Section J - Section H Attachments H.1 H.2 H.3 H.4.rtf

H-1

ATTACHMENT H.1

Electronic & Information Technology Accessibility Standards Evaluation (4/13/01)

Standards Group/Standard

CLIN

Fully Compliant

Partially Compliant

Non-Compliant

Notes:

1194.21 Software Applications and Operating Systems (36 CFR 1194.21)

(a) When software is designed to run on a system that has a keyboard, product functions shall be executable from a keyboard where the function itself or the result of performing a function can be discerned textually.

(b) Applications shall not disrupt or disable activated features of other products that are identified as accessibility features, where those features are developed and documented according to industry standards. Applications also shall not disrupt or disable activated features of any operating system that are identified as accessibility features where the application programming interface for those accessibility features has been documented by the manufacturer of the operating system and is available to the product developer.

(c) A well-defined on-screen indication of the current focus shall be provided that moves among interactive interface elements as the input focus changes. The focus shall be programmatically exposed so that assistive technology can track focus and focus changes.

(d) Sufficient information about a user interface element including the identity, operation and state of the element shall be available to assistive technology. When an image represents a program element, the information conveyed by the image must also be available in text.

(e) When bitmap images are used to identify controls, status indicators, or other programmatic elements, the meaning assigned to those images shall be consistent throughout an application's performance.

(f) Textual information shall be provided through operating system functions for displaying text. The minimum information that shall be made available is text content, text input caret location, and text attributes.

(g) Applications shall not override user selected contrast and color selections and other individual display attributes.

(h) When animation is displayed, the information shall be displayable in at least one non-animated presentation mode at the option of the user.

(i) Color coding shall not be used as the only means of conveying information, indicating an action, prompting a response, or distinguishing a visual element.

(j) When a product permits a user to adjust color and contrast settings, a variety of color selections capable of producing a range of contrast levels shall be provided.

(k) Software shall not use flashing or blinking text, objects, or other elements having a flash or blink frequency greater than 2 Hz and lower than 55 Hz.

(l) When electronic forms are used, the form shall allow people using assistive technology to access the information, field elements, and functionality required for completion and submission of the form, including all directions and cues.

TOTALS

1 Selective weighting can be done per standard as is appropriate. 2 Compliance at proposal submission = 3; compliance by scheduled delivery date after insignificant or no contractor development = 2; compliance by scheduled delivery date after significant contractor development = 1. No allowance is given here for partial compliance as gradations are difficult to verify and add complexity. Values among the three levels can be adjusted but should remain proportional due to the higher risk to the government of the two lower valued levels. 3 Weighted Value equals Weight value multiplied by Compliance Level value.

Electronic & Information Technology Accessibility Standards Evaluation (4/13/01)

Standards Group/Standard

CLIN

Fully Compliant

Partially Compliant

Non-Compliant

1194.22 Web-based Intranet/Internet Information and Applications (36 CFR 1194.22)

(a) A text equivalent for every non-text element shall be provided (e.g., via "alt", "longdesc", or in element content).

(b) Equivalent alternatives for any multimedia presentation shall be synchronized with the presentation.

(c) Web pages shall be designed so that all information conveyed with color is also available without color, for example from context or markup.

(d) Documents shall be organized so they are readable without requiring an associated style sheet.

(e) Redundant text links shall be provided for each active region of a server-side image map.

(f) Client-side image maps shall be provided instead of server-side image maps except where the regions cannot be defined with an available geometric shape.

(g) Row and column headers shall be identified for data tables.

(h) Markup shall be used to associate data cells and header cells for data tables that have two or more logical levels of row or column headers.

(i) Frames shall be titled with text that facilitates frame identification and navigation.

(j) Pages shall be designed to avoid causing the screen to flicker with a frequency greater than 2 Hz and lower than 55 Hz.

(k) A text-only page, with equivalent information or functionality, shall be provided to make a web site comply with the provisions of this part, when compliance cannot be accomplished in any other way. The content of the text-only page shall be updated whenever the primary page changes.

(l) When pages utilize scripting languages to display content, or to create interface elements, the information provided by the script shall be identified with functional text that can be read by assistive technology.

(m) When a web page requires that an applet, plug-in or other application be present on the client system to interpret page content, the page must provide a link to a plug-in or applet that complies with 1194.21 Software Applications and Operating Systems, (a) through (l).

CLIN

Fully Compliant

Partially Compliant

Non-Compliant

1194.31 Functional Performance Criteria

(a) At least one mode of operation and information retrieval that does not require user vision shall be provided, or support for assistive technology used by people who are blind or visually impaired shall be provided.

(b) At least one mode of operation and information retrieval that does not require visual acuity greater than 20/70 shall be provided in audio and enlarged print output working together or independently, or support for assistive technology used by people who are visually impaired shall be provided.

(c) At least one mode of operation and information retrieval that does not require user hearing shall be provided, or support for assistive technology used by people who are deaf or hard of hearing shall be provided.

(d) Where audio information is important for the use of a product, at least one mode of operation and information retrieval shall be provided in an enhanced auditory fashion, or support for assistive hearing devices shall be provided.

(e) At least one mode of operation and information retrieval that does not require user speech shall be provided, or support for assistive technology used by people with disabilities shall be provided.

(f) At least one mode of operation and information retrieval that does not require fine motor control or simultaneous actions and that is operable with limited reach and strength shall be provided.

CLIN

Fully Compliant

Partially Compliant

Non-Compliant

1194.41 Information, Documentation, and Support

a) Product support documentation provided to end-users shall be made available in alternate formats upon request, at no additional charge.

b) End-users shall have access to a description of the accessibility and compatibility features of products in alternate formats or alternate methods upon request, at no additional charge.

c) Support Services for products shall accommodate the communication needs of end-users with disabilities.

ATTACHMENT H.1.2

SECTION 508 INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

SECTION 508 – 36 CFR 1194, the Access Board’s Final Rule, requires Federal agencies, when developing, procuring, maintaining, or using Electronic and Information Technology (EIT) products and/or service, to ensure that the product and/or service provides access to both Federal employees and members of the public with disabilities. Federal employees and members of the public with disabilities must have access to and use of information and data comparable to those without disabilities, unless an undue burden would be imposed on the agency.

SECTION 508 CONFORMANCE - This solicitation includes a requirement for the provision of managed web portal services. The Government must procure the product that best meets the applicable Access Board Standards.

The application of 36 CFR 1194.2 does not apply to Electronic and Information Technology (EIT) that meet the exemptions described at FAR 39.204.

Offerors must provide a comprehensive specific list of all proposed EIT products (supplies and services) that are 100% compliant with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendment, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 CFR Part 1194. The location of the list containing full details of compliance must be clearly indicated (e.g., vendor’s or other exact web page location). Offerors must ensure that all EIT products that are less than fully compliant are offered pursuant to extensive market research, and ensure that the products and services offered best meet the Standards available to satisfy this solicitation’s requirements.

Utilizing the chart located in Section J, Attachment H.1, the offeror shall identify all Section 508 products/supplies that they propose to deliver under the resultant contract. The chart uses the same EIT section categories and numbering scheme as the original Access Board Standards.

A chart must be completed for each differing product proposed for the provision of supplies and/or services required in this solicitation. Offerors must provide the following information:

- A brief description of the product;

- The current conformance level of the product being offered; and

- If the products offered are not 100% conforming, indicate the anticipated date when 100% conformance will be reached.

Offerors may propose products or services other than the products or services commercially available provided the result of the substitution will provide a substantially equivalent or greater access to and use by individuals with disabilities; this is known as equivalent facilitation. The offeror must clearly indicate that the submission represents an Alternate proposal. The offeror must cross-reference such alternative to an explanation of how the equivalent facilitation accomplishes the functional capability. Please utilize the sheets developed for the Standards detailed above.

ATTACHMENT H.2

IRS CAPABILITY MATURITY MODEL (CMMI®) REQUIREMENTS

PRE-AWARD CMMI® VALIDATION

The goal of the Capability Maturity Model® Integration (CMMI®) validation effort during this source selection is to validate that Contractors selected to perform IRS software development work are capable of practicing the Software Engineering Institute (SEI) CMMI for Software Engineering (SW) or CMMI Development (DEV) Level 2 maturity.

The source selection practice as suggested by the SEI recommends that the procuring agency field a Standard CMMI Appraisal Method for Process Improvement (SCAMPISM2) team to determine prospective software development Contractors’ CMMI process maturity level. This is a very time-consuming, labor-intensive process and is not practical for multiple award acquisitions that are expected to consider many vendors. The objective of this approach, therefore, is to provide a means of validating Contractor process maturity within the time constraints of the acquisition.

All offerors shall provide evidence of process maturity in accordance with the IRS Policy and Procedure 39.1(B) Capability Maturity Model for software through the submission of SCAMPI results.

DATA SUBMISSION REQUIREMENTS

All offerors shall submit data from at least one external SCAMPI, but no more than three, that demonstrates software development compliance with SEI’s CMMI-SW Version 1.1 or CMMI-DEV Version 1.2. The submission material shall be dated within 36 months from the first day of the on-site period to the proposal due date to include the following information:

CMMI LEVEL 2 VALIDATION

Each Offeror’s submission will be validated by members of the IRS CMMI Review Team. The estimated completion time for each validation is no longer than 2 — 3 days per Offeror.

Acceptance Criteria: The SCAMPI information submitted is validated against established criteria and must clearly indicate:

POST-AWARD MONITORING

Contractors developing software for the IRS shall maintain Level 2 or better in the process areas for CMMI in order to continue to receive software tasking. The CMMI Review Team will monitor Contractor process maturity by:

ATTACHMENT H.3

IRS HSPD-12 PIV I PROCEDURES MANUAL

1 Purpose

This document will describe the procedures to be followed by the Internal Revenue Service (IRS) for Personal Identity Verification (PIV) and the issuance of identity credentials (badges) for Federal employees and contractors in IRS facilities, effective October 27, 2005. These procedures are in accordance with the requirements to implement Homeland Security Presidential Directive 12 (HSPD-12) as set forth by the Federal Information Processing Standards Publication 201 (FIPS 201), dated February 25, 2005, and the Office of Management and Budget (OMB) Memorandum M-05-24, dated August 5, 2005.

HSPD-12 was signed on August 27, 2004. This directive instructs all Federal agencies to develop a common procedure for secure and reliable forms of identification to be used by Federal employees and contractors to gain access to Federal facilities. This new procedure will enhance security, increase government efficiency, reduce identity fraud, and protect personal privacy.

HSPD-12 directed the Department of Commerce to develop FIPS 201, which defines the standards to be used in developing a common procedure across all government agencies. In addition, the OMB issued M-05-24 which further clarifies the schedule and implementation plan for this standard, which will be implemented in two major phases – PIV-I and PIV-II.

2.2 PIV I and PIV II

The first phase, or PIV-I, is the focus of this document and must be implemented by all Federal agencies on October 27, 2005. It establishes the minimum requirements for a process to meet control and security of objectives of HSPD-12, including personal identity proofing, registration, and issuance. It does not address the interoperability objectives of PIV Cards and systems among departments and agencies, which will be addressed in PIV-II, with new cards being issued starting on October 27, 2006.

2.3 Applicability

Long-term - The IRS must conduct a background investigation; adjudicate the results, and issue identity credentials to all employees and contractors who require long-term access to IRS facilities and/or information systems. Long-term access is defined as equal to or greater than six (6) months. Candidates that apply for appointments that are long-term will be required to undergo the PIV process defined in this manual.

Temporary - Temporary employees or contractors will be classified in two categories: Temporary short-term and Temporary long-term.

Contractors who will work more than 30 days and require access to the facility or to IRS systems will be required to adhere to the PIV requirements, depending on the risk level assessment.

Short-term - Short-term contractors, volunteers, commissions, and panels will be defined as working 1 month or less. For individuals in this category, a visitor badge will be issued and no FBI Criminal check or background investigation will be conducted. However, the IRS may make a risk-based decision depending on the risk level of the work to be performed, that fingerprints, additional screening, and background checks will be required.

Visitors - HSPD-12 does not apply to occasional visitors to the IRS facilities, such as volunteers or family members. Visitors will be issued a visitor badge.

Foreign Nationals – Contractors and sub-contractors and their employees may be allowed to work at the IRS if they are US citizens or have lawful permanent resident status. A foreign national is defined as a person who was born in a foreign country, is NOT a US citizen, and has a lawful permanent resident status. Background investigations for foreign nationals will be conducted on all contractors according to the procedures outlined in the Treasury Security Manual – TDP 71-10, Chapter 2, Section 2 - Contractor Investigations. IRS hiring policy states that an individual must be a US citizen in order to be considered for employment eligibility. Therefore, foreign nationals are currently not IRS employees.

2.4 Certification & Accreditation

The PIV processes outlined in this document for identity proofing and registration, as well as for issuance and maintenance of PIV Cards, will be submitted and incorporated in the Business Process Accreditation Template for approval and accreditation by the proper authorities within the IRS and the Department of the Treasury. All of the processes outlined here satisfy the requirements of FIPS 201 and OMB M-05-24. The requirements for this certification are outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-79 (SP 800-79). The Designated Accreditation Authority (DAA) has given the IRS an Authorization to Operate (ATO) effective October 27, 2005.

3 Requirements for PIV-I Requirements for personal identity verification are specified in Federal Information Processing Standards Publication 201 - Personal Identity Verification of Federal Employees and Contractors, issued by the National Institute of Standards and Technology (NIST). This standard contains requirements for PIV-I and PIV-II. An appendix to the standard contains two example identity proofing, registration and issuance process sets which meet the requirements for PIV: a role-based model and a system-based model. The role-based model is recommended for organizations which do not have a pre-existing PIV system.

3.1 Control Objectives

HSPD-12 established control objectives to establish what is meant by “secure and reliable forms of identification”; FIPS 201 expands those control objectives to the following set of high-level requirements:

3.2 Identity Proofing and Registration Requirements

Identity proofing is the process of providing sufficient information (to a PIV Registrar or trusted agent) to establish a person’s identity. Identity registration includes the collecting and recording of relevant attributes of that person, and associating that information with the unique identifier of that person.

The process shall begin with initiation of a National Agency Check with Written Inquiries (NACI) or other OPM or National Security investigation required for Federal employment. This requirement may also be satisfied by locating and referencing a completed and successfully adjudicated NACI, or other OPM or National Security investigation required for Federal employment. Additional OMB guidance in M-05-24 states that, if the results of the NAC are not received in 5 days, the identity credential can be issued based on the FBI National Criminal History Check (fingerprint check).

3.3 Issuance and Maintenance Requirements

Issuance of a PIV credential includes creation and personalization of the credential and giving the credential (in person) to the Applicant after verifying that the individual who collects the credential is in fact the Applicant for whom the credential is intended.

4 PIV-I Roles With the implementation of FIPS 201 requirements, several new roles have been identified that are key elements of the PIV process. These new roles are described below and are also outlined in the example role-based model included in Appendix A. of FIPS 201.

4.1 Role Requirements

One of the requirements of the PIV identity proofing, registration, and issuance process is to ensure that the principal of separation of duties is met. In order to distinguish a clear separation of responsibilities between roles, the IRS will adopt the first four role names and descriptions that are outlined in the FIPS 201 Section A.1.1.1 Roles and Responsibilities.

Named individuals within the existing IRS and contractor organizations may be designated to a role that they will perform in the PIV process. These individuals must complete training in their designated role. A list of individuals within each role will be maintained by the IRS HSPD-12 Program Office. This list will be distributed to each of the card issuing facilities. Individuals may be designated to more than one role; however they may not perform more than one role for a single PIV Card Applicant (as defined below). All individuals performing a PIV role must have a completed and favorably adjudicated NACI check on record.

Per the FIPS 201 requirements, each PIV role performed will be mutually exclusive from any other role performed for each PIV Card Applicant. In the FIPS 201 requirements, Appendix A, an example of a Role Based Model is illustrated as an approved example of PIV Identity Proofing, Registration and Issuance. The IRS will be adopting a similar model, using the roles described in the FIPS 201 requirements Appendix A, however slight variations have been made to accommodate the specific business needs of the IRS. The variations in the IRS model adopt the use of an approved identity proofing and registration process as outlined in Section 2.2 of the FIPS 201 requirements and satisfy the PIV objectives and requirements.

4.2 Role Descriptions

The following describes the five critical roles that will be employed at the IRS for identity proofing and issuance: The PIV Sponsor, Registrar, and Issuer will be named individuals that have been certified and trained to perform their designated role. A list will be maintained for individuals serving in these roles and a record of their completed background investigation will be kept on file. The PIV Applicant Representative is also a new IRS role that serves to protect the Applicant’s rights.

4.2.1 Applicant

This is the individual to whom a PIV credential potentially needs to be issued.

4.2.2 PIV Sponsor

This is the individual who substantiates the need for a PIV credential to be issued to the Applicant, and provides sponsorship to the Applicant. The PIV Sponsor requests the issuance of a PIV credential to the Applicant.

4.2.3 PIV Registrar

This is the entity responsible for identity proofing of the Applicant and ensuring the successful completion of the background checks. The PIV Registrar provides the final approval for the initial issuance of a PIV credential to the Applicant.

4.2.4 PIV Issuer

This is the entity that performs credential personalization operations and issues the identity credential to the Applicant after all identity proofing, background checks, and related approvals have been completed. The PIV Issuer is also responsible for maintaining records and controls for PIV credential stock to ensure that stock is only used to issue valid credentials.

4.2.5 PIV Applicant Representative

The PIV Card Applicant Representative is the entity that represents the interests of current or prospective Federal employees and contractors who are the Applicants for PIV Cards. They should represent the privacy concerns of applicants, assist an applicant who is denied a PIV Card because of missing or incorrect information in an Identity Source document, or act as a surrogate for an applicant that is not available for performing required actions.

5 New PIV Forms With the implementation of the new PIV process, two new forms and an informational guide have been developed by the IRS. These forms will assist in tracking and documenting the PIV process through the various roles / organizations and provide assurance that all of the proper steps have been taken in meeting PIV I compliance. A description of each of these documents is provided in this section and copies of the forms are provided in Appendix B. All of these documents satisfy the privacy requirements outlined in Section 8 of this manual and will adhere to current IRS record retention policies.

5.1 PIV Applicant Rights and Responsibilities Guide

The PIV Applicant Rights & Responsibilities Guide (Applicant Guide) will be given to each individual at the start of the hiring process. The Applicant Guide explains what to expect in the PIV process, the Applicant’s privacy and appeal rights, and who to contact for questions. A copy of Applicant Guide is included in Appendix B.

5.2 PIV Request Form

A new tracking form will be utilized to ensure that each step in the process is completed satisfactorily. The PIV Request Form will be signed by each of the roles mentioned in Section 3.1.2 and will document the authorizations for sponsorship, registration, and issuance of the PIV credential for the life of the credential. Finally, the new form will allow for a signature from the Applicant, indicating that important information about his/her rights was provided and that his/her permission to participate in the PIV process was granted.

The PIV Request Form will be checked by the PIV Issuer, who will ensure that the requirement for separation of duties has been met and that all of the steps in the process were completed. The completed PIV Request Form will authorize the Issuer to create a PIV credential for the Applicant. The original, signed PIV Request Forms will be stored in Physical Security in a secure location and follow current security and privacy procedures. The PIV Request Forms will be kept for the life of the PIV credential itself.

5.3 Contractor Risk Assessment Checklist

This new form will be used to document and communicate the risk for the type of background investigations to be performed on contractors. All new investigation packages will require this checklist to be submitted to the Procurement Sponsor Team. A copy is included in Appendix B.

6 PIV-I Processes The PIV-I processes contain detailed step-by-step instructions and are organized into three main process streams: 1) Identity proofing and registration, 2) PIV Card issuance, and 3) PIV Card maintenance. This structure follows the organization of the FIPS 201 requirements and together, they form the entire PIV life cycle for employees and contractors.

Throughout these processes, identity documents, investigation paperwork, and the PIV Request Form are passed through various organizations performing specific roles in the process. In every instance where an Applicant’s private information is indicated on a form, the document must be transferred in a secure manner to protect the Applicant’s privacy rights. Secure manner includes the following forms of transmission: hand-delivery, secure e-mail, fax (if the fax machine is in a secure location), courier, registered USPS mail, and UPS delivery.

The processes of identity proofing and registration are applied to Applicants for employment with the IRS as part of the hiring process, so that successful Applicants can be issued credentials promptly at Entry On Duty (EOD) for facility access. Specifics of the hiring process at IRS vary depending on the type of position being filled, and as a result there are slight variations in how the PIV identity proofing and registration is performed. The elements of identity-proofing and registration processes which are common to most types of hiring are presented here, with indications given where variations occur in some hiring types. It is important to ensure that in all hiring situations, the NACI or other relevant background investigation is initiated at least 5 days prior to Entry on Duty (EOD). All applicable existing privacy and record retention policies will be applied to this process. Refer to the Section 8 Privacy Considerations.

Step 1: Applicant Applies for Federal Credential/Position - The Applicant applies for a position by submitting an application for a current vacancy announcement. The submission can be online (via CareerConnector), or a paper application via mail or fax. The vacancy announcement includes wording on the requirements for a PIV credential, the privacy statement, as well as wording that the position requires a probationary period.

Step 2: Initial Assessment of Qualification - In most cases Human Resources (HR) makes an initial assessment of the Applicant’s qualifications relative to the vacancy announcement/position requirements. This can be done based on the application materials, through a test administered online (CareerConnector), or through a test/assessment administered in person at an IRS test site. In this step, HR determines whether to proceed to perform identity proofing and take fingerprints for a Fingerprint Check.

Step 3: Initiate PIV Request Form - In a face to face meeting with the Applicant, the Registrar (HR) initiates the PIV Request Form for the Applicant. The Registrar provides the Applicant Guide to the Applicant. The optional information in Section 1 of the PIV Request Form is not needed, since that information is collected as part of the fingerprinting process (Step 5). The Applicant’s signature will verify that he/she agrees to undergo the PIV process. If the Applicant has not already received the Applicant Guide describing the PIV process, a copy will be provided at this step. The Applicant Guide will contain information about the Applicant’s appeal rights, privacy, and contact information. Section 1 of the form is completed and then signed by the Applicant. The Sponsor signature will be left blank until the final determination is made in a later step.

Step 4: In-Person Identity Proofing - The Registrar (HR) checks a state or federal government-issued picture ID, as well as one other form of ID in accordance with the I-9 process. The I-9 form and other necessary forms are verified. If the Applicant does not present a valid ID, the Applicant is escorted from the building. If a document is thought to be fraudulent, the Registrar will notate on the PIV Request Form that there is reason to suspect the document is fraudulent and the reason why. The Applicant will be notified at a later time that the identity documents were not valid. ID verification is logged on the PIV Request Form by the Registrar.

Step 5: Obtain Fingerprints - The Registrar (HR) verifies that the Applicant completes the Consent for Fingerprint Check form and the Declaration for Federal Employment. Fingerprints are taken from the Applicant using Livescan or Ink & Roll. If any further information relating to PIV is required from the Applicant, notice is given at this point with a suspense date for providing the missing information. Please refer to IRM 1.23.3 Background Investigations Guide for additional details on how to take fingerprints.

Step 6: Initiate FBI Criminal Check - Fingerprints are transmitted to OPM by the Registrar (HR), in most cases by electronic means. The PIV Request Form is updated by the Registrar with the date that the FBI Criminal check was initiated. Please refer to IRM 1.23.3 Background Investigations Guide for additional details on how to transmit fingerprints to OPM.

Step 7: Results of Checks - If the FBI Criminal check results are favorable, the results are entered on the PIV Request Form and the form is signed by the Registrar. If the results are non-favorable, the results are entered on the PIV Request Form, and the form is signed by the Registrar. Please refer to Policy 67, Objections and Passovers on Suitability Issues and Suitability Adjudicative Determination Procedures for additional details on how to adjudicate the FBI Criminal check results.

Step 8: Decision on Hiring/Need for Credential - HR and/or Business Unit makes a determination on hiring, including: certifying the Applicant, determining suitability, evaluating selection criteria, and making the job offer. A decision to make a job offer requires a favorable outcome from the FBI criminal check.

In addition, any concerns over a fraudulent identity document that were noted on the PIV Request Form, must be resolved prior to making a job offer. If the fraudulent identity document question has not been resolved, HR and/or Business Unit must contact the Applicant and ask them to correct the situation by bringing in a valid identity document and having it re-verified. When the Applicant presents a new, valid identity document, HR and/or Business Unit will update the notation on the PIV Request Form that the suspected document has been cleared.

In the event of an unfavorable decision on hiring, HR retains the forms and the application information at least through the duration of the hiring season.

Step 9: Initiate Background Investigation - The Registrar (HR) initiates the Background Investigation – National Agency Check with Inquiries and updates the PIV Request Form. The package of investigation paperwork, including the required form SF-85, SF-85P, or SF-86, is mailed to OMB or NBIC depending on the type of background investigation. NBIC provides notification of receipt of the package back to the Registrar. Please refer to IRM 1.23.3 Background Investigations Guide for additional details on how to initiate a Background Investigation.

Step 10: Final Determination - The Sponsor (usually another HR official within the same Employment Branch office as the Registrar) signs the PIV Request Form indicating a final determination on the validity of a need for a PIV credential.

Step 11: Notify Issuer - The Registrar verifies that all applicable sections of the PIV Request Form have been completed properly and that 5 days have elapsed from the initiation of the background check. The Registrar then forwards the form via secure means to the Issuer. The Issuer (Physical Security) is notified by the Sponsor (HR) to initiate credential issuance, at a date no earlier than 5 days from the initiation of the background investigation.

Step 12: Complete Background Investigation - When the Registrar is notified that the final adjudication of the background investigation has been completed; the Registrar will notify the Issuer of the final disposition in a secure manner.

6.1.2 New Contractors

Individuals assigned to perform work under IRS contracts, and who require physical access, or access to systems and information, need identity credentials. The process of identity proofing and registration for these contractors varies depending on the type of work being performed, and the contractor organization. The elements of identity proofing and registration which are common to most types of contractors are presented here, with indications given where variations occur. All applicable existing privacy and record retention policies will be applied to this process. Refer to the Section 8 Privacy Considerations. In this section, the Contracting Officer’s Technical Representative (COTR) is the person responsible for assembling and transferring information to and from the Sponsor and the Registrar, however this individual is not designated to perform either of these roles. The COTR may reside in any organization within the IRS that manages a contract for services.

Step 1: Apply for Credential - The Applicant/employee submits a request through the contractor organization for a credential under a valid contract/task order to the COTR for that contract. The applicant provides identity information (First Name, Middle Initial (MI), Last Name, Social Security Number (SSN), contractor company name, contract number) to the COTR.

Step 2: Validate Need and Risk Level - The COTR validates the need for a credential under the contract/task order terms and statement of work, and makes a determination of the appropriate risk level and investigation type based on the duties to be performed. The COTR completes a risk assessment checklist for the Applicant which includes the identity information from Step 1, as well as the Risk Level/Investigation Type, Contractor Duties, and Duty Location/Issuing Office. The risk assessment checklist is included in the Appendix.

Step 3: Initiate Investigation Request - The COTR initiates a PIV Request Form for the Applicant and provides the Applicant with the PIV Applicant Guide. The Applicant Guide will contain information about the PIV I process, the Applicant’s appeal and privacy rights, and contact information. The COTR completes the Applicant Information (Section 1) of the PIV Request Form, and obtains the Applicant’s signature, leaving the Sponsor signature line blank.

Step 4: Initiate Investigation Record - The COTR sends the PIV Request Form and risk assessment checklist to the Procurement Sponsor Team (PST) using secure means to initiate the investigation record in the Procurement Background Investigation Process (PBIP) system, and provides the following information:

Step 5: Create Investigation Record in PBIP - The PST, acting as the Sponsor, initiates an Applicant record in PBIP. The PST signs the PIV Request Form as the Sponsor, and returns the form to the COTR.

Step 6: Perform Identity Proofing and Fingerprinting - When IRS (HR) performs the function as Registrar for identity proofing and fingerprinting, the COTR will contact HR to schedule an appointment for the applicant. The COTR will also forward the PIV Request Form, either in person or via secure mail, to the appropriate HR office. (Note: The PIV Request Form should never be brought to the appointment by the applicant as the chain of custody of the document would no longer be secure.) The COTR notifies the Applicant of the time and location of the appointment and the required identity documents that must be brought by the applicant to the appointment.

The Registrar (HR) completes and signs Section 2A of the PIV Request Form. The Registrar (HR) verifies that the Applicant has completed Form 12333, Consent for Fingerprint Check. HR sends the PIV Request Form and Form 12333 to Personnel Security and Investigations (PS&I) Contractor Program via secure mail.

HR will obtain fingerprints from the Applicant using Livescan or Ink & Roll. HR will transmit fingerprints directly to OPM or will send the FD 258 ink & roll fingerprint card directly to PS&I Contractor Program to ensure that a secure chain of custody of the print images. PS&I will forward the fingerprint cards to OPM.

HR emails the PST with the Registrar’s SEID, together with the Applicant information: First Name, MI, Last Name, the last four digits of SSN, Contract Number, and date of Identity Proofing/Fingerprinting (IPFP). The PST enters the Applicant fingerprint information and Registrar’s SEID into PBIP. HR copies the COTR and PS&I on this email to inform the COTR that the fingerprints have either been transmitted to OPM or the card has been sent to PS&I.

If identity proofing and fingerprints are performed by an accredited external trusted agent (ETA) (e.g. contractor organization’s security office, police department), the ETA performs the Registrar role for this step. (Note: the process definition for this case is not complete, but in outline should be similar to the above. In a face-to-face meeting with the Applicant, the ETA checks a state or federal government-issued picture ID, as well as one other form of ID in accordance with the I-9 process. ID verification information is sent to the COTR. The ETA obtains fingerprints, and the fingerprints are forwarded either directly to PS&I, or to the COTR for inclusion with the background investigation request package which will be sent to PS&I.

Step 7: Review Package for Completeness - The COTR reviews the background investigation paperwork completed by the Applicant to ensure it is complete. If necessary, it is returned to the Applicant for correction; the Applicant returns the corrected package to the COTR.

Step 8: Upload to ABIS - The COTR uploads the investigation request information into the PS&I Automated Background Investigation System (ABIS), which will also generate a background investigation request memorandum.

Step 9: Forward to NBIC - The COTR will assemble the background investigation request package which will include forms completed by the Applicant: SF-85P or SF-86, copy of Form I-9, Form 13340 Fair Credit Reporting Act, a copy of the email from HR regarding the fingerprints, the PIV Request Form with original signature of Applicant, the risk assessment checklist, and the background investigation request memorandum. The COTR mails the background investigation paperwork package to PS&I Contractor Program.

Step 10: Notify PST Package Sent - The COTR emails the PST with the “Sent to PS&I” date.

Step 11: Update “Sent to PS&I” Date - The PST enters the “Sent to PS&I” date into PBIP.

Step 12: Initiate Background Investigation - PS&I will initiate the background investigation for the appropriate risk level, with a minimum of NACI. The date and type of background investigation will be recorded on the PIV Request Form. The package of investigation paperwork is mailed to OMB or PS&I - NBIC depending on the type of background investigation. PS&I - NBIC provides notification of receipt of the package back to the Registrar. Please refer to IRM 1.23.3 Background Investigations Guide for additional details on how to initiate a Background Investigation.

Step 13: Decide Interim Approval - PS&I makes a determination on Interim Approval. The investigation interim decision (not applicable on revalidation and high risk root systems access and/or system administrator positions) is entered by PS&I into ABIS. PS&I Contractor Program completes and signs the relevant portions of the PIV Request Form, verifies that all applicable sections of the PIV Request Form have been completed properly, and that 5 days have elapsed from the initiation of the background check. PS&I Contractor Program forwards the information (interim approval letter if favorable and scanned copy of the PIV Request Form) to the COTR and the PST via secure email. The PST enters the investigation decision date and the Approval/Denial Registrar (AD) SEID into the PBIP system. (Note: PS&I Contractor Program will retain the original PIV Request Form until the final investigation is completed.)

If there was a notation on the PIV Request Form that a fraudulent identity document was suspected, interim access will be denied. In this case, PS&I will initiate the necessary contacts to verify the suspected fraudulent document, contact the subject for a personal interview, if necessary, and forward a report to PS&I National Security Programs to adjudicate the issue.

If Interim Approval is granted - The COTR schedules an appointment for the contractor with the Issuer to issue a credential.