Attachment C - Security Requirements.pdf

Page 1 of 6 ACCESS TO SBU REV. 8/2025

PART III - ATTACHMENT C - SECURITY REQUIREMENTS

ACCESS TO SENSTIVE BUT UNCLASSIFIED INFORMATION

GENERAL

U.S. Citizenship and Immigration Services (USCIS), Office of Security and Integrity (OSI), Personnel Security Division (PSD) has determined that performance of this contract requires that the Contractor, Subcontractor(s), vendor(s), etc. (herein known as Contractor), have unescorted access to a U.S. Government facility, access to U.S. Government Information Technology (IT) system(s) or access to Sensitive But Unclassified (SBU) information based on a need-to-know this information.

The Contractor and Contractor employees will adhere to the following requirements.

Note: The Government reserves the right to restrict access to some SBU information as needed to protect the Government’s interest.

Contractor access to classified information is not required under this contract. No access or safeguarding of classified information is authorized by Contractor employees at the Federal location or Contractor site.

FITNESS DETERMINATION

USCIS shall have and exercise full control over granting, denying, withholding, or terminating access of unescorted Contractor employees to a U.S. Government facility, access to U.S. Government IT system(s), or access to SBU U.S. Government information. USCIS has determined, or will determine, the risk/sensitivity level of positions under this contract.

The following conditions, among others, may be sufficient to disqualify a Contractor employee from performing under this contract:

• Misconduct or negligence in employment;

• Criminal conduct;

• Material, intentional false statement, or deception or fraud, in examination or appointment;

• Dishonest conduct;

• Excessive alcohol use, without evidence of rehabilitation, of a nature and duration that suggests the applicant or appointee would be prevented from performing the duties of the position in question, or would constitute a direct threat to the property or safety of the applicant, appointee, or others;

• Illegal use of narcotics, drugs, or other controlled substances, without evidence of rehabilitation;

• Knowing and willful engagement in acts or activities designed to overthrow the U.S.

Government by force;

Page 2 of 6 ACCESS TO SBU REV. 8/2025

• Any statutory or regulatory bar that prevents the lawful employment of the individual in the position in question;

• Violent conduct;

• Any other nondiscriminatory reason that an individual’s employment (or work on a contract) would not protect the integrity or promote the efficiency of the service.

USCIS may, as it deems appropriate, authorize and make a favorable Entry On Duty (EOD) determination based on favorable preliminary security checks. The favorable EOD determination will allow the Contractor employee to commence work temporarily prior to the completion of a full background investigation. The Contractor employee must begin performance on the contract within 180 days of the favorable EOD determination by OSI PSD. The Contractor will provide, through the Contracting Officer’s Representative (COR), notification to OSI PSD when an individual cannot/does not enter on duty or declines to enter on duty. Notification should be sent to the OSI PSD Customer Service mailbox at USCIS-OSI-PERSEC-CustomerServ@uscis.dhs.gov. The granting of a favorable EOD decision shall not be considered as assurance that a favorable final fitness determination will follow as a result thereof. The granting of a favorable EOD decision or final fitness determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by USCIS at any time during the term of the contract. No Contractor employee shall be allowed unescorted access to a U.S. Government facility, access to a U.S. Government IT system or access to SBU U.S. Government information without a favorable EOD determination or final fitness determination by OSI PSD.

BACKGROUND INVESTIGATIONS

Contractor employees and consultants requiring access to DHS facilities, IT systems, or SBU information under the contract, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The Contractor will comply with written requests, by the COR and/or OSI PSD, for information to determine Position Sensitivity Level. The results of the position sensitivity analysis by OSI PSD shall identify the appropriate background investigation to be conducted. Background investigations will be processed through OSI PSD.

The Contractor shall follow guidelines for package submission as set forth by OSI PSD. This includes compliance with requirements to submit forms through DHS enterprise established systems.

Performance on the contract is not authorized until a favorable EOD determination is made by OSI PSD.

To initiate the preliminary security screening process, the following forms must be submitted to OSI PSD for a reciprocity determination:

• DHS Form 11000-6, Non-Disclosure Agreement

• DHS Form 11000-25, Contractor Fitness/Security Screening Request

• USCIS Continuation Page to DHS Form 11000-25

If it is determined that reciprocity, or expedited EOD for Contractor employees with active clearances, does not apply, OSI PSD will request the following forms:

mailto:USCIS-OSI-PERSEC-CustomerServ@uscis.dhs.gov https://cisgov.sharepoint.com/sites/ECNosi/Offices/osi/PSD/PSD%20Resource%20Library/Forms/By%20Audience.aspx?id=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library%2F11000%2D6%20Nondisclosure%20Agreement%20Form%2Epdf&parent=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library https://cisgov.sharepoint.com/sites/ECNosi/Offices/osi/PSD/PSD%20Resource%20Library/Forms/By%20Audience.aspx?id=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library%2F11000%2D6%20Nondisclosure%20Agreement%20Form%2Epdf&parent=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library https://cisgov.sharepoint.com/sites/ECNosi/Offices/osi/PSD/PSD%20Resource%20Library/Forms/By%20Audience.aspx?id=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library%2FDHS%20Form%2011000%2D25%2Epdf&parent=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library https://cisgov.sharepoint.com/sites/ECNosi/Offices/osi/PSD/PSD%20Resource%20Library/Forms/By%20Audience.aspx?id=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library%2FDHS%20Form%2011000%2D25%2Epdf&parent=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library https://cisgov.sharepoint.com/sites/ECNosi/Offices/osi/PSD/PSD%20Resource%20Library/Forms/By%20Audience.aspx?id=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library%2FUSCIS%20Continuation%20Page%20to%20DHS%20Form%2011000%2D25%20%2D%20Fillable%2Epdf&parent=%2Fsites%2FECNosi%2FOffices%2Fosi%2FPSD%2FPSD%20Resource%20Library

Page 3 of 6 ACCESS TO SBU REV. 8/2025

• SF-85P, Questionnaire for Public Trust Positions (located in the eAPP system), which includes the following signature pages:

Fair Credit Reporting Disclosure and Authorization (FCR) Authorization for Release of Information (REL) Certification (CER) Authorization for Release of Medical Information (MEL) (if applicable)

• OF-306, Declaration for Federal Employment (approved use for Federal Contract Employment)

• Electronic fingerprint capture

The Contractor shall submit security forms to OSI PSD through the COR within five business days of notification of initiation of eAPP.

The Contractor shall not submit security forms for Contractor employees that are not currently needed to perform services on the contract. The number of vetted Contractor employees should be limited to the number necessary to meet contractual obligations.

EMPLOYMENT ELIGIBILITY

To ensure adequate background investigative coverage, Contractor employees must currently reside in the United States or its Territories. Additionally, Contractor employees are required to have resided within the United States or its Territories for three or more years out of the last five years. USCIS retains the right to deem an applicant as ineligible due to insufficient background coverage. This timeline is assessed based on the signature date of the SF-85P submitted for the applied position.

Contractor employees falling under the following categories may be exempt from the residency requirement:

• Those who have a current and adequate background investigation (commensurate with the position/risk sensitivity levels) completed for a Federal or Contractor employee position, in accordance with national policy;

• Those who work or worked for the U.S. Government in foreign countries in Federal civilian, contractor, or military capacities;

• Those who were or are dependents accompanying a Federal civilian or a military employee serving in foreign countries so long as they were or are authorized by the U.S.

Government to accompany their Federal civilian or military sponsor in the foreign location(s);

• Those who worked as a contractor employee, volunteer, consultant, or intern on behalf of the Federal Government overseas where stateside coverage can be obtained to complete the background investigation.

Page 4 of 6 ACCESS TO SBU REV. 8/2025

In accordance with “DHS Sensitive Systems Policy Directive 4300A”, only U.S. citizens are eligible for employment on contracts requiring access to DHS IT systems or involvement in the development, operation, management, or maintenance of DHS IT systems, unless a waiver has been granted by the Director of USCIS, or designee, with the concurrence of both the DHS Chief Security Officer and the Chief Information Officer or their designees.

In accordance with the Homeland Security Presidential Directive-12 (HSPD-12) http://www.dhs.gov/homeland-security-presidential-directive-12, Contractor employees who require unescorted access to USCIS facilities and/or utilize USCIS IT systems must be issued and maintain a Personal Identity Verification (PIV) card throughout the period of performance on their contract. Government-owned Contractor-operated facilities are considered USCIS facilities. PIV cards will be issued after OSI PSD has notified the COR that a favorable EOD determination has been rendered.

For new EODs, Contractor employees have ten business days from their EOD date to comply with HSPD-12. For existing EODs, Contractor employees have ten business days from the date these requirements are incorporated into the contract to comply with HSPD-12.

Contractor employees who require, but do not have, a PIV card must schedule an appointment to have one issued. To schedule an appointment:

https://cisgov.sharepoint.com/sites/connect/org/MGMT/OSI/Pages/HSPD-12.aspx

Contractor employees who are unable to access the hyperlink above shall contact the COR for assistance.

A Contractor employee required to have a PIV card shall:

• Properly display the PIV card above the waist and below the neck with the photo facing out so that it is always visible while in a USCIS facility.

• Keep their PIV card current

• Properly store the PIV card while not in use to prevent against loss or theft

Contractor employees who do not have a PIV card will need to be escorted at all times by a Government employee while at a USCIS facility and will not be allowed access to USCIS IT systems.

The Contractor will notify the COR of all terminations/resignations of Contractor employees immediately, but no later than 24 hours of occurrence, so that the COR can initiate required Exit Clearance actions on behalf of USCIS. The Contractor will return any USCIS issued PIV/identification cards, building passes, and any additional Government issued property (e.g.

computer, cell phone, etc.) of terminated/resigned employees to the COR. The COR will return PIV/identification cards and building passes to USCIS. The COR is responsible for immediately initiating the required Exit Clearance process to ensure all mandatory off boarding actions occur.

If PIV/identification card or building pass are not available to be returned, a report must be https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocso/CSTD/SecurityPerformanceAssessment/DHS%20Policy%20Directive%204300A%20-%20DHS%20Sensitive%20Systems%20(20170727).pdf#search=4300 http://www.dhs.gov/homeland-security-presidential-directive-12 https://cisgov.sharepoint.com/sites/connect/org/MGMT/OSI/Pages/HSPD-12.aspx

Page 5 of 6 ACCESS TO SBU REV. 8/2025 submitted to the COR referencing the pass or card number, name of individual to whom it was issued, the last known location and disposition of the pass or card.

CONTINUED ELIGIBILITY

USCIS reserves the right and prerogative to deny and/or restrict a Contractor employee from accessing a U.S. Government facility, access to U.S. Government IT system(s), or access to SBU information if the employee’s actions are in conflict with the standards of conduct or whom USCIS determines to present a risk of compromising SBU Information and/or classified information.

If a Contractor employee is found to be ineligible for access to USCIS facilities or information, the COR will advise the Contractor that the employee must stop performing services on the contract immediately.

USCIS will conduct periodic reinvestigations as required by regulation, to evaluate the continued fitness of Contractor employees. Security documents will be submitted to OSI PSD within five business days following notification of a Contractor’s reinvestigation requirement.

The Federal Government is transitioning to Trusted Workforce (TW) 2.0. TW 2.0 is a whole-of- Government background investigation reform effort overhauling the personnel vetting process by creating a Government-wide system that allows transfer of trust across organizations. All Contractor employees will be enrolled into continuous vetting at a date to be determined. Enrollment will be via a future continuous vetting system. Enrollment will include multiple requirements from all personnel and potential changes to processes, procedures, and systems. This contract will comply with all requirements that facilitate the mandated transition to TW 2.0. Periodic reinvestigations will continue to be a requirement until USCIS has fully transitioned to TW 2.0.

In support of the overall USCIS mission, Contractor employees are required to complete DHS/USCIS mandatory trainings as outlined in the Mandatory Training Resources table located here:

https://cisgov.sharepoint.com/sites/ECNhctt/Offices/hct/Training/TrnAdmWS/SitePages/1/Mandatory TrainingResources.aspx. Coordination with the course content owner will be needed to obtain off-network versions of the trainings for Contractors without USCIS network accounts. The COR will assist with identifying the course content owner. The Contractor shall certify that all mandatory trainings have been completed by established deadlines identified in the Mandatory Training Resources table.

The certification of the completion of the trainings by all Contractor employees shall be provided to both the COR and Contracting Officer (CO).

SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OSI through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

https://cisgov.sharepoint.com/sites/ECNhctt/Offices/hct/Training/TrnAdmWS/SitePages/1/MandatoryTrainingResources.aspx https://cisgov.sharepoint.com/sites/ECNhctt/Offices/hct/Training/TrnAdmWS/SitePages/1/MandatoryTrainingResources.aspx

Page 6 of 6 ACCESS TO SBU REV. 8/2025

The COR and OSI shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. If the Contractor fails to comply with the security requirements of this contract, the Contractor will be informed in writing by the CO or COR of the proper action to be taken to ensure compliance with such requirements.

REQUIRED REPORTS

Contractor employees will report any adverse information concerning their personal conduct to OSI PSD. The report shall include the Contractor’s name along with the adverse information being reported. Required reportable adverse information includes, but is not limited to, criminal charges and/or arrests, negative changes in financial circumstances, and any additional information that requires admission on the SF-85P or on any security form listed above.

The Contractor will provide to the COR a list of each position and its corresponding description of duties that will be required to meet full performance on the contract. The information must be detailed, thorough and accurate. The Contractor will provide updates when there are changes, to include when there are new positions, when positions are no longer needed and when there is a change in a position title or a description of duties. CORs will submit this information to USCIS-OSI-PSD- ContractorPD@uscis.dhs.gov no later than five days after contract award, unless directed sooner by the CO.

The Contractor will provide to the COR a Quarterly Report (on a Microsoft Excel Spreadsheet) containing the names of Contractor employees who are actively performing services on the contract.

The list shall include the Name, Position Title and SSN (last four digits) and should be derived from the system(s) used for Contractor payroll processing to ensure accuracy. OSI PSD will use this list to reconcile the contract quarterly. CORs will submit reports to USCIS-OSI-PERSEC- CONTRACTS@uscis.dhs.gov no later than the 10th day of each January, April, July and October.

mailto:USCIS-OSI-PSD-ContractorPD@uscis.dhs.gov mailto:USCIS-OSI-PSD-ContractorPD@uscis.dhs.gov mailto:USCIS-OSI-PERSEC-CONTRACTS@uscis.dhs.gov mailto:USCIS-OSI-PERSEC-CONTRACTS@uscis.dhs.gov