February 3, 2016 issue of the DPSAC NEWS

In This Issue

Spotlight on...Employees

Spotlight on Contractors Revisited: Foreign Nationals

Make ORS Personnel Security Your 1st Stop When Seeking Assistance from Another OPDIV

(Optional) Two-Factor Authentication for e-QIP

AOs & ATs: Watch for Renewal Notices for Temporary 6-Month Badges

Helpful Tips

News Briefs - Feds to Overhaul Background Investigation System

FAQs

Safety Corner . . . Strange Odor in the Workplace?

NED Training Schedule for Remainder of FY '16

ID Badge Rollout Scorecard

Past Issues

Contact Us

Division of Personnel Security and Access Control (DPSAC),

Office of Research Services

Personnel Security

Helpdesk: 301-402-9755

E-mail: orspersonnelsecurity@

mail.nih.gov

Access Control

Helpdesk: 301-451-4766

E-mail: facilityaccesscontrol@

mail.nih.gov

This is the eighth in a series of articles spotlighting position classifications that the NIH uses to determine the type of badge it can issue. Based on the individual's classification, s/he will be eligible for either an HHS ID Badge (PIV Card), an RLA Badge or an NIH Legacy ID Badge.

Determining an individual's correct classification is an important first step in the badge issuance process since it helps ensure that each person requiring access to NIH facilities and resources is vetted appropriately and qualifies for one of the three badge types.*

Classification: NIH FTE (Employee)

(the classification in the NED Portal appears as NIH FTE - including GS, SES, Title 42, etc.)

Who is an Employee?

An Employee is an individual who is Wage Grade (WG), Wage Leader (WL), Wage Supervisor (WS), General Schedule (GS), Senior Executive Service (SES), Scientific and Professional, Senior Biomedical Research Service (SBRS), Title 42, Title 38, Title 32, Senior Leaders, and Students (other than Summer Students).

Who is NOT an Employee? While everyone who works at NIH is loosely referred to as an 'employee,' DPSAC must distinguish between 'Employees,' and 'Contractors' since these classifications reflect different hiring standards and policies that determine whether the individual will be issued an Employee Personal Identity Verification (PIV) Card or a Contractor PIV Card. A Contractor is a non-NIH employee or trainee who works for a company paid by NIH for services rendered via a procurement vehicle to provide program support services.

Type of badge issued to Employees

Employees are issued a Personal Identity Verification or "PIV" Card (also known as an HHS ID Badge).

If an Employee is a foreign national or will be working at NIH for less than six-months, he or she will be issued a Restricted Local Access (RLA) badge with an orange stripe.

Figure 1

The PIV Card has a gold-colored computer chip on the face of the badge that stores data for identification (NOT personally identifiable information or PII), as well as for physical access to the NIH campus and controlled facilities and (if required) for logical access to NIH IT services.

The Employee's PIV Card has a white stripe (not visible against the white background of the card) containing the letter 'W.' (See Figure 1).

The Contractor PIV Card looks similar to and offers the same functionality as the Employee PIV Card, but is distinguishable from the Employee PIV Card by its green stripe containing the letter 'G' running horizontally below the individual's photo.

Are Employees entered into NED?
Yes. The Employee-applicant must be sponsored in the NED Portal by a PIV-approved sponsor before he or she can be enrolled and issued an ID badge.

Who processes the badge requests for Employees?
Once an IC AO with sponsor authority enters the Employee-applicant into NED, the individual will make an enrollment appointment with DPSAC.

Enrollment is a three-step process in which the applicant is identity-proofed, fingerprinted and photographed. Once enrollment is completed, AND the applicant has completed and submitted his or her e-QIP forms to DPSAC (or the person's e-QIP is on file), the applicant can proceed to the DPSAC badge issuance office to obtain a PIV card.

Note: in the PIV process, the Sponsor acts on behalf of NIH to request an applicant be issued an ID badge. Sponsor training must be completed and a signed certificate submitted to the HSPD-12 Program Office before a PIV Sponsor can request a badge for an applicant.

What background investigation is required for Employees?
Employee-applicants will be required to submit fingerprints and complete e-QIP (unless these items are already on file) in order to be issued a PIV Card or RLA Badge. All Employees will undergo a background investigation commensurate with their roles and responsibilities.

DPSAC submits the individual's fingerprints and completed e-QIP forms with attachments to the Office of Personnel Management (OPM) where the necessary and appropriate background investigation will be conducted.

The Division of International Services (DIS) is responsible for verifying that all non-immigrants (individuals who are not U.S. citizens or lawful permanent residents) placed at the National Institutes of Health (NIH):

Have been lawfully admitted to the United States, and
Are undertaking activities at NIH that are appropriate for their immigration status.

Such individuals must be cleared by the DIS before they are eligible for an NIH Identification Badge.

If the Foreign National (FN) is directly sponsored by the NIH, he/she must visit the DIS per their check-in procedures. To know if the FN is considered "NIH sponsored," he/she received an invitation letter and/or immigration documents directly from DIS. DIS will notify DPSAC that the FN checked in and is cleared for a badge.

How long is the badge good for?
Employee PIV Cards (HHS ID Badges) are issued to individuals who will be working at NIH longer than 6 months. Typically these badges have a 5-year life cycle (3-year life cycle for RLA Badges). At the end of the badge's life cycle, the badge holder will be required to renew his or her PIV Card.

Please note that any Employee who will be working at NIH for less than 6 months will receive an RLA Badge that is valid for a maximum of 6 months.

What else should you know about Employees?

Switching ICs?

If an Employee takes a position in another IC but will remain an Employee in NED, no new PIV Card is required. The existing badge will still be able to provide access to NIH facilities and IT systems. The new AO may need to e-mail Facility Access Control to modify the employee's access privileges to his or her old and new buildings/offices.

Change in NED Classification?

DPSAC often sees Employees who change positions and NED classifications at NIH (e.g., an Employee retires and stays on at NIH as a Contractor). DPSAC also sees Contractors who become Employees in NED on a regular basis. Please know that these changes in NED have different impacts to the existing PIV Card the individuals possesses:

Contractor (or any other NED classification) to Employee: When a non-Employee NED record is updated to Employee (e.g., Contractor converting to Employee), the person's existing ID badge will remain valid until the individual receives his/her Employee ID badge. NED will automatically request the issuance of an Employee ID badge as soon as the NED record is updated to Employee.
Employee to Contractor (or any other NED classification): If an Employee NED record is updated to any other NED classification (e.g., Contractor), the Employee's existing ID badge will be revoked immediately. NED will automatically request the issuance of a new badge for the individual.

The Employee badge is revoked immediately since some activities at NIH are "inherently governmental" and DPSAC cannot allow a non-Employee to possess an Employee badge. This ID badge could give the impression that an individual is still authorized to complete "inherently governmental" functions when in reality he or she is not.

Disposition of an Employee's ID Badge
When Employees end their employment/affiliation with the NIH, they must turn in their ID badge to their AO/Sponsor. The AO/Sponsor must return the ID badge to DPSAC in Building 31, Room 1B03 or the local ID Badge issuance office.

Should you have questions about a classification, please call the DPSAC Helpdesk at 301-402-9755 or e-mail them at:

orspersonnelsecurity@mail.nih.gov

*The 'NIH Badging Authority by Classification Table' containing brief descriptions of all position classifications can be viewed on the DPSAC website at: http://www.ors.od.nih.gov/ser/dpsac/badge/Pages/applying.aspx

Spotlight on . . . Contractors Revisited: Foreign Nationals

The Division of International Services (DIS) is responsible for verifying that all non-immigrants (individuals who are not U.S. citizens or lawful permanent residents) placed at the NIH:

Have been lawfully admitted to the United States and

Are undertaking activities at NIH that are appropriate for their immigration status.
According to DIS, if you are a foreign national contract worker (i.e. your immigration status is sponsored by another employer and/or you are paid by that employer such as Leidos, MSC, Kelly Scientific Services, SRA International, etc.), please visit the DIS for clearance between the hours of 1:00 pm and 4:00 pm, Monday through Friday. No appointment is necessary.

Applicants are advised to review the "Summary of Requirements By Immigration Status" to assure they have all documentation necessary for clearance. Foreign Nationals in the Contractor category will not receive a badge without prior clearance from DIS.

NOTE: More information can be found on the DIS website at: http://www.ors.od.nih.gov/pes/dis/Contractors/Pages/
CheckingInDIS.aspx.

Make ORS Personnel Security Your First Stop When Seeking Badging Assistance from Another HHS Operating Division (OPDIV)

From time to time remote NIH employees, contractors, and affiliates will require assistance with identity proofing, enrollment, certificate renewal, and ID badge issuance. If an individual is unable to visit an NIH badging facility due to lack of proximity, please reach out to the NIH Division of Personnel Security and Access Control (DPSAC) to request scheduling an appointment at a non-NIH Health and Human Services (HHS) badging facility.

Please DO NOT reach out directly to non-NIH HHS badging offices for badging assistance.

AOs should contact ORS Personnel Security regarding remote badging services. There are existing agreements with the Program Support Center (PSC) in the following cities: Boston, New York City, Philadelphia, Atlanta, Chicago, Dallas, Kansas City, Denver, San Francisco and Seattle.

There are additional HHS badging facilities at locations not listed here that require DPSAC to communicate with on a case by case basis.

DPSAC will coordinate all of the badging services related to the remote individual. DPSAC encourages Administrative Officers (AO) to contact ORS Personnel Security at orspersonnelsecurity@mail.nih.gov in order to make the arrangements with the appropriate parties. Please contact ORS Personnel Security for any other inquires related to NIH badging.

(Optional) Two-Factor Authentication for e-QIP Enrollment Now Available

As of January 10, 2016, e-QIP applicants have the "option" of using two factor authentication when logging into e-QIP. This change will affect the login process for all e-QIP applicants.*

*Two-Factor Authentication provides an additional layer of protection that e-QIP Direct Applicants can opt into when they are logging into e-QIP. The applicant must use either a smartphone or a desktop application to download an app to complete the action.

Click on Two-Factor Authentication to view the illustrated Login Guide.

AOs and ATs: Watch for Renewal Notices for Temporary 6-Month Badges in your NED Inboxes

Temporary 6-month ID Badges issued during the summer e-QIP outage are coming due for renewal. As reported in the January 6, 2016 DPSAC News, a security breach at the Office of Personnel Management (OPM) caused the agency to shut down e-QIP between July 16, 2015 and August 25, 2015 while it remedied its security problems.

As a result, over that 6-week period, DPSAC issued temporary ID badges with the intention of re-issuing permanent ID badges at the end of the badges' 6-month lifecycle.

The NED Team and DPSAC are alerting AOs and ATs that renewal notices may appear in their NED inboxes for individuals with these temporary badges over the next two months.

Note: the background information request forms processed during this outage were paper. Since OPM did not accept these paper forms, anyone who falls into this category or still has a 6-month badge must complete the background investigation request online via e-QIP.

Helpful Tips

AOs who wish to obtain sponsor authority -- must complete the sponsor training (see:http://www.ors.od.nih.gov/ser/dpsac/Training/Pages/administrators.aspx) and e-mail a copy of your signed certificate to the NIH HSPD-12 Program Office at: hspd12@od.nih.gov. Upon receipt of the certificate, the Program Office will authorize the AO as a sponsor.

ICs that want to add Lifecycle Work Station (LWS) operators to the approved roster -- send a written request to Richie Taffet at: taffetr@mail.nih.gov. Your request should include:

the new operator's name
his/her IC
his/her NED number
the operator's e-mail address, building/room and phone number

Once Mr. Taffet has approved the request, he will forward the name(s) to HHSIdentityAdmins@deloitte.com to complete the approval process, add the name(s) to the LWS operator roster, and inform the IC that the individual is now approved to operate the LWS.

Need to make changes to the LWS operator directories? -- drop an e-mail to Lanny Newman, newmanl@mail.nih.gov, and let him know what needs changing (e.g., adding new operators or LWS locations, removing operators, etc.). Remember, before a new operator can be added to the LWS directory, s/he must first be approved by Richie Taffet (see preceding Helpful Tip).

If an LWS is not available in your IC or your immediate area, and you work in the greater Bethesda or Rockville area -- please call 301-402-9755 to schedule an appointment with the Division of Personnel Security and Access Control located in Building 31, Room B1A26 or in Building 10, South Lobby, Room 1C52.

If you work outside the Bethesda/Rockville area, contact your local badge issuance office. You can find contact information for all badge issuance offices at: http://www.ors.od.nih.gov/ser/dpsac/Pages/contactinfo.aspx
.

Know someone who could benefit by receiving DPSAC News? -- have the person contact Lanny Newman at newmanl@mail.nih.gov and ask to be put on the mailing list.

News Briefs

Modernizing & Strengthening the Security & Effectiveness of Federal Background Investigations

Federal government to overhaul background investigation system

The White House issued the following 'fact sheet' on January 22, 2016

January 22, 2016 at 11:00 AM ET by Jamal Brown

Summary: Today, the Government announced a series of changes to modernize and strengthen the way we conduct background investigations and protect sensitive data.

FACT SHEET: Modernizing & Strengthening the Security & Effectiveness of Federal Background Investigations

Today, the Administration is announcing a series of changes to modernize and strengthen how the Federal Government performs and safeguards background investigations for its employees and contractors.

The Federal Government is responsible for issuing, handling and storing much of America's most important data. The Government also performs key functions with these data, such as conducting background investigations to assess whether individuals may serve as Federal employees, members of the Armed Forces, or contractors, be granted access to its facilities and information systems, and be trusted with classified and other sensitive information.

Last year, in light of increasing cybersecurity threats, including the compromise of information housed at the Office of Personnel Management (OPM), the Administration initiated a 90-Day Suitability and Security review to re-examine reforms to the federal background investigations process, assess additional enhancements to further secure information networks and systems, and determine improvements that could be made to the way the Government conducts background investigations for suitability, security and credentialing.

This review was conducted by the interagency Performance Accountability Council (PAC).

The Administration is announcing today the results of that review, and steps we are taking to improve the Government's security clearance and background investigation processes for federal employees and contractors.

These actions include establishing a new federal entity, which will strengthen how the Federal Government performs background investigations.

The actions will also assign the Department of Defense (DOD) responsibility for the IT security of and data related to the background investigations systems for the new entity. These actions will create a more secure and effective Federal background investigations infrastructure.

Establishing a New Federal Entity to Strengthen How the Government Performs Background Investigations
OPM's Federal Investigative Services (FIS) currently conducts investigations for over 100 Federal agencies - approximately 95 percent of the total background investigations government-wide - including more than 600,000 security clearance investigations and 400,000 suitability investigations each year.

As part of the reforms being announced today, the Administration is establishing a new government-wide service provider for background investigations, the National Background Investigations Bureau (NBIB), which will assume this mission and absorb FIS.

NBIB will concentrate solely on providing effective, efficient, and secure background investigations for the Federal Government. NBIB will report to the OPM Director, but unlike the previous structure, DOD will assume responsibility for the design, development, security, and operation of the background investigations IT systems for the new entity.

Leveraging Expertise at DOD for Processing Background Investigations and Protecting Against Threats
To leverage the latest modern technology, protect the sensitive information used to effectively adjudicate investigations, and bring the fullest security resources to bear against increasingly sophisticated and evolving threats, NBIB's information technology systems will be designed, built, secured, and operated by DOD, in accordance with NBIB requirements.

This approach will leverage DOD's significant national security, IT, and cybersecurity expertise, incorporating security into the fundamental design of the systems, strengthening the security of the data environment, and providing robust privacy protections.

To support this work, the President's Fiscal Year (FY) 2017 Budget will include $95 million in additional resources that will be dedicated to the development of these IT capabilities.

These efforts are supported by the Federal Chief Information Officer's call to federal agencies to phase out the use of legacy IT systems, where possible, and begin utilizing emerging technological tools and capabilities to adequately secure mission functions, systems, and information.

Implementation

While these changes will take time to fully implement, the Administration has taken and will continue to take immediate action to move forward with strengthening the background investigations process:

Build on the Security Measures Implemented in Response to the 2015 OPM Cyber Incidents -- in response to cybersecurity incidents at OPM last year, the Administration has taken a number of steps to strengthen the security of background investigation-related systems, including: expanding implementation of strong authentication for all users; increasing the number of scans for indicators of compromise; patching critical vulnerabilities; tightening policies and practices for privileged users; and identifying and prioritizing high value assets for additional security.

OPM has also hired a new senior cyber and information technology advisor to support the ongoing response to these recent incidents, complete development of OPM's plan to reduce the risk of future incidents, and recommend further improvements to secure OPM's IT.

Establish an NBIB Transition Team -- the Administration will establish a dedicated transition team headquartered in Washington D.C. to develop and implement a transition plan.

To read the White House fact sheet in its entirety, click here.

To read excerpts from a recent NextGov article about this important government initiative, click on the link: After OPM Hack, Pentagon to Store and Secure Sensitive Security Clearance Docs

FAQs

Q. What is the difference between "revocation" of a person's ID badge and "deactivation" of their NED record?

A. Revocation refers to the disabling of a person's ID badge in the NIH Physical Access Control System (PACS) and the HHS Smart Card Management System (SCMS). When this occurs, the person is no longer able to use the badge for physical and/or logical access (i.e., in the case of a smart card).

For example, when an Administrative Officer (AO) reports a person's ID badge as lost in the NED Portal, or the expiration date printed on the ID badge is in the past, the person's ID badge is revoked, but the NED record remains "active."

NED deactivation occurs when a person separates from NIH and their NED record status changes from active to inactive. For example, when an AO submits a 'deactivate' task in the NED Portal, or NED deactivates the record based on a person's 'not to exceed' (NTE) date, the deactivation (of the NED record) initiates the revocation of the person's ID badge and/or NIH network account.

Note: external systems that use NED as a data source (e.g., NBS, GovTrip, ServiceNow) may also be affected following the deactivation of a person's NED record.

Safety Corner

Strange Odor in the Workplace?

The following fire safety awareness article was prepared by the Division of the Fire Marshal

Know what to do and don't spend time looking for the source of a strange odor - report it by dialing 911 on a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus and, if necessary, evacuate the area.

Construction In or Near Your Work Area

At times, work being performed in a construction site may generate odors not normally encountered in your work area. Don't assume that the odor is from the construction site or is a non-threatening material. The odor could be from a fire or a chemical odor from a hazardous materials spill in a nearby lab or in the hallway outside of your office.

Remember - never assume - dial 911 on a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus for assistance.

Familiar Burning Odor

Many times individuals will recognize an odor that is frequently encountered, for example an electrical odor, and a short time later, find that the odor has dissipated. At the end of the day they leave work only to return the next morning to find that a fire occurred overnight.

Remember - never assume - dial 911 on a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus for assistance.

Burning Odor with No Sign of Smoke

Often individuals will smell a burning odor and, because they do not see smoke, do not call the fire department for assistance.

Small office appliances such as shredders can overheat, produce a burning odor and ultimately catch on fire if not emptied frequently and maintained properly.

Also, many times employees think "someone else has called the fire department." As a result, the fire department does not receive notification of the fire emergency until it has developed into a major incident.

Remember - never assume - dial 911 on a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus for assistance.

Odor Causing Physical Effects

Our bodies have a built-in monitoring system. If we are exposed to a chemical that may be harmful, in many cases our body will let us know by watery and/or burning eyes, coughing, nausea, etc.

If you find yourself in a situation where you are being physically affected, you should advise the people in the area of the problem, notify the fire department and evacuate the area. Note: many hazardous chemicals do not cause immediate physical effects.

Remember - never assume - dial 911 on a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus for assistance.

Even if you KNOW the cause of a chemical or burning odor - call the Fire Department by dialing 911 from a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus, so that the fire department can investigate the odor to confirm no one is in danger.

If you have questions regarding strange odors in the workplace, please contact the Division of the Fire Marshal, Office of Research Services at 301-496-0487.

NED Training Schedule: a Class a Month for the Balance of FY '16

New and relatively inexperienced NED Portal users with an Administrative Officer (AO) or Administrative Technician (AT) role are invited to take advantage of one of the hands-on NED training classes being offered (once a month) through the end of fiscal year 2016.

Each class will provide an overview of the NED Portal and the NIH business functions it supports from the perspective of a NED Portal user with the AO or AT role.

Upon completing the course, students will have a solid working knowledge of the NED Portal and be able to perform the following tasks: Register/Activate, Update, Modify, Transfer, Badge Renewal and Deactivate.

The course will also familiarize students with other aspects of the NED Portal so they can set their primary SAC coverage using Preferences, determine the status of a person's ID badge and/or network account request, look up and view information in a person's NED record and utilize NED reporting capabilities.

To register for one of the classes listed below, go to: http://training.cit.nih.gov/class_details.aspx?cId=NIHCIT-GN142

NIH badging statistics from HHS as of January 30, 2016

Sponsored: 37,054 Enrolled: 36,325 Issued: 35,260*

*This figure represents 95.0% of individuals who have been sponsored.

Note: the Department reports weekly on the number of individuals who have been sponsored, enrolled and issued new HHS ID Badges for each OPDIV.

DPSAC News reports the latest Departmental figures for NIH in the first issue published for that month

A biweekly e-newsletter from the Office of Research Services, Division of Personnel Security and Access Control (ORS/DPSAC) to keep you informed as NIH rolls out "Homeland Security Presidential Directive 12" (HSPD-12) establishing a common identification standard to better safeguard NIH and its workforce.