October 24, 2005
Financial Assistance Communication Liaison Policy Release: 2006 - 1
To: Bureau/Office Financial Assistance Communication Liaisons
Subject: Implementation of Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Financial Assistance Awardees
1. Purpose: This policy release establishes procedures for standard implementation of HSPD-12 in Department of the Interior financial assistance (i.e., grants and cooperative agreements).
2. Effective Date: Upon signature.
3. Expiration Date: Upon issuance of applicable Office of Management and Budget policy coverage.
4. Background and Explanation:
HSPD-12, issued on August 27, 2004, directs the creation of a new Federal standard for secure and reliable identification issued by Federal agencies to their employees and contractors, including all tiers of subcontractors, and financial assistance recipients. Implementation will be in several stages, with the initial phase being put in place on October 27, 2005. This first phase consists of implementation of procedures under which Personal Identity Verification (PIV) credentials such as security badges, building passes, and so forth, will only be issued after an individual's identity has been independently verified. Later phases will expand coverage to personnel who have already been issued credentials as of October 27, and use of Smart Cards.
Not every financial assistance recipient and subrecipient (hereafter, “recipient”) employee will need PIV credentials. There are two categories of recipient personnel who will be subject to the background investigations:
• Those who need routine and regular unsupervised access to a Federally controlled facility for more than 180 days;
• Those who need unsupervised access to a Federally controlled Level 3 or 4 information system.
Physical Access. A “Federally controlled facility” is federally owned or leased space, whether for single or multi-tenant occupancy, all or any portion of which is under the jurisdiction, custody or control of DOI. If a building is shared with non-government tenants, only access to the Federal area is controlled. The requirements for recipient credentialing apply even if there is no guard, card reader, or other physical control at the entrance to the office. The 180 calendar day period begins on the first day of the individual's affiliation with DOI (in this case, the date that grant or cooperative agreement performance actually begins rather than the grant or cooperative agreement award date) and ends exactly 180 days later, regardless of the number of times the recipient actually accessed a building or IT system.
Logical Access. An “information technology system” is defined in the Federal Information Security Management Act of 2002 (44 U.S.C. §3503(8)). Use of an information system by a recipient or contractor on behalf of an agency is defined in 44 U.S.C. §3544(a)(1)(A). If a recipient needs any amount of unsupervised access to a DOI IT system, HSPD-12 compliant credentials must be issued regardless of the duration of access. The credentialing requirement applies whether the recipient accesses the IT system from the premises of a DOI facility, from their own facility, through the Internet, or by any other means.
Uncredentialed Recipients. Recipients who do not fit into one of the above two categories will be treated as visitors. These persons must access the facility via a screening system, display a temporary/visitor badge at all times, and be escorted at all times. Normally, persons working exclusively outside on the grounds of federally controlled facilities need not receive background investigations.
Special Cases. The preceding paragraphs describe the minimum requirements. Depending on risk, increased application of HSPD-12 will be appropriate in some cases, depending on the nature of the grant/cooperative agreement. If higher level security, such as Secret or Top Secret, is needed, other clearances can be added to the HSPD-12 requirements.
Verification Process. To the extent possible, HSPD-12 clearance of recipient personnel will be handled through the same clearance procedures as for Department of the Interior employees. The process has two steps: a National Agency Check (NAC) and a NAC with Written Inquiries (NACI). After the individual applies for a PIV credential, a NAC will be processed. If this does not reveal any unfavorable information, a PIV credential will be issued; this should take about one week. Simultaneously, a NACI will also be initiated, with adjudication taking about six months. If the adjudication is favorable, nothing more needs to be done. If the adjudication is unfavorable, the PIV credentials will be revoked.
Should a recipient's PIV credentials be declined or revoked, the grant/cooperative agreement administration team must take some action to accommodate this in the grant/cooperative agreement. For example, it may be possible to arrange off-site performance or some other accommodation. In any case, the administering office must work together with the sponsor, i.e., program office, security personnel, and the recipient to address this situation promptly.
All PIV credentials will automatically have a five year expiration, except for foreign nationals. Foreign nationals' cards may be issued for five years, unless that date would extend past the expiration date of their work permit or visa. Governmentwide, the HSPD-12 clearance process for foreign nationals has not been finalized yet. Please be aware that there may be extra delay in obtaining verification for these individuals, especially during the early months of implementation.
If recipient personnel have already been investigated by another agency through OPM, the results of a prior HSPD-12 (or higher) clearance will be accepted by DOI upon receipt of appropriate verification.
Procedures. Early coordination with program officials is recommended in order to avoid delays in grant/cooperative agreement start-up. Recipients who already have badges may continue to use them until they expire. However, there will be (at least) a week delay for individuals who start unsupervised physical or logical access for the first time on or after October 27.
For now, the background investigations must be paid for by the Government. A source of funding has not been clearly defined, but it appears likely that the sponsoring program will bear the cost. Some program offices may not be aware of this yet. They should be referred to the Bureau's budget office for further guidance. We recommend that grant/cooperative agreement applications address limiting the number of recipient employees who will be investigated.
DOI grant/cooperative agreement office personnel will have additional duties, which should be reflected in the application process. DOI personnel will act as sponsors for recipient personnel. In this capacity, they will be responsible for ascertaining the risk level for the position, including credentialing requirements in the grant/cooperative agreement descriptions, validating individuals' need for a PIV credential, facilitating the badging process, and ensuring that credentials are renewed and rescinded in a timely manner. It is the DOI grant/cooperative agreement office's responsibility to make sure that recipients' credentials are returned to the Government at the end of the grant/cooperative agreement or whenever a recipient employee's affiliation with DOI ends.
Model Special Terms and Conditions language is attached. The language may be modified to suit circumstances, except that the flow down requirement must be included. It should be used in all grants and cooperative agreements where the terms require subrecipient personnel to have unsupervised access to a Federally controlled facility for more than 180 days or unsupervised access to a Federally controlled Level 3 or 4 information system.
In addition to new grants and cooperative agreements, HSPD-12 requirements must be added to some grants and cooperative agreements awarded prior to this policy release's issuance. Current grants or cooperative agreements that require recipient personnel to have physical and/or logical access as described above must be amended to include the PIV requirements before expiration when the grant/cooperative agreement extends past the expiration date of their current credentials. Grants or cooperative agreements that do not currently require recipient personnel to have physical and/or logical access as described above must be modified to include the HSPD-12 requirements if circumstances change such that recipient physical or logical access is newly required.
5. Action Required:
Coordinate with DOI grantcooperative agreement offices to ensure that the new procedures are followed and that grant or cooperative agreement work is not delayed. Starting immediately, insert language substantially similar to the attached model language in applications that require recipient personnel to have physical or logical access as described above. At the earliest opportunity, but no later than exercise of an amendment, amend applicable grants and cooperative agreements to include the new model language. Distribute this policy release as widely as possible within your bureau/office grants and cooperative agreements community.
6. Additional Information: If you have questions about this matter, please contact Kate Oliver at (202) 208-3345 or firstname.lastname@example.org.
Debra E. Sonderman, Director
Office of Acquisition and Property Management
Model HSPD-12 Grant/Cooperative Agreement Language
Recipient/Subrecipient Personnel Security and Suitability Requirements
Performance of this grant/cooperative agreement requires recipient/subrecipient personnel to have a Federal government-issued personal identification card before being allowed unsupervised access to a DOI [facility and/or information system]. _________________________ [to be completed by bureau/office, e.g., designated grants/cooperative agreement administrator] will be the sponsoring official, and will make the arrangements for personal identify verification and card issuance.
At least two weeks before start of grant/cooperative agreement performance, the recipient will identify all recipient and subrecipient personnel who will require [physical and/or logical] access for performance of work under this grant/cooperative agreement. The recipient and subrecipient must make their personnel available at the place and time specified by the __________________________[title to be completed by the bureau/office] in order to initiate screening and background investigations. The following forms, or their equivalent, may be used to initiate the credentialing process:
• OPM Standard Form 85 or 85P
• OF 306
• Fingerprint card (local procedures may require the fingerprinting to be done at a police station; in this case, any charges are to be borne by the recipient or subrecipient, as applicable)
• Release to Obtain Credit Information
• PIV card application (web-based)
Recipient and subrecipient employees are required to give, and to authorize others to give, full, frank, and truthful answers to relevant and material questions needed to reach a suitability determination. Refusal or failure to furnish or authorize provision of information may constitute grounds for denial or revocation of credentials. Government personnel may contact the recipient or subrecipient personnel being screened or investigated in person, by telephone or in writing, and the recipient agrees to make them available for such contact.
Alternatively, if an individual has already been credentialed by another agency through OPM, and that credential has not yet expired, further clearance may not be necessary. Provide the sponsoring office with documentation that supports the individual's status.
During performance of the grant/cooperative agreement, the recipient will keep the _____________________________[title to be completed by the bureau/office] apprised of changes in personnel to ensure that performance is not delayed by compliance with credentialing processes. Cards that have been lost, damaged, or stolen must be reported to the ___________________________________[title to be completed by the bureau/office] and Issuing Office within 24 hours. Replacement will be at the recipient's
expense. If reissuance of expired credentials is needed, it will be coordinated through the _____________________________________[ title to be completed by the bureau/office].
At the end of grant/cooperative agreement's performance, or when a recipient/subrecipient employee is no longer working under this grant/cooperative agreement, the recipient will ensure that all identification cards are returned to the ___________________________________ [title to be completed by the bureau/office].
Before starting work under this agreement, a National Agency Check (NAC) will be conducted to verify the identity of the individual applying for clearance. Upon successful completion of the NAC process, an identification card will be issued and access granted.
Simultaneously, a NAC with Inquiries (NACI) will be initiated to determine the individual's suitability for the position. If the NACI adjudication is favorable, nothing more needs to be done. If the adjudication is unfavorable, the credentials will be revoked. In the event of a disagreement between the recipient and the Government concerning the suitability of an individual to perform work under this grant/cooperative agreement, DOI shall have the right of final determination.
This requirement must be incorporated into any sub-grants/cooperative agreements that require subrecipient personnel to have unsupervised access to a Federally controlled facility for more than 180 calendar days or unsupervised access to a Federally controlled Level 3 or 4 information system.