Appendix A_1 HSPD12_Handbook_v8.pdf

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

CIO P 2181.1

October 20, 2008

GSA ORDER

SUBJECT: Homeland Security Presidential Directive-12 Personal Identity Verification and Credentialing

1. Purpose. This order issues and transmits the GSA HSPD-12 Personal Identity Verification and Credentialing Handbook.

2. Agency Goal. GSA’s goal is to implement the requirements of HSPD-12.

3. Cancellation. CIO IL-07-02 (Homeland Security Presidential Directive (HSPD) -12, Personal Identity Verification and Credentialing) and ADM 7640.2 (Credentials and Passes) are cancelled.

4. Applicability. This handbook provides policies and procedures for issuing and maintaining GSA credentials.

5. Forms - This handbook provides for the use of the following:

a. CIW – Contractor Information Worksheet.

b. DHS 176T – Statement of Personal History for Contract and Childcare Personnel.

c. FD-258 – Fingerprint Card (Used for GSA Contractors).

d. GSA 1380 – National Security Position.

e. GSA 3648 – Public Trust Position.

f. GSA 3687 – HSPD-12 Personal Identity Verification and Credentialing Handbook Revision Request.

g. OF-306 – Declaration for Federal Employment.

h. Quick Name Check Form.

i. SF75 – Request for Preliminary Employment Data.

j. SF85 – Questionnaire for Non-Sensitive Positions.

k. SF85P – Questionnaire for Public Trust Positions.

l. SF85P-S – Supplemental Questionnaire for Selected Positions.

m. SF86 – Questionnaire for National Security Positions.

n. SF87 – Fingerprint Card (Used for GSA Employees).

Casey Coleman Chief Information Officer

Attachments

GENERAL TABLE OF CONTENTS

CHAPTER 1 INTRODUCTION

CHAPTER 2 GSA HSPD-12 REQUIREMENTS

CHAPTER 3 CREDENTIALING PROCEDURES FOR EMPLOYEES

CHAPTER 4 CREDENTIALING PROCEDURES FOR CONTRACTORS

CHAPTER 5 PIV CARD MAINTENANCE AND RENEWAL

CHAPTER 6 PROVIDING LOGICAL ACCESS TO GSA IT SYSTEMS AND NETWORKS

CHAPTER 7 PROVIDING PHYSICAL ACCESS TO GSA-CONTROLLED FACILITIES

CHAPTER 8 GSA HSPD-12 PIV HANDBOOK REVISION PROCESS

ATTACHMENT A LIST OF HSPD-12 RELATED FORMS

ATTACHMENT B GSA SPECIFIC INFORMATION FOR SF85

ATTACHMENT C MSO ROLES DESCRIPTION

ATTACHMENT D FIPS 201 ROLES DESCRIPTIONS

ATTACHMENT E STEP-BY-STEP PROCESS FOR ENTERING DATA INTO CHRIS-

PSTS

ATTACHMENT F OMB FORM I-9, 1115-0136, EMPLOYMENT ELIGIBILITY

VERIFICATION

ATTACHMENT G FPS HQ AND REGIONAL OFFICES

ATTACHMENT H GSA HSPD-12 PIV HANDBOOK REVISION PROCESS

DETAILED DESCRIPTION

ATTACHMENT I STATUS OF CHILD CARE CENTERS LEGAL OPINION

ATTACHMENT J FEDERAL CHILD CARE CENTER WORKERS FACILITIES

ACCESS CREDENTIALING

ATTACHMENT K DEFINITION OF TERMS

ATTACHMENT L ACRONYMS

TABLE OF CONTENTS

CHAPTER 1. INTRODUCTION

Paragraph Paragraph Title Number

Acknowledgement Background Purpose and scope of document Overview of HSPD-12 process

CHAPTER 2. GSA HSPD-12 REQUIREMENTS

General Requirements Who needs GSA personnel security investigations and credentials?

Available GSA credentials Required background checks Privacy considerations Additional considerations

CHAPTER 3. CREDENTIALING PROCEDURES FOR EMPLOYEES

Roles and responsibilities in employee process Starting a new job at GSA Changing jobs within GSA Leaving a job at GSA

CHAPTER 4. CREDENTIALING PROCEDURES FOR CONTRACTORS

Roles in contractor process Joining a new GSA contract Changing GSA contracts Leaving a GSA contract Help for HSPD-12 related questions

CHAPTER 5. PIV CARD MAINTENANCE AND RENEWAL

Types of situations in which a PIV card may be reissued

PIV card renewal PIV card replacement PIV card re-issuance Reset PIN on PIV card

CHAPTER 6. PROVIDING LOGICAL ACCESS TO GSA IT SYSTEMS AND NETWORKS

General requirements Initial vs. full IT access Granting access to IT systems by authorizing officials upon personnel investigation verification Initial IT access waiver requests for contractors Change in employment status

CHAPTER 7. PROVIDING PHYSICAL ACCESS TO GSA-CONTROLLED FACILITIES

General requirements Access control on construction sites

CHAPTER 8. GSA HSPD-12 PIV HANDBOOK REVISION PROCESS

Type of Handbook changes Handbook Revision process description

CHAPTER 1. INTRODUCTION

1. Acknowledgement. The following policy document supersedes GSA HSPD-12 Personal Identity Verification – I (PIV-I) Standard Operating Procedure (SOP) – June 7, 2007 - Version 2.1.

2. Background. Homeland Security Presidential Directive 12 (HSPD-12) is a directive establishing a common identification standard for Federal employees and contractors. HSPD-12 requires all Federal Executive departments and agencies to conduct personnel investigations, adjudicate the results, and issue identity credentials to all Federal employees and contractors who require routine access to their building facilities and information technology (IT) systems. In response to HSPD-12, the National Institute for Standards and Technology (NIST) issued Federal Information Processing Standard 201 (FIPS 201), entitled “Personal Identity Verification of Federal Employees and Contractors” on February 25, 2005. FIPS 201 specifies the architecture and technical requirements for a common identification standard for Federal employees and contractors, with the goal of achieving appropriate security assurance for multiple purposes by efficiently verifying the identity of individuals.

a. FIPS 201 assigns Federal agencies a clear set of responsibilities with regard to identity credentialing:

(1) Federal departments and agencies shall implement government-wide identity proofing, registration, and issuance functions that accomplish the following:

(a.) Identification is issued based on sound criteria for verifying an individual employee’s identity.

(b.) Identification is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation.

(c.) Identification can be rapidly authenticated electronically.

(d.) Identification is issued only by providers whose reliability has been established by an official accreditation process.

(2) Each agency’s PIV [Personal Identity Verification] implementation shall meet the four control objectives (a) through (d) listed above such that—

(a.) Credentials are issued only 1) to individuals whose true identity has been verified and 2) after a proper authority has authorized issuance of the credential.

(b.) Only an individual with a personnel investigation on record is issued a credential.

(c.) An individual is issued a credential only after presenting two identity source documents, at least one of which is a valid Federal or State government issued picture ID.

(d.) Fraudulent identity source documents are not accepted as genuine and unaltered.

(e.) A person suspected or known to the government as being a terrorist is not issued a credential.

(f.) No substitution occurs in the identity proofing process. More specifically, the individual who appears for identity proofing and whose fingerprints are checked against databases is the person to whom the credential is issued.

(g.) No credential is issued unless requested by proper authority.

(h.) A credential remains serviceable only up to its expiration date. More precisely, a revocation process exists such that expired or invalidated credentials are swiftly revoked.

(i.) A single corrupt official in the process may not issue a credential with an incorrect identity or to a person not entitled to the credential.

(j.) An issued credential is not modified, duplicated, or forged.

b. To meet the responsibilities and implement the HSPD-12 requirements, the Heads of Services and Staff Offices (HSSOs) and Regional Administrators (RAs) agreed to establish procedures to ensure compliance with the Presidential Directive and the General Service Administration (GSA) Handbook ADM P 9732.1C (Suitability and Personnel Security).

(The GSA’s Directives can be found at http://insite.gsa.gov/ “Reference & Resources” tab, under Directives or access directly through:

http://insite.gsa.gov/Insite/gsa/ep/portletView.do?subTabId=0&pageTypeId=8683&channelP age=%2Fep%2FportletView.do%3FsubTabId%3D0&channelId=-8790.)

c. Implementing these procedures has required an integrated effort across many parts of

GSA:

(1) The Personnel Security Requirements Division (CPR) of the Office of the Chief Human Capital Officer (OCHCO) has overall responsibility for personnel security requirements at GSA and manages the processing and adjudication of personnel investigations for GSA employees.

(2) The Public Building Service (PBS) has by far the largest number of individuals within GSA using the HSPD-12 personnel investigation and credentialing process. PBS has provided guidance and expertise on procedures, physical access requirements, and building security.

(3) The HSPD-12 Project Management Office (PMO) of the Office of the Chief Information Officer (OCIO) is responsible for coordinating the activities of Services and Staff Offices (SSOs) and RA offices responsible for requesting personnel investigations and credentials for job candidates, employees, and contractors.

(4) The HSPD-12 Stakeholders Group includes representatives of all SSOs and works with the HSPD-12 PMO to coordinate implementation of the HSPD-12 credentialing process. It helps communicate issues and suggestions between the SSOs and the PMO. It also advises the HSPD-12 PMO on changes to the HSPD-12 credentialing process.

d. These various groups within GSA are working together to ensure that the appropriate personnel investigation and credentialing requirements and procedures are followed.

3. Purpose and scope of document. This document, the GSA HSPD-12 PIV Handbook, covers requirements and procedures for personnel investigations, credentialing requests, and the issuance of PIV cards. This Handbook supplements instructions contained in the following documents and takes precedence while these more authoritative documents are in the process of being revised to be compliant with HSPD-12 requirements:

• GSA Handbook ADM P 9732.1C (Suitability and Personnel Security)

• CIO P 2100.1D, GSA Information Technology Security Policy

• General Services Acquisition Manual (GSAM)

a. The purpose of this document is to provide both a broad overview of the personnel investigation and credentialing process at GSA and a set of detailed, step-by-step instructions for all of the participants in the HSPD-12 process.

b. Note: In many cases there are other documents, including the ones mentioned above as well as instructions from other organizations such as Office of Personnel Management

(OPM), GSA HSPD-12 Managed Service Office (MSO) and DHS Federal Protective Service (FPS) that contain detailed and authoritative information for their areas of responsibility. For example, ch. 2 of this document outlines various requirements for issuing credentials to employees and contractors. It summarizes the requirements in the text and covers informally the most common cases. Nonetheless, it is the GSA Handbook ADM P 9732.1C (Suitability and Personnel Security) that is the authoritative source for personnel security and suitability requirements. Wherever appropriate in this document, the more detailed and/or authoritative sources will be cited for use by GSA staff as needed. (See fig. 1-3 for an annotated list of resources and documents.)

Figure 1-3. Other resources: HSPD-12 related policy documents and instructions Document Title Document Location Publication

Date Policy Documents

Homeland Security Presidential Directive – 12

(HSPD-12)

http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html 08/2004

Federal Information Processing Standards 201-1

(FIPS 201-1)

http://insite.gsa.gov/graphics/staffoffices/fips201.pdf 03/2006

National Institute of Standards & Technology Interagency Reports http://csrc.nist.gov/publications/nistir/ 06/2007

National Institute of Standards & Technology Special Publications http://csrc.nist.gov/publications/nistpubs/ 06/2007

OMB Guidance M-07-06 Validating and Monitoring Agency Issuance of Personal Identity Verification Credentials http://www.whitehouse.gov/omb/memoranda/fy2007/m07-06.pdf 01/2007

OMB Guidance M-06-18 Acquisition of Products and Services for Implementation of HSPD-12 http://www.whitehouse.gov/omb/memoranda/fy2006/m06-18.pdf 06/2006

OMB Guidance M-05-24 Implementation of HSPD-12 – Policy for a Common Identification Standard for Federal Employees and Contractors http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf 08/2005

GSA Order ADM 9732.1C Suitability and Personnel Security Implementation of GSA personnel security policies and procedures.

http://insite.gsa.gov, GSA Insite > Reference & Resources > Directives, Tab “Directives By Number”

01/1998

GSA Order CPO 1878.1 GSA Privacy Act Program Implementation of GSA privacy policies and procedures.

http://insite.gsa.gov, GSA Insite > Reference & Resources > Directives, Tab “Directives By Number”

10/2003

GSA Order CIO P 2100.1D GSA IT Security Policy Implementation of GSA IT security policies and procedures.

http://insite.gsa.gov, GSA Insite > Reference & Resources > Directives, Tab “Directives By Number”

06/2007

Technical Guides GSA Data Release Policy Instructional Letter –

HCO IL-07-1

http://insite.gsa.gov, GSA Insite > Reference & Resources > Directives, Tab “Instructional Letters”

07/2007

Requesting OPM Personnel Investigations (IS-15) http://www.opm.gov/extra/investigate/IS-15.pdf 05/2001 OPM Investigations Reimbursable Billing for FY-http://insite.gsa.gov, GSA Insite > Information Technology > HSPD- 12 Implementation > Policy & Guidance Resources

10/2007

GSA Information Breach Notification Policy, HCO IL-07-02 http://insite.gsa.gov/Insite/gsa/ep/portletView.do?pageTypeId=8683 &subTabId=6&channelId=-

09/2007

Document Title Document Location Publication Date

8790&redirectUrl=http%3A%2F%2Finternotes.gsa.gov%2Finsite%2 Fgsad.nsf%2FInsiteInstructionalLettersDisplay%2F73218CF25140B DC58625735D00641B65%3FOpenDocument

c. This document covers personnel investigation and credentialing requirements and procedures in the following way:

(1) Ch. 2, “GSA HSPD-12 Requirements,” covers requirements for issuing credentials, describes what types of credentials can be issued and what type of personnel investigations should be conducted, and discusses privacy and other considerations.

(2) Ch. 3, “Credentialing Procedures for Employees,” covers the step-by-step procedures for requesting personnel investigations and credentials for GSA employees.

(3) Ch. 4, “Credentialing Procedures for Contractors,” covers the step-by-step procedures for requesting personnel investigations and credentials for GSA contractors.

(4) Ch. 5, “PIV Card Maintenance and Renewal,” covers step-by-step procedures for renewing expired PIV cards and replacing them when they are lost, damaged, stolen, or otherwise unusable.

(5) Ch. 6, “Providing Logical Access to GSA IT Systems and Networks,” covers additional requirements and procedures for obtaining access privileges to GSA IT systems and networks.

(6) Ch. 7, “Providing Physical Access to GSA-Controlled Facilities,” covers additional requirements and procedures for accessing GSA-controlled facilities, campuses, and buildings.

(7) Ch. 8, “GSA HSPD-12 PIV Handbook Revision Process,” describes the process for keeping the GSA HSPD-12 PIV Handbook up to date.

(8) Attachments cover a variety of information, including a list of all the forms used in HSPD-12 procedures and where to find them (Attachment A), and GSA-specific advice on how to fill out the SF85 form (Attachment B).

4. Overview of HSPD-12 process.

a. HSPD-12 and identity management. The HSPD-12 process is part of a larger identity management and security effort at GSA. At GSA, “identity management” is concerned with the identity of individuals who need to (or try to) access GSA-controlled resources such as IT systems, IT networks, GSA buildings, or other GSA-controlled facilities. Identity management begins with having in place a well-designed agency-wide security framework for identifying GSA resources and their particular security requirements.

b. When accessing a GSA resource (e.g., when entering a building or logging onto an IT system), an individual must usually provide some form of credential as a proof of identity.

Credentials come in many forms and can include a photo ID card used as a flash-pass to enter a building, or a user name and password used to logon to a GSA IT system, among others. In the future, the GSA PIV card will used to access both GSA buildings and IT systems.

c. The important point to note is that in order for the credential to be trustworthy, it must accurately identify the individual to whom it was issued. The credential has to be trustworthy and issued to the correct person, because it will be used to validate an individual’s request to access a GSA resource. Therefore, GSA must take care when determining what kinds of credentials are issued, who is receiving the credentials, and what access rights are granted to individuals holding those credentials.

d. The HSPD-12 program is an effort to improve the quality and reliability of GSA credentials by issuing a new agency-wide GSA ID card called the PIV card. The card uses smart card technologies: it has a computer chip embedded in the ID card that electronically stores credential information including biometric. This improved ID card will be used in the future to provide better controlled access to GSA buildings and IT systems.

e. The new GSA PIV card will support the identity management goal of providing the framework for linking three artifacts:

(1) An individual person

(2) Their issued credentials, where each credential represents a separate “identity”

(3) The access privileges granted to use GSA resources

f. In order to get these three linkages set up and working, there are five major steps. (See fig 1-4.1):

(1) Making a request for credentials and access privileges. In this step, an individual works with the designated GSA staff to make a request to be granted routine access to GSA resources; this usually happens when a new employee or contractor joins GSA, though requests for additional privileges or credentials can be made later as needed.

(2) Identity proofing. In this step, GSA verifies the identity of the individual requesting access; this usually involves doing name and fingerprint checks against multiple Federal and state databases, as well as conducting an OPM personnel investigation in most cases.

(3) Credentialing. In this step, if the identity proofing step has produced favorable results from the database checks and personnel investigation, GSA issues the appropriate credentials to the individual requesting access.

(4) Access provisioning. In parallel with the credentialing step and prior to using any credentials issued, GSA security staff grant (“provision”) access to specific IT systems and, in some cases, to specific GSA-controlled building and facilities.

(5) Usage. Finally, if an individual presents his or her credentials and requests to use or access specific GSA resources, and if the appropriate access privileges have been set up in advance (especially in the case of IT systems access), then the individual’s usage request is granted.

Figure 1-4.1. Stages in identity management

g. HSPD-12 and job and PIV card lifecycles. Another way to understand the HSPD-12 process is to look at the triggering events that initiate different kinds of process activity.

These events fall into two categories:

(1) Job lifecycle events, e.g., start a new job, change jobs, leave a job

(2) PIV card lifecycle events, e.g., issue a new card, replace a card, and renew a card

h. At each step in these lifecycles, different procedures need to be followed. Recently, most of the focus has been on the issuance of new PIV cards, but consideration also needs to be given to the full range of lifecycle events possible.

i. Fig. 1-4.2, below, sets out the various HSPD-12 related business processes for employees and contractors. It shows which chapters of the Handbook cover the procedures for events related to changes in employment. It also sets out where in the Handbook to find the maintenance and renewal procedures for PIV cards.

Figure 1-4.2. Job & PIV card lifecycles and process & events triggers

BP

Handbook Chapter

Process Process Description

Events that Trigger Process

Employee Job Lifecycle Management

BP 1.1 Handbook Ch. 3-2 Starting New Job at GSA

Investigate and provide appropriate agency credentials for new employee.

• Agency accepts new employee to staff a position, when the individual has no existing active job with GSA.

• Agency accepts employee to staff a position when the employee had been a GSA contractor.

• Employee onboard before Oct. 2005 does not have an existing personnel investigation.

BP 1.2 Handbook Ch. 3-3

Changing Jobs within

GSA

Adjust agency credentials for existing employee working in a new position within the agency.

• Employee switches from an existing position to a new position.

• Employee is staffed against a new position while continuing to work on an existing job.

• Cardholder’s organizational affiliation has changed.

BP 1.3 Handbook Ch. 3-4 Leaving Job at GSA Revoke credentials when ending agency employment. • Agency terminates employee.

Contractor Job Lifecycle Management

BP 2.1 Handbook Ch. 4-2

Joining New GSA Contract

Investigate and provide appropriate agency credentials for new contractor.

• Agency accepts new contractor to staff a contract when contractor has no existing active contract.

• Agency accepts contractor to staff a contract when the contractor had been an employee.

• Contractor onboard before Oct. 2005 who does not have an existing personnel investigation.

BP 2.2 Handbook Ch. 4-3

Changing GSA Contracts

Adjust agency credentials for existing contractor working on a new contract within the agency.

• Contractor switches from an existing contract to a new contract.

• Contractor is staffed against new contract while continuing to work on an existing contract.

• Cardholder’s organizational affiliation has changed.

BP 2.3 Handbook Ch. 4-4 Leaving GSA Contract

Revoke credentials when ending GSA employment as a contractor.

• Agency terminates contract..

• Contractor company terminates contractor, e.g.

resignation, retirement, death.

• Contractor company reassigns contractor to other work outside the agency.

PIV Card Lifecycle Management

BP 3.1 Handbook 5-2 Card Renewal

Issue new PIV card to cardholder with an expired card.

• PIV card has expired or is within six (6) weeks of expiring.

BP 3.2 Handbook 5-3 Card Replacement

Return old PIV card and issue new PIV card to same cardholder.

• PIV card has been damaged.

• PIV card has been broken.

• PIV card is unreadable.

• PIV card is not usable.

• Cardholder name or other card data has changed.

BP 3.3 Handbook 5-4

Card Re-issuance

Issue new PIV card to cardholder without returning old PIV card.

• PIV card has been lost.

• PIV card has been stolen.

• PIV card has been destroyed.

• PIV card has been compromised.

CHAPTER 2. GSA HSPD-12 REQUIREMENTS

1. General Requirements.

a. GSA must use an approved identity-proofing and registration process that complies with FIPS 201 for all employees and contractors requesting a GSA PIV card.

b. Identity proofing is required to firmly establish an individual’s identity. For individuals receiving a PIV card, this is accomplished by conducting a personnel security investigation and an FBI National Crime History Check (NCHC), known as the fingerprint check, as well as other similar checks as deemed appropriate by GSA. Requirements for individuals not receiving a PIV card, such as visitors, certain temporary contractors, child care workers, etc., are described in par. 2. The results of an investigation and background check are reviewed and adjudicated by GSA or organizations designated by them. Employment at GSA is subject to an employee or contractor having favorable adjudication results. The PIV card and other GSA credentials must be withheld or revoked if the appropriate national security or job suitability decisions are unfavorable.

c. The type of personnel investigation required varies according to an individual’s job responsibilities and access to classified or sensitive information (i.e., Personally Identifiable Information (PII)). Likewise, the choice of GSA credentials to be issued is based on an individual’s job responsibilities, work location, and access to IT systems. (See par. 2, below, for more information on the groups to whom GSA issues credentials; par. 3 for the types of credentials issued; and par. 4 for the kinds of investigations required.)

d. All employees and all long-term contractors must be issued a PIV card; other GSA personnel may be issued a PIV card as needed. (See par. 2, below, for specific information on what credentials are needed for different categories of individuals.) Issuance of a PIV card requires favorable results on an FBI fingerprint check and the initiation of a personnel security investigation at the level of the National Agency Check with written Inquiries (NACI) or higher. If final adjudication of the personnel investigation results is unfavorable, the PIV card is revoked.

e. The PIV identity-proofing and credentialing process must adhere to the principle of separation of roles. No single individual may have the ability to both request issuance of a new PIV card and approve the same request.

f. During the credentialing process, the employee or contractor requesting a PIV card must appear at least once in person in front of an authorized PIV official, the MSO/GSA Enrollment Officer. This happens when the employee/contractor appears to have fingerprints and a photo taken. At that time, the employee/contractor must provide two identity source documents in original form. These documents must be on the list of acceptable documents included in I-9, Office of Management and Budget (OMB) No. 1115-0136, “Employment Eligibility Verification.” (See Attachment F). One of the documents must be a valid (not expired) picture ID issued by a State government or the Federal Government.

g. GSA must use an approved and certified ID card, card issuance, and card maintenance process. GSA must issue credentials through systems and third-party providers whose reliability has been established by GSA, documented, and approved in writing.

h. Personnel who receive a PIV card should keep their PIV card in an electromagnetically opaque sleeve that is on the FIPS 201 Approved Products List. The electromagnetically opaque sleeves are distributed along with the PIV cards.

i. PIV cards or other GSA credentials should be worn above waist level and be clearly visible at all times by GSA personnel and other personnel at GSA-occupied space. (See ch. 7 for additional information on credential requirements for physical access to GSA-controlled facilities.)

j. Special privileges letter codes such as “P” for property removal and “C” for child care parent/employee that were previously issued on GSA credentials are discontinued for GSA PIV cards.

2. Who needs GSA personnel security investigations and credentials?

a. All employees and contractors.

(1) GSA initiates personnel investigations, adjudicates the results, and issues appropriate identity credentials to all its employees and contractors who require “routine access” to its controlled facilities and/or its information systems.

(2) Routine access is defined as regularly scheduled access. For example, a contractor who reports to the facility on a regular basis in the performance of ongoing responsibilities has routine access and a personnel investigation must be conducted. A contractor who is summoned for an emergency service call is not required to have a personnel investigation and is treated as a visitor. GSA contractors who require regularly scheduled access to one or more GSA-controlled facilities, even under multiple contracts, should be treated as having routine access to GSA facilities.

(3) Personnel investigations for employees are conducted by OPM, and the results are adjudicated by the GSA Personnel Security Requirements Division (OCHCO/CPR).

(4) The Department of Homeland Security’s Federal Protective Service (DHS/FPS), under memorandums of agreement (MOAs) with Public Building Service (PBS) and GSA, processes and adjudicates personnel investigations for GSA contractors. Personnel investigations for contractors are conducted by the Office of Personnel Management at the request of FPS.

(5) Requirements for GSA contractors differ according to whether their employment is expected to be long-term or temporary:

(a.) Long-term contractors are those employed for more than 6 months.

(b.) Temporary contractors are those employed for 6 months or less.

b. Employees and long-term contractors.

(1) All employees and those long-term contractors requiring routine access to GSA facilities and/or IT systems must have a personnel investigation appropriate for their job responsibilities in order to be issued a PIV card. The agency must initiate a minimum of a National Agency Check with Written Inquiries (NACI) and must have received favorable results on the FBI fingerprint check before a PIV card can be issued and access to GSA facilities granted.

(2) Initial or full access to GSA Information Technology (IT) systems may be granted by the authorizing official for IT systems (known as the Designated Approving Authority (DAA)). Authorizing officials may grant initial or full access to GSA IT systems after verifying through the GSA OCHCO/CPR that an employee or contractor has an Access National Agency Check and Inquiries (ANACI), National Agency Check with Law and Credit (NACLC), Single Scope Background Investigation (SSBI), or other acceptable level of investigation or clearance. (The list of authorizing officials can be found at http://insite.gsa.gov/ Information Technology tab, under IT Security > Points of Contact or access directly through: http://insite.gsa.gov/graphics/staffoffices/poc.xls.)

(3) If the authorizing official does not grant an employee or contractor initial or full access to GSA IT systems, the same personnel investigation requirements based on an employee’s or contractor’s job responsibilities to obtain a PIV card will apply to obtain initial and full IT access. Initial IT access shall be defined by the authorizing official commensurate with the employee or contractor’s job function and the risk and magnitude of harm that can be done. Contracting Officers (COs), Contracting Officer Technical Representatives (COTRs), or their designees may submit waiver requests to grant contractors initial IT access before GSA receives the results of the fingerprint check.

(See ch. 6-4 for additional information, including guidelines and procedures for submitting waiver requests.) Full IT access is provided upon completion of a personnel investigation with favorable results. (See par. 4 and ch. 6 for more details on risk levels and access to IT systems.)

c. Temporary contractors.

(1) Temporary contractors are defined as those contractors employed for 6 months or less.

(2) Generally, temporary contractors do not receive a GSA PIV card unless they require access to GSA IT systems. Temporary contractors needing issuance of a GSA PIV card and/or access to IT systems must abide by the same personnel investigation requirements as those for long-term contractors. This includes the requirement that initial or full IT access is granted by the authorizing official after verifying an existing ANACI, NACLC, SSBI, or other acceptable level of investigation or clearance. If the authorizing official does not grant an employee or contractor initial or full access to GSA IT systems, initial IT access is granted only after receiving a favorably adjudicated FBI fingerprint check, and full IT access is granted only after a favorably adjudicated personnel investigation (at the minimum level of a NACI). COs, COTRs, or their designees may submit waiver requests to grant contractors initial IT access before GSA receives the results of the fingerprint check. (See ch. 6-4 for additional information, including guidelines and procedures for submitting waiver requests.)

(3) The CO, COTR, project manager, or other designated representative designated to handle contractor staffing decisions for a given contract is responsible for making determinations regarding whether a contractor is a long-term contractor or a temporary contractor. They are also responsible for monitoring the duration of projects, and should the work exceed 6 months, all temporary contractors must be required to submit the personnel investigation documentation required of long-term contractors.

(4) Temporary contractors who will be working up to 6 months and need routine access to nonpublic areas of GSA-controlled facilities shall either undergo a law enforcement check or must be escorted, at the minimum. Escorts are defined as employees and contractors who have received a favorable initial suitability decision and possess valid identification credentials (either a current PIV card or temporary badge and I-9 document).

(5) Temporary contractors who will receive a law enforcement check are required to submit form DHS176T or SF85P and undergo a law enforcement check. These forms shall be submitted by the contractor to the designated GSA staff prior to the commencement of work. These materials will be forwarded to DHS/FPS for the processing of the law enforcement check. (See ch. 4 for procedures on credentialing temporary contractors.)

(6) Escorts are required for temporary contractors awaiting the results of the law enforcement check.

(7) The following general procedures must be followed for temporary contractors who will be working in a facility and needing routine access:

(a.) Apply adequate controls to systems and facilities: ensure temporary staff has limited/controlled access to building facilities and information systems (See chs. 6 and 7).

(b.) Provide temporary contractors with clear documentation on the rules of behavior and consequences for violation before granting access to facilities and/or systems.

(c.) Document any security violations involving temporary contractors, and report them to the appropriate authorities within 24 hours. (For IT systems, “authorities” would be the DAA, ISSM or ISSO, as well as the GSA IT Security office. For buildings, “authorities” would be the GSA building manager and building security office.)

(d.) Any credentials issued to temporary contractors must be visually and electronically distinguishable from GSA PIV cards.

d. Non-US Citizens

(1) OPM issued final guidance on their credentialing standards through memorandum “Final Credentialing Standards for Issuing Personal Identity Verification Cards Under HSPD-12” on July 31, 2008.

(2) Per OPM guidance, GSA will not request background investigations for non-US citizens who have not been a US resident for three consecutive years. Instead, GSA will request the following checks to receive initial access or entry of duty determination:

(a.) FBI Fingerprint and Name Check

(b.) National Crime Information Center (NCIC)/Interstate Identification Index (III)/National Law Enforcement Telecommunications System (NLETS)/Wanted Person Check

(c.) Citizen and Immigration Services Check (CIS)/e-Verify

(3) Non-US citizens who do not meet the three-year resident requirement and receive a favorable result on the required checks for initial access or entry of duty determination will receive a facility access card rather than a PIV card. GSA is currently developing the plan to issue facility access cards to such non-US citizens and other personnel groups.

(4) When a non-US citizen who previously did not meet the three-year resident requirement meets that requirement, the written inquiries portion of the NACI is required to be performed and a final determination decision made. The non-US citizen will then receive a PIV card.

e. Visitors.

(1) Visitors must comply with each GSA-controlled facility’s access requirements.

(2) Some facilities may require a visitor to obtain a visitor badge (see par. 3c) and be provided with an escort while in the facility. Escorts are defined as employees and contractors who have received a favorable initial suitability decision and possess valid identification credentials (either a current PIV card or temporary badge and I-9 document). The escort is responsible for the whereabouts of the visitor.

(3) If the visitor leaves the premises, their visitor badge should become invalid and require them to reapply for a new visitor badge in order to reenter the facility.

f. Agencies supported by GSA.

(1) Certain small agencies, national committees, and presidential commissions are supported by GSA in handling their personnel processing. This support is coordinated through GSA’s Agency Liaison Division (ALD).

(2) The employees and contractors of these agencies, committees, and commissions are subject to the same HSPD-12 requirements and procedures that are in use for GSA employees and contractors as described in this document.

g. Child care workers.

(1) All child care workers in Federal work places must meet the investigative requirements of the Crime Control Act of 1990, PL 101-647, Subtitle E, “Child Care Worker Employee Background Checks,” as amended by PL 102-190. The background check must be:

(a.) Based on fingerprints taken by a law enforcement officer and other identifying information

(b.) Conducted through the FBI’s Identification Division and through the State criminal history repositories in each state in which the child care employee has been resident or has listed in an employment application;

(c.) Initiated through the personnel program of the applicable employing agency

(2) The GSA Child Care Operations Division has worked with the Office of Homeland Security, Federal Protective Service (FPS) to ensure that all child care workers in Federal work places have gone through the security check process mandated by the Crime Control Act. However, the criminal history check is not the equivalent of the FIPS 201-mandated minimum NACI because it lacks the written inquiries component. Therefore, child care workers are not eligible for PIV credentials.

(3) Child care workers in Federal workplaces will receive facility access cards (FAC) to enable access to local facilities. The facility access cards will be compatible with, but both physically and electronically distinct from, the PIV card. GSA is currently developing the plan to issue facility access cards to child care workers and other personnel groups.

h. Volunteers. All volunteers who are affiliated with GSA and require access to federally controlled information systems and facilities must abide by the identity-proofing and registration requirements for GSA employees and contractors as defined in this guidance.

i. Retirees. In the past, special provisions were made to issue retirees with retired ID cards or alter their existing credentials so as to indicate that they were no longer active Federal employees. However, under the current HSPD-12 guidelines, retirees are no longer issued special retiree credentials, nor can they retain their existing credentials, even if the credentials are disabled (for example, punching a hole through the smart card chip) and/or altered (for example, stamping “Retired” across the face of the credential).

j. Foreign government visitors (J-visa holders).

(1) On occasion, GSA has foreign government visitors working for periods of up to 18 months on an exchange basis. The rules governing this program are managed by the Department of State Exchange Visitor Program (http://exchanges.state.gov/).

Participants in this program are investigated by the State Department. Personnel investigation information on the participants can be accessed through the Student and Exchange Visitor Information System (SEVIS) of the Department of Homeland Security.

(2) Participants in this program with favorable investigations may be issued a contractor PIV card. J-visa holders are a different personnel group than non-US citizens and have different personnel investigation and credentialing requirements.

k. Employees and contractors detailed from other Federal agencies.

(1) Federal employees and contractors on detail from other Federal agencies with routine access to GSA-occupied facilities and/or IT systems must have the same level of personnel investigation as would be required of a GSA employee or contractor. If the detailee has already received a public trust certification or national security clearance at the appropriate level, then their manager or COTR should contact the OCHO/CPR (for employees) or HSPD-12 POC (for contractors) to request verification. Otherwise, the detailee’s manager should follow the processes described in chs. 3 and 4 of this document to request the appropriate personnel security investigation and adjudication.

(2) Detailees will retain the credentials issued by their parent agency, including their agency-issued PIV-2-compliant card. Until such time as interagency authentication of Federal PIV cards becomes available, there may be instances where detailed employees and contractors need to be issued GSA PIV cards or other GSA credentials in order for them to have access to GSA-occupied facilities and IT systems. In these cases, the individual’s personnel investigation and prior adjudication with the parent agency must be verified before a GSA PIV card is issued to them. (See ch. 2-6, which identifies CPR as the office that verifies the prior investigations and adjudication results.)

l. Presidential transition staff. Presidential transitions staffs include large numbers of campaign staff, security personnel from various Federal agencies, and volunteers. GSA provides administrative support to the transition, including acquisition of office space, IT support, and payment of official transition staff. GSA will coordinate with all campaigns to ensure that credentialing requirements are known prior to Election Day. Official transition staff will require PIV cards immediately, and GSA will make arrangements to provide credentialing enrollment and activation equipment and personnel security representatives as close to the transition site as possible to expedite fingerprint capture and personnel investigation submission. Volunteers will follow standard HSPD-12 guidelines or be treated as visitors requiring escort, depending on duties assigned by the transition staff.

m. Federal Emergency Response Official (FERO). Requests for Federal Emergency Response Officials (FERO) designation for GSA Central Office employees and contractors are submitted by their PIV sponsor and approved by the Office of Emergency Response and Recovery (OERR). Requests for FERO designation for all other GSA employees and contractors are submitted by their PIV sponsor and approved by the regional emergency coordinator for that individual’s region. If a request for FERO designation is approved, the card holder will have “Emergency Response Official” printed within a red stripe at the bottom of their PIV card. A FERO designation is restricted to government-wide emergency responders who will staff a Multi-Agency Coordination Center as identified by Federal agencies to the DHS Federal Emergency Management Agency (FEMA) or otherwise when approved by the regional emergency coordinator.

3. Available GSA credentials.

a. PIV card.

(1) The PIV card is the Federal identity card mandated for use in authenticating access to physical and logical agency resources in accordance with Homeland Security Presidential Directive 12 (HSPD-12). (See http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html for the complete directive) The PIV card is credit-card sized, with one or more embedded integrated circuit chips (ICCs) that provide memory capacity and computational capability. Its form and functionality are defined by NIST standards and publications including FIPS 201-1, and NIST publications SP800-73, SP800-76, and SP800-78. (See link to NIST Special Publications in fig. 1-3).

(2) Data stored in the card or displayed on its face include a digital photograph, name, agency affiliation, contact information, fingerprint templates, expiration date, and other data associated with the cardholder. Multiple PKI digital certificates that can be used for electronic authentication, digital signing, and digital encryption are included on the PIV card.

(3) The fingerprints captured during the enrollment process are placed as a digital file on the chip of the PIV card. This biometric data is used to identify cardholders uniquely by comparing the cardholder’s fingerprints with the fingerprint data stored on the PIV card. A successful comparison guarantees a very high level of trust in the identity of the cardholder, thus confirming that the person presenting the card is the actual cardholder.

The scanned fingerprints are stored as “minutiae templates” (key points for comparison) on the chip of the card and can only be read from the card after providing the card PIN.

To protect cardholder privacy, the actual fingerprint images are not stored on the card.

Minutiae templates cannot be used to reconstruct the original fingerprint images, thus mitigating concerns of privacy even if the card is lost or stolen.

(4) The PIV card should be issued to all GSA employees and to all contractors who need routine access to GSA IT systems and GSA-occupied facilities for more than 6 months. It can be issued to other contractors and affiliates as deemed necessary for GSA as described in this document.

(5) The PIV card cannot be issued until an individual has received favorable results of an initial suitability check that includes an FBI fingerprint check and the submission of a personnel investigation request at the minimum level of a NACI.

(6) The maximum expiration date for a GSA PIV card is 5 years from the date of issuance.

(7) PIV cards do not contain any company-specific information for contractors. As a result, a contractor may reuse an unexpired PIV card when moving between contractor companies without a break in work at GSA. If there is a break, the PIV card must be returned to GSA. GSA may then reissue the same card or a new card to the contractor when they start working for a new company.

(8) Note: In the future, for the PKI digital certificates on a GSA PIV card to work properly for logging onto GSA IT networks, the UPN (User Principal Name) data field in the MSO PIV card request must be set properly. It must match the individual’s unique identifier in the GSA IT network directory service. As a result, the GSA HSPD-12 PMO will generate the UPN for each PIV card applicant and provide the data to IT security.

b. Temporary credentials.

(1) Temporary badges may be issued to individuals who have received at least a favorable initial suitability decision and are eligible to receive a PIV card. Employees and contractors awaiting issuance of their PIV card can use the temporary badge in place of a PIV card when entering GSA-managed buildings after signing in and providing a suitable government-issued photo ID. In addition, if an employee or long-term contractor forgets his/her card on a particular day, or if the person is waiting for a replacement PIV card, they can also be issued a temporary badge after their identity has been confirmed.

(2) The design of temporary badges must make the badges physically and electronically unique and easily differentiated from a PIV card. The badge holds no photo or biometric data for the employee/contractor. This practice eliminates the possibility of mistaking temporary badges for valid PIV cards.

(3) When accessing a GSA-controlled facility that restricts entry, the process of using a temporary badge must include identity verification of the individual. A government-issued picture ID must be verified before allowing individuals with temporary badges into GSA facilities. Any sign-in procedures established for that facility should be followed.

(4) Employees and contractors can request a temporary badge directly from a regional credentialing officer (RCO). Regional credentialing officers must verify the individual’s identity and that the individual has received a favorable initial or final suitability decision. A temporary badge must be returned in order to receive a PIV card and should not be used for more than 30 days without verifying the need for its continued use.

(5) Credentialing officers can obtain a supply of temporary badges from the HSPD-12

PMO.

c. Visitor credentials.

(1) Visitor credentials should be issued in accordance with the procedures approved by the facility’s Building Security Committee (BSC). GSA employees and contractors without their GSA-issued credentials should follow the procedures for visitors.

(2) In some GSA-occupied spaces, visitors are required to be issued a visitor badge.

Before issuing a badge, the visitor’s identity should be checked by visual and/or electronic inspection of a government picture ID, a state driver’s license, or other photo

ID.

(3) If the visitor leaves the premises, their visitor badge should become invalid and require them to reapply for a visitor badge in order to reenter.

d. Regional credentials.

(1) Regional credentials are identity cards issued by regional organizations within GSA. They indicate the regional affiliation of the cardholder and have been authorized for use by RAs and/or HSSOs. In some cases, regional cards also function as physical access cards for opening door locks or entry/exit gates to GSA buildings and facilities.

(2) Over time, regional credentials will be phased out in favor of the agency-wide PIV card. Nonetheless, regional cards that are used for physical access will be retained until the associated building physical access systems (PACSs) are upgraded to be compatible with the national PIV card.

e. Local and building-specific credentials.

(1) Local credentials and building-specific credentials are cards used for access to specific buildings and/or GSA-controlled facilities. They may or may not indicate the identity of the registered cardholder on their face. They are issued in accordance with BSC rules for individual buildings and facilities as well as any applicable RA- and SSO-defined requirements.

(2) Over time, these cards will be phased out as their associated building or facility PACS are…