RFP_Attachment_F_-_Background_Investigation_Process.pdf

QMAC-CY-140001-N

Attachment F – Background Investigation Process – Page 1

ATTACHMENT F – BACKGROUND INVESTIGATION PROCESS FOR TMIS 2.0 CONTRACTOR AND

SUBCONTRACTORS

The Background Investigation process shall be followed for all contractors and subcontractors within the accreditation boundary. The process for all of the contractors and subcontractors outside of the accreditation must either comply with the process as described within this document or a contractor defined and PMO approved commercially equivalent background investigation process. Regardless of which process is selected, all of the job descriptions listed within this document must adhere to a background investigation process.

Step One: Submit the following items to General Services Administration, E-Gov Travel, GSA e-GOV Travel PMO Security Office Attn: ISSO 1800 F. Street NW 3rd Floor, Mail Hub 3400 Washington, DC 20405

Contractor Worksheet (complete sections I, II, III and V. Do not complete other sections).

FD 258 (Applicant) , Fingerprint (2) Cards

Step Two: This PMO office will review and forward the security package to DHS/FPS for further processing.

Step Three: DHS/FPS will initiate the subject in e-QIP and contact the subject via e-mail with instructions to complete the security questionnaire (SF 85 or SF 85P) in the Office of Personnel Management (OPM) automated Electronic Questionnaire for Investigation Processing (e-QIP).

The subject will have seven (7) work days to log onto the OPM portal to complete the process.

The TMIS 2.0 contractor should instruct the subject to save all work in case they have to exit and return prior to completing the questionnaire.

If a question is not applicable, use N/A. The website address is http://www.opm.gov/e-qip.

Step Four: Requests for Extensions: Email DHS/FPS with the reason and how many additional days are needed. Include the TMIS 2.0 ISSO at the FAS Travel PMO office as an information addressee.

Step Five: When the Applicant completes the e-QIP form, he/she should remember to print out all signature pages (CER, REL, MEL) prior to electronically releasing the e-QIP form to DHS/FPS.

Certification Page (CER): Certification that the application is complete.

General Release (REL): Authorization for Release of Information.

Authorization for Release of Medical (MEL) Information: If required.

Step Six: Release the security questionnaire electronically to DHS/FPS. The Applicant should coordinate with the contractor/sponsor to have original signed hard copy documents delivered to:

General Services Administration, E-Gov Travel, Attachment F – Background Investigation Process – Page 2

GSA e-GOV Travel PMO Security Office Attn: ISSO 1800 F. Street NW 3rd Floor, Mail Hub 3400 Washington, DC 20405

Overview of Clearances for Role Types

Ultimately, appropriate Background Investigation level will be determined based upon role of Contractor’s employee package submitted for Government review. The list below should be considered general guidelines only.

MBI

o Personnel with administrative access to the TMIS 2.0 solution o Personnel with access to TMIS 2.0 reporting tools

NACIC

o Personnel with non-administrative access to the TMIS 2.0 solution

MBI

System Administrators ((Network, Database, Backup, Computer Operations)(Specialist, Engineer, Administrator, Tech Support, Operator) o Anyone with Administrator access to any system component that stores, transmits, or processes the information in quantity.

o System Engineer Responsible for effective provisioning, installation/configuration, operation, and maintenance of systems hardware and software. Also responsible for repair and recovery from system failure.

o Network Engineer Responsible for effective provisioning, installation/configuration, operation, and maintenance of network hardware and software. Also responsible for repair and recovery from network failure.

o Database Administrator Responsible for installation/configuration, operation and maintenance of database and related hardware and software. Also responsible for repair and recovery from database failure (such as corruption of database).

Customer Support Level 2 o Ability to reset passwords for users or search database without entering specific user or specific transaction o Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Includes password reset of user accounts and may include other account management.

System Developers (Database Designers, System Architects, Application Developers) o Anyone with responsibility or direct input into the design or functionality of the

Information System o System Architect

Responsible for design of system including provisioning resources.

Includes intimate knowledge of system and designing capabilities to meet requirements.

Attachment F – Background Investigation Process – Page 3 o Database Designers Responsible for designing the databases including developing database relationships and backup strategy.

o Application Developers

Responsible for programming application including interfaces, connections to databases, etc.

Security Administrators (Firewall or IDS Admins, System Log review, oversight) o Anyone with access to security components of the Information System such as firewalls, IDS, system logs or responsibility to provide direct oversight of the security of the information system and/or change management process.

o Information System Security Officer/Security Manager Oversees security functionality, performs incident response, ensures compliance and coordinates with TMIS 2.0 ISSO and FAS Travel PMO for scans, POA&Ms, Assessments, Change Management, Incidents and other security requirements.

o Firewall Administrator Responsible for developing rule-base for boundary firewall and firewalls used between layers within the information system. Also responsible for reviewing firewall logs to find and resolve issues, ensure protection and identify incidents.

o IDS Administrator Responsible for developing rule-base for Intrusion Detection Systems throughout information system infrastructure. Also responsible for reviewing logs to find and resolve issues, ensure protection and identify incidents.

o Security Engineer Responsible for ensuring compliance with regulations and hardening guides, reviewing system logs to identify and resolve issues, ensure proper functioning of system and identify issues.

Back-office Sales o Direct access to the database interface. No direct access to the database file.

Ability to search and aggregate data based on travel information, organization, etc.

o Reviews transactions and determines trends to identify opportunities to improve costs or sales.

Reporting

Ability to search and aggregate data based on travel information, organization, etc.

o Produces reports for related positions and for customer agencies.

Business/Financial Analyst:

Ability to search and aggregate data based on travel information, organization, etc.

Attachment F – Background Investigation Process – Page 4 o Process and report accounting transactions including receivables, payables, billing, collection and financial reports.

Account Manager o Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction.

Integration Consultant o Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction. Advises systems/network administrators on requirements for connections to travel data sources. Has information on government travel data sources.

o Provides leadership and guidance on connecting TMIS 2.0 to government travel data sources for agency implementation of TMIS 2.0.

NACIC

Customer Support Level 1 o Direct access to the database interface. No direct access to the database file.

Does not have the ability to search the database without entering specific user or specific transaction.

o Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Does not include password reset of user accounts or other account management.

Project/Program Manager

Does not have the ability to search the database without entering specific user or specific transaction. No direct access to the system administration. If access is required to functionality included in LBI positions, must receive an LBI prior to that access.

o Provides oversight of personnel (including administrators). Provides leadership and allocates resources based on requirements.

Job Descriptions: This listing is provided for ease of use in identifying an appropriate job title to use.

Account Manager - Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction.

Application Developers - Responsible for programming application including interfaces, connections to databases, etc.

Attachment F – Background Investigation Process – Page 5

Back-office Sales - Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc. Reviews transactions and determines trends to identify opportunities to improve costs or sales.

Business/Financial Analyst: - Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc. Process and report accounting transactions including receivables, payables, billing, collection and financial reports.

Database Administrator - Responsible for installation/configuration, operation and maintenance of database and related hardware and software. Also responsible for repair and recovery from database failure (such as corruption of database).

Database Designers - Responsible for designing the databases including developing database relationships and backup strategy.

Firewall Administrator - Responsible for developing the rule base for boundary firewall and firewalls used between layers within the information system. Also responsible for reviewing firewall logs to find and resolve issues, assure protection and identify incidents.

Customer Support Level 1 - Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Does not include password reset of user accounts or other account management.

Customer Support Level 2 - Ability to reset passwords for users or search database without entering specific user or specific transaction. Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Includes password reset of user accounts and may include other account management.

IDS Administrator - Responsible for developing the rule base for Intrusion Detection

Systems throughout information system infrastructure. Also responsible for reviewing logs to find and resolve issues. Assure protection and identify incidents.

Information System Security Officer (ISSO)/Security Manager - Oversees security functionality, performs incident response, Assures compliance and coordinates with TMIS 2.0 PMO ISSO for scans, POA&Ms, Assessments, Change Management, Incidents and other security requirements.

Integration Consultant - Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction. Advises systems/network administrators on requirements for

Attachment F – Background Investigation Process – Page 6 connections to data sources. Has information on government travel data systems.

Provides leadership and guidance on connecting TMIS 2.0 to travel data sources for government implementation of TMIS 2.0.

Network Engineer - Responsible for effective provisioning, installation/configuration, operation, and maintenance of network hardware and software. Also responsible for repair and recovery from network failure.

Security Administrators (Firewall or IDS Admins, System Log review, oversight) - Anyone with access to security components of the Information System such as firewalls, IDS, system logs or responsibility to provide direct oversight of the security of the information system and/or change management process.

Security Engineer - Responsible for ensuring compliance with regulations and hardening guides, reviewing system logs to identify and resolve issues, Assure proper functioning of system and identify issues.

System Administrators ((Network, Database, Backup, Computer Operations)(Specialist, Engineer, Administrator, Tech Support, Operator) Anyone with Administrator access to any system component that stores, transmits or processes the information in quantity.

System Architect - Responsible for design of system including provisioning resources.

Includes intimate knowledge of system and designing capabilities to meet requirements.

System Developers (Database Designers, System Architects, Application Developers) -

Anyone with responsibility or direct input into the design or functionality of the Information System

System Engineer - Responsible for effective provisioning, installation/configuration, operation, and maintenance of systems hardware and software. Also responsible for repair and recovery from system failure.

Reporting - Direct access to the database interface. No direct access to the database file.

Ability to search and aggregate data based on travel information, organization, etc.

Produces reports for related positions and for customer agencies.

Project/Program Manager - Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. No direct access to the system administration. If access is required to functionality included in LBI positions, must receive an LBI prior to that access. Provides oversight of personnel (including administrators). Provides leadership and allocates resources based on requirements.

Attachment F – Background Investigation Process – Page 7

NOTES To TMIS 2.0 Contractors Subject To HSPD12:

You can designate that the package be sent to you first if you like in order to assure that the appropriate fields are completed appropriately. Just assure that you turn these around in a timely manner as the time required for notification by the DHS/FPS is dependent on their receipt of the background investigation package.

All appointments in the Federal service require the incumbent to be investigated. Investigations should be initiated within 14 calendar days of placement in a position or the date a designation is elevated. If at any time, it is determined that a required investigation has never been conducted for the initial subject, the appropriate required investigation must be conducted, even if there have been subsequent personnel actions that would not be subject to investigation (such as transfers, promotions, or reassignments). A new investigation is required if there has been a break in service of greater than two (2) years.

Everything starts with the Position Description (PD). The type investigation required is determined by information reflected on the PD. The position "sensitivity designation" (Special, Critical, or Noncritical Sensitive) and the "public trust designation" (High, Low, or Moderate Risk) combines to determine the "level of access" and/or "risk level" required. Generally, a change that increases the sensitivity/risk level of a position requires a higher level investigation.

Employees moving to a new position at a higher sensitivity/risk level than the sensitivity/risk level of the position they left must meet the investigative requirements of the sensitivity/risk level designation of the new position. Any required higher level investigation must be initiated within 14 working days of the date the new position is occupied.