TE 12 Personnel Security 07302024.pdf

2024 IHP Field Services Contract Technical Exhibit #12

TE 12 Personnel Security 07302024 1

Personnel Security Requirements and Procedures

STAFFING/EMPLOYMENT ELIGIBILITY

Security: Security requirements are based on contractor personnel’s positions, functions, and access requirements. All DHS contracts must ensure compliance with HSAR 3004.470-3 and include applicable clauses in accordance with the requirements at HSAR 3004.470-4.

PERSONNEL PRE-SCREENING

FEMA will determine contractor personnel’s eligibility to perform work under this contract. The Contractor is responsible for ensuring that contractor personnel the Contractor proposes to perform work under this contract are United States citizens and have a personal background free from issues that may render them ineligible to perform work under this contract. Pre-screening of potential contractor personnel should be completed prior to submitting candidates to FEMA. The following list identifies some common issues that can potentially render an individual ineligible to perform work under this contract. This list is not intended to be all-inclusive and does not represent the full scope of personal conduct and character evaluated in the personnel screening process. To improve the likelihood that FEMA will determine contractor personnel are eligible to perform work under this contract, the Contractor should screen out candidates whose background contains any of the following issues:

• Lack of U.S. Citizenship (lawful permanent residents are not U.S. citizens),

• Recent or multiple charges for driving under the influence (DUI) or similar charges,

• Multiple issues involving alcohol use,

• Recent involvement with illegal drugs,

• Pending criminal charge/open dispositions,

• History of violent crimes,

• Currently on probation or parole,

• Currently subject to a domestic-violence or other court-ordered protection order,

• Registered sex offender or narcotic offender,

• Defaulted/delinquent Federal loans,

• Delinquent Federal or State taxes, including failure to file,

• Delinquent child support payments,

• Excessive delinquent personal debt

A background free of the listed issues does not guarantee FEMA will find the contractor personnel eligible to perform work under this contract.

Contract Personnel Security Requirements for Housing Assessment Service Contracts:

All contractor personnel serving on the Housing Assessor Services (HIS) Contract in any capacity covered by this Performance Work Statement requiring access to DHS or FEMA information systems or routine access to DHS or FEMA facilities, shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Program Office will determine the risk designation for each contractor position by comparing the functions and duties of the position against those

TE 12 Personnel Security 07302024 2 of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service. Contractor personnel occupying positions with a moderate risk designation shall be required to undergo a Tier 2 Suitability (T2) background investigation and receive a favorable adjudication thereof from FEMA Personnel Security Division (PSD) prior to performing work under this contract.

Likewise, contractor personnel occupying positions with a high risk designation shall be required to undergo a Tier 4 (T4) background investigation and receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

(a) Contractor Employee and/or Applicant Processing Requests

Contractors performing on this contract must be United States Citizens. Contractor applicants must also be 18 years of age or older to allow for the conduct of certain security related queries.

To initiate the request to process a contractor employee/applicant, the Prime Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II, DHS 11000-25, Contractor Fitness/Security Screening Request Form. “,”. The FEMA COR shall ensure that all other applicable sections of the Section II, DHS 11000-25, Contractor Fitness/Security Screening Request Form are completed prior to submitting the form to FEMA PSD for processing.

Upon receipt of the completed Section II, DHS 11000-25, Contractor Fitness/Security Screening Request Form, FEMA PSD shall:

(1) Determine the presence or absence of a serviceable prior, in-scope, favorably adjudicated background investigation that meets or exceeds the current requirement. If such an investigation exists, the contractor employee/applicant will be requested to provide an OF306, Declaration for Federal Employment, (OF306), DHS Form 11000-6, “Conditional Access to Sensitive But Unclassified Information Non-Disclosure Agreement” and DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act” to determine whether or not there has been any activity since this last adjudication that may prevent FEMA PSD from applying reciprocity. If there are no issues reciprocity will be granted. Upon the verification and granting of reciprocity FEMA PSD will notify the COR of the names of the favorably adjudicated contractor personnel. The COR will, in turn, notify the Prime Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

If, during the review of the contractor employee/applicant’s OF306, there are issues noted that require further inquiry, the case may be delayed for additional processing.

(2) If there is not a serviceable previous background investigation to be considered for reciprocity, FEMA PSD will issue an electronic notification via email to the contractor employee/applicant directing completion of the process allowing five (5) business days to meet compliance with the requirement. The notification will include process directions, contact information for customer support, directions for fingerprinting to include a list of FEMA fingerprint locations, as well as

TE 12 Personnel Security 07302024 3 electronic copies of the foregoing security documents which are part of the full investigation package:

* Standard Form 85P, “Questionnaire for Public Trust Positions” (electronic only)

* Optional Form 306, “Declaration for Federal Employment”

* SF 87, “Fingerprint Card” (1 copy)

* DHS Form 11000-6, “Conditional Access to Sensitive but Unclassified Information Non- Disclosure Agreement”

* DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

Applicants born outside the United States will be required to provide proof of citizenship in the form of a Certificate of Naturalization (Form N550 or N570), an unexpired U.S. Passport, or State Department issued Consular Report of Birth Abroad (CRBA) (FS-240)

It is preferred that fingerprint captures be completed at a FEMA facility closest to the contractor’s home base however, in situations where this is not possible, the process may be performed by local law enforcement or authorized fingerprinting facility if pre-approved by the FEMA COR. If the SF87 Fingerprint Card needs to be mailed to the contractor employee/applicant’s personal physical address due to not being within acceptable driving distance of a FEMA facility, the request may be made by responding to the FEMA PSD Security Specialist which sent the security package.

FEMA PSD will only accept complete packages consisting of all of the above documents, except for the Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Residency requirements apply to the background investigation process. Persons subject to investigation and final adjudication for fitness or suitability must have lived within the United States for no less than 3 of the last 5 years as defined in the DHS Instruction 121-01-007-01, Revision 1The Department of Homeland Security, Personnel Security, Suitability and Fitness Program (June 14, 2017). DHS has determined this to be the minimum amount of time required to be the sufficient minimum investigative period for the purpose of performing a suitability or fitness adjudication.

Likewise, OPM and OMB require a final adjudicative decision to support the issuance of the HSPD- 12 compliant PIV Card that assessors are issued by FEMA Physical Security.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

(b) Process Compliance

TE 12 Personnel Security 07302024 4

(1) Non-Compliant Cases

Contractors who fail to respond by the cited deadline for completion of the eQIP process without first providing just cause and/or a request for extension, or in the absence of exigent circumstances, will be found non-compliant.

(i) The COR will receive notification of non-compliant cases.

1. The COR will in turn notify the Prime Contractor that the contractor/applicant has been removed from any further processing for no less than a 90 day period.

2. The FEMA PSD case will be closed without further action being taken.

(ii) Current contractors who fail to respond to the eQIP requirement and who are found in non- compliance will immediately be removed from the HIS contract.

(iii) Non-Compliant contractor/applicants who fail to respond to the eQIP requirement may be resubmitted one time for processing after 90 days.

1. A second failure to respond to the eQIP requirement, will result in a final non-compliance and the contractor/applicant will not be considered for further processing on the HIS contract under any circumstances.

(2) Effect on Waiver Hiring

Any contractor deemed non-compliant at any previous processing point will not be considered a viable candidate under the terms of the DHS Emergency Waiver in the event of a Disaster Declaration where expedited hiring practices are enacted for the HIS contract that reduce steady-state requirements.

This includes any and all scenarios that may qualify under the term “Just in Time” hiring. Any contractor or applicant who has previously been deemed non-compliant will not be considered under any abbreviated or surge hiring process.

Any contractor or applicant found non-compliant with the surge hiring process under the Emergency Waiver will not be considered for further processing during normal operations unless there is just cause for the non-compliance.

(3) Compliant Cases

Contractors will be authorized to begin work following a favorable pre-appointment screening performed by FEMA PSD. This process includes a review of the completed eQIP submission.

Questionnaire (SF85P), the OF 306, the individual credit report, and the FBI response to the submission of the individual’s fingerprints.

1. An Entry-On-Duty (EOD) approval will be issued to the COR.

TE 12 Personnel Security 07302024 5

2. The contractor record will be sponsored in the DHS Enterprise Identity Management System, IDMS, (badge system), to facilitate the issuance of the FEMA Contractor HSPD-12 PIV ID Badge.

3. All cases approved for EOD will continue being processed for the full background investigation required by the position of record.

4. Notices of EOD approval will be sent to the Prime Contractor by the FEMA COR.

* Upon notification of the hiring approval, the Prime contractor will collect and process the Form I-9, Employment Eligibility Verification from the contractor, including sub-contractors where applicable.

* The results of these verifications will be maintained as part of the employment record by the Prime Contractor(s) and may be subject to audit.

* An unfit determination will be issued by FEMA PSD to the contractor who is the subject of record, not the Prime Contractor.

* An unfit notice will be issued by FEMA PSD to the COR who will notify the Prime Contractor.

* The Prime Contractor will be directed to remove the contractor from service on the HIS contract via the COR notice.

* The FEMA PSD case will be closed without further action being taken.

2. Cases presenting with issues determined to be security concerns will be delayed in final determination. A Delay notification will be sent to the COR who will notify the Prime Contractor who will be afforded an opportunity to explain/mitigate the concern. This is generally a 15 to 30 day process however the timeframe may be impacted by caseload.

* Cases that are successfully mitigated will be cleared and returned to normal processing as noted above in sub-section (3) (i).

* Cases that cannot be mitigated will be determined unfit.

* An unfit determination notice will be issued by FEMA PSD to the contractor who is the subject of record, not the Prime Contractor.

* An unfit determination notice will be issued by FEMA PSD to the COR who will notify the Prime Contractor.

* The Prime Contractor will be directed to remove the contractor from service on the HIS contract via the COR notice.

* The FEMA PSD case will be closed without further action being taken.

(c) Continued Eligibility and Reinvestigation

TE 12 Personnel Security 07302024 6

Contractors who receive a preliminary favorable fitness determination and initial EOD approval are subject to a final favorable adjudication of the full background investigation once completed by the Defense Counterintelligence Security Agency (DCSA-investigation service provider) for continued performance on the HIS Contract. In any instance where a closed investigation case report is received from DCSA wherein security issues are cited, the contractor will be processed for potential mitigation under the same criteria described above.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file, send a final favorable determination notification to the contractor employee and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

DHS/FEMA shall exercise full control over granting, denying, withholding or terminating unescorted access to all DHS/FEMA facilities, assets, systems and information based upon the final adjudication of the required background investigation.

Eligibility determinations based on a T2, or T4 (or the equivalent DCSA investigation) are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

The Contracting Officer, independent of FEMA PSD, may direct the Prime Contractor to exclude from working on this contract any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency.

(d) DHS/FEMA HSPD-12 Personal Identity Verification (PIV) ID Badges

Upon EOD approval and verification of citizenship by the Prime Contractor, the contractor will make an appointment to receive the DHS/FEMA HSPD-12 PIV ID Badge, hereinafter the PIV Card, at a FEMA Facility or at a designated DHS Component Office selected from a predetermined, pre-approved list of issuers. No contractor will report to any location for badge issuance without first establishing and confirming an appointment time and date. Contractors must provide personal identification that establishes proof of citizenship in order to be badged, one item of which must be a current picture ID. Prior to scheduling a PIV Card appointment each PIV recipient is required to sign DHS Personal Identity Verification Cardholder Responsibility Agreement (Attachment 25) obligating them to the rules of separation.

TE 12 Personnel Security 07302024 7

Refer to the DHS PIV Card Acceptable Identity Source Documents for lists of acceptable forms of identification (Attachment 26).

In any instance where an appointment has been established, confirmed and the contractor arrives on time and fully prepared, and is unable to be badged, the incident will immediately be reported to the FEMA PSD HIS Office and/or the FEMA Badge Office for resolution.

After the contractor is issued the PIV Card, it must remain with him/her until the end of service on the contract or until the PIV Card reaches expiration or is otherwise recalled by the Prime Contractor or the Government. The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence.

If the contractor loses the PIV Card or it is stolen, a report is required to be made as soon as the loss is known. The report must be made to the Prime Contractor’s Security Manager and in no instance, less than 24 hours after discovery to the COR who will notify FEMA Security so that the PIV Card can be immediately deactivated. The contractor may receive a replacement PIV Card but not until these steps are followed.

If the contractor fails to complete any required security process, is removed by the Contracting Officer, resigns or is terminated by the Prime Contractor, is found unfit through final adjudication of the background investigation, or is removed from service for any other reason, the PIV Card will be revoked. The contractor will surrender the PIV Card to the Prime Contractor within 24 hours of notification. The Prime Contractor will relay the PIV Card to the COR who will return it to FEMA Security.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

With regard to contractor control of Government Property, specifically the Personal Identity Verification (PIV) badge, FAR 52.245-1, Government Property, section (f) Contractor plans and systems. The contractors shall establish and implement property management plans, systems, and procedures at the contract, program, and site or entity level to enable outcomes to retrieve Government property.

(e) Direct Work Performance Requirements

The Prime Contractor will use and supply the unique assessor identification number to be used in the FEMA NEMIS software when requested by FEMA Contract Management and Housing Assessment Services staff.

TE 12 Personnel Security 07302024 8

The contractors shall be trained to recognize, assess and record disaster related damages to residential structures for the purpose of determining habitability, and shall be indoctrinated to the process between disasters.

The contractors shall be trained on protecting Personnel Identifiable Information (PII) as well as on Fraud Awareness and Detection to identify indicators of potential fraud and procedures to follow when encountered.

In any instance of separation from the HIS Contract, the Prime Contractor, in addition to ensuring that the PIV Card is collected and returned in accordance with the processes described in Section (d) above, shall ensure that any DHS/FEMA or CMHIS vendor-issued equipment and/or proprietary information in the possession of the departing contractor is returned to the COR within 24 hours of termination or departure from the prime Contractor.

Additional Services required by HIS Prime Contractor

a) Registration of HIS Contractor assessors/staff into FEMA Suitability Tracker by prime contractor

b) Schedule appointments for Badge/credentialing of contract personnel to control access to Government Furnished Property (GFP) /equipment and privileges to Government locations/facilities

Ad-Hoc Reports

HIS Prime contractor shall submit ad-hoc reports per the Government Customer’s request.

Reports may be required to contain real-time data

* Number of active registered assessor personnel badged

* Number of active registered office personnel badged

* Name and company of individuals terminated from program participation (notice must be made to FEMA Security via the FEMA COR within 24 hours of the termination)

* Upon CMHIS COR written request individual contact information may be needed for CMHIS assessor complaints, fraud, FEMA Security and or Office of General Council at any time.

* Ad-hoc reports per the Government Customer’s request monthly may be required to contain real-time data

Quarterly Report

HIS Prime contractor shall submit at the end of each quarter, no later than the fifth day after the close of the quarter, a written report containing:

TE 12 Personnel Security 07302024 9

* Dates and number of Fitness Forms 121-3-1-6 submitted to FEMA for entry into pre- screening for adjudication

* List of individuals whose badges were collected and returned to FEMA

* Lessons learned and preventive and corrective actions as a result of lessons learned

The HIS Prime contractor is responsible for maintaining privacy safeguards in their respective collection, use, storage and destruction of Individual Data.

The HIS Prime contractor shall notify the potential candidate to monitor their email daily for any additional information needed by PSB to continue processing their case (i.e. mitigation documents, eQIP updates) until they receive a PIV badge.