Attachment 5 - Treasury Security Manual (TD P 15-71, Chapter II, Section 2), Updated 28Jul2011).pdf

Chapter II Investigative Requirements for Federal Updated Section 2 Employees, Contractors, Subcontractors, 7/28/11

Experts, Consultants and Paid/Unpaid Interns

1. Introduction

The purpose of this section is to describe investigative requirements for Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns, who require staff-like access, wherever the location, to (1) Treasury/bureau-owned or controlled facilities; or (2) work on contracts that involve the design, operation, repair or maintenance of information systems; and/or (3) require access to sensitive but unclassified information.

Investigative requirements described herein also apply to personnel employed by United States boards/commissions/committees, regulatory corporations/boards/enterprises, federally funded research and development centers and federally chartered entities, for example: Smithsonian Institution, Federal Reserve, Legal Services Corporation, State Justice Institute, and United States Institute of Peace.

This section does not prescribe policy with respect to issuance of security clearances for access to classified National Security information under the National Industrial Security Program (NISP). See Chapter IV.

2. Scope

The provisions in this section apply to all bureaus, the Office of Inspector General (OIG), the Office of Treasury Inspector General for Tax Administration (TIGTA), and the Office of the Special Inspector General for the Troubled Asset Relief Program (SIGTARP) hereafter referred to as “bureaus.” This section does not affect authorities reserved to the Assistant Secretary (Office of Intelligence and Analysis).

3. Requirements

a. The Contracting Officer’s Technical Representative (COTR), in conjunction with the appropriate Departmental Offices (DO)/bureau management and the corresponding personnel security officer will review the work to be performed under contract and assign the highest risk designation to the entire contract in accordance with the criteria in Chapter I, Section 2, Position Sensitivity and Risk Designation. Each Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern will undergo investigative processing based on the works risk level designation.

Attachment 5

b. The level to which such contractors, subcontractors, experts, consultants, and paid/unpaid interns are investigated shall be comparable to that required for Federal employees who occupy the same positions and who have the same position sensitivity designation. This includes contractors, subcontractors, experts, consultants, and paid/unpaid interns who have access to information or passwords associated with DO/bureau IT systems, designated sensitive positions, including off-worksite access.

c. All Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns are subject to a background investigation to determine their suitability and fitness for DO/bureau work and the investigation must be favorably adjudicated. Investigation of contractors, subcontractors, experts, consultants, and paid/unpaid interns will be conducted by employees of any of the following:

(1) The hiring DO/bureau.

(2) Another Federal agency.

(3) A contracting firm knowledgeable of the background investigations program that has been selected by the hiring DO/bureau, in consultation with the Office of Security Programs (OSP).

(4) An agency/company delegated by the individual DO/bureau Security

Officer.

DO/bureau personnel security officers, in consultation with the COTR, Computer Security Officer, or appropriate DO/bureau official are to weigh potential risks and the magnitude of loss or harm that could be caused by individual Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns and determine risk levels for the DO/bureau facilities, information systems, and sensitive but unclassified information. Each DO/bureau has the final authority to designate the minimum requirements for their respective Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns background investigations.

d. DO/bureaus shall establish procedures to ensure information contained in the forms submitted by Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns for background investigations is treated in a confidential manner. It is the Department’s policy that such information should only be available for review by employees of the DO/bureau security office.

e. Responsibility for adjudication of the background investigations shall remain with the DO/bureau personnel security officer or delegated authority. This applies to, but is not necessarily limited to end-product vendors but all Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns.

Individuals hired as Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns shall be subject to the same requirements as DO/bureau employees for the purpose of determining position sensitivity/risk and investigative requirements and shall not be processed through the NISP.

f. DO/bureaus shall establish and maintain a personnel security file for each individual Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern in (1) all national security positions; (2) all moderate and high risk public trust positions; and (3) those low risk or non-sensitive positions on whom unfavorable or derogatory information has been developed or received unless the file is maintained by the Office of Personnel Management (OPM).

DO/bureaus need not maintain a file on a Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern granted access to classified information under the NISP, unless there is a requirement (1) for additional investigation in connection with access to DO/bureau facilities or IT systems; or (2) for access to classified information not covered under the NISP.

With regard to favorable investigations on Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns in low or moderate risk positions, DO/bureaus may, at their discretion, retain either the entire report or pertinent investigative data only. The specific location of personnel security files shall be at DO/bureau discretion with the following exception: all national security files shall be maintained by the DO/bureau security officer.

g. DO/bureau building service Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns whose duration of employment exceeds 30 days shall undergo, at a minimum, limited criminal history background checks as a condition for U.S. Government work. Such checks shall be based upon a technical search of the fingerprint files maintained by the FBI.

h. Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns who are screened for DO/bureau work shall not be considered to have been granted security clearance for access to classified information on the basis of the successful completion of any required investigation under this section.

i. Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns requiring access to DO/bureau facilities in foreign countries who have been certified by the Department of State Diplomatic Security Service as meeting investigative and adjudicative criteria for access to facilities under the authority of a Chief of Mission shall be deemed to meet personnel security standards.

4. Honoring Security Clearances

DO/bureau personnel security officers shall honor a Federal employee’s, contractor’s, subcontractor’s, expert’s, consultant’s, and paid/unpaid intern’s valid security clearance for access to classified information issued by other United States Government agencies or departments, provided the investigative basis for the clearance is current and meets investigative requirements. Additional investigation may be necessary if the investigation upon which the Federal employee’s, contractor’s, subcontractor’s, expert’s, consultant’s, and paid/unpaid intern’s security clearance was based is not sufficient for that needed for access to DO/bureau facilities, IT systems, and/or sensitive information.

5. Citizenship Requirements

a. Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to DO/bureau-owned or controlled facilities, IT systems or security items or products, shall either be U.S. citizens or have lawful permanent resident alien status (green card holders).

b. DO/bureaus shall adhere to the following standard when allowing Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns access to DO/bureau-owned or -controlled facilities, IT systems, or security items or products.

(1) Low Risk = U.S. Citizen or lawful Permanent Resident Alien.

(2) Moderate Risk = U.S. Citizen or lawful Permanent Resident Alien with at least three or more years of U.S. residency from the date of legal entry to the U.S.

(3) High Risk = U.S. Citizen.

c. Only under exceptional circumstances should a waiver be requested when a

Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern does not meet the citizenship or lawful permanent resident alien status requirement. Requests for waivers to the citizenship requirement must be submitted in writing. Foreign nationals employed as Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns shall not be allowed access to DO/bureau-owned or controlled facilities, IT systems, or security items or products prior to the issuance of a waiver.

d. Waivers for noncitizens performing in low-risk/non-sensitive positions may be requested in writing by COTRs through the DO/bureau security officer to the Director, OSP for determination.

e. Waivers for noncitizens performing in moderate-risk positions shall be requested in writing by the COTR, through a senior executive-level (SES) manager in the business unit that has the contract or through the DO/bureau head, to the Director, OSP for determination.

f. Waivers for access to high-risk positions will not be considered for foreign nationals.

g. Waivers for foreign nationals working in IT positions involving the development of DO/bureau hardware or software products will not be considered if the position involves the design of security models, application integration, customization of software or hardware, or configuration of servers or networks. Waivers will not be allowed if the position has the ability to manipulate, or alter or affect the integrity; accessibility or availability of IT maintained information or records.

h. All waivers involving IT systems must also be routed though Treasury’s Chief

Information Officer for review prior to approval by the Director, OSP and final determination.

i. All waiver requests must include the following:

(1) The full name, date of birth, place of birth, and current citizenship of the applicant.

(2) A completed SF 85, SF 85P, or SF 86.

(3) A completed background investigation.

(4) A description of the job/duty to be performed.

(5) Justification why there is no qualifying U.S. citizen or lawful permanent resident alien available or capable of performing the task.

(6) A business case necessitating the waiver.

(7) An assessment of the risk associated with granting the waiver.

(8) All security countermeasures and actions taken to mitigate the risks associated with the requested waiver.

6. Solicitations and Contracts

Solicitations and contracts shall include an appropriate caveat that contractor, subcontractor, expert, consultant, and paid/unpaid intern screening is required for access to DO/bureau facilities, IT systems, security items and products, and/or sensitive information. The caveat shall require the successful contractor, subcontractor, expert, consultant, and paid/unpaid intern to execute appropriate security forms prescribed by the DO/bureau personnel security component (1) prior to work being performed; and (2) in advance of being granted access to DO/bureau facilities, IT systems, and/or sensitive information.

7. Adverse Information and Revocation of Access

a. When adverse information is developed in the course of an investigation, the scope of the inquiry will normally be expanded to the extent necessary to obtain such additional information as may be required to determine whether the Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern may be employed and granted access to DO/bureau facilities, IT systems, security items and products, and/or sensitive information.

b. A Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern on whom unfavorable or derogatory information has been developed during a personnel investigation must be so advised and offered an opportunity to refute, explain, clarify, or mitigate the information in question.

The individual should also be advised that neither the nature of the information or the results of the interview, if he/she is denied employability on the U.S.

Government-funded contract, will be conveyed by the DO/bureau to the employing company or any representative of the firm. However, if after final adjudication, a determination is made of ineligibility to render services and access to DO/bureau facilities is denied, the person will be formally notified and informed of the decision and the reason(s).

c. When denial of Federal employee staff-like access is appropriate, the contractor, subcontractor, expert, consultant, and paid/unpaid intern shall be informed, simultaneously with notification to the employing company that the individual is denied access for reasonable cause. The company shall be notified that the finding makes the individual ineligible to render services or otherwise perform work. The government may not disclose any details of the adverse information to the employing firm. This decision of the U.S. Government does not intend to imply that the contractor’s, subcontractor’s, expert’s, consultant’s, and paid/unpaid intern’s suitability for employment elsewhere in the company is affected.

d. Access to DO/bureau facilities, IT systems, security items and products, and sensitive information is a privilege. It may be revoked by the affected DO/bureau based upon unsanctioned, negligent or willful action on the part of a Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern.

Examples of actions that can trigger revocation include, but are not limited to, exploration of a sensitive system and/or data, introduction of unauthorized and/or malicious software, unauthorized modification or disclosure of IT systems and/or data, or failure to follow prescribed access control policies or procedures.

8. Nondisclosure Agreement for Sensitive Information

a. DO/bureau personnel security officers, in consultation with DO/bureau IT systems security officers, contracting officers, and COTRs, shall determine whether sensitive information to which Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns require access, warrants execution of a nondisclosure agreement as a condition thereof. When determined to be necessary following review and approval of DO/bureau legal counsel, each non-disclosure agreement will reference to the conditional nature of access to sensitive information with respect to the work, or specialized project, for which such access is required.

b. A sample nondisclosure agreement is shown in Attachment 1.

(1) DO/bureaus may draft and execute their own agreements; however, the use of a nondisclosure agreement other than Attachment 1 requires review and approval by appropriate DO/bureau legal counsel and the Director, OSP prior to use.

(2) If Attachment 1 is used the DO/bureau may only modify it by insertion of specific language in blank or parenthetical spaces relative to the contract, contracting DO/bureau or project. Other modifications require appropriate DO/bureau legal counsel and Director, OSP approval.

c. The original signed non-disclosure agreement shall be retained in the DO/bureau personnel security file for minimum of five years and for at least as long as the Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern has access to the facility, IT system or security items or products for which they executed the agreement. The DO/bureau has the discretion to maintain the agreement for as long as the information is deemed sensitive. A copy may be maintained in the official contract file. If requested, a copy may be furnished to the individual signatory.

d. DO/bureaus shall consult with legal counsel to determine whether annual appropriations acts, in effect at the time an agreement is executed, contain provisions requiring the inclusion of specific text in nondisclosure agreements.

Attachment 1

(Project or Contract Name/Number) Conditional Access to Sensitive Information

Non-disclosure Agreement

I, ______________, hereby consent to the terms in this Agreement in consideration of my being granted conditional access to certain United States Government documents or material containing sensitive information.

I understand and agree to the following terms and conditions:

1. By being granted conditional access to sensitive information, the United States Government has placed special confidence and trust in me and I am obligated to protect this information from unauthorized disclosure, in accordance with the terms of this Agreement.

2. As used in the Agreement, sensitive information is any information the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Title 5 U.S.C. 522a, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

3. I am being granted conditional access contingent upon my execution of this Agreement for the sole purpose of (identify the nature of contract work or special project). This approval will permit me conditional access to certain information, (identify type(s) of information, e.g., documents, memoranda, reports, testimony, deliberations, maps, drawings, schematics, plans, assessments, etc.) and/or to attend meetings in which such information is discussed or otherwise made available to me.

4. I will never divulge any sensitive information that is provided to me pursuant to this Agreement to anyone unless I have been advised in writing by (identify the bureau or in the case of bureau sensitive information released to the Office of Inspector General (OIG) or Treasury Inspector General for Tax Administration (TIGTA), or the Special Inspector General for the Troubled Asset Relief Program (SIGTARP) in accordance with a written arrangement related to the official audit/investigative functions of the OIG or TIGTA or SIGTARP for that particular matter). Should I desire to make use of any sensitive information, I will do so in accordance with paragraph 6 of this Agreement. I will submit to the (identify DO/bureau) for security review, prior to any submissions for publication, any book, article, column or other written work for general publication that is based upon any knowledge I obtained during the course of my work on (name the project) to ensure that no (identify DO/bureau) sensitive information is disclosed.

5. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may result from any disclosure, publication, or revelation of sensitive information not consistent with the terms of this Agreement.

6. Upon signing this non-disclosure agreement, I will be permitted access to official (identify DO/bureau) documents containing sensitive information and understand that any copies must be protected in the same manner as the originals. Any notes taken during the course of such access must also be protected in the same manner as the originals.

7. If I violate the terms and conditions of this Agreement, I understand that the unauthorized disclosure of sensitive information could compromise (identify DO/bureau) security.

8. If I violate the terms and conditions of this Agreement, such violation may result in the cancellation of my conditional access to sensitive information. This may serve as a basis for my being denied conditional access to the (identify DO/bureau information, both classified and sensitive information in the future. If I violate the terms and conditions of this Agreement, the United States may institute a civil action for damages or any other appropriate relief. The willful disclosure of information to which I have agreed herein not to divulge may constitute a criminal offence.

9. Unless and until I am provided a written release by the (identify DO/bureau) from this Agreement or any portions of it, all conditions and obligations contained in this Agreement apply both during my period of conditional access, which shall terminate at the conclusion of my work on (name of project/contract), and at all times thereafter.

10. Each provision of this Agreement is severable. If a court should find any provisions of this Agreement unenforceable, all other provisions shall remain in full force and effect.

11. I understand that the United States Government may seek any remedy available to it to enforce this Agreement, including, but not limited to, application for a court order prohibiting disclosure of information in breach of this Agreement.

12. By granting me conditional access to information in this context, the United States Government does not waive any statutory or common law evidentiary privileges or protections that it may assert in any administrative or court proceeding to protect any sensitive information to which I have been given conditional access under the terms of this Agreement.

13. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or liabilities created by Executive Order 13526 or 13556; Section 7211 of Title 5, United States Code (governing disclosures to Congress);

Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 421 et seq.)(governing disclosures that could expose confidential Government agents), and the statutes that protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 128, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50

USC Section 783 (b)). The definitions, requirements, obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement and are controlling.

14. My execution of this Agreement shall not nullify or effect in any manner any other secrecy or nondisclosure Agreement which I have executed or may execute with the United States Government except within the Department of the Treasury as noted in item 8, above.

15. I make this Agreement in good faith, without mental reservation or purpose of evasion.

Name Date

Signature

This Agreement was accepted by the undersigned on behalf of the (Treasury Department or identify bureau) as a prior condition on conditional access to sensitive information. Further release to any other third party requires execution of a nondisclosure agreement.

When information is shared with the Office of Inspector General or the Treasury Inspector General for Tax Administration or the Special Inspector General for TARP, for official audit/investigative purposes, the following statement must be added below the signature line.

“This Agreement was accepted by the undersigned on behalf of the (identify bureau and (the Office of Inspector General or Treasury Inspector General for Tax Administration, Special Inspector General for TARP, as applicable) for conditional access to sensitive information.

Further release and dissemination of (identify DO/bureau) sensitive information under this non-disclosure agreement must be in accordance with a written arrangement related to the official audit/investigative functions of the OIG or TIGTA or SIGTARP for that particular matter.

Further release to any other third party requires execution of a nondisclosure agreement.”

(IdentifyDO/bureau signatory Date

(OIG or TIGTA or SIGTARP signatory) Date

4. Honoring Security Clearances