NPR_1600_004A.pdf

| NODIS Library | Organization and Administration(1000s) | Search |

NASA

Procedural Requirements

NPR 1600.4A

Effective Date: April 08, 2016

Expiration Date: April 08, 2021

COMPLIANCE IS MANDATORY

Identity and Credential Management

Responsible Office: Office of Protective Services

NAII 1600.4A, Foreign National Access Management (FNAM) Operations Manual

Table of Contents Preface P.1 Purpose P.2 Applicability P.3 Authority P.4 Applicable Documents and Forms P.5 Measurement/Verification P.6 Cancellation

Chapter 1. Introduction

1.1 Overview

1.2 Scope

1.3 Waivers and Exceptions

Chapter 2. Roles and Responsibilities

2.1 Overview

2.2 Agency Roles and Responsibilities

2.3 Center Roles and Responsibilities

2.4 Separation of Duties for the PIV Role

2.5 Training

2.6 Privacy

Chapter 3. Enrollment and Credential Issuance

3.1 Overview

3.2 Chain of Trust

NPR 1600.4A -- TOC Verify current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 1 of 58

NPR 1600.4A -- TOC Verify current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 1 of 58 https://nodis3.gsfc.nasa.gov/main_lib.html https://nodis3.gsfc.nasa.gov/lib_docs.cfm?range=1___ https://nodis3.gsfc.nasa.gov/adv_search.cfm http://nodis3.gsfc.nasa.gov/

3.3 NASA Credential Types

3.4 Applicant Categories

3.5 On-Site Enrollment and Issuance Procedures for NASA Credentials

Chapter 4. Foreign Nationals

4.1 Overview

4.2 NASA Foreign National Access Policy and Related Requirements

4.3 On-Site Enrollment and Issuance Procedures for Foreign Nationals

4.4 Implementation

4.5 Identity Vetting Requirements

4.6 Requirements for Visas

4.7 Requirements Based on Type of Onsite Affiliation

4.8 Requirements Based on Visitor Attributes

4.9 Requirements Based on Credential Type

4.10 Requirements for Remote-Only Access

Chapter 5. Characteristics of NASA Badges

5.1 NASA Credential Types

5.2 NASA PIV Credential Data

5.3 The Uniform Universal Personal Identification Code (UUPIC)

Chapter 6. PIV Credential Management Lifecycle

6.1 PIV Credential Inventory

6.2 PIV Credential Storage and Handling

6.3 Final Adjudication and Subsequent Investigation

6.4 Credential Usage: Display, Protection, and Proper Usage

6.5 PIV Credential Renewal

6.6 PIV Credential Re-issuance

6.7 PIV Credential PIN Reset

6.8 PIV Credential Revocation

6.9 Lost and Stolen Credentials

6.10 Forgotten Credentials

6.11 PIV Credential Suspension

6.12 PIV Credential Return

6.13 PIV Credential Termination

6.14 PIV Credential Destruction

Appendix A: Definitions Appendix B: Acronyms Appendix C: NASA PIV Photo Identification Badge Standards Appendix D: Subscriber Agreement Appendix E: References

NPR 1600.4A -- TOC Verify current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 2 of 58

NPR 1600.4A -- TOC Verify current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 2 of 58

Preface P.1 Purpose

a. This National Aeronautics and Space Administration (NASA) directive establishes Agency-wide identity, credential, and access management policy and establishes high-level implementation requirements as set forth in NASA Policy Directive (NPD) 1600.2, NASA Security Policy, as amended. Identity, credential, and access management are the activities that deal with identifying individuals and controlling their access to resources (e.g., facilities and information technology (IT) systems) by associating user rights and restrictions with the established identity.

b. This NASA directive prescribes personnel responsibilities and procedural requirements for the creation, usage, and management of identities and the creation and issuance of identity credentials to assist NASA Centers and Component Facilities in executing the NASA security program to protect people, property, and information.

P.2 Applicability

a. This NASA directive is applicable to NASA Headquarters and NASA Centers, including Component Facilities and Technical and Service Support Centers. This language applies to Jet Propulsion Laboratory (JPL), a Federally Funded Research and Development Center (FFRDC), employees, JPL personnel, other contractors, grant recipients (to include recipients of cooperative agreements), or parties to agreements only to the extent specified or referenced in the appropriate contracts, grants, or agreements.

b. This NASA directive is applicable to all other personnel completing work through Space Act Agreements, Memorandums of Agreement/Understanding, or other applicable agreements, those assigned or detailed under the Intergovernmental Personnel Act, partners, and visitors.

c. In this directive, all mandatory actions (i.e., requirements) are denoted by statements containing the term "shall" or "must." The terms: "may" or "can" denote discretionary privilege or permission, "should" denotes a good practice and is recommended, but not required, "will" denotes expected outcome, and "are/is" denotes descriptive material.

d. In this directive, "NASA directives" refers to both Agency-level and Center-level directives.

e. In this directive, all document citations are assumed to be the latest version unless otherwise noted.

f. This directive is applicable to NASA directives developed or revised after the effective date of this NPR.

P.3 Authority National and Commercial Space Programs, 51 United States Code (U.S.C.) § 20132, Public Law (Pub. L.) 111-314, 124 Stat. 3328 (2010).

P.4 Applicable Documents and Forms

NPR 1600.4A -- Preface Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 3 of 58

NPR 1600.4A -- Preface Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 3 of 58

a. E-Government Act of 2002, 44 U.S.C. § 101.

b. Privacy Act of 1974, 5 U.S.C. § 552a.

c. Rehabilitation Act of 1973, 29 U.S.C. § 701.

d. Paperwork Reduction Act of 1980, 44 U.S.C. §§ 3501-3521.

e. Fraud and Related Activity in Connection with Computers, 18 U.S.C. § 1030.

f. Numbering System for Federal Accounts Relating to Individual Persons, Executive Order (E.O.)

9397, (1943).

g. Exchange Visitor Program, 22 CFR 62.

h. Office of Management and Budget (OMB) Memo M-05-24, August 5, 2005, "Implementation of Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standards for Federal Employees and Contractors."

i. NASA Procedural Directive (NPD) 1050.1, Authority to Enter Into Space Act Agreements.

j. NPD 1382.17, NASA Privacy Policy.

k. NPD 1440.6, NASA Records Management.

l. NASA Procedural Requirement (NPR) 1382.1, NASA Privacy Procedural Requirements.

m. NPR 1441.1, NASA Records Retention Schedules.

n. NPR 1600.1, Security Program Procedural Requirement.

o. NPR 1600.3, NASA Personnel Security.

p. NPR 1660.1, NASA Counterintelligence and Counterterrorism.

q. NPR 2190.1, NASA Export Control Program.

r. NPR 2200.2, Requirements for Documentation, Approval, and Dissemination of NASA Scientific and Technical Information.

s. NPR 2810.1, Security of Information Technology.

t. NPR 2841.1, Identity, Credential, and Access Management Services.

u. NASA Identity Management and Account Exchange (IdMAX) System.

v. Department of Homeland Security, United States Customs and Border Protection, Form I-94, Arrival/Departure Record.

w. Homeland Security Presidential Directive 12 (HSPD-12), April 27, 2004.

x. Federal Information Processing Standards Publication (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors.

y. Federal Identity Credential and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011.

z. NIST SP 800-79-2, Guidelines for the Certification and Accreditation of Personal Identity Verification Card Issuers.

NPR 1600.4A -- Preface Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 4 of 58

NPR 1600.4A -- Preface Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 4 of 58

aa. NIST SP 800-104, A Scheme for PIV Visual Card Topography.

bb. Office of Personnel Management Electronic Questionnaire for Investigation Processing (e-QIP) System.

cc. Office of Personnel Management (OPM) Federal Investigations Notice No. 10-05, May 17, 2010, "Reminder to Agencies of the Standards for Issuing Credentials under HSPD-12."

P.5 Measurement/Verification To determine compliance with this NASA directive, the Office of Protective Services (OPS) shall provide assessments/audits of the application of this policy requirement. This will consist of periodic reporting from the Centers, including information collected for the satisfaction of OMB. The specific metrics utilized will conform to those described in the latest version of the Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance.

P.6 Cancellation

a. NPR 1600.4, Identity and Credential Management, dated August 12, 2012.

b. Memorandum for Center Directors, dated April 2, 2014, "Interim Policy Regarding Foreign National Access Management."

NPR 1600.4A -- Preface Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 5 of 58

NPR 1600.4A -- Preface Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 5 of 58

Chapter 1. Introduction

1.1 Overview

1.1.1 In recent years, the Federal Government has increased emphasis on improving the physical and logical security of the hundreds of thousands of facilities that it owns and leases, as well as the Information Technology (IT) systems to support the diverse mission work of Federal agencies. The Government Accountability Office (GAO) has identified the need to develop a common framework that includes key practices for guiding agencies' physical security efforts, such as employing a risk management approach to facility protection, leveraging advanced technology (e.g., smart cards), improving information sharing and coordination, and implementing performance measurement and testing. (See http://www.gao.gov/new.items/d0549.pdf). GAO has also outlined the need for standard performance metrics to evaluate the effectiveness of physical security protections.

1.1.2 This NASA directive establishes the policies and high-level procedures that shall be used throughout NASA to achieve the improvements in physical security protections required by GAO.

Strong Identity, Credential, and Access Management (ICAM) practices and adherence to the Federal common framework for ICAM as outlined in the Federal ICAM (FICAM) Roadmap Guidance Document will address any weaknesses within NASA's physical security infrastructure.

1.1.3 Identity management and credential management allows the identity of an individual to be verified in the digital realm, so that identity can be trusted to conduct business. Even low-risk employees possess access behind physical and logical safeguards that can give them unprecedented access to critical information and systems. This document seeks to establish a common, standardized basis for ICAM within NASA.

1.1.4 ICAM business processes include all the processes necessary to support proofing and vetting the identity of all people requiring access (physical, logical, or both) to NASA resources. ICAM business processes also include all the necessary processes for issuing credential and granting access based on favorable identity proofing and vetting. The governance structure that has been established for ICAM business processes is documented in NPR 2841.1, Identity, Credential, and Access Management Services.

1.2 Scope

1.2.1 The policies and procedures identified within this document define the approved processes for NASA to manage personal identities and the issuance of NASA Personal Identity Verification (PIV) credentials. This NPR also establishes the policy for the management of other types of NASA non-PIV credentials, visitor badges, and alternate Agency credentials. Non-PIV logical access tokens are not covered in this document. Use of vetted and bound identity for physical access is covered by NPR 1600.1, and logical access is covered by NPR 2810.1 Security of Information Technology. The policies and procedures for granting remote only IT access to foreign nationals are described in this NPR (see section 4.10). The policies and procedures necessary to properly manage ICAM services as an integrated end-to-end service to improve security, efficiency, and inter-Center collaboration are covered in NPR 2841.1.

1.2.2 The terms "PIV credential" and "non-PIV credential" are used frequently in this document. The term "PIV credential" refers to the credential which is issued to civil service and contractor employees who need physical or logical access to NASA facilities and IT systems for 180 calendar days or more in a 365-day period. NASA's procedures for issuing PIV credentials must conform to

NPR 1600.4A -- Chapter1 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 6 of 58

NPR 1600.4A -- Chapter1 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 6 of 58 days or more in a 365-day period. NASA's procedures for issuing PIV credentials must conform to Homeland Security Presidential Directive 12 (HSPD-12). All other credentials issued by NASA are referred to as "Non-PIV" credentials. Non-PIV credentials include such things as: visitor badges, alternate Agency credentials, and other credentials as specified in NPR 2841.1.

1.3 Waivers and Exceptions

1.3.1 Centers might occasionally experience difficulty in meeting specific requirements established in the series of NASA security program NPRs and may request waivers and/or exceptions to those specific requirements. The process for submitting requests for waivers or exceptions to specific elements of the NASA Identity and Credential Management program is as follows:

a. The Asset, Program, or Project Manager and Center Chief of Security (CCS)/Chief of Protective Services (CCPS) shall justify the exception request through security risk analysis: e.g., cost of implementation; effects of potential loss of capability to the Center; compromise of national security information; injury or loss of life; loss of one-of-a-kind capability; or inability to perform its missions and goals, etc.

(1) Justification will also include an explanation of any compensatory security measures implemented in lieu of specific requirements.

(2) The exception request shall be submitted to the Center Director.

b. The Center Director shall confirm that the exception request has the concurrence of both the CCS/CCPS and, as necessary, the Center Chief Information Officer (CIO). The Center Director will then either recommend approval or return the exception request to the CCS/CCPS for further study or closure. The Center Director forwards concurrence to the Mission Support Directorate Associate Administrator at NASA Headquarters.

c. The Mission Support Directorate Associate Administrator shall forward exception requests to the Assistant Administrator (AA) for the Office of Protective Services (OPS) at Headquarters or return proposals to the Center Director for further study or closure. Approval authority of the waiver or exception request resides with the Mission Support Directorate Associate Administrator.

d. The AA for Protective Services will coordinate implementation of any approved waiver or exception for further study or denial and closure.

NPR 1600.4A -- Chapter1 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 7 of 58

NPR 1600.4A -- Chapter1 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 7 of 58

Chapter 2. Roles and Responsibilities

2.1 Overview

2.1.1 All NASA employees and contractor employees, as well as NASA tenants and contractors for NASA tenants, shall comply with this directive. Government, commercial, educational, or private entities and their employees and contractors (all tiers) needing physical or logical access will also comply with this directive.

2.1.2 The AA for OPS is the system owner of all systems used to manage identities and to issue NASA PIV credentials. The AA for OPS has overall responsibility for ensuring uniformity of credential issuance policies and procedures throughout the Agency.

2.1.3 All NASA organizational components must adhere to the policies and procedures herein and promulgate implementing regulations, as required, consistent with the policies and procedures set forth herein. Center Directors, through their Center OPS, supported by the Center Office of the Chief Information Officer (OCIO), Center Human Resources Office (HRO), Procurement Office, and other offices as necessary will ensure that local operating procedures and execution conform to the policies and procedures herein.

2.1.4 The following roles and responsibilities are established to conform to the guidelines prescribed in National Institute of Standards and Technology (NIST) Special Publication 800-79-1, "Guidelines for the Accreditation of Personal Identity Verification Card Issuers."

2.1.5 Failure to comply with the policies and procedures set forth in this NPR and NPR 2841.1 shall be treated as a violation of security requirements, per NPR 1600.1, section 2.3, and must be reported as a security incident to the CCS/CCPS and the Agency Identity Management Official (AIMO).

2.2 Agency Roles and Responsibilities

2.2.1 Personal Identity Verification (PIV) Card Issuer (PCI) Senior Authorizing Official (SAO) — The AA for OPS shall be the PCI SAO for Identity and Credential Management. The PCI SAO establishes budgets and provides oversight for the identity management and credential management functions and services of NASA. The PCI SAO documents all identity management and credential management responsibilities, roles, and procedures to be followed by NASA. The PCI SAO identifies and designates qualified individuals to the roles of PCI Designated Accreditation Authority (DAA), PCI Assessor, PCI AIMO, and other NASA officials that are involved with Agency identity management. The PCI SAO establishes appropriate attributes and assessment methods for a certification and accreditation, per NIST Special Publication 800-79-1, of the programs and procedures established in this document for the issuance of credentials. The PCI SAO ensures consistent application of this policy across NASA.

2.2.2 PCI AIMO — The PCI AIMO shall be a Federal employee. The PCI AIMO manages the identity management program at NASA and documents the policies and operations of the identity management program in this and other supporting documentation. The PCI AIMO ensures that all personnel, services, facilities, and/or equipment necessary to carry out the policies in this document are procured, updated, and provided reliably. The PCI AIMO ensures that credentials are produced and issued in accordance with the requirements in this document. The PCI AIMO approves all authorizer and investigation reviewer designations. The PCI AIMO recommends and executes an action plan to reduce or eliminate deficiencies and discrepancies identified by the assessor during the

NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 8 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 8 of 58 certification and accreditation (C&A).

2.2.3 PCI Designated Accreditation Authority (DAA) — The Deputy AA for OPS shall be the PCI DAA. The PCI DAA reviews the certification documentation and the recommendation prepared by the PCI assessor and accredits the PCI as required by Homeland Security Presidential Directive (HSPD)-12. Through accreditation, the DAA accepts responsibility for the operation of the PCI at an acceptable level of risk to NASA. The SAO can also fulfill the role of the DAA.

2.2.4 PCI Assessor — The PCI assessor shall be a Federal employee. The PCI assessor will be organizationally separate from the persons and the office(s) directly responsible for the day-to-day operation of identity management for the Agency and correction of deficiencies and discrepancies identified during the certification. The PCI assessor will have the appropriate skills, resources, and competencies to perform certifications of the Agency. The PCI assessor conducts the PIV C&A, per

NIST SP 800-79-1.

2.2.5 NASA Enterprise Applications Competency Center (NEACC) — The NEACC provides hosting and management for core ICAM services. The NEACC provides help desk support for the systems implemented for identity management and credential management including trouble ticket management and procedures for handling escalation. The NEACC formally interfaces with appropriate service, security, support groups, and organizations as required, provides access to technical and user training, computer-based training, and maintains records related to this training.

2.3 Center Roles and Responsibilities

2.3.1 The Center PIV Issuing Facility (PIF) Manager — The Center PIF manager shall be a Federal civil service employee serving as the CCS/CCPS or equivalent role designation at a Center or a designee of the Chief. The PIF manager supports the PCI AIMO at the Center level. The PIF manager oversees the identity management and credential management program implementation at the Center and documents the operations and procedures of the Center's identity management and credential management programs. The PIF manager or designee validates the individuals at the Center who perform the roles of PIV requester and PIV sponsor. The PIF manager or designee monitors training status of all persons fulfilling PIV identity management and credential management roles at the Center. The PIF manager identifies and designates individuals to fill the roles of PIV authorizer, PIV enrollment official, and PIV issuance official. The PIF manager is responsible for ensuring that all personnel, services, facilities, and/or equipment necessary to carry out the policies in this document at the Center are procured, updated, and provided reliably. The PIF manager is responsible for ensuring that credentials are produced and issued in accordance with the requirements in this document. The PIF manager or designee reviews identity source document discrepancies and provides determinations for the acceptance of the documents. The PIF manager or designee is responsible for issuance of all non-PIV credentials (i.e., visitor badges, temporary badges, and alternate Agency credentials).

2.3.2 PIV and non-PIV Applicant — Per Federal Information Processing Standards (FIPS) 201-2, the PIV applicant is the individual to whom a PIV credential needs to be issued. The PIV applicant is a prospective or current NASA worker (e.g., a civil servant or an employee of a Federal contractor), requiring access to NASA facilities and/or IT resources. The PIV applicant is responsible for providing identification documents and data for the PIV request, for being photographed and providing biometrics during enrollment, and providing valid identity documents during enrollment and issuance. The PIV applicant signs for acceptance of the PIV credential and acknowledgement of related responsibilities for proper handling and use of the PIV credential once issued, as defined in Appendix D: Subscriber Agreement of this document. PIV applicants will not perform any role in the creation of their identity and issuance of their credential with the exception of the role of

NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 9 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 9 of 58 requester for the purpose of renewal and reissuance.

2.3.3 PIV and non-PIV Requestor — The role of PIV requestor is not defined in FIPS 201-2. The PIV requestor is the individual who submits the necessary information on behalf of the PIV applicant to initiate the process of requesting a PIV credential. The non-PIV requestor is the individual who submits the necessary information on behalf of the non-PIV applicant to initiate the process of requesting a non-PIV credential.

2.3.4 PIV and non-PIV Sponsor — The PIV sponsor is defined in FIPS 201-2 as the individual who substantiates the need for a PIV credential to be issued to the PIV applicant and provides sponsorship to the PIV applicant. The PIV sponsor requests the issuance of a PIV credential to the applicant. The PIV sponsor shall be a NASA civil servant employee or a California Technical Institute Jet Propulsion Laboratory employee who establishes and endorses the need for a relationship between the applicant and NASA. The PIV sponsor designates and approves the position risk determination (PRD) in the NASA Identity Management System. The PIV sponsor corrects or completes, as necessary, incorrect or missing information in the credential issuance request. The PIV sponsor is responsible for tracking the status of persons and reporting where access should be modified or terminated. The PIV sponsor is an individual from the identified entity for the following applicant affiliation:

a. Human Resource (HR) specialist for NASA civil service employees.

b. Contracting Officer's Representatives (COR) or other Federal civil service technical personnel responsible for work requirements for contractors.

c. Grants technical official for grantees.

d. Authorizing official or designee for any agreement between NASA and any outside entity.

e. The NASA civil servant program or project manager who requires the foreign national to access NASA facilities or IT systems.

2.3.5 PIV and non-PIV Enrollment Official — The PIV enrollment official covers a portion of the duties that are described in FIPS 201-2 for the PIV registrar. The PIV enrollment official is the entity responsible for identity proofing of the PIV applicant and ensuring the successful collection of the information necessary to confirm employer sponsorship, bind the applicant to their biometric data, and validate the identity source documentation. The role of the PIV enrollment official shall be performed by personnel from the Center Protective Services Office. The PIV enrollment official collects, establishes, and verifies identity information of an applicant. The PIV enrollment official captures the biometrics and photograph of the applicant. The PIV enrollment official checks identity source documents for authenticity, captures copies and/or scans of the identity source documents, compares the name and demographic data in the PIV credential request and the identity source documents, and determines whether any discrepancies exist. The non-PIV enrollment official performs the equivalent functions for non-PIV credentials as the PIV enrollment official does for PIV credentials.

2.3.6 PIV and non-PIV Authorizer — The PIV authorizer covers the portions of the PIV approval duties described in FIPS 201-2 that are not done by the PIV enrollment official. The PIV authorizer provides the final approval for the issuance of the PIV credential to the applicant. The PIV authorizer and the non-PIV authorizer shall be a NASA civil servant. The PIV authorizer and the non-PIV authorizer will hold no other role in the identity management or credential issuance process for a given identity. The PIV authorizer will hold no role other than the role of applicant in the issuance of their credential. The PIV authorizer and the non-PIV authorizer will be trained in adjudication by an accredited provider of adjudication training. The PIV authorizer reviews the PIV credential request, NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 10 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 10 of 58 reviews the PIV sponsor's endorsement, and confirms identity source document validation and biometrics capture has occurred. The PIV authorizer coordinates checks for existing background investigations. The PIV authorizer coordinates requests for background investigations as necessary.

The PIV authorizer coordinates background investigation submissions through the OPM Electronic Questionnaire for Investigation Processing (e-QIP), as required. The PIV authorizer adjudicates the results of the fingerprint check and adjudicates background investigation results. The PIV authorizer records the results of the fingerprint check and background investigation results and approves or denies NASA PIV credential issuance. The PIV authorizer records the final result of adjudicated investigations and, when the adjudicated investigations are favorable, authorizes continued use of an issued PIV credential, as required in NPR 1600.3, NASA Personnel Security.

2.3.7 PIV and non-PIV Investigation Reviewer — The PIV investigation reviewer is an optional role within NASA that is not described in FIPS 201-2. The PIV investigation reviewer may be a civil servant or a designated contractor. The PIV investigation reviewer shall not be allowed to authorize production or issuance of a NASA PIV credential. The PIV investigation reviewer assists the PIV authorizer with:

a. Reviewing the PIV credential request, the PIV sponsor's endorsement, and confirming that identity source document validation occurred and that biometrics capture has occurred.

b. Coordinating checks for existing background investigation.

c. Coordinating requests for background investigations, as necessary.

d. Coordinating background investigation submissions through the OPM e-QIP, as required.

e. Reviewing the results of the fingerprint checks and background investigation as they are received.

f. Recording results of the fingerprint check.

g. Updating PIV applicant information when necessary.

2.3.8 PIV and non-PIV Issuance Official — The PIV issuance official is defined in FIPS 201-2 as the PIV issuer. The PIV issuer is the entity that performs credential personalization operations and issues the identity credential to the applicant after all identity proofing, background checks, and related approvals have been completed. The PIV issuance official is also responsible for maintaining records and controls for PIV credential stock to ensure that stock is only used to issue valid credentials. The role of the PIV issuance official shall be performed by personnel authorized by the CCS/CCPS. The PIV issuance official issues NASA PIV credentials to approved PIV applicants.

The PIV issuance official is responsible for submitting the order for the PIV credential to be encoded and printed with the appropriate identity information. The PIV issuance official verifies the applicant's identity through visual and biometric verification prior to issuing the NASA PIV credential. The PIV issuance official ensures the applicant has selected a Personal Identification Number (PIN). The PIV issuance official secures, receives, accounts for, and handles unissued NASA PIV credential stock and NASA PIV credentials that are no longer authorized for use due to termination of employment, badge expiration, contract or grant expiration, or expiration of need for the badge by any individual.

2.3.9 PIV Digital Signatory — The PIV digital signatory is the entity that digitally signs the PIV biometrics and Cardholder Unique Identifier (CHUID), as defined in FIPS 201-2.

2.3.10 PIV Authentication Certification Authority (CA) — The PIV Authentication CA is the entity that signs and issues the PIV Authentication Certificate.

2.3.11 International Visit Coordinator (IVC) — The IVC is responsible for reviewing, coordinating, NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 11 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 11 of 58 processing, and granting final authorization of all visits, assignments, or access requests by and for foreign nationals visiting NASA. The IVC works with the program managers and sponsors to determine access requirements, work description, dates of the visit, length of the assignment, citizenship, risk associated with the visit, and other pertinent information. The IVC works with the Center Protective Services Office, the program managers, and sponsors to determine escort requirements while the foreign national is located at the Center. Pre-visit identity vetting is conducted and completed by the IVC. The IVC coordinates and ensures access reviews are performed by the following: project office, sponsor, Center Protective Services Office, Center Counterintelligence Special Agent (CISA), and export control office. When necessary, the IVC coordinates review and approval with the Center public affairs office for press or foreign space agency members, the Center protocol office for High-Level Protocol Visits (HLPV), and the Center sponsor and the export control office for NASA Exchange Visitor Program visitors. The IVC informs the sponsor of the approval or denial of the access request and, in the case of approvals, reports the terms and conditions of the visit to the sponsor. The IVC coordinates with request reviewers to ensure appropriate timeframes are followed for processing of the access request and escalates outstanding requests to the AIMO for resolution.

2.3.12 Escort — Escorts are responsible for providing continuous physical supervision of those persons without sufficient access privileges, as determined by a risk-based determination, or need to be granted unsupervised access to the Center/Facility. Escorts of foreign nationals are required to acknowledge understanding and acceptance of the Access Control Plan (ACP) and escort requirements associated with each foreign national visitor, prior to the beginning of the visit. Escorts of foreign nationals are required to maintain active certified escort status by completing annual escort training and maintaining a valid NASA PIV credential, Department of Defense (DoD) Common Access Card (CAC), or other Federal agency PIV that has been successfully registered utilizing the NASA credential registration process. Escorts of foreign nationals are assigned an additional, Agency-standard badge that identifies their certified status as an escort of foreign nationals at that Center/Facility. Escorts of foreign nationals from designated countries are required to complete an in-person briefing with the CISA prior to the visit and an in-person debriefing with the CISA following the visit.

2.3.13 Host — The host is a NASA civil servant or contractor who is the point of contact for detailed information about a foreign national's work requirements and responsibilities. The host understands the technical nature of the visit and works with the sponsor, requestor, and escort to process the individual and ensure they are properly escorted and aware of their responsibilities while at the Center.

2.4 Separation of Duties for the PIV Role

2.4.1 Per the requirements specified in FIPS 201-2, the principle of separation of duties shall be enforced to ensure that no single individual has the capability to issue a PIV credential without the participation of at least one other authorized person.

2.5 Training

2.5.1 Overview training is required for each role identified in this document to ensure a general and uniform understanding of the NASA policies and procedures for identity management.

2.5.2 Role-based training is required for each of the following roles in the PIV issuance process:

IVC, PIV enrollment official, PIV authorizer, PIV investigation reviewer, and PIV issuance official.

Recertification is required each year to ensure training is up-to-date and conducted with the most

NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 12 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 12 of 58 recent system updates. Failure to complete annual recertification will result in the individual's role being revoked. Training records are maintained by the System for Administration, Training, and Educational Resources for NASA (SATERN) computer-based training system or subsequent/succeeding system(s).

2.6 Privacy

2.6.1 NASA shall ensure that applicant information and systems which facilitate identity management processes are managed consistent with:

a. NPD 1382.17, NASA Privacy Policy.

b. NPR 1382.1, NASA Privacy Procedural Requirements.

c. Homeland Security Presidential Directive 12 (HSPD-12).

d. OMB Memorandum 05-24.

e. Privacy Act of 1974 (Public Law 93-579, 5 U.S.C. § 552a).

f. E-Government Act of 2002 (Public Law 107-347, 44 U.S.C. § 101).

2.6.2 As prescribed in NPR 1382.1, NASA shall conduct and maintain a Privacy Impact Assessment (PIA) of the identity management program. NASA will conduct and maintain PIAs for all systems which are used in the identity management processes and include Personally Identifiable Information (PII) and Information in Identifiable Form (IIF) of the applicant. The NASA System of Records Notice (SORN) will be updated and maintained to reflect the disclosure of information to other Federal agencies.

2.6.3 Only individuals with a legitimate need to access the systems in which an applicant's IIF is stored and maintained shall be allowed to access those systems. It is the responsibility of each Center PIF manager to ensure that the access restrictions defined in the PIA are enforced. NASA will ensure privacy of applicant information is sustained through all steps of identity management including enrollment and issuance. PIV credential issuance facilities will provide an electromagnetically opaque sleeve that assists in protecting against unauthorized contactless access to information stored in the PIV credential.

2.6.4 The Privacy Act Statement shall be posted in every enrollment and issuance location, on the applicable NASA Web site, and provided in pre-enrollment packages to the applicant. The Privacy Act statement covers:

a. Use of collected PII.

b. Protections provided to ensure the security of PII.

c. Effects of partial disclosure and non-disclosure of information by the applicant.

2.6.5 The Subscriber Agreement (see Appendix D: Subscriber Agreement) shall be posted in every enrollment and issuance location on the applicable NASA Web site and provided in any pre-enrollment packages to the applicant. The Subscriber Agreement covers:

a. Authorized uses of the PIV credential.

b. Authorized uses of the Public Key Infrastructure (PKI) certificates and services provided with the PIV credential.

NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 13 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 13 of 58

c. Notification requirements for the applicant.

d. Requirements to return the PIV credential at the end of use.

2.6.6 The following documentation shall be made available, at the request of the applicant:

a. Complaint procedures.

b. Appeals procedures, as described in NPR 1600.3, for those denied a PIV credential or whose PIV credential is revoked.

c. Consequences for employees violating NASA privacy policies, as described in NPR 1382.1.

2.6.7 All notifications provided during identity management processes shall be conducted in a secure manner, ensuring applicant information is secure at all times. Centers will establish procedures for notifying applicants when their PII is lost, damaged, becomes corrupt, or stolen.

2.6.8 Any individuals violating the privacy requirements established in this chapter may be disciplined and/or banned from physical or logical access in compliance with NASA guidelines established in NPR 1382.1.

2.6.9 NASA shall archive and safeguard all stored data pursuant to NPD 1440.6, NASA Records Management, and NPR 1441.1, NASA Records Retention Schedules. Identity files are maintained for a minimum of two years after an individual's relationship with the Agency has ended. NASA may, at its discretion, increase but not reduce the time that identity source documents are to be maintained. The data to be maintained in electronic or hard copy includes:

a. Completed and signed PIV credential request.

b. Information related to the applicant's identity source documents.

c. Results of the applicant's background check.

d. Copies of the applicant's photograph.

e. Any additional documents used in the enrollment and issuance process.

NPR 1600.4A -- Chapter2 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 14 of 58

NPR 1600.4A -- Chapter2 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 14 of 58

Chapter 3. Enrollment and Credential Issuance

3.1 Overview

3.1.1 The NASA Identity Management and Credential Management Processes are designed to conform to the system-based model for identity proofing, registration, and issuance process that is described in NIST FIPS 201-2.

3.1.2 The NASA Identity Management and Account Exchange (IdMAX) system shall be the sole and authoritative source for the enrollment and processing of NASA identity data, as recognized by the Office of Management and Budget (OMB), per the Paperwork Reduction Act (OMB control number 2700-0158), and for the processing of access requests and for the issuance of credentials.

3.2 Chain of Trust

3.2.1 A chain of trust is followed which simultaneously captures the biometrics, photograph, identity source documents, and background investigation of the applicant and can be tied to the identity of that applicant at any point in the identity management process.

3.2.2 The credential is released to the applicant only after completion of the chain of trust by verifying that the biometric information contained on the credential matches the applicant.

3.3 NASA Credential Types

3.3.1 NASA uses both PIV credentials and non-PIV credentials. Each NASA credential is linked to an established identity and shall go through the appropriate issuance steps as outlined in this chapter.

See NPR 2841.1, for policy and procedures regarding NASA non-PIV credentials that allow access to only logical systems. Requirements for the characteristics of these credentials, including printing elements and technology capabilities are detailed in Chapter 5, Characteristics of NASA Badges.

3.3.2 NASA PIV Credentials

3.3.2.1 NASA PIV credentials shall be required for all persons who have been deemed as needing routine and regular physical only, logical only, and/or both physical and logical access to NASA Centers, facilities, and IT systems and resources for a period exceeding 179 calendar days in a 365-day period. These persons include all NASA employees, all NASA contractors, agreement partners, and non-NASA tenants in NASA facilities. NASA PIV credentials will be issued to both United States (U.S.) citizens and foreign nationals.

3.3.2.2 NASA PIV credentials will be issued following the identity proofing, registration, and issuance processes defined in this document for the management of identities of all new and current employees, contractors, and affiliates including foreign nationals.

3.3.2.3 NASA PIV credentials will be issued only after completion of a Federal Bureau of Investigation (FBI) fingerprint check and submission of a background investigation, which will be a Tier I background investigation, at a minimum.

3.3.2.4 NASA PIV credentials will have an expiration date set for a period not to exceed five years from the Card Production Request (CPR) generation date.

3.3.2.5 NASA PIV credentials shall not be issued to individuals holding a Federal PIV credential NPR 1600.4A -- Chapter3 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 15 of 58

NPR 1600.4A -- Chapter3 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 15 of 58

3.3.2.5 NASA PIV credentials shall not be issued to individuals holding a Federal PIV credential issued by another Federal entity. Reserve military personnel who are full-time NASA employees or contractors are exempt from this restriction and may be issued a NASA PIV credential in addition to their DoD CAC. Exceptions to this policy may be made only when the exception has been documented and approved via the process described in section 1.3, Waivers and Exceptions, of this document. The exception request will specifically explain why a non-NASA credential is not usable in the NASA ICAM services.

3.3.3 NASA Non-PIV Credentials

3.3.3.1 All NASA non-PIV physical access credentials shall be created utilizing the Agency Enterprise Physical Access Control System (EPACS) and in compliance with NPR 2810.1.

3.3.3.2 NASA non-PIV temporary credentials will be issued to any person (e.g., NASA employee, NASA contract personnel, non-NASA tenant, or other category of individuals; such as volunteers, guest researchers, interns, grantees, etc.) who needs access to a NASA facility or NASA IT system and who will be affiliated with NASA and its Centers or facilities for a period of less than 180 calendar days (up to 179 calendar days) in a 365-day period. The 180-day period begins the first day of affiliation and ends 179 calendar days later regardless of the work schedule. If an individual's affiliation extends for 180 calendar days in a 365-day period from the first day of affiliation regardless of the work schedule, the individual will be issued a NASA PIV credential. The following categories of affiliates with no logical access may, at the discretion of the CCS/CCPS, be exempted from the requirement to receive a NASA PIV credential at the 180 calendar day point: seasonal student interns, volunteers, construction workers, and others as approved by the AIMO.

3.3.3.3 Issuance of NASA non-PIV badges requires a minimum favorable adjudication of a National Crime Information Center (NCIC) name query and completion of steps 1-4 of section 3.5, On-Site Enrollment and Issuance Procedures for NASA Credentials, of this NPR. Escort requirements for individuals with a NASA non-PIV badge will be based on risk-determination by the CCS/CCPS, in compliance with the requirements in this document.

3.3.3.4 NASA non-PIV visitor badges allow physical-only access to the issuing NASA Center. For visitors, Centers are authorized to issue alternate agency credentials (i.e., NASA non-PIV credentials) for physical access to that Center based on a risk-based determination documented as part of the permanent record. NASA visitor badges shall be issued to individuals requiring access to a NASA Center for a period less than 30 calendar days in any single visit and not more than a cumulative total of 29 calendar days in a 365-day period. Escort requirements for individuals with visitor badges will be based on risk-determination by the CCS/CCPS, in compliance with the requirements in this document.

3.3.3.5 NASA non-PIV alternate Agency credentials shall be issued to accommodate unique situations of the Center not otherwise accommodated by NASA PIV credentials and NASA visitor badges. All NASA alternate Agency credential templates will have the approval of the Agency Identity Management Official prior to their creation and utilization. NASA alternate Agency credentials will be issued upon completion of a favorable adjudication of an NCIC name query. This is a minimum requirement, and additional security measures may be employed at the discretion of the CCS/CCPS. Issuance of these credentials will be based on a risk-based access determination by the CCS/CCPS. NASA alternate Agency credentials may be issued to individuals who hold a PIV credential issued by another Federal Government agency or department if their current non-NASA PIV credential does not work at the NASA Center. This may include contractors from another NASA Center in the event that electronic verification of a requirement to access the NASA Center is not available at a point of entry. Issuance of alternate Agency credentials requires completion of steps 1-3 of section 3.5, On-Site Enrollment and Issuance Procedures for NASA Credentials, NPR 1600.4A -- Chapter3 Verify Current version before use at:

http://nodis3.gsfc.nasa.gov/ Page 16 of 58

NPR 1600.4A -- Chapter3 Verify Current version befor use at:

http://nodis3.gsfc.nasa.gov/ Page 16 of 58 verification of a favorably adjudicated investigation, and capture of the individual's photograph.

3.3.4 Logical-only access credentials and their usage are addressed by NPR 2810.1 and include, but are not limited to, username and password, RSA tokens, and digital certificates.

3.4 Applicant Categories

3.4.1 NASA employees are Federal civil servants employed and paid by NASA and also includes individuals employed and paid by other entities but working for NASA under an Intergovernmental Personnel Act (IPA) agreement. NASA employees include all Non-Appropriated Funds Instrumentality (NAFI) employees; these employees shall be issued a civil servant badge with the affiliation of NAFI.

3.4.2 NASA contractor employees are individuals working for a contracting organization or entity with the responsibility to perform activities for NASA.

3.4.3 NASA grantees are individuals who are working under a grant or cooperative agreement and performing grant-funded activities at NASA Centers and facilities.

3.4.4 Detailees, for the purposes of this NPR, are either Federal employees from other-Federal agencies, U.S. military personnel, or non-Federal employees working at NASA through an IPA assignment. Any badges issued to a detailee shall be designated with an affiliation of NASA and will appear as a Federal employee badge. The Center PIF manager will coordinate with the Center HRO to validate investigative and suitability results for detailees from other-agency partners.

Government employees from other departments and agencies who do not have a PIV credential issued by their agency or department and require identity verification and access at NASA may be issued a NASA PIV credential or NASA alternate Agency credential.

3.4.5 International partners are individuals working for agencies or organizations of foreign governments, foreign education institutions, foreign companies, or international organizations who are engaged in a program of international cooperation in work done pursuant to a Space Act Agreement, as defined by NPD 1050.1, Authority to Enter into Space Act Agreements. A signed international agreement shall first be in effect for international partners to receive a foreign national NASA PIV credential.

3.4.6 Tenants…