Attachment B - Security Requirement 5 (March 2025).pdf

Page 1 of 4 Security Requirement 5

(REV. 3/2025)

U.S. Citizenship and Immigration Services Office of Security and Integrity – Personnel Security Division

SECURITY REQUIREMENTS

GENERAL

U.S. Citizenship and Immigration Services (USCIS) has determined that performance of this contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor), requires access to sensitive but unclassified information, and that the Contractor will adhere to the following.

FITNESS DETERMINATION

USCIS shall have and exercise full control over granting, denying, withholding or terminating access of unescorted Contractor employees to government facilities and/or access of Contractor employees to sensitive but unclassified information based upon the results of a background investigation.

USCIS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment Fitness authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment Fitness determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by USCIS, at any time during the term of the contract. No Contractor employee shall be allowed unescorted access to a Government facility without a favorable EOD decision or Fitness determination by the Office of Security & Integrity Personnel Security Division

(OSI PSD).

BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive but unclassified information shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract as outlined in the DHS Form 11000-25, Contractor Fitness/Security Screening Request Form and the USCIS Continuation Page to the DHS Form 11000-25. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through OSI PSD.

To the extent the DHS Form 11000-25 and the USCIS Continuation Page to the DHS Form 11000- 25 reveals that the Contractor will not require access to sensitive but unclassified information or access to USCIS IT systems, OSI PSD may determine that preliminary security screening and or a complete background investigation is not required for performance on this contract.

Completed packages must be submitted to OSI PSD for prospective Contractor employees no less than 30 days before the starting date of the contract or 30 days prior to EOD of any employees, whether a replacement, addition, subcontractor employee, or vendor. The Contractor shall follow guidelines for package submission as set forth by OSI PSD.

RFQ# 70SBUR25Q00000151 - ATTACHMENT B

Page 2 of 4 Security Requirement 5

A complete package will include the following forms, in conjunction with security questionnaire submission of the SF-85P, Security Questionnaire for Public Trust Positions via e-QIP:

• DHS Form 11000-6, Conditional Access to Sensitive But Unclassified Information

Non Disclosure Agreement

• FD Form 258, Fingerprint Card (2 cards)

• DHS Form 11000-25 Contractor Fitness/Security Screening Request Form

• USCIS Continuation Page to DHS Form 11000-25

• OF 306, Declaration for Federal Employment (approved use for Federal Contract

Employment)

• Foreign National Relatives or Associates Statement

EMPLOYMENT ELIGIBILITY

Be advised that unless an applicant requiring access to sensitive but unclassified information has resided in the U.S. for three of the past five years, OSI PSD may not be able to complete a satisfactory background investigation. In such cases, USCIS retains the right to deem an applicant as ineligible due to insufficient background information.

Only U.S. citizens are eligible for employment on contracts requiring access to Department of Homeland Security (DHS) Information Technology (IT) systems or involvement in the development, operation, management, or maintenance of DHS IT systems, unless a waiver has been granted by the Director of USCIS, or designee, with the concurrence of both the DHS Chief Security Officer and the Chief Information Officer or their designees. In instances where non-IT requirements contained in the contract can be met by using Legal Permanent Residents, those requirements shall be clearly described.

CONTINUED ELIGIBILITY

If a prospective employee is found to be ineligible for access to USCIS facilities or information, the Contracting Officer’s Representative (COR) will advise the Contractor that the employee shall not continue to work or to be assigned to work under the contract.

In accordance with USCIS policy, contractors are required to undergo a periodic reinvestigation every five years. Security documents will be submitted to OSI PSD within ten business days following notification of a contractor’s reinvestigation requirement.

In support of the overall USCIS mission, contractor employees are required to complete DHS/USCIS mandatory training courses, as outlined in the Mandatory Training course library located here:

https://uscis.acadisonline.com/AcadisViewer/Training/ProfessionalDevelopment?showRecentTrai ningCompletion=False&ReturnURL=_______gNemmXK99.eEkrTThZEQRg-- (aRmBrsU8Qpat5ihX6Z_QbpLiAoMTQPX3opsEjUCOaSzUJgHMWtPfxlMotC9B2mh7KteNgg FxOQh8CmNKzkd4xtlUMxBVBhFMK0OkNrBIY_s-https://uscis.acadisonline.com/AcadisViewer/Training/ProfessionalDevelopment?showRecentTrainingCompletion=False&ReturnURL=_______gNemmXK99.eEkrTThZEQRg--(aRmBrsU8Qpat5ihX6Z_QbpLiAoMTQPX3opsEjUCOaSzUJgHMWtPfxlMotC9B2mh7KteNggFxOQh8CmNKzkd4xtlUM https://uscis.acadisonline.com/AcadisViewer/Training/ProfessionalDevelopment?showRecentTrainingCompletion=False&ReturnURL=_______gNemmXK99.eEkrTThZEQRg--(aRmBrsU8Qpat5ihX6Z_QbpLiAoMTQPX3opsEjUCOaSzUJgHMWtPfxlMotC9B2mh7KteNggFxOQh8CmNKzkd4xtlUM https://uscis.acadisonline.com/AcadisViewer/Training/ProfessionalDevelopment?showRecentTrainingCompletion=False&ReturnURL=_______gNemmXK99.eEkrTThZEQRg--(aRmBrsU8Qpat5ihX6Z_QbpLiAoMTQPX3opsEjUCOaSzUJgHMWtPfxlMotC9B2mh7KteNggFxOQh8CmNKzkd4xtlUM https://uscis.acadisonline.com/AcadisViewer/Training/ProfessionalDevelopment?showRecentTrainingCompletion=False&ReturnURL=_______gNemmXK99.eEkrTThZEQRg--(aRmBrsU8Qpat5ihX6Z_QbpLiAoMTQPX3opsEjUCOaSzUJgHMWtPfxlMotC9B2mh7KteNggFxOQh8CmNKzkd4xtlUM https://uscis.acadisonline.com/AcadisViewer/Training/ProfessionalDevelopment?showRecentTrainingCompletion=False&ReturnURL=_______gNemmXK99.eEkrTThZEQRg--(aRmBrsU8Qpat5ihX6Z_QbpLiAoMTQPX3opsEjUCOaSzUJgHMWtPfxlMotC9B2mh7KteNggFxOQh8CmNKzkd4xtlUMxBVBhFMK0OkNrBIY_s-

Page 3 of 4 Security Requirement 5

Contractors without USCIS network accounts must coordinate with the course content owner, identified with the help of the COR, to access off-network course versions. For questions on training requirements, contact the Human Capital and Training team at uscismandatorytraining@uscis.dhs.gov. Contractors shall certify the completion of all mandatory training courses by the deadlines listed in the course library and provide certification of completion to both the COR and the Contracting Officer.

USCIS reserves the right and prerogative to deny and/or restrict the facility and information access of any Contractor employee whose actions are in conflict with the standards of conduct or whom USCIS determines to present a risk of compromising sensitive but unclassified information and/or classified information.

Contract employees will report any adverse information concerning their personal conduct to OSI PSD. The report shall include the contractor’s name along with the adverse information being reported. Required reportable adverse information includes, but is not limited to, criminal charges and or arrests, negative change in financial circumstances, and any additional information that requires admission on the SF-85P security questionnaire or on any security form listed above.

In accordance with Homeland Security Presidential Directive-12 (HSPD-12) http://www.dhs.gov/homeland-security-presidential-directive-12 contractor employees who require access to United States Citizenship and Immigration Services (USCIS) facilities and/or utilize USCIS Information Technology (IT) systems, must be issued and maintain a Personal Identity Verification (PIV) card throughout the period of performance on their contract. Government-owned contractor- operated facilities are considered USCIS facilities.

After the Office of Security & Integrity, Personnel Security Division has notified the Contracting Officer’s Representative that a favorable entry on duty (EOD) determination has been rendered, contractor employees will need to obtain a PIV card.

For new EODs, contractor employees have [10 business days unless a different number is inserted] from their EOD date to comply with HSPD-12. For existing EODs, contractor employees have [10 business days unless a different number of days is inserted] from the date these requirements are incorporated into the contract to comply with HSPD-12.

Contractor employees who do not have a PIV card must schedule an appointment to have one issued. To schedule an appointment:

https://cisgov.sharepoint.com/sites/connect/org/MGMT/OSI/Pages/HSPD-12.aspx

Contractors who are unable to access the hyperlink above shall contact the Contracting Officer’s Representative (COR) for assistance.

Contractor employees who do not have a PIV card will need to be escorted at all times by a government employee while at a USCIS facility and will not be allowed access to USCIS IT systems.

A contractor employee required to have a PIV card shall:

mailto:uscismandatorytraining@uscis.dhs.gov http://www.dhs.gov/homeland-security-presidential-directive-12 https://cisgov.sharepoint.com/sites/connect/org/MGMT/OSI/Pages/HSPD-12.aspx

Page 4 of 4 Security Requirement 5

• Properly display the PIV card above the waist and below the neck with the photo facing out so that it is visible at all times while in a USCIS facility

• Keep their PIV card current

• Properly store the PIV card while not in use to prevent against loss or theft http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20A uthorized%20Authoritative%20Credential%20Holder%20Responsibilit y%20Agreement.pdf

OSI PSD must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return any expired USCIS issued identification cards and HSPD-12 card, or those of terminated employees to the COR. If an identification card or HSPD-12 card is not available to be returned, a report must be submitted to the COR, referencing the card number, name of individual to whom issued, the last known location and disposition of the card.

SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OSI through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and OSI shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

The Contractor shall be responsible for all damage or injuries resulting from the acts or omissions of their employees and/or any subcontractor(s) and their employees to include financial responsibility.

http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20Authorized%20Authoritative%20Credential%20Holder%20Responsibility%20Agreement.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20Authorized%20Authoritative%20Credential%20Holder%20Responsibility%20Agreement.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/ocso/Documents/DHS%20Authorized%20Authoritative%20Credential%20Holder%20Responsibility%20Agreement.pdf