36A77620Q0079-016.pdf

JAMES A. HALEY VETERANS' HOSPITAL HOSPITAL POLICY

TAMPA, FLORIDA 33612 MEMORANDUM NO. 00-05

FEBRUARY 2018

PERSONAL IDENTITY VERIFICATION (PIV)

FOR FEDERAL EMPLOYEES, CONTRACTORS,

VOLUNTEERS AND AFFILIATES

1. PURPOSE: To establish a policy and procedures for issuance of the Personal Identity Verification (PIV) card at this facility. The VA PIV Project is a Departmental initiative intended to provide compliance with HSPD-12, FIPS -201 and related standards which address the Federal Government need for a standardized identity (PIV) credential to be issued to all Federal employees, contractors, volunteers, and Affiliates.

2. POLICY: It is the policy of the James A. Haley Veterans’ Hospital and Clinics (JAHVH) that all employees, contractors, volunteers and affiliates comply to the guidelines and processes of this memorandum.

a. On August 27, 2004, in response to the general threat of unauthorized access to physical facilities and information systems, the President issued Homeland Security Presidential Directive (HSPD-12). The established policies apply to the James A. Haley Veterans’ Affairs Hospital, Outpatient Clinics, the Community-Based Outpatient (CBOCs), and all other facilities owned or leased by the hospital.

b. The primary objectives of HSPD-12 are to establish a process to enhance security, increase Government efficiency, reduce identity fraud, and protect personal privacy by establishing a mandatory Government-wide standard for secure and reliable forms of identification issued by the Federal Government to its employees’ and contractors. In accordance with HSPD-12, the Secretary of Commerce issued on February 25, 2005, Federal Information Processing Standards Publication (FIPS PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors.

c. The VA PIV System automates the enrollment and issuance processes for the PIV credential, manages the identities of PIV cardholders, provides data management and provisioning services for interfacing systems, and provides audit and reporting data on PIV System transactions and events. It provides an integrated approach to the broad, heterogeneous VA network and forwards the concepts embodied in the One-VA strategic goal. The PIV process offers improved security of critical VA assets and extends broad protection for privacy and identity information maintained by the VA.

3. DELEGATION OF AUTHORITY AND RESPONSIBILITY:

a. The Director is responsible for appointing a PIV Card Issuance (PCI) Manager and Alternate for ensuring the effective operation of the PIV System. The Director will also ensure the PIV Department is appropriately staffed to comply with the separation of roles mandated for the verification and issuance of the PIV credential.

b. The PIV Card Issuance Manager is responsible for overseeing the day-to-day operations of the PIV issuance process at a facility and for ensuring the facility is within compliance of FIPS 201, and has met all privacy requirements and program guidelines.

The PCI Manager will be responsible for appointing all PIV administrative roles, within the PIV program.

c. Service Chiefs are responsible for appointing trusted officials as sponsors and for ensuring training and certification requirements are met. Service Chiefs will also ensure compliance of the PIV Privacy Policy.

d. Employees, Contractors, Volunteers & Affiliates are responsible for complying with the PIV Applicant training & certification requirements and for safeguarding the badge at all times and for reporting lost or stolen badges immediately to Police Service. All personnel issued a PIV card are also responsible for turning in their PIV card, Non-PIV card or Flash Badge to the VA Police upon leaving VA employment. VA employees transferring to another VA will retain their PIV card.

4. DEFINITIONS:

a. Facility PIV Card Issuer (PCI) Manager: PCI Managers are responsible for the entire PIV Card issuance process.

b. Applicant: A PIV Card Applicant is an employee, contractor, volunteer, or affiliate who needs access to VA facilities and/or Network computer systems.

c. Sponsor: PIV Sponsors are government employees designated by their Service chief as a trusted official then trained and certified by the Alternate PIC Manager. As Sponsor they are in the best position to verify that an Applicant has a bona fide need for a PIV Card. Sponsors initiate the card request process and enter applicants in to the PIV Enrollment Portal.

d. Registrar: PIV Registrars perform the “Biometrics Capture” phase of the PIV process by taking a picture and then obtaining fingerprints from the applicant, documenting the applicant's information in the Card Management System from two matching IDs, and verifying the applicant’s background investigation has either been adjudicated or submitted for all applicants requiring a PIV card.

e. Issuer: PIV Issuers print, inspect, and post issue the cards. At the end of the post issuance phase, the applicant will assign a 6-digit pin to the card. The pin number is current for the life of the PIV card.

f. Facility PIV Card Applicant Representative: PIV Card Applicant Representatives are individuals who act on behalf of the Applicant when PIV Card Issuance has been denied for any reason.

g. Facility Privacy Official: PIV Privacy Officials ensure that all privacy regulations are followed throughout the PIV Card Issuance process.

5. PROCEDURES:

a. GENERAL OBJECTIVES: The PIV System is to achieve compliance with HSPD- 12 and FIPS 201. Within the context of this goal, the system intends to provide:

(1) Personal Identity Verification (PIV) based on secure and reliable forms of identification credentials. PIV Credentials issued to support VA employees, contractors, volunteers, and affiliates who require physical access and/or logical access to VA controlled information systems and/or facilities.

(2) Issuance of PIV Credentials based on validation of an individual’s true identity and validation of the organizational affiliation.

(3) PIV credential holder Identity Management.

(4) Access Management and security policy enforcement surrounding the PIV processes.

(5) PIV Credential enrollment, registration, issuance, and lifecycle management automation.

b. APPLICANT:

(1) PIV applicant must have either an initiated or completed background investigation on file with HR.

(2) Must complete the “PIV Applicant” training located on the facility’s home page and provide the Service sponsor with a certificate of completion.

(3) Provide the service sponsor with all the required information to complete the “Applicant” section of the VA Form 0711.

(4) Provide two forms of identification with matching names (VA ID and one with photo, i.e., driver’s license, passport, military identification, Voter’s Registration Card, State Identification). Other acceptable forms of ID are found in Section 2.2 of FIPS 201- 1.

(5) Employees who separate from VA employment, for any reason, must turn-in the PIV card to the VA Police Service ID Section prior to departing the VA as part of the employee clearance process.

c. SPONSOR:

(1) Sponsors must complete the “TAM Sponsor” training located on the facility’s home page, and provide the Alternate PCI Manager with a certificate of completion.

(2) Verify that the applicant has a bona fide need to be issued a PIV Card.

(3) Verify the type of background check required for the position.

(4) Verify through Human Resources Management Service, Personnel Security Office that a background check has been completed on the employee. If no evidence of a background check exists, an FBI fingerprint check must be completed and the appropriate investigation be scheduled with OPM prior to the issuance of a PIV credential.

(5) Ensure the PIV applicant has two acceptable forms of ID in accordance with Section 2.2 of FIPS 201-1.

(6) Complete and sign the PIV Sponsor’s portion of the electronic VA Form 0711. The signature confers that the Sponsor has validated the PIV Applicant’s need for the PIV Card, and the appropriate background has been initiated or completed on file with Human Resources and the Applicant’s information on the VA Form 0711 is correct.

(7) Keep the applicant informed of the status of their PIV Card application.

d. REGISTRAR:

(1) The Registrar will confirm the authenticity of the VA Form 0711 received from the PIV Sponsor.

(2) Validate the identity and certification status of the PIV Sponsor who signed the VA Form 0711.

(3) Confirm PIV Applicant’s identification by confirming authenticity of PIV Applicant’s identification documents and that the documents match the Applicant.

(4) Capture the Applicant’s fingerprints and facial image.

(5) Verify the Applicant’s security clearance.

(6) Complete the Registrar’s Section of the VA Form 0711.

(7) Digitally sign the VA Form 0711 and wait for the “Task Complete” to appear on the screen.

e. ISSUER:

(1) Coordinate with Service Sponsors to ensure all service personnel have been entered into the PIV portal correctly.

(2) Provide PIV Sponsor training to Service Sponsors to ensure the proper data has been entered into the PIV portal.

(3) Confirm the authenticity of the electronic VA Form 0711 submitted by the sponsor with special attention given to the Applicant’s Outlook e-mail address and type of card.

(4) Personalize and print the PIV card.

(5) Post-Issue the card. During the post-issuance process, verify the identity of the PIV Applicant and obtain biometrics (fingerprints). If a qualifying fingerprint could not be obtained, the Applicant’s photo will be used for identification.

(6) Explain to the PIV Applicant how to logon utilizing the PIV Card and what to do in the event the PIV Card is lost or the PIN number is forgotten.

(7) Have the Applicant verify all the data on the PIV card is correct then have the Applicant read and digitally sign the Privacy Act Statement.

(8) Have the Applicant assign a six-digit pin to the PIV card. Explain that the PIN is good for three years, the life of the PIV card.

f. PIV CARD APPLICANT REPRESENTATIVE:

(1) Be an advocate for the PIV Applicant. For example, if an employee was denied a PIV card because of an unfavorable background investigation, the PIV Card Applicant Representative would inform the Applicant of their rights and course of action to resolve the concern.

(2) Represent the privacy concerns of the PIV Applicant to PIV officials.

(3) Assist PIV Applicants denied a PIV card due to identity document issues. For example, if a Registrar were unfamiliar with a document presented by an Applicant, the PIV Card Applicant Representative could assist the Applicant and Registrar (likely with the help of the PCI Manager) to determine if the document is acceptable.

g. FACILITY PRIVACY OFFICIAL:

(1) Ensure all PIV privacy and audit requirements are complied with.

(2) Provide oversight of the Facility Privacy Impact Assessment (PIA) and any remediation activities.

(3) Assist Facility PIV Officials in adhering to privacy controls throughout the life of the FIPS 201-1 implementation.

h. LOST PIV CARD: A lost, stolen, destroyed, or misplaced PIV card must be reported by the employee to their supervisor. Employees must contact the VA Police at extension 7554, to report the missing card. The VA Police will generate an Investigative Report (IR) which will include the card’s serial number and the date and time the card’s certificates were terminated in the PIV system by the PIV Issuer. The representative of the PIV office will report the lost, stolen, destroyed, or misplaced PIV card to the Information Security Officer. The PIV office will revoke the lost card’s certificates and the service’s sponsor will begin the process in the PIV Portal for PIV card replacement.

i. CLEARING STATION: All PIV badges are controlled items and will be turned in at the police ID Section, Building 42, room 119 upon termination, resignation, or separation of employment or completion of appointment.

j. TRAINING:

(1) The Alternate PCI Manager will ensure training of all staff regarding policies and procedures for the PIV System through ongoing education or one-on-one instruction.

(2) Police Service will provide PIV training to new employees/applicants at New Employee Orientations.

6. REFERENCES: Presidential Directive HSPD-12 (current edition), Federal Information Processing Standards Publication (FIPS PUB) 201(current edition).

7. FOLLOW-UP RESPONSIBILITY: The Chief, Police Service (132) is responsible for updating this hospital policy memorandum.

8. RESCISSIONS: Hospital Policy Memorandum No. 00-05, dated, June 2012.

//s// Joe D. Battle Director

DISTRIBUTION: Electronic Distribution to All Employees