Attachment 3 - Contractor On-Boarding Requirements.pdf

Attachment 3 - Contractor On-Boarding Requirements

Contractor On-Boarding Requirements Language

1.0 Contractor Employee On-Boarding Requirements

1.1 Paperwork Completeness and Accuracy

a. The IRS will provide the vendor POC with the Risk Assessment Checklist (RAC), along with other required investigative forms (details in section 1.5 below).

b. All forms must contain the full legal name that matches the applicant's identification (e.g.

state issued id, passport, etc.)

c. Vendors should ensure fields requiring social security numbers and phone numbers have the correct number of digits.

d. The IRS will reject forms that are incomplete, illegible, inaccurate, and contradict other forms in the package.

1.2 Contractor Eligibility

All contractor/subcontractor employees submitted for staff-like access approval must be eligible for IRS contract employment to the best of the vendor’s knowledge. In order to be approved for interim staff-like access, IRS will confirm that contractor/subcontractor employees first meet the following initial eligibility requirements:

1.2.1 U.S. Citizenship or Lawful Permanent Resident (LPR) status: Subjects must be US citizens or LPRs (dependent on position risk level) to be eligible for staff-like access. a. No documentation is required as proof of U.S. citizenship for subjects born in the United States.

b. If subjects are foreign-born, vendor POC MUST provide the subjects’ Alien Registration or “A” Number for verification of their status.

1.2.2 Selective Service Registration (for males born after 12/31/59): Vendor POC MUST provide the following documentation to the IRS:

a. Registered applicants: Official letters of verification can be obtained and saved via the Selective Service website at https://www.sss.gov/verify/proof/.

b. Non-registered applicants:

i. If the subject is foreign-born, vendors must provide a letter from the Selective Service stating the subject was not required to register or that the subject was required to register but it is too late.

ii. For US citizens or foreign-born subjects who were required to register but did not, the vendor must provide a written explanation as to why the non-registration was not knowing or willful.

1.2.3 Federal Tax Compliance: Subjects must be tax compliant and must remain compliant while actively working on IRS contracts.

a. IRS will check tax compliance – no documentation is required from the vendor POC.

https://www.sss.gov/verify/proof/

b. Vendors are responsible for informing their applicants of this requirement.

1.3 Timeliness

a. Delays in any of the actions stated below will result in contractor/subcontractor employee onboarding delays and starting work on the contract.

b. All investigative forms and documentation are due to the IRS within 10 business days of receipt. If IRS approval is required to confirm the qualifications of proposed contractor personnel, i.e. key personnel, documents must be submitted within 10 days of receipt of this approval.

c. All individuals listed on the RAC should be fingerprinted within 5 business days after IRS sponsorship in USAccess. If an individual is not able to make an appointment within this timeframe, the vendor POC will provide documentation that an appointment was not available and provide the date of the scheduled appointment.

d. The contractor/subcontractor employee must accurately complete the eAPP application, if applicable, within 8 calendar days of receipt of the invitation. Failure to complete eAPP will result in not being permitted to work on the contract.

1.4 Investigative Forms/Documentation, Fingerprinting, and eAPP

a. Contract Profile: Following the award of the contract, the COR will need to submit this document to HCO Mailbox to establish the Contract within the Contract Management Module (CMM) system. This creates the record for contract and task order information in the CMM.

b. Master Survey / Position Designation Tool: Following this meeting, the COR will work with the Vendor POC to complete this questionnaire for each unique position type on the contract. This questionnaire asks the vendor POC and COR to identify the duties the subjects will be performing for IRS in order to determine risk level for the position. A separate Master Survey must be completed for each position type on the contract (i.e., Systems Administrator, Programmer, Clerk Typist, etc.). The results must be saved and sent to IRS PS. The Position Designation Tool is listed here- Position Designation System (PDS) and Position Designation Tool (PDT) (dcsa.mil)

c. Investigative Forms/Documentation: The IRS will provide the vendor POC with the following investigative forms for completion by each applicant requiring staff-like access:

i. Risk Assessment Checklist (RAC): The RAC is a summary Excel spreadsheet that captures information related to the subjects for whom the vendor is requesting staff-like access.

The vendor POC must ensure that EVERY column in the RAC is completed accurately prior to submitting to the IRS. Failure to do so will result in a rejection of the RAC and a delay in the on-boarding process.

ii. OF-306, Declaration for Federal Employment (version 2023): Form must be completed and signed by each contractor/subcontractor employee requiring staff-like access.

https://www.dcsa.mil/Systems-Applications/Position-Designation-System-PDS-and-Position-Designation-Tool-PDT/ https://www.dcsa.mil/Systems-Applications/Position-Designation-System-PDS-and-Position-Designation-Tool-PDT/

iii. Non-Disclosure Agreement (NDA): Form must be completed and signed by each contractor/subcontractor employee requiring access to sensitive but unclassified (SBU) data.

This form is not required to be submitted to Personnel Security. This form is for the COR records only.

iv. Form 13340, Information Provided Concerning the Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act (FCRA): Form must be completed and signed by each contractor/subcontractor employee requiring staff-like access.

v. Notice 1379, Tax Check Notice: Provide to subjects to inform them of IRS’ intent to check their federal tax compliance at onboarding and annually thereafter while continuing to actively work on IRS contracts.

d. Fingerprinting and eAPP

IRS will enroll each subject in USAccess based on the information provided on the RAC. The USAccess system will send an email invitation to schedule a fingerprinting appointment.

Individuals should be fingerprinted within 5 business days of receipt of the sponsorship email.

Note that the USAccess email may sometimes be marked as SPAM. Subjects are asked to check their SPAM folders for the email.

Electronic Questionnaires for Investigations (eAPP): If contractor/subcontractor employees do not have a current federal background investigation already completed and favorably adjudicated at the appropriate risk level, they will receive an email with a link to complete the eAPP form online. The email will contain instructions for accessing the system, and guidance to assist if issues are encountered. Contractors and subcontractor personnel must complete eAPP within 8 calendar days of receipt of the email.

1.5 Contractor Training Requirements

a. Contractor/subcontractor employees must complete Security Awareness Training (SAT) within 10 business days of receiving approval of interim staff-like access.

b. Contractor/subcontractor employees must certify completion using the Form 14616, Contractor SAT Certification, and the Form 11370, Certification of Annual UNAX Awareness Briefing and provide these forms to the COR.

1.6 Security Badges

a. Contractor/subcontractor employees must accurately complete Form 13716A, Request for ID Media/Access Card for Contract Employee, and submit as a PDF document (no photocopies or pictures).

b. Contractor/subcontractor employees are responsible for:

i. Safeguarding their ID/access card.

ii. Wearing ID cards/security badges at or above the waist with photo facing out in an approved cover with no obstructions to the card.

iii. Reporting lost/stolen cards immediately to their COR, the local Facilities Management & Security Services (FMSS) physical security office, the Situational Awareness Management Center (SAMC), Treasury Inspector General for Tax Administration (TIGTA), and completing Form 4589, Lost or Forgotten ID Card Record.

1.7 Contractor Separation

a. The vendor POC is responsible for notifying the COR no later than one business day of a contractor/subcontractor employee separating (notification may also occur prior to separation).

b. If the contractor/subcontractor employee works more than one contract or task order, notification to multiple CORs may be combined.

c. The contractor/subcontractor employee is responsible for returning the following to the COR on or before their last day of work on the contract. Note that laptops and equipment are assigned to the individual, not the vendor and therefore must be returned upon separation:

i. IRS-issued badge and/or proxy card

ii. IRS keys

iii. IRS- issued laptop

iv. IRS furnished documents

v. IRS passports

vi. Any and all IRS data

vii. Any other items furnished or identified by the IRS

viii. Any other items or materials issued by the Agency for the contract.

Note:

IRM 10.23.2: “Staff-like Access” is authority granted to perform one or more of the following:

• Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

• Possess login credentials to information systems (IRS or vendor-owned systems that store, collect, and /or process IRS information);

• Possess physical and/or logical access to (including the opportunity to see, read, transcribe, and/or interpret) Sensitive but Unclassified (SBU) data, wherever the location (See IRM 10.5.1 for examples of SBU data);

• Possess physical access to (including the opportunity to see, read, transcribe, and/or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room, wherever the location). These items include, but are not limited to, security devices/records, computer equipment, Identification media. For details and further security requirements, see IRM 1.4.6.5.1, Minimum Protection Standards); or,

• Enter physical areas, wherever the location, that store/process SBU information (unescorted).

Staff-Like Access is granted to an individual who is not an IRS employee (and includes, but is not limited to: contractor/subcontractor employees, whether procured by IRS or another federal agency, vendors, delivery persons, experts, consultants, paid/unpaid interns, other federal employees, cleaning/maintenance employees, etc.), and is approved upon required completion of a favorable suitability/fitness determination conducted by IRS Personnel Security.

IRSAP Requirements - Submission of Security Forms and Related Materials (APR 2024) requires contractor/subcontractor employees needing staff-like access to IRS equities to be investigated by IRS Personnel Security (PS).

End of Contractor on-boarding requirements language