U.S. DEPARTMENT OF EDUCATION

Contractor Vetting Security Requirements
Department of Education Contractor Vetting Security Requirements (Updated 2-1-24)

REVISION HISTORY

DATE OF UPDATE SUMMARY OF CHANGES

2/1/24 Revisions to Section X
Department of Education Contractor Vetting Security Requirements (Updated 2-1-24)

I. Purpose

(1) This Contractor Vetting Security Requirements document establishes the U.S. Department of Education 

(ED)’s personnel security screening requirements for Contractor Employees who will require access to 

proprietary or sensitive ED information, including, but not limited to “Controlled Unclassified Information” 

as defined in 32 CFR Part 2002, ED information technology (IT) systems, ED facilities or space, and/or 

perform duties in a school or location where children are present. All references to the

“Contractor” or “Contractor Employee” include all individuals that will perform work under an ED contract 

including individuals employed by the Contractor, team member, subcontractor, consultant 

and/or independent Contractor.

(2) The Contractor shall comply with all requirements in this Contractor Vetting Security Requirements 

document.

(3) ED possesses all rights and privileges in all material to which the Contractor has access to as a result of an 

ED contract.

(4) Duplication or unauthorized disclosure of information contained in ED sensitive data, including, but not 

limited to “Controlled Unclassified Information” as defined in 32 CFR Part 2002, ED IT information 

systems or ED privilege information to which the Contractor or Contractor Employee may have access as 

a result of an ED Contract is prohibited by Public Law and is subject to criminal penalties.

(5) The Contractor or Contractor Employee must promptly notify the ED COR or ED Personnel Security Office 

if any Personally Identifiable Information (PII) or ED sensitive data has or is reasonably believed

to have been compromised.

II. Contractor Personnel

(1) The type of security investigation required to commence work on an ED contract will be governed by the 

position risk and sensitivity level of the Contractor position as designated in the contract (Note: COR 

provides position designation to the Contracting Officer to insert in the contract) and what information and/or 

access to facilities that ED will make available to the Contractor personnel that will not require access to 

classified information will fall under the following categories in accordance with 5 CFR 731:

(a) High Risk/Public Trust. Adverse impact on the efficiency of the service: Potential for exceptionally 

serious impact involving duties especially critical to the agency or a program mission with broad scope of 

policy or program authority.

(b) Moderate Risk/Public Trust. Adverse impact on the efficiency of the service: Potential for moderate to 

serious impact involving duties of considerable importance to the agency or program mission with 

significant program responsibilities and delivery of customer services to the public. 

(c) Low Risk/Non-Sensitive. Adverse impact on the efficiency of the service: Potential for impact involving 

duties of limited relation to the agency mission with program responsibilities that affect the efficiency of 

the service.

(2) Only U.S. citizens will be eligible for employment on contracts requiring a Low Risk/Non-Sensitive, 

Moderate Risk/Public Trust, High Risk/Public Trust, or a National Security designation.

(3) An approved waiver, in accordance with ACSC-OFO-013, Contractor Employee Personnel Security 

Screening is required, for any exception to the requirements of paragraph (2).

(4) All ED Contractor and Subcontractor employees must undergo personnel security screenings if, during the 

performance of the contract, they will be required to background investigation requirements.
Department of Education Contractor Vetting Security Requirements (Updated 2-1-24)

(5) The Contractor shall:

(a) Comply with the Principal Office (PO) processing requirements for personnel security screening;

(b) Ensure that no Contractor employee is placed in a higher risk position than for which the employee is 

approved;

(c) Ensure Contractor employees submit required security forms for reinvestigation in accordance with time 

frames set forth in section VII paragraph (2). 

(d) Report to the COR any information (e.g., personal conduct, criminal conduct, financial difficulties) that 

would raise a concern about the suitability of a Contractor employee or whether a Contractor employee's 

continued employment would promote the efficiency of the service or violate the public trust; 

(e) Protect sensitive and Privacy Act-protected information, including “Controlled Unclassified 

Information” as defined in 32 CFR 2002.4 (h), from unauthorized access, use, or misuse by its 

Contractor employees, prevent unauthorized access by others, and report any instances of 

unauthorized access, use, or misuse to the COR;

(f) Report to the COR any removal of a Contractor employee from a contract within one business day if 

removed for cause or within two business days if otherwise removed; 

(g) Upon the occurrence of any of the events listed under paragraph (b) of the clause at FAR 52.204–9, 

Personal Identity Verification of Contractor Personnel, return a PIV ID to the COR within seven 

business days of the Contractor employee's departure; and

(h) Report to the COR any change to job activities that could result in a change in the Contractor 

employee's position or the need for increased security access;

(i) Failure to comply with any of the requirements in this document may result in a termination of the 

contract for default or cause.

III. ED Procedures and Requirements

(1) The Government will be responsible for conducting the background investigation and the cost of the 

investigation unless otherwise specified by ED.

(2) All investigations will be conducted in accordance with applicable Executive Orders, these Contractor 

Vetting Security Requirements, and Homeland Security Presidential 12 (HSPD-12), and Federal 

Information Processing Standards Publication 201(FIPS 201) as amended.

(3) The Contractor will not be permitted to commence performance under an ED Contract until a sufficient 

number of its personnel, as determined by the COR, have received the requisite security approval 

determined by ED Office of Personnel Security office.

(4) During the life of an ED contract, the Contractor shall ensure that no Contractor Employee commences 

performance prior to receipt of written notice of pre-employment waiver from the Contracting Officer or 

COR.

(5) The Contractor shall update personnel information as individuals are added or deleted from the contract 

and provide such list to the COR so that the ED Security office is promptly notified.

(6) ED will provide the Contractor with the appropriate security forms and instructions for completing the 

security requirements including accessing the e-APP security electronic questionnaire.

(7) The COR will notify the Contractor of any Contractor Employees who are found ineligible to work for 

or on behalf of ED on an ED contract.

(8) All ED Contractor Employees are investigated commensurate with their position risk/sensitivity, in
Department of Education Contractor Vetting Security Requirements (Updated 2-1-24)

accordance with OPM's risk/sensitivity designation guidance.

(9) Any decision of ED’s regarding a Contractor Employee’s fitness is not considered an employment 

action.

(10) ED utilizes reciprocal recognition of fitness determinations for Contractor Employees in accordance with 

Executive Order 13488 or as amended and Security Executive Agent Directive 7 (SEAD 7). ED will 

maintain position risk level designation and other relevant documentation pertaining to a Contractor 

Employee’s security status.

(11) The COR will maintain position risk level designation and other relevant documentation pertaining to a

IV. Contractor Employment Review and Pre-Employment Waiver Requirements

(1) Background investigations must be conducted and favorably adjudicated for each Contractor 

Employee prior to commencing work on an ED contract. However, ED may grant a pre- employment 

waiver after a risk assessment of the applicable pre-employment checks and the completion of all preemployment requirements. Once approval of the pre-employment waiver and HSPD-12 requirements 

has been granted by the ED Office of Security, a (PIV) ID may be issued. The extent of the preemployment investigation will vary depending upon the risk level associated with each contractor 

position and whether the contractor position is long or short term. A pre-employment waiver will be 

disapproved if it develops derogatory information that cannot be resolved in the Contractor 

Employee’s favor and has an adverse impact on the efficiency and integrity of ED.

(2) When a pre-employment waiver is disapproved as the pre-employment investigation results so justify, 

PIV IDs will be suspended or revoked and access to ED IT systems, or access to ED information and 

facilities will be denied.

(3) All Contractor Employees who require unescorted access to ED facilities/space, access to ED 

Information, access to ED IT systems, or must perform duties in a school or in a location where 

children are present, must undergo a favorable pre-employment review, and must be issued a preemployment waiver approval before:

(a) They are authorized to bypass significant technical and operational security controls of general 

support IT systems, or major applications; or

(b) They are authorized to access applications where controls such as separation of duties, least 

privilege, and individual accountability cannot adequately protect the application or the 

information in it.

Long-Term Contractor Employees

Long-Term Contractor Employees, defined as Contractor Employees having access to ED facilities/space, 

ED Information, ED IT systems for 30 days or longer, and/or are required to perform duties at a school or 

location where children are present, require the following: 
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

5

Low/Moderate Risk Contractor Positions 

(a) Contractor Employees that are in Long-Term Contractor Positions must undergo the requisite 

background investigation. The minimum of which shall be a Tier 1 investigation (Low Risk) or 

Tier 2 (Moderate Risk) investigation.

(b) The pre-employment waiver requirements for Contractor Employees in this category include: 

the initiation and scheduling of the appropriate investigation; a favorable review of the 

electronic security questionnaire (e-App); favorable FBI fingerprint results; favorable review of 

the Declaration of Federal Employment (OF-306); favorable review of the National Student 

Loan Data Base system (NSLDS) check; the Cyber Security Training Certificate; and the Fair 

Credit Release Form.

High Risk/Public Trust Contractor Positions

(a) In addition to the pre-employment waiver requirements above, Contractor Employees in this category 

must undergo the requisite background investigation, the minimum of which shall be a Tier 4 (High 

Risk) investigation.

(b) The pre-employment waiver requirements for Contractor Employees in this category include: the 

initiation and scheduling of the appropriate investigation; a favorable review of the electronic security 

questionnaire (e-App); favorable FBI fingerprint results; favorable review of the OF-306; favorable 

review of the NSLDS check; Cyber Security Training Certificate; Fair Credit Release form; favorable 

review of the credit report; and favorable review of OPM/Defense Counter-Intelligence Security 

Agency (DCSA) preliminary checks. 

Short-Term Contractor Employees

(a) A Short-Term Contractor Employee is defined as having access to ED facilities/space, ED Information or 

school or location where children are present, for fewer than 30 days.

(b) Contractor Employees who will have physical access to ED controlled facilities/space, ED information, 

or ED IT systems (excluding any actual log-on access to ED IT systems), for less than 30 days (e.g., a 

one or two week project), or have infrequent access (e.g., three times a month), do not require an 

investigation, provided they have favorable fingerprint results of a FBI National History Check (NCHC), 

a signed Non-Disclosure Agreement on record with the Principal Office and have escorted access at all 

times.

V. Escort Procedures

Unescorted Access

(1) Contractor Employees are not required to have escorted access, and may serve as an escort if 

authorized by the Principal Office, provided they have a valid PIV ID. 
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

6

(2) Contractor Employee escorts may be subject to appropriate sanctions, including revocation 

of escort privileges, in accordance with applicable law and ED regulations for any knowing, 

willful, or negligent act that results in an individual being escorted, obtaining unauthorized 

access to ED information, ED IT systems, and/or to ED facilities/space or location or school 

where children are present.

Escorted Access

(1) Contractor Employees who do not have a valid PIV ID must be escorted while in ED 

facilities/space. Escorts are required to maintain line ofsight of the escorted Contractor 

Employee and of all work they are performing for the Department at all times.

(2) Contractor Employees who have a required escort may be subject to additional personnel screening, 

such as magnetometer and search of personal belongings, upon entry to or exit from ED 

facilities/space.

(3) Contractor Employee escorted access cannot be used to circumvent the personnel security 

requirements. For example, a Contractor Employee who has not undergone the personnel security 

screening cannot attend meetings if ED Information is going to be discussed at the meeting. A 

Contractor Employee who will require ongoing access to ED Information, ED IT Systems, ED 

facilities/space, or to schools or locations where children are present cannot be escorted on a daily 

basis instead of undergoing the personnel security screening process. 

VI. Contractor shall:

(1) Comply with the COR and Principal Office processing requirements for personnel security 

screening and granting access privileges. 

(2) Prior to submitting an exception waiver request to ED for approval, ensure that all non-U.S. 

citizen Contractor Employees are lawful permanent residents of the United States or have the 

appropriate work authorization documents required by the U.S. Department of Homeland 

Security, Bureau of Immigration and Appeals, to work in the U. S. 

(3) Ensure that a Contractor Employee is not placed in a higher risk position than the individual is 

approved for, unless approved by the Contracting Officer, Contracting Officer Representative 

and the Office of Personnel Security Director; 

(4) Notify a Contractor Employee (when contacted by the COR) that a determination has been made 

that the individual is ineligible to render services on an ED contract; 

(5) Report to the COR any information (i.e., personal conduct, criminal conduct, financial difficulties, etc.) 

that would raise concerns regarding fitness, warrant a follow up security screening or raise a concern 

about whether a Contractor Employee’s continued employment would promote the efficiency of the 

service or violate the public trust;

(6) Protect sensitive or Privacy Act-protected information including but not limited to “Controlled 

Unclassified Information” as defined in 32 CFR Part 2002 from unauthorized use or misuse by 

its Contractor Employees and prevent access to others, who are not authorized and do not have 

a need to know such information; 
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

7

(7) Report to the COR, within two business days, any instance in change of physical access requirements for 

a Contractor Employee within an ED facility/space. Report to the COR within two business days any 

removal of a Contractor Employee from a contract; or within one business day if removed for cause;

(8) Return a PIV ID to the COR within seven business days of the Contractor Employee’s departure. 

Report to COR of any job activities that a Contractor Employee has brought to their attention that 

they believe could result in a change in the Contractor Employee’s position or the need for 

increased security access; and

(9) Contractors shall ensure Contractor Employees:

(a) Respond to initial requests and additional requests for information during the 

screening and adjudication process, within the time frame established;

(b) Report to their supervisor and/or project manager any job activities that they 

believe could result in a change in their position or the need for increased 

security access; and

(c) Self-report to their supervisor any personal misconduct, criminal misconduct, or other 

information that may warrant a follow-up security screening or investigation.

VII. Background Investigations

(1) Background investigations are conducted by DCSA (as of October 1, 2019) on behalf of ED in 

accordance with 5 C.F.R. § 731.104 and HSPD-12 requirements. The investigation’s scope is 

determined by the risk/sensitivity level of the position, which is further determined by the 

position designation process. 

(2) Reinvestigations

Contractor Employees occupying Moderate and High-Risk public trust level positions must undergo 

a reinvestigation every five years for the duration of their contract at ED, or if there is a break in 

service to a federal contract service of 24 months or more. For Low Risk (T1) Contractor Employees, 

if a break in service of two years or more exists prior to reinstatement/reactivation, the individual will 

be required to submit a new package for a T1 investigation. Low Risk positions do not require 

periodic reinvestigations. Any position designated as a public trust or national security position 

requires a periodic reinvestigation. In addition, all positions are subject to re-evaluation if new 

adverse information is disclosed by the individual or discovered that could affect the individual’s 

suitability for employment and/or access to unclassified sensitive information. 

VIII. Reciprocity

1. Accepting Prior Determinations

ED will only grant reciprocal recognition of a prior favorable fitness determination or adjudication when:
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

8

(a) The prior favorable fitness determination or adjudication was based on criteria equivalent to suitability 

standards established by OPM;

(b) The individual has had no continuous (not cumulative) break in federal contract/service employment 

of 24 months or more since the favorable determination was made;

(c) The favorably adjudicated investigation meets the minimum position risk/sensitivity designation level 

requirements and has been verified and approved by OPS; and

(d) The investigation must have been completed within the last five years.

2. Denying Reciprocal Recognition of Prior Determinations.

ED may deny reciprocal recognition of a prior favorable fitness determination or adjudication when:

(a) The new position requires a higher level of investigation than previously conducted for that 

individual;

(b) There is a continuous (not cumulative) break in service of 24 months or more since the 

previous investigation;

(c) During the course of the security approval process, the OPS obtains new information (such as 

responses to questions raised during interviews or information obtained during reference 

checks) that calls into question the individual’s fitness based on character or conduct;

(d) A favorable investigation and fitness determination or adjudication cannot be verified; or

(e) The previous investigation was not completed within the last five years.

IX. Residency Requirement

(1) The Residency Requirement ensures an adequate background investigation can be completed. 

This requirement applies to both U.S. citizens and non-U.S. Citizens.

(2) Immediately prior to gaining unescorted access to ED facilities/space, access to ED information, or 

access to ED IT systems, and/or performing duties in a school or location where children are present, 

the Contractor Employees must have:

(a) Resided in the U.S. for three out of the last five years (not necessarily consecutive);

(b) Worked for the U.S. in a foreign country as either an employee or contractor in a federal or 

military capacity for three out of the last five years;

(c) Been a dependent of a federal or military employee or contractor in a foreign country for three 

out of the last five years;

(d) Studied abroad at a U.S. affiliated college or university; or
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

9

(e) Completed a current and adequate background investigation (commensurate with the position 

risk/sensitivity levels) for a federal or Contractor Employee position, barring any break in federal 

employment or federal sponsorship. 

(3) Waiver of Residency Requirement

Only the ED Director of the Office of Security, Facilities and Logistics (OSFLS), or designee, can 

approve Residency Requirement waivers. The approval must be obtained prior to the proposed 

Contractor Employee beginning work or providing any service to ED. 

X. Citizenship

(a) Only U.S citizens will be eligible for employment on contracts requiring a Low Risk/Non-Sensitive, 

Moderate Risk/Public Trust, a High Risk/Public Trust, or a National Security designation. 

(b) An approved waiver in accordance with ACSC-OFO-013, Contractor Employee Personnel Security 

Screenings, is required, for any exception to paragraph (a). 

(c) A non-U. S. citizen working in the U. S. and assigned to an ED contract must have been admitted legally 

to the U. S. or have acceptable Department of Homeland Security Credentials to prove immigrant status 

or employment authorization as listed on the Form I-9, Employment Verification.

XI. Dual Citizenship

U.S. Citizen Contractor Employees who hold dual citizenship with a foreign country may be granted clearance; 

however, OPS will consider how the Contractor Employee has obtained or exercised his/her dual citizenship 

status in making a security approval.

XII. Homeland Security Presidential Directive-12 (HSPD-12) and Federal Information Processing Standards 

(FIPS 201-3) Pre-Employment Requirements

(1) Contractor Employees who require access to ED facilities/space, access to ED Information, or access to ED 

IT systems, or who perform duties in schools or in a location where children are present, shall be subject to 

the requirements outlined in HSPD-12, FIPS 201- 3 and the HSPD-12 pre-employment requirements for 

PIV ID issuance.

(2) Contractor Employees must present two valid forms of identification, in original form, prior to 

commencement of work on an ED contract and PIV issuance.

(3) Contractor Employees must appear in person at least once before an ED official or an ED OPS 

authorized official of a trusted contract company, who is responsible for checking the 

identification documents. This identity proofing must be completed at a time prior to 

commencement of work under the covered contract and prior to PIV issuance and must be 

documented by ED or ED’s designated official. 

(4) During identity proofing, the Contractor Employee shall be required to provide two forms of 

identity source documents in original form. The identity source documents shall be bound to that 

applicant and shall be neither expired nor cancelled. If the two identity source documents bear 

different names, evidence of a formal name change shall be provided. A list of approved identity 

documents can be found in FIPS 201-3 (Section 2.7 PIV Identity Proofing and Registration 

Requirement.

XIII. National Student Loan Database System (NSLDS) Check.

All Contractor Employees are required to be in good standing regarding any federal subsidized or unsubsidized
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

10

student loans. Failure to demonstrate that any such loan repayment is in good standing will result in denial of the 

pre-employment waiver. 

1 Per the Federal Information Security Modernization Act of 2014 [FISMA], waivers to Federal Information 

Processing Standards are not allowed. 
Department of Education Contractor Vetting Security Requirements Updated 2-1-24

11

XIV. Adjudications

Background investigations conducted on Contractor Employees that require access to ED Information or 

ED IT systems or school or location where children are present must be adjudicated according to the OPM's 

suitability criteria published at 5 CFR Part 731.202, and OPM issued supplemental guidance. 

(1) For Unescorted Access to ED Facilities/Space:

Background investigations conducted on Contractor Employees that only require unescorted access to 

ED facilities/space, and no access to ED Information, ED IT systems or schools or locations where 

children are present, must be adjudicated using the basic fitness determination criteria stated in OPM's 

memorandum to the Heads of Departments and Agencies entitled "Final Credentialing Standards for 

Issuing Personal Identity Verification Cards under HSPD-12”, dated July 31, 2008. 

(2) Reporting Final Adjudication:

The final adjudication determination of each background investigation will be reported to OPM/DCSA 

within 90 days of the date of the completed investigation, as required by 5 CFR 731.203 and 5 CFR 1400. 

(3) ED affords fair, impartial, and equitable treatment to all Contractor Employees through the consistent 

application of fitness standards, criteria, and procedures as specified in applicable laws, regulations, 

directives and Executive Orders.

(4) Nondiscrimination in Adjudication:

ED does not discriminate based on race, color, religion, national origin, sex, gender identity, age, 

disability, genetic information, status as a parent, sexual orientation, marital status, or political 

affiliation in granting access security approvals for Contractor Employees. 

End of Document