Attachment 8 FEMA Personal Identity Verification Guidance.pdf

CDP COBRATF Training Operations and Support Services

Attachment 8

FEMA Personal Identity Verification Guidance

I. Purpose

Establish policy and procedures for Federal Emergency Management Agency (FEMA) preparation, issuance, use, and disposition of Department of Homeland Security (DHS) Personal Identity Verification (PIV) Cards for all eligible FEMA employees and qualified contractors as required by Homeland Security Presidential Directive 12 (HSPD-12). HSPD- 12 requires the development and implementation of a mandatory, government-wide standard for secure and reliable forms of identification. The National Institute for Standards and Technology (NIST), part of the Department of Commerce, issued Federal Information Processing Standard (FIPS) 201-1, which outlines the requirements for all Federal employees and contractors to be issued a Personal Identity Verification (PIV) Card for access to Federal facilities.

FIPS 201-1 requires that the process begin with the initiation of a National Agency Check with Written Inquiries (NACI) or other Office of Personnel Management (OPM) or National Security community investigation required for Federal employment. This requirement may also be satisfied by locating and referencing a completed and successfully adjudicated NACI. At a minimum, the FBI National Criminal History Check (fingerprint check) shall be completed before credential issuance.

II. Scope

The provisions of this Directive apply for issuance of identification credentials to all eligible FEMA employees and qualified contractors. Eligible FEMA employees and qualified contractors are defined as persons who have or are expected to have at least one hundred and eighty (180) days of service with FEMA or require access to FEMA logical assets (e.g.

Federal information systems, laptops, desktops, local area network). This directive does not apply to FEMA credentials, identification issued to FEMA employees and contractors with less than 180 days of service, or FEMA visitor passes. This directive is not intended to eliminate or modify any employment suitability and background investigation requirements established by law, Executive Order, DHS directives, or FEMA Instruction 1220.1.

III. Policy and Procedures

A. FEMA employees and contractors, who require physical access to FEMA facilities and currently have or expect to have at least one hundred and eighty (180) days of service with FEMA, will be issued a PIV Card.

PERSONAL IDENTITY VERIFICATION GUIDANCE

DIRECTIVE 121-1

B. All eligible employees and qualified contractors will be entered into the issuance process by a PIV Sponsor. For FEMA employees the PIV Sponsor must be a Human Capital representative or designee. For FEMA contractors who require a PIV Card, the PIV Sponsor must be their contractually-assigned Contracting Officer’s Technical Representative (COTR).

C. A PIV Card will be issued to an eligible employee or qualified contractor based on the favorable adjudication of an FBI National Criminal History Check (fingerprint check) and the submission of a NACI. Individual retention of the PIV Card will be provisional pending the completion of the NACI (background investigation) and the favorable adjudication of the investigation by FEMA. Suitability and background investigation requirements, including those governing individuals with existing background investigations, are defined in FEMA Instruction 1220.1.

D. FEMA employees and contractors who are not eligible for the PIV Card will be issued other FEMA identification in order to gain physical and logical access, as appropriate.

E. FEMA will not issue a PIV Card to any federal affiliate who should possess an active PIV

Card or Common Access Card (CAC) from their home agency.

F. FEMA employees and contractors who are denied issuance of a PIV Card will be entitled to initiate the appeal process to dispute the adjudication results.

G. FEMA PIV Cardholders must report lost or stolen PIV Cards immediately upon discovery to the Office of the Chief Security Officer at FEMASecurityActions@fema.gov (within 24 hours) for the fulfillment of revocation procedures.

H. PIV Cards that are damaged, expired, or collected from exiting FEMA employees or contractors must be revoked in the physical access control system and the card management system and then physically destroyed.

IV. Responsibilities

A. The FEMA Associate Administrator is responsible for appointing the Chief Security Officer (CSO) as the HSPD-12 Senior Authorizing Official for FEMA.

B. The CSO is responsible for:

1. Establishment of HSPD-12 chain of trust by appointing additional roles within PIV Card Issuance (PCI) organization as required by FIPS 20 I-I, NIST 800-79-1 and FEMA PIV Card issuance and usage procedures; and

2. Maintenance of budgetary controls, provision of oversight, approval of policy, and assertion of authority over all PCI functions and services.

mailto:FEMASecurityActions@fema.gov�

V. Definitions

A. Eligible Employee/Qualified Contractor: a person who has or is expected to have at least one hundred and eighty (180) days of service with FEMA -OR- requires access to FEMA logical assets (e.g. Federal information systems, laptops, desktops, local area network).

B. Personal Identity Verification (PIV) Card: a physical artifact (e.g., identity card, "smart" card) issued to an individual that contains stored identity credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) that supports the claimed identity of the cardholder and can be authenticated against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable).

C. PIV Sponsor: an individual who acts on behalf of FEMA to request a PIV Card for an eligible employee or qualified contractor.

VI. Authorities

A. Homeland Security Presidential Directive 12 (HSPD-12), "Policy for a Common Identification Standard for Federal Employees and Contractors," August 27, 2004.

B. Federal Information Processing Standard (FIPS) 201-1, "Personal Identity Verification (PIV) of Federal Employees and Contractors," National Institute of Standards and Technology (NIST), March 2006 (Updated).

C. Special Publication 800-79-1, "Guidelines for the Certification and Accreditation of PIV Card Issuing Organizations," NIST, June 2008.

D. Memorandum 05-24, Director, Office of Management and Budget (OMB), "Implementation of HSPD-12 - Policy for a Common Identification Standard for Federal Employees and Contractors," August 5, 2005.

VII. Responsible Office

Office of the Chief Security Officer

VIII. References

A. Memorandum, CSO, DHS, "HSPD-12 Requirements for All DHS Personnel," October 19, 2006.

B. FEMA Instruction 1220.1, Employment Suitability Screening and Background

Investigation Requirements.