2010-32895. Federal Acquisition Regulation; Personal Identity Verification of Contractor Personnel

AGENCY:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Final rule.

SUMMARY:

DoD, GSA, and NASA are issuing a final rule amending the Federal Acquisition Regulation (FAR) to provide additional regulatory coverage to reinforce the requirement of collecting from contractors all forms of Government-provided identification once they are no longer needed to support a contract.

DATES:

Effective Date: January 31, 2011.

FOR FURTHER INFORMATION CONTACT:

For clarification of content, contact Mr. Michael Jackson, Procurement Analyst, at [phone]. For information pertaining to status or publication schedules, contact the Regulatory Secretariat at [phone]. Please cite FAC 2005-48, FAR Case 2009-027.

SUPPLEMENTARY INFORMATION:

I. Background

DoD Inspector General Audit Report No. D-2009-005, entitled “Controls Over the Contractor Common Access Card Life Cycle,” addressed whether Government controls over contractor Common Access Cards (CAC) were in place and worked as intended. A “CAC” is the DoD term for a Personal Identity Verification (PIV) card. A PIV card is required in order to gain access to a Federal facility. The most prevalent issue of the audit report, and the one that DoD, GSA, and NASA are undertaking to resolve with this case, was that the CACs were not adequately accounted for after contract performance or completion.

DoD, GSA, and NASA are amending the FAR by inserting new paragraphs (d)(1) and (d)(2) under FAR 4.1301, Policy. Paragraph (d)(1) provides policy on recovering PIVs. Paragraph (d)(1) requires that agency procedures ensure that Government contractors account for all forms of Government-provided identification issued to Government contractors under a contract, and return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the agency: When no longer needed for contract performance; upon completion of a contractor employee's employment; or upon contract completion or termination. Paragraph (d)(2) authorizes the contracting officer to delay final payment under a contract if the contractor fails to comply with these requirements.

DoD, GSA, and NASA are also modifying FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel, to be consistent with FAR part 4.

DoD, GSA, and NASA published a proposed rule in the Federal Register at 75 FR 28771 on May 24, 2010. Three respondents submitted four comments on the proposed rule, which are addressed below.

Although none of the public comments received caused a change in the FAR text, the FAR text is changed in the final rule as follows:

• FAR 4.1301(d)(1) is revised to clarify that this section applies to agency procedures related to PIV card return.
• FAR 4.1301(d)(1) and 52.204-9(b) are revised to clarify that the rule applies when PIV cards are issued to contractor employees.
• FAR 52.204-9(d) is revised to clarify that the rule flows down to all subcontractor employees when they are required to have access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.
• FAR 52.204-9(d) is also revised to clarify that the prime contractor is responsible for returning all subcontractor PIV cards that have been issued by an agency.

II. Discussion of Public Comments

A. Lost Cards

Comment: Two respondents stated that they have concerns over what happens when a contractor claims to have lost an identity card and therefore cannot return it.

Response: Each agency will establish policies for control of PIV cards. Some agencies, for example, may replace a lost card once, but costs for replacement of any subsequent lost PIV cards may be borne by the contractor. The respondent may be voicing concern that there is a potential for misuse and fraud with lost cards. DoD, GSA, and NASA recommend that agencies program the PIV cards to become inactive if they have not been used after a prolonged period of time.

B. Timing

Comment: Another respondent expressed concern with waiting until the closeout period instead of taking care of the PIV cards at contract completion.

Response: The FAR rule does not authorize waiting until the closeout period, but instead requires the contractor to take action as its employees leave, and again at contract completion. If the contractor fails to take action as its employees leave or at contract completion and the contracting officer does not follow up, then the contracting officer must reconcile the matter at contract closeout.

C. Contractor Involvement in Issuance Process

Comment: Another respondent stated that contractor companies are not typically involved in the PIV card issuance process. Further, contractor responsibility for PIV card retrieval could be improved through involving the contractor/subcontractor in the PIV card issuance process.

Response: The Defense Acquisition Regulation Council and the Civilian Agency Acquisition Council agree that PIV card retrieval could be improved if the contractor was notified when an employee is issued a PIV card. DoD, GSA, and NASA recommend that agencies amend their PIV card procedures, if they are not doing so already, to notify the contractor company when an agency issues a PIV card to a contractor employee. In addition, the rule has been revised to state that the prime contractor is responsible for the return of all PIV cards that have been issued to the subcontractor's employees by the agency.

D. Withholding Payment

Comment: The same respondent had concerns about how long the Government may withhold payment for non-compliance. The respondent stated that the period of time that final payment may be delayed should be specified, e.g., “not to exceed 30 days” or “pending satisfactory resolution of the non-compliance.”

Response: It would be unwise to state a specific date such as “not to exceed 30 days” because the contractor may need a longer time to return the PIV card. Adding language like “pending satisfactory resolution of the non-compliance” is superfluous, as it is a given that the Government would only hold final payment until the non-compliance has been resolved.

III. Executive Order 12866

This is not a significant regulatory action and, therefore, is not subject to review under Section 6(b) of Executive Order 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

IV. Regulatory Flexibility Act

DoD, GSA, and NASA certify that this final rule will not have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the requirements of the actions required and the clause are not significantly burdensome. Currently, it is a common business practice to have procedures in place to revoke and return PIV cards when no longer in use by the contractor.

V. Paperwork Reduction Act

The Paperwork Reduction Act does not apply because the changes to the FAR do not impose information collection requirements that require the approval of the Office of Management and Budget under 44 U.S.C. chapter 35.

List of Subjects in 48 CFR Parts 4 and 52

• Government procurement

Dated: December 22, 2010.

Millisa Gary,

Acting Director, Federal Acquisition Policy Division.

Therefore, DoD, GSA, and NASA amend 48 CFR parts 4 and 52 as set forth below:

1. The authority citation for 48 CFR parts 4 and 52 continues to read as follows:

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42 U.S.C. 2473(c).

PART 4-ADMINISTRATIVE MATTERS

2. Amend section 4.1301 by adding paragraph (d) to read as follows:

4.1301

Policy.

* * * * *

(d)(1) Agency procedures for the return of Personal Identity Verification (PIV) products shall ensure that Government contractors account for all forms of Government-provided identification issued to Government contractor employees under a contract, i.e., the PIV cards or other similar badges, and shall ensure that contractors return such identification to the issuing agency as soon as any of the following occurs, unless otherwise determined by the agency:

(i) When no longer needed for contract performance.

(ii) Upon completion of a contractor employee's employment.

(iii) Upon contract completion or termination.

(2) The contracting officer may delay final payment under a contract if the contractor fails to comply with these requirements.

PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

3. Amend section 52.204-9 by revising the date of the clause; redesignating paragraph (b) as paragraph (d); adding a new paragraph (b); adding paragraph (c); and revising newly redesignated paragraph (d) to read as follows:

52.204-9

Personal Identity Verification of Contractor Personnel.

* * * * *

Personal Identity Verification of Contractor Personnel (JAN 2011)

* * * * *

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee's employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor`s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of Clause)