CNIC_M-5530.2_Navy_Installation_Access_Control04Jun2020.pdf

DEPARTMENT OF THE NAVY

COMMANDER NAVY INSTALLATIONS COMMAND

716 SICARD STREET SE SUITE 100

WASHINGTON NAVY YARD DC 20374-5140

CNIC-M 5530.2

N3 4 Jun 2020

CNIC MANUAL 5530.2

From: Commander, Navy Installations Command

Subj: NAVY INSTALLATION ACCESS CONTROL

Ref: (a) See appendix B

1. Purpose. To implement Navy policy, assign responsibilities and prescribe procedures for managing and executing the Department of Defense (DoD) Physical Security Program for Access Control.

2. Scope and Applicability. This manual applies to Commander, Navy Installations Command (CNIC) headquarters, regions and installations.

3. Records Management

a. Records created as a result of this manual, regardless of format or media, must be maintained and dispositioned for the standard subject identification codes 1000 through 13000 series per the records disposition schedules located on the Department of the Navy/Assistant for Administration (DON/AA), Directives and Records Management Division (DRMD), at https://portal.secnav.navy.mil/orgs/DUSNM/DONAA/DRM/Records-and-Information- Management/Approved%20Record%20Schedules/Forms/AllItems.aspx.

b. For questions concerning the management of records related to this manual or the records disposition schedules, please contact your local records manager or the DON/AA DRMD program office.

4. Review and Effective Date. Per OPNAVINST 5215.17A, CNIC (N3) will review this manual annually on the anniversary of its effective date to ensure applicability, currency, and consistency with Federal, Department of Defense, Secretary of the Navy, and Navy policy and statutory authority using OPNAV 5215/40, Review of Instruction. This manual will be in effect for 10 years unless revised or cancelled in the interim and will be reissued by the 10-year anniversary date if it is still required, unless it meets one of the exceptions in OPNAVINST 5215.17A, paragraph 9. Otherwise, if the manual is no longer required, it will be processed for cancellation as soon as the need for cancellation is known following the guidance in OPNAV Manual 5215.1 of May 2016.

4 Jun 2020

CNIC M-5530.2

i

NAVY INSTALLATION

ACCESS CONTROL

ii

TABLE OF CONTENTS

CHAPTER 1 NAVY ACCESS CONTROL PROGRAM MANAGEMENT Page 0101 General…………………………………………………………………………...….. 1-1 0102 Policy..………………………………………………………………………….…… 1-1 0103 Authority…………………………………………………………………………….. 1-1 0104 Responsibilities…………………………………………………………………….... 1-1 0105 Installation and Facility Access Control……………………………………….......... 1-6 0106 Defense Biometric Identification System (DBIDS)……………………………..…... 1-8 0107 Naval Facilities Engineering Command (NAVFAC)......………………………..….. 1-9

CHAPTER 2 REQUIREMENT FOR ACCESS TO A NAVY INSTALLATION

0201 Types of access…………………………………………………………………..….. 2-1 0202 Establishing Identity for Unescorted Access………………………………….…..… 2-1 0203 Establishing Fitness for Unescorted Access……………………………..………….. 2-2 0204 Establishing Purpose for Unescorted Access…………………………..……………. 2-4 0205 Requirement for Special Events and Emergencies………………………………..… 2-5 0206 Related Measures………………………………………………………………….… 2-5 0207 Additional Requirements……………………………………………………….…… 2-5

CHAPTER 3 PROCEDURES FOR GRANTING ACCESS TO A NAVY INSTALLATION

0301 General Sponsorship………………………………………………………………… 3-1 0302 Sponsorship for Contractors………………………………………………………… 3-1 0303 Granting Escorted Access…………………………………………………………… 3-3 0304 Granting Trusted Travel Access…………………………………………………..… 3-3 0305 Granting Unescorted Access………………………………………………………… 3-5 0306 Visitor Control Process……………………………………………………………… 3-5 0307 Visitor Control Process Completion with Waiver and Appeal………….................... 3-7 0308 Enrollment…………………………………………………………………………… 3-9 0309 Access Control Process……………………….…………………....………………... 3-10 0310 EPACS Failure Contingencies………………………………………………………. 3-12

CHAPTER 4 ACCEPTABLE FORMS OF IDENTIFICATION

0401 Acceptable Credentials……………………………………………………………… 4-1 0402 Source Identity Documents………………………………………………….………. 4-5 0403 Verification of Credentials………………………………………………………..… 4-7

CHAPTER 5 IMPLEMENTATION

0501 Implementing Policies…………………………………………………………..…… 5-1 0502 Allowable Deviations……………………………………………………………..…. 5-2 0503 Navy Policy for Acceptable Purposes………………………………………….……. 5-2 0504 National Crime Information Center (NCIC)………………………………………… 5-2 0505 DBIDS Base Security Officer (BSO) and Security Site Manager (SSM)…………... 5-2 0506 DBIDS Credentials………………………………………………………………..… 5-3 0507 DBIDS Photographs………………………………………………………………… 5-3 0508 DBIDS Handheld Scanners…………………………………………………………. 5-4 iii

0509 DBIDS Consumables……….……………………………………………………….. 5-4 0510 CNIC DBIDS Team Site……………………………………...................................... 5-4

CHAPTER 6 CONTRACTED TRANSPORTATION SERVICES

0601 Contracted Transportation Services Requirements………………………………...… 6-1

CHAPTER 7 ENTRY CONTROL PROCEDURES

0701 Entry Control Point Procedures………………………………………………….…... 7-1

APPENDICES

APPENDIX A Minimum Fitness Determination Standards………………………………. A-1

APPENDIX B References…………………………………………………………………. B-1

APPENDIX C Definitions…………………………………………………………………. C-1

APPENDIX D Acronyms……………………………………………………...…………... D-1

CNIC-M 5530.2

1-1

CHAPTER 1

NAVY ACCESS CONTROL PROGRAM MANAGEMENT

0101. General. To establish and prescribe procedures for access control to CNIC via entry control points (ECPs) using the Defense Biometric Identification System (DBIDS) or other Electronic Physical Access Control Systems (ePACS). The standards prescribed herein are the minimum required for Navy installations. Compliance is mandatory. Commanders with tactical control (TACON) for FP may authorize additional security requirements.

0102. Policy. Per reference (a), CNIC installations, property and personnel must be protected.

Commanders have the authority to take reasonably necessary and lawful measures to protect installation property and personnel, but that authority must not be exercised in an arbitrary, unpredictable, or discriminatory manner. Removal or denial actions must be based on reasonable grounds and judiciously applied. This manual amplifies DoD and Department of the Navy (DON) security standards and guidance for authorizing physical access to CNIC installations and/or stand-alone facilities.

0103. Authority

a. Authority to control access to CNIC installations varies based on jurisdiction, property rights and geographic location.

b. For CONUS, Alaska, Hawaii, U.S. territories and possessions within U.S. jurisdiction, commanding officers (COs) publish and enforce guidance to protect installation resources per DoD and DON policy. Reference (b) prohibits individuals from entering or reentering military installations within the jurisdiction of the U.S. for a purpose prohibited by law or lawful regulation after being ordered not to enter/reenter by any CO or the CO’s designee.

c. For OCONUS locations, a CO's right to exercise this authority comes from U.S. laws and Status of Forces Agreement (SOFA), memorandums of agreement (MOA), or memorandums of understanding (MOU) applicable to the overseas area and from bilateral and multilateral agreements between the U.S. and the host nation.

d. COs will protect civil liberties, privacy and personally identifiable information (PII). PII collected, used, maintained, or disseminated in the execution of this manual will be appropriately maintained and safeguarded to prevent its unauthorized access, use, disclosure, or loss. The collection, use, maintenance and dissemination of PII must comply with the requirements in references (c) through (j).

0104. Responsibilities

a. CNIC Operations (N3) will:

(1) Provide direction and oversight to region and installation Navy Security Force (NSF) personnel, which are comprised of Active and Reserve Duty military personnel, DON civilians and contractor personnel.

1-2

(2) Provide unified and consistent policy, procedures, standards of service and practices for effective and efficient management of the CNIC Ashore Protection Program.

(3) Identify the resources required to implement policy required by this manual as part of the planning, programming and budgeting system process.

b. CNIC Force Protection (N34) will:

(1) Establish policies for CNIC installation access control that contain, at a minimum, the items listed in paragraph 0501.

(2) Implement procedures for all populations to gain access to CNIC installations.

(3) Enable access procedures providing a uniform process to establish identity, purpose and determine fitness for gaining access to CNIC installations.

(4) Ensure all other physical security measures are subject to randomization and unpredictability requirements for security purposes, but will not be arbitrary or discriminatory.

(5) Field electronic Physical Access Control Systems (ePACS) at all CNIC installations.

(a) New ePACS and ePACS undergoing significant upgrade (valued at more than 50 percent of replacement cost) must interface with the Identity Matching Engine for Security Analysis (IMESA) via the Interoperability Layer Service (IoLS) and read, enroll, and electronically verify all listed credentials as described in Chapter 4.

(b) All ePACS must comply with references (b), (d), (e) and (k).

(6) Direct implementation of the following at all CNIC installations:

(a) A training program for perimeter security personnel, including at both the ECP and visitor control center (VCC), on the requirements, processes and prohibitions described in this manual and the appropriate DoD Component policy.

(b) A redress and appeal process for individuals denied unescorted access.

(c) Credential requirements, fitness disqualifications, Privacy Act statement and redress and appeal processes, ensuring they are clearly and conspicuously posted at the VCC and on the installation website if one exists.

(d) A determination of the acceptable purposes for accessing the installation, per this manual, applicable Federal, state and local laws, DoD and Navy policies.

(e) Coordination with local first responders to establish appropriate standard operating procedures for facilitating access to first responders during emergencies, per paragraph 0205.c(1) and (2) of this manual.

1-3

(f) Establish alternate means to process visitors through the visitor control process (VCP) when the VCC is closed.

(g) Adjudicate requests for deviations listed in paragraph 0502 for installations under their authority, direction, and control, and review each approved deviation annually to assess associated risks. The only allowable deviations are listed in paragraph 0502.

(h) Fund the operation, maintenance, and enhancement of IMESA with additional government data sources.

c. Region Commanders (REGCOM) will:

(1) Establish assessment staffs as appropriate.

(2) Develop operational level access control guidance as required.

(3) Validate manpower and resource allocation in support of access control.

(4) Provide monthly DBIDS aggregate transactions and aggregate credential issuance report to CNIC.

d. Installation COs will:

(1) Work with local tenant commands as well as host nation authorities to identity and fitness proof applicants to the greatest extent practical and within legal authority in OCONUS locations.

(2) Coordinate organic and internal access control systems and components with their installation tenants prior to obligating funds for project execution.

(3) Ensure all persons requesting unescorted access demonstrate a valid purpose for entry, are identity proofed and a fitness determination is completed.

(4) Establish commander’s intent and define risk tolerance in relation to installation perimeter access control.

(5) Determine credential requirements for personnel under the age of 18 who require non-recurring access and are not in possession of an authorized identification credential or identity source document listed in paragraph 0402.

(6) Issue debarment letters to deny an individual access to the installation due to involvement in the commission of a criminal offense, when access is inconsistent with the interests of national security, when personal conduct reflects negatively on the image of the United States overseas, or when access adversely affects the health, safety, or morale of personnel on that installation.

1-4

(7) Implement procedures for off-base first responders’ physical access requirements during emergencies.

(8) Determine the number of personnel Trusted Travelers are authorized to escort in addition to sponsorship and escort rules for DoD family members under the age of 18.

(9) Delegate, in writing, the authority to perform identity proofing, vetting and determination of fitness, and access authorizations and privileges.

(10) Designate an installation Single Source Coordinator (SSC).

(11) Provide monthly DBIDS aggregate transactions and aggregate credential issuance report to region.

(12) Ensure tenant commands and unit commanders understand and follow installation access control guidance and procedures.

(13) Coordinate with tenant commands and unit commanders to identify their key mission essential personnel and associated resources essential to comply with this manual, and coordinate and integrate associated unit processes into the installation Antiterrorism (AT) plan.

e. Installation Security Officers will:

(1) Act as the primary advisor to the installation CO for AT, Law Enforcement (LE) and Physical Security (PS), to include installation access control.

(2) Conduct access control assessments and planning.

(3) Develop and publish installation specific access control policies and procedures.

(4) Establish a VCC for registration and issuance of installation access credentials and passes.

f. VCC Supervisors will:

(1) Ensure personnel are trained, proficient, and designated to:

(a) Produce and issue DBIDS credentials.

(b) Produce Access Control Lists, or other measures associated with access control accountability and authorized entry.

(c) Ensure the DON Local Population ID Card/Base Access Pass Registration (SECNAV Form 5512/1) is the sole means to initiate background checks on all visitors and/or contractors/vendors. Every background check for the purpose of unescorted access control requires completion of the SECNAV Form 5512/1 for accountability purposes.

1-5

1. Installations will keep the original copy or an electronic copy of all completed SECNAV Form 5512/1 for a minimum of three years or until the Department of Justice (DOJ) conducts their periodic audits, whichever is greater.

2. SECNAV Form 5512/1 may not be used for multiple background checks.

Each time a National Crime Information Center (NCIC) check is conducted, complete a new SECNAV Form 5512/1.

(d) Establish procedures to revoke credentials of individuals who no longer require installation access.

(e) Establish provisions to ensure only users who have been trained to operate the DBIDS system have access to the equipment.

(f) Establish procedures to protect DBIDS equipment against theft or damage.

Note: If the facility where the equipment is housed cannot be secured, the equipment must be removed at the end of each duty day.

(g) Manage current and future access control requirements based on operational vulnerabilities.

(h) Ensure debarment information obtained from the installation staff judge advocate (SJA) is current and uploaded into the appropriate authoritative Consolidated Law Enforcement Operation Center (CLEOC) or its successor system, and DBIDS database.

(i) Establish procedures to issue visitor passes during VCC non-operating hours, ensuring individuals meet all requirements listed in paragraphs 0202, 0203 and 0204.

(j) Establish reporting procedures for lost/stolen ID cards or access credentials.

(k) Ensure individuals requiring access are properly proofed and vetted prior to issuance of a pass, as appropriate.

g. Single Source Coordinators will:

(1) Establish local policy to inspect transportation service vehicles.

(2) Establish local policy outlining validation procedures for empty transportation service vehicles with a legitimate on-base call for service when requesting installation access.

(3) Establish one or more transportation service stands on an installation to queue for fares and/or pick-ups/drop-offs.

1-6

(4) Oversee registration and clearance for vendors, contractors and drivers providing transportation services, e.g., taxicab, limousine, ride share and shuttle services.

(5) Serve as the approval authority for business entities operating transportation services on the installation per region/installation policies.

(6) Verify transportation service vehicle operators have completed appropriate vetting and met fitness standards for installation access.

(7) Conduct quarterly reviews with transportation service companies to verify drivers continued employment with the company.

(8) Coordinate issues between the installation security department and contractors.

0105. Installation and Facility Access Control

a. Objective. The objective of installation perimeter access control is to physically control personnel and vehicular entry to installations, facilities and resources. Requirements for gaining access must be implemented consistently, uniformly and predictably to facilitate authorized entry. Random Antiterrorism Measures (RAMs) may be applied in addition to the access control process per reference (l).

(1) Requirements for controlling installation access include, but are not limited to:

(a) Escort qualifications, responsibilities and authorizations.

(b) Sponsorship qualifications, responsibilities and authorizations.

(c) Access privileges at each Force Protection Condition (FPCON).

(d) Mission-essential personnel (MEP) designation.

(e) Emergency response designation, if applicable.

(f) Day and time designation for access.

(g) Locations authorized for access.

(2) COs employ access control measures at an installation perimeter to enhance security and protect personnel, resources and property.

b. Entry Control Standards. COs are responsible for the following entry control standards:

(1) Standard 1. Establish program guidelines which clearly delineate operational and administrative command responsibilities.

1-7

(2) Standard 2. Standardize and integrate the process of identifying, authorizing, credentialing, authenticating and granting access.

(a) Electronically scan all Common Access Card (CAC)/DBIDS and other approved credentials at all times.

(b) Conduct a visual inspection of access credentials when electronic systems are not installed or are inoperative.

(c) Utilize Automated Vehicle Gate – Low (AVG-L) technology. When installed, operate AVG-L to the maximum extent possible during non-peak vehicle traffic hours (60 vehicles per hour or less).

(3) Standard 3. Identify key and essential personnel in AT plans consistent with different FPCON levels and different emergency types. Verify the AT plan and the Emergency Management (EM) plan are consistent in identifying key and essential personnel. See reference

(m) for applicable personnel categorization.

(4) Standard 4. Implement guidance contained in reference (n) for new ECP construction or major modifications to ensure AT construction standards for positive access control are incorporated.

(5) Standard 5. Establish access control capabilities based on installation criticality.

REGCOMs and COs may direct additional security measures based on installation criticality, FPCONs, area specific threat related intelligence and higher headquarters direction. Additional security requirements will be consistent with regional plans and CNIC guidance.

(6) Standard 6. VCCs will have the capability to issue temporary credentials to those individuals who are authorized to access installations/facilities but who do not meet the requirements to be issued a CAC, U.S. Government issued and authenticated Federal Personal Identity Verification (PIV) credentials, DoD Civil Service Retiree Card, Uniformed Services Identification (TESLIN) cards or Veteran’s Health Identification Card (VHIC).

(a) The VCC design and location considerations are addressed in paragraph 5-7.6.2 of reference (n).

(b) Trained NSF may issue visitor passes at the ECP using the DBIDS Access Control Workstation to otherwise eligible personnel when the VCC is closed. All requirements as outlined in paragraphs 0202, 0203 and 0204 must be met prior to issuing a pass and allowing installation access.

(7) Standard 7. Contracting Officers (KOs) and SSCs will include the issuance and revocation guidelines contained in this chapter as a part of solicitations, contracts and agreements. Existing solicitations, contracts and agreements should not be modified until renewed.

1-8

(a) CNIC has adopted DBIDS as a standardized process for granting unescorted access privileges to vendors, contractors, suppliers and service providers. DBIDS is specifically for those vendors and contractors not otherwise entitled to the issuance of a CAC.

(b) Vendors, contractors, suppliers and service providers who seek routine, unescorted access to CNIC installations and can provide appropriate justification may obtain reusable credentials under DBIDS.

(c) DBIDS credentials are issued free of charge. Visiting vendors may continue to obtain daily passes directly from the individual CNIC installations by submitting identification credentials for verification and undergoing a criminal screening/background check.

Alternatively, a vendor may choose to obtain long-term DBIDS credentials at each installation's respective VCC by enrollment, registration, background vetting, screening, issuance of credentials, and electronic validation of credentials. Further information regarding DBIDS can be found at: https://www.cnic.navy.mil/om/dbids.html.

(8) Standard 8. Publish and implement consistent emergency access control policy and procedures at each installation. Ensure policies/procedures address the requirement for viable means to allow rapid authentication and access to responding emergency personnel in times of crisis.

0106. DBIDS. DBIDS is a DoD-owned and operated system developed by the Defense Manpower Data Center as a force protection program to manage personnel and installation access at DoD facilities. It is a networked client/server database system designed to easily verify the access authorization of personnel entering military installations by the use of barcode, contactless and fingerprint biometric technology. The program supports the adding, retrieving, updating and displaying of information for individuals who require military installation access.

The DBIDS software application is used to enter personnel data into a database, capture information, and retrieve that data and biometric information for verification and validation at a later time. DBIDS enhances the military law enforcement mission by helping to provide a safe and secure community and by allowing access to data.

a. This program utilizes a personal computer (PC) based client/server database system to register personnel and organizations and a web-based portal for operators to perform additional administrative and law enforcement tasks. There are two types of workstations in the DBIDS model: the registration workstation (RW) and the Access Control Workstation (ACW).

Operators using the DBIDS general workstation perform registration, administration and security operations.

b. The DBIDS Admin Web Portal allows administrative roles and law enforcers, such as Base Security Officers (BSOs), Site Security Managers (SSMs) or Law Enforcement Officers (LEOs) to view reports, manage operator roles, set force protection levels and perform a status updates to persons or vehicles.

c. The RW produces DBIDS credentials for people who do not possess a DoD credential but are entitled to recurring and unescorted access to an installation. The system incorporates

1-9 existing CAC, Uniformed Services ID card (Teslin) and contactless card technology for cross platform compatibility. For DoD ID cardholders, data elements are retrieved from the IoLS database to authenticate the cardholders and streamline the DBIDS registration process. The design provides an intuitive graphical user interface and dialogue to capture and display person, vehicle and organization data. It contains a module that positively identifies an individual based on the personal data stored on the person’s ID card.

d. DBIDS utilizes the ACW to validate access at ECPs within a DoD facility. At the ECP, operators can also validate an individual by capturing a live fingerprint image and comparing it to the fingerprint image stored in the database. System design allows BSOs to add and modify site perimeters and access areas, and provides for category specific access. Additionally, individuals can be restricted from accessing selected areas.

0107. Naval Facilities Engineering Command (NAVFAC). Provides engineering expertise, recommendations, and support to CNIC’s installation access control program including:

(1) Providing recommendations for force protection construction standards regarding planning and design standards that support this manual.

(2) Providing input in acquiring necessary equipment and resources. Coordinates equipment condition and limitations based on Navy requirements and performance specifications during research and development efforts.

(3) Administration of the Unified Facilities Criteria (UFC) system in coordination with Headquarters, U.S. Army Corps of Engineers (HQUSACE) and Air Force Civil Engineer Center

(AFCEC).

2-1

CHAPTER 2

REQUIREMENTS FOR ACCESS TO A NAVY INSTALLATION

0201. Types of Access. There are three types of access to a military installation: escorted, trusted traveler and unescorted. Each type of access has a specific set of requirements which must be implemented consistently, uniformly and predictably to facilitate entry by authorized personnel.

a. Unescorted Access. Unescorted access requires individuals to establish their identity, be determined fit for access, and establish an acceptable purpose for presence on the installation.

Unescorted access may also be granted per applicable laws and Navy policies. Exceptions to these requirements include:

(1) Special events, circumstances and activities.

(2) Installations which require open, unimpeded access to the public, per paragraphs 0401.c and d., and 0502 of this manual.

(3) A minor under the age of 18 who does not have an acceptable credential and is accompanied by another individual over the age of 18.

b. Trusted Traveler Access. The trusted traveler program allows authorized individuals who have been granted unescorted access to simultaneously vouch for co-travelers (in the same vehicle or on foot) and enable those co-travelers to obtain trusted traveler access. Trusted traveler access, if permitted at the installation, requires individuals to have an acceptable purpose for their presence on the installation and be capable of establishing their identity and being determined fit for access upon demand by installation security personnel. Individuals may be required to establish their identity per paragraph 0202 based on installation policy.

c. Escorted Access. Individuals unable to meet the requirements for trusted traveler or unescorted access may be granted escorted access, per installation-level policy. If an individual is granted escorted access, the assigned escort must remain within visual contact of the escorted individual at all times.

0202. Establishing Identity for Unescorted Access. Identity is established either by presenting one “acceptable credential” or by presenting an acceptable combination of “source identity documents.” Acceptable credentials and source identity documents are listed in paragraph 0401 of this manual.

a. Acceptable credentials and source identity documents must:

(1) Be original and current (unexpired).

(2) Not contain the markings “Not Valid for Federal Purposes,” “Not For Use as Federal Identification,” “Federal Limits May Apply,” or any other similar phrase.

2-2

(3) In the case of a driver’s license or non-driver’s identification card issued by a state, territory, possession, or the District of Columbia, be compliant with the REAL ID Act of 2005.

b. Individuals holding more than one acceptable credential must use the credential most accurately depicting the capacity in which the individual is acting for the specific visit to the installation, per reference (o).

c. Installation COs will not require more than one acceptable credential to establish identity as a standard access control process. Intermittent requirements to present additional credentials as a random antiterrorism measure are considered part of an installation’s AT program, not access control.

d. Installation COs will accept all types of credentials listed in paragraph 0401 as acceptable for their type of installation. Installation COs with unique mission requirements may refuse to accept one or more of the credentials listed in paragraph 0401 as acceptable for their type of installation when approved as a deviation per paragraphs 0401.c and d., and 0502 of this manual and consistent with applicable laws.

0203. Establishing Fitness for Unescorted Access. Fitness for access has two elements:

historic fitness and current fitness.

a. Historic fitness is established, at a specific point in time, only by means of a review of the individual’s prior criminal history through a check of NCIC, the Interstate Identification Index, and relevant government databases and service criminal justice information systems. The requirement to establish historic fitness for unescorted access may be met by either:

(1) Establishing historic fitness at the time of access through an on-the-spot review and adjudication conducted by government personnel at an installation or at a centralized processing location.

(2) Minimum fitness determination standard through an inquiry of NCIC “Persons Files” and Interstate Identification Index (III), NCIC National Sex Offender Registry (NSOR), Terrorist Screening Database (TSDB), DOJ National Sex Offender Public Website (NSOPW), and CLEOC, or successor system database review for debarments. When performing inquiries to NCIC and III, adhere to the following:

(a) Government personnel performing vetting will at a minimum query these systems using NCIC Message Key Code: “QWI.” The “QWI” query will perform two vetting transactions, the “QWA” and “QH,” which will identify if the individual is located in the NCIC “Persons Files” (includes NSOR and TSDB queries) or if they are indexed in the III system.

(b) The NCIC “QWI” query will include the individual’s name, date of birth, and at a minimum one additional numeric identifier, e.g., social security number, driver’s license number, passport number, etc.

2-3

b. For OCONUS installations without NCIC, III, or NSOR access, COs will direct use of equivalent local authoritative data sources, including host nation law enforcement, to meet the intent of this policy, proving that historic fitness was previously established by any one of the following:

(1) The acceptable credential used to establish identity, if listed as establishing historic fitness listed in paragraph 0401.d of this manual, includes:

(a) A previously conducted review and adjudication at an installation if followed, immediately and without lapse, by enrollment in IMESA for continuous vetting;

(b) The DoD Consolidated Adjudication Facility, or predecessor organization, determination that the individual is eligible for access to classified information, so long as that eligibility remains in scope;

(c) A favorably adjudicated Tier 1 or higher background investigation performed by the DoD Consolidated Adjudication Facility or other Federal agency that remains in scope; or

(d) Other means established by Navy policy.

c. Current fitness is established, on a recurring and continuing basis, only through a review (either on-the-spot at the VCC or nightly through IMESA) of an individual’s current derogatory information through a check of authoritative government sources (real-time or most recent file from such source). The review includes:

(1) Terrorism lists, such as the NCIC Known and Appropriately Suspected Terrorist File and the Terrorism Screening Database.

(2) Felony wants and warrants, such as those listed in the NCIC Wanted Persons File.

(3) Debarment order lists, such as relevant Service criminal justice information systems.

(4) Other relevant government databases that may be available such as:

(a) Other NCIC files (including NSOR);

(b) Criminal justice or immigration databases; or

(c) Other appropriate biometric or biographic government databases.

d. Until a DoD standard for historic and current fitness is established, the Navy has established its own fitness adjudication criteria. See appendix A.

(1) Installation COs must conspicuously post their established adjudication criteria and redress and appeal process for those negatively adjudicated.

2-4

(2) Installation COs may grant unescorted access to a convicted felon, per applicable federal, state, and local laws, after considering appropriate mitigating factors such as the nature and seriousness of the offense, the circumstances surrounding the offense, recency and frequency of the offense, the individual’s age and maturity at the time of the offense, the individual’s effort toward rehabilitation and other factors.

(3) Installation COs may grant unescorted access to individuals without U.S. citizenship based on the installation’s characteristics or mission. In situations where an installation requires U.S. citizenship for unescorted access due to characteristics or mission, acceptable proof of citizenship can be demonstrated with any one of the following:

(a) An unexpired U.S. passport or passport card.

(b) An original or certified true copy of a birth certificate issued by a state, territory, possession, or the District of Columbia bearing a raised seal.

(c) A certificate of naturalization (Form N-550 or N-570).

(d) A Consular Record of Birth Abroad.

(e) Other documents as established by Navy policy.

(4) An individual with dual U.S. citizenship will be treated the same as an individual with only U.S. citizenship. Presentation of any one of the documents listed in CNIC-M 5530.14 paragraph 3.3.c(5) is sufficient to prove U.S. citizenship.

0204. Establishing Purpose for Unescorted Access. All individuals must have an acceptable purpose for presence on the installation.

a. Purpose is established by:

(1) The acceptable credential presented if listed as establishing purpose in paragraph 0401.

(2) Documentation including, but not limited to, bills of lading or event tickets.

Documentation may be hardcopy or electronic.

(3) Trusted DoD systems such as, but not limited to, the Carrier Appointment System.

(4) Lists including, but not limited to, guest lists, transportation officer delivery/pickup lists or appointment lists.

(5) Verbal discussion with the individual seeking access.

(6) By other means defined by CNIC and installation-level policy.

2-5

(7) Certain purposes may only be valid for specific identities (e.g., a name on appointment list is only a valid purpose if the individual has established their identity, as described in paragraph 0202 and that identity matches the entry on the list).

0205. Requirements for Special Events and Emergencies. After performing a risk assessment, REGCOMs may grant a temporary waiver to one or more of the requirements outlined in paragraphs 0202 and 0203 of this manual for special events or in case of an emergency on the installation. Temporary waivers issued under this paragraph are not considered deviations.

a. The requirements must be met to the extent feasible.

b. Installation COs must manage increased risk associated with waiving these requirements.

Measures must be taken to ensure that individuals who have been granted access to the installation for the special event do not have access to other parts of the installation not associated with the event. The special event itself constitutes the acceptable purpose required by paragraph 0204.

c. Installation COs will coordinate with local first responder organizations, including law enforcement and fire and medical response organizations, to develop procedures for facilitating access during emergency response events.

(1) Through such procedures, COs may establish appropriate criteria to waive the requirements outlined in paragraphs 0202 and 0203 for first responders to emergency response events. The emergency response event itself constitutes the acceptable purpose required by paragraph 0204.

(2) Access control personnel granting access to first responders during an emergency should direct first responders to check in with the on-scene incident commander to coordinate their activities and prevent mistaken identities that could hinder a coordinated response to the emergency.

0206. Related Measures. The installation COs are authorized to inspect the vehicle, parcels and belongings of an individual seeking installation access.

0207. Additional Requirements. When approved as a deviation per paragraphs 0401.c and d., and 0502, COs with unique mission requirements may establish more restrictive access control requirements. Examples of such situations include, but are not limited to, installations where access requires an active security clearance or very high-profile CNIC installations, such as the Pentagon Reservation.

3-1

CHAPTER 3

PROCEDURES FOR GRANTING ACCESS TO A NAVY INSTALLATION

0301. General Sponsorship. General sponsorship allows approved individuals affiliated with the DoD to take responsibility for verifying and authorizing an applicant’s need for access to an installation.

a. Active Duty, Guard and Reserve personnel on official orders, CAC holders (to include Contractor CAC holders with written permission from the CO), military retirees, and family members 18 years of age and older are authorized to sponsor individuals onto an installation.

b. Privatized housing residents with DBIDS credentials are authorized to sponsor individuals onto the installation they are affiliated with/assigned to, but sponsorship privileges are limited to their particular housing area only.

c. Installation bank and credit union employees with DBIDS credentials are authorized to sponsor bank/credit union affiliated individuals for the purposes of conducting bank or credit union business.

d. Temporarily Assigned (TDY) Personnel. Active Duty, Guard and Reserve personnel on official orders, and CAC holders on official TDY orders to an installation are authorized to sponsor individuals onto that installation only for the duration of their TDY/Active Duty orders.

e. COs will establish further guidelines and restrictions concerning the numbers of visitors which may be sponsored, times of day, length of time the credential can be issued for, and other restrictions as appropriate and codify into local guidance. Additionally, COs have the flexibility to include sponsorship privileges for unique categories not addressed in this manual.

f. All sponsored visitors must comply with requirements in Chapter 2.

0302. Sponsorship for Contractors. CNIC uses a methodology that involves Navy activities that “sponsor” contractors and vendors for issuance of either a DBIDS credential or a CAC.

a. DBIDS Sponsoring Activities. A Navy activity sponsoring a vendor company for registration in DBIDS must be designated and approved as a Sponsoring Activity (SA) by the Approved Facility Contact (AFC) , normally the VCC Supervisor. See paragraph 0306 of this manual for specific procedures.

b. CAC Trusted Agents. A Navy activity that desires to sponsor a contractor employee seeking the issuance of a CAC must accomplish the application through an Active Duty military or Civil Service employee Trusted Agent (TA). TAs are approved and designated by the Trusted Agent Security Manager (TASM) under the applicable procedures of the Contractor Verification System (CVS). See reference (p) for specific procedures and CAC eligibility.

3-2

c. Privilege of Sponsorship. Contractor and vendor sponsorship by SAs, SSCs and TAs is a privilege, not a right, and the Navy reserves the discretion to remove sponsorship at any time when in the best interests of the Government.

d. Sponsor or sponsoring organization will:

(1) Prepare registration forms for access credential applicants.

(2) Escort prospective contractor employees from the ECP to the appropriate office to initiate identity proofing and vetting for credential issuance.

(3) Ensure contracts contain requirements for contractor personnel to return local access credentials to the issuing office when the contract is completed, or when a contractor employee no longer requires access to the installation.

(4) Ensure issued access credentials are retrieved and returned to the issuing office when the relationship that served as justification changes, or is terminated.

e. Registration. Companies may direct their employees to register into DBIDS.

(1) Employee Registration and Credentialing. The vendor/contractor company must provide the DBIDS Registrar with an approved employee list. The data required either before or during registration in DBIDS may include, but is not limited to:

(a) Name

(b) Social security number

(c) Company/employer information

(d) Company address

(e) Company phone number(s)

(f) Contract number(s)

(g) Contract date(s) of performance

(h) Company-issued employee identification number

(i) Individual digital photo

(j) Date of birth

(k) Fingerprints

3-3

(l) Employee home address

(m) Employee personal phone numbers

(2) Applicants voluntarily provide personal information with full knowledge regarding the types of information collected, understanding the purpose of collection, how the information may be shared and how the information will be protected. The applicant understands the lack of successful identity proofing may result in denial of access to the installation.

(3) Biometrics. To biometrically authenticate enrollment into the system, the credential will be scanned and the fingerprint biometric captured utilizing the fingerprint reader on the handheld device provided with the system.

(4) Once the vendor/contractor employee's identity has been validated and enrollment into the system biometrically authenticated, the credential is issued.

0303. Granting Escorted Access

a. Individuals unable to meet the requirements of paragraphs 0202 or 0203 may be granted escorted access to the installation, per installation-level policies.

b. Escorts must be provided by the organization or individual responsible for sponsoring, or otherwise associated with the individual’s visit, and must remain within reasonable visual contact of the individual(s) they are escorting.

c. Escorts must report any conduct by the escorted individual that causes a risk to the safety, security or efficiency of the installation or its occupants per installation procedure. Failure to comply with escort duties may result in the temporary or permanent loss of escort privileges.

d. Escorts functioning in their personal capacity or neglectfully functioning in their official capacity may be personally accountable for the conduct of the individual(s) they are escorting per installation security policies.

e. Escorts must be U.S. citizens, have a DoD affiliation, and themselves be granted unescorted access per this manual.

f. Installation-level policies will determine the number of people an individual may escort and may require specific training or additional qualifications to serve as an escort.

0304. Granting Trusted Traveler Access

a. Trusted traveler programs may not be established at non-ePACS-enabled CNIC installations, with the sole exception of U.S. uniformed military personnel entering the installation in formation. Procedures for trusted traveler access for uniformed U.S. military personnel in formation will be established by the installation CO.

3-4

b. A trusted traveler program may be established by installation COs with or without IMESA functionality, per Navy policies.

(1) The authorized individual must have sufficient knowledge of the co-travelers to legitimately vouch for their identity, fitness and purpose. Individuals may be personally accountable for the conduct of those co-travelers per installation security policies. Installation level policies may require the authorized individual to accompany the co-traveler until he or she departs the installation.

(2) Co-travelers, except uniformed U.S. military personnel entering the installation in formation, may be required to establish their identity by presenting an acceptable credential, per installation level policies.

(3) The installation CO will determine the number of co-travelers that an authorized individual may vouch for at any time.

(4) Installation level policies will determine the specific populations of individuals authorized to vouch for co-travelers under the trusted traveler program, except that individuals without both U.S. citizenship and a DoD affiliation are not permitted to do so.

(5) At least one individual must satisfy the requirements outlined in paragraphs 0202, 0203, and 0204 and be granted unescorted access to be permitted to vouch for co-travelers.

(6) Except as provided for in this manual, procedures for trusted traveler programs are established and implemented locally and may vary from installation to installation.

(7) Trusted traveler programs are permitted only at FPCON NORMAL, ALPHA, and BRAVO, and may be further restricted by the CO.

(8) Trusted traveler programs must be suspended in the event of an ePACS failure except:

(a) For uniformed military personnel returning in formation.

(b) For the period of time that a suspension would cause a bona fide traffic safety risk, as determined by the installation CO, on a road not owned or managed by DoD.

(9) Per installation level policies, when an installation’s trusted traveler program is suspended due to an ePACS failure, co-travelers may be:

(a) Granted unescorted access per paragraph 0305 by presenting an acceptable credential listed in paragraph 0401.a through 0401.c to establish identity, fitness, and purpose;

3-5

(b) Granted escorted access per paragraph 0303 by presenting any acceptable credential; or

(c) Processed through (VCP) as a visitor per paragraph 0306.

0305. Granting Unescorted Access. Installation COs may grant unescorted access only to individuals who satisfy the unescorted access requirements outlined in chapter 2. In addition, with respect to such individuals, installation COs may:

a. Grant recurring unescorted access:

(1) To ePACS-enabled CNIC installations with IMESA functionality for only those individuals who are currently enrolled in both IMESA and the local installation ePACS.

(2) To ePACS-enabled CNIC installations without IMESA functionality for only those individuals who are currently enrolled in the local installation ePACS.

(3) To non-ePACS-enabled CNIC installations for only those individuals presenting a DoD CAC; DoD Uniformed Services Identification card (USID); or Non-CAC Local or Regional DoD Credential (LRC) valid for that particular installation.

b. May grant short-term (seven days or less) unescorted access to only those individuals who meet the requirements outlined in chapter 2 but do not meet the requirements for recurring unescorted access as described in paragraph 0305.a if such individuals successfully complete the VCP as described in paragraph 0306 of this manual.

c. Process individuals who meet the requirements for recurring unescorted access as described in paragraph 0305.a through the access control process at the ECP, per paragraph 0308 of this manual.

d. Process individuals who do not meet the requirements for recurring unescorted access as described in paragraph 0305.a through:

(1) Automatic enrollment per paragraph 0309, if eligible; or

(2) The VCP at the VCC per paragraph 0306 of this manual.

e. May conduct the VCP at the ECP rather than the VCC as long as doing so does not adversely impact the throughput of the ECP or the safety of ECP personnel. The VCP at the ECP must be the functional equivalent to the VCP at the VCC.

0306. Visitor Control Process (VCP)

a. Visitors. Visitors are defined based on the type of installation.

3-6

(1) At ePACS-enabled CNIC installations with IMESA functionality, a visitor is any individual:

(a) Who is not enrolled in IMESA and the local installation ePACS; or

(b) Whose enrollment in IMESA or the local installation ePACS has expired.

(2) At ePACS-enabled installations without IMESA functionality, a visitor is any individual:

(a) Who is not enrolled in the local ePACS; or

(b) Whose enrollment in the local ePACS has expired.

(3) At non-ePACS-enabled CNIC installations, a visitor is any individual who does not hold a CAC, USID, or non-CAC LRC issued by the local installation or region.

b. VCP Procedures. Installation COs will establish VCP procedures.

(1) Such VCP procedures must satisfy all the requirements outlined in Chapter 2 by:

(a) Establishing identity, using either an acceptable credential or an acceptable combination of source identity documents as described in Chapter 4.

(b) Establishing historic fitness, either by performing an on-the-spot review or by proving that historic fitness was previously established as described in paragraph 0203.a(1).

(c) Establishing current fitness.

(d) Establishing an acceptable purpose for presence on the installation, either by means of the credential the individual uses to establish their identity simultaneously establishing an acceptable purpose or by any other means described in paragraph 0204.

(2) During the VCP, the procedures will require that:

(a) All acceptable credentials and source identity documents will be visually inspected front and back for signs of alteration or counterfeit, and verified as described in paragraph 0403.

(b) Acceptable credentials and source identity documents that appear questionable (e.g., damaged laminates, evidence of tampering) or altered will not be accepted.

(3) The procedures will require that, upon successful completion of the VCP:

3-7

(a) Visitors with an enrollable acceptable credential at an ePACS-enabled DoD installation, with or without IMESA functionality, will be enrolled per paragraph 0307 of this manual.

(b) All other visitors will be issued a…