Exhibit 7 GSA Security Manual.pdf

VENDOR FITNESS

DETERMINATION

TRAINING MANUAL

Table of Contents Purpose

Zonal Help Desks

Authorities and References

What is HSPD-12?

What is a fitness determination?

Types of Contractors

Who needs a background investigation?

Who does NOT need an investigation?

Escort-Only Contractors

Fitness Determination Types

Requesting Official (RO) Contractor Approval List

Special Agreement Check (SAC) Investigation Process

Tier 1 or Higher Investigation Process

Escort-Only (EO) Contractor Review Process

Contractors with Prior Investigations

US Residency Requirement

Contractor Credential

GSA Access Card/PIV

Roles and Responsibilities

Investigation Documents

Common Causes of Unfit Determination

Common Delays and Errors in Investigation Process

Notification of Investigation Status

Terms and Acronyms

Attachment 1, How to Encrypt Documents Using WinZip

Attachment 2, Completing the E-QIP

Attachment 3, Example Email for SAC Applicants

Attachment 4, Example E-mail for Tier 1, 2 and 4 Applicants

Attachment 5, Fitness Determination Applicant Instructions (Tier 1, 2, & 4)

Attachment 6, Requesting Official Contractor Approval List

Attachment 7, Contractor Information Worksheet

Attachment 8, OF306—Declaration for Federal Employment

Attachment 9, GSA3665—Authorization to Obtain Credit Report

Attachment 10, SF85 Worksheet

Attachment 11, SF85P Worksheet

Purpose The purpose of this document is to provide a detailed description to GSA prime vendor POCs and applicants of how to properly complete an HSPD-12 background investigation.

Zonal Help Desks GSA Fitness Determinations will be processed within five work zones as listed below:

Zone A includes regions 1, 2, and 3.

States in Zone A: Maine, New Hampshire, Vermont, Massachusetts, Connecticut, New York, New Jersey, Pennsylvania, Puerto Rico, West Virginia, Maryland, Delaware, Rhode Island, Virgin Islands and Virginia Team Lead: Tom Heinze Email Address: zonea-hspd12@gsa.gov Phone Number: 617-565-2051

Zone B includes regions 4 and 7.

States in Zone B: Kentucky, Tennessee, North Carolina, South Carolina, Mississippi, Alabama, Georgia, Florida, Arkansas, Louisiana, Oklahoma, Texas and New Mexico Team Lead: Cheri Tow Email Address: zoneb-hspd12@gsa.gov Phone Number: 404-331-1002

Zone C includes regions 5, 6, and 8.

States in Zone C: Minnesota, Wisconsin, Michigan, Illinois, Indiana, Ohio, Nebraska, Iowa, Missouri, Kansas, Montana, North Dakota, South Dakota, Wyoming, Utah, and Colorado.

Team Lead: Connie Chidester Email Address: zonec-hspd12@gsa.gov Phone Number: 312-886-1189

Zone D includes regions 9 and 10.

States in Zone D: Alaska, Washington, Oregon, Idaho, Nevada, Arizona, California, and Hawaii Team Lead: Kristy Frost Email Address: zoned-hspd12@gsa.gov Phone Number: 415-884-9759

Zone E includes regions NCR and CO.

States in Zone E: Washington DC Team Lead: Phil Ahn Email Address: hspd12.security@gsa.gov Phone Number: 202-501-4459

Authorities and References

HSPD-12 http://csrc.nist.gov/drivers/documents/Presidential-Directive-Hspd-12.html

OPM HSPD-12 Credential Standards https://www.opm.gov/investigations/background-investigations/reference/final-credentialing-standards.pdf

GSA Order CIO P 2181.1--HSPD-12 https://insite.gsa.gov/portal/mediaId/681058/fileName/HSPD12_Handbook_v8.action

GSA Order 5400.2--Requesting Official https://insite.gsa.gov/portal/content/533289l

What is HSPD-12?

Homeland Security Presidential Directive 12 (HSPD-12) is a presidential directive for executive agencies that establishes a mandatory, government-wide standard for secure and reliable forms of identification issued by the federal government to its employees and contractors requiring long-term (greater than 180 days) access to federal buildings, facilities, and information technology (IT) systems. Prior to the issuance of these identification credentials, the person’s identity and trustworthiness must be proven via a personnel security investigation (fitness determination).

What is a fitness determination?

A fitness determination is the result of a personnel security background investigation.

Contractors may be issued a credential upon receipt of a favorable preliminary fitness determination, also known as an enter-on-duty (EOD) determination.

Types of Contractors

1. Long-term contractors are those individuals working on GSA contract(s) for greater than 6 months.

2. Short-term contractors are those individuals working on GSA contract(s) for 6 months or less.

Who needs a background investigation?

1. All GSA contractors (both long-term working more than 6 months and short-term working less than 6 months) who need routine access to GSA facilities. Routine access is defined as a regularly scheduled need to access the facility.

2. Any GSA contractor who requires regularly scheduled access to one or more GSA– controlled facilities, even under multiple contracts, should be treated as having routine access to GSA facilities. Individuals who completed an investigation previously with another agency must still complete the investigation process before working in GSA facilities.

Who does NOT need an investigation?

1. Contractors who are working in GSA leased facilities with security level I or II and those facilities with security level III that are not 100% occupied by the government.

2. The contractors needed to mitigate emergency situations--broken pipes; failure of

HVAC units; elevator repairs; etc. must be escorted at all times, however they are not required to have prior approval from the Zonal Help Desk. Property/building management staff may authorize access for these individuals in these types of situations.

3. Those contractors who will only access public space--lawn maintenance, vending machine technicians and suppliers, and FedEx & UPS delivery personnel.

4. Contractors working on new construction projects prior to occupancy and not yet considered to be substantially complete.

5. Contractors involved in repair and alteration projects where the work spaces are partitioned and/or fully separated from occupied spaces, with isolated access for contractors.

6. Contractors being escorted for 15 consecutive days or less. These contractors must be escorted at all times by a federal employee, FPS Security contractor, or GSA contractor who is in possession of a GSA issued PIV credential. Prior review and approval by Zonal Help Desk through the submission of personal information is required for tracking purposes. Escorted personnel must be within line of site from the escort at all times.

Escort-Only Contractors

1. The contractors needed to mitigate emergency situations--broken pipes; failure of

HVAC units; elevator repairs; etc. must be escorted at all times, however they are not required to have prior approval from Zonal Help Desk. Property/building management staff may authorize access for these individuals in these types of situations.

2. Non-emergency contractors may be approved for escorted access up to 15 consecutive days within a 6-month period. If they need to work for more than 15 consecutive days in GSA facilities, they must submit documentation to receive a background investigation for unescorted access.

3. Applicants who have previously been found unfavorable cannot be considered for escort-only access. Also, individuals in the process of completing a GSA Fitness Determination are not allowed to be escorted.

4. Vendors should coordinate with their GSA Requesting Official (RO) to consider the type of project and proximity to escorted contractors when determining the number of personnel reasonably escorted by the same escort. It is suggested that 5-7 people per escort is typically manageable.

5. To receive approval for escort-only access on a GSA project, the prime vendor POC must submit a CIW as well as the full legal name of the individual doing the escorting;

whether they are a government employee, a FPS Security contractor, or a GSA contractor with the appropriate credentials; and the dates of escort in the email containing their CIW. Individuals needing escort-only access must be listed on the RO Contractor Approval List. Allow at least 3 business days to process the CIW prior to applicant needing to start work.

6. Escorts are responsible for the whereabouts and activities of escorted personnel at all times, and must remain within line of sight of escorted individuals at all times while in non-public space. The person doing the escorting must be either a federal employee, FPS security contracts, or GSA contractor who is in possession of a GSA issued PIV credential.

Fitness Determination Types The requesting official is responsible for making decisions regarding whether a contractor is a long-term contractor or a short-term contractor. They are also responsible for monitoring the duration of the project, and should the work exceed 6 months, all short-term contractors must submit the background investigation documentation of a long-term contractor, prior to the expiration of the short-term investigation. Contractors are not authorized to work on GSA contracts prior to receipt of a favorable EOD or final determination.

1. Special Agreement Check (SAC) or Short-Term Investigations: Non-HSPD-12 SACs are good for 6 months from the date of the SAC determination. Short-term contractors must submit a completed CIW (Form 850) and OF306 to Zonal Help Desk then complete fingerprint enrollment. The CIW and OF306 must be submitted together to the Zonal Help Desk via encrypted email. Upon completion of a SAC, a contractor may work up to 6 months only. If additional work is required after the expiration date, a new investigation is required.

2. Tier 1, 2, and 4 or Long-Term Investigations:

a. Tier 1 (formerly known as low risk or NACI) is designed for contractors working greater than 180 days (6 months) and/or for contractors needing network access.

These investigations are currently valid indefinitely, as long as the contractor continues without a break in service on GSA contracts; however all GSA contractor credentials must be returned when contract work is completed, regardless of the expiration date on the credential. Tier 1 contractors must submit a completed CIW (Form 850) to the Zonal Help Desk via encrypted email. Next (based on email instructions) contractor will submit their on-line e-QIP questionnaire, including uploading the OF306 and GSA3665 and complete fingerprint enrollment.

b. Tier 2 (formerly known as MBI) is designed for contractors working longer than 6 months and whose duties require a higher degree of trust, such as IT system administrators, individuals who handle financial transactions, individuals who deal with personally identifiable information (PII), and other sensitive information. Tier 2 contractors must submit a completed CIW (Form 850) to the Zonal Help Desk via encrypted email. Next (based on email instructions) contractor will submit their on-line e-QIP questionnaire, including uploading the OF306 and GSA3665 and complete fingerprint enrollment.

c. Tier 4 (formerly known as BI) is designed primarily for embedded contractors working in staff-like positions, with access to high-risk information. Tier 4 contractors must submit a completed CIW (Form 850) to the Zonal Help Desk via encrypted email. Next (based on email instructions) contractor will submit their on-line e-QIP questionnaire, including uploading the OF306 and GSA3665 and complete fingerprint enrollment.

NOTE: If Tier 1, 2, or 4 contractors return at a later date for additional and/or new contract work, a new CIW is required (to identify new contract/task order information) and new credentials will be provided at that time, as needed. Those with a break in service longer than 2 years will be required to complete a new background investigation prior to working on GSA contracts.

Requesting Official (RO) Contractor Approval List

1. The prime vendor POC initiates a list of contractors needing to work on each contract for approval by the RO. This list authorizes the Zonal Help Desk to process the appropriate investigation on the listed contractors.

2. If a CIW is received for an applicant who does not appear on this list, the CIW will not be processed and the prime vendor POC will be notified that it cannot be processed until their name appears on the approval list.

3. Each time contractor(s) are added or removed from a contract, the list must be updated, sent through the RO for approval, and forwarded to the Zonal Help Desk with a copy to the prime vendor POC.

4. The items on the RO Contractor Approval List that must be completed by the prime vendor POC are listed below:

a. Last Name, First Name, Middle Name and Suffix: this information should be their full legal name as it appears on their photo ID.

b. Position Title: this should reflect the duties they are completing for the GSA contract.

c. Vendor Name, if subcontractor: if contractor works for a sub of the prime vendor the name of the subcontract company goes here.

d. If the contractor is to be escorted only, include name of escort and dates to be escorted.

e. Date Removed from Project/Contract: when appropriate, enter dates individuals are terminated, have completed their portion of the contract, leave the employ of the vendor prime or subcontractor, etc. Effectively, this is the date that person will no longer need access to the facility for this project/contract.

Special Agreement Check (SAC) Investigation Process

1. If assisting the applicant and discussing personal information, always verify the applicant’s full legal name, DOB, and SSN.

NOTE: Applicants are not allowed to work on the project until they receive a favorable SAC determination. They are not authorized to work past 6 months from the date of the SAC determination without completing an additional background check.

2. Receive training covering all aspects of the fitness determination process from the

Zonal Help Desk. At the completion of training the following forms will be provided: RO Contractor Approval List, CIW template, and OF306 (Declaration for Federal Employment)

3. Prepare RO Contractor Approval List to include the following for all contractors who will be working on the contract/project:

Full Legal Name Position Title Dates Required on Project Vendor Name (if subcontractor) Name of Escort (if escort only) Dates of Escort (If escort only)

4. Send completed RO Contractor Approval List to GSA Requesting Official for approval.

5. If personnel are added to or removed from the contract/project a new RO Contractor Approval List must be submitted to GSA RO for approval. Any CIWs received for personnel who do not appear on the RO Approved List will be rejected.

6. Have applicant complete section 1 of the CIW as follows (If an individual changes from one contract to another, a new CIW is always required.):

a. Name: full legal name, including full middle name. If no middle name, enter NMN. If middle name is only an initial, enter the initial and (IO). The name on the CIW must be the same as it appears on the applicant's photo ID.

b. Suffix: select the appropriate response from the drop-down window.

c. Gender: select the appropriate response from the drop-down window.

d. Social Security Number: from applicant’s social security card.

e. Date of Birth: as it appears on the applicant’s birth certificate.

f. Place of Birth: city of birth and country (as it appears on the birth certificate) are needed for everyone, even if they are born outside the US. State is only required for US, Mexican, and Canadian born applicants. (Province for Canada, but entered in state data field.)

g. Home Address: must be a physical address; PO Box is not acceptable.

h. Phone: include work and cell phone numbers as applicable.

i. Email: should be applicant’s personal email (if they have one) or prime vendor

POC’s email. It is important someone is reviewing emails at the address provided, as this is where instructions will be sent for completing the background investigation processes.

j. Position Title: for the function the applicant will be performing on this contract/project.

k. Prior Investigation: if applicant has been investigated before, include date and agency that performed the investigation (estimated dates are acceptable).

l. US Citizen: select the appropriate radio button--Yes or No. This must be answered by both US-born and non-US Born applicants.

m. Non-US Citizens Only: must complete city and state of entry into US, full date of entry (MM/DD/YYYY), alien registration number, and country of citizenship.

n. Company Name (Sub) (if applicable): if the CIW is for an applicant who works as a subcontractor for the prime, put in the subcontract company name.

7. Have applicant complete and sign OF306 as follows:

a. Name format must be first middle last. If there is no middle name, put NMN in as the middle name. If initial only, enter the initial followed by (IO). Name should match that provided on the CIW and be the same as it appears on the applicant’s photo ID.

b. All items must be answered, no blanks.

c. All data must be in the format as directed for each item on the form.

d. If any item 9-14 is answered “Yes”, ensure all information directed by the italicized print is included in the “Continuation Space” item 16.

e. No extraneous marks of any type are permitted.

f. If born in the US, Canada (province) or Mexico, state must be entered.

g. It is recommended the OF306 be typed, but it will be accepted handwritten or in a combination of both, all handwritten portions must be clear and legible.

h. Any corrections must be crossed out using a single line and each must be initialed and dated by the applicant.

i. Any corrections not properly lined out and illegible forms will be rejected and resubmission must be typed.

j. Applicant must sign/date on line 17a. Date must be legible.

8. Send completed CIW (Word document only) and completed/signed OF 306 via email to

Zonal Help Desk.

a. Both documents must be encrypted--no scanned CIWs will be accepted.

b. File name of CIW/OF306 must be formatted with the applicant’s Last, First Middle--document (i.e., Smith, Pete Jack--CIW or Doe, James Mike--OF306).

9. After Zonal Help Desk receives the complete and accurate CIW, the applicant will receive two emails the first is the SAC Investigation Instructions from accesscard@gsa.gov (also sent to the prime vendor POC, Zonal Help Desk, and GSA POC) and the second is the enrollment instructions from HSPD12Admin@usaccess.gsa.gov.

10. Ensure applicant schedules enrollment appointment, following the instructions below

(provided in the email).

a. Schedule an enrollment appointment at the nearest “SHARED” USAccess Credentialing Center and complete the fingerprint enrollment process as soon as possible at https://timetrade.com/app/usaccess/workflows/usaccess001/schedule/?appoint mentTypeGroupId=hspd12, by single clicking on “Click to Schedule”.

b. They must bring two valid and non-expired forms of ID to complete their fingerprint enrollment. Two forms are required to validate their identity, one of which must be a government-issued photo ID.

c. Their first and last names MUST match that submitted on their CIW. To review a complete list of acceptable forms of IDs, please go to the following link:

http://www.fedidcard.gov/viewdoc.aspx?id=109.

d. If they receive an email from the GSA Managed Service Office’s (MSO) USAccess program via HSPD12Admin@usaccess.gsa.gov stating that they do not need to enroll due to their previous enrollment, please email hspd12.security@gsa.gov to notify GSA that they have already gone through the fingerprinting process.

11. If applicant is more than 100 miles from a MSO USAccess Shared Credentialing Station, please email the Zonal Help Desk to determine how to best complete the fingerprinting process.

12. Validate applicant has completed fingerprint enrollment process at an MSO Credentialing Center as scheduled. Failure to enroll within 30 days will result in cancellation of the SAC.

13. Reach out to Zonal Help Desk for any support during the investigation process.

14. Receives SAC Fitness Determination as evidence applicant is authorized to begin work on the GSA contract/project.

Tier 1 or Higher Investigation Process

1. If assisting the applicant and discussing personal information, always verify the applicant’s full legal name, DOB, and SSN.

NOTE: Applicants are not allowed to work on the project until they receive an enter on duty or final fitness determination.

2. Receive training covering all aspects of the fitness determination process from the

Zonal Help Desk. At the completion of training the following forms will be provided:

RO Contractor Approval List, CIW template, and SF 85/85P Worksheet.

3. Prepare RO Contractor Approval List to include the following for all contractors who will be working on the contract/project:

Full Legal Name Position Title Dates Required on Project Vendor Name (if subcontractor) Name of Escort (if escort only) Dates of Escort (If escort only)

4. Send completed RO Contractor Approval List to GSA RO for approval.

5. If personnel are added to or removed from the contract/project a new RO Contractor

Approval List must be submitted to GSA RO for approval. Any CIWs received for personnel who do not appear on the RO Contractor Approved List will be rejected.

6. Have applicant complete section 1 of the CIW as follows (If an individual changes from one contract to another, a new CIW is always required.):

a. Name: full legal name, including full middle name. If no middle name, enter NMN. If middle name is only an initial, enter the initial and (IO). The name on the CIW must be the same as it appears on the applicant's photo ID.

b. Suffix: select the appropriate response from the drop-down window.

c. Gender: select the appropriate response from the drop-down window.

d. Social Security Number: from applicant’s social security card.

e. Date of Birth: as it appears on the applicant’s birth certificate.

f. Place of Birth: city of birth and country (as it appears on the birth certificate) are needed for everyone, even if they are born outside the US. State is only required for US, Mexican, and Canadian born applicants. (Province for Canada, but entered in state data field.)

g. Home Address: must be a physical address; PO Box is not acceptable.

h. Phone: include work and cell phone numbers as applicable.

i. Email: should be applicant’s personal email (if they have one) or prime vendor POC’s email. It is important someone is reviewing emails at the address provided, as this is where instructions will be sent for completing the background investigation processes.

j. Position Title: for the function the applicant will be performing on this contract/project.

k. Prior Investigation: if applicant has been investigated before, include date and agency that performed the investigation (estimated dates are acceptable).

l. US Citizen: select the appropriate radio button--Yes or No. This must be answered by both US-born and non-US Born applicants.

m. Non-US Citizens Only: must complete city and state of entry into US, full date of entry (MM/DD/YYYY), alien registration number, and country of citizenship.

n. Company Name (Sub) (if applicable): if the CIW is for an applicant who works as a subcontractor for the prime, put in the subcontract company name.

7. Send completed CIW (Word document only) via email to Zonal Help Desk.

a. CIW must be encrypted--no scanned CIWs will be accepted.

b. File name of CIW must be formatted with the applicant’s Last, First Middle--document (i.e., Smith, Pete Jack--CIW).

8. After Zonal Help Desk receives complete and accurate CIW the applicant receives three emails:

a. Tier 1, 2, and 4 Investigation Instructions from accesscard@gsa.gov (also sent to prime vendor POC, Zonal Help Desk, and GSA POC).

b. The enrollment instructions from HSPD12Admin@usaccess.gsa.gov.

c. Registration code from do-not-reply@registration.opm.gov. If not received within

24 hours of Fitness Determination Applicant Instruction email, contact Zonal Help Desk.

9. Ensure applicant schedules enrollment appointment, following the instructions below (provided in the email).

Credentialing Center and complete the fingerprint enrollment process as soon as possible at

b. They must bring two valid and non-expired forms of ID to enroll for their USAccess credential. Two forms are required to validate their identity, one of which must be a government-issued photo ID.

c. Their first and last names MUST match that submitted on their CIW. To review a

d. If they receive an email from the GSA Managed Service Office’s (MSO) USAccess program via HSPD12Admin@usaccess.gsa.gov stating that they do not need to enroll due to their previous enrollment, please email hspd12.security@gsa.gov to notify GSA that you have already gone through the fingerprinting process.

NOTE: If applicant is more than 100 miles from a MSO USAccess Shared Credentialing Station, please email the Zonal Help Desk to determine how to best complete the fingerprinting process.

10. Validate applicant has completed fingerprint enrollment process at an MSO

Credentialing Center as scheduled. Failure to enroll within 30 days will result in cancellation of the investigation.

11. Have applicant complete and sign the OF306, Declaration for Federal Employment.

Then separately scan (PDF, TIFF or PNG only) the document in preparation for uploading it to the e-QIP application.

the middle name. If initial only, enter the initial followed by (IO). Name should match that provided on the CIW and be the same as it appears on the applicant’s photo ID.

d. If any item 9-14 is answered “Yes”, ensure all information directed by the italicized print is included in the “Continuation Space” item 16.

e. No extraneous marks of any type are permitted.

f. If born in the US, Canada (province) or Mexico, state must be entered.

g. Recommend OF306 be typed, but it will be accepted handwritten or in a combination of both, all handwritten portions must be clear and legible.

h. Any corrections must be crossed out using a single line and each must be initialed and dated by the applicant.

i. Any corrections not properly lined out and illegible forms will be rejected and resubmission must be typed.

j. Applicant must sign/date on line 17a. Date must be legible.

12. Have applicant complete and sign the GSA3665, Authorization to Obtain Credit Report.

Then separately scan (PDF, TIFF or PNG only) the document in preparation for uploading it to the e-QIP application.

a. Name format must be Last, First Middle Suffix. If there is no middle name, put NMN in as middle name. If initial only, enter the initial followed by (IO). The name must appear as it does on both the CIW and the OF306.

b. Input SSN.

c. Sign and date. Date must be legible.

13. It is recommended that the applicant use the SF85/85P Worksheet to allow them to collect all required information needed prior to completing the online e-QIP application.

This form must not be submitted in lieu of completing the on-line e-QIP application. It is a worksheet for the applicant’s use only.

14. Assist applicant in accessing e-QIP at http://www.opm.gov/e-qip and click on the

“Enter e-QIP Application Site” button.

a. The e-QIP system will verify if the web browser is approved. Then click “Continue to e-QIP.”

b. Logging into e-QIP

i. Click the button titled “Register for Username and Password”.

ii. Enter Social Security Number.

iii. Answer the golden questions (last name, city of birth, year of birth, and registration code); the answers to these questions are case sensitive.

iv. Create and confirm a Username and Password.

v. Select three (3) challenge questions that can be used in the event of a forgotten password.

NOTE: Applicant will need a username and password to re-enter the application if it times out; if they need to step away from it before completion; or the application is rejected after released for processing.

c. Completing e-QIP--failure to timely complete this process will delay the investigation and prevent them from receiving their enter-on-duty determination (EOD). Do not release the e-QIP application until they have completed their fingerprint enrollment. Without an EOD they will not have access to GSA facilities.

i. Follow the onscreen instructions to complete the security questionnaire. Use the save function often and answer all applicable questions. If they log off without completing the security questionnaire, and return at a later time, they will be able to resume where they left off.

ii. In the residence section--be sure to list a verifier with their complete mailing address (to include St., Ave., Blvd., as applicable) and phone number.

iii. In the employment section--do not use the button that says “supervisor same as employer”. They must list their supervisor’s name, address (to include St., Ave., Blvd., as applicable) and phone number.

iv. Select “Certify Investigation Request” to complete their security questionnaire.

v. Select “Signature Forms” link.

vi. Select “Yes” next to “Do you agree to utilize the click-to-sign functionality on all relevant forms?”

vii. They must then re-enter their e-QIP password and select “Continue.”

viii. Select “Click Here to Sign” link in the signature block.

ix. Select “Yes” next to “Do you have an additional document and/or file that you would like to associate with this request?” This is very important as this is the main reason applications are rejected. Repeat this process for both documents (OF306 and GSA3665).

x. Upload the OF306, Declaration for Federal Employment and the GSA3665, Authorization to Obtain Credit Report into their e-QIP questionnaire.

xi. Ensure they have completed their fingerprint enrollment process and upload both OF306 and GSA3665 before they release their completed e-QIP application.

Select “Release Request/Transmit to Agency” to finalize their e-QIP questionnaire.

NOTE: While assisting the applicant in completing their e-QIP application they must be present throughout the process.

15. E-QIP Invitations will be limited to two invitations per applicant. If applicant fails to complete their e-QIP after two attempts, they will be unable to re-apply for a GSA Security Investigation for 1 year.

16. Contact Zonal Help Desk for support during the investigation process.

17. Receive enter-on-duty and/or final fitness determination as evidence applicant is authorized to begin work on the GSA contract/project.

18. If applicant receives, “Must Wait for Final Notification”, they must wait to receive final determination before beginning work on any GSA project. This notification means there was something that prevented OPM from issuing a favorable EOD.

19. If applicant receives an unfit determination, they cannot work on GSA contracts under any circumstances. If they previously received enter-on-duty, they must be removed immediately and credentials must be returned to regional OMA Staff. They must wait 1 year to reapply for a new background investigation.

Escort-Only (EO) Contractor Review Process

1. Zonal Help Desk verifies whether the applicant’s name is listed on the RO Contractor

Approval List, including dates they will be working. If applicant’s name does not appear on the RO Contractor Approval List, the CIW is rejected back to the vendor.

2. Ensure CIW is properly completed. If CIW is incomplete, it will be immediately rejected back to the vendor for corrections.

3. Ensure submittal email contains full legal name of individual escorting applicant and whether they are a federal employee, FPS security contractor or GSA contractor with the appropriate credentials. The email must also contain the dates of escort.

4. If applicant was previously found unfit, request will be rejected back to prime vendor

POC and GSA POC(s) indicating due to a previous unfit determination, the individual cannot be escorted in the facility for any reason.

5. Ensure escort is either a federal employee, FPS security contractor, or GSA contractor who is in possession of a GSA issued PIV credential. If escort does not meet these requirements, request will be rejected back to prime vendor POC and GSA POC(s) indicating a new escort meeting the requirements must be submitted.

6. If escort meets requirements and applicant has not previously been found unfit, the following notification will be sent to the prime vendor POC and GSA POC(s) as proof of EO review:

ESCORT-ONLY CONTRACTOR

Last, First Middle (Suffix):

Vendor Prime:

Contract Location:

Escort Only Start Date:

Escort Only End Date:

GSA POC(s):

Escort (Last, First, Middle, Suffix):

The escort-only review has been completed for this individual and the escort listed above has an appropriate background investigation.

At all times, while being escorted on a GSA contract, this notification should be carried by the individual being escorted, along with a photo ID.

NOTE: Individuals in the process of completing a GSA fitness determination are not allowed to be escorted.

Contractors with Prior Investigations

1. If it has been more than 2 years since an individual has worked on a GSA contract/project, the prior investigation is invalid. The contractor must complete an updated CIW and undergo a completely new fitness determination background investigation and receive their enter-on-duty determination prior to accessing the facility or receiving credentials.

2. If it has been less than 2 years since the individual has worked on a GSA contract/project, a new investigation is not required. However, an updated CIW is required to update their record.

3. Submit updated CIW to the Zonal Help Desk via encrypted email. Ensure individual’s name is listed on RO Contractor Approval List prior to submitting CIW.

4. When update has been completed the applicant, the prime vendor POC, and the GSA

POC will received the following notification:

The following individual’s record has been updated and they are approved to work on the GSA contract/project, without further investigation. Details are listed below:

Last, First Middle (Suffix):

Approved Access (SAC, Tier 1, etc.):

Vendor Prime:

Contract Number:

Contract Expiration:

Contract Location:

CO/COR/PM/FM:

The appropriate credential has been requested as applicable based on the CIW provided and the RO Contractor Approval List.

NOTE: If you already have an active GAC/PIV this notification is for informational purposes only.

US Residency Requirement

1. A Tier 1 or above investigation cannot be conducted on non-US born applicants who have less than 3 years continuous U.S. residency.

2. Submit a completed Tier 1 or higher investigation package, but OPM will perform only a SAC. If favorable, the individual will be eligible to be on site for 6 months. A new SAC is required every 6 months until the 3-year residency is obtained, at which time a new Tier 1 investigation must be initiated.

Contractor Credential

1. The GSA requesting official determines if contractor requires fitness determination and

GAC/PIV. GAC/PIVs are required for building access in some locations and network access in all locations. An EOD determination status must be verified prior to GAC/PIV issuance. Individual must have EOD determination in the process of a final Tier 1 or above to receive a GAC/PIV. GAC/PIVs are not issued to individuals with only a SAC.

SAC credentials are yet to be determined.

2. HSPD-12 PIV or GSA Access card (GAC/PIV) is required when contractors need IT access and/or routine access to GSA facilities for 6 months or more. The expiration date printed on the front of the GAC/PIV card does not represent the contract end date. The credential must be returned to GSA when the individual is no longer working on the GSA contract, regardless of the card expiration date.

3. The IT certificates assigned to the card expire 3 years from the date it is activated. GSA

USAccess will send email reminders at 45 days, 30 days, and 15 days prior to certificate expiration. The email will include how to set up a “Certificate Update” appointment at a USAccess Credentialing Center. Some Zonal Help Desks have the ability to refer contractors who need certificate updates to Lightweight Credentialing Stations (not listed on the appointment website). The email notification and certificate update process works, if the following conditions are met: the applicant supplied a monitored email address on the CIW; the card is active--not suspended or terminated; there are no pending data changes, such as the name on the card or a reprint/reissue request; or the certificates have not already expired or are going to expire within 24 hours.

4. Excerpt from FAR 52.204-9 Personal, Identity Verification of Contractor personnel--

”The contractor shall comply with agency PIV procedures identified in the contract that implement HSPD-12, OMB guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201. The contractor shall account for all forms of Government-provided identification issued to the contractor employees in connection with performance under this contract. The contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government: 1) When no longer needed for contract performance. 2) Upon completion of the contractor employee's employment. 3) Upon contract completion or termination. The CO may delay final payment under a contract if the contractor fails to comply with these requirements. The contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a federally-controlled information system. It shall be the responsibility of the prime contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.”

NOTE: ALL credentials must be turned in to the GSA RO at the end of the contract or when the individual has completed his/her duties on the contract whichever is soonest.

GSA Access Card/PIV

Roles and Responsibilities

1. Prime Vendor POC

a. Attends training provided by the Zonal Help Desk regarding the investigation

b. Initiates RO Contractor Approval List to include full legal names and associated information for all contractors who will be working on contract/project and sends it to RO for approval.

c. Assists contractors and subcontractors in completing all investigation requirements within time constraints.

d. Notifies RO (via an updated RO Contractor Approval List) of anyone being added to contract/project and anyone leaving the contract/project. Ensures all GSA credentials are returned to the RO for those leaving the project or at the end of the project.

2. Vendor Applicant

a. Completes section 1 of the CIW.

b. Schedules and enrolls at MSO station for fingerprints per enrollment email.

c. Completes OF306, GSA3665, and/or e-QIP as applicable for the type of investigation requested.

Investigation Documents

1. SAC

a. CIW

b. MSO or SF87 Fingerprints

c. OF306, Declaration for Federal Employment

2. Tier 1 and above

a. CIW

b. MSO or SF87 Fingerprints

c. SF85 or 85P on-line e-QIP application

d. OF306, Declaration for Federal Employment

e. GSA3665, Authorization to Obtain Credit Report

Common Causes of Unfit Determination This is in no way inclusive and is provided to show examples of unfit determination causes.

1. Use of illegal drugs within the past year.

2. Omissions and/or untruthful information provided.

3. Offenses without completion of court assigned penalties.

4. Recent criminal offenses.

Common Delays and Errors in Investigation Process This is in no way inclusive and is provided to show examples of delays in the investigation process.

1. Incomplete/inaccurate/inconsistent information provided on CIW.

2. Incomplete/inaccurate/inconsistent information provided on e-QIP questionnaire or attached forms (CIW, OF306, GSA3665, etc.).

3. Not completing fingerprints prior to submitting e-QIP.

4. Hard-copy fingerprints, which take longer than electronic prints.

5. Inconsistent/incorrect SSN and/or full name on all forms.

6. Not attaching required forms in e-QIP.

7. Not responding timely to email inquiries for clarification.

8. Lengthy response times from law enforcement agencies.

9. The contract company’s failure to emphasize the importance and priority of the investigation to its employees. Successful companies typically assign a responsible employee to track and review investigation forms being submitted, and assisting with the overall process.

10. Failing to ensure additional information requests are brought to the attention of the employee, and ensure compliance with the request.

11. Individual contract employee’s failure to submit all the required documents.

12. Submission of illegible forms.

13. Forms submitted with cross-through or write-overs.

14. Inconsistent information on fingerprint cards, if applicable. They must match all other documents (full name must be the same), and must also match ID used at the time of fingerprinting.

15. Incomplete e-QIP questionnaire. Must include complete addresses (including zips, Ave, St, Blvd, etc.) for residences, schools, and references.

16. Failure to submit electronically-signed e-QIP pages, OF306, and GSA 3665.

17. Failure to submit the forms correctly within specified timeframes and to respond timely to additional information requests.

Notification of Investigation Status

1. An enter-on-duty determination is the notification that allows long-term contract employees to begin working on GSA contracts pending the completion of their full Tier 1 or higher investigation. It is at this time that a GAC/PIV may be produced, as needed.

2. There are times that an applicant will receive a notification entitled “Will Need to Wait for Final Fitness Determination”. This occurs when something is discovered during the preliminary background investigation that is of concern and/or is unclear. Due to this issue, OPM will not make an enter-on-duty determination until the final investigation results are received. The final fitness determination can sometimes take several months. Until the final results are received, the individual is not authorized to work on GSA contracts, even under escort. The contract company, under consultation with the GSA RO, may need to consider selecting another applicant to work on the GSA contract, if the work they were scheduled to perform will begin soon.

3. A SAC determination is typically received within a few days of the applicant submitting all the required information. The SAC determination allows access for only 6 months. If an individual changes from one contract to another, a new CIW is always required.

4. A final fit determination will be provided by OPM for all Tier 1 or above investigations. This allows the individual to work continuously on GSA contracts without expiration, provided there is no break in service of greater than 2 years. If an individual changes from one contract to another, a new CIW is always required.

5. In the event an applicant cannot be found suitable to access GSA facilities, a final unfit notification will be provided by OPM. This notification will be sent to Zonal Help Desk, applicant, prime vendor POC, and GSA requesting official. An individual receiving this determination cannot work in any GSA facility even under escort. The applicant cannot reapply for a new investigation for a period of 1 year and there is no appeal process.

Note: The Zonal Help Desk, applicant, prime vendor POC, and GSA requesting official will receive all of the above fitness determination notifications via e-mail.

Terms and Acronyms

CIW--Contractor Information Worksheet (Form 850) CO--Contracting Officer COR--Contracting Officer’s Representative DOB--Date of Birth e-QIP--Electronic Questionnaires for Investigation Processing EOD--Enter on Duty Determination GAC--GSA Access Card GSA Form 3665--Authorization to Obtain Credit Report GQ--Golden Questions HSPD-12--Homeland Security Presidential Directive 12 IT--Information Technology IO--Initial Only MSO--Managed Service Office OF 306--Declaration for Federal Employment OMA--Office of Mission Assurance OPM--Office of Personnel Management PII--Personally Identifiable Information PIV card--Personal Identity Verification card PM--Project Manager POC--Point of Contact RO--Requesting Official SAC--Special Agreement Check SF--Standard Form SSN--Social Security Number

Attachment 1, How to Encrypt Documents Using WinZip

1. Right click on the document you want to zip.

2. Click on WinZip then Add to Zip file.

3. Open the zip file wherever it is saved. Switch the Encrypt button to on.

4. Click on Options and select Apply to all files in the Zip.

5. Click Ok to continue. Then create a password and input it into the appropriate blocks.

This password must be emailed to the Zonal Help Desk in an email separate from the encrypted documents.

6. Click Save and you are finished.

Attachment 2, Completing the E-QIP

1. The contractor must receive a registration code from OPM at do-not-reply@registration.opm.gov. If the applicant does not receive this code within 24 hours of receiving Fitness Determination Applicant Instruction email, they must contact Zonal Help Desk.

2. Applicant accesses the e-QIP application at http://www.opm.gov/e-qip/. For best results, applicant should copy and paste this link into the address line of their web browser. Then the applicant clicks on the “Enter e-Qip Application Site” button. Zonal Help Desk provides a copy of the SF-85/85P Worksheet. This is a tool used to collect all required application information prior to inputting it into the e-QIP (this worksheet cannot be submitted in lieu of completing the online application; it is for applicant use only).

Accessing the e-QIP Website

3. The system must verify the web browser used is properly configured. If changes are required, retest the configuration. Once properly configured, click continue.

Testing Your Web Browser for Compatibility

4. Next, applicant must log into e-QIP. If applicant is a first-time user, click the button titled “Register for Username and Password” and enter Social Security Number. The next screen requires applicant to answer three (3) Golden Questions (applicant’s last name, city of birth, and year of birth) and input the registration code. This information must be input just as it appears on the CIW and is case sensitive. Then the applicant creates a username and password. The system then prompts applicant to select three

(3) Challenge Questions to be used in the event they forget their password. If they are not a first-time user and have a username and password, they log in using this information. If they have forgotten their username or cannot answer the three challenge questions, they will need to contact the Zonal Help Desk for assistance. If they have forgotten their password, click on “Forgot Password” link and follow instructions.

Accessing Your e-QIP Application

5. Applicant then begins entering all their information as requested in the application by following the onscreen instructions to complete the e-QIP questionnaire. They must use the save function often and answer all applicable questions. (When inputting verifiers, they must use complete mailing addresses (Ave, Blvd, St, etc.) and phone numbers. In the employment section, they must not use the button that says “supervisor same as employer” as they must list their supervisor’s name, address, and phone number). If they encounter validation errors, they must be resolved before the process can be completed.

Entering Data and Validating Errors

6. Applicant continues following the instructions in the application to ensure these errors are corrected. Review the information entered by clicking the display button in upper left corner. If information is correct, press continue to go to next screen. After they have completed filling in all the required information, they will see the screen below.

Click on Continue. If they log off without completing the e-QIP questionnaire, and return at a later time, they will be able to resume where they left off.

Certifying Their Answers

7. Once they have input all of the required application data and reviewed the archival copy, they select “Certify Investigation Request”. Then they must electronically sign their signature pages by selecting “Signature Forms” link. To do this, they will need to select “Yes” next to “Do you agree to utilize the click-to-sign functionality on all relevant forms” and then re-enter their e-QIP password and select “Continue”. The final step is to select the “Click Here to Sign” link in the signature block.

8. The next five steps in the process are imperative. If not properly completed, these steps will delay and/or cause their investigation to be rejected. Any corrections and/or write-overs on these forms will not be accepted; the forms must be signed and dated very carefully. Then forms must be reviewed prior to submission to ensure that all required information is included. The full name on all these forms must be the same as that on their photo ID. Social security number must also match on all the documents.

The applicant then completes and signs the OF306, Declaration for Federal Employment and GSA3665, Authorization to Obtain Credit Report, then scans them separately into .pdf, .tiff, or .png files and separately uploads each document into their e-QIP questionnaire. To do this, select “Yes” next to “Do you have an additional document and/or file that you would like to associate with this request?”

Instructions

Archival Copy

Signature Forms

Attachments Summary

Attachment Summary Upload File

9. Once forms are uploaded, click on the “Return to Attachments Summary” button.

Ensure all required documents are uploaded before releasing the application.

Release Request to Agency

10. The last step is very important, as their investigation will not begin until they have released their application. They do this by selecting “Release Request/Transmit to Agency” to finalize their e-QIP questionnaire. Make sure they have completed their fingerprint/enrollment process before they “Release Request/Transmit to Agency” to complete their e-QIP application.

Confirmation

Attachment…