Section C Final - Attachment 4.docx

GSA SOLICITATION QMAD-JM-100001-N

August 23, 2010

GSA SOLICITATION QMAD-JM-100001-N

Attachment 4 – Background Investigation (BI) Process for ETS Contractors and their Subcontractors August 23, 2010

Attachment 4 BACKGROUND INVESTIGATION (BI) PROCESS FOR ETS CONTRACTORS and THEIR SUBCONTRACTORS Step One: Submit the following items to General Services Administration, E-Gov Travel, Attn: ISSO E-Gov Travel, Crystal Plaza 4, Suite 300, 2200 Crystal Drive, Arlington, VA 22202.

· Contractor Worksheet (complete sections I, II, III and V. Do not complete other sections).

· FD 258 (Applicant) , Fingerprint (2) Cards

Step Two: This PMO office will review and forward the security package to DHS/FPS for further processing.

Step Three: DHS/FPS will initiate the subject in e-QIP and contact the subject via e-mail with instructions to complete the security questionnaire (SF 85 or SF 85P) in the Office of Personnel Management (OPM) automated Electronic Questionnaire for Investigation Processing (e-QIP). The subject will have seven (7) work days to log onto the OPM portal to complete the process. The ETS contractor should instruct the subject to save all work in case they have to exit and return prior to completing the questionnaire.

If a question is not applicable, use N/A. The website address is http://www.opm.gov/e-qip.

Step Four: Requests for Extensions: Email DHS/FPS with the reason and how many additional days are needed. Include the ETS ISSO at the PMO office as an information addressee.

Step Five: When the Applicant completes the e-QIP form, he/she should remember to print out all signature pages (CER, REL, MEL) prior to electronically releasing the e-QIP form to DHS/FPS.

· Certification Page (CER): Certification that the application is complete.

· General Release (REL): Authorization for Release of Information.

· Authorization for Release of Medical (MEL) Information: If required.

Step Six: Release the security questionnaire electronically to DHS/FPS. The Applicant should coordinate with the contractor/sponsor to have original signed hard copy documents delivered to: GSA E-Gov Travel PMO; ISSO; 2200 Crystal Drive Suite 300; Arlington, VA 22202

HSPD-12 Background Investigations; The following are the job descriptions and level of BI that needs to be requested for an individual. Where there is a choice of BI levels (e.g. MBI/LBI) the ETS Contractor will need to determine which level they want the individual submitted for investigation. If you have any questions, please contact the ETS PMO.

HSPD-12 Clearance required for:

· MBI preferred, LBI acceptable

· Personnel with administrative access to the TAV or OBE system

· Travel MIS Reporting System personnel

· Embedded or Accommodated TMC personnel with the ability to aggregate user data or perform data mining (This would include personnel who perform back office sales, reporting groups, etc.)

· NACIC

· Embedded or Accommodated TMC personnel with the ability to view user data

· TAV or OBE personnel with non-administrative access to the system

MBI preferred, LBI acceptable

· System Administrators ((Network, Database, Backup, Computer Operations)(Specialist, Engineer, Administrator, Tech Support, Operator)

· Anyone with Administrator access to any system component that stores, transmits or processes the information in quantity.

· System Engineer

· Responsible for effective provisioning, installation/configuration, operation, and maintenance of systems hardware and software. Also responsible for repair and recovery from system failure.

· Network Engineer

· Responsible for effective provisioning, installation/configuration, operation, and maintenance of network hardware and software. Also responsible for repair and recovery from network failure.

· Database Administrator

· Responsible for installation/configuration, operation and maintenance of database and related hardware and software. Also responsible for repair and recovery from database failure (such as corruption of database).

· Helpdesk Level 2

· Ability to reset passwords for users or search database without entering specific user or specific transaction

· Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Includes password reset of user accounts and may include other account management.

· System Developers (Database Designers, System Architects, Application Developers)

· Anyone with responsibility or direct input into the design or functionality of the Information System

· System Architect

· Responsible for design of system including provisioning resources. Includes intimate knowledge of system and designing capabilities to meet requirements.

· Database Designers

· Responsible for designing the databases including developing database relationships and backup strategy.

· Application Developers

· Responsible for programming application including interfaces, connections to databases, etc.

· Security Administrators (Firewall or IDS Admins, System Log review, oversight)

· Anyone with access to security components of the Information System such as firewalls, IDS, system logs or responsibility to provide direct oversight of the security of the information system and/or change management process.

· Information System Security Officer/Security Manager

· Oversees security functionality, performs incident response, ensures compliance and coordinates with ETS2 PMO ISSO for scans, POA&Ms, Assessments, Change Management, Incidents and other security requirements.

· Firewall Administrator

· Responsible for developing rule-base for boundary firewall and firewalls used between layers within the information system. Also responsible for reviewing firewall logs to find and resolve issues, ensure protection and identify incidents.

· IDS Administrator

· Responsible for developing rule-base for Intrusion Detection Systems throughout information system infrastructure. Also responsible for reviewing logs to find and resolve issues, ensure protection and identify incidents.

· Security Engineer

· Responsible for ensuring compliance with regulations and hardening guides, reviewing system logs to identify and resolve issues, ensure proper functioning of system and identify issues.

· Mid-Office Quality Control

· Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc.

· Reviews transactions at the TMC to ensure compliance with standards and TMC business practices.

· Back-office Sales

· Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc.

· Reviews transactions and determines trends to identify opportunities to improve costs or sales.

· Reporting

· Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc.

· Produces reports for related positions and for customer agencies.

· Business/Financial Analyst:

· Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc.

· Process and report accounting transactions including receivables, payables, billing, collection and financial reports.

· Account Manager

· Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction.

· Identifies customer requirements and plans and manages resolutions. Communicates with customer agencies and researches issues.

· Implementation Manager

· Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction.

· Identifies customer requirements and plans and manages resolutions. Communicates with customer agencies and identifies potential issues and solutions.

· Integration Consultant

· Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction. Advises systems/network administrators on requirements for connections to agency financial systems. Has information on agency financial systems.

· Provides leadership and guidance on connecting ETS to agency financial system for agency implementation of ETS.

NACIC

· Helpdesk 1

· Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction.

· Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Does not include password reset of user accounts or other account management.

· Project/Program Manager

· Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. No direct access to the system administration. If access is required to functionality included in LBI positions, must receive an LBI prior to that access.

· Provides oversight of personnel (including administrators). Provides leadership and allocates resources based on requirements.

· Travel agents

· Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction

· Plan and sell transportation and accommodations for agency customers. Determine destination, modes of transportation, travel dates, costs, and accommodations required.

· Fulfillment

· Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction

· Ensure that transactions meet all requirements and ensure booking of tickets, reservations, etc.

Job Descriptions: This listing is provided for ease of use in identifying an appropriate job title to use.

· Account Manager - Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction. Identifies customer requirements and plans and manages resolutions. Communicates with customer agencies and researches issues.

· Application Developers - Responsible for programming application including interfaces, connections to databases, etc.

· Back-office Sales - Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc. Reviews transactions and determines trends to identify opportunities to improve costs or sales.

· Business/Financial Analyst: - Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc. Process and report accounting transactions including receivables, payables, billing, collection and financial reports.

· Database Administrator - Responsible for installation/configuration, operation and maintenance of database and related hardware and software. Also responsible for repair and recovery from database failure (such as corruption of database).

· Database Designers - Responsible for designing the databases including developing database relationships and backup strategy.

· Firewall Administrator - Responsible for developing the rule base for boundary firewall and firewalls used between layers within the information system. Also responsible for reviewing firewall logs to find and resolve issues, assure protection and identify incidents.

· Fulfillment - Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. Assures that transactions meet all requirements and Assure booking of tickets, reservations, etc.

· Helpdesk 1 - Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Does not include password reset of user accounts or other account management.

· Helpdesk Level 2 - Ability to reset passwords for users or search database without entering specific user or specific transaction. Responsible for working with agency customers and assisting with identifying and resolving issues between users and interface. Includes password reset of user accounts and may include other account management.

· IDS Administrator - Responsible for developing the rule base for Intrusion Detection Systems throughout information system infrastructure. Also responsible for reviewing logs to find and resolve issues. Assure protection and identify incidents.

· Implementation Manager - Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction. Identifies customer requirements and plans and manages resolutions. Communicates with customer agencies and identifies potential issues and solutions.

· Information System Security Officer (ISSO)/Security Manager - Oversees security functionality, performs incident response, Assures compliance and coordinates with ETS2 PMO ISSO for scans, POA&Ms, Assessments, Change Management, Incidents and other security requirements.

· Integration Consultant - Direct access to the database interface. Overview of the information system. No direct access to the database file or administrative rights to the information system. Does have the ability to search database without entering specific user or specific transaction. Advises systems/network administrators on requirements for connections to agency financial systems. Has information on agency financial systems. Provides leadership and guidance on connecting ETS to agency financial system for agency implementation of ETS.

· Mid-Office Quality Control - Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc. Reviews transactions at the TMC to assure compliance with standards and TMC business practices.

· Network Engineer - Responsible for effective provisioning, installation/configuration, operation, and maintenance of network hardware and software. Also responsible for repair and recovery from network failure.

· Security Administrators (Firewall or IDS Admins, System Log review, oversight) - Anyone with access to security components of the Information System such as firewalls, IDS, system logs or responsibility to provide direct oversight of the security of the information system and/or change management process.

· Security Engineer - Responsible for ensuring compliance with regulations and hardening guides, reviewing system logs to identify and resolve issues, Assure proper functioning of system and identify issues.

· System Administrators ((Network, Database, Backup, Computer Operations)(Specialist, Engineer, Administrator, Tech Support, Operator) Anyone with Administrator access to any system component that stores, transmits or processes the information in quantity.

· System Architect - Responsible for design of system including provisioning resources. Includes intimate knowledge of system and designing capabilities to meet requirements.

· System Developers (Database Designers, System Architects, Application Developers) - Anyone with responsibility or direct input into the design or functionality of the Information System

· System Engineer - Responsible for effective provisioning, installation/configuration, operation, and maintenance of systems hardware and software. Also responsible for repair and recovery from system failure.

· Reporting - Direct access to the database interface. No direct access to the database file. Ability to search and aggregate data based on travel information, organization, etc. Produces reports for related positions and for customer agencies.

· Project/Program Manager - Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. No direct access to the system administration. If access is required to functionality included in LBI positions, must receive an LBI prior to that access. Provides oversight of personnel (including administrators). Provides leadership and allocates resources based on requirements.

· Travel agents - Direct access to the database interface. No direct access to the database file. Does not have the ability to search the database without entering specific user or specific transaction. Plan and sell transportation and accommodations for agency customers. Determine destination, modes of transportation, travel dates, costs, and accommodations required.

NOTES To ETS Contractors:

You can designate that the package be sent to you first if you like in order to assure that the appropriate fields are completed appropriately. Just assure that you turn these around in a timely manner as the time required for notification by the DHS/FPS is dependent on their receipt of the BI package.

All appointments in the Federal service require the incumbent to be investigated. Investigations should be initiated within 14 calendar days of placement in a position or the date a designation is elevated. If at any time, it is determined that a required investigation has never been conducted for the initial subject, the appropriate required investigation must be conducted, even if there have been subsequent personnel actions that would not be subject to investigation (such as transfers, promotions, or reassignments). A new investigation is required if there has been a break in service of greater than two (2) years.

Everything starts with the Position Description (PD). The type investigation required is determined by information reflected on the PD. The position "sensitivity designation" (Special, Critical, or Noncritical Sensitive) and the "public trust designation" (High, Low, or Moderate Risk) combines to determine the "level of access" and/or "risk level" required. Generally, a change that increases the sensitivity/risk level of a position requires a higher level investigation. Employees moving to a new position at a higher sensitivity/risk level than the sensitivity/risk level of the position they left must meet the investigative requirements of the sensitivity/risk level designation of the new position. Any required higher level investigation must be initiated within 14 working days of the date the new position is occupied.