Attachment B Security Clearances and Safeguarding SBU Info.pdf

SECURITY CLEARANCES AND

SAFEGUARDING SENSITIVE BUT UNCLASSIFIED (SBU) BUILDING INFORMATION

Security Clearances. Contractor shall comply with the following requirements pertaining to security clearances.

(a) All personnel performing work under the Contract on the Project site must obtain an Enter on Duty (EOD) determination before they will be granted access to the site.

(b) To obtain an EOD determination, Contractor shall submit for all such personnel fingerprints on Form SF87 and a completed Contractor Information Worksheet (CIW). Detailed information is available at Detailed information is available at GSA Access Card . USAccess Credentialing Centers can be located at US Access Centers.

(c) In addition, all such personnel who will be on site 6 months or longer must apply for and receive clearance in accordance with Homeland Security Presidential Directive 12 (HSPD- 12). See Section IV, Contract Clauses, GSAR 552.204-9.

SECURITY CLEARANCE REQUIREMENTS (NONCLASSIFIED CONTRACT)

(NOTE: DOES NOT INCLUDE LEASED SPACE)

1) Introduction

a) Homeland Security Presidential Directive 12 (HSPD-12) “Policy for a Common Identification Standard for Federal Employees and Contractors” mandated the implementation of a government-wide standard for secure and reliable forms of identification, also known as security credentials.

b) All contractor employees who require routine access to GSA-controlled facilities or its Information Technology (IT) infrastructure are required to be issued this type of credential. Routine access is defined as regularly scheduled access to Government facilities for a period greater than six (6) months.

c) Prior to being issued this form of identification, each individual must have both their identity and trustworthiness proven. This is accomplished by conducting a personnel security investigation (Tier 1) and a Federal Bureau of Investigation (FBI) Criminal History Fingerprint check. All contractors seeking to conduct business on or within federal facilities that are controlled and operated by the Federal Government are required to have a personnel security investigation conducted.

d) Contractors require a favorable initial suitability determination based off the submission of a Tier 1 to receive an identification credential meeting HSPD-12 requirements.

e) The Contractor is responsible for returning all HSPD-12 badges to GSA upon project completion.

2) Clearance Type

a) Long-Term Contractor Clearance Tier 1 http://www.gsa.gov/portal/category/107203 http://www.fedidcard.gov/centerlist.aspx

i) This section covers the procedures for obtaining a security clearance for contractors working on GSA-controlled facilities.

ii) The Tier 1 clearance is required for contractors who require access for more than six (6) months and those who need Information Technology (IT) access (regardless of how long they will be working on a GSA-controlled facility).

iii) Procedures for each Tier 1 applicant to be cleared:

a. The prime contractor will submit to the Contracting Officer and then maintain throughout the course of the contract, a list of all prime contractor employees (applicant) and subcontractor employees (applicant) who are required on the project using the form: Requesting Official (RO) Contractor Approval List. (Note: Submission of the RO list will trigger GSA to provide HSPD-12 and e-Qip training for the prime contractor.)

b. The Contractor Information Worksheet (CIW) (form GSA850) will be submitted by GSA to the prime contractor after prime contractor has received HSPD-12 and e-Qip training. (Note: The prime contractor must designate a Point of Contact (POC) on the

CIW.)

c. Each applicant for the HSPD-12 compliant Tier 1 credential will complete section 1 of the CIW and return the CIW to the POC. The POC is responsible to submit all completed CIW's via email to zonec-hspd12@gsa.gov. (Note: applicants for the Tier 1 credential will not be eligible for escort during credential processing.)

d. The applicant will then receive an email that will invite them to apply to e-QIP, and they will also receive an email with an invite to an enrollment appointment.

e. The applicant must complete the enrollment appointment before completing e-Qip.

f. Following the instructions in the invitation to apply to e-Qip email, the applicant will log into e-Qip and complete a background history questionnaire.

g. As per the instructions in the invitation to apply to e-Qip email, the applicant is also required to complete the Declaration for Federal Employment OF-306.

(Note: Digital signatures are not accepted, all questions must be checked, answered, or marked NA. The completed OF-306 must be signed, scanned into a PDF and uploaded to E-Qip.)

h. As per the instructions in the invitation to apply to e-Qip email, the applicant is also required to complete the Authorization to Obtain Credit Report 3665.

(Note: Digital signatures are not accepted. The completed 3665 must be signed, scanned into a PDF and uploaded to E-Qip.)

i. After completing steps e-h above, the applicant is required to certify that their answers are true, electronically sign and submit the e-QIP application.

mailto:zonec-hspd12@gsa.gov

j. Office of Mission Assurance (OMA) will notify the applicant directly if any errors occurred when completing the e-QIP application.

(Note: Failure to respond to these messages will result in delay of their Tier 1 or termination of e-Qip.)

k. A contractor Enter on Duty (EOD) email will be received by POC and applicant upon clearance adjudication.

l. Upon completion of HSPD-12 credential processing, the applicant will be notified by email that an appointment will need to be scheduled for the HSPD-12 credential pick up and activation.

b) Escort Procedures

i) A HSPD-12 credentialed contractor may escort up to five (5) non-cleared individuals to access GSA-controlled facilities.

ii) Escort procedures are limited to individuals needing site access for no more than fifteen (15) consecutive days.

iii) A contractor may be escorted for a total of fifteen (15) cumulative days, on either a single day or multiple day escort, per six (6) month interval, per escorted individual.

iv) Individuals in the process of obtaining the HSPD-12 credential will not be eligible for escort during the HSPD-12 adjudication period.

v) Procedures:

a. Persons being escorted must be added to the Requesting Official (RO) Contractor Approval List.

b. A current CIW for the escortee must be submitted with the updated Requesting Official (RO) Contractor Approval List by the POC.

c. The POC is responsible to submit changes to the Requesting (RO) Official Contractor List to the Requesting Official (GSA POC).

d. The POC is responsible to submit the escortee CIW no later than three (3) business days in advance of the escort date, via email to zonec-hspd12@gsa.gov.

mailto:zonec-hspd12@gsa.gov

Safeguarding and Dissemination of Sensitive But Unclassified (SBU) Building Information. This clause applies to all recipients of SBU building information, including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

(a) Marking SBU. Contractor-generated documents that contain building information must be reviewed by GSA to identify any SBU content, before the original or any copies are disseminated to any other parties. If SBU content is identified, the Contracting Officer (CO) may direct the contractor, as specified elsewhere in this contract, to imprint or affix SBU document markings to the original documents and all copies, before any dissemination.

(b) Authorized recipients.

(i) Building information designated SBU must be protected with access strictly controlled and limited to those individuals having a legitimate business need to know such information.

Those with a need to know may include Federal, State and local government entities, and nongovernment entities engaged in the conduct of business on behalf of or with GSA.

Nongovernment entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, utilities, and others submitting an offer or bid to GSA, or performing work under a GSA contract or subcontract. Recipient contractors must be registered as “active” in the System for Award Management (SAM) database at www.sam.gov and have a legitimate business need to know such information. If a subcontractor is not registered in the SAM and has a need to possess SBU building information, the subcontractor shall provide to the contractor its DUNS number or its tax ID number and a copy of its business license. The contractor shall keep this information related to the subcontractor for the duration of the contract and subcontract.

(ii) All GSA personnel and Contractors must be provided SBU building information when needed for the performance of official Federal, State, and local government functions, such as for code compliance reviews and for the issuance of building permits. Public safety entities such as fire and utility departments may require access to SBU building information on a need to know basis. This clause must not prevent or encumber the dissemination of SBU building information to public safety entities.

c. Dissemination of SBU building information:

(i) By electronic transmission. Electronic transmission of SBU information outside of the

GSA network must use session encryption (or alternatively, file encryption). Encryption must be via an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES), in accordance with Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules per GSA policy.

(ii) By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include, but are not limited to CDs, DVDs, and USB drives.

Nonelectronic forms of SBU building information include paper documents, among other formats.

1) By mail. Contractors must utilize only methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt.

2) In person. Contractors must provide SBU building information only to authorized recipients with a need to know such information. Further information on authorized recipients is found in Section 2 of this clause.

d. Record keeping. Contractors must maintain a list of all entities to which SBU is disseminated, in accordance with sections 2 and 3 of this clause. This list must include at a minimum: (1) the name of the State, Federal, or local government entity, utility, or firm to which SBU has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the SBU building information, with access strictly controlled and limited to those individuals having a legitimate business need to know such information; (3) contact information for the named individual; and (4) a description of the SBU building information provided. Once “as built” drawings are submitted, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and/or suppliers, and submit them to the CO. For Federal buildings, final payment may be withheld until the lists are received.

e. Safeguarding SBU documents. SBU building information (both electronic and paper formats) must be protected, with access strictly controlled and limited to those individuals having a legitimate business need to know such information. GSA contractors and subcontractors must not take SBU building information outside of GSA or their own facilities or network, except as necessary for the performance of that contract. Access to the information must be limited to those with a legitimate business need to know.

f. Destroying SBU building information. When no longer needed, SBU building information must be destroyed so that marked information is rendered unreadable and incapable of being restored, in accordance with guidelines provided for media sanitization within GSA CIO IT Security 06-32, Media Sanitization Guide and Appendix A of NIST Special Publication 800-88, Guidelines for Media Sanitization. Alternatively, SBU building information may be returned to the CO.

g. Notice of disposal. The contractor must notify the CO that all SBU building information has been returned or destroyed by the contractor and its subcontractors or suppliers in accordance with paragraphs 4 and 6 of this clause, with the exception of the contractor's record copy. This notice must be submitted to the CO at the completion of the contract to receive final payment. For leases, this notice must be submitted to the CO at the completion of the lease term. The contractor may return the SBU documents to the CO rather than destroying them.

h. Incidents. All improper disclosures of SBU building information must be immediately reported to the appropriate task order Ordering Official. If the contract provides for progress payments, the CO may withhold approval of progress payments until the contractor provides a corrective action plan explaining how the contractor will prevent future improper disclosures of SBU building information. Progress payments may also be withheld for failure to comply with any provision in this clause until the contractor provides a corrective action plan explaining how the contractor will rectify any noncompliance and comply with the clause in the future.

i. Subcontracts. The contractor and subcontractors must insert the substance of this clause in all subcontracts.