![](media/image1.jpeg){width="1.5833333333333333in" height="1.575in"}

IT Security Resource Guide for Contracting Officers and Contracting
Officer's Representatives

30 November 2006

Prepared by the Commerce IT Security Team

Nancy A. DeFrancesco, Chief Information Security Officer

\(202\) 482-3490, <NDeFrancesco@doc.gov>

![](media/image2.png){width="8.679166666666667in"
height="6.170138888888889in"}

**Personnel Security Requirements Quick Reference Sheet for CORs
\[*NOTE: Always verify with your servicing Security Officer*\]**

<table style="width:100%;">
<colgroup>
<col style="width: 7%" />
<col style="width: 23%" />
<col style="width: 5%" />
<col style="width: 7%" />
<col style="width: 2%" />
<col style="width: 12%" />
<col style="width: 7%" />
<col style="width: 1%" />
<col style="width: 3%" />
<col style="width: 3%" />
<col style="width: 6%" />
<col style="width: 1%" />
<col style="width: 6%" />
<col style="width: 11%" />
</colgroup>
<tbody>
<tr class="odd">
<td><strong>Contract IT Risk Level</strong></td>
<td><strong>Examples of IT functions applicable</strong></td>
<td><strong>Contract Duration</strong></td>
<td colspan="3"><blockquote>
<p><strong>Type of Investigation Required</strong></p>
<p><strong>and When to Order</strong></p>
</blockquote></td>
<td colspan="7"><blockquote>
<p><strong>Forms Required</strong></p>
<p><strong>(see form titles below table)</strong></p>
</blockquote></td>
<td><strong>Estimated Cost of Check per person</strong></td>
</tr>
<tr class="even">
<td>High Risk</td>
<td><ul>
<li><p>Network/ system administrator</p></li>
<li><p>System developer</p></li>
<li><p>IT security positions (such as information system security
officers or IT security office staff)</p></li>
<li><p>Experts and Consultants (GS-13 or higher equivalent)</p></li>
</ul></td>
<td>All</td>
<td><blockquote>
<p>Pre-employment check (includes NCIC check) <strong>before</strong>
start of work</p>
</blockquote></td>
<td colspan="2"><p>Background Investigation (BI) initiated within 3 days
of start of work <strong>if</strong> pre-employment check favorable</p>
<p>[reinvestigation every 5 years]</p></td>
<td colspan="2">Pre-employment check memo</td>
<td colspan="2"><p>SF-85P</p>
<p>and I-9</p></td>
<td><p>FD-258</p>
<p>or</p>
<p>CAS Check</p></td>
<td colspan="2">Credit Release Authorization</td>
<td><blockquote>
<p>BI/35 $3,350</p>
<p>BI/120 $2,825</p>
</blockquote></td>
</tr>
<tr class="odd">
<td>Moderate Risk</td>
<td><ul>
<li><p>User of a financial or other <strong>critical</strong> system who
has anything more than “read only” access</p></li>
<li><p>User of a system that has personal/Privacy Act/other protected
data in it (e.g., social security numbers or Title 13 data)</p></li>
<li><p>Experts and Consultants (GS-13 or higher equivalent)</p></li>
</ul></td>
<td>All</td>
<td><blockquote>
<p>Pre-employment check (includes NCIC check) <strong>before</strong>
start of work</p>
</blockquote></td>
<td colspan="2"><blockquote>
<p>Minimum Background Investigation (MBI) initiated within 3 days of
start of work <strong>if</strong> pre-employment check favorable</p>
</blockquote>
<p>[reinvestigation every 5 years]</p></td>
<td colspan="2">Pre-employment check memo</td>
<td colspan="2"><p>SF-85</p>
<p>and I-9</p></td>
<td><p>FD-258</p>
<p>or</p>
<p>CAS Check</p></td>
<td colspan="2">Credit Release Authorization</td>
<td><p>Not available</p>
<p>MBI/35 - $600.00</p>
<p>MBI/120 - $525.00</p></td>
</tr>
<tr class="even">
<td rowspan="2">Low Risk</td>
<td rowspan="2"><ul>
<li><p>User with access to a DOC local area network, e-mail, and basic
office applications only</p></li>
</ul>
<blockquote>
<p>**Note: Experts and Consultants (GS-13 or higher equivalent) are
Moderate or High risk per Security Manual section 1003</p>
</blockquote></td>
<td>180 days or more</td>
<td colspan="3"><blockquote>
<p>National Agency Check with Inquiries (NACI) <strong>upon</strong>
start of work.</p>
</blockquote></td>
<td colspan="2"><blockquote>
<p>SF-85 and I-9</p>
</blockquote></td>
<td colspan="2">SF-87</td>
<td colspan="3"><blockquote>
<p>Credit Release Authorization</p>
</blockquote></td>
<td><blockquote>
<p>$100.00</p>
</blockquote></td>
</tr>
<tr class="odd">
<td>Less than 180 days</td>
<td colspan="3">Special Agreement Check (SAC) <strong>upon</strong>
start of work.</td>
<td colspan="4"><blockquote>
<p>OFI-86C</p>
<p>[COR completes items 1-12 and 14 with code “R” in block 7, then
subject signs block 13]</p>
</blockquote></td>
<td colspan="3"><blockquote>
<p>FD-258</p>
</blockquote></td>
<td><blockquote>
<p>$47.00</p>
</blockquote></td>
</tr>
<tr class="even">
<td rowspan="2">National Security Information and systems up to Secret
classification</td>
<td>Critical-sensitive (see Security Manual section 1002)</td>
<td rowspan="2">All</td>
<td colspan="2"><blockquote>
<p>Pre-employment check <strong>before</strong> start of work</p>
</blockquote></td>
<td><blockquote>
<p>BI [reinvestigation every 5 years]</p>
</blockquote></td>
<td>Pre- employment check memo</td>
<td colspan="2"><blockquote>
<p>SF-86</p>
</blockquote></td>
<td>CD-79</td>
<td colspan="2">Credit Release Authorization</td>
<td>FD-258</td>
<td><blockquote>
<p>BI/35 $3,350</p>
<p>BI/120 $2,825</p>
</blockquote></td>
</tr>
<tr class="odd">
<td>Non-critical sensitive (see Security Manual section 1002)</td>
<td colspan="2"><blockquote>
<p>Pre-employment check <strong>before</strong> start of work</p>
</blockquote></td>
<td><blockquote>
<p>National Agency Check with Law and Credit (NACLC) [reinvestigation
every 10 years]</p>
</blockquote></td>
<td>Pre-employment check memo</td>
<td colspan="2"><blockquote>
<p>SF-86</p>
</blockquote></td>
<td>CD-79</td>
<td colspan="2">Credit Release Authorization</td>
<td>FD-258</td>
<td><blockquote>
<p>$240 – (35)</p>
<p>$192 – (120)</p>
</blockquote></td>
</tr>
</tbody>
</table>

### Form Titles:

-   CD-79 Request for Security Clearance

-   SF-85P Questionnaire for Public Trust Positions

-   FD-258 Fingerprint Chart with OPM ORI number

-   SF-87 Fingerprint Chart with OPM ORI number

-   SF-85 Questionnaire for Non-Sensitive Positions

-   OFI-86C, Special Agreement Check

-   SF-86 Questionnaire for National Security Positions

-   I-9 INS -- Employment Eligibility Verification

## **IT Security References for CORs**

### OAM Issuances:

Commerce Acquisition Manual (CAM) Section 1337.70 *Security Processing
Requirements for On-Site Service Contracts*
<http://oamweb.osec.doc.gov/docs/CAM-1337-70-Personnel-Security-Processing.pdf>
(select "save to desktop" if you have a problem opening the linked
file). This CAM contains:

-   Commerce Acquisition Regulation (CAR) 1352.237-71, Security
    Processing Requirements for Contractor/Subcontractor Personnel
    working on a Department of Commerce site (High or Moderate Risk
    Contracts)

-   CAR 1352.237-72, Security Processing Requirements for
    Contractor/Subcontractor Personnel Working on a Department of
    Commerce site (Low Risk Contracts)

-   CAR 1352.237-73, Security Processing for Contractor/Subcontractor
    Personnel Working on a Department of Commerce site (National
    Security Contracts)

-   CAR 1352.237-74, Foreign National Visitor and Guest Access to
    Departmental Resources

Procurement Memorandum 2006-01, *Guidance for Implementation of Homeland
Security Presidential Directive (HSPD) 12 in Contracts*\
<http://oamweb.osec.doc.gov/docs/PM_2006-01.pdf>

Procurement Memorandum 2006-06, *Information Security in Acquisitions\
*<http://oamweb.osec.doc.gov/docs/PM-2006-06-InformationSecurity-in-Acquisitions.pdf>

CAR 1352.239-73, *Security Requirements for Information Technology
Resources\
*[*http://oamweb.osec.doc.gov/docs/CAR1352.239-73.pdf*](http://oamweb.osec.doc.gov/docs/CAR1352.239-73.pdf )

### DOC Security Issuances:

Department of Commerce IT Security Program web site\
<http://ocio.os.doc.gov/ITPolicyandPrograms/IT_Security/index.htm>

List of IT Security Officers by Operating Unit (DOC Intranet)\
<http://home.commerce.gov/cio/ITSIT/ITSO_LIST_LINK.htm>

Commerce *IT Security Program Policy and Minimum Implementation
Standards*\
Full policy:
<http://ocio.os.doc.gov/ITPolicyandPrograms/Policy___Standards/DEV01_003884>

Chapter 5, System and Services Acquisition:
<http://ocio.os.doc.gov/ITPolicyandPrograms/Policy___Standards/DEV01_003884#P697_86354>

Department of Commerce *Manual of Security Policies and Procedures* (DOC
Intranet)
[http://home.commerce.gov/osy/SecurityManual/Security%20Manual%20Contents2.pdf](http://home.commerce.gov/osy/SecurityManual/Security Manual Contents2.pdf)

### National Institute of Standards and Technology (NIST) Standards and Guidelines:

Federal Information Processing Standard (FIPS) 201-1, *Personal Identity
Verification (PIV) of Federal Employees and Contractors\
*[ http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf](http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf)

FIPS 199, *Standards for Security Categorization of Federal Information
and Information Systems*\
<http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf>

FIPS 200, Minimum Security Requirements for Federal Information and
Information Systems\
<http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf>

NIST Special Publication 800-23, *Guidelines to Federal Organizations on
Security Assurance and Acquisition/Use of Tested/Evaluated Products*\
<http://csrc.nist.gov/publications/nistpubs/800-23/sp800-23.pdf>

[NIST Special Publication 800-26 Rev 1
draft](http://csrc.nist.gov/publications/nistpubs/800-23/sp800-23.pdf)*,
**Guide for Information Security Program Assessments and System
Reporting Form***  \
<http://csrc.nist.gov/publications/nistpubs/800-26/sp800-26.pdf>

NIST Special Publication 800-35*, Guide to Information Technology
Security Services\
*<http://csrc.nist.gov/publications/nistpubs/800-35/NIST-SP800-35.pdf>

NIST Special Publication 800-36, *Guide to Selecting Information
Technology Security Products\
*<http://csrc.nist.gov/publications/nistpubs/800-36/NIST-SP800-36.pdf>

[NIST Special Publication
800-37,](http://csrc.nist.gov/publications/nistpubs/800-36/NIST-SP800-36.pdf)
*Guide for the Security Certification and Accreditation of Federal
Information Systems\
*<http://csrc.nist.gov/publications/nistpubs/800-37/SP800-37-final.pdf>

NIST Special Publication 800-53, *Recommended Security Controls for
Federal Information Systems\
*
[http://csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf](../%20http:/csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf)

NIST Special Publication 800-64, *Security Considerations in the
Information System Development Life Cycle*\
<http://csrc.nist.gov/publications/nistpubs/800-64/NIST-SP800-64.pdf>

NIST Special Publication 800-100, *Information Security Handbook: A
Guide for Managers\
<http://csrc.nist.gov/publications/nistpubs/800-100/SP800-100-Mar07-2007.pdf>*

**Other:**

National Industrial Security Program Operating Manual (NISPOM)\
<http://www.dss.mil/isp/odaa/documents/nispom2006-5220.pdf>