Attachment_J_-_PIV_Requirements_Draft_for_metadata_TS_.pdf

Goddard Space Flight Center Protective Services Procurement

RFP No. NNG17602670R

ATTACHMENT J

PIV Requirements

July 2017

Attachment J, Page 1 of 4

Attachment J – PIV Requirements

PIV Card Issuance Procedures in accordance with FAR clause 52.204-9, Personal Identity

Verification of Contractor Personnel

FIPS 201 Appendix A graphically displays the following procedure for the issuance of a PIV credential.

Figure A-1, FIPS 201, Appendix A

The following steps describe the procedures for the NASA Personal Identity Verification Card

Issuance (PCI) of a PIV credential:

Step 1:

The Contractor’s Corporate Security Officer (CSO), Program Manager (PM), or Facility Security

Officer (FSO) submits a formal letter that provides a list of contract employees (applicant) names requesting access to the NASA Contracting Officer’s Representative (COR). In the case of a foreign national applicant, approval through the NASA Foreign National Management System (NFNMS) must be obtained for the visit or assignment before any processing for a PIV credential can take place. Further, if the foreign national is not under a contract where a COR has been officially designated, the foreign national will provide the information directly to their visit/assignment host, and the host sponsor will fulfill the duties of the COR mentioned herein. In each case, the letter shall provide notification of the contract or foreign national employee’s (hereafter the “applicant”) full name (first, middle and last), social security number (SSN) or NASA Foreign National

Management System Visitor Number if the foreign national does not have a SSN, and date of birth.

If the contract employee has a current satisfactorily completed National Agency Check with

Inquiries (NACI) or an equivalent or higher degree of background investigation, the letter shall indicate the type of investigation, the agency completing the investigation, and date the investigation

Attachment J, Page 2 of 4 was completed. Also, the letter must specify the risk/sensitivity level associated with the position in which each applicant will be working (NPR 1600.1, §4.5 is germane) Further, the letter shall also acknowledge that contract employees may be denied access to NASA information or information systems based on an unsatisfactory background investigation/adjudication. .

After reviewing the letter for completeness and concurring with the risk/sensitivity levels, the

COR/host must forward the letter to the Center Chief of Security (CCS). The CCS shall review the OPM databases (e.g., DCII, PIP, et al.), and take appropriate steps to validate the applicant’s investigation status. Requirements for a NACI or other investigation shall be initiated only if necessary.

Applicants who do not currently possess the required level of background investigation shall be directed to the e-QIP web site to complete the necessary background investigation forms online.

The CCS shall provide to the COR/host information and instructions on how to access the e-QIP for each contract or foreign national employee requiring access

Step 2:

Upon acceptance of the letter/background information, the applicant will be advised that in order to complete the investigative process, he or she must appear in-person before the authorized PIV registrar and submit two forms of identity source documents in original form. The identity source documents must come from the list of acceptable documents included in Form I-9, Employment Eligibility Verification, one which must be a Federal1 or State issued picture identification. Fingerprints will be taken at this time. The applicant must appear no later than the entry on duty date.

When the applicant appears, the registrar will electronically scan the submitted documents; any document that appears invalid will be rejected by the registrar. The registrar will capture electronically both a facial image and fingerprints of the applicant. The information submitted by the applicant will be used to create or update the applicant identity record in the Identity

Management System (IDMS).

Step 3:

Upon the applicant’s completion of the investigative document, the CCS reviews the information, and resolves discrepancies with the applicant as necessary. When the applicant has appeared in person and completed fingerprints, the package is electronically submitted to initiate the NACI. The CCS includes a request for feedback on the NAC portion of the NACI at the time the request is submitted.

Step 4:

Prior to authorizing physical access of a contractor employee to a federally-controlled facility or access to a Federal information system, the CCS will ensure that a check has been performed with the National Crime Information Center (NCIC) and Interstate Identification Index. In the case of a foreign national, a national check of the Bureau of Immigration and Customs

Enforcement (BICE) database will be performed for each applicant. If this process yields

1 A non-PIV government identification badge, including the NASA Photo Identification Badge, MAY NOT BE

USED for the original issuance of a PIV vetted credential

Attachment J, Page 3 of 4 negative information, the CCS will immediately notify the COR/host of the determination regarding access made by the CCS.

Step 5:

Upon receipt of the completed NAC, the CCS will update IDMS from the NAC portion of the

NACI and indicate the result of the suitability determination. If an unsatisfactory suitability determination is rendered, the COR will advise the contractor that the employee is being denied physical access to all federally-controlled facilities and Federal information systems.

Based on a favorable NAC and NCIC/III or BICE check, the CCS will authorize the issuance of a PIV federal credential in the Physical Access Control System (PACS) database. The CCS, based on information provided by the COR/host, will determine what physical access the applicant should be granted once the PIV issues the credential.

Step 6:

Using the information provided by the applicant during his or her in-person appearance, the PIV card production facility creates and instantiates the approved PIV card for the applicant with an activation date commensurate with the applicant’s start date.

Step 7:

The applicant proceeds to the credential issuance facility to begin processing for receipt of his/her federal credential.

The applicant provides to the credential issuing operator proof of identity with documentation that meets the requirements of FIPS 201 (DHS Employment Eligibility Verification (Form I-9) documents. These documents must be the same documents submitted for registration.

The credential issuing operator will verify that the facial image, and optionally reference finger print, matches the enrollment data used to produce the card. Upon verification of identity, the operator will locate the employee’s record in the PACS database, and modify the record to indicate the PIV card has been issued. The applicant will select a PIN for use with his or her new

PIV card. Although root data is inaccessible to the operator, certain fields (hair color, eye color, et al.) may be modified to more accurately record the employee’s information.

The applicant proceeds to a kiosk or other workstation to complete activation of the PIV card using the initial PIN entered at card issuance.

Attachment J, Page 4 of 4

ALTERNATIVE FOR APPLICANTS WHO DO NOT HAVE A COMPLETED AND

ADJUDICATED NAC AT THE TIME OF ENTRANCE ON DUTY

Steps 1 through 4 shall be accomplished for all applicants in accordance with the process described above. If the applicant is unable to appear in person until the time of entry on duty, or does not, for any other reason, have a completed and adjudicated NAC portion of the NACI at the time of entrance on duty, the following interim procedures shall apply.

1. If the documents required to submit the NACI have not been completed prior to EOD, the applicant will be instructed to complete all remaining requirements for submission of the investigation request. This includes presentation of I-9 documents and completion of fingerprints, if not already accomplished. If the applicant fails to complete these activities as prescribed in NPR 1600.1 (Chapters 3 & 4), it may be considered as failure to meet the conditions required for physical access to a federally-controlled facility or access to a Federal information system, and result in denial of such access.

2. Based on favorable results of the NCIC, the applicant shall be issued a temporary NASA identification card for a period not-to-exceed six months. If at the end of the six month period the NAC results have not been returned, the agency will at that time make a determination if an additional extension will be granted for the temporary identification card.

3. Upon return of the completed NAC, the process will continue from Step 5.