10 L 18 SOW ATT 14 PIB 21 06 PIV Card Management Training Final.pdf

PIB 21-06 PIV CARD MANAGEMENT TRAINING

11/30/2021 and 12/2/2021

This Photo by Unknown Author is licensed under CC BY-SA-NC

Presenters

• Nicole Howerton - Procurement Analyst, Acquisition Policy &

Program Division, Office of Acquisition Management

• Lee Davis - Procurement Analyst, Acquisition Systems & Measures

Division, Office of Acquisition Management

• Melissa DeBoer - Region 1 PIV POC, Program Analyst, Data

Analytics & Program Management Branch

• Steve Dunn - Region 3 PIV POC, Office of Design & Construction

• Phil Ahn - Deputy Director, Office of Mission Assurance

• Yom Nguyen - Office of Mission Assurance

Housekeeping

• This presentation is being recorded

• Registration via zoom.gov is required and 1 CLPs will be added to your CSOD account following the training (Certificates are not necessary). Sign in using the attached attendance form.

• Please submit questions during the presentation via the zoom chat box. Additional questions may be added via this Google Form if time does not allow for Q&A

• We will pause at specific times in the presentation to review questions

• The slides and recording will be posted to the NARC PIV InSite

• We will send a link to a survey after the training for certification and feedback purposes.

Agenda Part I - Purpose & Introduction Part II - Roles & Responsibilities Part III - PIV Onboarding, Validation & Collection Part IV - PIV Dashboards Part V - References & Resources 4

Purpose & Introduction

1. WELCOME to our training on the PIB 21-06 PIV Card Management Policy!

2. This is a collaboration between the:

⚬ PBS Office of Acquisition Management (OAM)

⚬ PBS Region 3 Office of Design & Construction (ODC)

⚬ PBS Region 1 Program Management (1P)

⚬ GSA Office of Mission Assurance (OMA)

3. For the PBS workforce, including all Requesting Officials or GSA POCs across business lines which is apprised of:

⚬ Contract Specialists (CSs)

⚬ Contracting Officers (COs)

⚬ Contracting Officer’s Representatives (CORs)

⚬ Project Managers (PMs)

Support & Impact

•Reduces our security risk

•Improved contract administration

•Improved PIV card outcomes

•Clearly defined roles and responsibilities

Supports our strategies for success

A brief history from then to now.

Tracking & Measuring

•Reduce the number of uncollected inactive cards

•Reduce the number of active cards on expired contracts

•Reduced data errors

Monitoring and taking action on PIV card categories

Big Picture Goals

• Ultimate goal of PIB 21-06

• Resourceful guide supports the PIV validation and collection efforts

Increase visibility and accountability for key stakeholders who are part of PIV card collection process.

Problems & Opportunities

• Poses significant security concerns

• Cards can be used to gain unauthorized access to GSA buildings and information systems

• Places GSA personnel, federal property, and data at risk

Inefficient management & oversight of PIV cards

Why is PIV Card Management important?

Important PIV Terms

1. Active: PIV or GSA Access card that is held by a contractor who is working on a current contract.

2. Active on expired contract: PIV card is held by a contractor who is active on an expired contract.

3. Inactive contractor cards: PIV card is deactivated or terminated for a contractor who is not working on any GSA contract.

4. Collected: Terminated PIV cards that GSA has successfully collected from a separated contractor.

5. Uncollected: Terminated PIV cards that GSA has not yet collected from a separated contractor. The Contractor has been listed as no longer associated with GSA but the card has not been logged as returned, destroyed or lost/stolen.

6. Uncollectible: Terminated PIV cards that GSA is unable to collect from a separated contractor after due diligence has been completed. Additional efforts to recover the cards have ceased.

7. Lost/Stolen: PIV cards that have been reported lost/stolen to GSA.

8. Outstanding: PIV cards that require GSA action; this category includes PIV cards that are active on expired contracts and uncollected.

9. ROCAL (Requesting Official Contracting Action List):

Identifies contractors on the contract, what type of background investigation is needed and if the contractor needs a GSA Access Card or not.

10. Requesting Official (RO): Staff that includes Contracting Officers (CO) and Contracting Officer’s Representatives (COR) as designated and authorized by the CO. Specific responsibilities of the RO are outlined in Appendix A of (CIO P 2181.1). The RO requests PIV cards on behalf of a contractor employee, certifies the status of outstanding PIV cards and notes inactive cards as uncollected.

Part II - Roles & Responsibilities

•Point of contact for managing PIV cards

• Initiating background investigations

•Resolving outstanding PIV card concerns

•Primary resource for PIV credentialing concerns, investigations, and updates to GCIMS

HSPD-12 Points of Contact

Office of Mission Assurance (OMA) HSPD-12 Branch

Security is our top priority

Roles & Responsibilities

RO Roles and Responsibilities

• The primary RO is generally the COR via delegation

• Submitting and updating the regional Requesting Official Contracting Approval List (ROCAL) (Sample ROCAL Sheet)

• Providing the information for section 2-6 of GSA Form 850-19 Contractor Information Worksheet (CIW) template to begin the background investigation process

• Tracking the status of PIV cards on the GCIMS Contract Dashboard (Refer to Dashboard User Guide) and reporting any discrepancies during contract performance to the CO and the HSPD-12 Zonal POC

• Complete HSPD-12 training in GSA OLU

• Link to the overall RO process 10

•The RO verifies contractors are active on each contract through GCIMS review

Notifying OMA of updates to the CIW or Contract Dashboard record based on any changes in the contract or contractor status, including the results of the PIV Validation review outlined in section 8B of PIB 21-06

•Collecting and returning PIV Cards to HSPD-12 Point of Contact when the contractor has completed/left the contract

•Complete & submit the Lost, Stolen, Uncollectible form

•Link to Roles & Responsibilities

Roles & Responsibilities

PIV Validation Process

Security is our top priority

Roles & Responsibilities

PIV Validation:

Contracting Officer Roles & Responsibilities

• When not delegated to a COR; functions as the RO

• Records actions as Government Furnished Property (GFP) in EASi

• Ultimate responsibility for issued PIV cards

• Reviews GCIMS Dashboard report for card validation needs

• Option Periods:

Review PIV cards issued prior to exercising an option (Attachment 1 PIV Validation Process) Applicable to all actions with option periods excluding construction options

Q&A Session

• Please enter questions in the Zoom Chat box or in the attached Google form

Part III - PIV Onboarding, Validation & Collection

RO Onboarding Responsibilities Determine the type of background investigation required based on the sensitivity level of the position and if a GSA Access Card (PIV) is required

Evaluate the type and length of contractor access required to GSA resources including federally-controlled IT systems and physical access to federally-controlled facilities

Initiate the background investigation process by completing and submitting the CIW Bot to their HSPD-12 POC (typically Zonal help desk). This prompts the email from HSPD-12 POC to Vendor POC including instructions, CIW template & ROCAL

Vendor POC will work with RO to complete ROCAL for approval and submission by RO to HSPD-12 POC.

Vendor POC is responsible for submitting completed CIWs for processing to HSPD-12 POC. RO responsible for working with Vendor POC to make sure contractors complete their portion (enrollment process and eQIP).

Link to Contractor Onboarding

Onboarding Process Enhancements

CIW Form Filler BOT The GSA Form 850-19 is the template that begins the background investigation process and is updated by the Requesting Official (RO) under sections 2-6

Link→CIW Form Filler Info Sheet Link→ Full CIW Bot form *RPA training forthcoming*

The Form Filler is a mandatory unattended BOT that will automate the entry of sections 2-6. For internal use by the RO or designated official.

•Complete CIW Filler Bot Request Form (step 3 above in the onboarding process)

•BOT uses the EASi BI report for data processing for PBS to query contract information submitted via a google form

•Run time - Every 10 minutes during working hours •Any areas flagged for review will be noted in the output email for RO review

•Forward to POC (HSPD-12 to fill out section 1) and continue normal CIW processing procedure

Step 1

PIV VALIDATION PROCESS

• RO Review GCIMS Contract Dashboard Tool

Verify contractor has an “active” status via a GCIMS dashboard review and if there is a change in information

Check ROCAL for all listed for continued need throughout contract performance

• If there are any changes needed:

Notify→ HSPD-12 Zonal POCs

Step 2 RO takes the following actions if there are changes based on their review:

• Submits revised ROCAL to the HSPD-12 POC if there are changes needed

• Notifies HSPD-12 POC when the GCIMS record should be made inactive

OMA will deactivate the record if the contractor is not on another active GSA contract.

• Note: PIV cards will be deactivated 30 days after POP

Step 3 CO review of GCIMS Contract Dashboard report

• Submitted by the COR - TAB 41, COR Security Badging and Escorting Documentation of PIB 18-02

• Required for each validation period, prior to options and closeout

PIV Card Semiannual Review Where? GCIMS Contract Dashboard and D2D PIV Card Status Dashboard Why? To confirm the continued need for PIV card access and account for each card When? Semiannually and prior to option exercise

*Refer to PIV Card Critical Events (Table 1 of PIB 21-06)

When to submit CIW and/or ROCAL

A new CIW is needed with:

• Change in contract/task order number (+ROCAL)

• Change in GSA POC or RO (i.e. COR/PM or CO) (also modify in EASi)

• Change in contract dates (dates are pulled from EASi first and must be current)

• Contractor name change

• Vendor POC change (+ROCAL)

• Option year award or modification for additional work

• Change in building information [ROCAL req to be removed from PIB 21-06]

• If end of PoP ---> proceed with card collection or CIW updates if new contract or an extension is awarded

When •Personnel no longer needed for contract performance

•When contractor personnel employment concludes

•Upon contract completion or termination

•Changes in PoP

•Contractor contract transfer

What •CIW and ROCAL documentation

•GCIMS Contract Dashboard Review

•D2D Dashboard Review

Who •Notify HSPD-12 POC

•Notify Regional PIV POC

•Vendor POC

Key Takeaways: RO Notifications

Key Takeaways: RO Notifications

Q&A Session

• Please enter questions in the Zoom Chat box or in the attached Google form

PIV Collection Process

Process, Step 1 Upon discovery that a PIV card is no longer needed:

Notify--> HSPD-12 Zonal POCs Note: Request deactivation of IT ENT Access and GCIMS account

HSPD-12 Points of Contact

Process, Step 2 Send Initial PIV Card Collection Request (Attachment 3) Who? Vendor POC and the contractor/cardholder Why? Notifies requirement to return the card within 5 business days When? Upon Discovery What? Complete Lost/Stolen or

Uncollectible form if applicable

Process, Step 3 Send 2nd PIV Card Collection Request (Attachment 4) Who? Vendor POC and the contractor/cardholder Why? Advises the PIV card is outstanding and must be returned within 5 business days.

When? Sent 5 business days after the initial request email

What? Complete Lost/Stolen or Uncollectible form if applicable

(NOTE: The RO has discretion to allow longer time periods if there are known issues where the Vendor POC or contractor makes an effort or has already attempted to collect the card.

This determination must be recorded as a memorandum to the contract file 28

Process, Step 4 Send Final PIV Card Collection Request (Attachment 5) Who? - Vendor POC and the contractor/cardholder Why? - Advises the contractual remedies available if the card is not returned within 5 business days.

When? Sent 5 business days after the 2nd request email

What? - Complete Lost/Stolen or Uncollectible form if applicable

Process, Step 5 Initiate Contractual Remedies

Who? Vendor POC and the contractor/cardholder

Why? Advises the contractual remedies available if the card is not returned within 5 business days

When? 5 business days after the final request email

What? Document file with supporting memorandum noting actions taken, prior requests and the CO final determination

(Complete Lost/Stolen or Uncollectible form if determined to be uncollectible (EASi TAB 41 COR Security Badging and Escorting Documentation or 26 Homeland Security Presidential Directive (HSPD-12) Compliance.)

PIV Collection Process Contractual Remedies Overview Contractual Remedies for Outstanding PIV Cards

If the access card(s) has not been returned after due diligence has been taken:

Issuance of an Interim Contractor Performance Assessment Report identifying the performance issue

Delay final payment [refer to Attachment 2 Invoice Rejection Guide]

Federal Protective Service (FPS) notification and card reported as lost/stolen/uncollectible

Recommendation to the Agency Suspension and Debarment Official for consideration of administrative action

Termination

Invoice Rejection

1. Reject the receiving report for final invoice where a PIV card is unaccounted for.

a. Email the OCFO Zonal POC

b. Reference the PDN or contract/task order # and invoice number

c. Reason for rejection - Select “Other” and annotate: “PIV card(s) have not been returned”

d. Add justification, if requesting invoice rejection after 7 days

2. File supporting documentation under TAB 30 Payment, Inspection and Acceptance.

*Refer to link on Invoice rejection instructions and Reviewing and Rejecting Invoices

When •Personnel no longer needed for contract performance

•When contractor personnel employment concludes

•Upon contract completion or termination

What •Lost/Stolen/Uncollectible Form

•PIV Collection Request notices

• IT and GCIMS Access Deactivation

How •The CO may approve final payment on a contract after one of the following has occurred:

•Review of the GCIMS Contract Dashboard report in the contract file and any other verification from the COR that all PIV cards are accounted for

•RO submission of a Lost or Stolen GSA Access Card Replacement Request form to the HSPD-12 Card POC for any cards accounted for

Key Takeaways: PIV Collection

Key Takeaways: RO NotificationsKey Takeaways: PIV Card Collection Process

Q&A Session & Poll

• Enter questions in the Zoom Chat box or in the attached Google form

• Please respond to the poll following the Q&A period.

Part IV - PIV Dashboards GCIMS Contract Dashboard PIV D2D Dashboard

GCIMS

Contract Dashboard Overview

• OMA weekly training - Every Wed at 2pm-3pm EST

• This is the primary tool for RO’s in their PIV card management Accessed by designated RO’s: https://gcims.gsa.gov

• Ability to view all contracts and contract statuses assigned to you under one location

• Easily monitor contractor employment and investigation statuses with the click of a button

• Access to detailed contractor information and easily download the information you need

• Fields to review for validation: Employment and Contractor status

GCIMS

Contract Dashboard Demo

Link to the GCIMS Contract Dashboard

PIV D2D

Dashboard Overview

Purpose of the Dashboard:

✔To provide a clear picture of all PIV data for comprehensive workload monitoring ✔ Assists in strategic planning and enable regions to prioritize their reviews ✔ Capability to drill down to detailed contract/PIV card data by month of expiration ✔ Detailed contract and PIV card data so regions can quickly and easily identify the cards that require action, and ✔ Progress made since the last reporting period

✔Displays who is issued a credential (HSPD-12)

✔Provides regions with a forecast of when the contractor will complete work

✔Potential issues have been placed into 2 groups in the “Card Flagged” field:

Expired Contract: The contract associated with the PIV card has no contract end date or the contract end date is prior to the last running of the report (beginning of this month)

Uncollected Card: The Contractor has been listed as no longer associated with GSA but the card has not been logged as returned, destroyed or lost/stolen 39

Demo

Access report: https://d2d.gsa.gov/report/gsa-piv-card-status

Tips Tips:

✔ Importance of EASi accuracy

✔ Report sorting

✔ Printing - Click for Additional Details -> Download Data → Crosstab→ CSV File

✔ Understanding the numbers

•Expired contracts (Goal: Less than 5% of the total # active cards)

•Uncollected (Goal: Less than 5% uncollected over 90d)

Part V – References & Resources

References

GSA Order ADM 5400.2 FAR 4.13 Personal Identity Verification (PIV) FAR 9.4 Debarment, Suspension, and Ineligibility FAR 52.204-9 Personal Identity Verification of Contractor Personnel FAR 42.15 Contractor Performance Information FAR 45.105 Contractors' Property Management System Compliance FAR 52.245-1 Alt 1 (Apr 2012)

GSAM 504.13

GSAM 552.204-9

2181.1 ADM

GSA OIG Audit A190085-1

References

Resources

• PIV NARC Insite

• RO Training: Available on GSA OLU

• End of Period of Performance Flow Chart

• Contractor Departure Flow Chart

• Contract Dashboard User Guide - Quick Start

• Lost/Stolen/Uncollectible Form

• Fitness Determinations & Types of Investigations

• RO Roles & Responsibilities

• RO Process Flow Chart

• HSPD-12 POCs

• COR Delegation for Credentials Management

• PIV Feedback Form

Resources - Updated

• CIW Filler Bot

• CIW Filler RPA Fact Sheet

• CIW Filler RPA User Guide

• CIW Filler RPA Training

Q&A

• Add questions to the attached Google form and in the Zoom Chat box

• PIV Q&As Catalog

• Reminder: Sign in using the attached attendance form to receive credit.

• A survey will be shared following this training to obtain your feedback. All who watch the recordings are required to certify via this form.

Points of Contact

● Nicole Howerton, Office of Acquisition Management

○ nicole.howerton@gsa.gov

● Lee Davis, Office of Acquisition Management

○ Lee.Davis@gsa.gov

● Melissa DeBoer, Region 1

○ Melissa.deboer@gsa.gov

● Steve Dunn, Design & Construction, Mid-Atlantic Division Region 3

○ Steve.Dunn@gsa.gov

● Phil Ahn, Deputy Director, Office of Mission Assurance

○ Phil.Ahn@gsa.gov

THANK YOU FOR ATTENDING TODAY’S EVENT! 47