Vendor Training Manual September 2023.pdf

VENDOR FITNESS

DETERMINATION

TRAINING MANUAL

Updated

Table of Contents Purpose

Zonal Help Desks

Authorities and References

What is HSPD-12?

What is a fitness determination?

Types of Contractors

Who needs a background investigation?

Who does NOT need an investigation?

Escort-Only Contractors

Fitness Determination Types

Requesting Official (RO) Contractor Approval List

Special Agreement Check (SAC) Investigation Process

Special Agreement Check (SAC) Expiration and Re-Investigation Process

Tier 1 or Higher Investigation Process

Escort-Only (EO) Contractor Review Process

Contractors with Prior Investigations

US Residency Requirement

Contractor Credential

GSA Access Card/PIV Roles and Responsibilities

Investigation Documents

Common Causes of Unfit Determination

Common Delays and Errors in Investigation Process

Notification of Investigation Status

Terms and Acronyms

Attachment 1, How to Encrypt Documents Using WinZip

Attachment 2, Completing the eApp

Attachment 3, Example Email for SAC Applicants

Attachment 4, Example Email for Tier 1, 2 and 4 Applicants

Attachment 5, Requesting Official Contractor Approval List

Attachment 6 Contractor Information Worksheet

Attachment 7, OF306—Declaration for Federal Employment

Attachment 8, SF85 Worksheet

Purpose The purpose of this document is to provide a detailed description to GSA prime vendor POCs and applicants of how to properly complete an HSPD-12 background investigation.

Zonal Help Desks GSA Fitness Determinations will be processed within five work zones as listed below:

Zone East: includes regions 1, 2, and 3.

States in Zone A: Maine, New Hampshire, Vermont, Massachusetts, Connecticut, New York, New Jersey, Pennsylvania, Puerto Rico, West Virginia, Maryland, Delaware, Rhode Island, Virgin Islands and Virginia.

Team Lead: Tom Heinze Email Address: zonea-hspd12@gsa.gov Phone Number: 617-565-2051

Zone Central: includes regions 4, 5, 6 States in Zone Central: Minnesota, Wisconsin, Michigan, Nebraska, Iowa, Illinois Indiana, Ohio, Kansas, Missouri, Kentucky, Tennessee, South Carolina, North Carolina, Mississippi, Alabama, Georgia, and Florida Team Lead: Drew McCullah Email Address: zonec-hspd12@gsa.gov Phone Number: 312-886-1189

Zone West: includes regions 7, 8, 9 & 10 States in Zone West: Washington, Oregon, Idaho, Utah, Montana, Wyoming, North Dakota, South Dakota, California, Nevada, Colorado, Arizona, New Mexico, Texas, Oklahoma, Arkansas, and Louisiana.

Team Lead: Michael Skeels Email Address: zoned-hspd12@gsa.gov Phone Number: 415-884-9759

HSPD-12 CO/NCR includes regions NCR and CO.

States: Washington DC Team Lead: Phil Ahn Email Address: hspd12.security@gsa.gov Phone Number: 202-501-4459

Authorities and References

HSPD-12 http://csrc.nist.gov/drivers/documents/Presidential-Directive-Hspd-12.html

OPM HSPD-12 Credential Standards https://www.opm.gov/investigations/background investigations/reference/final-credentialing-standards.pdf

GSA Order CIO P 2181.1--HSPD-12 https://insite.gsa.gov/portal/mediaId/681058/fileName/HSPD12_Handbook_v8.actio n

GSA Order 5400.2--Requesting Official https://insite.gsa.gov/portal/content/533289l

What is HSPD-12?

Homeland Security Presidential Directive 12 (HSPD-12) is a presidential directive for executive agencies that establishes a mandatory, government-wide standard for secure and reliable forms of identification issued by the federal government to its employees and contractors requiring long-term (greater than 180 days) access to federal buildings, facilities, and information technology (IT) systems. Prior to the issuance of these identification credentials, the person’s identity and trustworthiness must be proven via a personnel security investigation (fitness determination).

What is a fitness determination?

A fitness determination is the result of a personnel security background investigation.

Contractors may be issued a credential upon receipt of a favorable preliminary fitness determination, also known as an enter-on-duty (EOD) determination.

Types of Contractors

Who needs a background investigation?

Long-term contractors are those individuals working on GSA contract(s) for greater than 6 months.

1.

Short-term contractors are those individuals working on GSA contract(s) for 6 months or less.

2.

All GSA contractors (both long-term working more than 6 months and short-term 1.

Who does NOT need an investigation?

working less than 6 months) who need routine access to GSA facilities. Routine access is defined as a regularly scheduled need to access the facility.

Any GSA contractor who requires regularly scheduled access to one or more GSA– controlled facilities, even under multiple contracts, should be treated as having routine access to GSA facilities. Individuals who completed an investigation previously with another agency must still complete the investigation process before working in GSA facilities.

2.

All contractors being cleared must fall under one of the following categories.

https://insite.gsa.gov/employee-resources/safety-and-security/background-investigation-access-card-process/requesting-officials-roles-responsibilities/contractor-onboarding?term= We can no longer do clearances on micro purchases or credit card purchases.

3.

Contractors who are working in GSA leased facilities with security level I or II and those facilities with security level III that are not 100% occupied by the government.

1.

The contractors needed to mitigate emergency situations--broken pipes; failure of HVAC units; elevator repairs; etc. must be escorted at all times, however they are not required to have prior approval from the Zonal Help Desk. Property/building management staff may authorize access for these individuals in these types of situations.

2.

Those contractors who will only access public space--lawn maintenance, vending machine technicians and suppliers, and FedEx & UPS delivery personnel.

3.

Contractors working on new construction projects prior to occupancy and not yet considered to be substantially complete.

4.

Contractors involved in repair and alteration projects where the work spaces are partitioned and/or fully separated from occupied spaces, with isolated access for contractors.

5.

Contractors being escorted for 15 days or less. These contractors must be escorted at all times by a federal employee, FPS Security contractor, or GSA contractor who is in possession of a GSA issued PIV credential. Prior review and approval by Zonal Help Desk through the submission of personal information is required for tracking

6.

https://insite.gsa.gov/employee-resources/safety-and-security/background-investigation-access-card-process/requesting-officials-roles-responsibilities/contractor-onboarding?term= https://insite.gsa.gov/employee-resources/safety-and-security/background-investigation-access-card-process/requesting-officials-roles-responsibilities/contractor-onboarding?term= https://insite.gsa.gov/employee-resources/safety-and-security/background-investigation-access-card-process/requesting-officials-roles-responsibilities/contractor-onboarding?term=

Escort-Only Contractors purposes. Escorted personnel must be within line of sight from the escort at all times.

The contractors needed to mitigate emergency situations--broken pipes; failure of HVAC units; elevator repairs; etc. must be escorted at all times, however they are not required to have prior approval from Zonal Help Desk. Property/building management staff may authorize access for these individuals in these types of situations.

1.

Non-emergency contractors may be approved for escorted access up to 15 days per contract per ADM 2181.1. If they need to work for more than 15 days in GSA facilities, they must submit documentation to receive a background investigation for unescorted access.

2.

Applicants who have previously been found unfavorable cannot be considered for escort-only access. Also, individuals in the process of completing a GSA Fitness Determination are not allowed to be escorted.

3.

Vendors should coordinate with their GSA Requesting Official (RO) to consider the type of project and proximity to escorted contractors when determining the number of personnel reasonably escorted by the same escort. It is suggested that 5-7 people per escort is typically manageable.

4.

To receive approval for escort-only access on a GSA project, the prime vendor POC must submit a CIW and should include the full legal name of the individual doing the escorting; whether they are a government employee, a FPS Security contractor, or a GSA contractor with the appropriate credentials; and the dates of escort in the email containing their CIW. Individuals needing escort-only access must be listed on the RO Contractor Approval List. Allow at least 3 business days to process the CIW prior to the applicant needing to start work.

5.

Escorts are responsible for the whereabouts and activities of escorted personnel at all times, and must remain within line of sight of escorted individuals at all times while in non-public space. The person doing the escorting must be either a federal employee, FPS security contracts, or GSA contractor who is in possession of a GSA issued PIV credential.

6.

Fitness Determination Types

The requesting official is responsible for making decisions regarding whether a contractor is a long-term contractor or a short-term contractor. They are also responsible for monitoring the duration of the project, and should the work exceed 6 months, all short term contractors can re-submit for a second SAC investigation or switch to a long-term investigation. This must be done prior to the expiration of the short-term investigation. Contractors are not authorized to work on GSA contracts prior to receipt of a favorable EOD or final determination. If the SAC expires the contractor must be removed until the new SAC or Tier 1 is approved.

Special Agreement Check (SAC) or Short-Term Investigations: Non-HSPD-12 SACs are good for 6 months from the date of the SAC determination. Short-term contractors must submit a completed CIW (Form 850) and OF306 (version 2023) to Zonal Help Desk then complete fingerprint enrollment. The CIW and OF306 must be submitted together to the Zonal Help Desk via encrypted email. Upon completion of a SAC, a contractor may work up to 6 months only. If additional work is required after the expiration date, a new investigation is required.

1.

Tier 1, 2, and 4 or Long-Term Investigations: 2.

Tier 1 (formerly known as low risk or NACI) is designed for contractors working greater than 180 days (6 months) and/or for contractors needing network access. These investigations are currently valid indefinitely, as long as the contractor continues without a break in service on GSA contracts;

however all GSA contractor credentials must be returned when contract work is completed, regardless of the expiration date on the credential. Tier 1 a.

NOTE: If Tier 1, 2, or 4 contractors return at a later date for additional and/or new contract work, a new CIW is required (to identify new contract/task order information) and new credentials will be provided at that time as needed. Those with a break in service longer than 2 years will be required to complete a new background investigation.

Requesting Official (RO) Contractor Approval List contractors must submit a completed CIW (Form 850) to the Zonal Help Desk via encrypted email. Next (based on email instructions) the contractor will complete fingerprint enrollment, then submit their on-line eApp questionnaire.

Tier 2 (formerly known as MBI) is designed for contractors working longer than 6 months and whose duties require a higher degree of trust, such as IT system administrators, individuals who handle financial transactions, individuals who deal with personally identifiable information (PII), and other sensitive information. Tier 2 contractors must submit a completed CIW (Form 850) to the Zonal Help Desk via encrypted email. Next (based on email instructions) the contractor will complete fingerprint enrollment, then submit their on-line eApp questionnaire.

b.

Tier 4 (formerly known as BI) is designed primarily for embedded contractors working in staff-like positions, with access to high-risk information. Tier 4 contractors must submit a completed CIW (Form 850) to the Zonal Help Desk via encrypted email. Next (based on email instructions) the contractor will complete fingerprint enrollment, then submit their on-line eApp questionnaire.

c.

The prime vendor POC initiates a list of contractors needing to work on each contract for approval by the RO. This list authorizes the Zonal Help Desk to process the appropriate investigation on the listed contractors.

A.

If a CIW is received for an applicant who does not appear on this list, the CIW will not be processed and the prime vendor POC will be notified that it cannot be processed until their name appears on the approval list.

B.

Each time contractor(s) are added or removed from a contract, the list must be updated, sent through the RO for approval, and forwarded to the Zonal Help Desk

C.

NOTE: do not remove contractors from the RO list.

Special Agreement Check (SAC) Investigation Process

NOTE: Applicants are not allowed to work on the project until they receive a favorable SAC determination. They are not authorized to work past 6 months from the date of the SAC determination without completing an additional background check.

with a copy to the prime vendor POC.

The items below the heading on the RO Contractor Approval List that must be completed by the prime vendor POC are listed below:

D.

Last Name, First Name, Middle Name and Suffix: this information should be their full legal name as it appears on their photo ID.

a.

Position Title: this should reflect the duties they are completing for the GSA contract.

b.

Vendor Name, if subcontractor: if contractor works for a sub of the prime vendor the name of the subcontract company goes here.

c.

If the contractor is to be escorted only, include the name of escort and dates to be escorted.

d.

Date Removed from Project/Contract: when appropriate, enter dates individuals are terminated, have completed their portion of the contract, leave the employment of the vendor prime or subcontractor, etc.

Effectively, this is the date that person will no longer need access to the facility for this project/contract. NOTE: do not remove contractors from the RO list.

e.

If assisting the applicant and discussing personal information, always verify the applicant’s full legal name, DOB, and SSN is correct before sending in any paperwork.

1.

Receive training covering all aspects of the fitness determination process from the Zonal Help Desk. At the completion of training the following forms will be provided: RO Contractor Approval List, CIW template, and

OF306

Full Legal Name

Position Title

Dates Required on Project

Vendor Name (if subcontractor)

Name of Escort (if escort only)

Dates of Escort (If escort only)

(Declaration for Federal Employment)

Prepare RO Contractor Approval List to include the following for all contractors who will be working on the contract/project:

3.

Send completed RO Contractor Approval List to GSA Requesting Official for approval.

4.

If personnel are added to or removed from the contract/project a new RO Contractor Approval List must be submitted to GSA RO for approval. Any CIWs received for personnel who do not appear on the RO Approved List will be rejected.

5.

Have applicants complete section 1 of the CIW as follows (If an individual changes from one contract to another, a new CIW is always required.)

6.

Name: full legal name, including full middle name. If no middle name, enter NMN. If the middle name is only an initial, enter the initial and (IO). The name on the CIW must be the same as it appears on the applicant's photo ID.

a.

Suffix: select the appropriate response from the drop-down window.b.

Gender: select the appropriate response from the drop-down window.

c.

Social Security Number: from applicant’s social security card.d.

Date of Birth: as it appears on the applicant’s birth certificate. e.

Place of Birth: city of birth and country (as it appears on the birth certificate) are needed for everyone, even if they are born outside the US. State is only required for US, Mexican, and Canadian born applicants. (Province for Canada, but entered in the state data field.)

f.

Home Address: must be a physical address; PO Box is not acceptable.

g.

Phone: include work and cell phone numbers as applicable. h.

Email: should be the applicant's personal email. It is important someone is reviewing emails at the address provided, as this is where instructions will be sent for completing the background investigation processes.

i.

Position Title: for the function the applicant will be performing on this contract/project.

j.

Prior Investigation: if the applicant has been investigated before, include date and agency that performed the investigation (estimated dates are acceptable).

k.

US Citizen: select the appropriate radio button--Yes or No. This must be answered by both US-born and non-US Born applicants.

l.

Non-US Citizens Only: must complete city and state of entry into the US, full date of entry (MM/DD/YYYY), alien registration number, and country of citizenship.

m.

Company Name (Sub) (if applicable): if the CIW is for an applicant who works as a subcontractor for the prime, put in the subcontract company name.

n.

Have applicant complete and sign OF306 as follows: 7.

Name format must be first, middle, last. If there is no middle name, put NMN in as the middle name. If initial only, enter the initial followed by (IO). Name should match that provided on the CIW and be the same as it appears on the applicant’s photo ID.

o.

All items must be answered, no blanks. p.

All data must be in the format as directed for each item on the form.q.

If any item 9-14 is answered “Yes”, ensure all information directed by the italicized print is included in the “Continuation Space” item 16.

r.

No extraneous marks of any type are permitted. s.

If born in the US, Canada (province) or Mexico, a state must be entered.

t.

It is recommended the OF306 be typed, but it will be accepted handwritten or in a combination of both, all handwritten portions must be clear and legible.

u.

Any corrections must be crossed out using a single line and each must be initialed and dated by the applicant.

v.

Any corrections not properly lined out and illegible forms will be rejected and resubmission must be typed.

w.

Applicant must sign/date on line 17a. Date must be legible. x.

Send completed CIW (Word document only) and completed/signed OF 306 via email to Zonal Help Desk.

8.

Both documents must be encrypted--no scanned CIWs will be accepted.

y.

File name of CIW/OF306 must be formatted with the applicant’s Last, First Middle-- document (i.e., Smith, Pete Jack--CIW or Doe, James Mike--OF306).

z.

After Zonal Help Desk receives the complete and accurate CIW, the applicant will receive two emails the first is the SAC Investigation Instructions from zone_-hspd12@gsa.gov (also sent to the prime vendor POC, Zonal Help Desk, and GSA POC) and the second is the enrollment instructions from HSPD12Admin@usaccess.gsa.gov.

9.

Ensure the applicant schedules an enrollment appointment, following the instructions below (provided in the email).

10.

Schedule an enrollment appointment at the nearest “SHARED” USAccess Credentialing Center and complete the fingerprint enrollment process as soon as possible at https://portal.usaccess.gsa.gov/scheduler, by single clicking on “Click to Schedule”.

aa.

They must bring two valid and non-expired forms of ID to complete their fingerprint enrollment. Two forms are required to validate their ab.

https://portal.usaccess.gsa.gov/scheduler

SAC Expiration and Re-Investigation identity, one of which must be a government-issued photo ID.

Their first and last names MUST match that submitted on their CIW.

To review a complete list of acceptable forms of IDs, please go to the following link: http://www.fedidcard.gov/viewdoc.aspx?id=109.

ac.

If they receive an email from the GSA Managed Service Office’s (MSO) USAccess program via HSPD12Admin@usaccess.gsa.gov stating that they do not need to enroll due to their previous enrollment, they can skip this step only.

ad.

If the applicant is more than 100 miles from a MSO USAccess Shared Credentialing Station, please email the Zonal Help Desk to determine how to best complete the fingerprinting process.

11.

Validate the applicant has completed the fingerprint enrollment process at an MSO Credentialing Center as scheduled. Failure to enroll within 30 days will result in cancellation of the SAC.

12.

Reach out to Zonal Help Desk for any support during the investigation process.

13.

Receives SAC Fitness Determination as evidence the applicant is authorized to begin work on the GSA contract/project.

14.

The vendor should complete one of the following steps:1.

Resubmit second applicant CIW SAC request, along with OF 306, 30 days prior to SAC expiration

Request the RO submit a revised ROCAL to the Zone changing the investigation type requested from a SAC to a Tier 1 first. This is to be done for any contractors issued a SAC that they now wish to convert to a Tier 1 investigation 30 days prior to the SAC expiration. After acceptance of the ROCAL by the Zone, the Vendor POC should then submit the applicant CIW to the Zone to initiate the Tier 1 investigation.

Let the SAC expire as there is no continuing need for access, update the

ROCAL

http://www.fedidcard.gov/viewdoc.aspx?id=109

Tier 1 or Higher Investigation Process

Full Legal Name

Position Title

Dates Required on Project

Venor Name (if subcontractor)

Name of Escort (if escort only)

Dates of Escort (If escort only) with the date removed from the contract and send updated ROCAL to the RO.

If assisting the applicant and discussing personal information, always verify the applicant’s full legal name, DOB, and SSN is correct before sending in any paperwork.

1.

Receive training covering all aspects of the fitness determination process from the Zonal Help Desk. At the completion of training the following forms will be provided: RO Contractor Approval List, CIW template, and SF 85/85P Worksheet.

2.

Prepare RO Contractor Approval List to include the following for all contractors who will be working on the contract/project:

3.

Send completed RO Contractor Approval List to GSA RO for approval. 4.

If personnel are added to or removed from the contract/project a new RO Contractor Approval List must be submitted to GSA RO for approval. Any CIWs received for personnel who do not appear on the RO Contractor Approved List will be rejected.

E.

Have applicant complete section 1 of the CIW as follows (If an individual changes from one contract to another, a new CIW is always required.):

F.

Name: full legal name, including full middle name. If no middle name, enter NMN. If the middle name is only an initial, enter the initial and (IO).

The name on the CIW must be the same as it appears on the applicant's photo ID.

f.

Suffix: select the appropriate response from the drop-down window. g.

Gender: select the appropriate response from the drop-down window. h.

Social Security Number: from applicant’s social security card. i.

Date of Birth: as it appears on the applicant’s birth certificate. j.

Place of Birth: city of birth and country (as it appears on the birth certificate) are needed for everyone, even if they are born outside the US.

State is only required for US, Mexican, and Canadian born applicants.

(Province for Canada, but entered in the state data field.)

k.

Home Address: must be a physical address; PO Box is not acceptable.l.

Phone: include work and cell phone numbers as applicable. m.

Email: should be the applicant's personal email. It is important someone is reviewing emails at the address provided, as this is where instructions will be sent for completing the background investigation processes.

n.

Position Title: for the function the applicant will be performing on this contract/project.

o.

Prior Investigation: if the applicant has been investigated before, include date and agency that performed the investigation (estimated dates are acceptable).

p.

US Citizen: select the appropriate radio button--Yes or No. This must be answered by both US-born and non-US Born applicants.

q.

Non-US Citizens Only: must complete city and state of entry into the US, full date of entry (MM/DD/YYYY), alien registration number, and country of citizenship.

r.

Company Name (Sub) (if applicable): if the CIW is for an applicant who works as a subcontractor for the prime, put in the subcontract company name.

s.

Send completed CIW (Word document only) via email to Zonal Help Desk. a. CIW must be encrypted--no scanned CIWs will be accepted.

G.

File name of CIW must be formatted with the applicant’s Last, First Middle-- document (i.e., Smith, Pete Jack--CIW).

t.

After Zonal Help Desk receives complete and accurate CIW the applicant receives several emails:

H.

Tier 1, 2, and 4 Investigation Instructions from zone_-hspd12@gsa.gov(also sent to prime vendor POC, Zonal Help Desk, and

GSA POC).

u.

NOTE: If applicant is more than 100 miles from a MSO USAccess Shared Credentialing Station, please email the Zonal Help Desk to determine how to best complete the fingerprinting process

If you have previously completed an eApp questionnaire, use the username and password you configured in eApp. If you cannot remember the information or need it reset, contact the help desk for assistance. Go to https://myinvestigation.nbis.mil/subjectportal/ to login and complete your application.

The enrollment instructions from HSPD12Admin@usaccess.gsa.gov.v.

Steps to complete the eApp login process. w.

Ensure the applicant schedules enrollment appointment, following the instructions below (provided in the email).

I.

Schedule an enrollment appointment at the nearest “SHARED” USAccess Credentialing Center and complete the fingerprint enrollment process as soon as possible at :https://portal.usaccess.gsa.gov/scheduler, by single clicking on “Click to Schedule”.

x.

They must bring two valid and non-expired forms of ID to enroll for their USAccess credential. Two forms are required to validate their identity, one of which must be a government-issued photo ID.

y.

Their first and last names MUST match that submitted on their CIW. To review a complete list of acceptable forms of IDs, please go to the following link: http://www.fedidcard.gov/viewdoc.aspx?id=109.

z.

If they receive an email from the GSA Managed Service Office’s (MSO) USAccess program via HSPD12Admin@usaccess.gsa.gov stating that they do not need to enroll due to their previous enrollment, they can skip this step only.

aa.

Validate the applicant has completed the fingerprint enrollment process at an MSO Credentialing Center as scheduled.

J.

It is recommended that the applicant use the SF85/85P Worksheet to allow them to collect all required information needed prior to completing the online eApp application. This form must not be submitted in lieu of completing the on-line eApp application. It is a worksheet for the applicant’s use only.

K.

Assist the applicant in accessing eApp L.

https://myinvestigation.nbis.mil/subjectportal/ mailto:HSPD12Admin@usaccess.gsa.gov

OR

NOTE: Applicant will need a username and password to re-enter the application if it times out; if they need to step away from it before completion; or the application is rejected after released for processing

You will receive two emails from NBIS, one with a user ID and the other with a temporary password. The email will contain the link to eApp.

A.

You will sign in using the user ID provided in the first email and the temporary password provided in the second email.

B.

You will then create a new password after entering your Social Security Number and Date of Birth.

C.

Once you have created your new password, you will sign in with your user ID and password. For each eApp login, you will receive an email containing a one-time passcode to use to confirm your identity.

D.

Complete the online application as soon as possible to avoid delays.E.

After completing and releasing your eApp, the review process will start. F.

Completing eApp - failure to timely complete this process will delay the investigation and prevent them from receiving their enter-on-duty determination (EOD). Do not release the eApp application until they have completed their fingerprint enrollment. Without an EOD they will not have access to GSA facilities.

M.

Follow the onscreen instructions to complete the security questionnaire. Use the save function often and answer all applicable questions. If they log off without completing the security questionnaire, and return at a later time, they will be able to resume where they left off.

a.

In the residence section--be sure to list a verifier with their complete mailing address (to include St., Ave., Blvd., as applicable) and phone number.

b.

In the employment section-- They must list their supervisor’s name, address (to include St., Ave., Blvd., as applicable) and phone number.

c.

Select “Certify Investigation Request” to complete their security questionnaire. v. Select “Signature Forms” link.

d.

Select “Yes” next to “Do you agree to utilize the click-to-sign functionality on all relevant forms?”

e.

NOTE: While assisting the applicant in completing their eApp application they must be present throughout the process.

Escort-Only (EO) Contractor Review Process

Ensure they have completed their fingerprint enrollment process before they release their completed eApp application. Select “Release Request/Transmit to Agency” to finalize their eApp questionnaire.

f.

eApp Invitations will be limited to two invitations per applicant. If an applicant fails to complete their eApp after two attempts, they will be unable to reApply for a GSA Security Investigation for 1 year.

N.

Contact Zonal Help Desk for support during the investigation process.O.

Receive enter-on-duty and/or final fitness determination as evidence the applicant is authorized to begin work on the GSA contract/project.

P.

If an applicant receives, “Must Wait for Final Notification”, they must wait to receive final determination before beginning work on any GSA project. This notification means there was something that prevented OPM from issuing a favorable EOD. NOTE these can take 3-24 months to complete.

Q.

If an applicant receives an unfit determination, they cannot work on GSA contracts under any circumstances. If they previously received enter-on-duty, they must be removed immediately and credentials must be returned to regional OMA Staff. They must wait 1 year to reapply for a new background investigation.

R.

Zonal Help Desk verifies whether the applicant’s name is listed on the RO Contractor Approval List, including dates they will be working. If the applicant's name does not appear on the RO Contractor Approval List, the CIW is rejected back to the vendor.

1.

Ensure CIW is properly completed. If CIW is incomplete, it will be immediately rejected back to the vendor for corrections.

2.

Ensure submittal email contains full legal name of individual escorting applicant and whether they are a federal employee, FPS security contractor or GSA contractor with

3.

Based on a review of GCIMS, this individual has never been found unfit by GSA:

Last, First Middle (Suffix):

Vendor Prime:

Contract Number:

Dates worked on a GSA contract will be coordinated with and monitored by the GSA Requesting Official (RO). Escorting cannot be performed while an investigation (SAC or Tier) is pending. The RO is responsible for ensuring the escort and escorted personnel follow the GSA escort policy.

Escort:

Temporary Contractor/Escortee:

Please contact the Help Desk at the phone number or email address listed below if you have any questions.

the appropriate credentials. The email must also contain the dates of escort.

If the applicant was previously found unfit, the request will be rejected back to prime vendor POC and GSA POC(s) indicating due to a previous unfit determination, the individual cannot be escorted in the facility for any reason.

4.

Ensure escort is either a federal employee, FPS security contractor, or GSA contractor who is in possession of a GSA issued PIV credential. If the escort does not meet these requirements, the request will be rejected back to prime vendor POC and GSA POC(s) indicating a new escort meeting the requirements must be submitted.

5.

If the escort meets these requirements and the applicant has not previously been found unfit, the following notification will be sent to the prime vendor POC and GSA POC(s) as proof of EO review:

6.

Must be a GSA contractor who is in possession of a GSA issued PIV credential, a federal employee or Federal Protective Service security contractor.

Responsible for the whereabouts and activities of escorted personnel at all times●

Must remain within line of sight of escort at all times while in non-public space● Can only be escorted a total of 15 days per contract●

NOTE: Individuals in the process of completing a GSA fitness determination are not allowed to be escorted.

Contractors with Prior Investigations

The following individual’s record has been updated and they are approved to work on the GSA contract/project, without further investigation. Details are listed below:

Last, First Middle (Suffix):

Determination on Record (SAC, Tier 1, etc.):

Vendor Prime:

Contract Number:

The appropriate credential has been requested as applicable based on the CIW provided and the RO Contractor Approval List.

NOTE: If you already have an active GAC/PIV this notification is for informational purposes only.

US Residency Requirement

The vendor will need to submit updated CIW to the Zonal Help Desk via encrypted email for every new contract or work order.

1.

Break in Service: Any contractor with a greater than 2-year break in service from their last contract/work order, will need to submit a new CIW, update their application within eApp for a Tier 1 or above investigation and may need to enroll as instructed. Access under the new contract/work order shall not be granted until such time they receive an approval email under the new contract/work order.

a.

Break in Service: Less than a 2 year break. When update has been completed the applicant, the prime vendor POC, and the GSA POC will received the following notification:

b.

Contractor Credential

A Tier 1 or above investigation cannot be conducted on non-US born applicants who have less than 3 years of continuous U.S. residency.

1.

The process for a non US-Born applicants with less than 3 years residency is as follows:

2.

The vendor will need to submit a complete Tier 1 investigation package.

Once OPM has confirmed immigration status, they will perform only a

SAC.

a.

If the SAC is favorable, the individual will be eligible to be on site for 6 months. If access is needed beyond the initial 6 months the vendor will need to submit a new Tier 1 investigation package 30 days before the SAC expires.

b.

This process will be repeated until access is no longer needed or untill the 3-year residency requirement is met, at which time a new Tier 1 investigation must be initiated.

c.

The GSA requesting official determines if the contractor requires fitness determination and GAC/PIV. GAC/PIVs are required for building access in some locations and network access in all locations. An EOD determination status must be verified prior to GAC/PIV issuance. Individual must have EOD determination in the process of a final Tier 1 or above to receive a GAC/PIV. GAC/PIVs are not issued to individuals with only a SAC. SAC credentials are yet to be determined.

1.

HSPD-12 PIV or GSA Access card (GAC/PIV) is required when contractors need IT access and optional (per RO approval) for routine access to GSA facilities for 6 months or more. The expiration date printed on the front of the GAC/PIV card does not represent the contract end date. The credential must be returned to GSA when the individual is no longer working on the GSA contract, regardless of the card expiration date.

The IT certificates assigned to the card expire 3 years from the date it is activated. 3.

GSA USAccess will send email reminders at 45 days, 30 days, and 15 days prior to certificate expiration. The email will include how to set up a “Certificate Update” appointment at a USAccess Credentialing Center. Some Zonal Help Desks have the ability to refer contractors who need certificate updates to Lightweight Credentialing Stations (not listed on the appointment website). The email notification and certificate update process works, if the following conditions are met: the applicant supplied a monitored email address on the CIW; the card is active--not suspended or terminated; there are no pending data changes, such as the name on the card or a reprint/reissue request; or the certificates have not already expired or are going to expire within 24 hours.

Excerpt from FAR 52.204-9 Personal, Identity Verification of Contractor personnel-

- ”The contractor shall comply with agency PIV procedures identified in the contract that implement HSPD-12, OMB guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201. The contractor shall account for all forms of Government-provided identification issued to the contractor employees in connection with performance under this contract. The contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government: 1) When no longer needed for contract performance. 2) Upon completion of the contractor employee's employment. 3) Upon contract completion or termination. The CO may delay final payment under a contract if the contractor fails to comply with these requirements. The contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally controlled facility and/or routine access to a federally-controlled information system. It shall be the responsibility of the prime contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.”

4.

If the card is lost or stolen and cannot be collected and returned, the vendor will need to take the following steps:

5.

Step 1. Vendor Point of Contact (POC) or contractor contacts the FPS Megacenter at 877-437-7411 to obtain a incident number for the lost or stolen card a.

Step 2. Vendor POC or Contractor emails GSA Requesting Official (RO) that a GSA Access Card is lost or stolen. Providing the full legal name and incident number.

b.

NOTE: ALL credentials must be turned in to the GSA RO at the end of the contract or when the individual has completed his/her duties on the contract whichever is sooner.

GSA Access Card/PIV

Roles and Responsibilities

Prime Vendor POC 1.

Attends training provided by the Zonal Help Desk regarding the investigation process.

a.

Initiates RO Contractor Approval List to include full legal names and associated information for all contractors who will be working on contract/project and sends it to RO for approval.

b.

Assists contractors and subcontractors in completing all investigation requirements within time constraints.

c.

Notifies RO (via an updated RO Contractor Approval List) of anyone being d.

Investigation Documents

Common Causes of Unfit Determination

This is in no way inclusive and is provided to show examples of unfit determination added to contract/project and anyone leaving the contract/project. Ensures all GSA credentials are returned to the RO for those leaving the project or at the end of the project.

Vendor Applicant 2.

Completes section 1 of the CIW.e.

Schedules and enrolls at MSO station for fingerprints per enrollment email.f.

Completes OF306 and/or eApp as applicable for the type of investigation requested.

g.

SAC 1.

CIW a.

MSO or SF87 Fingerprintsb.

OF306, Declaration for Federal Employment c.

Tier 1 and above 2.

CIWd.

MSO or SF87 Fingerprints e.

SF85 or 85P on-line eApp application f.

Use of illegal drugs within the past year. 1.

Omissions and/or untruthful information provided. 2.

Common Delays and Errors in Investigation Process

This is in no way inclusive and is provided to show examples of delays in the investigation process.

Offenses without completion of court assigned penalties. 3.

Recent criminal offenses.4.

Incomplete/inaccurate/inconsistent information provided on CIW. 1.

Incomplete/inaccurate/inconsistent information provided on eApp questionnaire or attached forms (CIW, OF306, etc.).

2.

Not completing fingerprints prior to submitting the eApp. 3.

Hard-copy fingerprints, which take longer than electronic prints.4.

Inconsistent/incorrect SSN and/or full name on all forms. 5.

Not responding timely to email inquiries for clarification. 6.

Lengthy response times from law enforcement agencies. 7.

The contract company’s failure to emphasize the importance and priority of the investigation to its employees. Successful companies typically assign a responsible employee to track and review investigation forms being submitted, and assisting with the overall process.

8.

Failing to ensure additional information requests are brought to the attention of the employee, and ensure compliance with the request.

9.

Individual contract employee’s failure to submit all the required documents.10.

Submission of illegible forms. 11.

Forms submitted with cross-through or write-overs. 12.

Inconsistent information on fingerprint cards, if applicable. They must match all other documents (full name must be the same), and must also match ID used at the time of fingerprinting.

13.

Incomplete eApp questionnaire. Must include complete addresses (including zips, Ave, St, Blvd, etc.) for residences, schools, and references.

14.

Failure to submit electronically-signed eApp pages. 15.

Notification of Investigation Status

Note: The Zonal Help Desk, applicant, prime vendor POC, and GSA requesting official will receive all of the above fitness determination notifications via e-mail.

Failure to submit the forms correctly within specified timeframes and to respond timely to additional information requests.

16.

An enter-on-duty determination is the notification that allows long-term contract employees to begin working on GSA contracts pending the completion of their full Tier 1 or higher investigation. It is at this time that a GAC/PIV may be produced, as needed.

1.

There are times that an applicant will receive a notification entitled “Will Need to Wait for Final Fitness Determination”. This occurs when something is discovered during the preliminary background investigation that is of concern and/or is unclear. Due to this issue, OPM will not make an enter-on-duty determination until the final investigation results are received. The final fitness determination can sometimes take several months. Until the final results are received, the individual is not authorized to work on GSA contracts, even under escort. The contract company, under consultation with the GSA RO, may need to consider selecting another applicant to work on the GSA contract, if the work they were scheduled to perform will begin soon.

2.

A SAC determination is typically received within a few days of the applicant submitting all the required information. The SAC determination allows access for only 6 months. If an individual changes from one contract to another, a new CIW is always required.

3.

A final fit determination will be provided by OPM for all Tier 1 or above investigations. This allows the individual to work continuously on GSA contracts without expiration, provided there is no break in service of greater than 2 years. If an individual changes from one contract to another, a new CIW is always required.

4.

In the event an applicant cannot be found suitable to access GSA facilities, a final unfit notification will be provided by OPM. This notification will be sent to Zonal Help Desk, applicant, prime vendor POC, and GSA requesting official. An individual receiving this determination cannot work in any GSA facility even under escort. The applicant cannot reapply for a new investigation for a period of 1 year and there is no appeal process.

5.

Terms and Acronyms

CIW--Contractor Information Worksheet (Form

850) CO--Contracting Officer COR--Contracting Officer’s Representative DOB--Date of Birth EOD--Enter on Duty Determination GAC--GSA Access Card Report GQ--Golden Questions HSPD-12--Homeland Security Presidential Directive 12 IT--Information Technology IO--Initial Only MSO--Managed Service Office OF 306--Declaration for Federal Employment OMA--Office of Mission Assurance OPM--Office of Personnel Management PII--Personally Identifiable Information PIV card--Personal Identity Verification card PM--Project Manager POC--Point of Contact RO--Requesting Official SAC--Special Agreement Check SF--Standard Form SSN--Social Security Number

Attachment 1, How to Encrypt Documents Using WinZip

1. Right click on the document you want to zip.

2. Click on WinZip then Add to Zip file.

3.

Open the zip file wherever it is saved. Switch the Encrypt button to on.

4. Click on Options and select Apply to all files in the Zip.

5. Click Ok to continue. Then create a password and input it into the appropriate blocks.

This password must be emailed to the Zonal Help Desk in an email separate from the encrypted documents.

6. Click Save and you are finished.

Attachment 2, Completing the eAPP

OR

If you have previously completed an eAPP questionnaire, use the username and password you configured in eApp. If you cannot remember the information or need it reset, contact the help desk for assistance. Go to https://myinvestigation.nbis.mil/subjectportal/ to login and complete your application.

1.

You will receive two emails from NBIS, one with a user ID and the other with a temporary password. The email will contain the link to eAPP.

a.

You will sign in using the user ID provided in the first email and the temporary password provided in the second email.

b.

You will then create a new password after entering your Social Security Number and Date of Birth.

c.

Once you have created your new password, you will sign in with your user ID and password. For each eAPP login, you will receive an email containing a one-time passcode to use to confirm your identity.

d.

Complete the online application as soon as possible to avoid delays.e.

After completing and releasing your eAPP, the review process will start.f.

Applicant then begins entering all their information as requested in the application by following the onscreen instructions to complete the eApp questionnaire. They must use the save function often and answer all applicable questions. (When inputting verifiers, they must use complete mailing addresses (Ave, Blvd, St, etc.) and phone numbers. the employment section, they must not

1.

https://myinvestigation.nbis.mil/subjectportal/

NOTE: If an applicant was born overseas of US parents, follow these instructions: under item 7a, check the block, I am a US citizen, but I was NOT born in the US. Then answer items 7b and 7c. Item 7b, provide your mother’s maiden name. Item 7c, indicate what documentation for foreign birth of US citizen was provided: Consulate Birth Abroad document (FS240, FS545, or DS1350) if your birth was registered with the State Department and you were provided one of these forms, provide the following pieces of information: date the form was prepared and give an explanation if needed. Citizenship Certificate (DHS) if your birth was registered with Homeland Security and this certificate was provided to you, then you will need to provide the following piece of information: where certificate was issued; city;

state; certificate #; and month/day/year of issue. If the subject is unsure of what was issued and they hold or have held a US passport, provide that information in section 7c.

OPM will verify the passport number with the State Department.

Entering Data and Validating Errors

6. Applicant continues following the instructions in the application to ensure these errors are corrected. If the information is correct, press continue to go to the next screen.

After they have completed filling in all the required information, click on Continue. If they log off without completing the eApp questionnaire, and return at a later time, they will be able to resume where they left off.

Certifying Their Answers

7. Once they have input all of the required application data and reviewed the archival copy they select “Certify Investigation Request”. Then they must electronically sign their signature pages by selecting “Signature Forms” link. To do this, they will need to select “Yes” next to “Do you agree to utilize the click-to-sign functionality on all relevant forms” and then re-enter their eApp password and select “Continue”. The final step is to select the “Click Here to Sign” link in the signature block.

8. The next steps in the process are imperative. If not properly completed, these steps will delay and/or cause their investigation to be rejected. Any corrections and/or write-overs on these forms will not be accepted; the forms must be signed and dated very carefully. Then forms must be reviewed prior to submission to ensure that all required use the button that says

“supervisor same as employer” as they must list their supervisor’s name, address, and phone number). If they encounter validation errors, they must be resolved before the process can be completed.

a.

information is included. The full name on all these forms must be the same as that on their photo ID. Social security number must also match on all the documents.

Release Request to Agency

10. The last step is very important, as their investigation will not begin until they have released their application. They do this by selecting “Release Request/Transmit to Agency” to finalize their eApp questionnaire. Make sure they have completed their fingerprint/enrollment process before they “Release Request/Transmit to Agency” to complete their eApp application.

Attachment 3, Example Email for SAC Applicants

SUBJECT: GSA Special Agreement Check (SAC) Fitness Determination Applicant Instructions (less than 6 month)--APPLICANT NAME

You are not allowed to work on any GSA project until you…