23_TCRS_Sec_J_Atch_J-15_ADP_Req CAC_Instruc.pdf

Attachment J-15 ADP/IT Requirements and CAC Instructions

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 1 of 8

1.0 PERSONNEL SECURITY ADP/IT REQUIREMENTS:

1.1 Formal Designations Required: Contractor personnel requiring access to the following must be in positions designated as ADP/ IT-I (critical sensitive) or ADP/IT-II (non-critical sensitive):

• Access to a secure DoD facility.

• Access to a DoD IS or a DoD Common Access Card (CAC)-enabled network.

• Access to DEERS or the B2B Gateway.

1.2 ADP/IT Position Sensitivity Designations:

1.2.1 An ADP/IT position category includes access to DoD information systems. It is a designator that indicates the level of IT access required to fulfill the responsibilities of the position, including the potential risk for an individual assigned to the position to adversely impact DoD missions or functions. The contractor’s Facility Security Officer (FSO) shall use the guidance below to determine a contractor employee’s specific ADP/IT level. Contractor personnel designated for assignment to a ADP/IT position shall undergo a successful background security screening before being granted access to DoD Information Technology (IT) systems and /or any DoD/Defense Health Agency (DHA) data directly extracted from those contained on any system (e.g, test and /or production) that contains sensitive data.

1.2.1.1 ADP/IT I: Critical Sensitive Position: A position where the individual is responsible for the development and administration of MHS IS/network security programs and has the direction and control of risk analysis and/or threat assessment. The required investigation is a SSBI or equivalent.

Responsibilities include:

• Significant involvement in life-critical or mission-critical systems.

• Responsibility for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting severe damage to persons, properties or systems, or realizing significant personal gain.

• Relatively high risk assignments associated with or directly involving the accounting, disbursement, authorization for disbursement from systems of:

• Dollar amounts of 10 million dollars per year, or greater; or

• Lesser amounts if the activities of the individuals are not subject to technical review by higher authority in the ADP/IT-I category to ensure the integrity of the system.

• Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 2 of 8

• Other positions as designated by the Designated Approving Authority (DAA) that involve a relatively high risk for causing severe damage to persons, property or systems, or potential for realizing a significant personal gain.

1.2.1.2 ADP/IT II: Non-Critical-Sensitive Position: A position where an individual is responsible for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the ADT/IT- I category. The required investigation is a National Agency Check with Law Enforcement and Credit or equivalent. Responsibilities include, but are not limited to:

• Access to and/or processing of proprietary data, information requiring protection, or government-developed privileged information involving the award of contracts.

• Accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than 10 million dollars per year.

• Other positions as designated by the DAA that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in ADP/IT-I positions.

1.2.2 Employee Prescreening:

1.2.2.1 Contractors shall conduct thorough reviews of information submitted on an individual’s application for employment in a position that requires either an ADP/IT background investigation or involves access via a contractor system to data protected by either the Privacy Act of 1974, as amended, or the HHS HIPAA Privacy and Security Final Rule. For contractors working in the United States (U.S.) and the District of Columbia, this prescreening shall include reviews that:

• Verify U.S. citizenship.

• Verify education (degrees and certifications) required for the position in question.

• Screen for negative criminal history at all levels (federal, state, and local).

• Screen for egregious financial history; for example, where adverse actions by creditors over time indicate a pattern of financial irresponsibility or where the applicant has taken on excessive debt or is involved in multiple disputes with creditors.

1.2.2.2 For contractors working outside the U.S. and District of Columbia, shall include reviews that:

• Verify citizenship.

• Verify education (degrees and certifications) required for the position in question.

• Screen for negative criminal history, to the maximum extent possible as permitted by local laws of the host Government.

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 3 of 8

• Screen for egregious financial history, to the maximum extent possible as permitted by local laws of the host Government.

1.2.2.3 The prescreening shall be conducted as part of the pre-employment screening, and shall be completed before the assignment of any personnel to a position requiring the aforementioned ADP/IT accesses. The pre-screening can be performed by the contractor’s personnel security specialists, human resource manager, hiring manager, or similar individual.

1.3 Processing Personnel Security Requirements and Granting Interim Access to DoD IS:

1.3.1 Contractor requests for a NACLC/SSBI type of security investigation are submitted to the federal investigating agency, Office of Personnel Management, via the electronic Questionnaires for Investigations Processing (eQIP) system. Contractor personnel who do not have an investigation or appropriate level of investigation to obtain access to DoD/DHA IT data, systems or networks shall complete the SF 86 in eQIP.

1.3.2 The Personnel Security Branch (PSB) may grant DHA contractors interim ADP/IT II/CAC access to DoD IT systems and DoD/DHA data upon confirmation of favorable results from the advance NAC, FBI fingerprint check and a scheduled/open investigation. Foreign Nationals or non U.S. Citizen contractor employees will not be granted interim access to DoD IT systems and DoD/DHA data.

1.4 eQIP Training and Access: The contractor FSO shall complete eQIP training to access and use Eqip and complete the eQIP Access User Form for eQIP user accounts to be created.

1.4.1 FSO Roles and Responsibilities:

The contractor FSO shall:

• Be a U.S. citizen

• Have a favorably adjudicated NACLC investigation or equivalent

• Provide list of applicants to PSB for verification of security eligibility.

• Initiate applicant’s security questionnaire in eQIP.

• Select the appropriate Agency Use Block (AUB) template in eQIP.

• Notify the COR by e-mail that an eQIP request has been initiated and requires their approval.

• Inform applicant to complete security questionnaire in eQIP within 10 calendars days.

• Perform initial review of applications for required information.

• Capture and transmit e-fingerprints to OPM via SWFT or mail two FD258 fingerprint cards to

PSB.

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 4 of 8

• Verify applicant’s citizenship and upload proof of citizenship document to investigation request before releasing case to PSB.

• Serve as the main point of contact (POC) for the applicant.

• Monitor the eQIP request, which includes ensuring the applicant completes the Eqip form in designated time period.

• Cancel or delete an eQIP request on an applicant.

• Act as POC if DoD Central Adjudication Facility (DoD CAF) requires additional information on contractor employees.

1.5 Additional Investigation Processes:

1.5.1 Background Investigation Request for ADP/IT-I: Contractors requiring an ADP/IT-I investigation for their personnel shall have their FSOs coordinate and submit a written request on company letterhead to the DHA Contracting Officer Representative (COR) for endorsement. The request letter shall be signed by, at a minimum, the FSO or other appropriate executive. It shall include a detailed job description which justifies the requirement for the ADP/IT-I. The justification letter shall be emailed to a company assigned POC in PSB.

1.5.2 Reinvestigation Requirements: Contractor personnel in positions designated as ADP/IT-I and ADP/IT-II have reinvestigation requirements. ADP/IT-I positions are critical sensitive and shall be re-investigated every five years. ADP/ IT-II positions are non-critical sensitive and shall be re-investigated every 10 years. The reinvestigation shall be initiated within 60 days of the closed date of the last investigation. The FSO shall track the reinvestigation requirement for contractor employees and initiate new investigations, as required above. Fingerprints are not required for re-investigations unless specifically requested.

1.5.3 Reciprocal Acceptance of Prior Investigation: An investigation is reciprocated when a new contractor employee has an existing favorably adjudicated investigation that meets the appropriate level of investigation required; and the break in service has been two years or less. The FSO shall verify prior investigation and if valid, provide PSB new employee’s name, social security number and date of birth.

1.5.4 Requests for Additional Information: PSB may require additional information while the contractor employee’s investigation is in progress. The FSO will be notified to provide the information by a specified date or the investigation may be rejected or returned unacceptable. The FSOs shall review applications for required information prior to release, to reduce case rejections and requests for additional information.

1.5.5 Notification of Employee Termination and Unfavorable Personnel Security Determination: The FSO shall notify PSB immediately when a contractor employee is terminated from a DHA contract. E-mail notification shall include the employee’s name and termination date.

1.5.6 If a contractor moves a contractor employee to another one its DHA contracts, PSB shall be notified immediately, especially when a contractor employee is being moved from an unclassified contract to a classified contract.

1.5.7 PSB will notify FSOs when a contractor employee has received an unfavorable personnel security determination. Upon receipt of a denial letter from PSB, the FSO shall immediately terminate the employee’s access to DoD IT systems. The return receipt letter included with the denial letter from PSB shall be returned to PSB one week after receipt of the letter to show compliance with terminating employee’s access.

1.5.8 Transfers Between Contractors: When contractor employees transfer employment from one DHA contractor to another DHA contractor while their investigation for ADP/IT trustworthiness determination is in process, the scheduled investigation may be applied to the new employing contractor. It shall be the responsibility of the new employer to provide notification to PSB when this type of transfer occurs. The notification shall contain employee’s name and effective date of transfer.

1.5.9 Electronic Fingerprint Capture and Submission: Contractors shall submit fingerprints by mailing two fingerprint cards or by using e- fingerprints and transmitting via SWFT as it improves processing time and securely transmits fingerprints.

1.5.10 The requirements above must be met by contractors and subcontractors who have access to DoD IS containing information protected by the Privacy Act of 1974 and Protected Health Information (Pll) under HIPAA. The required investigation must be completed and favorably adjudicated prior to authorizing ADP/IT access to DoD systems/networks. Interim approvals are not authorized to non-US citizen contractor employees for access to DoD systems/networks.

1.5.11 Notification and Mailing: The contractor shall use the following information to contact the PSB. The contractor shall handle sensitive information according to applicable laws and DoD policies related to privacy and confidentiality. The contractor shall transmit personally identifiable information or protected health information via encrypted e-mail or the OPM secure portal.

Mailing Address:

Defense Health Agency ATTN: Personnel Security Branch 7700 Arlington Blvd., Suite 5101 Falls Church, VA 22042-5101 eQIP Helpdesk: (703) 681-6508 E-mail address: dhapsb@mail.mil

TCRS HT9402-17-R-0002, Section J, Attachment J-15 mailto:dhapsb@mail.mil

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 6 of 8

2.0 PROCESSING FOR A CAC:

2.1 The Common Access Card (CAC) is the standard identification for Service members, Department of Defense (DoD) civilian employees, and eligible DoD contractor personnel. It is the principal card used to enable both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely. Access to the DoD network requires the use of a computer with Government-controlled configuration or use of a DoD-approved remote access procedure in accordance with the Defense Information System Agency Security Technical Implementation Guide.

2.1.1 Trust Associated Sponsorship System (TASS), is a web-based system that allows eligible DoD contractors to apply for a CAC through the internet. Government sponsors (also known as Trusted Agent) approve the application to receive government credentials.

2.2 Roles and Responsibilities:

The contractor FSO shall:

• Be a U.S. citizen

• Have a favorably adjudicated NACLC investigation or equivalent

• Identify contractor support personnel who require a CAC for accessing DoD networks and facilities.

• Verify the applicant’s background investigation

• Complete Defense Health Agency (DHA) Form 33, Sections I and III on the applicant’s behalf for an initial or renewal CAC.

• Submit the form to the Contracting Officer Representative (COR) for approval.

• Fax (703-681-5207) or email (dhatass@dha.mil) the completed DHA Form 33 to TASS / Common Access Card Branch (CACB).

• Coordinate with the Trusted Agent (TA), Defense Enrollment Eligibility Reporting System (DEERS) record updates (Name, SSN, DOB etc.).

• Set up an out processing procedure to collect the CAC when an applicant is terminated from the company or when the CAC is no longer required.

• Notify the TA or TASS/CACB to revoke the applicant’s CAC.

• Return CACs to the TA or Defense Health Agency (ATTN: Personnel Security Branch/TASS- CACB), or the nearest Real-Time Automated Personnel Identification Systems (RAPIDS) facility), and follow up with an email to dhatass@dha.mil providing the name(s) of the CAC(s) mailto:dhatass@dha.mil

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 7 of 8 that were submitted to the facility.

2.3 CAC Guidelines and Restrictions:

2.3.1 Any person willfully altering, damaging, lending, counterfeiting, or using these cards in any unauthorized manner is subject to fine or imprisonment or both, as prescribed in sections 499, 506, 509, 701, and 1001 of title 18, United States Code (U.S.C.) Section 701 prohibits photographing or otherwise reproducing or possessing DoD ID cards in an unauthorized manner, under penalty of fine or imprisonment or both. Unauthorized or fraudulent use of ID cards would exist if bearers used the card to obtain benefits and privileges to which they are not entitled. Examples of authorized photocopying include photocopying of DoD ID cards to facilitate medical care processing, check cashing, voting, tax matters, compliance with appendix 501 of title 50, U.S.C. (also known as “The Service member’s Civil Relief Act”), or administering other military-related benefits to eligible beneficiaries. When possible, the ID card will be electronically authenticated in lieu of photographing the card.

2.3.2 ID cards shall not be amended, modified, or overprinted by any means. No stickers or other adhesive materials are to be placed on either side of an ID card. Holes shall not be punched into ID cards, except when a CAC has been requested by the next of kin for an individual who has perished in the line of duty. A CAC provided to next of kin shall have the status of the card revoked in DEERS, have the certificates revoked, and have a hole punched through the integrated circuit chip before it is released to the next of kin.

2.4 Access: The granting of access is determined by the contractor or system owner as prescribed by the DoD.

2.5 Accountability: CAC holders shall maintain accountability of their CAC at all times while affiliated with the DoD.

2.6 Multiple Cards: In instances where an individual has been issued more than one ID card (e.g., an individual that is eligible for an ID card as both a Reservist and as a contractor employee), only the ID card that most accurately depicts the capacity in which the individual is affiliated with the DoD should be utilized at any given time.

2.7 Renewal and Reissuance: The applicant for CAC renewal or reissuance shall be required to surrender the current CAC card that is up for renewal. A CAC card holder may apply for a renewal 30 days prior to the expiration date of a valid CAC.

2.8 Replacement: The applicant shall provide a letter from the local security office confirming the CAC has been reported lost, stolen confiscated or destroyed, and a valid (unexpired) State or Federal Government-issued picture ID.

2.9 Transfers Between Contractors: The contractor is authorized to retain the CAC when transferring employment from one DHA contractor to another. It shall be the responsibility of the new employer to provide notification to PSB/TASS when this type of transfer occurs. The notification shall contain employee’s name; new contractor delivery order number and effective date of transfer.

3.0 Retrieval: The CAC is property of the U.S. Government and shall be retrieved and returned to TASS/CACB when the card has expired, or it is damaged or compromised, or when the applicant is no

TCRS HT9402-17-R-0002, Section J, Attachment J-15 Page 8 of 8 longer affiliated with the DoD contractor or no longer meets the eligibility requirements for the card.

Defense Health Agency Mission Assurance Division Personnel Security Branch

ATTN: TASS/CACB

7700 Arlington Blvd, Suite 5101 Falls Church, VA 22042-5101

TASS/CACB: (703) 681-6777

E-mail address: dhatass@dha.mil

3.1 Personal Identification Number (PIN) Resets: Should an individual’s CAC become locked after attempting three times to access it, the PIN will have to be reset at a RAPIDS facility.

3.1.1 Contractors shall ensure that CACs are only used by the individual to whom the CAC was issued. Individuals must protect their PIN and not allow it to be discovered or allow the use of their CAC by anyone other than him/herself. Contractors are required to ensure access to DoD systems applications and data is only provided to individuals who have been issued a CAC and whose CAC has been validated by the desktop middleware, including use of a card reader. Sharing of CACs, PINs, and other access codes is expressly prohibited.