C5_FDA CTR Personnel Security Clearance.pdf

75F40126R00020 Request for Proposal FDA Occupational Safety, Industrial Hygiene, Information Systems, and Training (OSIST)

Attachment C5 – FDA Contractor Personnel Security Clearance Standards

FDA Contractor Personnel Security Clearance Standards and Residency Requirements (October 2017)

1. BACKGROUND - The Office of the Assistant Secretary for Management and Budget, Department of Health and Human Services (DHHS), requires that Contractor employees (including subcontractors) who will be working in DHHS-owned or leased space and/or who will have access to DHHS equipment, and non-public privileged, proprietary, or trade secret information, must undergo a background investigation that results in a favorable determination.

Contractor employees who will work in DHHS-owned or leased space for less than thirty

(30) days are considered visitors and are exempted from background investigation requirements; and therefore, will not be issued a Personal Identity Verification (PIV) Card. These contractor employees go through visitor screening each day and must be escorted at all time while in DHHS-owned or leased space.

2. GENERAL - The Contractor must submit the following items to the Contracting Officer’s Representative (COR), within five (5) business days of commencement of work under this contract:

• A roster of contractor employee names, identifying Key Personnel and Tier designation(s);

• Confirmation all individual employee security information has been submitted properly; and

• "Contractor's Commitment to Protect Non-public Information Agreement" forms signed by each employee named in the roster.

Pursuant to HSPD-12, the Contractor must advise its prospective employees about the security and background requirements stated herein.

For any individual who does not obtain a favorable background investigation he/she must cease work on the contract immediately.

If a Contractor employee changes job responsibilities under this contract, the Contractor must notify the COR, and the Government will make a determination whether an additional security clearance is required.

In the event there are any proposed personnel changes in the Contractor’s staffing roster previously submitted to the COR, the Contractor must submit an updated roster to the COR, along with a brief explanation for the change. In turn, the COR will initiate the procedures stated herein to ensure any new contractor employees obtain a PIV card in a timely manner – prior to that individual commencing work under the contract.

Note: If the proposed personnel change is for a position designated Key Personnel under the contract, a complete justification – along with a resume or curriculum vitae – must be submitted to the Contracting Officer and COR for review and approval. If approved, the Contracting Officer will execute a Contract Modification prior to that individual commencing work under the contract.

3. BACKGROUND INVESTIGATIONS - With the exception of costs associated with fingerprinting Contractor employees outside of the FDA Personnel Security Office, the Government will conduct all required background investigations at no cost to the Contractor.

The cost of fingerprinting Contractor employees at any location other than the FDA Personnel Security Office will be borne by the Contractor. Employees who hold or have previously held a Government security clearance must advise the FDA Personnel Security Staff of the details of such clearance.

Note: Background investigations will be conducted by the Defense Counterintelligence and Security Agency (DCSA)

4. CONTRACT RISK DESIGNATION(S) - Contractor employees who will be in DHHS-owned or leased space for thirty (30) days or more must be able to obtain and shall obtain a PIV card pursuant to Homeland Security Presidential Directive-12 (HSPD-12) in order to access to DHHS-owned or leased property without an escort. (See Section 6 for details on the PIV Card process) However, in the event that work must commence before a security screening can be completed, contractor employees will be considered visitors, as described above, and allowed onto DHHS-owned or leased property, but must be escorted at all times.

All Contractor employees who undergo a background investigation are required to log onto the the National Background Investigation Services (NBIS) eAPP system. The FDA Personnel Security Specialist will provide access to the e-Qip as well as guidance as to which forms will be required. The forms required vary with the position risk designations for the contract.

All standard forms submitted to the FDA will be forwarded to the Defense Counterintelligence and Security Agency (DCSA) to initiate background investigations. The assigned FDA Personnel Security Specialist will resolve with the contractor employee any issues arising out of inaccurate or incomplete forms.

The Risk Designation(s) for this contract is/are Tier(s): 1

There are three (3) potential position risk designations, which are:

• Non-Sensitive Low Risk (Tier 1) - Positions which involve the lowest degree of adverse impact on the efficiency of the Agency. The forms set forth by the FDA Personnel Security Specialist are required for Non-Sensitive Low Risk Positions.

• Sensitive Moderate Risk (Tier 2) or Sensitive High Risk (Tier 4) - Public Trust

Positions - Positions in which the incumbent's actions or inaction could diminish public confidence in the integrity, efficiency, or effectiveness of assigned Government activities, whether or not actual damage occurs.

In order to access the e-QIP system, Contractor employees must provide the appropriate FDA Personnel Security Specialist with the following information: (a) full name; (b) position title; (c) social security number; (d) date of birth; (e) place of birth; (f) email address; and

(g) phone number. This information will be provided on the e-Qip form that will be electronically sent to the employee. The FDA Personnel Security Specialist will use this information to enter each Contractor employee into the e-QIP system. Once this is done, each Contractor employee will receive an email that contains a web link to access the e- QIP system, as well as instructions and additional forms needed to initiate the background investigation.

A Contractor’s failure to comply with the e-QIP processing guidelines will result in that Contractor’s employees being denied access to FDA property until all security processing has been completed. Furthermore, any such noncompliance may detrimentally impact Contractor performance, Contractor performance evaluations, rights and remedies available at law and equity retained by the Government.

5. PERSONAL IDENTITY VERIFICATION (PIV) CARDS - All PIV Cards (and any other type of Government-issued Access Card) shall remain the property of the Federal Government. At any time, if a Contractor employee is terminated or otherwise ceases work under the contract, or no longer requires a PIV Card for contract performance purposes, the Contractor must collect the individual’s PIV card and immediately notify FDA Personnel Security Staff in writing, with copies to the respective COR and Contracting Officer. The Contractor must immediately return the PIV Card(s) to the COR.

Because PIV Cards, like other Government-issued Access Cards are Government property, Contractors and Contractor Employees are hereby placed on notice that any abuse, destruction, defacement, unauthorized transfer or withholding (i.e., failure to return to the Government) may be punishable to the greatest extent at law.

Unauthorized possession of a PIV Card, or any other type of Government-issued Access Card, and/or willfully allowing any other person to have or to use your Access Card, is prohibited and can be criminally prosecuted under 18 U.S.C. §§ 499 and 70I, which prohibit photographing or otherwise reproducing or possessing HHS identification cards in an unauthorized manner, under penalty of fine, imprisonment, or both. Wrongdoers may also be held financially responsible for any/all civil and equitable remedies – to include, but not limited to, damages for any pecuniary loss suffered by the Government as a result of any of the above-listed actions or failure to act.

6. PIV CARD PROCESS - The COR will sponsor Contractor employees on the Form HHS 745 and HHS Smart Card Management System (SCMS) for the purpose of obtaining an FDA PIV Card. In order to obtain a PIV card, a Contractor employee must receive a favorable FBI fingerprint return and complete required security forms. The FDA Personnel Security Specialist will provide the Contractor employee(s) direction for scheduling fingerprinting appointments at the FDA location or other approved location.

During a fingerprint appointment, each contractor employee must present two (2) forms of identification in order to receive his or her PIV Card. One form of identification must be a government-issued photo identification document. Acceptable forms of identification are listed in

Appendix A, provided below. An individual who receives an unfavorable report may appeal that finding by submitting a written request to the FDA Personnel Security Specialist.

Required background investigations may include, but are not limited to:

• Review of prior Government/military personnel records;

• Review of FBI records and fingerprint files;

• Searches of credit bureaus;

• Personal interviews; and

• Written inquiries covering the subject's background.

7. RESIDENCY REQUIREMENTS FOR FOREIGN NATIONALS - Under the requirements for Homeland Security Presidential Directive-12 (HSPD-12), DCSA can complete a background investigation only for persons who have resided in the U.S. for a total of at least three (3) of the past five (5). The residency requirements apply only to foreign nationals. If any prospective foreign national contractor/subcontractor employee does not meet the residency requirements, he/she cannot qualify for a PIV Card under HSPD-12.

8. NON-PUBLIC DATA PROTECTION - The Contractor must protect the privacy of all information reported by or about Contractor employees and protect against unauthorized disclosure.

*Upon a favorable fingerprint return, the Contractor will be notified to return to the

Badging and Credentialing Office for their building pass.

*Food and Drug Administration Badging and Credentialing Office 8:00 a.m. – 12:00 p.m. and 1:00 p.m. – 3:00 p.m., Eastern

Time 10903 New Hampshire Avenue Building 32, Room 1205

Silver Spring, MD 20993

By appointment only Telephone: (301) 796-4000

NIST FIPS 201-3 I SP -12 PI I

(I- PI I

April 30, 2025

P

S

S N T

[SP 800-63A

MAY

S A N T

MAY

D

[ A -I

-551)

-766)

A

- -94A

-560

-561) -550

-570) -197)

-179)

-1350)

-327)

D

O

A

NIST [SP 800-63A

NIST FIPS 201-3 A I SP -12 PI I

(I- PI I

April 30, 2025

N T I FIPS-201-3 2 PI I

P 2022 A

( I ( F A I