New PIV Card Readers Debut at All NIH Main Campus Perimeter Entrances June 30, 2014

Starting Monday morning, June 30, 2014, NIH will activate the new PIV card readers controlling access to all NIH main campus perimeter entrances.  

Drivers and pedestrians with PIV cards who enter the NIH campus will need to remove their cards from their protective cases, and then touch and hold the cards to the face of the readers to open the gate or turnstile.    

Important: Removing the card from the reader too quickly may result in a misread and the gate will not open.    

Individuals with NIH Legacy badges should still be able to use their badges to access the NIH campus.  

HHS mandated the installation of the new reader system at NIH to comply with Department security policies relating to Homeland Security Presidential Directive 12 (HSPD-12).  

Still time to test your PIV card - and avoid delays 

Getting a green light at the NLM test kiosk

Employees, contractors and affiliates still have time to test their PIV cards at one of the seven kiosks located in buildings across the NIH campus and the Bayview Research Center, Baltimore, before NIH activates the new readers.

DPSAC is encouraging everyone to test their PIV Card at a kiosk to make sure it works before the June 30 changeover.  

If your card doesn't work at the kiosk, it's likely that the antenna embedded in the card is broken and you'll need to have your badge replaced.*  

Discovering a problem at the kiosk --  before you need to use your card with the new readers to enter the campus -- will save you time and inconvenience, and will make the people waiting in line behind you much happier.    

Where to find a kiosk  

Kiosks are installed in the lobbies of Building 31 A and C wings, Building 45, Building 10 (Clinical Center) North and South, Building 38 (NLM loading dock entrance), and Bayview Research Center, Baltimore, MD

Staff at 9609 Medical Center Drive ('Shady Grove') should be aware that the card readers in service at that building's entry portals use the same technology as the readers at the NIH main campus perimeter. If your HHS ID Badge/PIV Card works at your building entrance, it will work for campus entry. If the card doesn't work at your entrance, it will need to be replaced.

Portable testing station travels to off-campus locations -- ORS has been sending a trained staff member equipped with a portable testing device to several off-campus locations. The remaining schedule for this service is provided below:

If your PIV Card is broken -- you will need to make an appointment with DPSAC's Facility Access Control ([email protected] or 301-451-4766) or at other NIH Badge Issuance locations (including: Rocky Mountain Laboratories, MT; Research Triangle Park, NC; Bayview Research Center, Baltimore, MD; the Frederick National Laboratory for Cancer Research) to have your badge reissued.   

Important: If you find that your PIV Card is broken and the card's expiration date is within 180 days, contact your AO for an early badge renewal.

* DPSAC reports that some of the early PIV Cards may contain broken or defective antennas that would normally transmit the signal needed to operate the new PIV Card readers. The PIV Card contains two antennas: the old PIV Card reader uses the antenna that operates by proximity; the new reader uses the other antenna, receiving the card's data only if that antenna is in physical contact with the reader.    

NIH To Begin Issuing New  

'Restricted Local Access (RLA) Badge' in July, 2014

NIH will soon begin issuing a new type of identification credential, the Restricted Local Access (RLA) Badge to NIH staff who fall into one of three categories:

1.  Short-term staff at NIH less than six months   

2.  Summer Students beginning in 2015

3.  Foreign Nationals

Release of the new badge, originally scheduled for July 1, will occur later in July once DPSAC is in receipt of the card blanks used in printing the new badges. DPSAC will notify the administrative community when the new badges become available.

When an AO requests an ID badge in the NIH Enterprise Directory (NED) for anyone in these categories, an RLA Badge will automatically be triggered.  While this change should have no impact on the current NED workload for the administrative community, DPSAC wants to make sure the community is aware of these important changes to avoid any confusion. 

The RLA Badge lifecycle 

The RLA Badge is valid for 3 years when issued to foreign nationals. RLA Badges issued to short-term staff are valid for a maximum of 6 months. When RLA Badges are issued to summer students beginning in 2015, they will be valid through September 30 of the year issued.

NIH worked with HHS to develop the RLA Badge in order to meet HSPD-12 security guidelines for individuals who do not qualify for an HHS ID Badge (PIV Card).  

The new RLA Badge is an NIH-issued smart card that can be used for physical access to NIH facilities and logical access to NIH information systems, and will allow people in the above categories to log in to NIH networks in a more secure fashion. It looks similar to the HHS ID Badge and will contain an embedded computer chip and an orange stripe.

The Process to Get an RLA Badge

The process to get an RLA Badge will be similar to the PIV process used to issue HHS ID Badges.

1. Badge request in NED

When you request an ID badge for anyone in the above categories, NED will automatically default the request to an RLA Badge.

2. Enrollment appointment with DPSAC

All individuals receiving an RLA Badge will need to complete an enrollment appointment with DPSAC. Enrollment appointments are 20 minutes and consist of identity proofing, fingerprint capture and a photograph. The individual will need to show two IDs, one of which must be a Federal or State photo ID.

3. Background investigation forms

Everyone receiving an RLA Badge must complete the appropriate background investigation. Short-term and intermittent staff will undergo a fingerprint check only (cost to the IC of $21.50). Foreign nationals will undergo the appropriate investigation based on their position at NIH and length of time in the United States. DPSAC will ensure that individuals receive the appropriate forms to complete (if required).

4. Badge issuance

Once all of the above steps are completed, individuals will be instructed to schedule an appointment to pick up their RLA Badge. Badge issuance takes approximately 20 minutes to complete and individuals must bring their photo ID to their appointment.

Any individuals for whom you enter badge requests in NED BEFORE July 14 will not receive an RLA Badge. Only badge requests made in NED ON/AFTER July 14 will receive the RLA badge. Any individuals in the above categories who currently possess an HHS ID Badge or NIH Legacy Badge will receive an RLA Badge when their current badge is renewed.

Special Notes Regarding Foreign Nationals

1. Badge expiration dates: NIH sees a large number of foreign nationals who join our workforce each July. If these foreign nationals have a badge requested in NED before July 14, NED will default to a 5 year HHS ID Badge. Any badge requests for foreign nationals after July 14 will be defaulted to a 3 year RLA Badge.

To avoid confusion among your foreign national staff, ICs may want to begin adjusting the expiration date in NED to 3 years instead of 5 years for any HHS ID Badge requests made before July 14. This would help ensure that all new foreign nationals in your IC receive a badge for the same length of time.

2. No Social Security Number: Please be advised that DPSAC will NOT issue any type of ID badge to individuals without a Social Security Number (SSN). Individuals without an SSN must access the NIH facilities as a daily visitor.

3. Alien Authorized to Work Until Date (AAWUD): The Division of International Services (DIS), ORS, must clear all foreign nationals placed at the NIH before badge issuance. This clearance ensures that foreign nationals are lawful to be in the U.S. and are authorized to work at the NIH.

The AAWUD is an important date in that it marks the end date of a foreign national's work authorization, which is determined by the DIS and entered by the DIS into NED.

Please note that if the AAWUD lapses, NED will immediately initiate a revocation of the affected foreign national's ID badge. Therefore, it is important for the NIH administrative community to initiate new or renewal requests to the DIS in a timely manner to avoid unnecessary revocation.  

At the three-year mark of residence in the U.S., a background check requirement will be triggered and the IC will be billed accordingly.   

NED v3.6 Release incorporates changes relating to the RLA Badge 

A June 16 communique from the NED Team to the NED AO/AT community describes support for the new RLA badge. To view this e-mail, click on: Important: NED v3.6 Release - June 30, 2014.   

For additional information about RLA

The HSPD-12 Program Office will be offering basic and advanced NED classes on July 9, 2014. This training is designed to help beginners and advanced users quickly master NED in a hands-on computer lab environment. All classes are FREE! 

Additional Classes in FY2014    

How to Enroll

To log onto the HHS Learning Management System you can use either your PIV card and PIN or your NIH credentials. If you experience any difficulties accessing the LMS, please contact the CIT Training Program at 301-594-6248 or send an e-mail to: [email protected]. 

News Briefs

HSPD-12: Is government's glass half full or half empty?

Excerpted from the May 29, 2014 issue of GCN.com

By (ISC)2 Government Advisory Board Executive Writers Bureau

The Heartbleed scare that shocked the Internet world in April reinforced the reality that the age of password-based authentication has ended. Shared secrets stored in vulnerable databases are simply not protected by single-factor identification.  

The security community has long known that a secure second factor, bound to an assured identity, is the key to defending the IT ramparts from even more sophisticated attacks. And while the financial industry is resisting the use of multifactor smart cards, the federal government has been focused on smart card technology since issuing Homeland Security Presidential Directive 12 (HSPD-12) almost a decade ago.

HSPD-12 was an unfunded mandate with the ambitious goal to issue "secure and reliable forms of identification for government employees and contractors ... including contractor employees." These credentials were to be used for multifactor logical and physical access to both facilities and information systems.

The HSPD-12 mandate is approaching its 10th anniversary on Aug. 27, 2014, an opportunity to assess the degree to which the directive has been followed.  

While the White House recognizes the program as a top IT security priority, and congressional attention to the topic promises to grow as the election season gets closer, a truer measure will be an assessment of how widely the technology is being used to secure federal IT systems.

To read the full article, please click on: HSPD-12