary and seasonal workers, and those needing intermittent physical access such as delivery services. These persons must access the facility via a screening system, display a temporary/visitor badge at all times, and/or be escorted at all times. Normally, persons working exclusively outside on the grounds of federally controlled facilities, such as grounds maintenance workers, parking attendants, and some construction workers, need not receive PIV credentials.

Special Cases. The preceding paragraphs describe the minimum requirements. Depending on risk, increased application of HSPD-12 will be appropriate in some cases. Workers at construction sites may or may not need PIV credentials depending on the nature of what is being built. For example, it may be appropriate to credential workers on a critically sensitive dam. Similarly, even grounds workers at a sensitive site, such as the White House, should be credentialed. If higher level security, such as Secret or Top Secret, is needed, other clearances can be added to the HSPD-12 requirements.

Verification Process. To the extent possible, HSPD-12 clearance of contractor personnel will be handled through the same procedures as for employees. The process has two steps: a National Agency Check (NAC) and a NAC with Written Inquiries (NACI). After the individual applies for a PIV credential, a NAC will be processed. If the NAC does not reveal any unfavorable information, a PIV credential will be issued; this should take about one week. Simultaneously, a NACI will also be initiated, with adjudication taking about six months. If the adjudication is favorable, nothing more needs to be done. If the adjudication is unfavorable, the credentials will be revoked.

Should a contractor’s PIV credentials be declined or revoked, the contract administration team must take some action to accommodate this in the contract. For example, the contract may have to be terminated if there is no alternative to on-site performance by the individual in question. On the other hand, it may be possible to arrange off-site performance or some other accommodation. In any case, the contracting officer must work together with the sponsor, security personnel, and the contractor to address this situation promptly.

All PIV credentials will automatically have a five year expiration, except for foreign nationals. Foreign nationals’ cards may be issued for five years, unless that date would extend past the expiration date of their work permit or visa. Governmentwide, the HSPD-12 clearance process for foreign nationals has not been finalized yet. Please be aware that there may be extra delay in obtaining verification for these individuals, especially during the early months of implementation.

If contractor personnel have already been investigated by another agency through OPM, the results of a prior HSPD-12 (or higher) clearance will be accepted by DOI upon receipt of appropriate verification.

Contracting Procedures. Early coordination with requisitioners is recommended in order to avoid delays in contract start-up. Contractors who already have badges may continue to use them until they naturally expire. However, there will be (at least) a week delay for individuals who start unsupervised physical or logical access for the first time on or after October 27.

For now, the background investigations must be paid for by the Government. A source of funding has not been clearly defined, but it appears likely that the sponsoring program will bear the cost. Some program offices may not be aware of this yet. They should be referred to the Bureau’s budget office for further guidance. We recommend that solicitations and contracts address limiting the number of contractor employees who will be investigated.

Contracting Officer’s Representatives (CORs) will have additional duties, which should be reflected in the COR appointment letter. CORs will act as sponsors for contractor personnel. In this capacity, they will be responsible for ascertaining the risk level for the position, including credentialing requirements in Statements of Work, validating individuals’ need for a PIV credential, facilitating the credentialing process, and ensuring that credentials are renewed and rescinded in a timely manner. It is the COR’s responsibility to make sure that contractors’ credentials are returned to the Government at the end of the contract or whenever a contractor employee’s affiliation with DOI ends.

Model Section C language is attached. The language may be modified to suit circumstances, except that the flow down requirement must be included. It should be used in all contracts where the requisitioner needs contractor personnel to have routine and regular unsupervised access to a Federally controlled facility for more than 180 days or unsupervised access to a Federally controlled Level 3 or 4 information system. It should rarely be applicable to contracts for supplies. When contracting on behalf of other agencies, language from the requisitioning agency that serves the same purpose may be used.

In addition to new contracts, HSPD-12 requirements must be added to some contracts awarded prior to this DIAPR’s issuance. Current contracts that require contractor personnel to have physical and/or logical access as described above must be modified to include the PIV requirements when an option is exercised, or before expiration when the contract term (i.e., the need for contractor access) extends past the expiration date of their current credentials. Contracts that do not currently require contractor personnel to have physical and/or logical access as described above must be modified to include the HSPD-12 requirements if circumstances change such that contractor physical or logical access is newly required.

6. Action Required:

Distribute this DIAPR as widely as possible, including to requisitioners. Coordinate with program offices and other requisitioners to ensure that the new procedures are followed and that contract work is not delayed. Starting immediately, insert language substantially similar to the attached model language in solicitations that require contractor personnel to have physical or logical access as described above. At the earliest opportunity, but no later than exercise of an option, modify applicable contracts to include language substantially similar to the model language.

7. Additional Information:

If you have questions about this matter, please contact Dee Emmerich at (202) 208 3348 or delia_emmerich@os.doi.gov.

Contractor Personnel Security and Suitability Requirements

Performance of this contract requires contractor personnel to have a Federal government-issued personal identification card before being allowed unsupervised access to a DOI [facility and/or information system]. The Contracting Officer’s Representative (COR) will be the sponsoring official, and will make the arrangements for personal identify verification and card issuance.

At least two weeks before start of contract performance, the Contractor will identify all contractor and subcontractor personnel who will require [physical and/or logical] access for performance of work under this contract. The Contractor must make their personnel available at the place and time specified by the COR in order to initiate screening and background investigations. The following forms, or their equivalent, will be used to initiate the credentialing process:

• OPM Standard Form 85 or 85P
• OF 306
• Fingerprint card (local procedures may require the fingerprinting to done at a police station; in this case, any charges are to be borne by the contractor)
• Release to Obtain Credit Information
• PIV card application (web-based)

Contractor employees are required to give, and to authorize others to give, full, frank, and truthful answers to relevant and material questions needed to reach a suitability determination. Refusal or failure to furnish or authorize provision of information may constitute grounds for denial or revocation of credentials. Government personnel may contact the contractor personnel being screened or investigated in person, by telephone or in writing, and the Contractor agrees to make them available for such contact.

Alternatively, if an individual has already been credentialed by another agency through OPM, and that credential has not yet expired, further investigation may not be necessary. Provide the COR with documentation that supports the individual’s status.

During performance of the contract, the Contractor will keep the COR apprised of changes in personnel to ensure that performance is not delayed by compliance with credentialing processes. Cards that have been lost, damaged, or stolen must be reported to the COR and Issuing Office within 24 hours. Replacement will be at the contractor’s expense. If reissuance of expired credentials is needed, it will be coordinated through the COR.

At the end of contract performance, or when a contractor employee is no longer working under this contract, the Contractor will ensure that all identification cards are returned to the COR.

Before starting work under this contract, a National Agency Check (NAC) will be conducted to verify the identity of the individual applying for clearance. Upon successful completion of the NAC process, an identification card will be issued and access granted.

Simultaneously, a NAC with Inquiries (NACI) will be initiated to determine the individual’s suitability for the position. If the NACI adjudication is favorable, nothing more needs to be done. If the adjudication is unfavorable, the credentials will be revoked. In the event of a disagreement between the Contractor and the Government concerning the suitability of an individual to perform work under this contract, DOI shall have the right of final determination.

This requirement must be incorporated into any subcontracts that require subcontractor personnel to have regular and routine unsupervised access to a Federally controlled facility for more than 180 calendar days or any unsupervised access to a Federally controlled Level 3 or 4 information system.