Att G_NIST PR_2401_01.pdf

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 1

Facility Access and Electronic Access Control

NIST PR 2401.01

Issue Date: 9/19/2025

Effective Date: 6/8/2016

PURPOSE

This directive establishes policies and procedures for requesting and managing physical access to National Institute of Standards and Technology’s (NIST) facilities. It further defines the responsibilities and procedures for the issuance, display, replacement and relinquishment of NIST issued badges including Personal Identification Verification (PIV/PIV-I), Facility Access Cards (FACS), Limited Access Cards (Yellow Badges), and Visitor Paper Badges Furthermore, this directive establishes a formalized process for NIST employees and associates to serve as escorts for any person(s) needing temporary access to NIST facilities, and not specifically authorized unescorted access, who require an escort for the duration of their visit while in access-controlled space.

APPLICABILITY

The provisions of this directive apply to NIST owned or controlled sites. Facility Access and Electronic Access Control affects NIST employees, associates, contractors and vendors. vendors who access a NIST campus or facility. (NOTE: Due to additional physical security and/or access control requirements at certain NIST facilities, some provisions of this directive may not be applicable to a particular facility. Please contact the Emergency Services Office or the Space Owner for any facility specific questions.)

REFERENCES

• Department of Commerce, Security Manual of Policies and Procedures, Office of Security, December 2012

• Department of Commerce, Department Administrative Orders (DAO) 207-12, Foreign National Visitor and Guest Access Program

• Risk Management Process for Federal Facilities: An Interagency Security Committee Standard, Department of Homeland Security, 2016

• Risk Management Process for Federal Facilities, Appendix B: Countermeasures, Department of Homeland Security, 2019 http://home.commerce.gov/osy/SecurityManual/Security%20Manual%20Chapters/Security%20Manual.pdf http://www.osec.doc.gov/opog/dmp/daos/dao207_12.html http://www.osec.doc.gov/opog/dmp/daos/dao207_12.html http://www.dhs.gov/sites/default/files/publications/ISC_Risk-Management-Process_Aug_2013.pdf http://www.dhs.gov/sites/default/files/publications/ISC_Risk-Management-Process_Aug_2013.pdf https://www.cisa.gov/sites/default/files/publications/isc-risk-management-process-2016-508.pdf ktg1 Highlight

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 2

• Homeland Security Presidential Directive 12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004

• OMB M-11-11, Continued Implementation of HSPD-12 Policy for Common Identification Standard for Federal Employees and Contractors, February 3, 2011

• Real ID Act, Department of Homeland Security

• P 1400.00, Visiting Research and Associate Policy

• P 2100.00, Facilities and Site Management Policy

• O 1401.00, Domestic Associates Program

• O 1402.00, Foreign Guest Researcher Program

• O 2402.00, Physical Security Program

• PR 2402.01, Cyberlock Access Control

• N 6103.09, Access and Use of Personal Identity Verification (PIV) Card Authentication to Information Systems

DEFINITIONS

Access Controlled Space - area which is secured by or controlled by a Physical Access Controlled system or other locking mechanism.

Access Requirement Document (ARD) – a Department of Commerce (DOC) form developed for processing of Foreign Nationals (FN) in accordance with the Department Administrative Order (DAO) 207-12.

Activation – a process whereby the card recipient places the Personal Identification Verification (PIV) card in the PIV card reader and is prompted for a password (PIN) and the card is “personalized” with the recipient’s security certificates.

Approved NIST Escort – a NIST Federal employee or an Associate who has been issued a PIV/PIV-I Card or a Site Badge, who has completed the required escort training and who has been given the authority to escort visitors within NIST controlled space. Foreign Nationals are prohibited from serving as escorts. NOTE: Only federal employees are authorized to escort foreign nationals. Escorting of Foreign Nationals requires the Federal employee escort to complete the Counterintelligence Training.

Associate/Affiliate – an individual who works at NIST sites but is not employed by NIST.

Refer to the NAIS Associate types for description of each.

Badge – card used for identification purposes, bearing information such as one’s name, logo or place of employment or academic affiliation. Can be used for visual identification purposes and/or physical access to facilities. (see also NIST Facility Access Card).

http://www.dhs.gov/homeland-security-presidential-directive-12 http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf http://www.dhs.gov/real-id-enforcement-brief https://inet.nist.gov/cos/directives/visiting-researcher-and-associate-policy https://inet.nist.gov/ofpm/directives/facilities-and-site-management https://inet.nist.gov/tpo/directives/domestic-associates-program https://inet.nist.gov/iaao/directives/foreign-guest-researcher-program https://inet.nist.gov/eso/directives/physical-security-program https://inet.nist.gov/eso/directives/cyberlock-access-control https://inet.nist.gov/oism/directives/piv_card_notice http://www.osec.doc.gov/opog/dmp/daos/dao207_12.html https://inet.nist.gov/sites/default/files/documents/tpo/services/nais-types_0_0.pdf

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 3

Badge Office – the central point where cards are issued to employees and non-NIST employees.

Business Hours – The regular operating hours of the NIST campuses are Monday – Friday from 6 am – 7 pm, except during federal holidays and other emergency site closure events.

Certificate – is an electronic digital signature installed on the PIV card chip to bind a public key with an identity – information such as the name of a person or an organization, their address, etc.

Color Codes for Cards –

Blue stripe: foreign national associate;

Green stripe: domestic associate; and

Yellow card: limited access, no color stripe for employees.

Common Access Cards (CAC) - a credential, like a PIV Card, that meets the requirements of Homeland Security Presidential Directive (HSPD) – 12 and Federal Information Processing Standards (FIPS) 201-2.

Electronic Access Control – controlling entry into a physical area by means of a controller and electronic components including locks, cyberlocks, readers, and sensors. Electronic access control specifies who can go where and when.

Employee – a full-time or part-time Federal employee of the National Institute of Standards and Technology.

Enrollment – process whereby the applicant enrolls in the USAccess system for a PIV credential, presents the proper identification documents, has photo and fingerprints captured and verifies personal information provided.

Escort/Site Hosts – a badged federal employee or associate who is approved/authorized and identified to accompany a non-badged person(s) within access-controlled areas during Business and/or Security-Hours. area. NOTE: Only Federal Employees, who are also U.S.

Citizens, are authorized escort/host Foreign National visitors/guests during their time at NIST administered sites. On the Boulder campus, NTIA, NOAA and GSA are approved to sponsor visitors or affiliates to enter the campus.

Escorted Access – A limited form of facility access, which requires an individual to be accompanied by an approved/authorized NIST Escort while inside NIST-controlled facilities and spaces.

Facility User Badge – card issued to NIST Center for Neutron Research (NCNR) users by the NCNR User Office.

Foreign National (FN) – any person who is not a citizen or legal permanent resident of the United States of America.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 4

Guest – see DAO 207-12 for definition and must be registered in the Visitor Registration System and entered into NAIS.

Guest Researcher – a type of associate who collaborates with NIST on research projects of mutual interest, and/or works under a federal funding agreement with a U.S. university or U.S. company.

Human Resource Arrivals and Departure System (HRADS) – system that controls the status of employees.

Limited Access Card (Yellow Badge) – Yellow identification card with visual image issued to Kiss & Ride, Child Care Center and visitors’ applicants (construction, maintenance, service providers, delivery personnel, etc.) and only permits electronic access authority at NIST Gaithersburg perimeter Gates and Child Care Center.

NIST Associate Information System (NAIS) – Automated system that supports the process of bringing NIST associates, affiliates, contractors, guest researches, other federal employees, and all non-NIST individuals to the NIST campus or allowing access to NIST resources.

NIST Facility Access Card (FAC) – overall name provided for a visually identifiable card that represents the various card types issued by the NIST Badge Office.

Personal Identification Number (PIN) - a secret string of numbers that a claimant memorizes and uses to authenticate his or her identity with their PIV Card. PINs are generally 6-8 digits in length.

Personal Identification Verification (PIV)/Personal Identification Verification Interoperable (PIV-I) Card – a physical artifact (e.g., identity card, “smart” card) issued to an individual that contains stored identity information (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the claimed identity of the cardholder can be verified against the stored information by another person (human readable and verifiable) or an automated process (computer readable and verifiable). A PIV/PIV-I Card meets the requirements of HSPD-12 and FIPS 201-2.

Physical Access Control System (PACS) – software/hardware system that controls access to the NIST campus and specific facilities controlled by NIST.

Piggybacking/Tailgating – Piggybacking occurs when an authorized person allows someone to follow them through a door to secure area. Tailgating occurs when an unauthorized person slips in through a door before it closes. Both practices are breaches of security.

Police Services Group (PSG) – Federal police officers responsible for physical protection of the site, traffic enforcement, motor vehicle and crime investigations, and emergency response.

Protective Security Officer (PSO) – contract security guard that operates security posts at NIST access/egress gates.

https://iapps.nist.gov:7102/NAISWeb/naisLogin.html

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 5

Security-hours – also referred to as out-of-hours, after-business hours or after hours. The period from 7:00 pm to 6:00 am Monday through Friday and all hours Saturday, Sunday and holidays.

Site Badge – NIST issued badge in lieu of HSPD-12 Compliant card (PIV/ PIV-I, or CAC).

Issued upon notification that personnel are not eligible for HSPD-12 compliant card, i.e.

Works on site less than 179 days per calendar year. Permits electronic access authority to NIST Sites. For PIV eligible individuals, the card will only be valid for 60 days until the individual’s adjudication is completed and HSPD-12 Compliant card can be issued.

Temporary Site Badge – a temporary badge issuance that only provides 24-hour physical access consistent with the badge holders issued PIV/PIV-I or Site badge.

Visitor – see DAO 207-12 for definition, individuals must be registered in the Visitor Registration System.

Visitor Paper Badge – A paper badge issued to an individual who is only visiting the site for a limited duration, less than 14 days in a consecutive 365-day period, and is sponsored by an employee of NIST and does not permit electronic access authority at NIST sites. All visitors must be escorted by their sponsor while on the site.

Visitor Registration System – A NIST web-based system where departmental sponsors enter information on visitors to the campus.

DELEGATION OF AUTHORITY

The NIST Director hereby delegates the Associate Director for Management Resources (ADMR) authority to provide management of the HSPD-12 program.

The ADMR hereby delegates to the Director, Emergency Services Office (ESO), oversight of the Facility Access and Electronic Access Control Program, to include management of the HSPD-12 program.

RESPONSIBILITIES

NIST Director

• Has overall responsibility for compliance with HSPD-12 and other applicable federal regulations regarding badging of employees, associates, etc.

• Ensures logical and physical access control measures are in place for the overall security of NIST sites.

• Delegates to the Director, ESO oversight of the electronic access control program.

• Expects all occupants of NIST-owned and operated sites to comply with this directive.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 6

Organizational Unit (OU) Directors

• Ensure that new employees and eligible Associates/Affiliates apply for and receive a

NIST FAC.

• Process special requests for modified access authorizations for NIST employees and non-NIST employees.

• Submit all requests for the installation, modification or removal of access control points (i.e. door locks, cyberlock hardware, physical access control readers) to the existing system to ESO for review and approval.

• Report all unauthorized access or compromised cards/pins immediately to the ESO.

• Provide a list of authorized users by lock/facility locations to the ESO. Any changes or modifications made to existing access must be provided to the ESO within two days of implementation. ESO may require additional information to complete requests.

• Only authorizes the access necessary to meet mission requirements and such access must be consistent with the individual’s NIST site access (days and times).

• Reviews and concurs internal requests to allow Foreign National personnel, temporary access to the NIST campus during Security Hours. Access request concurrences are then submitted to the ESO for review and approval.

Office of Human Resources Management (OHRM)

• Ensure that new Federal employees proceed to the Badge Office for a photograph and receipt of their Site Badge until their PIV card is received.

• Inform Federal employees to bring two (2) forms of identification for enrollment in the USAccess system.

• Terminate the employment status and card issuance in USAccess system when Federal employees leave or transfer from the agency.

Department Sponsors (DS)

• Ensure NAIS Initiators enter correct information into the NAIS system for sponsored domestic or foreign national Associates/Affiliates.

• Attend counterintelligence briefings provided by the NIST Office of Security (OSY) annually for sponsoring of FNs.

• Review roles/responsibilities with sponsored Associates/Affiliates while on NIST administered sites.

• Review and sign the DAO 207-12 Attachment 2, for each foreign national for each agreement period, Certification of Conditions and Responsibilities for Departmental https://inet.nist.gov/tpo/directives/domestic-associates-program https://inet.nist.gov/iaao/directives/foreign-guest-researcher-program https://inet.nist.gov/sites/default/files/documents/forms/att2po.pdf

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 7

Sponsors or Foreign National Guests. (NOTE: For the NCNR, all sponsors sign Attachment 2 once a year rather than for each foreign national)

• Review the DAO 207-12 Attachment 3, for each foreign national for each agreement period, ensure the Foreign National Guests understands the restriction for their appointment. Ensure that the DAO 207-12 Attachment 3 is signed by the FN associate/affiliate and provided to OSY through NAIS.

• Submit an Access Requirement Document (ARD) in accordance with Department of Commerce DAO 207-12 Foreign Guest Access to NIST OSY.

• Ensure the USAccess sponsor, for their organization, terminate the employment status and card issuance of the PIV/IPIV-I card in the USAccess system when the individual leaves NIST.

o Collect the PIV/PIV-I card / Site Badge issued and return to the Badge Office.

o Ensure NAIS is updated when Associate/Affiliate departs and sends notification to OSY and the Emergency Services Office (ESO) through NAIS.

NIST Center for Neutron Research (NCNR)

• Process/create badges for employees and Associates/Affiliates requiring special access as Facility Users to Building 235.

• Process employees and Associates/Affiliates into the NCNR ACS.

NIST Office of Security (OSY)

• Conduct background investigations and provide decisions to Badge Office for issuance of cards.

• Approve/disapprove (NIST-1260) foreign visit requests to NIST-owned and operated sites and promptly notify DS and ESO of the decision via NAIS.

• Provide counterintelligence briefings annually and upon request to NIST employees.

• Notify OHRM, DS, ESO, and Contracting Officer Representative (COR) when an applicant has been deemed ineligible for issuance of a credential.

• Process foreign national Associates/Affiliates who meet the requirements for a PIV-I card into the General Services Administration (GSA) USAccess system.

Director, Emergency Services Office (ESO)

• Serves as the NIST Chief Physical Security Officer;

• Develops and executes the NIST Security Program, including but not limited to, developing and implementing security directives and procedures; evaluating/auditing security practices; conducting risk assessments in accordance with ISC standards and https://inet.nist.gov/sites/default/files/documents/forms/att3po.pdf https://inet.nist.gov/sites/default/files/documents/forms/att3po.pdf https://inet.nist.gov/sites/default/files/documents/ofpm/services/fnv_accessrequirements.pdf

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 8

DOC guidance; identifying/implementing mitigation measures; developing and executing security outreach, education and exercise programs; and such other measures/activities necessary to identify, assess, mitigate and where possible eliminate security threats to NIST;

• Executes the NIST Security Program in accordance with applicable laws, Executive Orders, regulations, standards and directives;

• “Makes risk-based decisions for access to all NIST facilities (except for access covered under the TR-5 reactor license), which deviate from existing policies and procedures. For access covered under the TR-5 reactor license, the NCNR Director has primary responsibility and works in close consultation with the ESO Director.”

Develops and maintains the NIST Physical Security directives and supplemental guidance;

• Provides programmatic Physical Security guidance and oversight to NIST-administered sites (NOTE: For the NCNR, this is a shared responsibility with the NCNR Director/TR-5 Licensee;

• In collaboration with OSY, ensures the effective fulfillment of a common protection objects for NIST;

• Serves as the Office of Primary Responsibility for all NIST access control decisions;

• Oversees all access control systems for NIST (NCNR & NANO-Fab ACS excluded), including but not limited to:

o The management, maintenance and expansion of the physical access control system (PACS);

o Reviewing of all requests for access control devices and installation plans;

o Defining procedures and practices to be used where ACS are to be utilized;

o Identifying ESO and OSY personnel who must be granted access in all ACS implementations; and, o Developing criteria for the submission of both types of request for access control devices (stand-alone and NIST-wide).

• Approves all access controls systems utilized at NIST.

• Approve/disapprove requests for access during security-hours for Associates/Affiliates/Contractors and FNs and promptly notify DS and ESO of the decision.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 9

ESO Badge Office

• For PIV enrollment – capture fingerprints and photographs, validate two (2) forms of identification provided, and enroll the individual into the USAccess system.

• Issue appropriate card type for employees and Associates/Affiliates and enter information into the PACS.

• Issue Temporary Site Badge to staff who have forgotten their PIV/PIV-I or Site Badge for 24-hours physical access, record and acquire signature.

• Notify and send reminders to individuals that their PIV card is available for pickup and assist in the activation of the credential.

• Import PIV card into the PACS.

• Assign appropriate access levels

• Assist individuals, as needed, with updating their PIV card certificates.

• Process requests for renewal and reissue cards.

• Act as sponsor for individuals not previously entered into USAccess system (Gaithersburg).

• Update site / PIV cards with additional access levels as authorized and inform the individual / DS of the change.

• Import CAC into access control system (Boulder).

• Issue PIN for Child Care Center (CCC) parents/guardians and Conference attendees (Boulder).

• Issue parking permit (exception: handicap and carpool are issued by DOC PSG).

o Gaithersburg - Carpool passes only o Boulder - parking permits only

Visitor Center (VC)

• Issue Visitor Paper Badge to registered visitors.

• Direct staff that have forgotten their PIV/PIV-I or Site Badge to the Badge Office for a temporary single day site badge.

• Collect NCNR Facility User access badges that are surrendered to the VC due to expiration date or deactivated badges. VC Staff return badges to the NCNR User Office (Gaithersburg Only).

• Provide directions and guidance to visitors new to the NIST site.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 10

• Process and capture fingerprints for submission to the respective OSY security office per agency procedures (Boulder only).

Employees and Associates/Affiliates/Contractors

• Ensure the NIST Badge is physically displayed at all times while on NIST campus and follow the rules of behavior as specified in Appendix A.

• Within the timeline provided in the notice complete enrollments, activations, certificate updates, and renewal requests of their PIV card when notified.

• Within 48 hours report the loss, damage, or theft of their NIST Badge to their supervisor and the Badge Office. Complete forms NIST-351 for OHRM and DN-42 for submission to ESO.

• Report damaged or non-functioning credentials (PIV, PIV-I, NIST FAC) to the Badge Office.

• Ensure correct information is entered into the Visitor Registration System for visitors/guests to the NIST campus.

• Upon receipt of their PIV card, individuals must utilize it to gain access to NIST facilities and must comply with OISM’s logical access policy if they will be using NIST connected computers.

• Individuals must surrender their Site Badge upon receipt of their PIV card.

• Upon separation or departure from NIST, individuals must return their issued NIST FAC to the Badge Office.

• Based on the limitations of the PACS, individuals must ensure controlled doors are properly secured at all times (they cannot be propped open) and must not permit any “piggybacking/tailgating” entry of others. Escorted visitors/guests must remain with the Department Sponsor (DS) during their visit.

Protective Security Officers

• Main gate – issue temporary Visitor Paper Badge during security-hours.

• Distribute NCNR access cards, as necessary, to users during security-hours (Gaithersburg).

BADGING PROCEDURES

Initial Entry for All Individuals to the Campus

• New employees, Associates/Affiliates/contractors will be required to have a background check prior to issuance of a NIST FAC.

https://inet.nist.gov/oism/directives/piv_card_notice

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 11

• TPO processes domestic Associates/Affiliates while IAAO processes FN and legal permanent resident Associates/Affiliates, then individuals proceed to OSY.

• NCNR Facility Users proceed directly to NCNR User Office to be processed for a Facility User’s badge.

• PML Facility Users will be directed to the NanoFab User Office and will be escorted to the Badge Office to receive a Site Badge.

Site Badge Procedures for Associates/Affiliates/Contractors (all Non-NIST employees)

• DS ensures all Associate/Affiliate/Contractors (all non-NIST employees) are entered into the NAIS system for access to NIST administered sites.

• NIST OSY approves application and enters the information into NAIS.

• Badge Office verifies information in NAIS for Associates/Affiliates.

o For those individuals who are not eligible for a PIV card, the Badge Office provides the individual with a Site Badge for 179 days which can be extended up to 1 year if they do not qualify for a PIV or PIV-I. For those requiring a PIV card, the Badge Office will provide the individual with a Site Badge valid for 60 days until the adjudication has been completed and a PIV can be issued. Individuals requiring IT access for any duration will receive a PIV Card.

PIV/PIV-I Procedures for Employees/Associates

• All applicants will be required to have a background check prior to issuance of a card.

• A Site Badge will be issued for physical access pending issuance of a PIV/PIV-I or for individuals who are not eligible to receive a PIV/PIV-I card.

• Upon notification of sponsorship into the USAccess system, the individual would contact their respective badge office to schedule an enrollment appointment. When the individual arrives for the appointment, they will need to have two (2) forms of identification.

• Badge Office validates documents against USAccess record, captures fingerprints and photograph of individual.

• Upon receipt of e-mail notification of PIV/PIV-I card for pickup, individuals will immediately schedule an appointment in accordance with the instructions in the e-mail. Failure to do so may result in a lapse in physical access to the NIST campus.

• Badge Office will assist the individual with the activation of the PIV/PIV-I card and PIN requirements.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 12

• Upon receipt of e-mail notification to update the digital certificate on the PIV card, the individual must, as soon as possible, schedule an appointment in accordance with the instructions in the e-mail. Failure to do so will result in a lapse of logical access.

• Badge Office will assist the individual with the certificate update process of the PIV card.

• Badge Office and iTAC will assist individuals who require PIN resets.

• Sponsors of FNs must follow NIST directives O1402.00 and PR1402.01.

• Upon receipt of e-mail notification for a renewal credential for pickup, individual immediately schedules an appointment in accordance with the instructions in the e-mail.

Card Procedures for Limited Access Card (Yellow Badge) (Gaithersburg)

• All individuals must be sponsored by a NIST employee, who must complete and submit a DN-52.

o Foreign Nationals must be approved for access by the Office of Security.

o Chief, Facilities Services Division (FSD) sponsors/approves non-affiliated childcare center applicants.

• All applicants will be required to have a criminal history check prior to issuance of a Limited Access Card.

• Once the application has been approved, the Badge Office notifies the sponsor via e-mail.

o The sponsor must register the applicant in the Visitor Registration System for the applicant to be issued a Visitor Paper Badge at the VC.

o The sponsor will escort the visitor to the Badge Office to be issued the card. The applicant must present two (2) forms of identification prior to issuance.

Card Procedures for Limited Access Card (Boulder)

• Card Procedures for Limited Access Card (Boulder)All individuals must be sponsored by a NIST employee, who must complete and submit a DN-52.

• Foreign Nationals must be approved for access by the Office of Security.

• Chief, Facilities Services Division (FSD) sponsors/approves non-affiliated childcare center applicants.

• All applicants will be required to have a criminal background check prior to issuance of a Limited Access Card.

• Once the application has been approved, the VC notifies the sponsor via e-mail.

https://inet.nist.gov/iaao/directives/foreign-guest-researcher-program-procedures https://inet.nist.gov/iaao/directives/foreign-guest-researcher-program-procedures

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 13

• The sponsor must register the applicant in the Visitor Registration System for the applicant to be issued a Visitor Paper Badge at the VC.

• The sponsor will escort the visitor to the Badge Office to be issued the card. The applicant must present two (2) forms of identification prior to issuance.

Procedures for Temporary Building Access for NIST Employees and Associates who arrive at NIST but forgot their issued PIV/PIV-I or Site Badge

• NIST employees and associates who have forgotten their issued badge will report to the VC for a one-day NIST visitor "paper badge." All individuals must be registered in the VRS and present photo identification at the time of their arrival (driver’s licenses must meet REAL ID Act requirements). The individual will then be directed to the NIST Badge Office.

• The NIST Badge Office will issue a temporary (single day, non-photo) site badge.

This will allow physical access to all access-controlled entry points. (NOTE: For Building 235, separate “Orange Badges” are issued by the NCNR for facility access.)

o Individuals with 24x7 access will be issued a temporary site badge with "24x7 Security Hours" printed on it.

o Individuals with business hours only access will be issued a temporary site badge with "Business Hours Only" printed on it.

• Individuals issued a temporary site badge MUST return the badge to the Badge Office the morning of the next business day in order to get their current badge reactivated.

• Failure to return this temporary site badge will result in an email notification to the individual and their supervisor, host or sponsor.

ACCESSING NIST CAMPUSES AND BUILDINGS

An individual’s physical access to the NIST campus is dependent upon a number of factors including the time of day when access is needed, the position they hold at NIST (i.e. federal employee, associate or visitor), or the assignment of access rights requested by the Operating Union and approved by the ESO.

• Visitors/Guests to NIST are only allowed access during Business Hours unless an access request was submitted and approved by the ESO.

• NIST Associates are provided with Business Hours Access (6 am – 7 pm, M-F) to the NIST Campus and their assigned buildings and laboratory spaces. Upon approval from their OU, NIST Associates may be provisioned with extended hours of access.

The first option (Tier 1) allows access from 7 pm – 10 pm, Monday-Friday. The second option (Tier 2) allows access 24-hours, 7 days a week.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 14

• Federal employees with NIST issued PIVs, as well as NOAA and NTIA federal employees in Boulder, are provided with 24-hour access, 7 days a week to the NIST Campus and their assigned buildings and laboratory spaces.

Business Hours Entry for Visitors to the Campus

All visitors, 18 years of age and older, must be preregistered in NIST’s visitor registration system. Upon arrival, visitors are required to present an accepted form of photo I.D.

(NOTE: Children younger than 18 years old do not need to be registered or provide identification but must be accompanied and escorted by a parent or legal guardian or they must be participating in a school function occurring on the campus and be under the care of school staff. Not all state-issued driver's licenses can be accepted by NIST. Under the REAL ID Act of 2005, federal agencies, including NIST, can only accept REAL ID-compliant state driver’s licenses.)

In order to enter a visitor into the Visitor Registration System, you must know if that visitor is a U.S. citizen or not. For each non-U.S. citizen visiting the NIST campus, the form NIST-1260 must be fully completed and submitted. The information submitted will be used to conduct a routine background check of that individual, which must be completed before they can enter the NIST campus.

VC staff validates information and provides a Visitor Paper Badge and a temporary parking pass to the individual. Temporary visitor passes are issued at the Visitor Center and may not exceed five (5) days in duration. In a consecutive 365-day period, a person may visit a NIST campus a maximum of fourteen times.

Unless approved by the ESO, visitors are only permitted on NIST campuses between the hours of 6 am – 7 pm, Mondays – Fridays (except Federal Holidays). For visitors who entered the NIST campus during non-security hours, but their visit will require them to exit the campus during security hours, the sponsor must contact the Emergency Services Office at 301-975-2660, prior to the start of security hours, to obtain authorization to extend their visit. All visitors exiting NIST sites during security hours must exit via the Main Gate and return their paper visitor badge to security personnel.

Security Hours Entry for Visitors to the Campus

In accordance with current security requirements at federal facilities, visitor access to NIST sites during security hours - 7:00 p.m.—6:00 a.m., Monday-Friday and all-day Saturday and Sunday - is restricted and requires all visitors to be escorted.

All visitors who require access to the NIST campuses during these hours must be specifically authorized by the ESO, prior to their arrival.

• For U.S. citizens, the visitor’s host must submit an email to the ESO (eso.nist.gov) at least 72 hours before the start of the visit. The email must include the name of the visitor, the date and time for the visit, the location(s) where the ktg1 Highlight ktg1 Highlight ktg1 Highlight ktg1 Highlight

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 15 visitor will enter and the name of the person who shall serve as their escort while on campus.

• For non-U.S. Citizens, the OU director must submit an email to the ESO (eso.nist.gov) at least 72 hours before the start of the visit. The email must include the name of the visitor, the date and time for the visit, the location(s) where the visitor will enter and the name of the person who shall serve as their escort while on campus. Only NIST employees may sponsor or host a foreign national visitor.

All sponsors must have completed a yearly Counterintelligence Briefing with NIST OSY. Lawful Permanent Resident (Green Card Holding) visitors must present an alien registration card (green card) upon arrival. Non-Permanent Resident visitors must present a valid passport (original only) upon arrival. All foreign national visitors must be escorted in non-public areas.

If authorized, all visitors shall:

• Proceed to Main Gate entrance and present valid photo identification.

• Sign-in and out of the facility.

• Be escorted at all times by the sponsoring individual who is authorized security hours access to the NIST facility.

• Sponsors must escort authorized visitors when accessing NIST facilities and/or non-public areas during security hours.

ESCORTING

Who Requires an Escort?

While in access-controlled space, all persons who require an escort must remain under the direct or location-controlled (e.g. restroom) observation of an authorized escort.

Who is permitted to serve as an Escort?

• Any federal NIST employee, who has been issued a PIV badge, is authorized to escort (domestic or foreign national) visitors in NIST facilities.

• Any PIV/PIV-I badged NIST associate (except for foreign nationals) is authorized to escort visitors in NIST facilities.

• Any NIST associate (except for foreign nationals) who has been issued a Facility Access Badge, who has completed the mandatory Escort Training and who has been issued an authorized escort badge, are permitted to serve as escorts. (NOTE: Escort Training and Escort Badges are valid for a period of 12 months, after which time both the training and the badge must be renewed.)

• Authorized escorts may relinquish their escort duties to another authorized escort if they are unable to fulfil their duties.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 16

What are the Escort Procedures?

• Visitors who are within public areas and non-access-controlled space (i.e. NIST auditoriums, cafeteria, library, parking lots, visitor centers) do not require an escort.

• Construction personnel and laborers who are working in outside/open air areas that are at least twenty yards from the exterior entrance point of a building, do not require an escort.

• Visitors who are within access-controlled space (i.e. NIST offices, laboratories) must be escorted at a ratio of 1 escort to every 10 visitors.

• Visitors who are working on the exteriors of NIST buildings (i.e. roofs), within underground utility spaces and tunnels, or in restricted access areas under construction must be escorted at a ratio of 1 escort to every 12 visitors.

• Visitors who are inside Buildings 245 and 318 must be escorted at a ratio of 1 escort for every 5 visitors. (NOTE: For Building 235, the number of escorts for tours is at the discretion of the Director of the NIST Center for Neutron Research)

Rules of Conduct for Escorting

• Escorts who observe or suspect suspicious behaviors or activities being carried out by anyone they are assigned to escort are required to immediately report that information to NIST Police Services. Examples of suspicious behaviors and activities may include:

o Attempted entry into unauthorized area;

o Photographing or recording security countermeasures and/or protocols, documents and materials inside NIST’s offices and laboratories;

o Theft, Vandalism, Use of Controlled Substances; or o Failure to stay in the view of the escort official.

• Failure to effectively control uncleared workers will result in immediate loss of escort privileges.

• Any violation of this temporary policy will result in persons being removed from the property immediately.

• Escorts who violate this policy will be suspended from the escort program pending a full review of the incident.

• Persons who are being escorted and who violate this policy could be barred from the site.

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 17

DIRECTIVE OWNER

137 – Emergency Services Office (ESO)

APPENDICES

A. Rules of Behavior for all Card Types (FAC)

B. Revision History

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 18

APPENDIX A

RULES OF BEHAVIOR FOR ALL CARD TYPES (FAC)

• The NIST FAC must be displayed fully to the Police Officer/Security Officer at all access gates and at all times, between the waist and neckline, while on NIST administered sites.

• All visitors/guests must display their Visitor Paper Badge while on the NIST campus and must remain with their NIST sponsor/host/escort at all times. NIST sponsors that do not maintain control of visitors while on site may lose their ability to further sponsor visitors to the site.

• If authorized for “security-hours” access, you must present your badge to a reader while entering or exiting campus and buildings during these hours.

• The NIST FAC should only be utilized to access previously authorized areas. You agree not to attempt to access controlled areas unless properly authorized.

• You may NOT piggyback when entering an access-controlled space, unless escorting visitors/guests or being escorted by an authorized escort.

• You may not share your assigned NIST FAC or associated PIN (for PIV cards) with anyone and must protect each appropriately. Individuals found in violation of this policy may be escorted off site immediately and denied access to NIST-administered sites.

• You must secure your NIST FAC to prevent loss / theft.

• You must use your PIV for logical access at all times in accordance with N 6103.09.

• You must immediately report a lost or stolen NIST FAC to the ESO Badging office (during business hours) or Police Dispatch (after business hours). Once reported you will be required to complete a DN-42 form for submission to the ESO Badging Office for the reissuance of badge.

• The NIST FAC remains property of the Federal government and must be returned when you depart from NIST (i.e., separation, retirement, transfer, termination). It can be turned in to the Badge Office, the Police Services Group Office, or to one of the PSOs at the gate.

https://inet.nist.gov/oism/directives/piv_card_notice

NIST Procedure 2401.01 Ver. 2 (Uncontrolled Copy in Print) Page 19

APPENDIX B

REVISION HISTORY

Revision Date Responsible Person Description of Change Initial Draft

01/05/14 Dan Cipra (M&O) First Draft for access control

Rev. .01 06/20/14 Edward Mai (ESD) Incorporated badging and access control into one procedural document

Rev. .02 10/01/15 Edward Mai (ESD) Incorporated comments from various sources

Rev. .03 02/20/16 Edward Mai (ESD) Updated based upon comments received by the DRB

Rev. .04 03/08/16 Edward Mai (ESD) Updated from additional comments and responses.

Rev. .1.0 8/10/2017 Dan Cipra Updated with new verbiage when arriving at NIST without PIV.

Rev. 1.1 08/21/17 Edward Mai (ESO) Updated to reflect organization change, Site Badge, and Temporary Site Badge updates

Rev. 1.2 07/07/2020 Charles J. Couch

(ESO)

Revised Access Control

Rev. 1.3 8/17/2020 Charles J. Couch

(ESO)

Modified to answer OAC comments.

Rev 1.4 6/16/2025 Richard Kelsey

(ESO)

Updated visitor paper badge day limit

Rev 1.5 9/19/2025 Richard Kelsey

(ESO)

Updated age requirements