Attachment 8 - TE 1.2 - CAC Procedures.pdf

SP3300-22-R-5005

Attachment 8 - TE 1.2 - CAC Procedures

COMMON ACCESS CARD (CAC) PROCEDURES

TE 1.2 – CAC Procedures

Performance under this contract may require the contractor to obtain a Common Access Card (CAC). If CACs are issued under this contract, the contractor shall complete and comply with the following steps to obtain, control, and turn-in Government-issued CACs, as well as establish procedures to control and account for contractor CACs at all times. This process is only for the issuance and accountability of CACs. Contractors may be required to provide additional forms and follow additional procedures for other forms of access and/or background/security checks depending on local site/installation requirements. All email communications covered in this Technical Exhibit (TE) are to be digitally signed. All emails containing Personally Identifiable Information (PII) are to be encrypted.

1. The contractor has each contractor employee requiring a CAC complete and sign Sections I and II of the DD Form 1172-2. The instructions for completing the DD Form 1172-2 are located at http://www.cac.mil/docs/1172-2-Instructions.pdf.

A. For Section II, Block 22 - If the contractor employee signs and the DD Form 1172-2 it is then forwarded by the contractor. This provides verification for the employee information. If the contractor is submitting a DD Form 1172-2 for him/herself (e.g., the owner), with no higher authority above them for verification, then the signature in Block 22 must be notarized to verify identity.

2. The contractor forwards the DD Form(s) 1172-2 via hand-carry, secure mail, or encrypted email to (NOTE: The contractor may forward these forms individually or as a group):

A. The Contracting Officer’s Representative (COR) for the contract, if a COR was designated.

B. The Contracting Officer (KO) for the contract, if no COR was designated.

3. Each contractor employee must verify his/her account information upon receipt of an email from the Government containing a username and password for the Trusted Associate Sponsorship System (TASS). The web link for TASS is included in the email.

4. Each contractor employee will receive an email via TASS when his/her account has been approved. The email will notify the employee to obtain a Government-issued CAC from the nearest Real-Time Automated Personnel Identification System (RAPIDS) office. The email will also provide a link that identifies the locations of RAPIDS offices.

5. Each contractor employee shall obtain his/her issued CAC from the RAPIDS office.

6. The contractor, within one (1) business day of issuance, provides written notice via email to the

COR (or the KO, if no COR was designated) for each contractor CAC issued identifying the contractor employee’s name, the date of issuance, and the date of expiration of the CAC. This notification may be made individually for each contractor employee or together for a group of contractor employees.

http://www.cac.mil/docs/1172-2-Instructions.pdf

7. The contractor establishes procedures to control and account for Government-issued contractor CACs at all times, to include the following:

A. Ensure contractor CACs issued for this contract are only used for the purpose of performing under this contract.

B. Ensure contractor CACs are secured in a manner that precludes unauthorized use and that recognizes the CAC is the property of the U.S. Government.

C. Ensure contractor employees do not abuse or place holes in their CACs.

D. Ensure contractor employees do not display their CACs in public.

8. If a contractor CAC is lost or stolen:

A. The contractor employee shall immediately notify the contractor that the contractor CAC has been lost or stolen.

B. The contractor shall immediately notify the COR (or the KO, if no COR was designated), detailing the circumstances regarding the lost or stolen contractor CAC, as follows:

In person, followed within one (1) business day by a written notice via email, or In writing, via email, or By telephone, followed within one (1) business day by a written notice via email.

C. The contractor shall report the lost or stolen CAC card to the local DLA Police/host installation police, who will provide the contractor a police report. If there is no local DLA Police/host installation police, or no police report is provided, the contractor shall provide information to the COR/KO, as applicable, detailing the circumstances of how the CAC was lost or stolen. The COR/KO will provide a memorandum for the contractor employee to support issuance of new CAC.

D. The contractor has the contractor employee bring the report/memorandum to the nearest RAPIDS office. If the CAC can be reissued within 24 hours, bring the report/memorandum to the nearest CAC office for reissue. If the CAC cannot be reissued in 24 hours, follow the steps for a new CAC, beginning at Step 1.

9. If the expiration date for a contractor CAC is prior to completion of the contract and the contractor employee is to continue working under the contract and still requires a CAC, the contractor:

A. Notifies the COR as follows:

In person, followed within one (1) business day by a written notice via email, or In writing, via email, or By telephone, followed within one (1) business day by a written notice via email.

B. No less than two (2) weeks prior to the current CAC’s expiration date, completes and complies with the steps above beginning with Step 2 for issuance of a new contractor CAC for the employee.

C. Brings the expiring CAC to the RAPIDS office for turn-in and receives new CAC.

D. Notifies the COR once a new CAC has been issued.

10. The contractor/contractor employee turns in any found CACs immediately, via hand-carry, to the nearest Federal law enforcement office.

11. The contractor immediately collects all contractor CAC(s) from the contractor employee(s) at:

A. Contract completion or termination B. Termination/Reassignment of an employee (this includes any reason the employee is no longer working for the contractor under the contract or otherwise no longer requires a

CAC)

12. The contractor shall:

A. For contract completion/termination:

1) Provide the COR with a list of current contract employees with the following information NLT 15 days prior to completion/termination of the contract:

a) Employee’s location and mailing address (e.g. site, bldg., room, cubicle, etc.)

b) Location of all IT/DLA equipment to be returned

c) The date of departure, (i.e. their last workday)

d) Signed DD-2875 System Authorization Access Request (SAAR) for each employee

2) The COR will use this information to go to the DLA Single Point Of Entry

(SPOE.dla.mil) and complete the DLA Employee Departure Request. A DD- 2875 will be submitted for each Contractor employee.

3) The COR will provide a DLA Form 43, Exit Checklist to complete NLT 7 days prior to completion or termination of the contract.

4) Within one (1) business day after collecting the contractor CAC(s), arranges for turn-in via one of the below methods:

a) If the COR/KO is co-located or near enough that in-person transfer of CACs can be arranged, the contractor:

b) Arranges to meet the COR (or the KO, if no COR was designated) to turn-in the collected contractor CAC(s).

c) Hand-carries all collected contractor CACs for turn-in to meet the COR (or the KO, if no COR was designated).

d) Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the COR. The contractor is provided a copy of the receipt.

5) If in-person transfer of CAC cannot be arranged, the contractor:

a) Sends, via certified mail, the CACs to the COR/KO. The contractor includes in the package the Government-Issued Contractor CAC Turn-In Receipt, with signed acknowledgement of contractor turn-in.

b) Notifies COR/KO that CACs have been sent via certified mail.

c) Receives a completed copy of the receipt from the COR/KO once the

COR/KO has received the CACs.

https://spoe.dla.mil/ux/rest/share/OJSXG33VOJRWKSLEHUZDQJTSMVZW65LSMNSVI6LQMU6VGQS7KBJE6RSJJRCSM5DFNZQW45CJMQ6TAMBQGAYDAMBQGAYDAMBQGAYS2MJQGAYCMY3PNZ2GK6DUKR4XAZJ5INAVIQKMJ5DV6SCPJVCQ

B. For termination/resignation/reassignment of an employee:

1) Immediately notifies the COR that the employee is no longer working for the contractor under the contract or otherwise no longer requires a CAC, as follows:

a) In person, followed within one (1) business day by a written notice via email, or

b) In writing, via email, or

c) By telephone, followed within one (1) business day by a written notice via email.

2) Follows the turn-in procedures above in paragraph 12. A. for contract completion/termination

Contractor Reporting Requirements: The contractor is required to submit, on a monthly basis, to the COR a report of all employees working on the contract who have been issued CAC cards and a verification of whether each listed employee still requires a CAC. The report must note where changes have occurred (additions or deletions) since the previous month. Contractor employees who already have a CAC related to another DLA or DoD contract must be included in the monthly report. Contractor shall note the issuing organization and the CAC expiration date. Contractor is still responsible for notifying the COR/KO when the individual is no longer working under the subject contract.

The above procedures have been established as a DLA security measure. Contractors are advised that failure to comply with any of the above requirements will be considered a violation of the terms and conditions of the contract and the Contracting Officer may take action to remedy such violations.

Specifically, failure to safeguard, follow these procedures, including reporting requirements, or turn-in CACs within the established timeframes may result in the following actions, which are in addition to other actions the Contracting Officer may take under governing law and regulation and the terms and conditions of the contract:

• Immediate work stoppage (issuance of a stop work order), not to be lifted until resolution of CAC issue

• Disapproval of invoices and delay of payment

• Withholding of final payment (in accordance with FAR 52.204-9)

• Documentation of CAC Non-Compliance in the Contractor Performance Assessment Reporting

System (CPARS)