# Presentation: 733488

## Acquisitions IT Security, and the Suitability Investigations Process

- February 2005

- Daniel Sands
- NCI/OM/ISCS
- 301-496-1678
- sandsd@mail.nih.gov

## Credit where credit’s due...Rob LeVine, NIEHSRenita Brooks, NCI Cindy Walczak, NHLBI Tish Best, NCI

**Notes:**
Also Robin Turley, Bruce Woodcock, Blaise Czekalski, and others.

## Acquisitions IT Security

- What is Required
- Security Designations
- Type of Investigations
- Compiling & Processing the “Package”
- Issues & questions

## AIS IT Security Requirements

- NOT NEW:  Policy and procedures on this topic have existed for years
- HHS placed emphasis in 2003 on enforcing designations/investigations
- Dona Lenkin Memo, NIH Deputy CIO to IC Executive Officers on June 25, 2003

## Reference:  HHS Instruction

- HHS Transmittal 98.1, Personnel Manual, Issued January 8, 1998
- HHS Instruction 731-1
- Policy, page 2, “Every department position, including those occupied by Commission Corps officers and those of contractors, must be designated with a sensitivity level.”
- Policy, page 3, “All employees and contractors must...be subject to personnel investigation requirements.”

## Action Items to IC’s

- Modify contracts to include IT security clauses
- NIH IT Security Awareness Training
- Non-disclosure agreements
- Security designation and investigations
- System Security Plan (SSP) where applicable
- _[http://rcb-intranet.nci.nih.gov/workforms_set.htm](http://rcb-intranet.nci.nih.gov/workforms_set.htm)_
- Include IT security language in **new** contracts
- Designate all IT positions
- Carry out suitability investigations
- The employee may not start official work on the assigned position until the package is submitted and security training has been completed

**Notes:**
We are working our way through each one of these now.  If you haven’t already, you may get a call from your Contract Officer or an ISSO to discuss the status of your contract.

## Designation Requirements

- Does NOT apply to off-site contractors who do not directly access NCI data
- Every Federal Employee receives the minimum level automatically (Level 1)
- Initial target group is Information Technology – why we’re here
- Applies to subcontractors too
- Contractor employees processed through the Project Officer (PO)

**Notes:**
WOULD apply to local contractors that build and host NCI systems or provided other IT support, like CTIS, IMS, Peace, TerpSys, etc.

## Sensitivity Levels

- Three Designations for Positions
- Non-Sensitive (1)
- Public Trust (5 and 6)
- National Security (2,3,4) - DoD
- The three designations correlate with specific sensitivity levels
- PO makes the determination with assistance of ISSO

## Assignment of Security Level

- Determine the sensitivity and criticality of data and the degree of risk a position poses.
- The higher the degree of risk, the higher the designation and corresponding investigation.

## Sensitivity Levels - Described

| Level 1 | Basic  | For usual non-sensitive work | NACI
$88 |
| --- | --- | --- | --- |
| Level 5 | Sensitive,
Low | Borderline cases and limited scope | NACIC
$102 |
| Level 5 | Sensitive, moderate | Some privileges, moderate scope | MBI
$425 |
| Level 5 | Sensitive, high | Those with privileges and scope | LBI
$2070 |
| Level 6 | Very highest
sensitivity | Few unless application rating demands level | BI 
$2505 |

**Notes:**
National Agency Check (NAC) – an integral part of all background investigations, consisting of searches of the OPM Security/Suitability Investigations Index (SII), the Defense Clearance and Investigations Index (DCII), the Federal Bureau of Investigation (FBI) Identification Division’s name and fingerprint files, and other files or indices when necessary. 

National Agency Check and Inquiries (NACI) – the basic and minimum investigation required on all new Federal employees consisting of a NAC with written inquiries and searches of records covering specific areas of an individual’s background during the past five years (inquiries sent to current and past employers, schools attended, references, and local law enforcement authorities).

NACI and Credit (NACIC) – this NACI includes the addition of a credit record search. 

Minimum Background Investigation (MBI) – this investigation includes a NACIC, a face-to-face personal interview between the investigator and the subject, and telephone inquiries to selected employers. 

Limited Background Investigation (LBI) – this investigation includes a NACIC, personal subject interview, and personal interviews by an investigator of subject’s background during the most recent three years. 

Background Investigation (BI) – this is a more in-depth version of the LBI since the personal investigation coverage is the most recent five to seven years. This investigation is required of those going into “high risk” public trust positions.  

## Investigation Steps

- Person in a designated position is informed of requirement for investigation through PO via contractor management
- Person fills out forms and mails to NCI reviewer Renita Brooks – time is a factor
- NCI reviewer approves or rejects package based on completeness
- NCI reviewer signs cover letter and provides agency information, including CAN to pay for investigation

**Notes:**
There’s a roster spreadsheet that is a useful tool for collecting the list of employees and tracking the packages and has been added as a deliverable in the RCB workforms.

In some IC’s the PO is the reviewer.  To help minimize the impact of the PO, at NCI Renita Brooks does this.  The PO should inform the contractor’s manager to understand the forms requirements so they can perform a quality review as well.

CAN is provided by the PO.  Investigations become just another part of doing business via contracts.  NOTE:  Although we refer to contracts, AIS applies to ALL acquisition vehicles.  We’re working on this now...but for now the RCB Workforms (along with ISSO AIS website) provide and best information for all acquisitions whether they be RCB contracts or not.  There is a simplified version of the workforms available for things such as PO’s.

## 25A = BI, fast 35 day turnaround

- 20C = LBI, normal 120 day
- 15C = MBI            NACI = 02B

- 5 = MBI or LBI
- 6 = BI
- 1 = NACI

- “Contractor” - plus additional title

- CAN # for providing budget – ex 83237__

- 034A

- 371360063

- FILL OUT BLOCKS
- A, C, G, I, J, L,O, P?

- NACI forms are signed by the Project Officer.
- MBI and LBI forms are signed by NIH.

- HE07 for SF-85 (NIH)
- HE00 for SF-86 Forms (HHS)
- HE00 for SF85P (HHS)

## Processing the Package

- Level 1 NACI goes directly from Renita Brooks to OPM
- All other levels have a few additional stops
- Renita sends the package to the NIH/OD
- Cassandra Harris reviews and sends the package to the HHS Security Officer
- HHS sends the packages to OPM
- OPM communicates back to NIH, NCI
- PO maintains records on file

**Notes:**
Cassandra Harris is in the division of Security and Emergency Response.

## The Investigation ‘Package’

- HHS Credit Release Form
- Official Fingerprints SD 2582 copies (NIH Police recommended)
- OF306, Declaration of Federal Employment (includes contractors)
- SF 85 or SF85P – Questionnaire for Public Trust Positions
- Resume of the candidate
- Cover letter with required authorities*

**Notes:**
NIH Police do digital fingerprints.  Fingerprint forms are available at many local police departments and local FBI offices.  NIH Police do not go to contractor sites to fingerprint large numbers of employees.

## Recommendations

- Contracts should be modified now
- Position designations can be made now
- Start investigations processing
- The safe choice is to default to the higher level for IT position designations, e.g. MBI
- Forms available online http://ais.nci.nih.gov

## NIH Investigations Contact

- NCI IT Security Review
- Ms. Renita Brooks
- 301-451-5876 or _[brookr@mail.nih.gov](mailto:brookr@mail.nih.gov)_
- NCI ISSO
- Daniel Sands, Blaise Czekalski, Bruce Woodcock
- 301-496-1678 or _[NCIIRM@mail.nih.gov](mailto:NCIIRM@mail.nih.gov)_
- NIH Div. of Security and Emergency Response
- Ms. Cassandra Harris
- 301-451-4689 or _[harrisca@mail.nih.gov](mailto:harrisca@mail.nih.gov)_

## Action Items to IC’s

- Modify contracts to include IT security clauses
- NIH IT Security Awareness Training
- Non-disclosure agreements
- Security designation and investigations
- System Security Plan (SSP) where applicable
- _[http://rcb-intranet.nci.nih.gov/workforms_set.htm](http://rcb-intranet.nci.nih.gov/workforms_set.htm)_
- Include IT security language in **new** contracts
- Designate all IT positions
- Carry out suitability investigations

**Notes:**
We are working our way through each one of these now.  If you haven’t already, you may get a call from your Contract Officer or an ISSO to discuss the status of your contract.

## Slide 18

**Notes:**
This available on the AIS website and is being required as deliverable in the RCB workforms.

## Slide 19

## Slide 20

## Slide 21

## Slide 22