Attachment_13_DLA_SOP_J72.001.pdf

Defense Logistics Agency

STANDARD OPERATING

PROCEDURE

DLA SOP J72.001

Effective August 1, 2014

J7

SUBJECT: Contractor Common Access Card (CAC) Issuance and Accountability Process for DLA Contracts

References:

(a) Defense Logistics Acquisition Directive (DLAD) 4105.01, updated February 12, 2014

(b) Federal Acquisition Regulation (FAR)

(c) DoDM 1000.13, Volume I, DoD Identification Cards: (ID) Card Life-Cycle, January 23,

(d) DLA Instruction 1000.13: Common Access Card (CAC) Issuance Program and the

Trusted Associate Sponsorship System (TASS)

1. PURPOSE: In accordance with the authority cited in reference (a), this SOP assigns responsibilities and provides procedures for the issuance and accountability of contractor CACs when issued in support of a DLA contract.

2. APPLICABILITY: This SOP applies to all DLA Contracting Officers (COs), Contracting Officer’s Representatives (CORs), to include Alternate Contracting Officer’s Representatives (ACORs), and Trusted Agents (TAs). This SOP only covers the process for contractor CACs. As part of the contractor on-boarding process, individuals may be required to submit additional forms and follow other processes described elsewhere.

3. DEFINITIONS: See Glossary.

4. RESPONSIBILITIES: See Enclosure 1.

5. PROCEDURES: See Enclosure 2.

6. INFORMATION REQUIREMENTS:

a. For contracts where a COR has been designated, the Contracting Officer Representative Tracking Tool (CORT Tool) is used to store and maintain the Contractor CAC Log and Contractor CAC Turn-In Receipts throughout the life of the contract.

b. For contracts where a COR has not been designated, EProcurement Records Management is used to store and maintain the Contractor CAC Log and Contractor CAC Turn-In Receipts throughout the life of the contract. Note: Records Management may not yet be available for all contracts. If Records Management is not available, the Contractor CAC Log and Contractor Turn-In Receipts shall be kept as part of the official contract file.

7. INTERNAL CONTROLS:

a. The CAC Justification Form (Figure 1) documents the applicant’s need for a CAC and the sponsor’s acceptance of the responsibilities assigned to them.

b. The electronic Contractor CAC Log (Figure 3) prepared and maintained by the COR (or by the CO, as applicable) and monitored by the CO, tracks contractor CACs from issuance through turn-in for disposal, and provides accountability of all contractor CACs issued under a contract.

c. The Government-Issued Contractor CAC Turn-In Receipt (Figure 4) documents the chain of custody, from the contractor to the COR to the nearest Real-Time Automated Personnel Identification System (RAPIDS) office, for each contractor CAC issued under the contract.

d. Contractors are required to submit a monthly report of all employees who currently possess a CAC. The reports are used to validate the Contractor CAC Log and to assist the CO in determining whether CACs that are no longer needed have been properly turned-in.

e. When requested by the TA, CORs/COs will provide a digitally signed email to reverify a contractor employee’s continuing need for a CAC. Revalidation is to occur every six months, per references (c) and (d).

f. COR/COs will immediately notify the TA and installation security when a contractor employee is unexpectedly terminated to ensure the immediate revocation of the CAC and associated credentials.

8. RELEASEABILITY: RESTRICTED. This SOP is approved for restricted release. It is available to users with CAC authorization on the eWorkplace DLA Audit Readiness Tool Website at: https://eworkplace.dla.mil/sites/S18/Pages/SOP.aspx.

9. EFFECTIVE DATE: This SOP is effective on August 1, 2014, and remains in effect until it is either superseded or cancelled. Thereafter, the SOP will be reviewed annually and either certified as current or revised, whichever is applicable.

MATTHEW R. BEEBE

Director DLA Acquisition

Enclosures

1. Responsibilities

2. Procedures

Attachments A. Contractor Instructions B. COR Designation Language

Figures

1. CAC Justification Form

2. DD Form 1172-2, Application for Identification Card/DEERS Enrollment

3. Contractor CAC Log

4. Government-Issued Contractor CAC Turn-In Receipt

5. Contractor CAC Process Flow

ENCLOSURE 1

RESPONSIBILITIES

1. DLA Acquisition (J7). J7 will:

a. Develop procedures for COs and CORs to follow regarding the management and oversight of CACs issued to contractor employees working under DLA contracts.

This includes procedures related to the issuance, retrieval and revalidation of CACs, as well as standard language to be included in contracts.

b. Coordinate with DLA Installation Support (DS) to ensure that J7 procedures and guidance supports the DLA CAC Program.

c. Maintain and update this SOP, as required.

d. Coordinate with DS to ensure compliance through periodic spot checks and other verification checks as determined by the TASS Service Point of Contact (SPOC).

2. DLA Installation Support (DS). DS will:

a. Inform J7 whenever there are changes to the DoD or DLA CAC Program that may necessitate a change in J7 procedures.

b. In coordination with J7, ensure compliance with procedures through periodic spot checks and other verification checks as determined by the DLA TASS SPOC.

c. Ensure that TAs understand their responsibilities and follow the procedures set forth in this SOP and references (c) and (d).

3. DLA J-codes, Primary Level Field Activities (PLFAs) and other DLA Organizations.

Organizations will:

a. Ensure that the employee meets the requirements of paragraph 4(b) of reference (d) for issuance of a CAC when submitting to the COR/CO and TA that a contractor employee requires a CAC.

b. Ensure CORs fully understand their responsibilities for the management and accountability of contractor CACs and follow the procedures of this SOP.

4. Contracting Officers (COs). CO’s will:

a. Follow this SOP and include a requirement in COR designation letters directing

CORs follow this SOP.

b. Pursue remedies against the contractor in accordance with the terms and conditions of the contract, upon contractor non-compliance.

c. Revalidate a contractor employee’s continuing need for a CAC when requested by the TA (for contracts in which no COR has been designated).

d. Participate in compliance reviews.

5. Contracting Officer’s Representatives (CORs). CORs will:

a. Follow this SOP.

b. Revalidate contractor employee’s continuing need for a CAC when requested by the

TA.

c. Participate in compliance reviews.

6. DLA TASS SPOC. The DLA TASS SPOC will:

a. Maintain a group email address for COR/COs to contact when questions arise about

TASS Site, TASM and TA assignment.

b. When necessary, assist COR/COs in identifying the appropriate DLA TASS Site for a DLA contract.

7. Trusted Agent (TA). The TA will:

a. Follow the procedures of this SOP and perform the responsibilities in reference (d).

b. When notified by the COR/CO that a contractor employee no longer requires a CAC, immediately revoke the contractor’s credentials in TASS.

c. Notify installation security when informed by the COR/CO that a contractor refuses to return their CAC.

ENCLOSURE 2

PROCEDURES

OVERVIEW: Contractor employees performing work under a contract may, in full or in part, require physical access to a Federally-controlled facility or installation and/or access to a Federally-controlled information system. When soliciting the contract, the CO must determine whether the contract performance will require “contractors to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system” (FAR 4.1303). In determining whether the contractor will require routine physical access, the CO, working with the customer and COR, as applicable, must assess whether the contractor employee(s) meet(s) the requirements for a CAC in accordance with paragraph 4(b) of DLAI

1000.13 related to logical and physical access (Note: If only physical access is required, a contractor must require access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six (6) months or more to necessitate issuance of a CAC. DLAI 1000.13 defines “recurring basis” as at least two times per week and/or eight times per month for multiple facilities). If a contractor employee does not meet the requirements for a CAC as stated in reference (d), the COR/CO will work with the local installation security office for issuance of a local credential.

If the contract will require contractor employees to have either physical or logical (i.e. access to information systems) access, the CO inserts FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel, and DLAD 52.204-9000, Contractor Personnel Security Requirements, in the solicitation and subsequent contract. If performance is to occur at a non-DLA site that has physical site and/or information security requirements specific to that location, the CO will work with the customer to include those requirements in the solicitation and subsequent contract, in addition to the CAC requirements of this SOP.

NOTE 1: All email communications covered in this SOP are to be digitally-signed. All emails containing Personally Identifiable Information (PII) are to be encrypted.

NOTE 2: This SOP provides procedures for contracts where a COR has been designated, as well as for contracts where no COR has been designated. In cases where no COR has been designated, COs are responsible for the entire range of COR activities included in this SOP. In some instances, COR/COs may also serve as the Trusted Agent (this is not a requirement).

NOTE 3: Many DLA contracts use Alternate Contracting Officer’s Representatives (ALTCORs) in addition to CORs. As used in this SOP, CORs include ALTCORs and the terms should be considered interchangeable.

NOTE 4: DoD policy does not allow for a contractor employee to possess more than one CAC, even when working simultaneously on multiple contracts. If a contractor employee already possesses a valid CAC related to another DLA or DoD contract, the contractor must notify the COR/CO that the employee already has a CAC. The COR will annotate the contractor employee’s CAC information on the Contractor CAC Log. Contractors must ensure that individuals who fall into this situation are identified in the monthly report.

1. DESCRIPTION:

a. Pre-Award:

(1) The CO, by consulting with the customer, determines whether the contract will require contractor employees to obtain a CAC based on the criteria in references (c) and (d). If the contractor will require a CAC, the CO:

(a) Incorporates in the solicitation and in the subsequent contract, the current versions of FAR clause 52.204-9 and DLAD clause 52.204-9000.

(b) Ensures that the Performance Work Statement (PWS)/Statement of Work (SOW) for the solicitation and the subsequent contract includes the required standardized language (Attachment A) which provides detailed instructions to the contractor regarding issuance, control, and accountability of contractor CACs.

(c) Issues the COR, as applicable, a designation letter, which includes standard language regarding contractor CACs (Attachment B) in the COR responsibilities, and provides electronic copies of the CAC Justification Form (Figure 1), Contractor CAC Log (Figure 3) and the Contractor CAC Turn-In Receipt (Figure 4).

b. Post-Award:

(1) The CO:

(a) Reiterates to the COR his/her responsibilities regarding contractor CACs, as prescribed in the COR designation letter, during the COR Initial Orientation for the contract.

(b) Reiterates to the contractor its responsibilities regarding contractor CACs, as prescribed in the contract, during the Pre-Performance Conference or other pre-performance discussion for the contract.

(2) The COR (or CO if a COR is not designated):

(a) Receives the completed (Sections I and II) and signed DD Form(s) 1172-2, Application for Identification Card/DEERS Enrollment, from the contractor via hand-carry, secure mail, or digitally signed/encrypted email, for each contractor employee working under the contract that requires access to a Federally-controlled facility or installation and/or Federally-controlled information system.

(NOTE: The form(s) may be forwarded individually or as a group from the contractor.)

(b) Uses the Contractor CAC Log for the contract and logs the receipt of each DD Form 1172-2 application.

(c) Completes and signs Section III of the DD Form(s) 1172-2.

(d) Completes and signs the CAC Justification Form (Figure 1).

(e) Forwards the DD Form(s) 1172-2 and the CAC Justification Form to the TA for processing of the CAC application(s). If the TA cannot be identified, the COR sends an email to the DLA TASS SPOC at DLATASSSPOCOffice@dla.mil to indicate that they have a contract that requires assignment to a DLA TA.

(3) The TA:

(a) Receives the completed and signed (Sections I, II, and III) DD Form(s) 1172-2

(Figure 2), Application for Identification Card/DEERS Enrollment and the CAC Justification Form, from the COR.

(b) Sends an encrypted email to DLA Intelligence (DI)/Personnel Security (PERSEC) identifying him/herself as the TA and verifies that contractor has been vetted per references (c) and (d).

(c) Inputs the data from the DD Form(s) 1172-2 application(s) to the TASS and creates a contractor employee account for each application.

(d) Forwards an email to each contractor employee requesting the individual verify his/her account information in TASS. The email contains the web link for TASS and a username and password generated by the system for the contractor employee to use to access TASS.

(e) Approves the verified contractor employee account in TASS. The system then forwards an email to the contractor employee notifying the individual that his/her account has been approved and requesting the contractor employee to obtain a Government-issued CAC from the nearest RAPIDS office. The email provides a link that identifies the locations of RAPIDS offices.

(4) The COR (or CO if a COR was not designated):

(a) Receives written notice via email from the contractor for receipt of each contractor CAC issued. The notice shall identify the contractor employee’s name, the date of issuance, and the date of expiration of the CAC. The notification may be made individually for each contractor employee or together for a group of contractor employees.

(b) Logs the issuance of each contractor CAC in the Contractor CAC Log.

(c) When a COR has been designated, the COR notifies the CO immediately of any issues that arise at any time involving contractor CACs as follows:

a. In person, followed within (1) business day by a written notice via email, or

b. In writing, via email, or

c. By telephone, followed within one (1) business day by a written notice via email.

(d) During the performance of the contract and when requested by the TA, reverifies the contractor employee’s continuing need for a CAC via digitally signed email.

(e) Ensures that the contractor provides a monthly report of all employees working under that contract who still require a CAC and those who do not. For those that no longer require a CAC, ensure that contractor follows/has followed the procedures for turn-in to the COR/CO. This monthly report is a contract deliverable (CDRL), whether priced or not separately priced, and must be received with the monthly invoice.

(f) Notifies the CO of non-compliance if the contractor fails to provide the monthly report.

(g) Maintains the Contractor CAC Log in the CORT Tool or EProcurement Records Management, as applicable.

(h) At any point during the life of the contract, notifies the TA and CO, as applicable, as soon as it is determined that a contractor employee no longer requires a CAC.

(5) The CO:

(a) Routinely monitors for currency and completeness the Contractor CAC Log prepared and maintained by the COR in the CORT Tool.

(b) Takes immediate action if notified by the COR that there is an issue with a contractor CAC based on the nature of the non-compliance and in accordance with the remedies available per the contract (i.e. stop work order, negative CPARS report and/or delay/withholding of payment).

c. Special Circumstances

(1) Contractor Employee Termination/Reassignment (this includes any reason the employee is no longer working for the contractor under the contract):

(a) The COR or CO (if a COR was not designated):

1. Receives notification immediately from the contractor that the employee is no longer working for the contractor under the contract, as follows:

a. In person, followed within (1) business day by a written notice via email, or

c. By telephone, followed within one (1) business day by a written notice via email.

2. Logs receipt of the notification in the Contractor CAC Log. NOTE: If COR has been designated, the COR also notifies the CO immediately of the contractor employee’s termination/reassignment.

3. Immediately notifies the TA that the contract employee has been terminated/reassigned. The TA will revoke the credentials in TASS.

4. Receives a request from the contractor, within one (1) business day after notification, to arrange turn-in of the contractor employee’s CAC.

5. If the COR/CO is co-located or near enough that in-person transfer of CACs can be arranged, the COR/CO:

a. Receives (via hand-carry) all turned-in contractor CACs from the contractor.

b. Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the contractor, and provides the contractor a copy of the receipt.

6. If in-person transfer of CACs cannot be arranged, the COR/CO:

a. Receives notice that contractor CACs have been sent to the COR/CO via certified mail.

b. Receives all turned-in contractor CACs from the contractor.

c. Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt, and provides the contractor a copy of the receipt via email or mail.

7. Within two (2) business days, hand-carries the turned-in contractor CACs to the nearest RAPIDS office for turn-in and disposal.

8. Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the RAPIDS office.

9. Logs receipt and turn-in of the contractor CAC in the Contractor CAC Log.

10. Provides final status of CACs to the TA (and CO as applicable) via digitally signed email.

11. Maintains the completed Government-Issued Contractor CAC Turn-In Receipt in the CORT Tool or EProcurement Records Management, as applicable.

(2) Lost or stolen contractor CAC:

1. Receives immediate notification from the contractor detailing the circumstances regarding the lost or stolen contractor CAC, as follows:

a. In person, followed within one (1) business day by a written notice via

c. By telephone, followed within one (1) business day by a written notice via email.

2. Logs receipt of the notification in the Contractor CAC Log for the lost or stolen CAC. NOTE: If COR has been designated, the COR also notifies the CO immediately of the lost or stolen CAC card.

3. Immediately notifies the TA that contractor CAC has been lost or stolen.

4. Ensures that the contractor reports the lost or stolen CAC card to the local

DLA Police/host installation police, who will provide the contractor a police report. If there is no local DLA Police/host installation police, or no police report is provided, COR (or CO where COR was not designated) prepares a signed memorandum (on organization letterhead) detailing the circumstances of how the CAC was lost or stolen based on information provided by the contractor and any other available information.

5. If the CAC can be reissued within 24 hours, directs the contractor to bring the report/memorandum to the nearest RAPIDS office for CAC reissuance.

6. If the CAC cannot be reissued within 24 hours, the TA will revoke the CAC in

TASS and the contractor, COR/CO, and TA are responsible for completion of the steps in 1.b. (Post-Award) above, as applicable, for issuance and logging of a replacement CAC.

7. When contractor notifies issuance of a new CAC in accordance with 1.b.

(Post-Award) above, logs the issuance of the new contractor CAC in the Contractor CAC Log.

(3) Contractor CAC expiration date is prior to completion of the contract:

1. Receives notice from the contractor that a CAC is expiring and the employee still requires a CAC, as follows:

a. In person, followed within one (1) business day by a written notice via

c. By telephone, followed within one (1) business day by written notice via email.

2. Follows the steps under 1.b. (Post-Award), above, for issuance of a new contractor employee CAC. (NOTE: The contractor shall begin the process for issuance of a new contractor CAC no later than two (2) weeks prior to expiration of the old contractor CAC).

3. When contractor notifies issuance of a new CAC, logs the issuance of the new contractor CAC in the Contractor CAC Log.

d. Contract Completion or Termination:

1. Receives a request from the contractor, within one (1) business day after the contractor collects the contractor CACs at contract completion or termination, to arrange for the turn-in of the contractor CACs for the contract.

2. Notifies the TA that the contract has ended. The TA will revoke the CACs in

TASS.

3. If the COR/CO is co-located or near enough that in-person transfer of CACs can be arranged, the COR/CO:

a. Receives (via hand-carry) all turned-in contractor CACs from the contractor.

b. Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the contractor, and provides the contractor a copy of the receipt.

4. If in-person transfer of CACs cannot be arranged, the COR/CO:

a. Receives notice that contractor CACs have been sent to the COR/CO via certified mail.

b. Receives all turned-in contractor CACs from the contractor.

c. Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt, and provides the contractor a copy of the receipt via email or mail.

5. Within two (2) business days, hand-carries the turned-in contractor CACs to the nearest RAPIDS office for turn-in and disposal.

6. Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the RAPIDS office.

7. Logs the receipt and turn-in of the contractor CACs in the Contractor CAC

Log.

8. Tracks all CACs issued under the contract until all have been received, logged, and turned-in for disposal.

9. Maintains the Contractor CAC Log in the CORT Tool or EProcurement

Records Management, as applicable. COR provides the final log to the CO for inclusion in EProcurement Records Management.

10. Maintains all completed Government-Issued Contractor CAC Turn-In

Receipts in the CORT Tool or EProcurement Records Management, as applicable.

11. Notifies the TA via digitally signed email when all contractor CACs issued under the contract have been received and turned-in.

12. Notifies the TA, CO and installation security if the contractor refuses to turn-in the CAC.

(b) The CO:

1. If the contractor does not return CACs, withholds final payment in accordance with FAR 52.204-9.

2. Uploads a copy of the completed Contractor CAC Log to EProcurement Records Management.

3. INPUTS/OUTPUTS: The following are the data requirements or inputs needed to perform the procedures for issuing and accounting for contractor CACs, and the subsequent end-products or outputs once all steps in the procedures have been performed.

a. Inputs:

(1) Contract clauses in the solicitation/contract regarding contractor personnel security and identity verification.

(2) Standardized language in the solicitation/contract PWS/SOW regarding contractor responsibilities for the issuance, control, and accountability of contractor CACs.

(3) Completed DD Form(s) 1172-2, Application for Identification Card/DEERS

Enrollment.

(4) Completed CAC Justification Form, whereby the sponsor documents the applicant’s need for a CAC and accepts the responsibilities assigned to them.

(5) COR designation letter that includes COR responsibilities regarding contractor CACs, and provides electronic copies of the Contractor CAC Log and the Contractor CAC Turn-In Receipt.

(6) Tracking of contractor CACs from issuance to turn-in for disposal via the Contractor

CAC Log.

(7) Chain of custody acknowledgements for turned-in contractor CACs via the

Government-Issued Contractor CAC Turn-In Receipt.

b. Outputs:

(1) Issuance of contractor CACs for the contract.

(2) Accountability for contractor CACs for the contract from issuance to turn-in and disposal.

(3) Retrieval of contractor CACs once the contract is completed/terminated or contractor employee no longer needs.

GLOSSARY

PART I. ABBREVIATIONS AND ACRONYMS

ALTCOR Alternate Contracting Officer’s Representative

CAC Common Access Card

CO Contracting Officer

COR Contracting Officer’s Representative

CORT Tool Contracting Officer Representative Tracking Tool

DEERS Defense Enrollment Eligibility Reporting System

RAPIDS Real-Time Automated Personnel Identification System

SPOC Service Point of Contact

TA Trusted Agent

TASM Trusted Agent Security Manager

TASS Trusted Associate Sponsorship System

PART II. DEFINITIONS

Unless otherwise noted, these terms and their definitions are for the purposes of this SOP:

Common Access Card. A smart card about the size of a credit card that is the standard identification for U.S. military and Department of Defense (DoD) civilian employees, and eligible contractor personnel.

Contracting Officer Representative Tracking Tool. A Department of Defense (DoD) web management capability for the appointment of CORs. Other capabilities provided by the system include identifying all training completed by the COR by complexity of the work/requirement (Type A/B/C), including basic and refresher training requirements, adding and reviewing documents, such as a Status Report, COR trip report, correspondences and other miscellaneous documents to one or more of the COR appointed contracts, and terminating the COR appointment. The CORT Tool is a secure website available at: https://wawf.eb.mil/.

EProcurement Records Management. A DLA application that serves as the official repository for contractual documents. Takes the place of the traditional hard copy contract file.

Real-Time Automated Personnel Identification System. Applicable software that allows users to issue a DoD identification (ID) card.

Service or Agency Point of Contact. The individual that manages TASS for the service or agency; coordinates with Defense Manpower Data Center; and establishes sites with TASS capability, oversees TASM registration and ensures the maintenance of other required field support.

Trusted Agent. The individual that inputs CAC application data into the Trusted Associate Sponsorship System (TASS) and completes the sponsorship process, including but not limited to, confirmation of completed background vetting.

Trusted Agent Security Manager. The individual that oversees the activity for TASS site TAs that assigned under them.

Trusted Associate Sponsorship System. A catalyst for streamlining the in-processing of contractor personnel by providing a tool to reduce the time it takes to verify, certify and approve contractor information. TASS is a secure website available at: https://www.dmdc.osd.mil/tass/.

ATTACHMENT A

Contractor Instructions

Include the following language in each Performance Work Statement (PWS) or Statement of Work (SOW) where contract employees are required to obtain a CAC:

Common Access Card (CAC) Procedures

Performance under this contract may require the contractor to obtain a Common Access Card (CAC). If CACs are issued under this contract, the contractor shall complete and comply with the following steps to obtain, control, and turn-in Government-issued CACs, as well as establish procedures to control and account for contractor CACs at all times. This process is only for the issuance and accountability of CACs. Contractors may be required to provide additional forms and follow additional procedures for other forms of access and/or background/security checks depending on local site/installation requirements.

1. The contractor has each contractor employee requiring a CAC complete and sign Sections I and II of the DD Form 1172-2. The instructions for completing the DD Form 1172-2 are located at http://www.cac.mil/docs/1172-2-Instructions.pdf.

o For Section II, Block 22 - If the contractor employee signs and the DD Form 1172-2 it is then forwarded by the contractor. This provides verification for the employee information. If the contractor is submitting a DD Form 1172-2 for him/herself (e.g., the owner), with no higher authority above them for verification, then the signature in Block 22 must be notarized to verify identity.

2. The contractor forwards the DD Form(s) 1172-2 via hand-carry, secure mail, or encrypted email to (NOTE: The contractor may forward these forms individually or as a group):

o The Contracting Officer’s Representative (COR) for the contract, if a COR was designated.

o The Contracting Officer (CO) for the contract, if no COR was designated.

3. Each contractor employee must verify his/her account information upon receipt of an email from the Government containing a username and password for the Trusted Associate Sponsorship System (TASS). The web link for TASS is included in the email.

4. Each contractor employee will receive an email via TASS when his/her account has been approved. The email will notify the employee to obtain a Government-issued CAC from the nearest Real-Time Automated Personnel Identification System (RAPIDS) office. The email will also provide a link that identifies the locations of RAPIDS offices.

5. Each contractor employee shall obtain his/her issued CAC from the RAPIDS office.

6. The contractor, within one (1) business day of issuance, provides written notice via email to the COR (or the CO, if no COR was designated) for each contractor CAC issued identifying the contractor employee’s name, the date of issuance, and the date of expiration of the CAC. This notification may be made individually for each contractor employee or together for a group of contractor employees.

7. The contractor establishes procedures to control and account for Government-issued contractor CACs at all times, to include the following:

o Ensure contractor CACs issued for this contract are only used for the purpose of performing under this contract.

o Ensure contractor CACs are secured in a manner that precludes unauthorized use and that recognizes the CAC is the property of the U.S. Government.

o Ensure contractor employees do not abuse or place holes in their CACs.

o Ensure contractor employees do not display their CACs in public.

8. If a contractor CAC is lost or stolen:

o The contractor employee shall immediately notify the contractor that the contractor CAC has been lost or stolen.

o The contractor shall immediately notify the COR (or the CO, if no COR was designated), detailing the circumstances regarding the lost or stolen contractor CAC, as follows:

In person, followed within one (1) business day by a written notice via email, or In writing, via email, or By telephone, followed within one (1) business day by a written notice via email.

o The contractor shall report the lost or stolen CAC card to the local DLA

Police/host installation police, who will provide the contractor a police report. If there is no local DLA Police/host installation police, or no police report is provided, the contractor shall provide information to the COR/CO, as applicable, detailing the circumstances of how the CAC was lost or stolen. The COR/CO will provide a memorandum for the contractor employee to support issuance of new CAC.

o The contractor has the contractor employee bring the report/memorandum to the nearest RAPIDS office. If the CAC can be reissued within 24 hours, bring the report/memorandum to the nearest CAC office for reissue. If the CAC cannot be reissued in 24 hours, follow the steps for a new CAC, beginning at Step 1.

9. If the expiration date for a contractor CAC is prior to completion of the contract and the contractor employee is to continue working under the contract and still requires a CAC, the contractor:

o Notifies the COR as follows:

In person, followed within one (1) business day by a written notice via email, or In writing, via email, or By telephone, followed within one (1) business day by a written notice via email.

o No less than two (2) weeks prior to the current CAC’s expiration date, completes and complies with the steps above beginning with Step 2 for issuance of a new contractor CAC for the employee.

o Brings the expiring CAC to the RAPIDS office for turn-in and receives new CAC.

o Notifies the COR once a new CAC has been issued.

10. The contractor/contractor employee turns in any found CACs immediately, via hand-carry, to the nearest Federal law enforcement office.

11. The contractor immediately collects all contractor CAC(s) from the contractor employee(s) at:

o Contract completion or termination o Termination/Reassignment of an employee (this includes any reason the employee is no longer working for the contractor under the contract or otherwise no longer requires a CAC)

12. The contractor:

o For contract completion or termination – within one (1) business day after collecting the contractor CAC(s), arranges for turn-in via one of the below methods:

i. If the COR/CO is co-located or near enough that in-person transfer of CACs can be arranged, the contractor:

Arranges to meet the COR (or the CO, if no COR was designated) to turn-in the collected contractor CAC(s).

Hand-carries all collected contractor CACs for turn-in to meet the COR (or the CO, if no COR was designated).

Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the COR (or the CO, if no COR was designated). The contractor is provided a copy of the receipt.

ii. If in-person transfer of CAC cannot be arranged, the contractor:

Sends, via certified mail, the CACs to the COR/CO. The contractor includes in the package the Government-Issued Contractor CAC Turn-In Receipt, with signed acknowledgement of contractor turn-in.

Notifies COR/CO that CACs have been sent via certified mail.

Receives a completed copy of the receipt from the COR/CO once the COR/CO has received the CACs.

o For termination/reassignment of an employee:

i. Immediately notifies the COR (or the CO, if no COR was designated) that the employee is no longer working for the contractor under the contract or otherwise no longer requires a CAC, as follows:

In person, followed within one (1) business day by a written notice via email, or In writing, via email, or By telephone, followed within one (1) business day by a written notice via email.

ii. Follows the turn-in procedures above for contract completion or termination, as applicable.

Contractor Reporting Requirements: The contractor is required to submit, on a monthly basis, to the COR (or the CO, if no COR was designated) a report of all employees working on the contract who have been issued CAC cards and a verification of whether each listed employee still requires a CAC. The report must note where changes have occurred (additions or deletions) since the previous month. Contractor employees who already have a CAC related to another DLA or DoD contract must be included in the monthly report. Contractor shall note the issuing organization and the CAC expiration date. Contractor is still responsible for notifying the COR/CO when the individual is no longer working under the subject contract.

The above procedures have been established as a DLA security measure. Contractors are advised that failure to comply with any of the above requirements will be considered a violation of the terms and conditions of the contract and the Contracting Officer may take action to remedy such violations. Specifically, failure to safeguard, follow these procedures, including reporting requirements, or turn-in CACs within the established timeframes may result in the following actions, which are in addition to other actions the Contracting Officer may take under governing law and regulation and the terms and conditions of the contract:

Immediate work stoppage (issuance of a stop work order), not to be lifted until resolution of CAC issue

Disapproval of invoices and delay of payment Withholding of final payment (in accordance with FAR 52.204-9) Documentation of CAC Non-Compliance in the Contractor Performance Assessment

Reporting System (CPARS)

ATTACHMENT B

The following language shall be included in COR Designation Letters for all contracts where contract employees will be issued CACs. COs may include the language as either an attachment to the designation letter or provide a reference to the Standard Operating Procedure (SOP), Contractor Common Access Card (CAC) Issuance and Accountability, located at:

https://eworkplace.dla.mil/sites/S18/Pages/SOP.aspx.

Common Access Card (CAC) Management

The COR is responsible for coordinating the issuance and turn-in and monitoring of contractor Common Access Cards (CACs) by accomplishing the following:

1. Post-Award:

Receives the completed (Sections I and II) and signed DD Form(s) 1172-2, Application for Identification Card/DEERS Enrollment, from the contractor via hand-carry, secure mail, or digitally signed/encrypted email, for each contractor employee working under the contract that requires access to a Federally-controlled facility or installation and/or Federally-controlled information system. (NOTE: The form(s) may be forwarded individually or as a group from the contractor.)

Uses the Contractor CAC Log for the contract and logs the receipt of each DD Form 1172-2 application.

Completes and signs Section III of the DD Form(s) 1172-2.

Completes and signs the CAC Justification Form.

Forwards the DD Form(s) 1172-2 and the CAC Justification Form to the TA for processing of the CAC application(s). If the TA cannot be identified, the COR will send an email to the DLA TASS SPOC at DLATASSSPOCOffice@dla.mil to indicate that they have a contract that requires assignment to a DLA TA.

Receives written notice via email from the contractor for receipt of each contractor CAC issued. The notice shall identify the contractor employee’s name, the date of issuance, and the date of expiration of the CAC. This notification may be made individually for each contractor employee or together for a group of contractor employees.

Logs the issuance of each contractor CAC in the Contractor CAC Log.

Notifies the CO immediately of any issues that arise at any time involving contractor

CACs as follows:

o In person, followed within one (1) business day by a written notice via email, or o In writing, via email, or o By telephone, followed within one (1) business day by a written notice via email.

When requested by the TA, reverifies the contractor employee’s continuing need for a CAC via digitally signed email.

Ensures that the contractor provides a monthly employee report of all employees working under that contract who still require a CAC and those who do not. For those that no longer require a CAC, ensure that contractor follows/has followed the procedures for turn-in.

If the contractor fails to provide the monthly report, notifies the CO of non-compliance.

Maintains the Contractor CAC Log in the CORT Tool.

At any point during the life of the contract, notifies the TA and CO as soon as it is determined that a contractor employee no longer requires a CAC.

2. Contract Completion or Termination:

Receives a request from the contractor, within one (1) business day after the contractor collects the contractor CACs at contract completion or termination, to meet to turn-in the contractor CACs for the contract.

Notifies the TA that the contract has ended. The TA will revoke the CAC in TASS.

Arranges for physical turn-in of CACs:

o If co-located or near enough that in-person transfer of CACs can be arranged:

Receives (via hand-carry) all turned-in contractor CACs from the contractor.

Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt with the contractor, and provides the contractor a copy of the receipt.

o If in-person transfer of CACs cannot be arranged:

Receives (via certified mail) all turned-in contractor CACs from the contractor.

Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt, and provides the contractor a copy of the receipt via email or mail.

Within two (2) business days, hand-carries the turned-in contractor CACs to the nearest RAPIDS office for turn-in and disposal.

Completes and signs the Government-Issued Contractor CAC Turn-in Receipt with the RAPIDS office.

Logs the receipt and turn-in of each contractor CAC in the Contractor CAC Log.

Tracks all CACs issued under the contract until all have been received, logged, and turned-in for disposal.

Maintains the Contractor CAC Log in the CORT Tool and forwards an electronic copy of the completed log to the CO for uploading to EProcurement Records Management.

Maintains all completed Government-Issued Contractor CAC Turn-In Receipts in the

CORT Tool.

Notifies the TA and CO in writing via email when all contractor CACs issued under the contract have been received and turned-in.

If contractor refuses to return CACs, immediately notifies the CO, TA and installation security.

3. Special circumstances:

a. Contractor Employee Termination/Reassignment (this includes any reason the employee is no longer working for the contractor under the contract):

Receives notification immediately from the contractor that the employee is no longer working for the contractor under the contract, as follows:

o In person, followed within one (1) business day by a written notice via email, or o In writing, via email, or o By telephone, followed within one (1) business day by a written notice via email.

Logs receipt of the notification in the Contractor CAC Log.

Notifies the TA and CO immediately of the contractor employee termination/reassignment.

Receives a request from the contractor, within one (1) business day after notification, to meet the COR to arrange for turn-in of the contractor CAC.

Arranges for physical turn-in of CACs:

o If co-located or near enough that in-person transfer of CACs can be arranged:

Receives (via hand-carry) all turned-in contractor CACs from the contractor.

Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt with the contractor, and provides the contractor a copy of the receipt.

o If in-person transfer of CACs cannot be arranged:

Receives (via certified mail) all turned-in contractor CACs from the contractor.

Completes and signs the Government-Issued Contractor CAC Turn-In

Receipt, and provides the contractor a copy of the receipt via email.

Within two (2) business days, hand-carries the turned-in contractor CAC to the nearest

RAPIDS office for turn-in and disposal.

Completes and signs the Government-Issued Contractor CAC Turn-In Receipt with the

RAPIDS office.

Logs receipt and turn-in of the contractor CAC in the Contractor CAC Log.

Provides final status of CACs to the TA and CO via digitally signed email.

Maintains the completed Government-Issued Contractor CAC Turn-In Receipt in the

CORT Tool.

b. Lost or stolen contractor CAC(s):

Receives immediate notification from the contractor detailing the circumstances regarding the lost or stolen contractor CAC, as follows:

o In person, followed within one (1) business day by a written notice via email, or o In writing, via email, or o By telephone, followed within one (1) business day by a written notice via email.

Logs receipt of the notification in the Contractor CAC Log for the lost or stolen CAC.

Immediately notifies the TA and CO of the lost or stolen card.

Ensures that the contractor reports the lost or stolen CAC to the local DLA Police/host installation police, who will provide the contractor a police report. If there is no local DLA Police/host installation police, or no police report is provided, prepare a signed memorandum (on organization letterhead) detailing the circumstances of how the CAC was lost or stolen based on the information provided by the contractor and any other available information.

If the CAC can be reissued within 24 hours, direct the contractor to bring the police report/memorandum to the nearest RAPIDS office for reissuance.

If the CAC cannot be reissued within 24 hours, ensure the contractor completes steps in #1 for a replacement CAC.

Receives written notice via email from the contractor, within one (1) business day of issuance, once a new contractor CAC has been issued for the contractor employee.

Logs the issuance of the new contractor CAC in the Contractor CAC Log.

c. Contractor CAC expiration date is prior to completion of the contract:

Receives notice from the contractor, as follows:

o In person, followed within one (1) business day by a written notice via email, or o In writing, via email, or o By telephone, followed within one (1) business day by a written notice via email.

Follows the steps under Post-Award, above, for issuance of a new contractor employee CAC. (NOTE: The contractor shall begin the process for issuance of a new contractor CAC no later than two (2) weeks prior to expiration of the old contractor CAC).

Receives written notice via email from the contractor, within one (1) business day of issuance, once a new contractor CAC has been issued for the contractor employee.

Logs the issuance of the new contractor CAC in the Contractor CAC Log.

FIGURE 1

CAC Justification Form

Section I: Applicant and Contract Data

Applicant Name:

Contract Number (include task order number if applicable):

Contract End Date:

Contracting Office:

Section II: Eligibility Requirements (Select all that apply)

☐ The applicant requires both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely. Access to the DoD network must require the use of a computer with Government-controlled configuration or use of a DoD-approved remote access procedure in accordance with the Defense Information Systems Agency Security Technical Implementation Guide.

☐ The applicant requires remote access, via logon, to a DoD network using DoD-approved remote access procedures.

☐ The applicant requires physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six months or more. The frequency of “recurring basis” shall be at least two times per week/or eight times per month.

☐ The applicant is supporting a contract at a non-DLA site and the local site/installation security policy requires the contractor to obtain a CAC for installation entry control or physical access to facilities and buildings.

Section III: Sponsor Responsibilities (Select all boxes to acknowledge compliance)

I (the sponsor) understand I am responsible for each task listed below:

☐ I will provide a digitally signed email to the TASS Trusted Agent every six months when requested by the Trusted Agent to reverify the applicant’s requirement for a CAC.

☐ I will immediately notify the Trusted Agent when the applicant’s affiliation with DLA is terminated prior to the applicant’s CAC expiration.

☐ If the applicant leaves, is terminated/reassigned or is no longer supporting the contract for any reason, I will retrieve the credential and properly dispose of it by returning it to a RAPIDS office.

Sponsor’s Name Sponsor’s Phone Sponsor’s Email

Sponsor’s Signature Date

FIGURE 2

DD FORM 1172-2

FIGURE 3

CONTRACTOR CAC LOG

Contract Number:

Contractor:

Location:

Contract/Order Start Date:

Contract/Order Completion Date:

Contract/Order Termination (if prior to Contract/Order Completion Date):

Contractor Employee Name

DD

Form 1172‐2 Receipt Date

CAC

Issuance Date

CAC

Expiration

Date

Contractor Employee Termination

Date (if applicable)

CAC

Turn‐In Date to COR

CAC

Turn‐In Date to

RAPIDS

Office

Comments/Issues (e.g. notifications, lost or stolen CAC, CAC issued by another agency, etc.)

FIGURE 4

GOVERNMENT‐ISSUED CONTRACTOR COMMON ACCESS CARD (CAC)

TURN‐IN RECEIPT

The contractor shall complete the following information:

Contract Number:

Contractor:

Location:

The contractor shall identify the following information for each contractor CAC being turned‐in:

Employee Name Issue Date Expiration Date

The contractor shall return the above identified contractor CACs to the Contracting Officer’s Representative (COR) for the contract for turn‐in. The COR will enter the turn‐in date for the contractor CACs. The contractor shall acknowledge turn‐in of the contractor CACs and the COR will acknowledge receipt below:

Turn‐in Date to COR

Contractor Acknowledgement of Turn‐In COR Acknowledgement of Receipt

Signature: Signature:

Print Name: Print Name:

The COR will hand‐carry the above identified contractor CACs to the nearest Real‐Time Automated Personnel Identification System (RAPIDS) office for turn‐in. The RAPIDS office will enter the turn‐in date for the contractor CACs. The COR will acknowledge turn‐in of the contractor CACs and the RAPIDS office will acknowledge receipt below:

Turn‐in Date to RAPIDS Office

COR Acknowledgement of Turn‐In RAPIDS Office Acknowledgement of

Receipt

Signature: Signature:

Print Name: Print Name: