ATTACHMENT_D_-_SOL_-HSPD-12_-_Postal_Square_Building_CFM_RFP_47PM0717R0002.pdf

Section H HSPD-12 Security and Credentialing Requirements

PART 1 - SECURITY REQUIREMENTS AND PERSONAL IDENTITY VERIFICATION AND

CREDENTIALING PROCEDURES FOR CONTRACTORS

(NON-CLASSIFIED CONTRACT)

1.1 The General Services Administration (GSA) reserves the right to verify the identities of Contractor personnel with routine, unaccompanied access to GSA facilities or Information Technology (IT) systems and networks, to make contract employment suitability determinations based on background investigations, and control access to GSA facilities and IT systems and networks based on the suitability determinations. The term ‘Contractor’ refers to the General/Prime Contractor Company or lessor on a GSA contract and any related Subcontractor(s) company and Vendor(s). The term ‘Contractor Personnel’ refers to any Contractor personnel supporting GSA contracts. The Contractor and their Contractor Personnel shall comply with the GSA Personal Identity Verification (PIV) procedures outlined below, that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and the Federal Information Processing Standards Publication (FIPS PUB) Number 201, as amended. HSPD-12 requires Federal agencies to issue standardized PIV credentials to Federal employees and contractors and use the credentials for access to Federal facilities and IT networks and systems. GSA branded the PIV card that GSA issues to its personnel as the GSA Access Card. The GSA Access Card enables routine, unescorted access to GSA facilities and IT systems and networks.

1.2 In accordance with FAR 52.204-9 (Personal Identity Verification of Contractor Personnel (Jan 2011). the Contractor shall account for all GSA credentials issued to Contractor Personnel in connection with the performance under this contract. The Contractor Personnel shall immediately return credentials issued by GSA under any of the following conditions, as stipulated in FAR 52204-9:

All Contractor Personnel who will perform work on a GSA contract and will require routine access to GSA facilities or IT systems and networks may be required to obtain a GSA Access Card. The GSA Contracting Officer or their Designated Representative and/or the Security Officer will define routine access. Contractors must receive a favorable result on their Federal Bureau of Investigation (FBI) Fingerprint Check and GSA must have initiated a minimum of a National Agency Check with Written Inquiries (NACI) before GSA can issue an Access Card to them. GSA will revoke the Access Card for a Contractor who receives an unfavorable final suitability determination based on the NACI or higher background investigation. GSA may also remove the Contractor from the GSA contract and restrict access to GSA facilities and IT systems and networks if the Contractor receives an unfavorable final suitability determination.

A. GSA has full and complete control over granting, denying, withholding or terminating suitability determinations for Contractor Personnel supporting GSA contracts. GSA may authorize and grant temporary suitability to Contractor Personnel. A temporary or preliminary suitability determination by GSA does not guarantee that GSA will grant a favorable final suitability determination. A favorable temporary, preliminary or final suitability determination by GSA shall not prevent, preclude, or bar GSA from withdrawing or terminating a suitability determination.

B. HSPD-12 establishes the minimum background requirements for GSA to issue an Access Card. GSA may require Contractor Personnel to obtain a higher background investigation level than the minimum required background investigation for an Access Card based on the Contractor Personnel’s contract employment job duties.

C. Contractor Personnel may be required to submit additional personnel information to other Government Agencies affected by the contract work and based on working within that Agency’s space.

1.3. GSA may require Contractor Personnel who need less than routine access to GSA facilities or IT systems and networks to receive a favorable result on a National Agency Check (NAC) to access GSA facilities or IT systems and networks. The GSA Contracting Officer or their Designated Representative and/or the Security Officer will define the level of access to GSA facilities or IT systems and networks from a favorable NAC and will define how long the access is valid. Contractor Personnel that are not required to receive a favorable suitability determination may be required to be escorted at all times while in non-public GSA space.

1.4. The Contractor shall account for all GSA credentials issued to Contractor Personnel in connection with the performance under this contract. The Contractor Personnel shall immediately return credentials issued by GSA under any of the following conditions:

A. When the Contractor Personnel is no longer required for contract performance.

B. Upon completion of the Contractor Personnel’s employment.

C. Upon contract completion or termination.

D. If the Contractor Personnel is removed from the contractor based on an unfavorable determination on any suitability check.

1.5. The Contracting Officer may delay final payment or execute an equitable adjustment under the contract, if the Contractor and their Contractor Personnel fail to comply with the requirements in paragraph 1.4.

1.6. Contractor shall insert these requirements in all subcontracts. It shall be the responsibility of the Contractor to return all credentials issued by GSA in accordance with the terms set forth in paragraph 1.4, above of this section.

PART 2 - FEDERAL DEBT REDUCTION AND OVERSIGHT OF FEDERAL FUNDS

2.1 The GSA has a fiduciary responsibility to provide oversight of federal funding. The Contractor will work with the GSA to reduce expenditures, and assure oversight of federal tax dollars when requesting background checks. In order to reduce expenses and ensure prudent use of federal funds, the Contractor will make every effort to pre-screen or interview prospective personnel to help ensure they are suitable for employment, and are able to pass a background check prior to submitting employee applications to GSA.

2.2 The Contractor company shall assign and dedicate a single Point of Contact (POC) for the overall control, management, and oversight of all suitability investigation applications for its Contractor employees. The Contractor POC is responsible for collecting all of the Contractor employee background investigation documents and submitting them to the Contracting Officer or their Designated Representative to ensure the completion of the background investigation request. The Contractor POC shall follow the method identified by the GSA Contracting Officer or their Designated Representative and/or the Security Officer to submit the background investigation documents to GSA. The Contractor POC must provide follow-up and monitoring to ensure that the Contractor Personnel who needs an investigation responds to requested information and completes all required forms within the prescribed times allowed so as not to delay the project schedule or project completion date.

2.3 The Adjudicating Office of the Federal Protective Service may forward a written notification to contractor personnel for clarification information that pertains to the background investigation requesting additional information or supporting documentation. The POC shall ensure the Contractor responds to such inquiries so as not to cause delay, or consider submitting an alternate applicant so as not to cause delay with the project schedule or project completion date.

PART 3 - ADJUDICATION AUTHORITY

3.1 GSA and its Authorized Agent, the Federal Protective Services (FPS) or any other named designee, will be responsible for conducting the HSPD-12 background investigations, and credentialing of Contractor Personnel. GSA has the final authority to process the HSPD-12 background investigations, as directed by the Office of Personnel Management (OPM).

PART 4 -PROCESSING OF HSPD-12 INVESTIGATIONS AND CREDENTIIAL PROCEDURES

4.1 Submission of Forms: All Contractor Personnel requiring facility or IT system and network access may be responsible to fill out and complete security HSPD-12 forms and fingerprint cards or electronic fingerprint scans prior to being allowed access. GSA will provide detailed instructions on the HSPD-12 process, the forms to be submitted, and the handling of the forms after the contract has been awarded. Depending on the level of responsiveness and timeliness of individual Contractor personnel, a maximum of fifteen (15) days is expected for the completion and submission of all forms by the applicant for review through the GSA. More importantly, however, the Contractor and the single Contractor Point of Contact (POC) managing all Contractor Personnel has the responsibility to submit applications in a timely fashion so as not to delay any project activities or the overall project schedule. Complete submissions of all suitability investigation forms are required to be provided for all applicants a minimum, thirty (30) days prior to access being required without the need for a HSPD-12 credential or sixty (60) days prior to access being required when a HSPD-12 credential is required. Access requirements by Contractor Personnel shall be based on the contract time performance requirements, and the planned activities on the approved project schedule. The Contracting Officer or their Designated Representative and/or Security Officer will notify the Contractor POC in writing if any Contractor Personnel receive an unfavorable decision on their background investigation, and effective immediately; the individual will no longer be allowed to work on the project. The Contractor Personnel shall be responsible for planning and scheduling its work in such a manner as to account for the facility or IT access requirements. Difficulties encountered by the Contractor Personnel in gaining access when required by not fulfilling application requirements in a timely manner shall not be an excuse for Contractor non-performance under the contract, or the granting of any time extensions.

A. Throughout the life of the contract, the Contractor shall be responsible to follow these same procedures for any new Contractor personnel, who will require access to GSA’s space or IT systems and networks.

B. Also throughout the life of the contract, the Contractor shall maintain a listing of current/active personnel and their subcontractors’ personnel that have received a favorable suitability investigation and/or have a GSA credential. The Contractor shall provide the Contracting Officer or their Designated Representative, an updated listing of current/active personnel or subcontractors’ personnel when requested.

4.2. Unsuitable Personnel: If the Contracting Officer receives an unsuitable report on any Contract Personnel after the processing their application, or if the GSA finds a prospective Contractor Personnel to be unsuitable or unfit for their assigned duties the Contractor POC shall be advised immediately by the Contracting Officer or their Designated Representative and/or the Security Officer that the Contractor Personnel cannot continue to work or be assigned to work under the contract. The Contractor must then take action to remove the Contractor Personnel from the GSA contract.

4.3 Criteria for Eligibility: Refer to GSA Order 9732.1 or 5 CFR 731 which outlines the disqualifying and mitigating factors for personnel acceptance.

4.4 Prior Background Investigation: Contractor Personnel background investigations obtained through this process may be acceptable if the investigation can be validated to be equal to or higher level than required of the contract, and there is no break in service from when the suitability was provided. The Contracting Officer or their Designated Representative and/or the Security Officer in consultation with the FPS will determine whether there is a break in service and whether a prior background investigation meets GSA’s requirements to grant access to GSA facilities and IT systems and networks. GSA requires the Contractor Personnel to submit required background investigation documents for GSA to determine whether a prior investigation meet’s GSA requirements to grant access to GSA facilities and IT systems and networks.

4.5. Identification Credential: The following paragraphs describes GSA’s requirements for Contractor Personnel to display GSA credentials, follow GSA building screening procedures, and follow procedures to report lost GSA credentials.

A. Contractor Personnel with GSA credentials shall be required to comply with all applicable access security screening procedures applicable to Government or other personnel possessing similar credentials, or as determined by the building practices as defined by the Facility Security Committee.

B. All Contractor Personnel possessing credentials (Access Card, other agency-issued PIV credentials, or other credentials) shall visibly display their credentials at all times while in the building(s) where work is being performed.

C. The Contractor shall be responsible for ensuring that all GSA identification credentials are returned to the GSA when Contactor Personnel are no longer employed, providing service under the contract, the contract ends or the Contractor Personnel is removed as a result of an unfavorable determination on any suitability check.

D. The Contractor Personnel shall notify the GSA when credentials are lost. If the Contractor Personnel is determined to be negligent, the Contractor may be responsible for reimbursing the Government for its cost in issuing a replacement credential.

PART 5 - GSA ACCESS CARD: CONTRACTOR’S TRAVEL COSTS

5.1. Contractor personnel who require routine access to GSA-controlled facilities and/or access to GSA IT systems must receive a preliminary favorable HSPD-12 security background investigation, before receiving a GSA Access Card.

5.2. Following a favorable HSPD-12 security background investigation, Contractor Personnel may be required to enroll and activate a GSA credential card at a designated location. The credential card is also a photo Identification card, which includes biometric information. The following information is provided to assist the Contractor in estimating the costs that may be associated with this requirement. The Contractor Personnel will be expected to utilize the nearest credentialing site to their offices or place of contract performance. The credentialing station may be a mobile station in the area, or as a fixed station whose location(s) can be located through the following source:

http://www.fedidcard.gov/centerlocator.aspx. Credentialing centers that are listed as “Open to all Agency personnel” are open to all customer agencies including GSA Contractors. Credentialing centers that are listed as “For use by personnel from this Agency only” mean that they are only open to personnel of that specific agency that is hosting that credentialing center. Currently a minimum of two visits to a credentialing center may be required to enroll and activate the GSA credential. The first visit is to enroll for the credential, and the second visit may be required to pick-up and activate the credential. Travel distance to a credentialing center will vary based on availability of enrollment and activation stations identified in the link above. Additional visits to a credentialing center may also be required if the card holder needs to recertify their credential certificate (every 3 years), or when the employee will need to renew their GSA credential that has expired (every 5 years). Additional visits may also be required for lost or damaged credentials needing replacement.

5.3. If a GSA credential card is required, the Contractor would be responsible for all travel and labor costs associated with fingerprinting to meet the background investigation along with the credential card enrollment and activation steps to meet HSPD-12 requirements unless stated otherwise elsewhere in the contract. Travel costs may be comprised of mileage, vehicle rental, or other modes of transportation, per diem, and lodging. These costs are considered reasonable to the extent that they do not exceed, on a daily basis, the maximum rates in effect at the time of travel, as set forth in the Federal Travel Regulation, Chapter 301 – Temporary Duty (TDY) Travel Allowances, which can be accessed at the following website: http://www.gsa.gov/ftr.

Information on Privately Owned Vehicle (POV) Mileage Reimbursement Rates can be accessed at the following website: http://www.gsa.gov/travelpolicy.

5.4 Any annual training requirements associated with IT access that may be required for continued use of the GSA credential is expected to be completed within a timely fashion.

Otherwise, the Contractor Personnel’s access may be revoked and the credential taken away.

ARRA Temporary Contractors:

Complete GSA Form 850 instead of CIW

For Official Use Only Contractor Information Worksheet (CIW)

Version 4 (Updated 12/7/10) Pg. 1 of 2

Type Contractor (Definitions on Pg. 2)

ARRA Long Term Contractor

ARRA Temporary (Short Term) Contractors: Use GSA Form 850

Investigation Preference

(if option offered in region)

Priority (Option available for MBI / BI only)

Sponsoring Office Symbol

GSA Region (Options on Pg.2)

1. Contract Employee Information Name (Last/Family)

First (Given)

Middle (or NMN if none)

Suffix

Social Security #

Date of Birth

Place of Birth (POB): City

POB: State

Country

Sex

Home Address Street e-Mail

Address Street (line 2)

Phone Number (Day)

Phone Number (Cell)

City

State

Zip

Position (Job) Title

IT System Administrator

Prior Investigation

Investigation Date

Agency that Adjudicated Prior Investigation

U.S. Citizen

Non-U.S. Citizens Only: Port of Entry City and State

Date of Entry

Less than 3 Yrs.

U.S. Resident

Alien Registration #

Citizenship Country

2. Contact Information Company Name

Company is:

If Sub, Name of Prime

Task Order (TO) / Delivery Order (DO) Number (Enter Contract Base Number if TO / DO is Not Applicable)

Contract Number Type

Contract Start Date

Contract End Date

Has Option Yrs.

Or End Date TBD

Company Point of Contact (POC) Name

POC Phone Number (Day)

POC Email Address

3. Project/Work Location Information (Government site where contractor is working) GSA Building Number

Building Name

Building Address

4. Type of Investigation Requested for: GSA Access Card

Note: National Security positions are processed by GSA Personnel Security (CIS)

5. Requesting Official (Sponsor) Information Sponsor’s Name

Title

Is COR/COTR

Email Address

Phone Number (Day)

Date Forms Were Reviewed

Alternate POC and Phone Number or Comments

6. Personnel Security Office:

OPM PIPS Inv Status e-QIP Invitation # Date e-Mail Sent

[ ] Release Form

[ ] CER

[ ] Medical Release [ ] GSA Form3665

[ ] FD 258

[ ] CS Case

[ ] FD 258 RAP

[ ] Just

Date Received

[ ] Reviewed [ ] Scan/TIF

Date Sent to OPM

Suitability Decision Preliminary Date [ ] Unfavorable [ ] Favorable

Final Date [ ] Unfavorable [ ] Favorable

Notify Preliminary Decision [ ] Email: hspd12.security@gsa.gov [ ] Email: COTR/Requesting Official [ ] Email: Subject [ ] Email: Subject’s Company Notify Final Decision [ ] Email: hspd12.security@gsa.gov [ ] Email: COTR/Requesting Official [ ] Email: Subject [ ] Email: Subject’s Company

Contractor Information Worksheet

Instructions

Version 4 (Pg. 2 of 2)

Applicability of Contractor Information Worksheet Use this Contractor Information Worksheet for all GSA contractors except ARRA temporary contractors. For all ARRA temporary contractors, use the GSA Form 850 available at http://gsa.gov/forms.

How to Enable Macros if You Are Not Able to Enter Information or Select Options Electronically If you receive an option to enable macros when you open the file, select Enable Macros.

If you are not able to make selections or enter text on the form, please adjust your macros security settings. To adjust your settings, open the file. Click on Tools, then move your cursor to Macros, then select Security. On the Security window that appears, select Low, then click OK. Save the file to your workstation. When you reopen it, the form should work properly.

Type Contractor Definitions (Any GSA Service or Office May be Associated with Building Support, Embedded Contractors):

Building Support: Building maintenance or construction support contractor Embedded: “Side-by-side” or white collar contractor providing business services, and may have staff-like access to GSA space and IT systems External: Does not access GSA building or IT systems but requires a check or investigation Child Care: Child care worker

GSA Region Options: Region 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, NCR, or CO

Transmitting the Contractor Information Worksheet Do not save completed forms on your workstation. Per GSA requirements:

If Personally Identifiable Information (PII) needs to be transmitted over the Internet, it must be sent using encryption methods defined in Chapter 5, Paragraph 7 of GSA Order CIO P 2100.1E GSA Information Technology (IT).

o All passwords must be encrypted in storage.

o All sensitive information, such as PII, as deemed by the data owner, which is transmitted outside the GSA firewall, must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.”

o When using password generated encryption keys, a password of at least 8 characters with a combination of letters, numbers, and special characters is required. A password of at least 12 characters is recommended.

o Systems implementing encryption must follow the key management procedures and processes documented in CIO IT Security Procedural guide 09-43, “Key Management.”

If PII needs to be emailed within the GSA network, at a minimum Lotus Notes encryption is required.

For additional protection the information also can be encrypted as described in Chapter 5, Paragraph 7 of this IT security policy.

If PII needs to be sent by courier, printed, or faxed several steps should be taken. When sending PII by courier mark "signature required" when sending documents. This creates a paper trail in the event items are misplaced or lost. Don't let PII documents sit on a printer where unauthorized employees or contractors can have access to the information. When faxing information use a secure fax line. If one is not available, contact the office prior to faxing so they know information is coming and contact them after transmission to ensure they received it. For each event the best course of action is limit access of PII only to those individuals authorized to handle it, create a paper trail, and verify information reached its destination.

Submission Information Check with your GSA regional point of contact for instructions on how to submit the completed form.

Privacy Act Notice In compliance with the Privacy Act of 1974, the following information is provided: Solicitation of the information is authorized by the Federal Property and Administrative Services Act of 1949, as amended, and Part III of Title 5, U.S.C; O. 9397 Disclosure of the information is voluntary. This form will be used as a means to prepare and issue a credential or pass. Information will be transferred to appropriate Federal, State, local or foreign agencies, when relevant to civil, criminal or regulatory investigations or prosecutions, or pursuant to a request by GSA or such other agency in connection with the firing or retention of an employee, the issuance of a security clearance, the investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit. If the individual does not provide some or any part of the requested information, the employee will not be issued a credential and will not be allowed to enter a GSA-controlled building after normal working hours or when the building is under security.

http://gsa.gov/forms

CREDENTIALING APPLICATION FOR Revised 8/06/08 GSA NATIONAL CAPITAL REGION - HSPD-12 Federal ID Application Form

Office phone 202-205-2523 – Fax 202 260-5097 – Hours of Operation 8:00AM to 12:00am and 1:00pm to 4:00 Location: GSA NCR 7th Street. SW, Room 5052 Washington DC 20407

APPLICATANT INFORMATION

Applicant Name:______________________________ Last, First, MI (Please Print Legibly)

Position Title: ________________________________________________

(Required) Contract # ___________________________________________________

(If Contractor) Company Name: _______________________________________________

Address: _____________________________________________________

Telephone Number: (________) _______________________

CONTRACT EXPIRATION DATE _____/______/________

MM DD YYYY

Social Security Number:

DOB: ____________/_____________/_____________

MM DD YYYY

PLACE OF BIRTH (City, State):

Applicant Signature and Date:

Signature Date: _____________

Applicants GSA Office Correspondence Symbol: _____GS Grade______

(Required) Email address : __________________________________________________ (Applicant’s individual email address. Be sure it is accurate)

Office Address: _______________________________________

Building I.D #/ Name:_____________________________________ Room Number______________________

City: ____________________State: __________Zip Code_____________

Telephone: (_____)_____________________

Applicant Home Address:

Street: ______________________________________

City: _______________________________________

State: __________________Zip Code: ____________ Telephone Number: (_____)_____________________

Gender_______ Hair Color: ______________ Eye Color: ____________ Height: _____________ Citizenship: _______________

GSA APPROVING OFFICIAL/SUPERVISOR (SECURITY USE ONLY)

Emergency Responder Code:

None Federal Emergency Response Official Federal Fire Protection Official

GSA Specific Codes:

None Law Enforcement Carrying Firearm

FBI Fingerprints complete? Y or N

NACI complete: Y or N If Yes, Date Completed: _______________

NACI In progress? Y or N If yes, Date Submitted: _________________

Input Date: ________/________/_______ Processed by: _______________________

By signing this form, you are confirming that the above individual is an employee of or contracted by GSA.

Name (print):_____________________________________

Signature: _______________________________________

Date:____________________________________________

Telephone Number:________________________________

PRIVACY ACT STATEMENT:

In compliance with the Privacy Act of 1974, the following information is provided: Solicitation of the information is authorized by the Federal Property and Administrative Services Act of 1949, as amended, and Part III of Title 5, U.S.C; O. 9397 Disclosure of the information is voluntary. This form will be used as a means to prepare and issue a credential or pass.

Information will be transferred to appropriate Federal, State, local or foreign agencies, when relevant to civil, criminal or regulatory investigations or prosecutions, or pursuant to a request by GSA or such other agency in connection with the firing or retention of an employee, the issuance of a security clearance, the investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit. If the individual does not provide some or any part of the requested information, the employee will not be issued a credential and will not be allowed to enter a GSA-controlled building after normal working hours or when the building is under security.