FAA_Contractor Security Program_Vendor Training V-3.8.pdf

Federal Aviation Administration

By:

Date:

Federal Aviation Administration

Presented to: FAA Contract Vendors

Office of Security and Hazardous Materials Safety (ASH) Personnel Security Division (AXP)

Contractor Security Program: Vendor Training

FAA Personnel Security Division

Version 3.8

Agenda

• Policy

• Roles and Responsibilities

• Contract Company (Vendor)

• Contractor Applicant

• Vendor Applicant Process(VAP)

• Access

• Adding and Removing Contractor Applicants

• Reports

• Data integrity

• Contractor Applicant Requirements

• Fingerprint Cards

• eQIP questionnaire

• Investigation Results

• Interim Suitability Determination

• Obtaining an FAA PIV Card

• Questions

Federal Aviation

Why are Contractor Background Investigations required?

Federal Aviation Administration

Investigations are completed to determine the contractors suitability to work on a federal contract in order to authorize access to our facilities, systems, or to Sensitive Unclassified Information (SUI). To accomplish our mission the following Directive and Orders have been implemented:

Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors.

FAR 52.204-9: The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement HSPD-12, Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

FAA Order 1600.1F: establishes the Contractor and Industrial Security Program for the FAA and prescribes related policy, standards, criteria, and guidelines for security screening of contractor employees

FAA Order 1600.78: Federal Aviation Administration delegated responsibility for issuing specific ID cards used FAA-wide to Implement Homeland Security Presidential Directive -12, dated May 10, 2010.

Roles and Responsibilities

CONTRACT COMPANY

POINT OF CONTACT

As the designated point of contact for the FAA’s Vendor Applicant Process (VAP), responsibility includes submitting contract employees for investigations and removing contractors when applicable.

Assisting contractor applicants through background investigation process.

Remaining in communication with the FAA Security Office via the Vendor

Application Program (VAP) to maintain contractor’s work status for the duration of contract.

Notifying FAA CO/COR (within 24 hours) when a contractor completes work obligations or leaves the contract and return FAA PIV cards within 5 business days.

CONTRACTOR

APPLICANT

Federal Aviation Administration

Completing the required investigation forms. Forms that may be required include DOT 1631 Credit release, e-QIP, and work history/resume.

Comply with Requests to obtain (2) sets of fingerprint cards.

Responding to all email/phone calls for data clarification in a timely manner..

Contract Company Vendor

Responsibilities

Federal Aviation

Vendor POC responsibilities Best practice is for the Contract Company/Vendor to identify 1-3 Vendor POCs as well as an established POC for any of the sub-contract company(ies), when applicable.

Contract Award Request access to the Vendor Applicant Process (VAP).

Submit contract employees to the FAA by entering them into the VAP (approximately 30 days before their work obligations begin on the contract); required for any contractor that needs physical (unescorted access to FAA facilities/controlled space), logical (computer/network), and/or access to Sensitive Unclassified Information (SUI).

Contract Close-Out Complete VAP contractor removal process for all contractors related to the FAA contract.

Collection of FAA PIV Card & return to FAA CO/COR or ID Media Office (PIV credential may be returned by mailing to the address identified on the back of the card).

Verification of continued contract obligations for contractors to maintain FAA issued PIV card.

Federal Aviation

Vendor POC responsibilities continued…

Administration

Throughout the contract life Submit contract employees, update contractor’s work status as needed and remove contractors when they are no longer working on the FAA contract via the VAP.

Assist contractor applicants with completion of the investigative forms as needed.

Assist contractor with identifying and scheduling a fingerprint enrollment session. Fingerprint sessions may have a nominal fee which are the responsibility of the contractor.

Ensure that contractor applicants are completing the investigation form requirements and meeting the 15 calendar day processing time frame.

Confirm that contractors have received the appropriate favorable interim suitability determination prior to starting work.

Update contractor information via a new VAP entry as information changes (ex. contractor working a new contract number, contractor name and/or duty location changes).

Provide current contract employee roster as requested.

Vendor Applicant Process

VAP

Federal Aviation

The Vendor Applicant Process (VAP) The VAP system is for ADDING NEW contractors, REMOVING contractors and REQUESTING

REPORTS. The VAP system is NOT to be used for PIV card renewal requests.

It is very important that you use the VAP, as it is a secure website that will help protect the Personally Identifiable Information (PII) of everyone involved. You should never send us PII via email.

You will need to ensure that the contract number your employee will be working under is entered into the VAP. An investigation will not be conducted otherwise.

The Contract Vendor (Prime) should be identified as the company. If the contractor applicant is working for a sub-contracted company the awarded Vendor (Prime) must be identified.

It is your responsibility to ensure that your employees complete this process in the time frame assigned to them. They will not be authorized unescorted access to any FAA facilities without FAA Security approval.

The FAA requires a Background Investigation for contractors when access is needed to FAA facilities, systems, or to Sensitive Unclassified Information (SUI).

VAP Access

Administration

Access Requirement:

Companies are required to provide one (1) contact to be a VAP user. Larger companies may designate up to five (5) contacts.

VAP POC responsible for data integrity. Contract information entered into the VAP must be accurate and include contract number, contract expiration date, FAA contract point of contact.

*Incorrect and or incomplete information may delay contractor investigations being initiated by the FAA Security POC.

Making a VAP Access Request for the VENDOR POC:

Requests to add or remove a Vendor VAP POC must be sent to their Contracting Officer (CO) and/or Contracting Officer Representatives (COR) for coordination with our Contract Management team at 9-ASH-Security-Contract-Customer-Service@faa.gov.

Requests from VAP POCs will be rejected for CO/COR coordination.

A request must include:

1. Name (Full Legal Name)

2. Telephone Number

3. Email address

4. Company Name mailto:9-ASH-Security-Contract-Customer-Service@faa.gov

VAP application Adding a Contractor:

The Add Contractor has several fields to fill in on the ADD option screen. Most fields are mandatory. It is critical that all data, especially the Social Security Number (SSN), is entered correctly. In addition, it is very important for the vendor to get the contractor applicant’s email address correct because an email will be sent to the contractor by a Personnel Security Specialist (PSS).

The VAP remarks section should be used to provide any additional information that may be important (ex. contractor transferring from another contract, identify SPONSOR if different from the CO/COR).

Once all the data is entered, click the Submit button to prepare data to be sent to our Investigative Tracking System (ITS).

No investigative actions will be take on behalf of a contractor applicant until a VAP submission has been received.

DATA VALIDATION is imperative: Ensure contractor information that is entered into the VAP is correct. Information provided (legal “full” names, DOB, SSN, etc.) should be verified prior to entry. This information then should be consistent with all of the contractor applicant’s investigation forms.

Incorrect information delays the contractors ability to start work, hinders their ability to complete investigative requirements and to receive a PIV card.

VAP application continued…

Administration

Removing a Contractor:

The Remove Contractor module allows the vendor POC to inform the PSS of those contractors no longer working on a specific FAA contract. The removal request form is easy to fill in, again with most fields being mandatory. It is crucial that the contract number and SSN fields are entered correctly.

A VAP removal action should be submitted on any contractor no longer support the FAA contract.

Requesting a Report:

The vendor POC enters the contract number and a report will be emailed to the vendor. The purpose is to allow the vendor to reconcile their list of employees with the report.

Note: It is important to use the “remarks” section especially if the contractor has been terminated under derogatory circumstances.

Provide employee Date of Separation (DOS)

Identify if employee is eligible for rehire

Identify if employee left under favorable or unfavorable conditions

The Contractor Applicant

Contractor Applicant

Administration

From the date that FAA initiates the investigation invite, contractors have 15 calendar days to complete all packet requirements.

You should be aware of these items during this investigation phase:

Contractor investigation and FAA PIV card needs are specific to the contractor applicants FAA work obligation.

Applicants will complete the online questionnaire (eQIP), provide two (2) fingerprint cards, an Authorization to Obtain Credit Report (DOT1631 when required), and work history/resume (when required).

Contractors must respond promptly to all FAA inquiries for clarification on application.

When an investigation determination is made, the Vendor POC(s) and FAA CO/COR will be notified by email.

After a favorable investigation decision, contractors must comply with requirements to be issued the FAA PIV card.

The FAA PIV card will take 7-10 days to receive from initial requirements and must be activated immediately.

Contractor Applicant Responsibilities

16Federal Aviation Administration

When a Background Investigation is initiated the Contractor Applicant will be notified via the email and will be requested to complete the following:

Contractor applicant is sent an email notification to obtain two (2) sets of fingerprint cards, to review the Privacy Statement and, when applicable, the DOT 1631 form.

This email identifies the FAA Security Point of Contact (POC) for the contractor’s investigation.

Contractor must return forms and fingerprints to the Security Point of Contact at address identified in the investigation requirements email notification.

Depending on the investigation requirement the contractor applicant may also be required to complete the eQIP questionnaire via the eQIP portal. A registration code and instructions for the eQIP questionnaire will be included in an email notification when this is required.

Note: The Vendor POC and the FAA Official are copied on this initial correspondence.

Investigative Form Requirements

Fingerprint Cards

Administration

Obtaining the Fingerprint Card:

Respond to any request for fingerprint Submission. When requested, two (2) sets of fingerprint cards are required. The acceptable Fingerprint Card forms are the SF- 87 or FD-258.

Fingerprints may be completed by a local police department, a professional fingerprinting service (these options may have a nominal fee that are the responsibility of the contractor) or at an FAA ID Media Office if available.

It is recommended to schedule a fingerprint appointment as soon as the investigative need is identified for the contractor applicant. For some locations it may take a couple weeks to schedule a time.

All identifying information must be completed. PRINT LEGIBLY and ENSURE ACCURACY.

Failure to complete all required information may result in the fingerprint card being rejected.

Person taking the fingerprints must be trained and authorized to officially take fingerprints.

Official taking fingerprints must date, sign and identify their title and address.

Applicant may not take own fingerprints.

*FAA ID Media fingerprint services are available in limited areas. For a list of locations go to:

https://www.faa.gov/about/office_org/headquarters_offices/ash/ash_programs/piv/fingerprint_lo cations/ http://www.faa.gov/about/office_org/headquarters_offices/ash/ash_programs/piv/fingerprint_lo http://www.faa.gov/about/office_org/headquarters_offices/ash/ash_programs/piv/fingerprint_lo

Fingerprint Cards continued…

All hardcopy Fingerprint cards must be mailed to the below address:

ATTN: AXP-XXX (Number of the Investigating Branch identified in investigation invitation e.g. AXP-410) Security Command Center, Bldg. 230, Rm. 110 Federal Aviation Administration 6500 S. MacArthur Blvd.

Oklahoma City, OK 73169 eQIP Questionnaire (via the DCSA portal) The eQIP portal:

To access the eQIP questionnaire go to https://www.dcsa.mil/is/eqip/ via internet explorer.

This form may not be completed on a smartphone.

1. Click “Enter e-QIP”.

2. Click on “Register for Username and Password”.

3. Enter your Social Security Number and click “Submit”

4. Answer the 3 questions and enter the OPM registration code (provided to you), enter the code exactly as provided (case sensitive).

5. You will need to create a Username and Password (14 digits/alphas). Keep the username and password in a safe place.

20Federal Aviation http://www.dcsa.mil/is/eqip/ eQIP Questionnaire continued…

21Federal Aviation Administration

In eQIP, the applicant will complete either the SF-85 Questionnaire for Non-Sensitive Positions or SF- 85P Questionnaire for Public Trust Positions depending on the investigative position requirement.

ALL addresses must be complete and indicate whether it is a street, road, avenue, drive or etc. and include street number.

Residence and employment information must go back 5-7 years (follow term identified in form).

Employment history must identify any periods of unemployment.

If a previously completed e-QIP form exists, the applicant will need to review and update all information where necessary. Information or entries outside the required time frame should be removed.

Incomplete forms will be rejected and returned for completion, this will delay your investigation processing.

Contractor resident and employment information must go back per the term identified in the form with no date breaks.

If the contractor applicant is receiving an error message; the message will identify the reason for the error. Common errors are breaks in employment; these dates must be identified on the form and would be categorized as “dates unemployed”.

The applicant must digitally sign the “Certification Page” and “Release Page” and release the document to the agency.

Investigative Results Interim or Final Suitability Determinations

Federal Aviation

When may the contractor start work?

23Federal Aviation Administration

The Interim or Final Suitability Determination When the contractor has completed all investigation requirements to an accepted standard and a determination has been made, the FAA Security POC will email the notification. This notification is identified as an Interim Suitability Determination (ISD).

If the contractor applicant has previously completed a background investigation with the federal government, then reciprocity may be granted and a Final Suitability Notification letter is sent.

Reciprocity is the acceptance of another agency’s security assessment of the contractor applicant.

ISD notice is emailed to the FAA Official(s) with a copy to the VAP POC(s).

When an Interim notification is provided, the contractor applicant’s investigation may be identified as still in process until a final determination is made. The contractor is required to respond timely to any additional inquiries during this time. Failure to respond will result in a reversal of the initial ISD finding and the contractor will be denied the ability to continue work on the FAA contract.

If a contractor is denied after “due process” then the VAP POC should complete a VAP removal action.

Failure to complete the security process in a timely manner may result in an Interim Suitability being denied and the contractor applicant’s removal from the process

When the interim suitability is denied, the VAP POC may request that the Contractor Applicant still be considered by requesting that the background investigation be completed.

ISD notification types

24Federal Aviation

Obtaining a FAA PIV Card

FAA PIV Card Before obtaining an FAA PIV card a favorable Initial Suitability Determination must be received:

Upon favorable investigative determination notification, the Contract Company POC should complete the identification Card Application (DOT 1681) using the automated system located at https://idms.faa.gov/1681. The application must be completed by the contractor applicant within the FAA firewall and approved by their Sponsor (ex. CO, COR, Facility Mgr).

The Contract Company POC will be notified via email when the identification card application has been approved. An appointment should be made at this time for PIV card enrollment.

The contractor applicant must attend appointment and have a photo taken. Two (2) pieces of valid government issued identification are require at time of appointment (Acceptable identification attachment is available).

The contractor will receive instructions when the FAA PIV card is ready for pick-up. An appointment needs to be made to complete the card activation.

Federal Aviation

FAA PIV Card

Administration

FAA PIV Card National Support Desk. For PIV Card related issues, you may contact the FAA National PIV Support Desk at 1-888-584-8334 or submit your question via email at 9-natl-piv@faa.gov.

Cards lost, stolen, damaged or compromised cards should be reported within three (3) days.

To report, contact the FAA National PIV Support Desk at 1-888-584-8334 or submit notification to 9-natl-piv@faa.gov.

PIV Card Service Locations. An accredited PIV Card Issuer (PCI) can only issue PIV cards.

FAA accredited PCI enrollment issuance locations and ASH security service centers can be found at the following site: https://piv.faa.gov/ServiceCenterHours.htm.

Acceptable Applicant Identification. All applicants shall present two (2) forms of unexpired identity source documents in their original form. Acceptable identity source documents may be requested by contacting your FAA Security POC.

Identification Card Renewal. Cardholders are responsible for ensuring their identification card does not expire. The cardholder must initiate the renewal process at least 15 business days prior to expiration by completing the online Form 1681 located at https://idms. faa.gov/1681/.

mailto:piv@faa.gov mailto:9-natl-piv@faa.gov

Best Practices

32Federal Aviation Administration

Common Reasons for Determination Delays:

Incorrect names and transposed SSN submitted Contractor Applicant not completing fingerprint card requirement Contractor Applicants fail to complete online e-QIP questionnaire Contractor Applicant not addressing e-QIP rejections

Recommendations:

Contract Company should identify responsible POC to track progress and assist applicants through the FAA investigative process.

POC can reach out to the FAA Personnel Security to ensure they understand the process to assist their employees and sub-contractors Contract Company should submit contractor applicant into the Vendor Application Program

(VAP) approximately 30 days prior to contractor applicant needing to start work.

Contract Company should request applicant status if contractor is stating that they have completed all packet requirements and more than (5) business days have passed without an investigation determination notice.

Upon favorable investigative determination, Contract Company should contact the FAA CO/COR to request the FAA PIV card request.

Questions?

Additional training needs? Vendor one-on-one training sessions are available, to request contact the FAA’s Personnel Security Business and Analytics Division (AXP-300).

Federal Aviation

VAP

Interim or Final Suitability Determinations