TE 1.2-IT Eligibility RequirementsL for DSS Access.docx

SP3300-10-R-0020

IT Eligibly Requirements for DSS Access T.E 1.2

Alternative to NACI

Alternative to NACI

NACLC

NACLC

Information Technology (IT) Eligibility Categories: with Definitions

Level III: (Non-Privileged Access) All other positions involved in computer activities not covered in IT I and IT II. In establishing the categories of positions, other factors may enter into the determination, permitting placement in higher or lower categories based on the Agency’s judgment as to the unique characteristics of the system or the safeguards protecting the system.

Level II: (Limited Privileged Access) Those positions in which the incumbent is responsible for the direction, planning, design, operation, or maintenance of a computer system and whose work is technically reviewed by a higher authority of the IT I category to ensure integrity of the system.

Level I: (Privileged Access) Those positions in which the incumbent is responsible for planning, direction, and implementation of a computer security program; major responsibility for the direction, planning, and design of a computer system including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. (NOTE: Level I responsibilities will reside within the IA office of the J6N agency)

Three categories have been established for designating computer and computer-related positions -- ADP-I, ADP-II, and ADP-III. Specific criteria for assigning positions to one of these categories are as follows:

Category Criteria

ADP-I

· Responsibility or the development and administration of Agency computer security programs, and also including direction and control of risk analysis and/or threat assessment.

· Significant involvement in life-critical or mission-critical systems.

· Responsibility for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

· Relatively high risk assignments associated with or directly involving the accounting, disbursement, or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by higher authority in the ADP-I category to insure the integrity of the system.

· Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

· Other positions as designated by the Agency head that involve relatively high risk for effecting grave damage or realizing significant personal gain.

ADP-II

· Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the ADP-I category, includes, but is not limited to:

(1) access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts;

(2) accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than $10 million per year. Other positions are designated by the Agency head that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in ADP-I positions.

ADP-III

· All other positions involved in Federal computer activities.

(Note: IT terminology - Applicable to unclassified DoD information systems, a designator that indicates the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions. Position categories include: IT-I (Privileged), IT-II (Limited Privileged) and IT-III (Non-Privileged), as defined in DoD 5200.2-R (reference (r ) ). Investigative requirements for each category vary, depending on role and whether the incumbent is a U.S. military member, U.S. civilian government employee, U.S. civilian contractor, or a foreign national. The term IT Position is synonymous with the older term Automated Data Processing (ADP) Position (reference (a)). E2.1.36 IT Position Category DODI 8500.2 February 6, 2003)

NACI - National Agency Check Plus Written Inquiries. A personnel security investigation conducted by the Office of Personnel Management, combining a NAC and written inquiries to law enforcement agencies, former employers and supervisors, references and schools.

NACLC - National Agency Check with Law and Credit Check. Basic National Agency Checks (Security/Suitability Investigations Index, Defense Clearance and Investigations Index, fingerprint classification, and a search of the Federal Bureau of Investigation’s investigative index); Credit search covering all residence, employment, and education locations during the last 7 years and Law Checks covering all locations of residence, employment, and education during the last 5 years and to all locations of admitted arrest. If 35-day service is requested, all law checks will be scheduled by Record Search. If 75-day service is requested, law checks will be scheduled by a combination of inquiry and record coverage. (See Service Availability below for additional information about law checks).

TE 1.2