DASS_DRFP_Attachment_4.11_PIV.pdf

80SSC019R0007 DASS DRFP Attachment 4.11

2.A.1) 52.204-9 PERSONAL IDENTITY VERIFICATION (PIV) OF

CONTRACTOR PERSONNEL (JAN 2011)

(a) The Contractor shall comply with Agency PIV procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing Agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing Agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

PIV Card Issuance Procedures in accordance with FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel.

NIST FIPS 201-1 graphically displays the following procedure for the issuance of a

PIV credential.

Figure A-1, FIPS 201-1

The following steps describe the procedures for the NASA PIV Card Issuance (PCI) of a PIV credential:

Step 1:

For existing employees, the Facility Security Officer (FSO)/Company Representative (CR) submits a completed 1805 to the Security Office and marks it as a “Company Change”.

The FSO/CR does not have an action in the Identity Management & Account Exchange (IdMAX). For a new hire, the FSO/CR submits a completed 1805 to the Security Office and marks it as a “New Form”. They must create an identity in IdMAX for the new employee.

In the case of a foreign national applicant, approval through the IdMAX must be obtained for the visit or assignment before any processing for a PIV credential can take place.

The Security Office shall review the Office of Personnel Management (OPM) databases (e.g., PIPs, et al.), and take appropriate steps to validate the applicant’s investigation status.

Requirements for a National Agency Check with Inquiries (NACI) or other investigation shall be initiated only if necessary.

Applicants who do not currently possess the required level of background investigation shall be invited to complete the necessary background investigation forms at the Electronic Questionnaires for Investigations Processing (e-QIP) lab. The Security Office shall provide to the FSO/CR information and instructions on when and where the employee should report for the e-QIP lab.

Step 2:

For new hires, the Contracting Officer’s Representative (COR) shall sponsor the identity in IdMAX.

Step 3:

For existing employees, the Security Office will update the Affiliation in IdMAX.

For new hires, after applicant’s completion of the investigative document, the Security Office reviews the information and resolves discrepancies with the applicant, as necessary and then releases the investigation to OPM.

Step 4:

Upon release of the investigation to OPM, the applicant will appear in-person before the PIV registrar and submit two forms of identity source documents in original form. The identity source documents must come from the list of acceptable documents included in Form I-9, Employment Eligibility Verification, one which must be a Federal or State issued picture identification. Fingerprints will be taken at this time. When the applicant appears, the registrar will electronically scan the submitted documents; any document that appears invalid will be rejected by the registrar. The registrar will capture electronically both a facial image and fingerprints of the applicant. The information submitted by the applicant will be used to create or update the applicant identity record in IdMAX.

In the case of a foreign national, a check of the e-Verify will be performed for each applicant.

If this process yields negative information, the Security Office will immediately notify the COR/host of the determination regarding access.

Step 5:

Upon receipt of the completed background investigation, the Security Office will adjudicate the investigation and results will be added to IdMAX. If an unsatisfactory suitability determination is rendered, the COR will advise the contractor that the employee is being denied physical access to all federally-controlled facilities and Federal information systems.

Based on a favorable background investigation the Security Office will authorize the issuance of a PIV federal credential in the Physical Access Control System (PACS) database.

Step 6:

The applicant’s PIV credential is processed and printed.

Step 7:

When the PIV credential is received at the Center, the applicant provides to the Badging Official proof of identity with documentation that meets the requirements of FIPS 201 (DHS Employment Eligibility Verification (Form I-9) documents). These documents must be the same documents submitted for registration.

The Badging Official will verify that the facial image, and optionally reference finger print, matches the enrollment data used to produce the card. Upon verification of identity, the operator will locate the employee’s record in the IdMAX database, and modify the record to indicate the PIV card has been issued. The applicant will select a PIN for use with his or her new PIV card. Although root data is inaccessible to the operator, certain fields (hair color, eye color, et al.) may be modified to more accurately record the employee’s information.

(End of clause)