ADM 2181.1A HSPD-12.pdf

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

ADM 2181.1A

March 27, 2024

GSA ORDER

SUBJECT: Homeland Security Presidential Directive-12 Personal Identity Verification and Credentialing Policy, and Background Investigations for Contractor Employees

1. Purpose. This Order issues the U.S. General Services Administration’s (GSA) Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors (August 27, 2004) (HSPD-12) Personal Identity Verification (PIV) and Credentialing Policy, as well as background investigation requirements for contractor employees.

2. Background. There are three main guiding authorities for Federal credentialing and background investigations: Office of Management and Budget (OMB) Memorandum M-19-17, “Enabling Mission Delivery through Improved Identity, Credential, and Access Management” (May 21, 2019) (OMB Memorandum M-19-17), HSPD-12, and Federal Information Processing Standard (FIPS) 201-3. In addition, this directive aligns with the Office of Personnel Management's (OPM) “Credentialing Standards Procedures for Issuing Personal Identity Verification Cards under HSPD-12 and New Requirement for Suspension or Revocation of Eligibility for Personal Identity Verification Credentials” (December 15, 2020).

a. Per OMB Memorandum M-19-17, all executive agencies must issue a policy requiring the use of PIV credentials as the primary means of identification and authentication for access to the agency’s facilities, networks, and information systems that align with Federal Identity, Credential, and Access Management (FICAM).

b. HSPD-12 requires all executive departments and agencies to conduct background investigations, adjudicate the results, and issue identity credentials to all Federal employees and contractor employees who require routine physical access to federally-controlled facilities and information technology (IT) systems. HSPD-12 also requires the use of identification by Federal employees and contractor employees to gain physical access to federally controlled facilities and logical access to federally controlled information systems. GSA Access Cards (also known within GSA as PIV cards/credentials) must be:

(1) Issued based on sound criteria for verifying an individual’s identity.

(2) Strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation.

(3) Rapidly authenticated electronically.

(4) Issued only by providers whose reliability has been established by an official accreditation process.

c. The National Institute of Standards and Technology (NIST) issued FIPS 201-3, which specifies the architecture and technical requirements for common identification standards for Federal employees and contractor employees, with the goal of achieving appropriate security assurance for multiple purposes by efficiently verifying the identity of individuals.

3. Scope and Applicability.

a. This policy provides details for HSPD-12 PIV credentialing for GSA employees and contractor employees, as well as requirements regarding background investigations for contractor employees.

b. The policy must be implemented in conjunction with GSA Order ADM 9732.1E, “Personnel Security and Suitability Program Handbook,” GSA Order ADM 5400.2A, “General Services Administration Heads of Services and Staff Offices’ and Requesting Officials’ Roles and Responsibilities to Implement Homeland Security Presidential Directive-12,” and Federal Acquisition Regulation (FAR) 52.204-9, Personal Identity Verification of Contractor Personnel.

4. Cancellation. This Order cancels and supersedes GSA Order ADM 2181.1, “Homeland Security Presidential Directive-12 Personal Identity Verification and Credentialing Policy, and Background Investigations for Contractor Employees,” dated March 18, 2020.

5. Summary of Changes.

a. Updated references to the current FIPS 201-3 publication, which superseded FIPS 201-2, as well as to reflect new GSA policies.

b. Updated Requesting Official (RO) responsibilities, requiring them to complete the necessary documentation for lost/stolen/uncollectible GSA Access Cards.

c. Added responsibilities for a GSA Employee Supervisor.

d. Updated text pertaining to investigation types. Text is now general in nature to meet Defense Counterintelligence and Security Agency (DCSA) requirements.

e. Updated GSA requirements for background investigation relating to DCSA requirements such as RapBack, Trusted Workforce, Continuous Vetting, and other DCSA requirements that may come in the future.

6. Policy.

a. This policy outlines the processes for credentialing, as well as requirements regarding background investigations per Federal guidelines contained in OMB Memorandum M-19-17, HSPD-12, and FIPS 201-3, to allow designated individuals physical access to Federally controlled facilities and/or logical access to Federally controlled information systems.

b. GSA Access Cards will be issued to individuals who reside in the United States or its territories and require routine access to facilities under GSA’s jurisdiction, custody, or control (GSA-controlled) and/or GSA IT systems:

(1) Issuance of GSA Access Cards requires an initial fitness or access determination and the initiation of a background investigation at the appropriate Tier background investigation. If final adjudication of the background investigation result is unfavorable, the GSA Access Card will be revoked and returned to the Office of Mission Assurance (OMA).

(2) All individuals who receive a GSA Access Card:

(a) Should keep their GSA Access Card in an electromagnetically opaque sleeve that is on the FIPS 201-3 Approved Products List. The electromagnetically opaque sleeves are distributed along with the GSA Access Card.

(b) Should wear the card above waist level so that it is clearly visible at all times while in GSA-occupied space.

7. Responsibilities. Responsibilities related to HSPD-12 PIV and credentialing, including background investigations for contractor employees, can be found in Appendix A. Requirements for PIV issuance and credentialing application processes for GSA employees and detailees can be found in Appendix B. GSA contractor employees and other special category requirements for PIV issuance and credentialing application processes can be found in Appendix C.

8. References.

a. Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors (August 27, 2004).

b. OMB Memorandum M-05-24, “Implementation of Homeland Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors” (August 5, 2005).

c. OMB Memorandum M-19-17, “Enabling Mission Delivery through Improved Identity, Credential, and Access Management” (May 21, 2019).

d. FAR 4.1303, Contract clause.

f. FIPS 201-3, “Personal Identity Verification of Federal Employees and Contractors” (January 2022).

g. GSA Order ADM 5400.2A, “General Services Administration Heads of Services and Staff Offices’ and Requesting Officials’ Roles and Responsibilities to Implement Homeland Security Presidential Directive-12” (March 27, 2024).

h. GSA Order ADM 9732.1E, “Personnel Security and Suitability Program Handbook” (March 12, 2019).

9. Signature.

_______/s/_________________

ROBIN CARNAHAN

Administrator

Appendix A. GSA Employee Responsibilities in the PIV Issuance and Verification and Credentialing Processes

Appendix B. GSA Employee and Detailee Requirements in the PIV Issuance and Credentialing Processes

Appendix C. GSA Contractor Employee and Other Special Category Requirements in the PIV Issuance and Credentialing Processes

Appendix D. Definitions for the purposes of this Order

Appendix A. GSA Employee Responsibilities in the PIV Issuance and Verification and Credentialing Processes

GSA employees who have responsibilities during the GSA employee and contractor employee credentialing process are listed below:

Office of Mission Assurance (OMA).

1. Oversee, manage, maintain, assist, and implement the credentialing process for GSA employees and contractor employees and background investigation for contractor employees;

2. Fulfill the FIPS 201-3 PIV Sponsor, PIV Adjudicator, and PIV Security Officer role for GSA employees and contractor employees;

3. Assist in processing GSA contractor employees through the background investigation process; and

4. Make the final determination as to what type of background investigation is required for contractor employees depending upon:

a. The length of time the contractor employee is working on a contract,

b. The type of work being performed under the contract, and

c. How many investigations and/or what type of investigation was requested previously.

Requesting Officials (RO).

1. Make all background investigation and credentialing requests for all contractor employees on contracts they are designated to support to the OMA Help Desk or their Head of Service and Staff Office (HSSO) HSPD-12 Point of Contact (POC);

2. Assist contractor employees with any questions relating to completion of the background investigation and credentialing processes;

3. Prohibit contractor employees who need a background investigation from starting work without an initial fitness background investigation determination;

4. Request any additional GSA IT access rights, and/or other permissions necessary for the contractor employee to perform their duties;

5. Revoke IT access and retrieve all GSA-issued credentials, from either the contractor employee or the contractor, and forward the credentials to the regional OMA office for disposal when a contractor employee leaves a contract for any reason;

6. Make assessments regarding whether a contractor employee is a long-term contractor employee, a short-term contractor employee, or a temporary contractor employee based on each contractor employee’s contract performance length;

7. Complete all required documentation when a contractor’s GSA Access Card is lost, stolen, or uncollectible;

8. Follow General Services Administration Acquisition Regulation (GSAR) and General Services Administration Acquisition Manual (GSAM) requirements pertaining to HSPD-12;

9. In the event that the final adjudication results in an unfit determination, ensure, through the contracting officer, that the contractor employee is removed from the GSA contract and that access to all GSA IT systems and facilities is revoked immediately.;

10. Request any required additional appropriate Tier background investigation(s) for non-United States citizen long-term contractor employees (resident in the United States or its territories for less than three consecutive years) before a Special Agreement Check (SAC) expires once the three-year residency requirement is met;

11. Notify OMA staff or their HSSO’s HSPD-12 POC when there is any change on the Contractor Information Worksheet (CIW) by submitting an updated CIW to the OMA Help Desk. Changes can include but are not limited to: a change in the Contracting Officer’s Representative (COR), a change in building location, contractor company information, POC information, option year awarded, if additional contract work is added, and/or if a new task order is added; and

12. Request that GSA contracting officers include FAR § 52.204-9, Personal Identity Verification of Contractor Personnel, in all solicitations and contracts when contract performance requires routine access to GSA facilities or IT systems.

HSSO HSPD-12 POCs.

1. Request accurate and complete background investigations and GSA Access Cards for their contractor employees;

2. Assist the ROs in making requests and monitoring the background investigation and credentialing for contractor employees; and

3. Communicate and work closely with the RO, including, but not limited to, advising and assisting them on HSPD-12 procedures, risk level, appropriate background investigation, and credentialing.

Managed Service Office (MSO), Federal Acquisition Service (FAS).

1. Provide the production and management of GSA Access Cards; and

2. Provide the infrastructure of credential management system and credentialing stations.

Appendix B. GSA Employee and Detailee Requirements in the PIV Issuance and Credentialing Processes

GSA Employees.

1. Must appear in person at an authorized credentialing station during the background investigation and credentialing process to have fingerprints and a photo taken. At that time, the GSA employee must provide two identity source documents in original form. These documents must be on the list of acceptable documents included in Form I-9, OMB No. 1115-0136, “Employment Eligibility Verification”;

2. Must appear in person to pick up and activate the GSA Access Card;

3. Must notify their supervisor if their card is expiring, damaged or lost so that a new card can be issued and complete all required documentation; and

4. Must return their PIV card to their supervisor as part of the off-boarding process when leaving GSA employment.

GSA Employee’s Supervisor.

1. Must collect the GSA Access Cards from their employees leaving GSA employment and provide it to OMA; and

2. Must complete all required documentation when an inactive employee’s GSA Access Card is Uncollectible.

3. Must revoke all IT access privileges when an employee leaves GSA employment and provide all PIV cards to the HSSO, HSPD-12 POC, or OMA POC(s).

GSA Detailees:

1. Must meet requirements detailed in GSA Order HRM 9334.2A, “Detail of Employees,” and have their parent agency’s security organization provide the background investigation results to GSA OMA. The GSA hosting supervisor will ensure that this process occurs prior to the start of the assignment; and

2. Retain and use the credentials issued by their parent agency, including their agency-issued PIV compliant card. GSA will not produce a GSA Access Card.

Appendix C. GSA Contractor Employee and Other Special Category Requirements in the PIV Issuance and Credentialing

Processes

Long-term contractor employees (work duration of 6 months or longer).

1. Must have a background investigation appropriate for their job responsibilities in order to be issued a GSA Access Card (for example, if IT systems access or routine physical access to GSA facilities is required, or both). The contractor employee must have an initial fitness determination and have an appropriate Tier background investigation initiated in order to obtain a GSA Access Card.

2. Must appear in person for fingerprints and a photo at an authorized credentialing station during the background investigation process. At that time, the long-term contractor employee must provide two identity source documents in original form. These documents must be on the list of acceptable documents included in Form I-9, OMB No. 1115-0136, “Employment Eligibility Verification.” If needed, hard copy fingerprints can be approved by the OMA Help Desk.

3. Must appear in person to pick up and activate the GSA Access Card.

4. Must receive a new background investigation if the risk level of work required under a new contract is higher than the risk level associated with prior work by the contractor employee on a GSA contract. The RO for the new contract must follow the procedures for a long-term contractor employee starting a new contract.

5. Must notify their RO if their card is expiring, damaged, lost or stolen so that a new card can be issued.

6. Must comply with all background investigation requirements in accordance with the Federal Government’s personnel vetting process and GSA policy (e.g. reinvestigation, RapBack, Continuous Vetting, Trusted Workforce, or any subsequent initiatives).

7. May not obtain a GSA Access Card if they do not require IT systems access or routine physical access to a GSA-controlled facility.

8. Cannot begin work on a GSA contract without an initial fitness determination.

9.Cannot be escorted in order to perform work on a contract prior to obtaining an initial fitness determination.

Short-term contractor employees (work duration of less than 6 months).

1. Must undergo a SAC if they need routine physical access to GSA facilities and cannot start work on a contract prior to a favorable SAC determination. A SAC is valid for a period not to exceed 6 months. If the work extends beyond 6 months (e.g., due to a delay), the short-term contractor employee must apply for another SAC before the original SAC expires. If the SAC expires, the short-term contractor employee must be removed from the contract.

2. Must appear in person for fingerprints and a photo at an authorized credentialing station during the background investigation process. At that time, the short-term contractor employee must provide two identity source documents in original form. These documents must be on the list of acceptable documents included in Form I-9, OMB No. 1115-0136, “Employment Eligibility Verification”. If needed, hard copy fingerprints can be approved by the OMA Help Desk.

3. Will not receive a GSA Access Card, but may be granted physical access (e.g., escorted, temporary passes) by the Facility Security Committee (FSC) in accordance with the Interagency Security Committee (ISC) Risk Management Process.

4. Cannot complete a SAC more than twice. The only exception is for non-United States citizens who have resided within the United States or its territories for less than three consecutive years and an appropriate Tier background investigation will not be completed until the residency requirement has been met. If a short-term contractor needs more than two SACs during the period of a contract for a particular contractor employee, the RO should consult with OMA. OMA will make the determination as to what type of additional investigation is required.

5. Must comply with all background investigation requirements in accordance with the Federal Government’s personnel vetting process and GSA policy (e.g., reinvestigation, RapBack, Trusted Workforce, Continuous Vetting, or any subsequent initiatives).

Temporary contractor employees (work duration of 15 days or less).

1. Require escort upon entry and while inside a GSA-controlled facility.

2. Can only be in temporary contractor status once for each contract.

3. Will not receive a GSA Access Card.

4. Will not undergo a background investigation.

Non-United States citizen contractor employees (resident in the United States or its territories for less than three consecutive years).

1. Must undergo a SAC if they need routine physical access to GSA facilities and cannot start work on a contract prior to a favorable SAC determination. Per OPM guidance, “Final Credentialing Standards for Issuing Personal Identity Verification Cards Under HSPD-12,” dated July 31, 2008, GSA will not do Tier background investigations for non-United States citizens who have not been a resident in the United States or its territories for three consecutive years.

2. Must appear in person for fingerprints and a photo at an authorized credentialing station during the background investigation process. At that time, the non-United States citizen contractor employee must provide two identity source documents in original form. These documents must be on the list of acceptable documents included in Form I-9, OMB No. 1115-0136, “Employment Eligibility Verification”. If needed, hard copy fingerprints can be approved by the OMA help desk.

3. Must apply for an appropriate Tier background investigation if/when they meet the three-year residency requirement before the SAC expires. If the long-term non-United States citizen contractor employee does not obtain an initial fitness determination before the expiration of the SAC, the contractor employee must be removed from the GSA contract.

4. May be granted physical access (e.g., escorted, temporary passes) by the FSC in accordance with the ISC Risk Management Process.

5. Will not receive a GSA Access Card (unless they subsequently meet the residency requirement and receive an initial fitness determination).

6. Must comply with all background investigation requirements in accordance with the Federal Government’s personnel vetting process and GSA policy (e.g., reinvestigation, RapBack, Trusted Workforce, Continuous Vetting, or any subsequent initiatives).

Child care workers.

1. Must undergo a criminal history background check as mandated by the Crime Control Act of 1990, 34 U.S.C. § 20351.

2. Must have an initial fitness determination and be initiated for an appropriate Tier investigation in order to be eligible for a GSA Access Card.

3. Must comply with all background investigation requirements in accordance with the Federal Government’s personnel vetting process and GSA policy (e.g., reinvestigation, RapBack, Trusted Workforce, Continuous Vetting, or any subsequent initiatives).

Special category tenants.

Individuals licensed under the Randolph-Sheppard Act and employees of Certified Federal Credit Unions that meet the GSA joint use space requirements, and employees of entities holding a Memorandum of Agreement (MOA) or Memorandum of Understanding (MOU) with GSA, must follow the process of long-term contractor employees, short-term contractor employees, and temporary contractor employees depending upon the length of time stipulated in the relevant governing documents.

Outlease tenants.

1. May be granted physical access (e.g., escorted, temporary passes) by the FSC in accordance with the ISC Risk Management Process.

2. Are not Federal contractors.

3. Will not receive a GSA Access Card.

Student Volunteers.

1. Must follow GSA Order ADM 9732.1E, “Personnel Security and Suitability Program Handbook” on GSA Personnel Security requirements for background investigations.

2. Must follow GSA Order HRM 9308.1, “GSA Student Volunteer Service Program (SERVICE).”

3. Will be issued a GSA Access Card.

Appendix D. Definitions for the Purposes of this Order

Background Investigation. Type of investigation covering specific areas of a person’s background. The background investigation consists of a record search, credit search, and a necessary DCSA investigation as needed. The levels of investigation are SACs and any Tier background investigations.

Child Care Workers. Providers and their employees who operate under a GSA license agreement to provide child care services in GSA-controlled (owned and leased) facilities. They are not employed by the Government.

Contractor Information Worksheet (CIW). GAS Form 850, which is used to obtain contractor information pertaining to HSPD-12 and background investigation processes.

Federal Credit Union. A Federal Credit Union, as defined by 12 U.S.C. § 1752, is regulated and supervised by the National Credit Union Administration (NCUA).

The NCUA is a Federal Government agency with authority designated by the Federal Credit Union Act of 1934 to oversee the national credit union system in the United States. The Federal Credit Union locations are in GSA facilities that meet the GSA joint use space requirements, which allows GSA to do a background investigation and provide GSA Access Cards as needed.

Crime Control Act of 1990. 34 U.S.C. § 20351, Requirement for Background Checks. Requires that all individuals involved with the provision of child care services to children under the age of 18 undergo a FBI criminal background check and are investigated through state criminal history repositories.

Defense Counterintelligence and Security Agency (DCSA). Organization that provides background investigations for GSA.

Detailees. Employees from other Federal agencies on temporary assignment to GSA in accordance with GSA Order HRM 9334.2A, Detail of Employees.

Employee. A person that has a GSA position description (PD), on a full-time or part-time basis.

Escorts. GSA employees and contractor employees who have received an initial fitness determination, possess a valid GSA Access Card, and are responsible for the oversight of the contractor employees they are escorting. Escorts must be with and visually watch contractor employees at all times. The number of contractor employees per escort is limited to the number with whom the escort can maintain visual contact at all times.

Facilities. For the purposes of this policy and in relation to HSPD-12 guidance concerning routine physical access, a facility is defined as the physical structure (brick and mortar) and/or interior tenant space under the jurisdiction, custody, or control of GSA.

Federal Information Processing Standard 201-3 (FIPS 201-3). Standard written in response to HSPD-12 and published by the National Institute of Standards and Technology (NIST) in January 2022. FIPS 201-3 and its associated Special Publications provide a detailed specification for Federal agencies and departments deploying PIV cards for their employees and contractors.

GSA Access Card. The name of a PIV credential within GSA.

Heads of Services and Staff Offices (HSSOs) HSPD-12 Points of Contact (POCs). Personnel responsible for managing employee and contractor employee GSA Access Cards and contractor employee background investigations for their HSSOs.

Form I-9, OMB No. 1115-0136, Employment Eligibility Verification. Form presented by the applicant to the PIV registrar to assist the registrar in the identity proofing process.

Initial Fitness Determination. Also known as a favorable Enter on Duty determination, this allows a long-term contractor employee to begin work on a GSA contract prior to the completion of a full background investigation.

Long-term Contractor Employees. Contractor employees who work on a contract for 6 months or longer and may obtain a GSA Access Card.

Outlease tenants. Non-Federal tenants working in GSA Federally owned or Federally leased sublet space.

Personal Identification Verification (PIV) Credential. A physical artifact (e.g., identity card, smart card) issued to an individual that contains stored identity credentials (e.g., photograph, cryptographic keys, and digitized fingerprint representation) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable). Known within GSA as GSA Access Card or PIV Card.

PIV Adjudicator. The individual who adjudicates and attests to the results of the background investigation for each agency’s applicants for the Managed Service Office credentialing system.

PIV Security Officer. The individual who has the ability to immediately revoke a GSA Access Card upon termination or other security events. The individual also reviews flagged documents and duplicate fingerprint checks.

PIV Sponsor. Substantiates the need for a GSA Access Card to be issued to the applicant. The sponsor is responsible for managing the employment status of the card holder when a GSA Access Card holder retires, terminates, or for another reason no longer requires a GSA Access Card.

Randolph-Sheppard Act Vendors. The Act authorizes a blind individual licensed by the state licensing agency to conduct specified activities in vending facilities through permits or contracts. The Randolph-Sheppard Act locations are in GSA facilities that meet the GSA joint use space requirements, which allows GSA to do a background investigation and provide GSA Access Cards as needed.

Requesting Officials (RO). GSA employees that include Contracting Officers (CO) or Contracting Officer’s Representatives (COR) as designated and authorized by the CO for a specific contract effort. The ROs have specific oversight roles and responsibilities outlined in Appendix A.

Routine (Physical) Access. Regularly scheduled access to a facility at a minimum of once a week. For example, a contractor employee who reports to a facility once per week is determined to be a long-term contractor employee (if work duration on a contract is 6 months or longer) and should go through the appropriate Tier background investigation and may obtain a GSA Access Card.

Short-term Contractor Employees. Contractors who work on a contract for less than 6 months.

Special Agreement Check (SAC). An investigation for short-term contractor employees and non-United States citizen contractor employees with less than three consecutive years of residency in the United States or its territories that allows them to work on a GSA contract.

Student Volunteer. A person that works for GSA under the GSA Student Volunteer Service Program (SERVICE), GSA Order HRM 9308.1.

Temporary Contractor Employees. Contractor employees who work on a contract for 15 days or less.

Tier Investigations. An investigation for employees and long-term contractor employees. Tier background investigations are referenced in the Investigation

(INV) 15, Requesting National Background Investigations Bureau Personnel Investigations (or its successor).