1 Acquisitions IT Security, and the Suitability Investigations Process February 2005 Daniel Sands NCI/OM/ISCS

2 Credit where credit’s due… Rob LeVine, NIEHS Renita Brooks, NCI Cindy Walczak, NHLBI Tish Best, NCI

3 Acquisitions IT Security What is Required Security Designations Type of Investigations Compiling & Processing the “Package” Issues & questions

4 AIS IT Security Requirements NOT NEW: Policy and procedures on this topic have existed for years HHS placed emphasis in 2003 on enforcing designations/investigations Dona Lenkin Memo, NIH Deputy CIO to IC Executive Officers on June 25, 2003

5 Reference: HHS Instruction HHS Transmittal 98.1, Personnel Manual, Issued January 8, 1998 –HHS Instruction Policy, page 2, “Every department position, including those occupied by Commission Corps officers and those of contractors, must be designated with a sensitivity level.” Policy, page 3, “All employees and contractors must…be subject to personnel investigation requirements.”

6 Action Items to IC’s –Modify contracts to include IT security clauses NIH IT Security Awareness Training Non-disclosure agreements Security designation and investigations System Security Plan (SSP) where applicable –Include IT security language in new contracts –Designate all IT positions –Carry out suitability investigations –The employee may not start official work on the assigned position until the package is submitted and security training has been completed

7 Designation Requirements Does NOT apply to off-site contractors who do not directly access NCI data Every Federal Employee receives the minimum level automatically (Level 1) Initial target group is Information Technology – why we’re here Applies to subcontractors too Contractor employees processed through the Project Officer (PO)

8 Sensitivity Levels Three Designations for Positions –Non-Sensitive (1) –Public Trust (5 and 6) –National Security (2,3,4) - DoD The three designations correlate with specific sensitivity levels PO makes the determination with assistance of ISSO

9 Assignment of Security Level Determine the sensitivity and criticality of data and the degree of risk a position poses. Determine the sensitivity and criticality of data and the degree of risk a position poses. The higher the degree of risk, the higher the designation and corresponding investigation. The higher the degree of risk, the higher the designation and corresponding investigation.

10 Sensitivity Levels - Described Level 1 Basic For usual non- sensitive work NACI$88 Level 5 Sensitive,Low Borderline cases and limited scope NACIC$102 Level 5 Sensitive, moderate Some privileges, moderate scope MBI$425 Level 5 Sensitive, high Those with privileges and scope LBI$2070 Level 6 Very highest sensitivity Few unless application rating demands level BI$2505

11 Investigation Steps Person in a designated position is informed of requirement for investigation through PO via contractor management Person fills out forms and mails to NCI reviewer Renita Brooks – time is a factor NCI reviewer approves or rejects package based on completeness NCI reviewer signs cover letter and provides agency information, including CAN to pay for investigation

12 25A = BI, fast 35 day turnaround 20C = LBI, normal 120 day 15C = MBI NACI = 02B 5 = MBI or LBI 6 = BI 1 = NACI “Contractor” - plus additional title CAN # for providing budget – ex 83237__ 034A FILL OUT BLOCKS A, C, G, I, J, L,O, P? NACI forms are signed by the Project Officer. MBI and LBI forms are signed by NIH. HE07 for SF-85 (NIH) HE00 for SF-86 Forms (HHS) HE00 for SF85P (HHS)

13 Processing the Package Level 1 NACI goes directly from Renita Brooks to OPM All other levels have a few additional stops –Renita sends the package to the NIH/OD –Cassandra Harris reviews and sends the package to the HHS Security Officer –HHS sends the packages to OPM –OPM communicates back to NIH, NCI –PO maintains records on file

14 The Investigation ‘Package’ HHS Credit Release Form Official Fingerprints SD copies (NIH Police recommended) OF306, Declaration of Federal Employment (includes contractors) SF 85 or SF85P – Questionnaire for Public Trust Positions Resume of the candidate Cover letter with required authorities*

15 Recommendations Contracts should be modified now Position designations can be made now Start investigations processing The safe choice is to default to the higher level for IT position designations, e.g. MBI Forms available online

16 NIH Investigations Contact NCI IT Security Review –Ms. Renita Brooks or NCI ISSO –Daniel Sands, Blaise Czekalski, Bruce Woodcock or NIH Div. of Security and Emergency Response –Ms. Cassandra Harris or

17 Action Items to IC’s –Modify contracts to include IT security clauses NIH IT Security Awareness Training Non-disclosure agreements Security designation and investigations System Security Plan (SSP) where applicable –Include IT security language in new contracts –Designate all IT positions –Carry out suitability investigations