Attachment 10 FEMA Credentialing Manual.pdf

CDP COBRATF Training Operations and Support Services

Attachment 10

FEMA Credentialing Manual

FEMA MANUAL 121-3-1

CREDENTIAL AND ACCESS REFERENCE

APPROVAL DATE: 10/04/2012

DEPARTMENT OF HOMELAND SECURITY

OFFICE OF THE CHIEF SECURITY OFFICER

Foreword

This Manual provides guidance and policy direction for the administration, implementation, and oversight of the Federal Emergency Management Agency's credential and physical access procedures.

Table of Contents

CHAPTER 1: GENERAL INFORMATION

1-1 Purpose 1-2 Applicability and Scope 1-3 Supersession 1-4 Authorities/References 1-5 Policy 1-6 Definitions 1-7 Responsibilities 1-8 Reporting Requirement 1-9 Forms Prescribed

CHAPTER 2: PROCEDURES

2-1 Eligibility 2-2 Card and Credential Requests 2-3 Badge, Card and Credential Issuance 2-4 Proper Use 2-5 Visitor Sponsorship 2-6 Visitor Escort Requirements 2-7 Lost/Stolen/Recovered or Damaged Card/Credentials and Badges 2-8 Termination/Destruction of Card/Credentials and Badges 2-9 Card, Credential and Badge Inventory Tracking and Control 2-10 Misconduct and Penalties 2-11 Facility Access 2-12 Visitor Screening Procedures

CHAPTER 1: GENERAL INFORMATION

1-1.

Purpose

To implement policy and procedures governing the issuance, use, and destruction of all types of FEMA identity cards, access cards, credentials, and badges.

1-2.

Applicability and Scope

The provisions of this Manual apply to all FEMA facilities, employees, contracted personnel, and visitors (to include employees from Other Government Agencies (OGAs) and non-government organizations that have been provided access to FEMA facilities or information technology systems). Standard Operating Procedures (SOP) may be developed with the Office of the Chief Security Officer (OCSO) approval for site specific FEMA facility access requirements, which may deviate from this reference.

1-3.

Supersession

A. This policy supersedes FEMA Instruction 1210.1, “FEMA Identification Cards, Credentials, and Passes,” October 15, 1984.

B. This policy supersedes FEMA Instruction 1210.2 “Access Control Policy and Procedures for the Federal Emergency Management Agency Headquarters Building,” April 4, 1989.

1-4.

Authorities/References

A. Homeland Security Presidential Directive (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” August 27, 2004.

B. National Institute of Standards and Technology (NIST), The Federal Information Processing Standards Publication (FIPS) 201-1, “Personal Identity Verification (PIV) of Federal Employees and Contractors,” March 2006.

C. Office of Management and Budget Memo M-05-24, “Implementation of Homeland Security Presidential Directive (HSPD-12) – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005.

D. Office of Management and Budget, OMB M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD-12) – Policy for a Common Identification Standard for Federal Employees and Contractors,” February 3, 2011.

E. Department of Homeland Security Management Directive 121-01-008, “Issuance and Control of Department of Homeland Security Credentials,” February 17, 2009.

F. The Privacy Act of 1974, codified at 5 U.S.C. §552a, as amended G. Federal Acquisition Regulation Clause 52.204-9, “Personal Identity

Verification of Contractor Personnel,” March 31, 2009.

H. Executive Order 10450, “Security Requirements for Government

Employment,” April 17, 1953, as amended.

I. “X.509 Certificate Policy for the U.S. Federal Public Key Information

Common Policy Framework,” Version 3647 – 1.6, February 11, 2009.

J. “Criteria [for Suitability Determinations],” 5 C.F.R. § 731.202.

K. “Admission to Property,” 41 C.F.R. § 102-74.375.

L. FEMA Directive 121-1, “FEMA Personal Identity Verification Guidance,”

September 29, 2008.

M. FEMA Directive 121-3, “Facility Access Policy,” January 28, 2011.

N. DHS HSPD-12 Procedures Reference Book.

O. DHS/FEMA NIMS Guideline for Credentialing of Personnel.

P. FEMA NIMS Guide 0002.

Q. Delegation for Operations within the Department of Homeland Security, Directive 1200, June 5, 2012.

1-5. Policy

FEMA Directive 121-3 establishes policy for entering and exiting FEMA facilities which apply to anyone entering or exiting a FEMA-controlled facility, except classified areas.

A. This Reference provides policy implementation guidance under FEMA

Directive 121-3 for Facility Access at all FEMA facilities.

B. If an SOP is necessary for specific site access requirements that deviate from this reference, they must be first coordinated and approved by the FEMA Chief of Physical Security Branch prior to submission for approval to the FEMA Chief Security Officer (CSO).

1-6.

Definitions

A. Affiliate

B.

: Individual from an agency or organization, Federal or otherwise, that regularly provides FEMA with temporary assistance and support during normal or disaster operations, and thereby requires access to FEMA facilities or logical assets.

Applicant

C.

: Individual who is sponsored for a Personal Identification Verification (PIV) card, credential, badge or facility access.

Approved FEMA Escort

: Any individual who represents FEMA as an employee, detailee, or a contractor and thereby has the authority to escort visitors within FEMA space. Foreign Nationals cannot serve as FEMA escorts.

D. Approved FEMA Sponsor

E.

: Any individual who represents FEMA as an employee, detailee, or a contractor and verifies the need for a guest or visitor to enter FEMA space. Foreign Nationals cannot serve as FEMA sponsors.

Credential

F.

: A form of official identification which attests to the qualifications, competence, or authority of the individual to whom it is assigned.

Credential Holder

G.

: An individual possessing an identity credential.

Identity Management System

H.

: The system used to produce and maintain identity credentials and access badges.

Escorted Access

I.

: A limited form of facility access which requires an individual to be accompanied by an approved FEMA Escort while inside FEMA-controlled facilities and spaces. This access also requires sponsorship by an Approved FEMA Sponsor before entering FEMA facilities and spaces.

Escort Privileges

J.

: Authority granted to individuals which allows them to accompany “Escort Required” visitors into and within FEMA facilities and spaces; these privileges are not granted to Foreign Nationals.

Facility Access Card (FAC)

K.

: An access card issued to an individual who requires recurring access to a specific FEMA facility for no longer than 6 months, but who does not require or qualify for a PIV card/credential.

Facility Security Officer

L.

: A representative of the OCSO responsible for the implementation and maintenance of physical security measures at a given facility.

Federal Information Processing Standards (FIPS)

M.

: A standard for adoption and use by Federal departments and agencies that has been developed within the Information Technology Laboratory and published by NIST, a part of the U.S. Department of Commerce. A FIPS covers some topic in information technology to achieve a common level of quality or some level of interoperability.

FEMA Facility

N.

: Any permanent or temporary site, building, or structure occupied by FEMA personnel and/or equipment.

FEMA Personnel

O.

: All employees (irrespective of hiring status) and contractors of FEMA.

Foreign National

P.

: An individual who is not a citizen of the United States.

Guest

Q.

: An individual who is not a FEMA employee or contractor but is sponsored for physical access to FEMA facilities and has a valid PIV card/credential or Personal Identification Verification-Interoperability (PIV- I) card/credential. Examples of guests include, but are not limited to, OGA personnel who have a valid PIV card/credential and representatives from state and local government who have a valid PIV-I card/credential.

Holder

R.

: The individual issued a Government card, credential or badge.

Identity Credential: An object that authoritatively binds an identity (and optionally, additional attributes) to a token possessed and controlled by a person.

S. Identity Verification

T.

: The process of confirming or denying that a claimed identity is correct by comparing the credentials of a person requesting access with those previously proven and stored on the FEMA PIV card/credential or system and associated with the identity being claimed.

Law Enforcement Credential

U.

: A government issued form of identification that describes the authority of the bearer to carry a firearm and identifies that individual’s right to exercise specific responsibilities for official and legal purposes, including conducting investigations and making arrests.

Non-FEMA Personnel

V.

: All personnel other than FEMA employees, contractors, or detailees. Includes representatives from state, local, and Federal government departments and agencies, as well as non-governmental organizations.

Official Credentials and Badges

W.

: Identification which describes the authority of the bearer and identifies that individual’s right to exercise authority to perform specific official functions pursuant to law, statute, regulation, or DHS Directive.

Official Government Credential

X.

: A government-issued form of identification showing that an individual is entitled to represent, or exercise official power as part of a United States Government agency.

Official Government Investigator Credential

Y.

: A government issued form of identification that describes and identifies that individual’s right to exercise specific responsibilities for official and legal purposes, including conducting investigations.

Official Law Enforcement Credential

Z.

: A government issued form of identification that identifies an individual’s right to exercise specific responsibilities for official and legal purposes, including conducting investigations, and that describes the authority of the bearer to carry a firearm defined under specific authorities and making arrests.

Personal Identification Number (PIN)

AA. PIV Card/Credential: A PIV card/credential is a United States Federal smart card that contains the necessary data for the cardholder to be granted access to Federal facilities and information systems and assure appropriate levels of security for all applicable Federal applications (Common Access Cards (CAC) of the Department of Defense are PIV cards).

: A secret number stored on an identity credential that a Credential Holder memorizes and uses to authenticate his or her identity.

BB. PIV Compatible (PIV-C): A non-sanctioned Federal Government smartcard that can appear visually and/or electronically as meeting the specifications of PIV or PIV-I but does not meet all the required certification requirements of the Federal Government. This card may appear to be interoperable but cannot be validated to the Federal Bridge.

CC. PIV Interoperability Card/Credential (PIV-I): An identity only credential that meets the PIV technical specification (no standardized background investigation of the holder) to work with Federal PIV infrastructure elements such as card readers, and is issued in a manner utilizing a certified and approved service provider of the General Services Administration (GSA).

DD. Physical Access Control System (PACS): The system that controls an individual’s ability to access a physical location.

EE. Sponsor: The individual responsible for administering the on-boarding process for FEMA new employees (Human Capital) or new contractors (Contracting Officer's Representative or COR) and verifying the applicant's need for a card, credential, or access to FEMA-controlled space. This individual must not be the Enrollment Official or Issuer for the applicant that is being sponsored.

FF. Visitor: An individual who is sponsored for physical access to a FEMA facility, but does not have a PIV card/credential or PIV-I card/credential or DHS/FEMA issued FAC card. For individuals with a PIV card/credential or PIV-I card/credential, see definition of Guest.

GG. Visitor Access Card: A one-day access card assigned to visitors.

1-7. Responsibilities

A. Chief Security Officer:

1. Responsible for developing the policy and procedures for issuing, using, and disposing of all types of FEMA cards/credentials and badges, as well as approving any exceptions to documented policy.

2. Appoints the Identity and Credential Management (ICAM) Program Manager for FEMA under the OCSO.

B. Applicant: The individual applying for a FEMA card or credential and responsible for providing information required to be considered for issuance of same.

C. Contractor Facility Security Officer (FSO): Responsible for maintaining, initiating, and transferring background investigation and clearance information for a given contracting company.

D. Contracting Officer Representative (COR): Responsible for sponsoring contractors, notifying Personnel Security of personnel changes on the contract, and facilitating the exchange of information between the contractor’s FSO and Personnel Security.

E. Card/Credential/Badge Holder: Responsible for safeguarding and protecting the card/credential/badge issued to him or to her and for immediately reporting any loss of such card/credential/badge.

F. Identity and Credential Management Program Manager: Serves as an operations manager and oversees all Credential Issuing Officials during the implementation and operation of all phases of the program, ensuring that all procedures and policies are performed in accordance with this document. Position duties include:

1. Monitoring any potential problems arising from current procedures.

2. Providing recommendations for improvements.

3. Managing and tracking supply and equipment inventories.

4. Processing requests for all FEMA credentials and badges.

G. Enrollment Official: Initiates the chain of trust for identity proofing and provides trusted services to confirm employer sponsorship, bind applicants to their biometric, capture biometrics and electronic facial image, and validate the identity source documentation. The enrollment official will be a member of the OCSO.

H. Facility Security Officer/Manager: A representative of the Physical Security Branch of the OCSO who is responsible for the implementation and maintenance of physical security measures at a given facility.

I. Human Capital: Responsible for verifying FEMA employee-applicants’ need for a PIV card/credential and for sponsoring FEMA employees to obtain PIV cards/credential.

J. Issuing Official: An authorized FEMA credential/badge creator who personalizes the credential/badge with the identity of the authorized subjects, and delivers the personalized credential/badge to the authorized subjects along with appropriate instructions for protection and use.

K. Personnel Security Branch: Responsible for the initiation or verification of a background investigation or security clearance. The Branch reviews and adjudicates the results of the investigation and determines the individual's suitability for the position. This Branch is also responsible for creating and updating personnel security database information for all employees and contractors coming to work at FEMA.

L. Physical Security Branch: Responsible for the production, issuance, re-issuance, renewal, revocation, and termination of all FEMA cards, credentials, and badges. All operational issues related to FEMA cards, credentials, and badges are reported and controlled through the Branch.

M. Security Officer: Individual designated by FEMA to respond to and investigate suspicions of identity fraud and the only role authorized to revoke, terminate, and destroy a FEMA credential or badge. The Security Officer will be a member of the Physical Security Branch.

1-8. Reporting Requirement

Reporting requirements are issued and maintained by the DHS OCSO in the HSPD-12 Procedures Reference Book and are not listed here because of dynamic reporting requirement changes during the implementation of HSPD-12 in DHS.

1-9. Forms Prescribed

A. FEMA Form 121-3-1-1, Lost Badge/Key Report B. FEMA Form 121-3-1-2, PIV Credential C. FEMA Form 121-3-1-3, Facility Access Request D. FEMA Form 121-3-1-4, Official Government Credential Application E. FEMA Form 121-3-1-5, Employee Sign-In/Out Log F. FEMA Form 121-3-1-5A, Visitor Sign-In/Out Log

CHAPTER 2: PROCEDURES

2-1. Eligibility

A. The eligibility requirements for identity credentials, access cards, and official credentials are summarized in Table 1 below. “Card/credential” will be used to refer to all types of identity credentials, access cards, or official credentials.

Table 1: Eligibility Criteria for Different FEMA Card and Credential Types

Type In order to receive a…

Criteria You must…

FEMA PIV Card/ Credential

• Be an active FEMA employee or contractor.

• Be a Non-Federal Affiliate requiring routine access.

• Be determined suitable based on FBI Fingerprint

Background Check AND submission of a National Agency Check with Inquiries (NACI) (or equivalent) or higher background investigation.

FAC

• Designated by Security to require recurring access to a FEMA facility, but does not require or qualify for a PIV or PIV-I card/credential.

• Be determined suitable based on FBI Fingerprint Background Check.

• Must be escorted in Critical Infrastructure areas

• Issued for no longer than 6 months.

No Escort Required Visitor Card

• Be a current FEMA employee, detailee, or contractor

• Have lost or forgotten PIV card/credential or FAC.

• Have your employment status verified.

Escort Required Visitor Card

• Have a valid FEMA sponsor and escort.

• Not issued a PIV or PIV-I card/credential from home agency or organization.

• Have a valid government-issued photo ID.

• Not have recurring visits.

Honored Guest of the Administrator Access Card

• A special No Escort Required Access Card at Headquarters.

• Individual visitors to the Administrator specifically named by the Administrator as his guests.

• Cannot be a contractor or an individual representing a company.

• Must be escorted in any critical infrastructure areas.

Official Government Credential

• Be the FEMA Administrator.

• Be the Deputy Administrator.

• Be an Assistant Administrator or Regional Administrator.

• Be a FCO.

• Be the CSO.

• Be a member of the Mt. Weather Fire Department.

• Be a Security Specialist.

• Be a Special Agent.

• Be an investigator in the OCSO.

Applicants not listed above must have Administrator authorization and CSO approval.

2-2. Card and Credential Requests

A. All requests for Official Government Credentials require CSO approval.

Requests for Official Government Credentials for personnel not listed as eligible for Official Government Credentials in Table I above require authorization from the Administrator.

B. Requests for new PIV and PIV-I card/credential or FACs (to include reissuance and renewal) must be initiated using the FEMA PIV Credential (FEMA Form 121-3-1-2).

C. Requests for Official Government Credentials or Official Law Enforcement Credentials must be initiated using the FEMA Official Government Credential Application (FEMA Form 121-3-1-4).

D. Requests for additional facility access or special facility access requests when applicable to an existing PIV or PIV-I card/credential must be initiated using the Facility Access Request (FEMA Form 121-3-1-3).

E. Requests for visitors access cards must be made at the facility’s Security Desk in accordance with the Visitor Sponsorship and Visitor Escort Requirements outlined below.

F. FEMA employees, detailees, or contractors who have forgotten their access cards may visit the Security Desk to request a “No Escort Required” visitor access card for one day.

G. Individuals must meet the minimum eligibility requirements (outlined in Table I) for the card or credential that they are requesting in order to receive the card or credential.

H. Requests for a Facility Access Card must be justified and sponsored by a FEMA Branch Chief or higher and substantiated and approved by the Security Specialist responsible for controlling and approving access using the FEMA Official Government Credential Application (FEMA Form 121-3- 1-4).

121-3-1-4) 2-3. Badge, Card and Credential Issuance

A. The OCSO is the only FEMA office authorized to issue badges, cards, and credentials.

B. Only an employee or contractor’s legal name is authorized to appear on a card or credential. Any discrepancies will be resolved by verifying the employee’s identification with a driver’s license, social security card, birth certificate, or passport.

C. Issuance of updated cards or credentials will only occur when the card or credential to be replaced is returned on a one for one basis, except in the case of lost or stolen cards and credentials. FEMA employees and contractors may not retain more than one access card or identity credential and may retain only one official credential at a time.

D. FEMA will not issue a FEMA PIV card/credential to any individual employed or contracted by an OGA issuing its own PIV cards.

E. Cards/credentials remain valid until the specified expiration date or until termination of the card or credential. Cards/credentials may be updated and reissued to the bearer when a change takes place under the following conditions:

1. Upon legal name change by providing a marriage certificate, court order, or a divorce certificate;

2. Official change in the bearer’s authority or clearance information under U.S. Code and Delegation Authority on the basis of position or on the basis of information received from Personnel Security;

3. Significant change in the bearer’s appearance over a period of time;

4. Mutilation, damage, or excessive wear of the card/credential; or

5. Expiration (expiration date for Contractor cards/credentials shall coincide with the contract end date but shall not be longer than 3 years from date of issue).

F. All FEMA employees authorized to carry an Official Government Credential will be issued a credential case and a two-part credential that reflects the employee’s authority and title and shall identify employee specific legal authorities.

G. Official card/credential photograph criteria:

1. A full-face, frontal view, color digital image showing a true likeness of the bearer. If prescription glasses are worn full-time, then glasses may be worn in the credential photograph, except when the glasses are tinted;

2. Headgear is not authorized except for religious wear. Small hairclips, bows, etc., are acceptable. However, the hair should be pushed to the side or back if it interferes with a clear picture of a large portion of the face or the eye area. Hair shall not cover any of the facial features in the photograph;

3. Both eyes must be open; and

4. The photo must be clearly focused.

H. All FEMA Official Government Credentials must be approved by the CSO or designee before they are issued.

2-4. Proper Use

A. Do not attempt to clone, modify, or obtain data from any card/credentials.

B. Do not assist others in gaining unauthorized access to Federal facilities or information.

C. Display card/credential on an outer garment, above the waist, and below the shoulder at all times while within the confines of a FEMA facility.

D. Obscure card/credential from view when outside the confines of a FEMA facility.

E. All FEMA-issued card/credentials/badges that electronically store data or can utilize the electromagnetic spectrum will be kept in an approved electromagnetically opaque sleeve when not in use.

F. Issued cards/credentials/badges are used only for official purposes related to FEMA duties and must be displayed with discretion. The use of a card/credential/badge to coerce, intimidate, deceive, or obtain directly, any privilege, favor, preferential treatment, reward, or personal gain for themselves or others is considered misconduct.

G. The National Security clearance indicator displayed on the PIV card/credential should not be the sole determining factor used to verify an individual’s National Security clearance level. It is the responsibility of the meeting facilitator to set the security level of the meeting and ensure that all attendees have the required access and need-to-know. In the case of a meeting at the Sensitive Compartmented Information (SCI) level, the servicing Special Security Officer (SSO) should be contacted for guidance.

H. Possession of Official Government Credentials, Official Government Investigator Credentials, Official Law Enforcement Credentials or associated badge does not relieve the bearer from complying with established access control requirements. Any circumstances that present a reasonable doubt as to the authenticity or validity of the credential or the verification of identity or authority of the bearer shall be reported to appropriate security officials.

I. All cards/credentials/badges are considered to be accountable government property. Inappropriate use or misuse of cards/credentials/badges, in particular the sale or transfer of cards/credentials/badges to unauthorized persons, shall result in disciplinary action to include removal. The following rules apply to the handling of FEMA cards/credentials/badges:

1. Personnel shall protect assigned cards/credentials/badges and maintain them in good condition.

2. Cards/credentials/badges shall not be used as a means of identification for unofficial purposes.

3. Unauthorized or altered cards/credentials/badges, including any such containers/sleeves/holders that have been marked or covered by decals or stickers, will be reported to the OCSO for investigation and/or confiscated. Security Officers are authorized to confiscate faded, worn, damaged, or altered cards/credentials/badges.

4. Cards/credentials/badges that are damaged, expired, or collected from exiting FEMA employees or contractors must be returned to a Security Officer for proper storage and/or destruction.

5. Visitors must return Visitor Access Cards to the Security Desk at the conclusion of their visit each day. If a visitor is visiting for multiple days, he/she must follow the visitor access card issuance procedures each day.

J. An employee or contractor must turn in the assigned card/credential/badge when:

1. Employment with FEMA has been terminated;

2. Resigned from FEMA;

3. Retired from FEMA;

4. Transferred to a position that no longer requires a card/credential/badge;

5. Card/credential/badge is damaged and no longer presentable or serviceable;

6. Card/credential/badge expires;

7. Suspended from their positions (card/credentials/badge must be turned in upon or prior to suspension);

8. Placed on administrative leave during the course of an internal investigation/inquiry;

9. He/she no longer meets FEMA card/credential/badge requirements;

or

10. The Administrator determines that it is in the best interest of FEMA.

K. FEMA Security Awareness training and programs shall stress the importance of protecting cards/credentials/badges against loss or misuse.

2-5. Visitor Sponsorship

A. FEMA employees, detailees, and contractors holding a valid PIV card/credential, except Foreign Nationals, are eligible to sponsor visitors for physical access to FEMA space.

B. Sponsors are responsible for vouching for the need for a visitor or guest to have physical access to FEMA-controlled space.

C. Visitor access cards are intended for temporary visitors and may not be used for individuals who meet the criteria for obtaining a PIV card/credential or a FAC. FEMA employees and contractors may not sponsor as a visitor any individual who is in the process of acquiring a FEMA PIV card/credential or FAC. Sponsoring individuals under any other pretense may constitute a security violation unless authorized in advance by the designated Security Specialist controlling access to the facility.

D. Large group visits must be prearranged with the Facility Security Officer (FSO)/Facility Security Manager (FSM) at least two days prior to the planned visit. If circumstances dictate, this advance notice period may be waived by the FSO/FSM.

E. Upon a visitor’s arrival, the Approved FEMA Sponsor must appear in person at the Security Desk and sign the visitor log book as the visitor’s sponsor.

F. Sponsors are responsible for ensuring their visitor or guest adheres to all FEMA, DHS, and Federal policies while in FEMA controlled space.

G. Sponsors are responsible for ensuring that their visitors exit FEMA controlled space and all visitor access cards assigned to their visitors are returned to the Security Desk by the end of the day or the conclusion of the visit, whichever occurs first.

2-6. Visitor Escort Requirements

A. Visitors who have been issued an Escort Required Access Card must be escorted by an Approved FEMA Escort, who holds a valid PIV card/ credential, for the duration of their visit inside FEMA space.

B. Approved FEMA Escorts can be FEMA employees, detailees, and contractors holding a valid PIV card/credential, except Foreign Nationals, and are authorized to escort visitors in FEMA facilities. An Approved FEMA Escort does not have to be the visitor’s sponsor.

C. Visitors must remain under the direct or location-controlled (e.g., the escort knows the visitor is in the restroom, and the escort is waiting outside the restroom door) observation of an Approved FEMA Escort while inside FEMA space.

D. Escorts are responsible for ensuring the visitor is not exposed to information or areas to which the visitor does not have a valid need or clearance for access.

E. In the event of an emergency, escorts are responsible for escorting the visitor to the nearest and safest facility exit and remaining with the visitor in compliance with any emergency instructions while in FEMA spaces.

F. If an Escort Required Visitor is found without an escort, FEMA personnel should:

1. Accompany the unescorted occupant to the Security Desk, or

2. Direct the visitor to remain nearby while the employee contacts the

Security Desk.

3. Failure to properly report an Escort Required Visitor found without an escort constitutes a security violation.

G. If a visitor fails to cooperate as verbally directed, FEMA personnel should immediately contact the Security Desk to communicate the visitor’s location and report the incident as a security violation.

H. Failure to properly escort a visitor constitutes a security violation.

2-7. Lost/Stolen/Recovered or Damaged Card/ Credentials and Badges

A. If a card/credential/badge is lost, stolen, misplaced or otherwise removed from the holder’s physical possession and control, the holder shall report such loss within 18 hours to the OCSO. The following notifications must be made:

1. Verbal and written notification to the employee’s immediate supervisor.

2. Submit a FEMA Lost Badge/Key Report (FEMA Form 121-3-1-1) to

OCSO.

3. File a Uniform Crime Offense Report with the local law enforcement agency and ensure the information is included in the National Crime Information Center. The OCSO can assist employees with this task.

B. The card/credential/badge holder must immediately obtain all available information concerning the said loss, theft, or damage for inclusion in required reports.

C. Recovered cards/credentials/badges shall be reported to and returned to the OCSO for processing, inventory removal, or destruction as appropriate.

D. Records, reports, and documentation shall be adjusted to reflect recovery of the card/credential/badge, as appropriate.

E. If a card/credential/badge is damaged to the extent that it projects an unprofessional appearance or is not serviceable, the employee shall request a replacement by submitting the FEMA Badge/Credential Application (FEMA Form 121-3-1-2).

F. Damaged cards/credentials/badges may be approved for repair, replacement, or destruction based on their condition as determined by the Identity and Credential Management Section or appropriate designated representative.

G. Damaged cards/credentials/badges shall be returned to the OCSO, removed from the inventory, and destroyed.

2-8. Termination/Destruction of Card/Credentials and Badges

A. Recovered credentials and badges shall be destroyed by a representative of the OCSO.

B. Recovered cards/credentials/badges may be retained and reissued at the discretion of the Identity and Credential Management Section Chief.

C. During the final phase of out-processing, the Issuing Official shall cross reference the individual’s name against the card/credential/badge list to ensure any card/credential/badge issued has been returned.

D. Employees in regional, remote or disaster locations shall return cards/credentials/badges to their Security Manager/Officer or Security Point of Contact who shall return same to FEMA Headquarters OCSO Badging Office.

E. When a card/credential/badge holder has left FEMA, the holder’s supervisor must notify a Security Officer/Manager immediately so that the employee’s access is deactivated.

F. At the end of the day, cards/credentials/badges marked for destruction shall be checked against the access control record of the credential holder.

G. If a card/credential/badge is renewed or replaced, the status of the old card/credential/badge number shall be designated as “destroyed”. The renewed or reissued card/credential/badge shall be placed in an active status.

H. If a card/credential/badge was reissued due to loss or theft, the status of the old credential/badge number shall be designated as “lost” while the reissued credential/badge number shall be active.

I. After confirming the status of all the cards/credentials/badges marked for destruction and their replacements, if any, those card/credentials will be shredded using an on-site shredder; badges will be secured pending proper destruction.

J. Official Government Credentials may be retired and kept as a memento of honorable service to the United States and FEMA only after the credential has been invalidated (e.g., perforated (pin punched) with “Retired” or “Cancelled”). Official Credentials shall be retired under the following circumstances:

1. Upon transfer from the position that required the credential or

Retirement from Federal service by the individual holder, after satisfactory completion of at least one year of employment where the official credential was authorized; or

2. At the request of the family of a deceased employee, regardless of the length of employment.

3. Retirement of Official Law Enforcement Credentials must be done in accordance with statutory requirements and DHS Directives. (DHS Instruction #121-01-008).

2-9. Card, Credential and Badge Inventory Tracking and Control

A. The ICAM Section is responsible for maintaining accurate records of the card/credential/badge inventory and initiating any necessary actions to address discrepancies in inventory records.

B. Card/credentials, laminate, and credential stock paper and unissued badges will be stored in a physically secured area with controlled access that is limited to Security personnel.

C. Cards/credentials/badges shall only be shipped between members of the OCSO, or representatives. All shipping transactions must be tracked and reported to the ICAM Section.

D. The ICAM Section is responsible for ordering card/credential card/paper stock, laminate, ribbon, lanyards, card holders and credential cases, and other consumables from authorized vendors.

E. The Identity and Credential Management Section is required to maintain sufficient stock of card and credential card/paper stock, laminate, ribbon, lanyards, badge holders, and credential cases to meet the annual needs of FEMA. Mount Weather Emergency Services Division maintains stock of credential paper and prox card stock for use at Mount Weather Emergency Operations Center (MWEOC).

F. FEMA organizations are authorized to purchase card holders and lanyards for their employees from outside vendors. All PIV card/credential holders must be FIPS 201 compliant.

G. Employees are authorized to purchase and use privately purchased card holders and lanyards from outside vendors. All PIV card/credential holders must be FIPS 201 compliant.

2-10. Misconduct and Penalties

A. Misconduct: Employees and contractors are responsible for the proper use and safeguarding of all FEMA identification. The careless handling, abuse, misuse, or intentional misrepresentation of badges and credentials shall be cause for possible administrative or disciplinary action, which may include, but is not limited to temporary suspension, reassignment, revocation of official duties and responsibilities, removal from employment with FEMA or other penalties.

B. Penalties: Cards, credentials and badges must never be issued or used for transacting non-official business. Criminal penalties may be imposed pursuant to law for the improper use of the official identification, including, but not limited to:

1. 18 U.S.C. § 499, “Military, naval, or official passes” “Whoever falsely makes, forges, counterfeits, alters, or tampers with any naval, military, or official pass or permit, issued by or under the authority of the United States, or with intent to defraud uses or possesses any such pass or permit, or personates or falsely represents himself to be or not to be a person to whom such a pass or permit has been duly issued, or willfully allows any other person to have or use any such pass or permit, issued for his use alone, shall be fined under this title or imprisoned not more than five years, or both.”

2. 18 USC § 701, “Official badges, identification cards, other insignia” “Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.”

3. Security access violations are subject to discipline, administrative actions, and sanctions.

2-11. Facility Access

A. Access to FEMA facilities is granted based on possession of an approved, valid access badge or identity credential.

B. All personnel, regardless of affiliation, must present valid identification and are subject to the applicable screening requirements outlined below.

Exceptions to the following procedures can be made by the Facility Security Officer/Manager, as extenuating circumstances require, with risk determined and assumed.

C. PIV card/credential and FAC Screening Procedures at Facilities with a

PACS:

1. If an individual requires access to FEMA-controlled space, they shall report to the Badge Office with a completed Facility Access Request (FEMA Form 121-3-1-3).

2. Personnel with a valid PIV card/credential or FEMA-issued FAC shall present their card to guards stationed at perimeter checkpoints.

Once the guard has verified their PIV card/credential or FAC, they may proceed through the checkpoint. If their PIV card/credential or FAC has been programmed for access to FEMA-controlled space, it may be used with electronic card readers to gain access beyond the perimeter checkpoint.

3. First-time guests from OGAs with valid PIV card/credential or guests with PIV-I card/credential, may have unescorted access electronically programmed into the PACS for the duration of their visit. All Guests must be sponsored by an authorized FEMA Sponsor at the time of their first visit, and their card must be electronically authenticated before access is granted. Guests will be subject to visitor screening procedures (see below) for their first visit only.

D. PIV Card/Credential and FAC Screening Procedures at Facilities without a

PACS:

1. Personnel with a valid PIV card/credential or FAC present their card/credential to guards stationed at perimeter checkpoints. Once the guard has verified their PIV card/credential or FAC, they may proceed through the checkpoint.

2. First-time guests from OGAs or guests with PIV-I card/credential may be granted access on the basis of their PIV card/credential. All guests must be sponsored by an authorized FEMA Sponsor, who will specify the length of time the guest will require access. After sponsorship has been approved, guests may gain unescorted access by presenting their PIV card/credential to the guards when they enter FEMA facilities. Guests will also follow visitor screening procedures (see below) for their first visit only, unless required by a heightened security level.

2-12. Visitor Screening Procedures

A. Upon arrival at the Security Desk, visitors shall present a valid form of government-issued photo ID before they are issued an Escort Required Visitor Card. Additionally, visitors must pass through the magnetometer and/or X-ray machine upon entering a FEMA facility.

B. FEMA employees, detailees, or contractors who have forgotten their access card or identity credential shall present a valid form of government-issued photo ID at the Security Desk. Once their identity has been verified, their employment status will be verified to ensure it is still active.

The individual will then be issued a No Escort Required Facility Visitor Card which must be returned by the end of the day. FEMA employees issued such a card will not have to follow the visitor screening procedures in 2.12(A) above unless required by a heightened security level.

C. Law enforcement officials with verifiable law enforcement credentials and approval from the OCSO may retain custody of their firearms while visiting FEMA in the performance of their official duties. Law enforcement officials possessing jurisdiction within FEMA-controlled space who are responding to a call for service or conducting investigations will be allowed armed access without prior approval of the OCSO.

D. Under 44 CFR 15.15§ 15.15 in regard to MWEOC and the National Emergency Training Center (NETC) Weapons and Explosives: No person entering or while at Mt. Weather or the NETC will carry or possess firearms, other dangerous or deadly weapons, explosives or items intended to be used or that could reasonably be used to fabricate an explosive or incendiary device, either openly or concealed, except:

(a) For official purposes if the Administrator, Mt. Weather Executive Director, or the Assistant Administrator for the United States Fire Administration or designee approves; and

(b) In accordance with FEMA policy governing the possession of firearms.