II_2 - RFP Attachment J-12 - Contractor Onboarding Job Aid for Post-Award Orientation Meeting.docx

Contractor Onboarding Job Aid for Post-Award Orientation Meeting

Purpose and Use

This document is an optional job aid intended to assist the Contracting Officer’s Representative (COR) when participating in the post-award orientation meeting led by the Contracting Officer (CO). It provides a summary of requirements and actions with which vendors must comply for contractor/subcontractor employees requiring staff-like access to facilitate the contractor onboarding process. The contract should be reviewed to determine what information below is applicable per the terms of the contract. The CO and COR should coordinate to schedule and conduct one joint post-award orientation meeting. The Contractor Onboarding Checklist for Vendors located below may be provided to the vendor point of contact (POC) at the meeting.

Contractor/subcontractor employees who require staff-like access are NOT permitted to begin work on the contract until they receive, at a minimum, an interim staff-like access approval from IRS Personnel Security (PS) (See Note).

Table of Contents

I. Paperwork Completeness and Accuracy II. Contractor Eligibility

1. U.S. Citizenship and/or Lawful Permanent Resident Status

2. Selective Service Registration

3. Federal Tax Compliance III. Timeliness IV. Investigative Forms, Fingerprinting, and e-QIP

1. OPM Position Designation Tool

2. Investigative Forms

3. Fingerprinting

4. Electronic Questionnaires for Investigations Processing (e-QIP) V. Contractor Training Requirements VI. Security Badges VII. Contractor Separation

Contractor Onboarding Requirements

I. Paperwork Completeness and Accuracy

1. The IRS will provide the vendor POC with the Risk Assessment Checklist (RAC), along with other required investigative forms (details in section V below).

2. All forms must contain the full legal name that matches the applicant's identification (e.g. state issued id, passport, etc.)

3. Vendors should ensure fields requiring social security numbers and phone numbers have the correct number of digits.

4. The IRS will reject forms that are incomplete, illegible, inaccurate, and contradict other forms in the package.

II. Contractor Eligibility All contractor/subcontractor employees submitted for staff-like access approval must be eligible for IRS contract employment to the best of the vendor’s knowledge. In order to be approved for interim staff-like access, IRS will confirm that contractor/subcontractor employees first meet the following initial eligibility requirements:

1. U.S. Citizenship or Lawful Permanent Resident (LPR) status: Subjects must be US citizens or LPRs (dependent on position risk level) to be eligible for staff-like access.

a. No documentation is required as proof of U.S. citizenship for subjects born in the United States.

b. If subjects are foreign-born, vendor POC MUST provide the subjects’ Alien Registration or “A” Number for verification of their status.

2. Selective Service Registration (for males born after 12/31/59): Vendor POC MUST provide the following documentation to the IRS:

a. Registered applicants: Official letters of verification can be obtained and saved via the Selective Service website at https://www.sss.gov/Registration/Proof-of-Registration.

b. Non-registered applicants:

i. If the subject is foreign-born, vendors must provide a letter from the Selective Service stating the subject was not required to register or that the subject was required to register but it is too late.

ii. For US citizens or foreign-born subjects who were required to register but did not, the vendor must provide a written explanation as to why the non-registration was not knowing or willful.

3. Federal Tax Compliance: Subjects must be tax compliant and must remain compliant while actively working on IRS contracts.

a. IRS will check tax compliance – no documentation is required from the vendor POC.

b. Vendors are responsible for informing their applicants of this requirement.

III. Timeliness

1. Delays in any of the actions stated below will result in contractor/subcontractor employee onboarding delays and starting work on the contract.

2. All investigative forms and documentation are due to the IRS within 10 business days of receipt. If IRS approval is required to confirm the qualifications of proposed contractor personnel, i.e. key personnel, documents must be submitted within 10 days of receipt of this approval.

3. All individuals listed on the RAC should be fingerprinted within 5 business days after IRS sponsorship in USAccess. If an individual is not able to make an appointment within this timeframe, the vendor POC will provide documentation that an appointment was not available and provide the date of the scheduled appointment.

4. The contractor/subcontractor employee must accurately complete the e-QIP application, if applicable, within 7 calendar days of receipt of the invitation. Failure to complete e-QIP will result in not being permitted to work on the contract.

IV. Investigative Forms/Documentation, Fingerprinting, and e-QIP

1. Master Survey / Position Designation Tool: Following this meeting, the COR will work with the Vendor POC to complete this questionnaire for each unique position type on the contract. This questionnaire asks the vendor POC and COR to identify the duties the subjects will be performing for IRS in order to determine risk level for the position. A separate risk assessment must be completed for each position type on the contract (i.e., Systems Administrator, Programmer, Clerk Typist, etc.). The results must be saved and sent to IRS PS.

2. Investigative Forms/Documentation: The IRS will provide the vendor POC with the following investigative forms for completion by each applicant requiring staff-like access:

a. Risk Assessment Checklist (RAC): The RAC is a summary Excel spreadsheet that captures information related to all of the subjects for whom the vendor is requesting staff-like access. The vendor POC must ensure that EVERY column in the RAC is completed accurately prior to submitting to the IRS. Failure to do so will result in a rejection of the RAC and a delay in the onboarding process.

b. OF-306, Declaration for Federal Employment: Form must be completed and signed by each contractor/subcontractor employee requiring staff-like access.

c. Non-Disclosure Agreement (NDA): Form must be completed and signed by each contractor/subcontractor employee requiring access to sensitive but unclassified (SBU) data.

d. Form 13340, Information Provided Concerning the Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act (FCRA): Form must be completed and signed by each contractor/subcontractor employee requiring staff-like access.

e. Notice 1379, Tax Check Notice: Provide to subjects to inform them of IRS’ intent to check their federal tax compliance at onboarding and annually thereafter while continuing to actively work on IRS contracts.

3. Fingerprinting: IRS will enroll each subject in USAccess based on the information provided on the RAC. The USAccess system will send an email invitation to schedule a fingerprinting appointment. Individuals should be fingerprinted within 5 business days of receipt of the sponsorship email. Note that the USAccess email may sometimes be marked as SPAM. Subjects are asked to check their SPAM folders for the email.

4. Electronic Questionnaires for Investigations Processing (e-QIP): If contractor/subcontractor employees do not have a current federal background investigation already completed and favorably adjudicated at the appropriate risk level, they will receive an email with a link to complete the e-QIP form online. The email will contain instructions for accessing the system, and guidance to assist if issues are encountered. Contractors and subcontractor personnel must complete e-QIP within 7 calendar days of receipt of the email.

V. Contractor Training Requirements

1. Contractor/subcontractor employees must complete Security Awareness Training (SAT) within 10 business days of receiving approval of interim staff-like access.

2. Contractor/subcontractor employees must certify completion using the Form 14616, Contractor SAT Certification, and the Form 11370, Certification of Annual UNAX Awareness Briefing and provide these forms to the COR.

VI. Security Badges

1. Contractor/subcontractor employees must accurately complete Form 13716A, Request for ID Media/Access Card for Contract Employee, and submit as a PDF document (no photocopies or pictures).

2. Contractor/subcontractor employees are responsible for:

a. Safeguarding their ID/access card.

b. Wearing ID cards/security badges at or above the waist with photo facing out in an approved cover with no obstructions to the card.

c. Reporting lost/stolen cards immediately to their COR, the local Facilities Management & Security Services (FMSS) physical security office, the Situational Awareness Management Center (SAMC), Treasury Inspector General for Tax Administration (TIGTA), and completing Form 4589, Lost or Forgotten ID Card Record.

VII. Contractor Separation

1. The vendor POC is responsible for notifying the COR no later than one business day of a contractor/subcontractor employee separating (notification may also occur prior to separation).

2. If the contractor/subcontractor employee works more than one contract or task order, notification to multiple CORs may be combined.

3. The contractor/subcontractor employee is responsible for returning the following to the COR on or before their last day of work on the contract. Note that laptops and equipment are assigned to the individual, not the vendor and therefore must be returned upon separation:

a. IRS-issued badge and/or proxy card

b. IRS keys

c. IRS- issued laptop

d. IRS furnished documents

e. IRS passports

f. Any and all IRS data

g. Any other items furnished or identified by the IRS

h. Any other items or materials issued by the Agency for the contract

Note:

IRM 10.23.2: “Staff-like Access” is authority granted to perform one or more of the following:

· Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

· Possess login credentials to information systems (IRS or vendor-owned systems that store, collect, and /or process IRS information);

· Possess physical and/or logical access to (including the opportunity to see, read, transcribe, and/or interpret) Sensitive but Unclassified (SBU) data, wherever the location (See IRM 10.5.1 for examples of SBU data);

· Possess physical access to (including the opportunity to see, read, transcribe, and/or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room, wherever the location). These items include, but are not limited to, security devices/records, computer equipment, Identification media. For details and further security requirements, see IRM 1.4.6.5.1, Minimum Protection Standards); or,

· Enter physical areas, wherever the location, that store/process SBU information (unescorted).

Staff-Like Access is granted to an individual who is not an IRS employee (and includes, but is not limited to: contractor/subcontractor employees, whether procured by IRS or another federal agency, vendors, delivery persons, experts, consultants, paid/unpaid interns, other federal employees, cleaning/maintenance employees, etc.), and is approved upon required completion of a favorable suitability/fitness determination conducted by IRS Personnel Security.

Contract clause IR1052.204-9000 Submission of Security Forms and Related Materials (Jun 2020) requires contractor/subcontractor employees needing staff-like access to IRS equities to be investigated by IRS Personnel Security (PS).

Appendix: Contractor Onboarding Checklist For Vendors

☐ Completed Office of Personnel Management (OPM) Position Designation Tool for each unique position type and pdf file showing result.

☐ Completed and submitted Risk Assessment Checklist (RAC).

☐ Provided Alien Registration Number on the RAC for all foreign-born applicants.

☐ Provided proof of Selective Service registration for all male applicants born after 12/31/1959.

☐ Completed OF-306, Declaration for Federal Employment for each applicant requiring staff-like access.

☐ Completed Non-Disclosure Agreement (NDA) for each applicant requiring access to SBU data.

☐ Completed Form 13340, Information Provided Concerning the Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act (FCRA) for each applicant requiring staff-like access.

☐ Provided Notice 1379, Tax Check Notice to all applicants.

☐ Ensured all applicants completed fingerprinting within 5 business days of USAccess sponsorship.

☐ Ensured all applicants completed Electronic Questionnaires for Investigations Processing (e-QIP) within 7 calendar days of receipt of the invitation email.

2 January 21, 2021 Human Capital Office (HCO), Personnel Security