D.18 Personnel Security SOP Lebanon 36C24423R0132.pdf

Personnel Security Standard Operating Procedures November 03, 2021 | Area Lebanon

FOR INTERNAL USE ONLY

OFFICE OF INFORMATION AND TECHNOLOGY

FOR INTERNAL USE ONLY 2

Table of Contents

1 PURPOSE

2 SCOPE

3 POLICY

4 ROLES & RESPONSIBILITES

4.1 Facility Directors/Information System Owners and Program Managers

4.2 Human Resources (HR) Management Offices will:

4.3 Program or Project Managers, Contracting Officer Representative (COR) will:

4.4 Site Voluntary Service Officer will:

4.5 Information System Security Officers (ISSO) will:

5 PROCEDURES

5.1 Personnel Security Policy and Procedures - PS-1

5.2 Position Risk Designation - PS-2

5.3 Personnel Screening - PS-3

5.4 Personnel Termination - PS-4

5.5 Personnel Transfer - PS-5

5.6 Access Agreements PS-6

5.7 Third-Party Personnel Security - PS-7

5.8 Personnel Sanctions - PS-8

6 RESCISSIONS

7 REFERENCES

FOR INTERNAL USE ONLY 3

DOCUMENT CHANGE CONTROL

Version Release Date

Summary of Changes Reviewer Name/Title

Signature

1.0 11/03/2021 Initial DRAFT; submitted to Information System Owner and Information System Security Officer for review/implementation

Andru Ditzler / System Owner

1.1 11/03/2021 Final review; publication Use Andru Ditzler / System Owner

FOR INTERNAL USE ONLY 4

1 PURPOSE

This Standard Operating Procedure has been created to support and facilitate Personnel Security Controls at Area Lebanon. The procedures outlined in this document are consistent with VA Directives and VA Policies, VA Knowledge Service, and VA Handbook 6500.2.

The purpose of this Standard Operating Procedure (SOP) is to establish procedures for providing mandatory safeguard processes for the Personnel Security (PS) controls for all employees who are assigned to Area Lebanon, and are involved with the management, operation, and personnel security of the Area Lebanon information systems.

2 SCOPE

This SOP is applicable to all staff involved in the onboarding and offboarding process for all types of personnel assigned to the Area Lebanon.

3 POLICY

The intent of this document is to facilitate the implementation of Personnel Security controls as outlined by the National Institute of Standards and Technology (NIST).

Area Lebanon is required to follow published VA policies and regulations which establish criteria and procedures for making suitability determinations and taking suitability actions involving applicants for and appointees to covered positions. Suitability determinations are based on a person’s character or conduct that may have an impact on the integrity or efficiency of the service. Determining suitability for Federal employment will be consistent with 5 Part Code of Federal Regulations (CFR) 731. Determining fitness for contractor employees will be based on criteria equivalent to that used for Federal employees. Determinations made under this category are distinct from determinations of eligibility for assignment to, or retention in, sensitive national security positions. All assigned employees are required to comply with this PS

SOP.

This SOP requires Area Lebanon staff offices to collaborate, participate, and recognize the shared, related, and interdependent responsibility to provide effective and efficient personnel security services.

4 ROLES & RESPONSIBILITES

4.1 Facility Directors/Information System Owners and Program Managers

Responsible for ensuring the Standard Operating Procedures set forth in this document are followed by the individuals under his/her responsibility

4.2 Human Resources (HR) Management Offices will:

» Ensure all positions are designated with the appropriate risk or sensitivity level in accordance with the Position Designation Application Tool (PDAT) and ensure that each appointee and

FOR INTERNAL USE ONLY 5

employee receive a background investigation commensurate with the position risk or sensitivity level.

» Ensure position risk and sensitivity level designations are consistently applied to all positions in accordance with 5 CFR Part 731, Suitability, and 5 CFR Part 732, National Security Positions and the VA Knowledge Service. When appropriate, refer appointees and employees in Public Trust and National Security positions to the Security and Investigations Center (SIC) for initiation and adjudication of the investigation.

» Ensure appointees and employees in Low Risk/non-sensitive positions have background investigations initiated and adjudicated at the local level within established timeframes.

Adjudicative determinations must be made by appropriately trained personnel and reported to OPM.

» Ensure a fingerprint Special Agreement Check (SAC) is conducted on all new appointees who are exempt from the requirement to have a NACI or higher-level investigation. Whenever possible, the SAC should be performed prior to the appointee’s entrance on duty. When this is not possible, the SAC must be performed as part of the in-processing procedures. Ensure the SAC is adjudicated by appropriately trained personnel no later than 5 workdays after the results are received.

» Ensure all VA employees and contractors are successfully in-processed to and out-processed from the organization.

4.3 Program or Project Managers, Contracting Officer Representative (COR) will:

» Ensure appropriate language is included in applicable contracts so the Statement of Work (SOW) accurately reflects the requirements of the contract. The SOW (or other defining documentation related to the contract) must be reviewed using the PDAT and given the appropriate designation.

» Ensure all contractor employees who are not exempt from the investigative requirement are referred to the SIC for initiation and adjudication of the appropriate level of investigation.

» Ensure a SAC is initiated on all new contractor employees who are exempt from investigative requirements and who provide direct and/or ancillary health care services at VA facilities or have access to VA information systems or sensitive information per VA Directive 0710 May 2, 2016.

» Ensure the SAC is adjudicated by appropriately trained personnel no later than 5 business days after the results are received.

» Ensure appropriate personnel security contract clauses are included in the contracts.

4.4 Site Voluntary Service Officer will:

» Ensure a SAC is initiated prior to entry on duty for all new volunteers who have:

• Assignments associated with home health care;

• Assignments involving the provisions of patient care or working alone with patients;

• Assignments involving contact with pharmaceuticals or other biological agents;

FOR INTERNAL USE ONLY 6

• Assignments that provide access to patient records;

• Assignments involving clinical research;

• Assignments that provide access to any VA computer system;

• Access to any sensitive or Privacy Act protected information not identified above.

• Ensure the SAC is adjudicated by appropriately trained personnel no later than 5 workdays after the results are received.

4.5 Information System Security Officers (ISSO) will:

Manage the local information security program and serve as the principal security advisor regarding system access for all users.

5 PROCEDURES

5.1 Personnel Security Policy and Procedures - PS-1

» VA Knowledge Service is the overarching security policy that provides the risk-management based process for selecting VA information technology system security controls and is consistent and in alignment with NIST standards and guidelines and other related requirements. VA Knowledge Service, based on the current version of NIST SP 800-53, outlines VA’s system security controls required for the effective implementation of the Personnel Security family. The Area Lebanon follows policies and procedures outlined within VA Directive and VA Knowledge Service; VA Directive and Handbook 0710, Personnel Suitability and Security Program; and VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program for guidance and specific requirements for background screening of VA employees and contractors prior to granting access to VA information systems. VA policies are updated every 5 years per VA Directive and Handbook 6330.

» In addition, per VA Handbook 6500.6, the Program or Project Managers and Information System Owners who request or manage a contract or service must ensure that background investigations are initiated through the VA Security and Investigations Center.

» This SOP supports and facilitates the implementation of the information system Personnel Security Controls. The procedures outlined in this document are consistent with VA Directives, VA Policies, VA Knowledge Service, VA Handbook 0710 and VA Handbook 0735.

» This SOP will be reviewed at least every 365 days and updated every 5 years or when changes occur in the procedures or regulations, whichever is the earliest. The policy and SOP will be disseminated to those responsible for implementing the requirements.

5.2 Position Risk Designation - PS-2

» The organization has a Position Sensitivity Level Designation Process in place. Position sensitivity level refers to the degree of risk inherent in a position. Area management is responsible for ensuring that all positions are reviewed and assigned a sensitivity level that is commensurate with the degree of access, and the nature of the data being processed.

Position Sensitivity Level Designations are used to determine the eligibility of an employee to occupy a sensitive position and the type of investigation that must be conducted for the

FOR INTERNAL USE ONLY 7

employee to retain that position. Security criteria are used to screen background data collected on candidates and to determine their suitability for the position.

» All positions subject to investigation are designated with a risk and sensitivity level based on the documented duties and responsibilities contained within the Position Description (PD) and based on the PDAT review to determine the appropriate level of investigation for positions. Risk Levels are designated as Tier 4/High Risk, Tier 2/Moderate Risk, or Tier 1/Low Risk.

» The local Human Resources Office and the COR will utilize the Office of Personnel Management Position Designation Tool to determine the position risk designation and sensitivity levels. Incumbent employees, selected applicants, and contracted employees in positions designated as critical-sensitive must receive a high risk or moderate risk background investigation. The designation is based on an analysis of the official position description regarding degree of public trust, fiduciary responsibility, importance to the program, and authority and supervision received. All Position Designations are reviewed against Position Description by Human Resources. Based on these categorizations, appropriate background investigations are initiated.

» Human Resources Staff will ensure position risk and sensitivity level designations are consistently applied to all positions in accordance with 5 CFR Part 731, Suitability; 5 CFR Part 732, National Security Positions; and the VA Information Security Program. When appropriate, appointees and employees in Public Trust and National Security positions will be referred to the SIC for initiation and adjudication of the investigation.

» Supervisors will ensure position descriptions are written to reflect specific security responsibilities.

Note: Within this context, "significant security responsibilities," refer to employee obligations to protect VA sensitive information and to use such information, and the information derived from it, only in the execution of official duties.

5.3 Personnel Screening - PS-3

» Screening will be conducted for both federal and contract personnel who participate in the operation or maintenance of VA sensitive applications and VA sensitive information systems, as well as those individuals having access to VA sensitive data or information. The level of screening required will vary from minimal checks to full background investigations, depending upon the sensitivity of the information to be handled and the risk of loss and magnitude of harm that could be caused by the individual. Human Resources and CORs will utilize the Position Designation Application Tool (PDAT) to make this determination.

» All members of the VA workforce will go through the background screening process for the appropriate level of clearance required in accordance with existing Office of Personnel Management (OPM) and VA Policy. Screening is initiated with the Special Agreement Check (SAC) request (fingerprinting process). The Personal Identity Verification (PIV) procedures require that prior to issuance of a PIV badge, the appropriate level of background investigation has been initiated or adjudicated. The Special Agreement Check Card is also required prior to the expiration date of the issued PIV card for employee and contractors.

» Human Resources Management will:

FOR INTERNAL USE ONLY 8

• Pre-screen all workforce personnel, including new employees, without compensation staff (WOCs), students and volunteers utilizing VA Form 10-0453 Screening Checklist. As part of the screening process, Human Resources staff will verify, at a minimum, the accuracy of everyone’s identification, credentials, employment history, fingerprint checks, validation of resume, and educational references.

• Ensure appointees and VA employees have a successfully adjudicated background screening (Special Agreement Check) prior to permitting permanent access to VA information and information systems; in accordance with requirements contained in VA Directive and Handbook 0710 and VA Directive 0735.

• Utilize HRSmart to track employee background investigations and make the necessary updates to ensure that the database within the tool is accurate.

• Ensure re-investigations are initiated/conducted as indicated below, unless otherwise directed/addressed by VA policies:

▪ Tier 4/High Risk – Every 5 years

▪ Tier 2/Moderate Risk (Police Officers) – Every 5 years

▪ Individuals in Critical-Sensitive or Special-Sensitive position – Every 5 years

• In the event a position requirement changes to reflect a higher level or risk or sensitivity level

» Program or Project Managers, and COR

• Will ensure contractors have successfully adjudicated background screening (Special Agreement Check) prior to permitting permanent access to VA information and information systems; in accordance with requirements contained in VA Directive and Handbook 0710 and VA Directive 0735. Successful screening is conducted for all contract personnel.

• Will use a local management tracking tool to manage employee background investigations.

Note: Background Investigations: The level of background investigation required will vary, depending upon the sensitivity of the information to be handled and the risk and magnitude of loss or harm that could be caused by the individual. Procedures for completing background investigations are contained in VA Directive and Handbook 0710.

5.4 Personnel Termination - PS-4

» Service Chief and Supervisors, in coordination with HR Staff, will initiate termination actions upon knowledge of an employee separation/retirement or transfer to another facility.

Supervisors are responsible to ensure that all system user access are disabled properly, to include CUPS, IFCAP, DSS, BISL, HEC, VHA NDS, etc.

» The Supervisors will ensure that the separating employee completed and signed the Employee Clearance from Indebtedness form.

• For all separation or transfer actions, LEAF and Epas requests will be utilized to ensure accounts are properly disabled in a timely manner. The site ITOPS staff and ISSO will

FOR INTERNAL USE ONLY 9

ensure that every user account (Network, VistA, CSS, and VPN) is disabled within 24hours of the notification date or the effective date of separation, whichever comes first.

• The Service will submit LEAF and Epas request to properly document the deactivation of Network and VistA accounts.

• The VA Exit Survey includes information security topics for separating employees, to ensure the terminated individual understand the security constraints imposed by being former employee and to protect the VA sensitive information. The VA Exit Survey can be accessed here: https://survey.htm.va.gov/Perseus/se/2EA0F6794572BFAA

• ITOPS will disable information system access and will terminate/revoke any authenticators/credentials associated with the individual within 24 hours upon notification.

• ITOPS will retrieve all security-related VA information system-related property and complete VA Form 0887 VA Government Property Loan Form.

• HR will revoke and destroy the PIV credentials/card. In the event the user is separated due to intra-agency transfer, the individual will retain his/her PIV credentials. All PIV credentials are turned in to the PIV office for disposal.

• The Supervisor will ensure to retain access to VA information and information systems formerly controlled by the terminated individual.

• Note: all exit clearance form will be maintained for record.

• During other than clearance circumstances, Service Chief/Supervisors will request to ITOPS before close of business to disable/terminate user accounts on the date is determined that access is no longer required (i.e., work studies no show, employee on extended leave, suspension, etc.) An email will be sent to the ITOPS with full name of employee, User ID, and reason for disabling/terminating account.

• In the event of an unfriendly termination, the Service Chiefs, ISSO, and System Owner are notified by the appropriate authority immediately to close the user’s systems accounts. If the terminated user has the system administrator’s account access password, the password will be changed immediately. If an employee is to be fired, system access will be removed at the same time (or just before) the employee is notified of their dismissal.

During the “notice of termination” period, it may be necessary to assign the individual to a restricted area and function. This may be particularly true for employees capable of changing programs or modifying the system or applications. In some extreme cases, physical removal from the offices may be necessary.

» For users with Elevated Privilege functions:

• The Information System Owner will ensure that all elevated privilege access is revoked immediately and that the token is retained.

• An email message will be sent to FITS to ensure NMEA and/or Programmer Menu access is disabled immediately.

• The employee Supervisor will submit LEAF and Epas request to have all elevated privileges removed/deleted.

https://survey.htm.va.gov/Perseus/se/2EA0F6794572BFAA

FOR INTERNAL USE ONLY 10

5.5 Personnel Transfer - PS-5

» When an employee transfers within the facility, both the losing and gaining services will immediately initiate action to adjust menu access as necessary to ensure appropriate minimum-necessary access is granted. All managers/supervisors must ensure that access to information systems is revoked for personnel when no longer required due to change in job responsibilities, or transfer.

» HR Staff will review background investigation requirements and, if necessary, ensure that rescreening action is initiated based on the new PD.

» Upon receiving notification of an intra-facility reassignment or transfer action from HR, the losing Service Chief or designee is responsible for initiating a request to remove current menus. The gaining Service Chief will submit a request to modify/adjust menus and permissions as needed to perform assigned duties using the "least privilege" method.

» The Service Chief will notify ITOPS of any reassignment or intra-facility transfers actions within 24 hours. All personnel transfer changes will occur as soon as possible, but no later than 30 days after the effective date of the transfer action.

» As part of the transfer/reassignment actions the below activities will take place:

• Remove keys assigned when no longer required/needed

• Remove access to share folders

• Remove access to secure areas

• Ensure to remove any other access relevant to the current position.

5.6 Access Agreements (PS-6)

» All individuals requiring access to VA information systems must accept the appropriate National Rule of Behavior (ROB) prior to receiving access to VA information system(s) and re-sign at least annually thereafter. Failure or refusal to accept the rules of behavior will result in loss of system access.

» Area Lebanon will recognize only the current, published VA National Rules of Behavior as the acceptable access agreement for all personnel with, or requesting access to VA information systems.

» New Employees will sign the VA National Rules of Behavior prior to completion of their New Employee Orientation sessions. Any workforce members who are without compensation, students, contractors and volunteers must sign the ROB prior to receiving access to any VA information systems. Self-enrollment to the Talent Management System (TMS) and completion of the VA Privacy and Information Security and Rules of Behavior course, or the Mandatory Training for Trainees course will fulfill that obligation.

» Supervisors will assure employees have signed the Rules of Behavior prior to requesting access to the information system and re-sign annually thereafter.

» The ISSO will audit compliance with mandatory training and Rules of Behavior compliance.

Discrepancies/delinquencies will be reported to the appropriate Service Chief/Manager.

FOR INTERNAL USE ONLY 11

5.7 Third-Party Personnel Security - PS-7

» The Contracting Officer Representative (COR) is responsible for assuring background investigations are initiated for contracted users requiring access to VA information system(s) in accordance with VA Knowledge Service and VA Directive 0710. The COR is also responsible to monitor contractor compliance with VA information security requirements.

» All contracts, agreements, and relationships must be assessed to determine if a business associate relationship exists. A business associate relationship exists if the facility is required to release protected health information to a contractor or business partner for them to provide services on the facility’s behalf. If a business associate relationship is determined to exist, a business associate agreement must be enacted utilizing language approved by VHA Privacy Office. If a business associate is determined to serve more than one VA medical center, a national BAA may be enacted through the VHA HIPAA Program Management Office. BAA’s must be kept updated and documentation of agreements must be maintained as long as the agreement is in force. Nationally signed BAA’s may be found on the following website:

http://vaww.vhadataportal.med.va.gov/DataAccess/BusinessAssociateAgreements.aspx.

» In contracts/agreements for hardware, software, and computer-related services, appropriate security requirements, specifications, and training must be included in statements of work.

Security requirements and specifications should be properly implemented before the system is placed in operation and throughout the life cycle of the system. The site Contracting Officer, Privacy Officer, and ISSO will work together to identify entities that are business associates under the HIPAA Security Rule and ensure that Business Associate Agreements (BAAs) are enacted for all business associates in accordance with HIPAA BAA policies and procedures.

» All non-VA users having access to VA information resources through a negotiated contract, agreement, or arrangement shall meet the security levels defined by the contract, agreement, or arrangement. Clauses must be included in the procurement document(s) to prevent the contractor from inappropriately using or disclosing the information during the contract, agreement, or arrangement and after it has terminated. Contractors must adhere to Business Associate Agreement requirements, as applicable. The [define] Contracting Office and local contracting officers, with the cooperation of contracting officer’s representatives (COR’s) are responsible for implementing this policy.

» The COR will follow the site termination/transfer procedures as outlined on PS-4 Personnel Termination, PS-5 Personnel Transfer, and site Clearance procedures to ensure account termination for all third-party personnel is processed in a timely manner.

» The Contract Officer will:

• Identify and document personnel security requirements including security roles and responsibilities for third-party providers; this will be detailed in the contract.

• Require third-party providers to comply with personnel security policies and procedures established by VA

• Require third-party providers to notify the COR immediately of any personnel transfers or terminations of third-party personnel who possess VA credentials and/or badges, or who http://vaww.vhadataportal.med.va.gov/DataAccess/BusinessAssociateAgreements.aspx

FOR INTERNAL USE ONLY 12

have information system privileges. Also, when a contractor leaves prior to an unfriendly termination.

• Monitor provider compliance.

• The ISSO will:

▪ Assist CORs with the inclusion of personnel security requirements within acquisition-related documents and agreements

▪ Ensures personnel security requirements for third-party personnel are identified in contract agreements, Memorandum of Understanding, acquisition related documents such as Statement of Work

▪ Monitor third-party compliance with security requirements.

5.8 Personnel Sanctions - PS-8

• Area Lebanon relies on the national incident reporting policy VA Handbook 6500.2, Management of Security and Privacy Incidents, to determine what constitutes a security incident in the context of its business operations. Users who cause a security incident or who violate the National Rules of Behavior are subject to corrective or progressive disciplinary action by their supervisor. It is the responsibility of the supervisor, under the advisement of Human Resources Management, to decide upon and levy the appropriate sanction.

• Area Lebanon will adhere to the Table of Penalties established in VA Handbook 5021 to consider the appropriate level of sanction regarding information security incidents.

Actions may include, but are not limited to, progressive discipline or other resolutions.

Appropriate legal authorities outside of the agency may levy civil or criminal sanctions.

• The site’s Human Resources Service is responsible to employ a formal corrective action or sanction process for personnel failing to comply with established information security policies and procedures and will monitor personnel corrective actions or sanctions on an ongoing basis.

• If a security violation is noted, the Information Security Officer will determine the type of security violation. The ISSO will notify and provide evidence of the security violation to the employee’s Supervisor.

• When a formal sanction is initiated by other than the ISSO investigation, the local staff will ensure to immediately notify the System Owner and ISSO to take appropriate action in the event the sanctions involve removal/modification of access.

Note: Violations of VA’s information security policies and procedures may result in disciplinary action, including dismissal and legal action against the offending employee(s), contractors, or other individuals requiring logical access to VA information or information systems, consistent with law or contract terms as applicable.

6 RESCISSIONS

None

FOR INTERNAL USE ONLY 13

7 REFERENCES

» NIST 800-53, revision 4, Security and Privacy Controls for Federal Information Systems and

Organizations » VA Directive 6500, VA Cybersecurity Program » VA Directive 0710, Personnel Security and Suitability Program » VA Handbook 6500, Risk Management Framework for VA Information Systems VA

Information Security Program » VA Handbook 6500.6, Contract Security » VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program » VA Knowledge Service VA Knowledge Service, Risk Management Framework for VA

Information Systems - Tier 3: VA Information Security Program

Andru Ditzler

Information System Owner