II_2 - RFP Attachment J-11 - Contractor Employee On-Boarding Requirements.docx

Contractor Employee On-Boarding Requirements

1.0 Contractor Employee On-Boarding Requirements

1.1 Staff-Like Access Definition and Requirements

Only those contractors/subcontractors who require staff-like access to IRS systems, data, or facilities will follow the outlined process below. Those whose access is infrequent, or will not need staff-like access, and will be 100% escorted while in IRS space, will be managed by the Contracting Officer’s Representative (COR). Escort access is only permitted for infrequent access to IRS facilities and is NOT permitted if subjects require sensitive but unclassified (SBU) data access or systems access.

Contractors/subcontractors are not permitted to have “staff-like access” to IRS facilities, systems, or SBU data until they are determined to be both eligible and suitable to perform work as an IRS contractor by IRS Personnel Security (PS). Each contractor/subcontractor assigned to work under an IRS contract shall undergo investigative processing commensurate with the risk level designation associated with the work to be performed, and comparable to that required for Federal employees who occupy the same positions and who have the same position sensitivity designation.

“Staff-like Access” is authority granted to perform one or more of the following:

· Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

· Possess login credentials to information systems (IRS or Vendor-owned systems that store, collect, and /or process IRS information);

· Possess physical and/or logical access to (including the opportunity to see, read, transcribe, and/or interpret) Sensitive but Unclassified (SBU) data, wherever the location; (See IRM 10.5.1 for examples of SBU data);

· Possess physical access to (including the opportunity to see, read, transcribe, and/or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room, wherever the location. These items include, but are not limited to security devices/records, computer equipment, Identification media. For details and further security requirements, see IRM 1.4.6.5.1, Minimum Protection Standards); or,

· Enter physical areas, wherever the location, that store/process SBU information (unescorted).

Staff-Like Access is granted to an individual who is not an IRS employee (and includes, but is not limited to: contractors/subcontractors, whether procured by IRS or another federal agency, Vendors, delivery persons, experts, consultants, paid/unpaid interns, other federal employees, cleaning/maintenance employees, etc.), and is approved upon required completion of a favorable suitability/fitness determination conducted by IRS Personnel Security.

1.2 Eligibility requirements

Contractors must be eligible for IRS contract employment prior to submitting investigative forms/documentation used to determine their suitability. The vendor must communicate the eligibility requirements to their employees up front and state that only employees who meet the eligibility requirements should apply for IRS contract employment.

1.2.1 Contractor employees shall be federal tax compliant and must remain compliant while working on an IRS contract. Tax compliance will be determined by a check of the contractor employee’s federal tax accounts by trained IRS employees, to ensure that the contractor employees are not currently delinquent on their federal tax obligations.

1.2.2 Contractor employees shall be U.S. citizens or Lawful Permanent Residents (LPR), based on their designated risk level. For foreign-born subjects requiring staff-like access, they shall provide their Alien Registration number, full name, and date of birth.

1.2.3 Male contractors born after December 31, 1959, must be registered with Selective Service. If they are not registered, or are exempt from the requirement, they must provide a Status Information Letter from Selective Service.

1.2.3.1 Selective Service Registration Documentation – all male contractors/subcontractors requiring staff-like access who are born after 12/31/1959 must be registered with Selective Service (SS). Registration can be verified at the SS website at www.sss.gov.

Requirements include:

1. If the subject is properly registered, he must provide an official letter of verification from the SS website to the IRS. Letters can be printed/saved from the SS website upon verification of registration;

1. If the subject is foreign-born, the subject must contact the Selective Service (SS) Office and obtain the following to provide to the IRS:

1. a letter from SS stating the subject was not required to register; or,

1. a letter from SS stating the subject was required to register, but it’s too late. The subject must also provide a written explanation as to why his non-registration was not knowing and willful.

1. If the subject is a US Citizen and was required to register but is not registered, the subject must provide a written explanation as to why his non-registration was not knowing and willful and provide it to the IRS.

1.3 Suitability Screening Requirements

Once deemed eligible, contractors will be screened for suitability or fitness for duty based on their backgrounds. This process begins with timely submission of required investigative forms. The vendor shall assign a Vendor point of contact (POC) to manage this process.

Contractors/subcontractors needing staff-like access are not permitted to begin work on the contract until the required forms and documentation have been completed and properly submitted, to PS (incomplete/inaccurate forms will be rejected by PS); and PS has granted, at a minimum, interim staff-like access approval to the contractor/subcontractor. Only those needing staff-like access are required to submit the forms.

1.3.1 Investigative Forms/Documentation

The COR and vendor will work together to determine risk levels for each unique position type required by the contract as prescribed by PS, prior to or concurrent with submission of investigative forms.

Once the contract is entered into the tracking systems, the IRS will send the assigned Vendor POC an e-mail that will include the current investigative forms for all investigative processes, general guidance for completing documents, and instructions for properly submitting the completed documents. In addition, the Vendor POC e-mail will include instructions for what selective service registration and citizenship documentation is required from each applicant needing staff-like access. The e-mail will include the following forms, due within 10 business days of receipt (if IRS approval is required to confirm the qualifications of proposed contractor personnel, i.e. key personnel, documents must be submitted within 10 business days of receipt of this approval).

1. Risk Assessment Checklist (RAC) (this form provides PS with all required personal information about each contractor employee requiring staff-like access);

2. Master Survey / Position Designation Tool – This questionnaire asks the vendor POC and COR to identify the duties the subjects will be performing for IRS in order to determine risk level for the position. A separate risk assessment must be completed for each position type on the contract (i.e., Systems Administrator, Programmer, Clerk Typist, etc.).

3. Optional Form 306 (OF-306), Declaration for Federal Employment (investigative form used by PS to aid in determining subject’s eligibility and suitability for staff-like access);

4. Non-Disclosure Agreement (all contractors who will have staff-like access to Sensitive But Unclassified (SBU) information are required to complete an agreement);

5. Form 13340, Information Provided Concerning the Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act (FCRA) (provides consent for PS to check subject’s financial history); and,

6. Notice 1379, Tax Check Notice (provides subject with notification of IRS’ intent to check federal tax compliance).

1.3.2 Fingerprinting and e-QIP

Following submission of the required investigative forms, the Vendor POC must ensure the following: All individuals listed on the RAC are fingerprinted within 5 business days after sponsorship in USAccess. If an individual is not able to make an appointment within this timeframe, the vendor will provide documentation to the IRS that an appointment was not available and provide the date of the scheduled appointment. Note to Vendor POC: Sometimes the USAccess email ends up in the contractor employees Spam or Junk Mail and may go unnoticed by the contractor employee. The Vendor POC should remind the contract employee to search their Spam or Junk Mail folders shortly after the RAC is submitted for the USAccess email.

Contractor/subcontractor employees who are invited by PS to complete additional investigative forms in the Electronic Questionnaires for Investigations Processing (e-QIP) system must complete and release the forms in the e-QIP system within 7 calendar days of receipt of invitation.

1.4 Submission Requirements

Submitting a contractor package with missing or incorrect information will delay the on-boarding process. PS will not start the background investigation process until all required documentation is submitted complete and accurate. The Government will reject forms that are incomplete, illegible, inaccurate, and contradict other forms in the package.

The Vendor POC will send all the required forms by their associated due dates via encrypted e-mail or file transfer to the IRS.

2.0 Contractor Employee Training Requirements

Security Awareness Training is a requirement for IRS contractors (including subcontractors) to be completed within 10 business days of receiving approval of interim staff-like access to any IRS contract and annually thereafter. Contractor must complete the required contractor security training; Security Awareness Training (SAT) Form 14616 and UNAX Form 11370.

3.0 Contractor Employee Separation Contract Requirements

Contract employee separation occurs when a contractor employee is deceased, leaves for another contract/task order, the current contract expires, quits his/her job with the vendor company, cycles off IRS contracts within the vendor company, is removed for the good of the government, or is on extended absence due to military duty, pregnancy, illness, etc. The vendor POC is responsible for notifying PS and the COR within one business day of a contractor separating. This notification may be made at any time prior to the actual separation, but no later than one business day of leaving. If the contractor works on multiple contracts/task orders, notification can be combined, and the COR for each affected contract/task order shall be included on the joint notification.

When separating from the contract, the contractor employee is responsible for securing and returning the following to the COR on or before his/her last day of work on the contract, to include but not limited to:

· IRS-issued badge and/or proxy card

· IRS keys

· IRS- issued laptops

· IRS furnished documents

· IRS passports

· Any and all IRS data

· Any other items furnished or identified by the IRS

· Any other items or materials issued by the Agency for the contract

The return of the items is part of the contract and the IRS will not pay for contractor time to return any of the above listed items.

End of Contractor on-boarding requirements language 2 August 27, 2020 Human Capital Office (HCO), Personnel Security