FTC-II-11

SYSTEM NAME:

Personnel Security, Identity Management, and Access Control Records System–FTC. 

SECURITY CLASSIFICATION:

Not applicable. 

SYSTEM LOCATION:

Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580. 

System data pertaining to identity management are maintained separately off-site by an FTC 

contractor. See Appendix III for other locations where records may be maintained or accessed.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Current and former FTC employees, contractor staff, or other individuals who have 

requested, been issued, and/or used FTC identification for access to FTC and/or other Federally 

controlled facilities.

CATEGORIES OF RECORDS IN THE SYSTEM:

Names, security investigation reports, adjudication files, card files, and position

sensitivity designation files, and other data compiled, generated or used for personnel security 

clearance; fingerprints, photographs, signatures, and other personal data collected or used in 

connection with the issuance of FTC identification (credentials); time, date, location, or other 

data, logs, tapes, or records compiled or generated when such credentials are used to obtain 

physical or logical access to FTC facilities or resources.

These records are also covered by the applicable system notice published by the

Office of Personnel Management-Federal Investigative Services (OPM-FIS), OPM/CENTRAL-9 

(Personnel Investigations Records), and any successor system notice that may be published by 

OPM-FIS for this system. Any materials obtained from OPM-FIS remain property of OPM-FIS 

and are subject to OPM/CENTRAL–9. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 301; Homeland Security Presidential Directive–12 (HSPD-12). 

PURPOSE(S):

To conduct personnel security investigations; to make determinations required based 

upon the results of those investigations; and to maintain records of the investigations and 

determinations; to issue credentials that comply with Government-wide standards issued under 

HSPD-12, or to issue other non-HSPD-12 temporary identification for access to FTC facilities or 

resources; to maintain logs or other records of such logical and physical access by FTC staff, 

contractors, or other individuals; to detect, report and take appropriation action against improper 

or unauthorized issuance or use of FTC credentials, and unauthorized access to or use of FTC 

facilities and resources.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING 

CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

(1) Records in this system may be used to disclose to an agency in the executive, 

legislative, or judicial branch, in response to its request, information on the issuance of a security 

clearance or the conducting of a security or suitability investigation on individuals who, at the 

time the records are added to the system, were Commission employees.

(2) Access logs, tapes, or other system records may be reviewed or referred and disclosed 

to police or other law enforcement personnel for purposes of investigating possible criminal or 

other illegal activity of individuals who have accessed FTC facilities or resources.

See Appendix I for other ways that the Privacy Act permits the FTC to use or disclose 

system records outside the agency.

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

None, except as authorized under 5 U.S.C. 552a(b)(12) when trying to collect a claim of 

the Government. See Appendix I.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 

AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Paper and electronic records, tapes, or other digital or non-digital media. Identity 

management system data are maintained in an off-site database maintained and operated by a 

contractor on behalf of the FTC.
RETRIEVABILITY:

Paper records indexed by individual’s name. Electronic records searched and retrieved 

by name or other data fields or codes.

SAFEGUARDS:

Access to personnel security files is restricted to FTC Personnel Security staff, and such 

files are maintained in a combination-locked safe and lockable metal file cabinets, in locked 

rooms. Personnel investigation reports may be reviewed by an agency official (who has been 

subject to a favorable background investigation) only on a strict need-to-know basis. Identity 

management system (IDMS) data are collected, maintained and accessed only by authorized 

individuals. IDMS data are not maintained with other data on agency network servers, but are 

transferred by dedicated telephone data lines for off-site vendor storage, management and 

security. Security systems and equipment that electronically log or record usage of FTC-issued 

credentials to obtain access to FTC facilities or resources are secured electronically and 

physically (e.g., recording and video monitoring equipment and servers in rooms accessible only 

by authorized key cards). FTC buildings are guarded and monitored by security personnel, 

cameras, ID checks, and other physical security measures.

RETENTION AND DISPOSAL:

Personnel investigation reports are retained for 15 years or until an employee separates 

from the agency. Records of adjudicative actions are maintained for two years. Other records in 

this system are retained and destroyed in accordance with applicable retention and disposal 

schedules and guidance issued or approved by the National Archives and Records 

Administration.

SYSTEM MANAGER(S) AND ADDRESS:

Security Officer, Administrative Services Office, Office of the Executive Director, 

Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

NOTIFICATION PROCEDURE; RECORD ACCESS PROCEDURES; AND CONTESTING 

RECORD PROCEDURES:

See Appendix II.

RECORD SOURCE CATEGORIES:

Individual requesting or requiring FTC identification for logical or physical access 

purposes; Office of Personnel Management Security Investigations Index, FBI Headquarters 

investigative files, fingerprint index of arrest records, Defense Central Index of Investigations, 

previous employers, references identified by record subject individual, school registrars, and 

responsive law enforcement agencies.
EXEMPTIONS CLAIMED FOR THE SYSTEM:

Pursuant to 5 U.S.C. 552a(k)(5), records in this system, to the extent such records have 

been compiled to determine suitability, eligibility, or qualifications for employment or other 

matters, as set forth in the cited Privacy Act provision, and would reveal the identity of a 

confidential source, are exempt from the requirements of subsections (c)(3), (d), (e)(1), 

(e)(4)(G), (H), (I), and (f) of 5 U.S.C. 552a. See § 4.13(m) of the FTC Rules of Practice, 16

CFR 4.13(m).