Attachment 10 - Security Requirement 5 (Aug 2020).pdf

Page 1 of 5 Security Requirement 5

(REV. 8/20)

U.S. Citizenship and Immigration Services Office of Security and Integrity – Personnel Security Division

SECURITY REQUIREMENTS

GENERAL

U.S. Citizenship and Immigration Services (USCIS) has determined that performance of this contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor), requires access to sensitive but unclassified information, and that the Contractor will adhere to the following.

FITNESS DETERMINATION

USCIS shall have and exercise full control over granting, denying, withholding or terminating access of unescorted Contractor employees to government facilities and/or access of Contractor employees to sensitive but unclassified information based upon the results of a background investigation.

USCIS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment Fitness authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment Fitness determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by USCIS, at any time during the term of the contract. No Contractor employee shall be allowed unescorted access to a Government facility without a favorable EOD decision or Fitness determination by the Office of Security & Integrity Personnel Security Division

(OSI PSD).

BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive but unclassified information shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract as outlined in the DHS Form 11000-25, Contractor Fitness/Security Screening Request Form and the USCIS Continuation Page to the DHS Form 11000-25. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through OSI PSD.

To the extent the DHS Form 11000-25 and the USCIS Continuation Page to the DHS Form 11000- 25 reveals that the Contractor will not require access to sensitive but unclassified information or access to USCIS IT systems, OSI PSD may determine that preliminary security screening and or a complete background investigation is not required for performance on this contract.

Completed packages must be submitted to OSI PSD for prospective Contractor employees no less than 30 days before the starting date of the contract or 30 days prior to EOD of any employees, whether a replacement, addition, subcontractor employee, or vendor. The Contractor shall follow guidelines for package submission as set forth by OSI PSD.

Page 2 of 5 Security Requirement 5

A complete package will include the following forms, in conjunction with security questionnaire submission of the SF-85P, Security Questionnaire for Public Trust Positions via e-QIP:

• DHS Form 11000-6, Conditional Access to Sensitive But Unclassified Information

Non Disclosure Agreement

• FD Form 258, Fingerprint Card (2 cards)

• DHS Form 11000-25 Contractor Fitness/Security Screening Request Form

• USCIS Continuation Page to DHS Form 11000-25

• OF 306, Declaration for Federal Employment (approved use for Federal Contract

Employment)

• Foreign National Relatives or Associates Statement

EMPLOYMENT ELIGIBILITY

Be advised that unless an applicant requiring access to sensitive but unclassified information has resided in the U.S. for three of the past five years, OSI PSD may not be able to complete a satisfactory background investigation. In such cases, USCIS retains the right to deem an applicant as ineligible due to insufficient background information.

Only U.S. citizens are eligible for employment on contracts requiring access to Department of Homeland Security (DHS) Information Technology (IT) systems or involvement in the development, operation, management, or maintenance of DHS IT systems, unless a waiver has been granted by the Director of USCIS, or designee, with the concurrence of both the DHS Chief Security Officer and the Chief Information Officer or their designees. In instances where non-IT requirements contained in the contract can be met by using Legal Permanent Residents, those requirements shall be clearly described.

CONTINUED ELIGIBILITY

If a prospective employee is found to be ineligible for access to USCIS facilities or information, the Contracting Officer’s Representative (COR) will advise the Contractor that the employee shall not continue to work or to be assigned to work under the contract.

In accordance with USCIS policy, contractors are required to undergo a periodic reinvestigation every five years. Security documents will be submitted to OSI PSD within ten business days following notification of a contractor’s reinvestigation requirement.

In support of the overall USCIS mission, Contractor employees are required to complete one-time or annual DHS/USCIS mandatory trainings. The Contractor shall certify annually, but no later than December 31st each year, or prior to any accelerated deadlines designated by USCIS, that required trainings have been completed. The certification of the completion of the trainings by all contractors shall be provided to both the COR and Contracting Officer.

Page 3 of 5 Security Requirement 5

• USCIS Security Awareness Training (required within 30 days of entry on duty for new contractors, and annually thereafter)

• USCIS Integrity Training (annually)

• DHS Insider Threat Training (annually)

• DHS Continuity of Operations Awareness Training (one-time training for contractors identified as providing an essential service)

• Unauthorized Disclosure Training (one-time training for contractors who require access to USCIS information regardless if performance occurs within USCIS facilities or at a company owned and operated facility)

• USCIS Fire Prevention and Safety Training (one-time training for contractors working within USCIS facilities; contractor companies may substitute their own training)

• USCIS PKI Initiative Training (if supervisor determines the need for a PKI certificate)

• Computer Security Awareness Training (if contractor requires access to USCIS IT systems, training must be completed within 60 days of entry on duty for new contractors, and annually thereafter)

USCIS reserves the right and prerogative to deny and/or restrict the facility and information access of any Contractor employee whose actions are in conflict with the standards of conduct or whom USCIS determines to present a risk of compromising sensitive but unclassified information and/or classified information.

Contract employees will report any adverse information concerning their personal conduct to OSI PSD. The report shall include the contractor’s name along with the adverse information being reported. Required reportable adverse information includes, but is not limited to, criminal charges and or arrests, negative change in financial circumstances, and any additional information that requires admission on the SF-85P security questionnaire or on any security form listed above.

In accordance with Homeland Security Presidential Directive-12 (HSPD-12) http://www.dhs.gov/homeland-security-presidential-directive-12 contractor employees who require access to United States Citizenship and Immigration Services (USCIS) facilities and/or utilize USCIS Information Technology (IT) systems, must be issued and maintain a Personal Identity Verification (PIV) card throughout the period of performance on their contract. Government-owned contractor- operated facilities are considered USCIS facilities.

After the Office of Security & Integrity, Personnel Security Division has notified the Contracting Officer’s Representative that a favorable entry on duty (EOD) determination has been rendered, contractor employees will need to obtain a PIV card.

http://www.dhs.gov/homeland-security-presidential-directive-12

Page 4 of 5 Security Requirement 5

For new EODs, contractor employees have [10 business days unless a different number is inserted] from their EOD date to comply with HSPD-12. For existing EODs, contractor employees have [10 business days unless a different number of days is inserted] from the date these requirements are incorporated into the contract to comply with HSPD-12.

Contractor employees who do not have a PIV card must schedule an appointment to have one issued. To schedule an appointment:

https://ecn.uscis.dhs.gov/team/mgtosi/Offices/osi/FSD/HSPD12/PIV/default.aspx

Contractors who are unable to access the hyperlink above shall contact the Contracting Officer’s Representative (COR) for assistance.

Contractor employees who do not have a PIV card will need to be escorted at all times by a government employee while at a USCIS facility and will not be allowed access to USCIS IT systems.

A contractor employee required to have a PIV card shall:

• Properly display the PIV card above the waist and below the neck with the photo facing out so that it is visible at all times while in a USCIS facility

• Keep their PIV card current

• Properly store the PIV card while not in use to prevent against loss or theft http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20A uthorized%20Authoritative%20Credential%20Holder%20Responsibilit y%20Agreement.pdf

OSI PSD must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return any expired USCIS issued identification cards and HSPD-12 card, or those of terminated employees to the COR. If an identification card or HSPD-12 card is not available to be returned, a report must be submitted to the COR, referencing the card number, name of individual to whom issued, the last known location and disposition of the card.

SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OSI through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and OSI shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

The Contractor shall be responsible for all damage or injuries resulting from the acts or omissions of https://ecn.uscis.dhs.gov/team/mgtosi/Offices/osi/FSD/HSPD12/PIV/default.aspx http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20Authorized%20Authoritative%20Credential%20Holder%20Responsibility%20Agreement.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20Authorized%20Authoritative%20Credential%20Holder%20Responsibility%20Agreement.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20Authorized%20Authoritative%20Credential%20Holder%20Responsibility%20Agreement.pdf

Page 5 of 5 Security Requirement 5 their employees and/or any subcontractor(s) and their employees to include financial responsibility.