16.0_PIV_Policy_and_Guide.pdf

U.S. Department of the Interior Personal Identity Verification (PIV)

Policy and Guide For

Federal Employees and Contractors

December, 2005

Guidance complies with Homeland Security Presidential Directive 12 (HSPD-12)

And Federal Information Processing Standards 201 (FIPS 201)

Final Version 1.0

Document Information and Revision History

Version Date Author(s) Revision Notes

1st Draft 12/14/2005 HSPD-12 Core Initial Draft

2nd Draft 12/21/2005 Cyndy Anderson Updates included from MIT

Final 12/22/2005 Cyndy Anderson Final updates included from HSPD-12 team.

Department of the Interior PIV Policy and Guide

TABLE OF CONTENTS

CHAPTER 1 – INTRODUCTION

1.1 PURPOSE

1.2 BACKGROUND

1.3 APPLICABILITY

1.4 SCHEDULES AND DEADLINES

1.5 ABBREVIATIONS

1.6 DEFINITIONS

CHAPTER 2 – PERSONAL IDENTITY VERIFICATION, PART I (PIV-I)

2.1 PIV-I APPLICABILITY

2.2 PRIVACY POLICY

2.3 BACKGROUND INVESTIGATION REQUIREMENTS

Figure 1: High-Level PIV-I Process

2.4 REGISTRATION, IDENTITY PROOFING, & CREDENTIAL ISSUANCE

Figure 2 Process Overview

2.6 REPLACEMENT CREDENTIALS

2.7 PROVISIONAL CREDENTIALS

2.8 TEMPORARY CREDENTIALS

2.9 VISITOR CREDENTIALS

2.10 VOLUNTEER CREDENTIALS

2.11 CONTRACTING IMPACTS

2.12 AUDIT & RECORDS MANAGEMENT

CHAPTER 3 – TRAINING

3.1 WHERE TO GET ASSISTANCE

3.2 REPORTING REQUIREMENTS

APPENDICIES

Appendix A OMB Memo M-05-24 APPENDIX B PIV-I Credential Request Form APPENDIX B -1 Instructions for PIV I Form APPENDIX B -1 Instructions for PIV I Form Appendix C PIV Card Usage Privacy Act Notice APPENDIX D I-9 Documents Acceptable for Identity Proofing APPENDIX E Appeal Rights for the Denial of a Credential Appendix F Acquisition Policy Release 2006-3, October 18, 2005 (DIAPR) Appendix G Definition of Card Issuance and Facility Guidance Appendix H Model Statement of Work/Performance Work Statement Language Appendix I PIV Information Notice Appendix J Checklist for Review of a Privacy Act System or Records Maintenance Practices . 49 Appendix J Checklist for Review of a Privacy Act System or Records Maintenance Practices . 50 Appendix K Background Investigation Scheduling

(This page intentionally left blank.)

Chapter 1 – Introduction

1.1 PURPOSE

This DOI Guidance provides policies and procedures governing the Personal Identity Verification (PIV) process and Smartcard (DOI ID Badge) issuance requirements of the following directive, standards, and policies:

Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” dated August 27, 2004

National Institute of Standards and Technology (NIST) Federal Information Processing Standards 201 (FIPS 201), Personal Identity Verification (PIV) of Federal Employees and Contractors, dated February 25, 2005

Office of Management and Budget (OMB) Memorandum M-05-24, dated August 5, HSPD-12 mandates the development and implementation of a mandatory, government-wide standard for secure and reliable forms of identification issued by the Federal Government to its employees and contractors (and contractor employees).

FIPS 201 defines a reliable, government-wide Personal Identity Verification (PIV) process for use in applications such as access to federally controlled facilities and information systems. It also specifies a PIV Part II (PIV-II) system within which common identification credentials can be created and later used to verify a claimed identity.

OMB Memorandum M-05-24 provides guidance for implementing the requirements in FIPS 201 and HSPD-12. The guidance clarifies timelines, applicability, and the requirements of PIV-I.

For purposes of this Guidance, DOI organizations are collectively referred to as “Offices.”

No provision in this Guidance shall have the effect of nullifying or limiting protections for equal employment opportunity as defined under Title VII of the Civil Rights Act, 42 U.S.C. 3535(d), Executive Order (EO) 11478, or DOI’s implementing regulations under 24 CFR Part 7. DOI will not implement this Guidance in such a way as to impede equal employment opportunity on the basis of race, color, religion, sex, national origin, age, or disability.

1.2 BACKGROUND

In years past, government agencies required levels and means of authenticating the identification of Federal employees and contractors as a requirement to enter government facilities and use of government systems. Where appropriate, the agencies also implemented authentication mechanisms to allow access to specific areas or systems. The methods and levels of assurance for authentication and authorization, (i.e., identification and permission) varied widely from agency to agency, and sometimes within a single agency.

HSPD-12 requires that all government agencies develop specific and consistent standards for both physical and logical identification systems. The National Institute of Standards and Technology’s (NIST’s) FIPS 201 establishes detailed standards on implementing processes and systems to fulfill the requirements of HSPD-12. FIPS 201 outlines two phases to implementing an HSPD-12 program. Part I (PIV-I) describes the registration and identity proofing process that must be in place beginning October 27, 2005. Part II (PIV-II) describes the technical and interoperability requirements of an HSPD-12-compliant system that must be in place beginning October 27, 2006. This Guidance addresses the PIV-I requirements only.

The 2002 Federal Information Security Management Act (FISMA) does not permit waivers to the FIPS 201 standards.

1.3 APPLICABILITY

According to FIPS 201, the standard “is applicable to identification issued by Federal departments and agencies to Federal employees and contractors (including contractor employees) for gaining physical access to Federally controlled facilities and logical access to Federally controlled information systems except for ‘national security systems’ as defined by 44 U.S.C. §3542(b)(2).”

Specifically, PIV-I applies to all Federal employees, as defined in title 5 U.S.C §2105 “Employee,” within a department or agency. In addition, all individuals under long-term (6 months or longer) contract to the Federal government will be subject to PIV.

It is not required that temporary employees (less than 6 months), short-term guests, and occasional visitors to Federal facilities be subject to PIV-I. These individuals can be issued alternate credentials as described in section 2.8 of this Guidance. DOI reserves the right to subject any individual to the PIV-I process following a risk-based assessment. Office of Law Enforcement and Security Memorandum, Definition of Card Issuance and Facility Guidance Regarding HSPD-12, dated July 14, 2005 (Appendix G), outlines requirements for temporary federal employees, contractors, and others affiliated with the agency for less than 6 months. Background investigations are long-standing requirements and not a new requirement of the HSPD-12 and PIV-I process.

(Appendix A for an excerpt from OMB Memorandum M-05-24)

1.4 SCHEDULES AND DEADLINES

Per HSPD-12, FIPS 201, and OMB Memorandum 05-24, all Federal Agencies must create and implement a PIV-I-compliant process beginning no later than October 27, 2005.

All Agencies must create and begin implementation on a PIV-II-compliant system for new employees and contractors beginning no later than October 27, 2006.

All existing DOI contractors must be identity proofed (with at minimum a National Agency Check with Written Inquiries (NACI)) no later than October 27, 2007 or upon contract renewal or ID expiration, whichever is earlier.

All Federal employees with less than 15 years of Federal service, as of October 27, 2005, must be identity proofed with at minimum a NACI no later than October 27, 2007.

All Federal employees with more than 15 years of Federal service, as of October 27, 2005, whose NACI or other OPM approved background investigation is not on file must be identity proofed with at minimum a NACI, no later than October 27, 2008.

Access to DOI’s local area network (LAN) will require use of the PIV-II Card by employees and contractors no later than October 27, 2007.

Access to DOI’s NCI and level 4 physical facilities (GSA-owned and leased space, or others as deemed necessary based on risk assessment) will require use of the PIV-II Card by employees and contractors no later than October 27, 2007. (Appendix G)

1.5 ABBREVIATIONS

BI: Background Investigation

CHUID: Cardholder Unique Identifier

DHS: Department of Homeland Security e-QIP: Electronic Questionnaire for Investigations Processing

FBI: Federal Bureau of Investigations

FBI FP Check: FBI National Criminal History Fingerprint Check

FIPS: Federal Information Processing Standards

FISMA: Federal Information Security Management Act

HSPD: Homeland Security Presidential Directive

IDMS: Identity Management System

LACS: Logical Access Control System

NAC: National Agency Check

NACI: National Agency Check with Inquiries

NIST: National Institute of Standards and Technology

OCIO: Office of the Chief Information Officer

OIG: Office of the Inspector General

OMB: Office of Management and Budget

OPM: Office of Personnel Management

PACS: Physical Access Control System

PIV: Personal Identity Verification

PIV-I: Personal Identity Verification, Part I

PIV-II: Personal Identity Verification, Part II

PKI: Public Key Infrastructure

1.6 DEFINITIONS

Access control – the process of granting or denying requests to access physical facilities or areas, or to logical systems (e.g., computer networks or software applications). See also “logical access control system” and “physical access control system.”

Authentication - the process of establishing an individual’s identity and determining whether individual Federal employees or contractors are who they say they are.

Authorization - process of giving individuals access to specific areas or systems based on their rights for access and contingent on successful authentication.

Background Investigation – any one of various Federal investigations conducted by OPM, the FBI, or by Federal departments and agencies with delegated authority to conduct personnel security background investigations.

Biometric – a measurable physical characteristic used to recognize the identity of an individual. Examples include fingerprints and facial images. A biometric system uses biometric data for authentication purposes.

Contractor – see “Employee.”

Employee – as defined in Executive Order (EO) 12968, “Employee” means a person, other than the President and Vice President, employed by, detailed or assigned to, an agency, including members of the Armed Forces; an expert or consultant to an agency;

an industrial or commercial contractor, licensee, certificate holder, or grantee of an agency, including all subcontractors; a personal services contractor; or any other category of person who acts on behalf of an agency as determined by the agency head.

See also “Employee” as defined in title 5 U.S.C §2105.

e-QIP Tracking Number – Number assigned by e-QIP to each Form SF-85 application.

For those Interior bureaus and offices using e-QIP, the tracking number must be written on the fingerprint card when it is submitted to OPM in order to bind the fingerprint card to the proper applicant.

FBI FP Check – National Criminal History Fingerprint check of the FBI fingerprint files. This check is an integral part of the NACI, and is the minimum requirement for provisional card issuance.

FD-258 - Fingerprint Chart to accompany the NACI request when the individual to be investigated is a contractor (neither a Federal employee nor an applicant for Federal employment), or when agreed to by OPM.

Identity Management System (IDMS) - one or more systems or applications that manage the identity verification, validation, and card issuance process. The IDMS software is used by PIV Registrars to enroll Applicants.

Identity-proofing – the process of providing identity source documents (e.g., driver’s license, passport, birth certificate, etc.) to a registration authority, or the process of verifying an individual’s information that he or she is that individual and no other.

FIPS 201 requires that one of these documents be an original State or Federal Government-issued photo ID, and the other be from the approved set of identity documents listed on Form I-9.

Logical Access Control System (LACS) – protection mechanisms that limit users' access to information technology (IT) systems by restricting their form of access to those systems necessary to perform their job function. These LACS may be built into an operating system, application, or an added system.

National Agency Check (NAC) – The NAC is part of every NACI. Standard NACs are Security/Suitability Investigations Index, Defense Clearance and Investigation Index, FBI Name Check, and FBI National Criminal History Check.

National Agency Check with Inquiries (NACI) – the basic and minimum investigation required of all Federal employees and contractors consisting of searches of the OPM Security/ Suitability Investigations Index (SII), the Defense Clearance and Investigations Index (DCII), the Federal Bureau of Investigation (FBI) Identification Division’s name and fingerprint files, and other files or indices when necessary. A NACI also includes written inquiries and searches of records covering specific areas of an individual’s background during the past five years (inquiries sent to current and past employers, schools attended, references, and local law enforcement authorities).

Physical Access Control System (PACS) – protection mechanisms that limit users' access to physical facilities or areas within a facility necessary to perform their job function. These systems typically involve a combination of hardware and software (e.g., a card reader), and may involve human control (e.g., a security guard).

PIV-II Credential – a government-issued identity credential, referred to as a Smart Card, which contains a contact and contact-less chip. The cardholder’s facial image will be printed on the card along with other identifying information and security features that can be used to authenticate the user for physical access to federally controlled facilities. The card may include a PKI certificate, which controls logical access to federally controlled information systems.

Public Key Infrastructure (PKI) – A service that provides cryptographic keys needed to perform digital signature-based identity verification, and to protect communications and storage of sensitive data.

SF-87 - Fingerprint Chart for Federal employee(s) or applicant for Federal employment.

Submitting Office Identifier (SOI) – Number assigned by OPM to identify office that submitted the NACI request.

Temporary Employee - Temporary, Term, Student (SCEP, STEP), or intern paid or obtaining some type of benefit directly from DOI

VIP – See “Volunteer”

Volunteer - a non-paid individual working under the supervision of DOI.

Chapter 2 – Personal Identity Verification, Part I (PIV-I)

2.1 PIV-I APPLICABILITY

PIV-I requires the implementation of registration, identity proofing, and issuance procedures in line with the requirements of FIPS 201. PIV-I does not require the implementation of any new systems or technology.

DOI will continue to issue existing credentials (ID badges) under the temporary paper-based process, but the process for credential application and issuance will change, in compliance with HSPD-12 and FIPS 201.

2.2 PRIVACY POLICY

HSPD-12 explicitly states that “protect[ing] personal privacy” is a requirement of the PIV system. As such, DOI Offices shall implement the PIV system in accordance with the spirit and letter of all privacy controls specified in FIPS 201, as well as those specified in Federal privacy laws and policies, including but not limited to Section 207 of the E-Government Act of 2002, the Privacy Act of 1974, as amended (5 U.S.C.

§552a), and OMB Memorandum M-03-22, as applicable.

Personal Identify Verification records are subject to the Privacy Act and E-Government Act of 2002 requirements. DOI Offices and staff that collect, maintain, safeguard and use this information must comply with the Government statutory requirements and Policy, and DOI Privacy Act regulations (43 CFR 2.45 – 2.79) and DOI Privacy Act manual sections (383 DM Chapters 1-13).

The Departmental Privacy Act regulation requirements on safeguarding Privacy Act information must be used to ensure that appropriate safeguards are in place for handling PIV information (refer to 43 CFR 2.51 and 383 DM 8).

Ensure that those authorized to access personnel records subject to the Privacy Act understand how to apply the Act’s restrictions on disclosing information from a system of records, and specific Privacy Act system of records instructions.

See OPM”s Guide to Personnel Recordkeeping, Chapters One and Six, at:

http://www.opm.gov/feddata/recguide.pdf for instructions on proper safeguarding of personnel records.

One new privacy measure is that certain information on PIV information be provided to card applicants (Appendix C). Another new measure is that the Department post in multiple locations the Department’s PIV Privacy Act statement/notice, complaint procedures, and appeals procedures for those denied identification or whose identification credentials are revoked and sanctions for employees violating agency privacy policies (Appendix I) and post the notice.

2.3 BACKGROUND INVESTIGATION REQUIREMENTS

A National Agency Check with Inquiries (NACI) is the minimum background investigation (BI) that must be performed for all employees and contractors, except where the position designation requires a higher-level BI. In such cases, the BI shall be commensurate with the risk and security controls prescribed in the Position Designation or in accessing, managing, using, or operating Federal resources, including federal facilities and federal information systems as defined in OMB Memorandum M-05-24.

Appendix K describes the types of forms required for various background investigations and OPM scheduling and contact information.

Locating and referencing a completed and successfully adjudicated NACI or unexpired higher-level BI may also satisfy the requirements. To locate and reference a previously completed and successfully adjudicated NACI, contact the Bureau/Office Personnel Security Office or Human Resources Office as appropriate. If the applicant indicates that he/she has already been the subject of a Federal BI without a subsequent break in Federal employment, or Federal contracting employment not exceeding two (2) years, the applicant will be asked to furnish specific information, which will be used to verify the BI. The Office Human Resources (OHR) may meet the above requirements by completing the Form SF-75, Request for Preliminary Employment Data, Section K, Security Data, for federal employees transferring to the Department.

The Office of Human Resources (OHR) is responsible for determining the position sensitivity designation for all applicant positions, and for ensuring that employees have the appropriate investigation commensurate with that determination. Bureaus/Offices are responsible for ensuring periodic reinvestigations are scheduled as required.

At a minimum, the National Criminal History Fingerprint Check (FBI FP) portion of a NACI must be completed prior to issuance of any credential. The Advance NAC report consists of a search of the following three searches:

OPM Security/Suitability Investigations Index (SII)

FBI’s arrest records

FBI FP Check

A credential may be issued after the successful completion of the FBI FP check, however, the completion and successful adjudication of a full NACI or higher level investigation as appropriate, is still required for all applicants.

DOI will revoke the credential and the employee/contractor’s access if the BI process (including the adjudication of the investigative results) has not been completed within six months of credential issuance. A credential may also be revoked at any time for just cause during the investigative process or thereafter. Higher-level BIs that take greater than 6 months to complete require an office bureau to extend the expiration date of the credential.

See Appendix E, Appeal Procedures for Denial of a Credential.

Figure 1: High-Level PIV-I Process

When available through OPM’s secure website, applicants shall complete the Electronic Questionnaires for Investigations Processing (e-QIP) Standard Forms SF-85, SF-85P and SF-86. Completing the e-QIP web-based security questionnaires will lead to improved processing time of all types of investigations and dramatically reduce the overall error and rejection rates.

Refer to section 2.4 below for specific step by step instructions on completing and adjudicating a BI.

2.4 REGISTRATION, IDENTITY PROOFING, & CREDENTIAL ISSUANCE

The PIV-I process contains critical roles associated with identity proofing, registration, and credential issuance. They are: the Applicant, the Sponsor, the Registrar, and the Issuer. The roles of the Applicant, Sponsor, Registrar, and Issuer are mutually exclusive; no individual shall hold more than one of these roles in the identity proofing and registration process for one applicant. These roles may be ancillary roles assigned to personnel who have other primary duties.

The roles of Registrar and Issuer require training and certification. More information regarding training can be found in Chapter Three of this Guide.

Each PIV-I role and its corresponding responsibilities are listed below. The following roles shall be employed for the PIV-I identity proofing, registration, and issuance process.

A. Roles and Responsibilities

(1) Applicant

The Applicant is the individual to whom a PIV-I credential is to be issued. The following are Applicant responsibilities:

Complete required forms.

Provide two forms of legal identification, from the list of approved identity documents. (Appendix D). One must be a valid State or Federal Government issued photo ID.

Appear in person during various stages of the process.

(2) Sponsor

The Sponsor is the individual who substantiates the need for a PIV-I credential to be issued to the Applicant, and is the federal authority that requests PIV credentials for the Applicant. Sponsors are responsible Federal officials to include supervisors, managers, Contracting Officer Representatives, Administrative Officers, Human Resources or Security Specialists, Project Chiefs, Primary Investigators or similar level positions.

The following are Sponsor responsibilities:

Verify need for PIV credential.

Coordinate initial registration activities.

Serve as intermediary between Applicant and Registrar.

(3) Registrar

The Registrar is responsible for the identity proofing of the Applicant and coordinating the NACI or other BI activities. One or more individuals may perform the Registrar role. The Registrar provides the final approval for issuance of a credential to the Applicant. The following are Registrar responsibilities:

Ensure all necessary forms are provided to the Applicant.

Validate Applicant’s identity source documents. Documents must be in original form, not copies. One of these documents must be a State or Federal Government issued photo ID, and the other must be from the set of acceptable documents listed on Form I-9 (see Appendix C), as defined in FIPS 201.

Arrange for fingerprinting and obtaining a digital picture (facial image).

Make one copy of each identity source document.

Ensure a BI has been successfully adjudicated in accordance with DM 441, Personnel Suitability and Security, prior to the issuance of a credential.

Approve or Deny Issuance of a credential.

(4) Issuer

At the DOI, the role of the Issuer has three functional areas:

1. Card generation

Centralized within the National Business Center at the Department of the Interior, and includes credential personalization and operation.

2. Dissemination to a central Bureau or Office contact

Bureaus will designate a specific contact or office.

3. Issuance to the applicant.

At time of PIV Card issuance, the Issuer confirms the Applicant’s identification source document which must be a State or Federal-issued photo ID in orginal form (not copies), as defined in FIPS 201.

Issue credential (ID badge) to the Applicant, obtaining a signature from the Applicant attesting to the acceptance of the credential and related responsibilities.

(5) Other roles and responsibilities include:

Office of Personnel Management (OPM)

The OPM is responsible for conducting the NACI and other higher-level investigations as well as the initiating the FBI FP Check.

B. Registration, Identity Proofing, and Issuance Procedures

The following is a sequential list of steps for the application and issuance of a PIV credential. This procedural outline provides a detailed description of logical flow, dependencies, and responsible parties.

Note: Offices that modify the following to accommodate unique workflow requirements must ensure full compliance with FIPS-201 guidance.

(1) Sponsor – The Sponsor provides the following forms to Applicants that require a BI:

Federal Employees are required to complete the following four documents:

1. Standard Form (SF) 85 OPM Questionnaire for Non-Sensitive Positions, [or equivalent (SF-85P, SF-86)],

2. OF-306, Declaration for Federal Employment

3. SF-87, Fingerprint card

4. Fair Credit Reporting Release (if submitting an SF-85P or SF- 86).

Contractor Employees are required to complete the following four documents:

1. Standard Form (SF) 85 OPM Questionnaire for Non-Sensitive Positions, [or equivalent (SF-85P, SF-86)],

2. OF-306, Declaration for Federal Employment. Complete item #’s 1, 2, 6, 8-13, 16, 17

3. FD-258, Fingerprint card

4. Fair Credit Reporting Release (if submitting an SF-85P or SF- 86).

Note: The Fair Credit Reporting Release is not required when submitting forms for a NACI (SF-85).

(2) Applicant – Completes all forms provided except the Fingerprint card, which will be completed by the Applicant in the presence of the Registrar.

If available, the OPM e-QIP system may be used to complete the SF-85, SF- 85P, and SF-86 online. The Registrar or appropriate Bureau/Office authority will register the Applicant in e-QIP and provide the Applicant the website address and login information.

The Registrar completes the SF-xx (85, 85P, 86) and if using e-QIP, records the transaction number for future reference. The Registrar retains a copy of completed SF-xx until the investigation process is completed.

Note: The Office of Personnel Management serves as the official repository for investigation paperwork after the investigation is finalized.

(3) Sponsor – The Sponsor completes a Request for DOI Personal Identity Verification (PIV) Credential (Appendix B) for an Applicant, and submits the request to the Registrar. Once the Sponsor signs the form, the form should never be given to the Applicant except to fill in Applicant information in the presence of the Registrar or Delegated issuer.

(4) Registrar – The Registrar ensures the validity of the PIV request.

(5) Applicant – After completion of the forms, the Applicant must appear in person in front of the Registrar with completed forms (including one copy of SF-85, SF-85P, or SF-86 if completed online), Fair Credit Reporting Release (if submitting an SF-85P or SF-86), and two identity source documents in original form. The identity source documents must come from the list of acceptable documents included in Form I-9, Employment Eligibility Verification (Appendix C), as defined in FIPS 201. At least one document shall be a valid State or Federal government-issued photo identification (ID).

(6) Registrar - The Registrar shall visually inspect the identity source documents and authenticate them as being genuine and unaltered. In addition, the Registrar shall electronically verify the authenticity of the source documents, when the issuer of the source documents provides such services.

When electronic verification is not offered, the Registrar shall use other available tools (i.e., Passport and Drivers License checking guides) to authenticate the source and integrity of the identity source documents. The Registrar shall copy and subsequently compare the picture on the source documents with the Applicant to confirm that the Applicant is the holder of the identity source documents. If all the above checks are deemed to be successful, the Registrar shall copy the documents; file them in the Official Personnel Folder and record the following types of data for each of the two-identity source documents presented. Then sign, and date the PIV form.

Any other information used to confirm the identity of the Applicant

Note: It is acceptable to make and retain one copy of each identity source document and keep this copy in the Official Personnel Folder. If an electronic IDMS is used, this data shall be captured and entered into the system automatically.

(7) Registrar – The Registrar shall ensure the Applicant provides fingerprints as described below:

A full set of fingerprints shall be collected from all Applicants who can provide them. The fingerprints shall be used for “one-to-many” matching with the database of fingerprints maintained by the FBI. The Registrar shall refer to FIPS 201 and seek OPM guidance for alternative means for performing law enforcement checks in cases where obtaining ten fingerprints is not possible.

Retain a hardcopy of the prints or scan prints into the IDMS if available.

(8) Registrar – The Registrar shall capture a digital facial image of the Applicant per FIPS 201 specifications, and retain a file copy of the image or insert the image into the IDMS, if available.

(9) Registrar – The Registrar ensures the investigation paperwork is submitted to OPM for processing. The clock starts here. A credential may be issued while an investigation is pending at OPM. The PIV credential may be issued based upon the results of the FBI FP Check. (OMB memo M05-24).

However, the PIV-I requires that the registrar must verify successful completion and adjudication of the investigation within six months of credential issuance, or the credential and PIV-I authentication certificate for the credential shall be revoked. (FIPS-201, section 5.3.1, PIV-I Card Issuance) Higher-level investigations may take longer to process and are not limited by the six-month time constraint.

(10) Registrar – If FBI FP results are successful, complete Registrar section of PIV Request form and forward request to Issuer. Send approval notification to Sponsor. If NAC results are unsuccessful, notify Sponsor and determine next course of action.

Registrar consults with Sponsor. If NAC is unsuccessful (unusable fingerprints, incorrect identity, or criminal history), determine whether to proceed with another fingerprint check or terminate the process. If a decision is made to terminate the process, the Registrar must terminate the PIV request.

If the registrar determines to issue a credential, based on the successful FBI FP or a NAC, the registrar sends the request to the issuer (NBC) for card printing.

The credential is issued to the centralized bureau/office contact who then notifies the Issuer that the credential is available.

The Issuer contacts the Registrar and the Applicant that the credential is available.

(11) Registrar – Contacts Applicant and informs the Applicant to appear in person in front of the Issuer with original identification source document to receive a credential.

(12) Applicant – Appearance

Appears in person in front of Issuer and present a State or Federal Government issued photo ID and one other identity source document from the approved list on Form I-9. (Appendix D)

(13) Issuer – Printing and Issuing Credential

Confirms Applicant’s identity in person (compare photo with Applicant) by verifying State or Federal Government issued photo ID with identity source document information on PIV-I Request received from Registrar.

Completes the Issuer section of PIV-I Request form and witnesses the Applicant signing the acknowledgement of receipt and use of the Credential.

If specific Office guidelines requires, the Issuer forwards the completed PIV-I Request to Registrar, otherwise the PIV-I Issuer shall be responsible for maintaining the completed PIV form. In some cases they may also keep copies of the identity source documents.

(14) Issuer or Registrar- Filing the PIV documents.

Maintain original copy of PIV-I requests in secure centralized location, as determined by specific guidance at the Office. This may be in the Official Personnel Folder (OPF) or other secure location.

Offices must notify the Department where they are keeping the PIV documents in writing to the HSPD-12 Program manager.

Figure 2 Process Overview

2.5 EXPIRATION DATE REQUIREMENTS

All credentials issued by DOI must have an expiration date printed on the card. The expiration date for all credentials must be 5 years or less from the date of issuance.

The expiration date of Foreign Nationals cannot exceed the expiration date of their INS documents (green card, work permit, etc.).

New employees and new contractors must be issued PIV-II credentials beginning October 27, 2006. All existing employees and all existing contractors must be issued their PIV-II credentials by October 27, 2007.

2.6 REPLACEMENT CREDENTIALS

Replacement credentials are to be issued when an employee or contractor credential is lost, damaged, stolen, or expired. Offices are to:

Ensure the IDMS record for the individual states the credential is not expired;

Verify the individual with a 1:1 biometric match against the IDMS record;

Verify the individual’s identity against the IDMS record digital photograph;

Recapture the Applicant’s fingerprints or other biometrics;

Issue a new credential and update the IDMS record; and

Ensure that the Issuing Authority digitally signs the new credential record.

2.7 PROVISIONAL CREDENTIALS

At a minimum, the FBI FP Check portion of a NACI must be completed prior to issuance of any credential. Provisional credentials may be issued to new employees and contractors pending the results of the FBI Fingerprint Check. The provisional credentials will allow limited physical access to DOI facilities and limited logical access to DOI’s information systems.

2.8 TEMPORARY CREDENTIALS

Temporary credentials with limited access rights may be issued to temporary employees or contractors (less than 6 months), short-term guests, and/or occasional visitors. In addition, should a long-term employee or contractor forget his/her credential on a particular day, they will be issued a temporary credential after their identity is confirmed.

Temporary credentials may be issued to new employees and contractors pending issuance of provisional credentials.

2.9 VISITOR CREDENTIALS

Follow existing procedures for issuing visitor badges to grant limited access – after verifying the visitor’s identity by checking a State Driver’s license or other photo ID.

2.10 VOLUNTEER CREDENTIALS

All volunteer’s who are affiliated with DOI for more than 180 days and who require access to federally controlled information systems and federally controlled facilities must abide by the identity proofing and registration requirements for employees as defined in the Guidance. (Appendix G)

2.11 CONTRACTING IMPACTS

Contractors must abide by the identity proofing requirements defined in this Guidance.

PIV-I language must be included in all applicable contracts. Please refer to DIAPR 2206-3 (Appendix F) for specific language and model contract language (Appendix H).

In cases where contractors have access to mission-critical systems or sensitive data, they may be required to have a higher-level BI.

2.12 AUDIT & RECORDS MANAGEMENT

The Office of the Inspector General has responsibility for auditing identity proofing and registration records. As such, all agencies should be prepared for such reviews.

Agencies must comply with DOI “Records Disposition Management”, for the creation, maintenance, use, and disposition of all records associated with the PIV-I process.

Chapter 3 – Training

Training is available on a computer-based training disk produced by the U.S. Department of the Interior and made available to all agencies through the Smart Card Interagency Advisory Board. The training is available online at: http://www.vodium.com/goto/blm/hspd12.asp for a copy of the training in CD form contact the Office HSPD-12 project manager. Training modules include HSPD-12 Overview, PIV Roles and Responsibilities, Privacy, and Records Management.

3.1 WHERE TO GET ASSISTANCE

Contact the DOI’s HSPD-12 Program Management Office, Office of Human Resources.

Cynthia Anderson, PMP HSPD-12 Program Manger

(202) 219-0867 Cyndy_Anderson@ios.doi.gov

3.2 REPORTING REQUIREMENTS

DOI Offices are required to submit quarterly and annual reports on its PIV-I card programs to ensure controls are in place for tracking all PIV-I credentials. The HSPD-12 Program Manager will ensure all reporting requirements are met and provided to senior DOI managers and the DAA along with the HSPD-12 Executive Steering Committee.

APPENDICIES

Appendix A OMB Memo M-05-24

The following is an excerpt from OMB Memorandum M-05-24, Implementing Guidance for

HSPD-12:

“1. To whom does the Directive apply?

As defined below, Department and Agency heads must conduct a BI, adjudicate the results, and issue identity credentials to their employees and contractors who require long-term access to Federally controlled facilities and/or information systems.

A. Departments and Agencies

“Executive departments” and agencies listed in title 5 U.S.C. § 101, and the

Department of Homeland Security; “independent establishments” as defined by title 5 U.S.C. §104(1); and the United States Postal Service (title 39 U.S.C §

201).

Does not apply to:

“Government corporations” as defined by title 5 U.S.C. § 103(1) are encouraged, but not required to implement this Directive.

B. Employee

Federal employees, as defined in title 5 U.S.C § 2105 “Employee,” within a department or agency.

Individuals employed by, detailed to or assigned to a department or an agency.

Within the Department of Defense (DoD) and the Department of State

(DoS), members of the Armed Forces, Foreign Service, and DoD and DoS civilian employees (including both appropriated fund and non-appropriated fund employees).

Applicability to other agency specific categories of individuals (e.g., short-term (i.e. less than 6 months) guest researchers; volunteers; or intermittent, temporary or seasonal employees) is an agency risk-based decision.

Does not apply to:

• Within DoD and DoS, family members and other eligible beneficiaries.

• Occasional visitors to Federal facilities to whom you would issue temporary identification.

C. Contractor

• Individual under contract to a department or agency, requiring routine access to federally controlled facilities and/or federally controlled information systems to whom you would issue Federal agency identity credentials, consistent with your existing security policies.

Does not apply to:

• Individuals under contract to a department or agency, requiring only intermittent access to federally controlled facilities.

D. Federally Controlled Facilities

• Federally-owned buildings or leased space, whether for single or multi-tenant occupancy, and its grounds and approaches, all or any portion of which is under the jurisdiction, custody or control of a department or agency covered by this Directive.

• Federally controlled commercial space shared with non-government tenants. For example, if a department or agency leased the 10 th floor of a commercial building, the Directive applies to the 10 th floor only.

• Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities.

• Facilities under a management and operating contract. Such as for the operation, maintenance, or support of a Government-owned or-controlled research, development, special production, or testing establishment.

E. Federally Controlled Information Systems

• Information technology system (or information system), as defined by the Federal

Information Security Management Act of 2002 (44 U.S.C. § 3502(8)).

• Information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency (44 U.S.C. § 3544(a)(1)(A)).

• Applicability for access to Federal systems from a non-Federally controlled facility

(e.g. a researcher up-loading data through a secure website or a contractor accessing a government system from their own facility) should be based on the risk determination required by existing National Institute of Standards and Technology

(NIST) guidance.

Does not apply to:

• Identification associated with national security systems as defined by the Federal

Information Security Management Act of 2002 (44 U.S.C. § 3542(2)(A)).

Federal Information Processing Standard (FIPS 199): Standards for Security Categorization for Federal Information and Information Systems, 2/04, http://www.csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf.

See NIST Special Publication 800-59: Guideline for Identifying an Information System as a

National Security System, 8/03, http://www.csrc.nist.gov/publications/nistpubs/800-59/SP800-

59.pdf.

APPENDIX B PIV-I Credential Request Form

PIV-I Form can be found on the following two pages.

Request for DOI Personal Identity Verification (PIV) Credential Pursuant to Section 3(e)(3) of the Privacy Act of 1974 (Public law 93-573), the individual furnishing information on this form is hereby advised as follows:

1. The authority for solicitation of the information is 5 U.S.C. 301, Presidential Memorandum on Upgrading Security at Federal Facilities, June 28, 1995, and Homeland Security Presidential Directive – 12, August 27, 2004. 2. The principle purposes for which the information is intended to be used are: (a) To ensure the safety and security of DOI facilities and their occupants in which the system is installed; (b) To verify that all persons entering DOI facilities or other Government facilities with smart card systems are authorized to enter them; and (c) To track and control ID security cards issued to persons entering and exiting the facilities. 3. The routine disclosures of the information are: (a) To an expert, consultant, or contractor (including employees of the contractor) of DOI that performs, on DOI’s behalf, services requiring access to these records; (b) To the Federal Protective Service and appropriate Federal, State, local or foreign agencies responsible for investigating emergency response situations or investigating or prosecuting the violation of or for enforcing or implementing a statute, rule, regulation, order or license, when DOI becomes aware of a violation or potential violation of a statute, rule, regulation, order or license; (c) To another agency with a similar smart card system when a person with a smart card desires access to that agency’s facilities; and (d) To those identified in the Department of the Interior system of records notice: Interior, Computerized ID Security System, OS-1. A copy is available on the Department of the Interior Privacy Program website at www.doi.gov/ocio/privacy. 4. The effect on the individual of not providing all or any part of the requested information may result in disapproval of the issuance of the PIV ID credential.

A. Sponsor/COR - PIV Request

1. Replacement Card? No Yes: 1a. Reason for Replacement_______________________

2. Legal Name (L,F M): __________________________________ Phone No: _________________

3. Affiliation: Employee Temporary Employee Contractor Volunteer

4. U.S. Citizen? Yes No: 4a. Country of Citizenship ______________________________

4b. Work Permit Number: ________________________ Expiration Date: _________________

5. Employee Title: U.S. Government LE Firefighter Security Investigator

6. Federal Emergency Response Official? (Must be approved by Bureau/Office Law Enforcement Director)

7. Bureau: _______________________________ Office: ___________________________________

8. Work Address: ___________________________________________________________________

9. City: _______________________________ State: ___________ Zip: ______________________

10. Contractor Company: _________________________ Contract Number: ___________________ Sponsor Information

11. Name: _____________________________________ Phone Number: ______________________

12. Organization: ________________________________ Title: ______________________________

13. Email: _________________________________ I agree to sponsor the above application for a PIV credential and certify that the information is accurate to the best of my knowledge.

14. Sponsor/COR Signature: _______________________ Date (mm/dd/yyyy): ______/___/_______ B. Registrar - Source Document Confirmation, Applicant’s Picture, and Fingerprints (Only for New Cards after Section A is completed) Applicant Information

15. Birth date (mm/dd/yyyy): ______/____/_______ Social Security Number: ______-_____-______

16. Hair Color __________ Eye Color _________ Height ________ Weight ________ Gender______

17. Home Address: _________________________________________________________________

18. City: _________________________________ State: ___________ Zip: ___________________

19. Email: __________________________________ I certify that the information is accurate to the best of my knowledge.

20. Applicant Signature: __________________________ Date (mm/dd/yyyy): _____/____/_______

Identity Source Document 1 (Attach copy)

21. Name: ________________________________________________________________________

22. Document #: ___________________Document Title: __________________________________

23. Issuer: ________________________________________________________________________

24. Document Expiration Date (mm/dd/yyyy): ______/____/_______

Identity Source Document 2 (Attach copy)

25. Name: ________________________________________________________________________

26. Document #: ___________________ Document Title: __________________________________

27. Issuer: ________________________________________________________________________

28. Document Expiration Date (mm/dd/yyyy): ______/____/_______

Applicant’s Picture

29. Picture taken? Yes

30. Fingerprints taken or received? Yes (Employees use SF-87/ Contractors use FD-258)

31. Background Investigation Forms Complete? Yes (required for new cards only)

Field Registrar Certification: I hereby confirm that the information contained in the above documents was checked and verified.

32. Name: _________________________________________ Phone No.: _____________________

33. Organization: ________________________________ Title: ______________________________

34. Field Registrar Signature: ______________________ Date (mm/dd/yyyy): _____/____/______ Human Resources /Security Management Office NAC Adjudication Results

35. Fingerprint check NAC NACI Date Completed (mm/dd/yyyy): ______/____/______

36. Successful? Yes No

37. Comments: _____________________________________________________________________ I certify that the information regarding the above applicant is accurate to the best of my knowledge and approve this applicant for credential issuance.

38. Human Resources/Security Management Office Signature: ______________________________ Date (mm/dd/yyyy): ______/____/_______ Registrar Information

39. Name: _________________________________________ Phone No.: _____________________

40. Organization: ________________________________ Title: ______________________________

41. Email: _________________________________ I hereby confirm that the information contained in the above documents were checked and verified and the FBI fingerprint results have been successfully adjudicated.

42. Registrar Signature: _________________________ Date (mm/dd/yyyy): _____/____/________ C. Issuer (To be completed by Issuer, after Sections A and B are completed)

43. Name on Credential: ______________________________________________________________

44. Credential Identifier: _____________________________________________________________

45. Credential Expiration Date (mm/dd/yyyy): ______/____/_______

Issuer Information_

46. Name: _______________________________________ Phone No: _______________________

47. Organization: ________________________________ Title: ______________________________

48. Email: _____________________________ I hereby acknowledge issuance of a credential to the applicant identified above based on verification of the applicant’s identity and verification of the above Registrar’s issuance approval.

49. Issuer Signature: ____________________________ Date (mm/dd/yyyy): ______/____/_______ D. Applicant Acknowledgement (To be completed by Applicant, after Section C is completed)

I, the Applicant, confirm receipt of the PIV credential identified above and that the information is accurate to the best of my knowledge, and agree to abide by all rules and responsibilities associated with this credential.

50. Applicant Signature: _________________________ Date (mm/dd/yyyy): ______/____/_______

APPENDIX B -1 Instructions for PIV I Form

All information must be legibly printed in blue or black ink.

All strikethroughs must be initialed.

Forms with whiteout will not be accepted.

All signatures must be original signatures, no copies or stamped signatures.

Sponsors / Registrars / Issuers should maintain a log of all applicant forms they sign (Name, badge type, and date). When the information is entered into the electronic PIV system you maybe asked to digitally sign the forms of applicants that you have processed through the manual (paper-based) process.

Once the Sponsor signs the form, the form should never be given to the applicant except to fill in applicant information in the presence of the Registrar or Issuer.

Sponsor

Complete lines 1 – 10 about the applicant, lines 11 – 13 about yourself, and sign and date line

14. Send the form to your designated Registrar’s office.

Line 2 Legal Name of Applicant: - Last, First Middle names – as they appear on official documents (identity proofing source documents)

Line 3 Affiliations:

Employee – Permanent (career/ career conditional) DOI employee

Temporary Employee – Temporary, Term, Student (SCEP, STEP), or intern paid or obtaining some type of benefit directly from DOI

Contract…