Att 03 Risk Levels for Service Contract Personnel-Form.doc

Attachment 04

COMPLETE IF CONTRACTOR WILL HAVE ACCESS TO A NIST FACILITY OR

IT SYSTEM

Risk Levels for Service* Contract Personnel

Non-IT Service Contracts (non-National Security). The following risk designations should be used for Services Contracts where the contractor will have access to a DOC/NIST facility. Check the appropriate Risk Level and the rationale for it.

A. FORMCHECKBOX

High Risk - A contract will be designated High Risk if it meets ALL the following criteria:

FORMCHECKBOX

Work requiring continuous foreign travel of 90 days or more at any time during the performance of the contract under the auspices of the Department;

Work involving functions or operations of the Department that are critical to the accomplishment of the mission of the Department;

Work involving investigative, compliance, or senior-level auditing duties;

Work involving fiduciary, public contact, or other duties involving the highest degree of public trust;

If any other work will be designated High Risk by the head of operating unit or departmental office, attach rationale and check here FORMCHECKBOX

B. FORMCHECKBOX

Moderate Risk - A contract will be designated Moderate Risk if it meets ANY of the following criteria:

Work involving free access and movement during normal work hours within a Department of Commerce facility which houses National Security information or equipment with little or no supervision by an appropriately cleared Federal Government employee;

Work occurring during restricted hours within a Department of Commerce facility which houses classified or sensitive information or equipment even though supervised by a Federal Government employee;

Work requiring access to sensitive information (information protected under the Privacy Act or Title 13 of the U.S. Code); or

FORMCHECKBOX

Work involving foreign travel less than 90 days duration.

C. FORMCHECKBOX

Low Risk. The work to be done by the contractor does not fall into any of the categories noted above and will be given a Low Risk designation.

D. FORMCHECKBOX

No Risk Level Required. - The contractor will have access to a Federal Facility for less than 3 consecutive days, will be issued a Visitor Badge and will be escorted by a NIST employee at all times unless working in an area defined as "public" by the NIST Physical Security Officer. Since the individual will be escorted in all sensitive areas, no background investigation, NACI or SAC, will be required.

Note that contractors who are foreign nationals who are not permanent residents will require additional background review.

IT Service Contracts (non-National Security). The following risk designations should be used for Services Contracts where the contractor will have access to a DOC/NIST IT system. Check the appropriate Risk Level and the rationale for it.

Contract employees, regardless of appointment duration, requiring assignment of a system or network account for access to internal (i.e., non-public) Department of Commerce IT systems that do not require access to National Security information must undergo a background check based on consideration for the highest security categorization of the system(s) to which access is required and the access privileges required. A risk-based, cost-effective approach must be followed to determine the risk of harm to the system in comparison to the opportunity for personnel to cause harm. The following examples demonstrate the opportunity for personnel to cause harm depending on their access privileges, which impact the contract risk designation. The following examples are not all-inclusive, and CORs should contact their servicing IT Security Officer for additional assistance. Additional criteria for IT service contracts are described in the Department of Commerce IT Security Program Policy and Minimum Implementation Standards, Chapter 7, Section 7.4.

FORMCHECKBOX

High Risk: Personnel with IT security authority, “root” access to systems, or access to software source code have opportunity to bypass system security control settings – for example, network/system administrator, system developer, and IT security program positions (such as IT Security Office staff).

FORMCHECKBOX

Moderate Risk: “Super-users” of High- or Moderate-impact systems who may modify core data stores, users with authority to electronically approve financial transactions, or users with access to personal/Privacy Act/other protected data in it (e.g., social security numbers in human resource systems, etc.) other than their own. For these types of access privileges, the risk designation depends on the security categorization of the system(s) involved

IT-Low: Users with access to a DOC local area network, e-mail, basic office applications (such as Microsoft Office or Corel Office suites), and personal data records (i.e., only personal/private information pertaining to themselves such as their personal time and attendance record). For these types of access privileges, the risk designation depends on the security categorization of the system(s) involved.

National Security Contracts

National Security work designated “special sensitive”, “critical sensitive”, or “non-critical sensitive” will determine the level of clearance required for personnel working on the contract. Personnel security clearances for National Security contracts in the Department of Commerce are processed according to the Department of Defense National Industrial Security Program Operating Manual (NISPOM). For additional guidance on National Security contracts, refer to Chapter 43, Industrial Security, of the DOC Security Manual.

All employee positions in the Department of Commerce require a risk designation. In addition, positions that require access to National Security information must also have a sensitivity designation. The level of investigation required for a position is determined by its risk or sensitivity designation. The level of investigation required by the sensitivity designation will normally take precedence over that required by the risk designation. The exception to this requirement would be the investigation for a High Risk position requiring access to national security information at the Secret level. Guidance for the designation of sensitive positions is outlined below.

FORMCHECKBOX

Special Sensitive – include any positions that the head of an operating unit determines to be designated at a level higher than Critical-Sensitive. This may be due to special requirements under an authority other than E.O. 10450 and E.O. 12968 (such as DCID 6/4 that sets investigative requirements and standards for access to Sensitive Compartmented Information (SCI) and other intelligence-related Special Sensitive information.

FORMCHECKBOX

Critical Sensitive – are positions that have potential for exceptionally grave damage to the national security. These positions may include access to, and including, Top Secret defense information development or approval of war plans, plans or particulars of future, major, or special operations of war, or critical and extremely important items of war; investigative duties, the issuance of personnel security clearances, or duty on personnel security boards; or other positions related to national security, regardless of duties, that require the same degree of trust.

FORMCHECKBOX

Non-critical Sensitive – are positions that have the potential for serious damage to the national security. These positions involve either access to Secret or Confidential national security information or materials or to duties that may adversely affect, directly or indirectly, the national security operations of the Department.

* Services at NIST will include construction services.