Attachment 05 - CAC Procedures.pdf

ATTACHMENT 2 – TECHNICAL EXHIBIT 1.2

COMMON ACCESS CARD (CAC) PROCEDURES

TE 1.2 – CAC Procedures

Performance under this contract may require the contractor to obtain a Common Access Card (CAC). If

CACs are issued under this contract, the contractor shall complete and comply with the following steps to obtain, control, and turn-in Government-issued CACs, as well as establish procedures to control and account for contractor CACs at all times. This process is only for the issuance and accountability of

CACs. Contractors may be required to provide additional forms and follow additional procedures for other forms of access and/or background/security checks depending on local site/installation requirements. All email communications covered in this Technical Exhibit (TE) are to be digitally signed. All emails containing Personally Identifiable Information (PII) are to be encrypted.

1. The contractor has each contractor employee requiring a CAC complete DLAH Form 1728 in accordance with Enclosure 3; 2a. Note: Contractors do not complete blocks 11, 14, 15.a. or 15.b.;

these are completed by the COR.

2. The contractor hand carries the DLAH 1728 form(s) or sends via secure mail, or encrypted email to (NOTE: The contractor may forward these forms individually or as a group):

o The Contracting Officer’s Representative (COR) for the contract, if a COR was designated.

o The Contracting Officer (KO) for the contract, if no COR was designated.

3. Each contractor employee must verify their account information upon receipt of an email from the Government containing a username and password for the Trusted Associate Sponsorship

System (TASS). The web link for TASS is included in the email.

4. Each contractor employee will receive an email via TASS when his/her account has been approved. The email will notify the employee to obtain a Government-issued CAC from the nearest Real-Time Automated Personnel Identification System (RAPIDS) office. The email will also provide a link that identifies the locations of RAPIDS offices.

5. Each contractor employee shall obtain his/her issued CAC from the RAPIDS office.

6. The contractor, within one (1) business day of issuance, provides written notice via email to the

COR (or the KO, if no COR was designated) for each contractor CAC issued identifying the contractor employee’s name, the date of issuance, and the date of expiration of the CAC. This notification may be made individually for each contractor employee or together for a group of contractor employees. Note: This requirement is not applicable when the same person is performing both COR and TA roles.

7. The contractor always establishes procedures to control and account for Government-issued contractor CACs at all times, to include the following:

o Ensure contractor CACs issued for this contract are only used for the purpose of performing under this contract.

o Ensure contractor CACs are secured in a manner that precludes unauthorized use and that recognizes the CAC is the property of the U.S. Government.

o Ensure contractor employees do not abuse or place holes in their CACs.

o Ensure contractor employees do not display their CACs in public.

8. If a contractor CAC is lost or stolen:

o The contractor employee shall immediately notify the contractor that the contractor CAC has been lost or stolen.

o The contractor shall immediately notify the COR (or the KO, if no COR was designated), detailing the circumstances regarding the lost or stolen contractor CAC, as follows:

▪ Face-to-face, followed within one (1) business day by a written notice via email, or

▪ In writing, via email, or

▪ By telephone, followed within one (1) business day by a written notice via email.

o The contractor shall report the lost or stolen CAC card to the local DLA Police/host installation police, who will provide the contractor a police report. If there are no local

DLA Police/host installation police, or no police report is provided, the contractor shall provide information to the COR/KO, as applicable, detailing the circumstances of how the CAC was lost or stolen. The COR/KO will provide a memorandum for the contractor employee to support issuance of new CAC.

o The contractor has the contractor employee bring the report/memorandum to the nearest

RAPIDS office. If the CAC can be reissued within 24 hours, bring the report/memorandum to the nearest CAC office for reissue. If the CAC cannot be reissued in 24 hours, follow the steps for a new CAC, beginning at Step 1.

9. If the expiration date for a contractor CAC is prior to completion of the contract and the contractor employee is to continue working under the contract and still requires a CAC, the contractor:

o Notifies the COR as follows:

▪ Face-to-face, followed within one (1) business day by a written notice via email, or

▪ In writing, via email, or

▪ By telephone, followed within one (1) business day by a written notice via email.

o No less than ten (10) business days before the current CAC’s expiration date, completes and complies with the steps above beginning with Step 2 for issuance of a new contractor

CAC for the employee.

o Brings the expiring CAC to the RAPIDS office for turn-in and receives new CAC.

o Notifies the COR once a new CAC has been issued.

10. The contractor/contractor employee turns in any found CACs immediately, via hand-carry, to the nearest Federal law enforcement office.

11. The contractor immediately collects all contractor CAC(s) from the contractor employee(s) at:

o Contract completion or termination o Termination/Reassignment of an employee (this includes any reason the employee is no longer working for the contractor under the contract or otherwise no longer requires a

CAC)

12. For contract completion or termination – within one business day after collecting the contractor

CAC(s), arranges for turn-in via one of the below methods:

o The contractor:

i. If the COR/KO is co-located or near enough that in-person transfer of CACs can be arranged, the contractor:

• Arranges to meet the COR (or the KO, if no COR was designated) to turn-in the collected contractor CAC(s).

• Hand-carries all collected contractor CACs for turn-in to meet the COR (or the KO, if no COR was designated).

• Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the COR (or the KO if no COR was designated). The contractor is provided a copy of the receipt.

ii. If in-person transfer of CAC cannot be arranged, the contractor:

• Sends, via certified mail, the CACs to the COR/KO. The contractor includes in the package the Government-Issued Contractor CAC Turn-In Receipt, with signed acknowledgement of contractor turn-in.

• Notifies COR/KO that CACs have been sent via certified mail.

• Receives a completed copy of the receipt from the COR/KO once the

COR/KO has received the CACs.

13. For termination/resignation/reassignment of an employee:

o Immediately notifies the COR (or the KO, if no COR was designated) that the employee is no longer working for the contractor under the contract or otherwise no longer requires a CAC, as follows:

• Face-to-face, followed within one (1) business day by a written notice via email, or

• In writing, via email, or

• By telephone, followed within one (1) business day by a written notice via email.

o Follows the turn-in procedures above for contract completion or termination, as applicable.

14. Contractor Reporting Requirements: The contractor is required to submit, monthly, to the COR

(or the KO, if no COR was designated) a report of all employees working on the contract who have been issued CAC cards and a verification of whether each listed employee still requires a

CAC. The report must note where changes have occurred (additions or deletions) since the previous month. Contractor employees who already have a CAC related to another DLA or

DoD contract must be included in the monthly report. Contractor shall note the issuing organization and the CAC expiration date. Contractor is still responsible for notifying the

COR/KO when the individual is no longer working under the subject contract.

15. The above procedures have been established as a DLA security measure. Contractors are advised that failure to comply with any of the above requirements will be considered a violation of the terms and conditions of the contract and the Contracting Officer may take action to remedy such violations. Specifically, failure to safeguard, follow these procedures, including reporting requirements, or turn-in CACs within the established timeframes may result in the following actions, which are in addition to other actions the Contracting Officer may take under governing law and regulation and the terms and conditions of the contract:

a. Immediate work stoppage (issuance of a stop work order), not to be lifted until resolution of CAC issue

b. Disapproval of invoices and delay of payment

c. Withholding of final payment (in accordance with FAR 52.204-9)

d. Documentation of CAC Non-Compliance in the Contractor Performance Assessment

Reporting System (CPARS)