Attachment 12 FAA Order 1600-1E.pdf

ORDER

1600.1E

PERSONNEL SECURITY PROGRAM

07/25/05

DEPARTMENT OF TRANSPORTATION

FEDERAL AVIATION ADMINISTRATION

1600.1E 7/25/05 ii

1600.1E 7/25/05

TABLE OF CONTENTS

Page No.

FOREWORD i

CHAPTER 1. INTRODUCTION

1. Purpose……………………………………………………………… 1-1

2. Distribution…………………………………………………………. 1-1

3. Cancellation…………………………………………………………. 1-1

4. Explanation of Changes……………………………………………… 1 1-1

5. Forms………………………………………………………………… 1-2

6. References to Days…………………………………………………. 1-2

7. Authority to Change this Order………………………………………. 1-2

8. Objectives……………………………………………………………. 1-2

9. Exceptions to Requirements and Standards………………………….. 1-2

10. Scope…………………………………………………………………. 1-3

11. Policy…………………………………………………………………. 1-3

12. Definitions.............................................................................................. 1-4

CHAPTER 2. GENERAL

1. Responsibilities……………………………………………………… 2-1

2. Safeguarding Rights and Privacy of Applicants and Employees…… 2-4

CHAPTER 3. PERSONNEL SECURITY OPERATIONS AND

RESPONSIBILITIES.

1. General………………………………………………………………. 3-1

2. Standards of Operation……………………………………………… 3-1

3. Personnel Security Operational Responsibilities…………………… 3-1

CHAPTER 4. DESIGNATING POSITION SENSITIVITY AND RISK

LEVELS

1. Position Sensitivity and Risk Level Designation…………………… 4-1

2. Responsibility for Position Sensitivity and Risk Level Designations………………………………………………………….

4-1

3. Risk Levels…………………………………………………………… 4-1

4. Sensitivity Levels…………………………………………………….. 4-2

5. Position Sensitivity and Risk Level Designation Process…………….. 4-2

6. Official Record of Position Risk and Sensitivity Designation……… 4-3

7. Coding of Position Risk and Sensitivity Levels on Personnel Documents…………………………………………………………

4-3

Figure 1. Risk/sensitivity Level Coding……………………………… 4-3

8. Position Risk and Sensitivity Level Designation Procedures................ 4-4

9. Minimum Levels for Certain Positions……………………………….. 4-11 Figure 2. Category of Positions………………………………………. 4-11 ii

07/25/05 1600.1E

10. Regional Level Program Placements…………………………………. 4-12

11. Regional Level Positions……………………………………………… 4-13 Figure 3. Designated Positions……………………………………….. 4-13

CHAPTER 5. PERSONNEL SECURITY INVESTIGATION

REQUIREMENTS AND PROCEDURES

Section 1. Investigative Requirements 5-1

1. General……………………………………………………………….. 5-1

2. Types and Scope of Background Investigations……………………… 5-1

3. Basic Investigative Requirements…………………………………….. 5-3

4. Specific Requirements: Special-Sensitive Positions…………………. 5-6

5. Specific Requirements: Critical-Sensitive Positions…………………. 5-7

6. Specific Requirements: Non-critical-Sensitive Positions……………. 5-9

7. Specific Requirements: High-Risk Positions………………………… 5-9

8. Specific Requirements: Moderate-Risk Positions…………………… 5-10

9. Specific Requirements: Low-Risk Positions………………………… 5-11

10. Specific Requirements for Certain Positions…………………………. 5-11

11. Exceptions to Investigative Requirements……………………………. 5-11 Section 2. Waiver Requirements 5-12

1. Waiver of Pre-placement Investigative Requirements……………….. 5-12

2. Special Procedures for Accelerated Hiring…………………………… 5-19 Section 3. Investigation Process 5-20

1. Initiating, Monitoring, and Closing Investigations…………………… 5-20

2. Additional SSE Investigation…………………………………………. 5-23

3. Reciprocity, Standards and Procedures for Using Previous Investigations………………………………………………………….

5-24

4. Obtaining an Reviewing Previous Investigations…………………….. 5-25 Section 4. Investigative Forms 5-27

1. Forms Required for Investigations……………………………………. 5-27

2. Completion of Forms…………………………………………………. 5-28

3. Originals and Copies…………………………………………………. 5-30

CHAPTER 6. PERSONNEL SECURITY RECORDS

1. Personnel Security Files (PSF) ……………………………………… 6-1

2. Non-selected Applicants……………………………………………… 6-2

3. Transfer of PSF……………………………………………………….. 6-2

4. Separated Employees…………………………………………………. 6-2

5. Protection of Personnel Security Records…………………………….. 6-3

6. Employee Review of PSFs…………………………………………… 6-4

7. Privacy Act Requirements…………………………………………….. 6-5

8. Agreements to Release Personnel Security Records………………….. 6-6 iii

1600.1E 07/25/05

CHAPTER 7. PERSONNEL SUITABILITY STANDARDS, CRITERIA

AND ADJUDICATION

1. General……………………………………………………………….. 7-1

2. Suitability…………………………………………………………….. 7-1

3. Personnel Suitability Standard and Criteria………………………….. 7-2

4. Coordinating Personnel Security Information……………………….. 7-3

5. Suitability Adjudication……………………………………………… 7-3

6. Suitability Adjudication Process……………………………………… 7-4

7. Documentation and Notification……………………………………… 7-5

CHAPTER 8. PERSONNEL SECURITY STANDARDS, CRITERIA, AND

ADJUDICATION

1. Personnel Security Standard and Criteria…………………………….. 8-1

2. Security Adjudication………………………………………………… 8-3

3. Responsibility for Security Adjudications……………………………. 8-3

4. Case Adjudication Procedures……………………………………….. 8-3

5. Timeliness of Adjudications…………………………………………. 8-4

6. Security Adjudication Guidelines……………………………………. 8-5

7. Guideline A: Allegiance to the United States………………………. 8-7

8. Guideline B: Foreign Influence….…………………………………. 8-8

9. Guideline C: Foreign Preference.………………………………….. 8-9

10. Guideline D: Sexual Behavior.…………………………………….. 8-10

11. Guideline E: Personal Conduct…………………………………….. 8-11

12. Guideline F: Financial Consideration………………………………. 8-13

13. Guideline G: Alcohol Consumption………………………………… 8-14

14. Guideline H: Drug Involvement…………………………………….. 8-15

15. Guideline I: Emotional, Mental, and Personality Disorders………… 8-16

16. Guideline J: Criminal Conduct…………………………………….. 8-17

17. Guideline K: Security Violations…………………………………… 8-17

18. Guideline L: Outside Activities…………………………………….. 8-18

19. Guideline M: Misuse of Information Technology Systems…………. 8-18

20. Records to be Maintained…………………………………………… 8-19

CHAPTER 9. ACCESS AUTHORIZATIONS

1. General……………………………………………………………….. 9-1

2. Limitations and Restrictions on Access to Classified Information….... 9-2

3. Request Procedures…………………………………………………… 9-3

4. Interim Clearances……………………………………………………. 9-3

5. Temporary Clearances………………………………………………… 9-5

6. Final Clearances………………………………………………………. 9-6

7. Clearance Granting Procedures and Documentation............................. 9-6

8. Special Access Authorizations……………………………………….. 9-7

9. Terminating Access Authorizations………………………………….. 9-8

10. Visit clearance Requests……………………………………………… 9-9 iv

CHAPTER 10. ADVERSE SECURITY ACTIONS

1. General………………………………………………………………... 10-1

2. Preliminary Actions. …………………………………………………. 10-1

3. Security Clearance Denial, Suspension, and/or Revocation................. 10-1

4. Appeal………………………………………………………….……. 10-3

5. Employment of Individuals Previously Separated for Security Reasons………………………………………………………………

10-4

CHAPTER 11. ACCESS TO AUTOMATED INFORMATION SYSTEMS

1. General…………………………………………………………...... 11-1

2. Access Requirements……………………………………………… 11-1

3. Procedures…………………………………………………………. 11-2

CHAPTER 12. FOREIGN ASSIGNMENTS AND TRAVEL

1. General……………………………………………………………… 12-1

2. Investigative Requirements………………………………………… 12-1

CHAPTER 13. SECURITY CLEARANCES AND AUTHORIZATIONS

FOR IMMIGRANT ALIENS

1. General……………………………………………………………… 13-1

2. Investigative Requirements for Foreign Nationals.............................. 13-1

3. Procedures for Limited Access Authorizations................................... 13-1

4. Procedures for Immigrant Alien Security Clearances......................... 13-1

5. Approval for Visits by Foreign Nationals Cleared by other Agencies……………………………………………………………..

13-2

CHAPTER 14. NATIONAL EMERGENCY PERSONNEL SECURITY

PROCEDURES

1. Purpose……………………………………………………………… 14-1

2. Activation of Standby Procedures………………………………….. 14-1

3. Standby Procedures: Modification of Investigative Requirements………………………………………………………..

14-1

4. Required Plans for Personnel Security Operations During a National Emergency…………………………………………………

14-2

CHAPTER 15. PROGRAM EVALUATION

1. Introduction………………………………………………………… 15-1

2. Program Mission Statement………………………………………… 15-1

3. Evaluation Standards……………………………………………….. 15-1

4. Evaluation Criteria…………………………………………….......... 15-1

5. Responsibilities……………………………………………………... 15-2

6. Preliminary Phase…………………………………………………… 15-4

7. On-site Evaluation…………………………………………………... 15-6 v

8. Findings and Recommendations……………………………………. 15-6

9. Supporting Documentation…………………………………………. 15-6

10. Report Writing and Retention………………………………………. 15-7

APPENDICES

APPENDIX A.

Definitions…………………………………………………………………..

A-1

APPENDIX B.

Sample Letter for DCII Checks……………………………………………..

B-1

APPENDIX C.

Personnel Security Forms……………………………………………………

C-1

APPENDIX D.

Statutory Debarment Issues………………………………………………….

D-1

APPENDIX E.

Investigating Child Care Services Employees………………………………

E-1

APPENDIX F.

DOT F 1631, Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act…………………………

F-1

APPENDIX G.

Security Briefing Guidance for Access to Classified Information

G-1 vi

CHAPTER 1. INTRODUCTION

1. Purpose. This order states personnel security policy under the Department of Transportation (DOT) Order DOT 1630.2, Personnel Security Management, and establishes related standards, criteria, and procedures for the Federal Aviation Administration (FAA) consistent with applicable laws, Executive Orders (E.O.), and Government-wide regulations governing the Personnel Security Program.

2. Distribution. This order is distributed to the division level in headquarters, regions, and centers, with a limited distribution to all field office and facilities.

3. Cancellation. Order 1600.1D, Personnel Security Program, dated February 5, 1998.

4. Explanation of changes. This order:

a. Updates personnel security policy and procedures to include:

(1) New investigative requirements, including the Access National Agency Check with Inquiries, National Agency Check with Law Enforcement Inquiries and Credit, and Child Care National Agency Check.

(2) New waiver procedures for moderate risk positions.

b. Removes all references to the Contractor Security Program which is now found in FAA Orders 1600.72, Contractor and Industrial Security Program, and 1600.73, Contractor and Industrial Security Program Operating Procedures.

c. Delegates the initial responsibility for security clearance denials and revocations to the Director of Internal Security and Investigations, AIN-1, with final authority to the Assistant Administrator for Security and Hazardous Materials, ASH-1.

d. Revises office titles and routing symbols for the ASH organization.

e. Combines certain appendices into chapters.

f. Changes references to current DOT/FAA databases, such as, the Consolidated Personnel Management Information System, Integrated Personnel and Payroll System, etc., to the generic term of FAA-approved databases.

g. Establishes the Personnel Security Program’s evaluation process.

h. Eliminates Appendix 6, Suitability Adjudication Procedures and places it in a Personnel Security Supplement for internal use by ASH personnel.

1-1

5. Forms. Refer to Appendix C, Personnel Security Forms, for a listing of forms used in FAA’s Personnel Security Program.

6. References to Days. In this order, unless otherwise stated, all references to days refer to calendar days.

7. Authority to Change this Order. The Administrator has the authority to approve changes that establish or revise policy, delegate authority, or assign responsibility.

ASH-1 can issue changes to this order as necessary to carry out and manage the Personnel Security Program. ASH-1 must coordinate all changes with the Office of the Secretary of Transportation, Office of Security, M-40.

8. Objectives. The objectives of the Personnel Security Program are to ensure that employment or continued employment of persons in the FAA will promote the efficiency of the service and that the national security will be safeguarded. As the FAA, we must achieve this through consistent application of personnel security standards, criteria, and procedures referenced below.

a. E.O. 10450, Security Requirements for Government Employment, as amended, dated April 27, 1953.

b. E.O. 12958, Classified National Security Information, as amended by E.O. 13292, dated March 25, 2003.

c. E.O. 12968, Access to Classified Information, dated August 2, 1995;

d. Title 5, Code of Federal Regulations (CFR), Parts 731, Personnel Suitability;

732, National Security Positions, and 736, Personnel Investigations.

e. Investigative Standards for Background Investigations for Access to Classified Information, Security Policy Board (SPB) Issuance I-97, approved by the President, dated March 24, 1997.

f. Adjudicative Guidelines for Determining Eligibility for Access to Classified Information, SPB Issuance 2-97, approved by the President, dated March 24, 1997.

g. Investigative Standards for Temporary Eligibility for Access, SPB Issuance 3-97, approved by the President, dated March 24, 1997.

9. Exceptions to Requirements and Standards. ASH-1 has authority to approve any exceptions to the requirements and standards stated in this order including region and center supplements.

1-2

10. Scope. All employees and DOT/FAA-sponsored child care center workers (Appendix E) must apply the provisions of this order. FAA contractor employees are covered under the latest edition of FAA Orders 1600.72 and 1600.73.

11. Policy. As the FAA, we will:

a. Not employ or retain a person in employment unless a determination is made on behalf of the Administrator that the person’s employment will promote the efficiency of the service.

b. Not employ or retain a person in employment by FAA unless a determination is made on behalf of the Administrator that such employment is clearly consistent with the interests of national security.

c. Grant a person eligibility for access to classified information only when facts and circumstances indicate that access to this information is clearly consistent with the national security interests of the United States. We must resolve any doubt in favor of the national security.

d. Ensure that all employees responsible for making suitability and security determinations have completed formal FAA-approved adjudicative training within 1 year from the date of this order, or within 18 months of hiring, if hired after the date of this order.

e. Not grant access to classified information to anyone unless the required background investigation is completed and favorably adjudicated; the person has a need for access to the classified information to perform his or her duties; and the person signed an approved classified information nondisclosure agreement. In exceptional circumstances, the servicing security element can grant access to classified information to persons on whom the required investigations are not completed, consistent with Government-wide requirements for granting interim or temporary access.

f. Afford fair, impartial, and equitable treatment to all our employees and applicants through consistent application of personnel security standards, criteria, and procedures as specified in applicable laws, regulations, and orders. We will not discriminate on the basis of race, color, religion, sex, national origin, disability, or sexual orientation in granting access to classified information, or use the denial of access to classified information as a substitute for appropriate adverse suitability determination or disciplinary actions.

g. Provide all applicants and employees the opportunity to explain or refute any unfavorable information before the information is used as a basis for any adverse personnel, security, or similar action against them.

1-3

h. Not employ any person whom the Secretary of Transportation has removed from employment for national security reasons without the Secretary’s prior approval. This authority cannot be re-delegated.

i. Disclose investigative and personnel security records only to the extent necessary under this order; the latest editions of FAA Order 1200.23, Public Availability of Information; FAA Order 1280.1, Protecting Privacy of Information About Individuals;

and any other orders or directives that implement the Privacy Act and Freedom of Information Act.

12. Definitions. Refer to Appendix A.

1-4

CHAPTER 2. GENERAL

1. Responsibilities.

a. Administrator. The Administrator is responsible for ensuring that the FAA maintains a Personnel Security Program consistent with applicable laws, regulations, and orders. This program ensures that a person’s employment and continued employment with FAA promotes the efficiency of the service and is consistent with national security interests.

b. Assistant Administrator for Security and Hazardous Materials (ASH-1).

ASH-1 has the primary responsibility for carrying out the FAA’s Personnel Security Program, providing general direction for the program throughout FAA, and ensuring that resources needed for conducting an effective program are available and efficiently used.

c. Director, Office of Internal Security and Investigations (AIN-1). AIN-1 is responsible for the Personnel Security Program operations and direct program implementation in the regions, centers, and headquarters; and, in coordination with the Director, Office of Field Operations, AHS-1, for appraising the effectiveness and efficiency of the program. AIN-1 is also responsible for promulgating personnel security standards and guidelines that are applicable throughout FAA.

d. Director, Office of Field Operations (AHS-1). AHS-1 is responsible for Personnel Security Program operations and direct program implementation in the regions and centers.

e. Directors of Offices and Services. Directors of offices and services are responsible for ensuring that their subordinates understand and are complying with Personnel Security Program requirements.

f. Regional Administrators and Center Directors. Regional administrators and center directors are responsible for carrying out and complying with this order in their respective regions and centers.

g. Manager, Personnel Security Division (AIN-400). Under AIN-1, AIN-400, serves as the FAA’s Personnel Security Manager and is responsible for:

(1) Implementing and maintaining an effective Personnel Security Program.

(2) Ensuring compliance with personnel security and suitability investigative requirements.

(3) Assisting the Office of Human Resource Management and operating offices in suitability adjudication.

2-1

(4) Providing appropriate training throughout FAA for designating position risk and sensitivity levels, and for security and suitability adjudication.

(5) Ensuring that position risk and sensitivity levels are properly determined.

(6) Adjudicating security issues, granting security clearances, and, as necessary recommending revocation and denial of security clearances to AIN-1.

(7) Evaluating the effectiveness of the Personnel Security Program.

(8) Preparing consolidated reports for and on behalf of AIN-1, AHS-1, and

ASH-1.

(9) Providing guidance and direction throughout FAA on all personnel security matters.

h. Managers of Servicing Security Elements (SSE). Under AHS-1, the managers of the Security and Hazardous Materials Divisions are responsible for:

(1) Implementing and maintaining an effective Personnel Security Program within their area of responsibility.

(2) Ensuring compliance with personnel security and suitability investigative requirements.

(3) Assisting Human Resource Management Divisions and operating offices in suitability adjudication.

(4) Providing appropriate training throughout their area of responsibility for designating position risk and sensitivity levels, and for security and suitability adjudication.

(5) Ensuring that position risk and sensitivity levels are properly determined.

(6) Adjudicating security issues, granting security clearances, and, as necessary, recommending revocation and denial of security clearances to AIN-400.

(7) Providing guidance and direction throughout their areas of responsibility on all personnel security matters.

i. Managers of Human Resource Management Divisions (Personnel). Personnel managers are responsible for:

2-2

(1) Working with operating offices in collecting and submitting paperwork for required personnel security and suitability investigations on employees and applicants.

(2) Obtaining authorization from their SSE prior to processing personnel actions to place persons in public trust or sensitive positions.

(3) Ensuring that manual and automated master position description records accurately reflect approved position risk and sensitivity level designations.

(4) Adjudicating suitability issues in coordination with their SSE and the operating offices.

(5) Advising management officials regarding adverse actions against employees.

j. All FAA Managers. With respect to personnel security, general management responsibilities include:

(1) Ensuring that persons under their jurisdiction fully understand and are complying with personnel security standards, criteria, and procedures, thus appropriately protecting the interests of national security, the FAA and our employees, and promoting the efficiency of the service.

(2) Obtaining authorization from their SSE prior to processing personnel actions to place persons in public trust and sensitive positions.

(3) Identifying and reporting to their SSE any significant deviation from personnel security standards, criteria, or procedures.

(4) Sharing responsibility with the appointing or approving official for ensuring completion of the required forms for personnel security investigations.

k. Employees. Employees are responsible for:

(1) Familiarizing themselves with pertinent security regulations pertaining to their assigned duties, and the standards of conduct required for persons holding positions of trust. Recognizing and avoiding the kind of personal behavior that could result in rendering them ineligible for continued assignment in such a position. Maintaining continued eligibility for these positions.

(2) Reporting to their SSE any information that raises doubts as to whether another employee's continued eligibility for access to classified information is clearly consistent with the national security, as required by E.O. 12968.

2-3

(3) Protecting all classified information from unauthorized disclosure and reporting all contacts with persons, including foreign nationals, seeking a way to obtain unauthorized access to such information.

(4) Reporting all violations of security regulations to their SSE.

2. Safeguarding Rights and Privacy of Applicants and Employees. If you are the SSE, you must follow and implement the procedures listed below per FAA Orders 1200.23 and 1280.1.

a. You must give applicants and employees an opportunity to explain, refute, or deny any unfavorable information obtained as the result of an investigation before taking any unfavorable action based on that information. This includes denying a benefit to which they would otherwise be entitled.

(1) Applicants and employees have the right to make an oral or written reply.

This practice, commonly known as due process, prevents security from making errors that might otherwise result from mistakes in identity or erroneous information and provides an applicant or employee the opportunity to present mitigating information that is unknown to adjudicating officials.

(2) Provide the applicant or employee with the appropriate Privacy Act advisements as specified in the latest edition of FAA Order 1600.20, Civil Aviation Security Investigations Handbook.

(3) Furnish any records of the unfavorable information, including the employee’s or applicant’s response to the information, only to persons who have a need to know in their official capacity.

b. You must control investigative information gotten under a pledge of confidence keeping the commitment you made to the source of that information.

c. You must control medical information of a sensitive, personal nature obtained in conjunction with an investigation to ensure that it is not disclosed to persons who do not need it for official purposes. Do not use medical information to make a security or suitability determination until it has been properly interpreted by a medical official trained in analysis of the specific type of medical information concerned. If the medical official concludes that it might be harmful to an applicant or employee to see any of the medical information, you must deny access to that information to the person except through a medical official chosen by him or her.

d. You must ensure that all persons to whom information is being disclosed have a need to know it in an official capacity before releasing investigative information to anyone outside your organization. Also, the person receiving the information must ensure that the information is disclosed only to others who have a need to know it in an

2-4 official capacity. All persons reviewing the information will be required to sign FAA Form 1600-12, Investigative Record Review, however, the Subject of the information does not need to sign.

e. You must regard all Personnel Security Files, reports of personnel investigations, personal history statements, records of response to unfavorable information, computerized personnel security data, and other personnel security records and documents as Privacy Act information. Carefully protect them during handling, transmission, release, and storage following the procedures specified in the latest edition of FAA Order 1280.1.

f. If you receive a Freedom of Information Act (FOIA) request for the types of records mentioned in paragraph 2e of this chapter, apply Privacy Act considerations with all procedural requirements listed in the latest editions of FAA Orders 1200.23 and 1280.1.

2-5

CHAPTER 3. PERSONNEL SECURITY OPERATIONS

AND RESPONSIBILITIES

1. General. This chapter prescribes FAA standards and responsibilities for conducting personnel security operations and for maintaining personnel security records.

2. Standards of Operation. FAA’s personnel security operations must meet the following standards:

a. Operations will be conducted at organizational levels where they are closely controlled to ensure compliance with FAA and Department of Transportation (DOT) requirements, and must be managed in an efficient and effective manner.

b. Professionally qualified program managers will direct personnel security operations in servicing security elements (SSE). SSE and Human Resource Management Division (Personnel) managers can delegate responsibility for security and suitability adjudication, but must do so only to specialists who are fully trained to evaluate reports and results of personnel investigations and who have successfully completed an approved personnel security and suitability adjudication course.

c. SSEs will maintain close controls, conduct periodic evaluations as necessary, and closely monitor program operations when an operating office delegates personnel security operations to a field office.

3. Personnel Security Operational Responsibilities. SSEs have the primary responsibility for personnel security operations. However, Personnel and operating office officials will assist them by performing certain personnel security operational duties. The paragraphs below contain basic responsibilities for SSE, Personnel, and operating offices.

a. If you are the SSE, you must:

(1) Designate a program manager who will implement the FAA Personnel Security Program within your area of responsibility.

(2) Ensure that position sensitivity and risk level designations are accurate for all positions within your area of responsibility.

(3) Review investigative forms for completeness, confirm the necessity for investigations, and initiate personnel security investigations as required.

(4) Check national investigations indices for prior investigations concerning applicants and employees.

3-1

(5) Process requests for waiver of pre-placement investigative requirements, as specified in chapter 5, section 2, paragraph 1 of this order. Conduct local agency and other checks as necessary.

(6) Receive results of all investigations on applicants and employees from the Office of Personnel Management (OPM) or other sources. Review investigative reports to determine the adequacy of the investigation and to identify security or suitability issues.

(7) Conduct or arrange for any additional investigation necessary to resolve security or suitability issues.

(8) Provide due process to applicants and employees when required by chapter 2, paragraph 2 of this order.

(9) Make security determinations on all cases involving sensitive positions and grant or deny security clearances. Advise your Personnel and operating offices of these determinations.

(10) When requested, advise and assist your Personnel and operating offices in adjudicating suitability on applicants or employees.

(11) Prepare and conduct, or ensure that your operating offices conduct security briefings for employees as needed.

(12) Provide guidance to your Personnel and operating offices on personnel security policies and operating procedures.

(13) Periodically evaluate the Personnel Security Program to ensure that it is operating effectively and efficiently.

(14) Process visit clearance requests and certify security clearances as necessary.

(15) Advise your Personnel and operating offices of all changes in costs of background investigations.

b. If you are the operating office, you must:

(1) Designate a Personnel Security Coordinator to perform tasks listed in paragraph 3 of this chapter, and notify your SSE whenever a new coordinator is designated.

(2) Recommend position sensitivity and risk level designations on positions under your jurisdiction. On all newly established or revised positions, coordinate

3-2 with your SSE prior to submitting a Standard Form 52, Request for Personnel Action, to designate the sensitivity or risk level per chapter 4, Designating Position Sensitivity and Risk Levels.

(3) Ensure that all Optional Forms (OF) 8, Position Description, or equivalent, either electronic or hard-copy, show the approved sensitivity or risk-level designation, as well as any requirement for access to classified information. Place a remark on the OF-8 indicating the level of access required; i.e., Top Secret, Secret, Confidential, or other.

(4) Ensure that vacancy announcements state that appointment is subject to a favorably adjudicated personnel security investigation enabling the granting of a security clearance, when appropriate

(5) Ensure that before placing, or making any commitment to place a person in a special-sensitive, critical-sensitive, non-critical-sensitive, high-risk or moderate-risk position, your SSE and Personnel office have determined that the pre-placement investigative requirement was met or that an appropriate waiver was granted.

(6) Ensure that you submit a request for waiver to your SSE for processing when emergency conditions exist that may hinder meeting the investigative requirement prior to placement in the position.

(7) Budget for the costs of conducting personnel security investigations, or coordinate with your SSE to ensure budgeting for these costs.

(8) Obtain or assist your SSE and Personnel office in collecting personnel security questionnaires, fingerprints, and other forms as required for personnel security processing and ensure that the forms are submitted in time to initiate investigations.

Identity of the forms can be found in chapter 5, section 4, paragraph 1 of this order.

(9) Conduct or arrange for security briefings for new employees and employees with newly granted security clearances. Periodically conduct or arrange for additional briefings to maintain a high level of security awareness.

(Refer to Appendix G, Security Briefing Guidance for Access to Classified Information.)

(10) Advise your SSE of any questionable conduct or activity by an employee that would raise a security or suitability issue.

(11) Maintain records of the risk and sensitivity levels of your organization's positions.

3-3

(12) Maintain records of the security clearances held by your organization's employees. Maintain records as prescribed by the latest edition of FAA Order 1280.1.

c. If you are the Personnel office, you must:

(1) Coordinate with your SSE on each new or revised position description as needed to ensure that the original OF-8 or equivalent shows the approved risk or sensitivity level.

(2) Ensure that all vacancy announcements contain appropriate information about any investigative or personnel security clearance requirements that are a condition of employment in the position.

(3) Obtain or participate with your operating offices in collecting personnel security questionnaires, fingerprints, and other forms as required for personnel security processing, and ensure that the paperwork is properly completed and submitted in time to initiate investigations. Identity of the forms can be found in chapter 5, section 4, paragraph 1 of this order.

(4) Get available Official Personnel Folder (OPF) data about previous investigation(s) and provide this information to your SSE when an applicant is a current or former Federal employee,

(5) Coordinate with your SSE regarding any information about an applicant that raises a security or suitability issue. This includes information disclosed on an employment application or personnel security questionnaire, or from pre-placement inquiries, including prior employers, the OPF, or any other sources.

(6) Refer any information about an employee that would raise a security or suitability issue to your SSE.

(7) Get approval from your SSE before placing any person in a special-sensitive, critical-sensitive, non-critical-sensitive, or high-risk position. Ensure the requirements of chapter 5 of this order are met.

(8) Maintain accurate and current records of the sensitivity or risk-level designation for each position.

(9) Keep personnel security documents in the OPF as specified in chapter 9, paragraph 7 of this order.

(10) Enter the sensitivity or risk-level designation for each new position in an FAA-approved database.

3-4

(11) Adjudicate and make final suitability determinations, as required, on all cases with significant adverse information, coordinating with your SSE and appropriate operating officials.

d. If you are the Personnel Security Coordinator, you must:

(1) Become familiar with the policies and requirements of this order.

(2) Maintain liaison for your organization with your SSE and Personnel office.

(3) Assist your SSE in determining the risk or sensitivity level of each position in your organization and maintain a record of these designations. Update the records when positions change or are abolished.

(4) Arrange for the prompt submission of necessary forms to initiate personnel security investigations.

(5) Arrange for briefings when employees from your office are granted security clearances, and debriefings when they leave or their clearance is terminated.

(6) Maintain security clearance information for your organizations.

(7) Promptly notify your SSE regarding visits by employees within your organization to other FAA facilities, and to other agencies, when security clearance certifications are required prior to the visits.

(8) Advise your SSE regarding proposed details of persons to your organization whenever the details are to sensitive or public trust positions, and notify them when the detail ends.

(9) Notify your SSE about any questionable employee conduct or activity that raises a security or suitability issue.

(10) Promote an understanding of the Personnel Security Program's purpose and requirements within your organization.

(11) Keep the head of your organization informed of substantive problems affecting implementation of the Personnel Security Program.

(12) Recommend any new or modified procedures or policies believed to be in your organization's best interest to your SSE.

3-5

CHAPTER 4. DESIGNATING POSITION SENSITIVITY AND

RISK LEVELS

1. Position Sensitivity and Risk Level Designation. Human Resource Management Divisions (Personnel) and operating offices must designate positions based on their level of risk in terms of suitability for employment, access to automated information systems (information resources), or level of sensitivity in terms of national security.

a. Risk Level Designation. Personnel and operating offices must designate positions that are not designated as national security positions at a risk level commensurate with the public trust responsibilities and attributes of the position as it relates to the efficiency of the service.

They must rank them according to the degree of adverse impact an unsuitable employee could cause. They must designate positions where the incumbent has access to, or the responsibility for, information resources facilities, systems, or activities at a risk level commensurate with the responsibilities and other attributes of the position based on the extent to which an incumbent could cause damage to information resources or realize significant personal gain.

b. Sensitivity Designation. Personnel and operating offices must designate positions having national security duties at a national security sensitivity level necessary to ensure appropriate screening under E.O. 10450. They must assess the degree of damage that a person occupying a particular position could cause to the national security.

2. Responsibility for Position Sensitivity and Risk Level Designations. The servicing security element (SSE) is responsible for ensuring that correct risk or sensitivity-level designations are determined for every position within its jurisdiction. Personnel and operating offices must coordinate all position risk or sensitivity levels for new position descriptions with their SSE and with headquarters offices and services as necessary to ensure uniform designations for positions common in more than one region or center. Paragraphs 9 and 11 of this chapter list minimum risk levels for certain positions.

3. Risk Levels. There are three position risk levels, as follows:

a. Low Risk. Positions with the potential for impact involving duties of limited relation to the FAA mission with program responsibilities that affect the efficiency of the service.

This level includes positions which have limited impact on information resources.

b. Moderate Risk. Public trust positions with the potential for moderate to serious impact. They involve duties of considerable importance to the agency or program mission with significant program responsibilities and delivery of customer services to the public.

This level includes positions that have significant program responsibilities affecting large information resources.

4-1

c. High Risk. Public trust positions with the potential for exceptionally serious impact involving duties especially critical to the FAA or a program mission with broad scope of policy or program authority. This level includes positions that have major program responsibilities affecting information resources.

4. Sensitivity Levels. There are three sensitivity levels for designating positions with regard to national security:

a. Non-critical sensitive. Positions with the potential for causing serious damage to the national security.

b. Critical sensitive. Positions with the potential for causing exceptionally grave damage to the national security.

c. Special sensitive. Positions that are determined to be at a level higher than critical sensitive because of special requirements other than authority under E.O. 10450.

This category includes all positions requiring access to Sensitive Compartmented Information (SCI).

5. Position Sensitivity and Risk Level Designation Process.

a. SSEs will use the risk-level designation procedures outlined in paragraph 8 of this chapter to ensure that positions are uniformly designated. These procedures include the criteria for designating risk levels based on information resources duties and responsibilities.

They will use the national security criteria for approving sensitivity levels in conjunction with the risk-level designation procedures to ensure proper designation of national security positions.

b. Personnel and operating offices must designate positions requiring access to classified information at one of the three sensitivity levels in paragraph 4 of this chapter. Paragraph 8 of this chapter specifies the minimum sensitivity level for each level of access.

c. In many cases, particularly at the low-risk level, position risk is relatively clear.

Personnel and operating offices may not need to apply all of the specific designating procedures in paragraph 8 of this chapter. Similarly, identical positions may require only occasional case-by-case analysis. Apply specific procedures on at least a random basis to ensure proper designations even when risk levels may appear obvious.

d. Personnel and operating offices can designate national security positions, particularly those requiring Top Secret or SCI access, at the appropriate sensitivity level without applying the more detailed procedures. However, if the duties and responsibilities of the position warrant designation as a high-risk position, designate it at least critical sensitive, even if the level of access required is no higher than Secret.

4-2

6. Official Record of Position Risk and Sensitivity Designation. Personnel and operating offices must document position risk and sensitivity level designations on FAA Form 1600-59, Position Risk/Sensitivity Level Designation Record. The Personnel office is responsible for maintaining all forms unless arrangements are made with their SSE to do so.

The SSE should maintain a copy of the form when the position is designated as sensitive.

FAA Forms 1600-59 can also be maintained electronically in lieu of retaining hard copies. If an FAA Form 1600-59 already exists for a position, it is not necessary to reproduce another one.

7. Coding of Position Risk and Sensitivity Levels on Personnel Documents. The following coding is required for Government-wide use on appropriate personnel documents, such as, the Standard Form (SF) -50, Notification of Personnel Action, and SF-52, Request for Personnel Action. SSEs and Personnel offices must use the coding to record a position's level in the FAA-approved database. Information resources positions, as determined according to paragraph 8 of this chapter, will be identified by the letter C after the numerical coding.

Figure 1. Risk/sensitivity Level Coding

RISK/SENSITIVITY

LEVEL

CODING

High risk 6 Moderate risk 5 Special sensitive 4 Critical sensitive 3 Non-critical sensitive 2 Low risk 1

a. SSEs and Personnel offices must enter information concerning position sensitivity and risk-level designations, investigations initiated and completed, security clearance actions, waivers of investigative requirements, and other information as required by OST into the FAA-approved database. They must promptly enter all information. All employees with responsibility for entering information must ensure that the data maintained in the system are complete, accurate, and current.

b. SSEs and Personnel offices must ensure that the sensitivity or risk-level designation entered into the FAA-approved database for each position matches that shown on all personnel action forms. In any case where it does not, such as on an SF-52, the Personnel office should enter the designation using the coding shown above.

c. The Personnel Security Division, AIN-400, will represent the FAA in all discussions with OST concerning the data to be entered into the security subsystem; format for data entry; which data are mandatory or optional; which offices can view, enter, or change data;

and data archiving and deletion.

4-3

8. Position Risk and Sensitivity-Level Designation Procedures. If you are the Personnel or operating office, you must use the process specified in this paragraph to provide a systematic way of uniformly designating position risk and sensitivity levels. Designate each agency program for its impact and scope related to the efficiency of the service (program placement) and then designate each position for its degree of risk to its program (tentative risk level). This paragraph also contains specific program placements for offices and divisions at the region level and minimum risk and sensitivity-level requirements for certain FAA positions. (Refer to paragraphs 9 through 11 of this chapter.)

a. Sensitivity-level designation.

(1) You must designate all sensitive positions having national security duties requiring access to classified information as either non-critical sensitive, critical sensitive, or special sensitive. Listed below are the minimum sensitivity levels to use for positions requiring access to specific levels of classified information. Record the level of access which makes a position sensitive as a final adjustment factor (block IV) on FAA Form 1600-59. You must designate:

(a) positions requiring access to Confidential or Secret information at least non-critical sensitive;

(b) positions requiring access to Top Secret information at least critical sensitive;

and

(c) positions requiring access to SCI as special sensitive.

(2) You must designate all Executive positions as critical sensitive.

(3) SSEs only need to document the designation when it is apparent that the risk-level criteria described below would not affect a sensitivity-level determination. For example, if a position requires access to SCI, automatically designate the position as special sensitive regardless of other risk factors involved.

b. Risk-level designation. The risk-level designation process consists of designating each position for its degree of risk to its program, and making any final adjustments necessary because of unique factors specific to certain positions or to ensure organizational uniformity of operations.

(1) Program placement. Personnel and operating offices must follow the procedures below when determining program placement.

(a) Determine the program's impact on the efficiency of the service by identifying the area of primary program focus and then relating that area to one of the impact descriptions (major, substantial, moderate, or limited) listed in the left column of Chart A. The area of primary focus will be one of the following:

4-4

1 Accounting for, auditing, or disbursement of public funds;

2 Administrative, regulatory, or policy control over public and private programs or operations;

3 Protection of the national security;

4 Enforcement of Federal laws; or

5 Protection of life or property.

(b) If a program has more than one area of primary focus, or if questions arise as to placement of a program at one of two impact descriptions, base a decision on the best interests of the FAA's mission.

(c) Determine the program's scope of operations in terms of the efficiency of the service, choosing from one of the scopes (worldwide, Government-wide, multi-agency, or agency) listed across the top of Chart A.

(d) Use Chart A to determine program placement (major, substantial, moderate, or limited).

(2) Position risk points and tentative risk level. Consider the duties and responsibilities of the position, in the context of the program and the risk the position has for damage or abuse to the program, when determining position risk points.

Determine the degree of impact on the program of each of five risk factors and the assignment of points to each risk factor. Combine the sum of the risk points and the program placement to determine the tentative risk level. Follow the specific procedures below:

(a) Determine the degrees of impact for each of the five risk factor descriptions shown across the top of Chart B. For all of the factors except supervision received, use the degree descriptions shown in the left column. For supervision received, use the degree descriptions shown in the right column.

(b) Assign a point value for each risk factor to numerically reflect the degree of impact. The greater the impact, the more points assigned. Although Chart B only shows point values of 1, 3, 5, and 7, points may be assigned at the 2, 4, and 6 values to reflect borderline determinations.

(c) Add the point values for each of the risk factors to determine the total risk points.

(d) Use Chart C to find the tentative risk level, applying the program placement determined above (left column) and the total risk points (top of the chart).

4-5

CHART A

Scope of Operations

IMPACT

WORLDWIDE:

Operational activity is carried out worldwide, with primary focus in either the public or the private sector.

GOVERNMENTWIDE

Operational activity is carried out Government-wide, to all sectors, with primary focus on the public sector Government-wide.

MULTI-AGENCY:

Nationally or regionally with primary focus extending to more than one agency in the public sector, or to the elements in the private sector impacted by the agencies.

AGENCY:

Operations of the agency, or an agency’s region or area, with primary focus extending to the elements in the private sector impacted by the agency.

MAJOR: Impacts directly on the survival, stability, and continued effectiveness of Government operations, the promotion of major Government fiscal goals, or a primary social, political, or economic interest of the Nation.

MAJOR MAJOR SUBSTANTIAL MODERATE

SUBSTANTIAL: Impacts directly on the efficiency and effectiveness of a sizeable segment of the Federal work force, or the interests of large numbers of individuals in the private sector.

MAJOR

SUBSTANTIAL

MODERATE

MODERATE: Impacts directly on the effectiveness of an agency’s operations, the fiscal interests of an agency, or affects the social, political, or economic interests of individuals, businesses, or organizations in the private sector.

SUBSTANTIAL MODERATE MODERATE LIMITED

LIMITED: Limited impact on the operational effectiveness of one or a few programs in an agency, or the interests of a limited number of individuals in the private sector.

MODERATE MODERATE LIMITED LIMITED

Program Placement

4-6

CHART B

RISK FACTOR DESCRIPTIONS

DEGREE DEGREE OF PUBLIC

TRUST:

FIDUCIARY MONETARY

RESPONSIBILITY:

The consensus of confident expectation for honesty, integrity, reliability, responsibility, or justice placed in a position.

Authority or ability to obligate, control, or expend public money or items of monetary (bonds, etc.) value.

IMPORTANCE TO

PROGRAM:

Impact the individual position has, due to status, in or influence on the program as a whole, either…