DOE O 206.2 Chg 1 (LtdChg), Identity, Credential, and Access Management (ICAM)

AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of the Chief Information Officer U.S. Department of Energy ORDER Washington, DC Approved: 2-19-2013 Chg 1 (LtdChg): 9-2-2022 SUBJECT: IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (ICAM) 1. PURPOSE. To establish requirements and responsibilities for DOE’s identity, credential, and access management program that: a. Provides a trusted framework and common identity infrastructure for access to DOE facilities and systems; b. Reduces the identity, credential, and access management burden for individual DOE and contractor organizations by fostering common interoperable approaches; c. Aligns identity, credential, and access management activities that cross organizational boundaries; d. Enables trust in online transactions through common identity, credential, and access management policies and approaches; e. Establishes roles to enhance interoperability when collaborating with external identity management activities; and f. Establishes the credentialing requirements for federal and contractor employees of the Department. 2. CANCELLATION. DOE O 206.2, Identity, Credential, and Access Management (ICAM), dated 2-19-13. Cancellation of a directive does not, by itself, modify or otherwise affect any contractual or regulatory obligation to comply with the directive. Contractor Requirements Documents (CRDs) that have been incorporated into a contract remain in effect throughout the term of the contract unless and until the contract or regulatory commitment is modified to either eliminate requirements that are no longer applicable or substitute a new set of requirements. 3. APPLICABILITY. a. Departmental Applicability. Except for the equivalencies/exemptions in paragraph 3.c., this Order applies to all DOE Elements. The Administrator of the National Nuclear Security Administration (NNSA) must assure that NNSA employees comply with their responsibilities under this directive. Nothing in this directive will be construed to interfere with the NNSA Administrator’s authority under section 3212(d) of Public Law (P.L.) 106-65 to establish Administration-specific policies, unless disapproved by the Secretary. DOE O 206.2 http://www.directives.doe.gov/ 2 DOE O 206.2 2-19-2013 b. DOE Contractors. (1) Except for the exemptions in paragraph 3.c., the Contractor Requirements Document (CRD) sets forth requirements of this Order that will apply to contracts that include the CRD. (2) The CRD, or its requirements, must be included in contracts when: (a) Contractor employees require routine access to a DOE facility or DOE information system; or (b) The contractor operates a DOE facility or DOE information system. c. Equivalency/Exemption. (1) Equivalency. In accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 USC 2406 and 2511 and to ensure consistency through the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Directive for activities under the Director's cognizance, as deemed appropriate. (2) Exemption. DOE information systems that are considered “national security systems” as defined by 44 U.S.C. 3542(b)(2) are exempt from this Order. 4. REQUIREMENTS. a. General.

(1) DOE facilities and DOE information systems must meet the requirements of Office of Management and Budget (OMB)M-19-17, which requires that agency implementations align with the Federal Chief Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance, and the FICAM Architecture and Continuous Diagnostics and Mitigation (CDM). (2) DOE must procure services and products that comply with HSPD-12 requirements in current Federal Acquisition Regulations and, where applicable, are on the General Services Administration (GSA) Approved Products List. b. Identity. (1) Enterprise Identity Management Service. An enterprise identity management service (EIMS) must be developed and offered as a Department-wide service that: 3 DOE O 206.2 2-19-2013 (a) Links authoritative sources of identity information on DOE employees and contractor employees; (b) Establishes a unique identity record for each DOE employee and contractor employee; (c) Provides DOE Elements a singular authoritative source for identity information to conduct DOE business; and (d) Supports the management of federated identity records from trusted identity providers both internal and external to the Federal Government. (2) DOE Unique Identifier. All DOE employees and contractor employees must have a DOE unique identifier that remains with the individual forever. The DOE unique identifier must never be assigned to another individual. Individuals must always have the same DOE unique identifier: (a) No matter how often they join and separate from DOE; (b) If they move to/and from Federal employee or contractor employee status; or (c) If they are employed by multiple contractors. (3) Identity Information. Information about an individual’s identity should be collected only once and maintained in an authoritative data source and must be shared across DOE Elements through the EIMS. (4) Identity Record. The identity record in the EIMS must contain a DOE unique identifier and all identity information that is associated with DOE employee or contractor employee. (5) Authoritative Data Sources. Multiple authoritative data sources may contain information that constitute an identity record for an individual. (a) A registry of authoritative data sources must exist and be maintained. (b) Authoritative data sources must make available identity information to the EIMS. (c) A responsible entity must be identified to maintain each authoritative data source. (6) Lifecycle Management. Identity information must be established and maintained by the DOE entity which is responsible for the accuracy of the 4 DOE O 206.2 2-19-2013 information. The DOE unique identifier ensures that an individual only has one identity record in EIMS. (7) Enterprise Backend Attribute Exchange (BAE) Service. An enterprise BAE service must be established and maintained that: (a) Is compliant with the Federal guidance and specifications for BAE; (b) Interfaces with other Federal Agency BAE service providers to share DOE identity information with other Federal Agencies; and (c) Provides DOE Elements a singular authoritative source for identity information of other Federal Agencies to conduct DOE business. c. Credentials.

(1) HSPD-12 Credentials. HSPD-12 Credentials are the Federal identification credentials that are compliant with National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 201- 2, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated 8-2013, or its successor. [See Appendix A for further information on Personal Identity Verification (PIV).] The terms “HSPD- 12 credentials” and “PIV cards” are used interchangeably within this Order. (a) DOE HSPD-12 credentials (PIV card) are the property of the U.S. Government and must be recovered whenever an individual has terminated employment or their security clearance status changes or otherwise no longer requires a badge. 1 HSPD–12 Credentials must be issued to all Federal employees and contractor employees who require long term (greater than six months) physical access to DOE facilities or information systems. 2 Issuance of HSPD-12 Credentials to DOE employees or contractor employees who are employed or providing services for less than 6 months must be based on a risk analysis. (b) Processes and procedures for the issuance of DOE HSPD-12 Credentials must be specified in the DOE PIV Card Issuer (PCI) Operations Plan per NIST Special Publication 800-79-1, Guidelines for the Accreditation of Personal Identity Verification (PIV) Card Issuers (PCIs), dated 6-2008, or its successor. HSPD- 12 Credential role holders facilitate credential issuance, maintenance, and lifecycle management. 5 DOE O 206.2 2-19-2013 1 FIPS 201-2 specifies required separation of duties relative to the HSPD-12 Credential issuance process. 2 DOE Implementation of HSPD-12 credential-related tasks and assignment of roles will be defined in the PCI Operations Plan. 3 Authorizing the issuance of HSPD-12 Credentials is a Federal function. (2) DOE Security Badges. The HSPD-12 Credential is the DOE security badge. DOE O 473.1, Physical Protection Program, current version, establishes requirements for usage of the DOE security badge. (3) Other Government Agencies (OGA). HSPD-12 Credentials issued by OGAs must be accepted for identification of individuals as though it was issued by DOE. DOE shall not issue HSPD-12 Credentials to Federal employees from OGAs that issue HSPD-12 Credentials, including the Department of Defense (DoD), without approval from the Office of Environment, Health, Safety and Security (EHSS). (4) Other Badges. The issuance of other badges to include LSSO badges, is specified in DOE O 473.1, current version. d. Authentication and Authorization. (1) Enterprise Access Management Service (EAMS). An enterprise access management service must be developed and offered as a Department-wide service that: (a) Centralizes the authentication of individuals requiring access to DOE information systems. (b) Supports authentication credentials approved by the DOE Office of the Chief Information Officer (OCIO), which includes, at a minimum: 1 The DOE HSPD-12 Credential; 2 HSPD-12 Credentials from OGAs; 3 Personal Identity Verification Interoperability (PIV-I) credentials; and 4 Federated identity credentials from identity providers certified under the Trust Framework Provider Adoption Process (TFPAP). 6 DOE O 206.2 2-19-2013 (2) DOE Information Systems. DOE information systems must ensure that the credential used for authentication meets the minimum level of assurance (LOA) requirements, which are determined by conducting an electronic authentication risk assessment per OMB M-04-04 in conjunction with a FIPS-199 assessment.

(a) New DOE Information Systems. New DOE information systems must accept the following credentials if presented by the user and the credential meets or exceeds the LOA of the system: 1 An HSPD-12 Credential for DOE employees and contractor employees who possess an HSPD-12 Credential as required by this Order; 2 An HSPD-12 Credential for Federal employees and contractor employees from other government agencies; 3 A PIV-I credential; and 4 A federated identity credential from an identity provider certified under the TFPAP. (b) Existing DOE Information Systems. Existing DOE information systems must be upgraded to accept the credentials in 4d(2)(a), as appropriate, using the Risk Management Approach per DOE O 205.1, Department of Energy Cyber Security Program, current version. (c) System Specific Credentials. DOE information system owners may issue and manage credentials for authentication ONLY when: 1 The individual does not possess or have access to one of the credentials in 4d(2)(a); or 2 The DOE information system requires individuals to authenticate with a credential in addition to the credentials in 4d(2)(a). (d) DOE Headquarters Information Systems. DOE Headquarters information systems owned and operated by DOE Headquarters Staff Offices or by contractors on behalf of DOE Headquarters Staff Offices must use the EAMS for authentication. 7 DOE O 206.2 2-19-2013 (3) DOE Facilities. (a) Access control decisions are based on risk management principles as required by the current versions of DOE O 473.1 and DOE O 470.4, Safeguards and Security Program. (b) Access control processes must accept for authentication the following credentials: 1 An HSPD-12 Credential for DOE employees and contractor employees; 2 An HSPD-12 Credential for Federal employees and contractor employees from other government agencies; 3 A PIV-I credential; and 4 Other badges to include LSSO badges, as specified in DOE O 473.1, current version. (c) Automated access control systems should obtain authoritative data from the EIMS. (d) DOE O 473.1, current version, contains the requirements for access control systems. (4) Background Investigations. This Order does not impose background investigation requirements for authentication and authorization to DOE facilities or DOE information systems. (5) Authorization. Authorization to access a DOE facility or a DOE information system is inherently a risk-based decision. e. Privilege Management. (1) DOE employees and contractor employees must have access to a DOE information system and/or DOE facility: (a) To which they are entitled for the performance of official duties; and (b) Only for the time period or duration in which they require it. (2) Enterprise Privilege Management Service. An enterprise access privilege service must be developed and offered as a Department-wide service that: (a) Streamlines and automates the tasks associated with provisioning, updating, and deprovisioning access to DOE facilities and information systems that integrate with it; and 8 DOE O 206.2 2-19-2013 (b) Streamlines and automates the issuance and maintenance of HSPD-12 Credentials and other credentials covered in this Order. f. Public Key Infrastructure (PKI). (1) Public Key Infrastructure (PKI) certificates for authentication, encryption, and signing operations must be issued by a PKI that operates in compliance with the current X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework where intra- and inter-agency interoperability and trust is required.

(2) A DOE PKI must be implemented as an enterprise service that: (a) Is cross-certified or chained through an approved Shared Service Provider (SSP) with the U.S. Federal PKI Common Policy Framework; (b) Issues PKI certificates to DOE employees and contractor employees where intra- and inter-agency interoperability and trust is required; and (c) Operates under the direction of the DOE PKI Policy Management Authority (PMA). (3) DOE Elements may implement internal (or local), site-specific PKIs to satisfy local PKI requirements that do not require trust and interoperability outside of site-specific locations. These local PKIs are not subject to the direction of the DOE PKI PMA; however, local PKIs must adhere to the Risk Management Approach per DOE O 205.1, current version, especially with respect to non-repudiation. g. Digital Signatures and Encryption. (1) DOE Elements must enable use of the PKI certificates to digitally sign and encrypt emails, business transactions, and relevant business documents in those cases where digital signatures and/or encryption are required. (2) Digital signatures should be created with HSPD-12 Credentials, when practical. h. PIV FILES. All documentation created in the PIV process will be retained in files with unique file identification. PIV case files must be distinct from personnel security (access authorization) files. When a PIV decision is linked to a personnel security determination, the personnel security file (PSF) is only used for documentation of the personnel security process, not the identity-proofing process. The System of Record numbers for PIV files are DOE-63, Personal Identity Verification files and GSA/GOVT-7 HSPD 12 USAccess. 9 DOE O 206.2 2-19-2013 5. RESPONSIBILITIES. a. Lead Program Secretarial Officers (LPSOs). Lead Program Secretarial Officers (LPSOs) shall perform risk analysis per paragraph 4.c.(1)(b) to authorize the issuance of HSPD-12 Credentials to Federal employees and contractor employees at their sites whose term of service is less than 6 months. b. Heads of Departmental Elements. Heads of Departmental Elements shall: (1) Have overall responsibility for the implementation of DOE’s identity, credential, and access management program for their respective elements. (2) Establish written procedures within their organizations with clear lines of responsibility for implementing the requirements of this order, including but not limited to: (a) The issuance, use, suspension, recovery, and destruction of the DOE HSPD-12 credential. (b) Maintaining current and accurate employee information in PIV databases. (c) Frequent verification that access to logical systems and physical facilities has been removed for individuals who no longer have an official relationship with the Department. (3) Approve the issuance of Local Site-Specific Only (LSSO) badges to non- U.S. nationals who have resided in the U.S. for less than three years, based on a risk determination, and after the completion of the required background checks. (4) Designate responsible individuals to work with the DOE Office of Management, Office of Acquisition and Project Management (OAPM) and the NNSA Office of Acquisitions and Supply Management (OASM) in providing procurement policy and guidance to contracting officers as follows: (a) Identify and add the CRD of this Order to applicable existing and new contracts; and (b) Ensure coordination with the applicable ICAM professionals to monitor and ensure contractor compliance with the CRD requirement during performance.

(5) Ensure that personal information collected for employee and contractor identification is handled in accordance with the Privacy Act of 1974, DOE O 206.1, Department of Energy Privacy Program, current version, and DOE O 471.7, Controlled Unclassified Information, current version. 10 DOE O 206.2 2-19-2013 c. DOE Office of the Chief Information Officer (OCIO). The OCIO shall: (1) Serve as the Agency Lead for ICAM and is responsible for managing and tracking the execution of the DOE ICAM program. (2) Establish an Integrated Project Team (IPT) with representatives from the DOE Elements to ensure that the execution of the ICAM initiative is a coordinated and collaborative approach. (3) Ensure that Enterprise ICAM Services are developed and provided. (4) Appoint the DOE PKI PMA. (5) Approve credentials that the EAMS will support. d. Office of Environment, Health, Safety, and Security (EHSS). EHSS shall: (1) Oversee issuance and maintenance of the HSPD-12 Credentials for DOE Headquarters. (2) Publish and maintain the DOE PCI Operations Plan. (3) Maintain DOE access control and physical security policies. (4) Determine the issuance of HSPD-12 Credentials to Federal employees and contractor employees at DOE Headquarters whose term of service is less than 6 months. e. DOE ICAM Integrated Project Team (IPT). The IPT shall: (1) Work with the OCIO to ensure that program-level decisions are based on coordinated input from all the stakeholders. (2) Publish and maintain a DOE Federated ICAM Framework in order to define the goals and objectives for achieving a DOE ICAM target state that is consistent with this policy, national policy and Federal ICAM guidance, and in a manner that improves, rather than impedes, the fulfillment of the Department’s statutory missions. (3) Ensure that the enterprise requirements specified in paragraph 4 Requirements, (above) are fulfilled to satisfy DOE cross enterprise needs. f. DOE Contracting Officials. DOE Contracting Officials shall: (1) Incorporate the CRD into affected contracts unless other policy directions are provided by OAPM or OASM under paragraph 5.b.(1) of this Order. (2) Work in partnership with ICAM professionals or the Contracting Officer Representative, as appropriate, to ensure that applicable ICAM scope, 11 DOE O 206.2 2-19-2013 clauses, and the CRD are incorporated into contracts; and to ensure contractor compliance with the ICAM requirements during performance. 6. REFERENCES. a. Executive Office of the President, Homeland Security Presidential Directive 12, August 27, 2004, https://www.opm.gov/news/reports-publications/management- budget-reports/homeland-security-presidential-directive-hspd-12.pdf b. Executive Office of the President, National Strategy for Trusted Identities in Cyberspace (NSTIC), April 2011. https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrate gy_041511.pdf c. Executive Office of the President, White House Cyberspace Policy Review, May 2009, https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Polic y_Review_final.pdf d. Federal Acquisition Regulation 52.204-9, Personal Identity Verification of Contractor Personnel https://www.acquisition.gov/far/52.204-9 e. OMB Memorandum 04-04, E-Authentication Guidance for Agencies, December 2003. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2004/ m04-04.pdf

f. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 2005. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/ m05-24.pdf g. OMB Memorandum 11-11, Continued Implementation of HSPD-12 Policy for a Common Identification Standard for Federal Employees and Contractors, February 2011. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/ m11-11.pdf h. OMB Memorandum 19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019. https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf i. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006, https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/ m06-18.pdf https://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-12.pdf https://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-12.pdf https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.acquisition.gov/far/52.204-9 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2004/m04-04.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2004/m04-04.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-18.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-18.pdf 12 DOE O 206.2 2-19-2013 j. OMB Memorandum, Requirements for Accepting Externally-Issued Identity Credentials, October 6, 2011, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/o mbreqforacceptingexternally_issuedidcred10-6-2011.pdf k. FIPS 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013, https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf l. Office of Personnel Management (OPM) Memorandum, subject: Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD–12, July 31, 2008, (2008 Final Credentialing Standards) https://www.opm.gov/suitability/suitability-executive-agent/policy/final- credentialing-standards.pdf m. OPM Memorandum, subject: Credentialing Standards Procedures for Issuing Personal Identity Verification Cards under HSPD-12 and New Requirement for Suspension or Revocation of Eligibility for Personal Identity Verification Credentials, December 15, 2020, (2020 Credentialing Standards Procedures) https://www.opm.gov/suitability/suitability-executive-agent/policy/cred- standards.pdfDOE O 221.1, Reporting Fraud, Waste and Abuse to the Office of Inspector General, current version

n. Performance Accountability Council (PAC) Memorandum, subject: Guidance on Executive Branch-Wide Requirements for Issuing Personal Identity Verification (PIV) Credentials and Suspension Mechanism, March 02, 2016, (2016 PAC Memorandum) https://www.opm.gov/suitability/suitability-executive- agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf o. Joint Federal Investigations Notice and Suitability and Credentialing Executive Agent Notice/NBIB Notice No.18-02 Suit/Cred EA Notice No.18-01 dated April 05, 2018, https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/FINs/FY18/fin-18- 02.pdf p. DOE O 221.1, Reporting Fraud, Waste and Abuse to the Office of Inspector General, current version q. DOE O 470.4, Safeguards and Security Program, current version r. DOE O 471.7, Controlled Unclassified Information, current version s. DOE O 473.1, Physical Protection Program, current version t. DOE Federated ICAM Framework, June 30, 2011, https://powerpedia.energy.gov/wiki/Doe_federated_icam_framework https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/cred-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/cred-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/FINs/FY18/fin-18-02.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/FINs/FY18/fin-18-02.pdf https://powerpedia.energy.gov/wiki/Doe_federated_icam_framework 13 DOE O 206.2 2-19-2013 u. X.509 Certificate Policy For The U.S. Federal PKI Common Policy Framework, https://www.idmanagement.gov/docs/fpki-x509-cert-policy-common.pdf 7. DEFINITIONS. a. Adjudicator: The Adjudicator is a federal employee delegated the duty to review and adjudicate all federal employee and contractor background investigations. The Adjudicator enters or updates the adjudication results for applicants in the credential issuance system. b. Applicant: An individual applying for an HSPD-12 Credential. The applicant may be a current or prospective Federal hire or a Federal employee or an applicant for employment with a DOE contractor or a current DOE contractor employee. c. Authentication: The process of verifying a person’s identity using a credential (password, PIN, smartcard, badge, etc). The Physical Access community may use the term “validate & verify” a credential, which is an equivalent operation. d. Authoritative Data Source: A repository or system that contains identity information about an individual and is considered to be the primary or most reliable source for this information. In the case that two or more systems have mismatched or conflicting data, the identity information within the authoritative data source is considered to be the most accurate.

e. Authorization: The processes of granting or denying specific requests for obtaining and using information processing services or data and to enter specific physical facilities. Once a person is authenticated, the system determines the appropriate set of privileges (or access) for that individual. f. DOE facility: A facility, which is owned (or leased) and operated by DOE or by contractors on behalf of DOE, that is required by DOE O 473.1, current version, to have access control. g. DOE information system: An information system that is owned and operated by DOE or by contractors on behalf of DOE to accomplish a Federal function. Regardless of whether DOE Federal employees have access, this does not include information systems operated by M&O contractors unless such systems’ primary purpose is to accomplish a Federal function. h. HSPD-12 Credential: The HSPD-12 Credential is the Personal Identity Verification Card (or PIV Card) as mandated by Homeland Security Presidential Directive 12 (HSPD-12). i. Issuer: The organization that is issuing the HSPD-12 Credential to an applicant. https://www.idmanagement.gov/docs/fpki-x509-cert-policy-common.pdf 14 DOE O 206.2 2-19-2013 j. Level of Assurance: As described in OMB M-04-04, level of assurance (or LOA) is the degree of certainty that a credential used for authentication actually refers to the identity of the person who is using the credential. k. Personal Identity Verification Interoperability (PIV-I): PIV-I is a credential that is issued to non-Federal entities per Personal Identity Verification Interoperability for Non-Federal Issuers dated July 2010, to facilitate interactions with Federal Government facilities and information systems. l. Sponsor: The individual who substantiates the current, active DOE employment status of the individual and the need for an HSPD-12 Credential to be issued to an applicant, enters the applicant’s required biographical and sponsorship data elements into the credential issuance system, and remains aware of the applicant’s status and continuing need for holding an HSPD-12 Credential. 8. CONTACT. Office of the Chief Information Officer, 202-586-0166. BY ORDER OF THE SECRETARY OF ENERGY: DAVID M. TURK Deputy Secretary Appendix A – Federal Employees Only DOE O 206.2 2-19-2013 Page A-1 APPENDIX A: PERSONAL IDENTITY VERIFICATION (PIV) This Appendix provides the credentialing standards and procedures to promote defined goals in DOE eligibility determinations to issue HSPD-12 PIV credentials for access to federally controlled facilities and information systems:1 the protection of the life, safety, property, or health of employees, contractors, vendors or visitors to Federal facilities; the protection of the Government’s physical assets, information systems, records, including privileged, proprietary, financial or medical records; and the privacy of the individuals whose data the Government holds in its systems. 1. DEFERRED PROCESSING. If an HSPD-12 Credential applicant is currently awaiting a criminal hearing or trial; is awaiting or serving a form of pre-prosecution probation, suspended or deferred sentencing, probation, or parole in conjunction with an arrest or criminal charges for a crime that is punishable by imprisonment of 6 months or longer, or has an outstanding warrant, the adjudicator may suspend further processing and notify the sponsor of the cause. When the hearing, trial, criminal prosecution, suspended sentencing, deferred sentencing, probation, or parole has been completed, the applicant may be resubmitted to the identity proofing process to determine eligibility for an HSPD- 12 Credential.

2. HSPD-12 ELIGIBILITY ADJUDICATION. a. The credentialing standards (adjudicative guidelines) provided in the 2008 Final Credentialing Standards and the 2016 PAC Memorandum, as clarified by the 2020 Credentialing Standards Procedures, and any future iterations of such standards, must be applied to determine eligibility for an HSPD-12 PIV credential for physical or logical access to federally controlled facilities and/or information systems. b. The following six standards must be applied when adjudicating an individual’s eligibility for an HSPD-12 PIV credential which provides logical and/or unescorted physical access. The six standards may also be used when determining an individual’s suitability for other credentials, e.g., LSSO, which provides logical and/or unescorted physical access. A PIV card will not be issued to a person if: (1) The individual is known to be, or reasonably suspected of being, a terrorist; (2) The individual’s claimed identity cannot be verified; 1 The term “federally controlled”, as it relates to facilities and information systems is defined in 48 Code of Federal Regulations §2.101. Appendix A – Federal Employees Only Page A-2 DOE O 206.2 2-19-2013 (3) There is a reasonable basis to believe2 that the individual has provided fraudulent information concerning his or her identity; (4) There is a reasonable basis to believe the individual will attempt to gain unauthorized access to classified documents, information protected by the Privacy Act, information that is proprietary in nature, or other sensitive or protected information; (5) There is a reasonable basis to believe the individual will use a PIV card outside the workplace or inappropriately; or (6) There is a reasonable basis to believe the individual will use federally controlled information systems unlawfully, make unauthorized modifications to such systems, corrupt or destroy such systems, or engage in inappropriate uses of such systems. c. Additionally, the following supplemental standards must be applied to the adjudication of eligibility for individuals who do not require a suitability determination or security clearance. DOE may consider denying or revoking a PIV card to an individual based on one of these supplemental credentialing standards. (1) There is a reasonable basis to believe based on the individual’s misconduct or negligence in employment, that issuance of a PIV card poses an unacceptable risk;3 (2) There is a reasonable basis to believe based on the individual’s criminal or dishonest conduct, that issuance of a PIV card poses an unacceptable risk; (3) There is a reasonable basis to believe based on the individual’s material, intentional false statement, deception, or fraud in connection with contract employment, that issuance of a PIV card poses an unacceptable risk; (4) There is a reasonable basis to believe based on the nature or duration of the individual’s alcohol abuse without evidence of substantial rehabilitation, that issuance of a PIV card poses an unacceptable risk; (5) There is a reasonable basis to believe based on the nature or duration of the individual’s illegal use of narcotics, drugs, or other controlled 2 A “reasonable basis to believe” occurs when a disinterested observer, with knowledge of the same facts and circumstances, would reasonably reach the same conclusion.

3 An "unacceptable risk" refers to a threat to the life, safety, or health of employees, contractors, vendors, or visitors; to the Government's physical assets or information systems; to personal property; to records, including classified, privileged, proprietary, financial, or medical records; or to the privacy of data subjects, which will not be tolerated by the Government. Appendix A – Federal Employees Only DOE O 206.2 2-19-2013 Page A-3 substances without evidence of substantial rehabilitation, that issuance of a PIV card poses an unacceptable risk; (6) There is a statutory or regulatory bar that prevents the individual’s contract employment; or would prevent federal employment under circumstances that furnish a reasonable basis to believe that issuance of a PIV card poses an unacceptable risk; or (7) The individual has knowingly and willfully engaged in acts or activities designed to overthrow the U.S. Government by force. d. A new credentialing determination will be required if there has been a break in service (or in a contractor’s association with Government contract work) exceeding 24 months following the favorable adjudication of the previously conducted investigation. e. In the adjudication process, the adjudicator shall have the authority to obtain additional information as may be deemed necessary to resolve possible issues of concern pertaining to the applicant. f. An Individual who has received an unfavorable national security eligibility determination under E.O. 12968, Access to Classified Information, may undergo an HSPD-12 eligibility determination if the individual’s employment is not terminated due to the unfavorable information.4 The unfavorable national security adjudication determination may be sufficient basis for non-issuance or revocation of a PIV credential. 3. NON-UNITED STATES NATIONALS CREDENTIALING: The following credentialing standards must be applied to non-U.S. nationals5 who work as employees or contractors for Federal departments or agencies or others who require long-term logical or physical access to Federal government facilities. a. In circumstances where investigative standards cannot be met, a PIV must not be issued. b. Reciprocity rules do not apply to alternative identity credentials, e.g., alternative credentials issued by another Federal agency when a PIV cannot be issued. c. Non-U.S. national credentials must indicate the specific site to which the individual is granted access. The site name must be printed on the credential; for 4 If an individual who otherwise meets these standards is found: 1) unsuitable for the competitive civil service under 5 CFR part 731, 2) ineligible for access to classified information under E.O. 12968, 3) disqualified from appointment in the excepted service or from working on a contract, or 4) ineligible to hold a national security sensitive position, the unfavorable decision may be a sufficient basis for non-issuance or revocation of a PIV card. 5 The term “United States national” includes both U.S. citizens and U.S. non-citizen nationals (i.e., American Samoans). Appendix A – Federal Employees Only Page A-4 DOE O 206.2 2-19-2013 the GSA USAccess credential, the site name must be placed in the Agency Specific Data field. d. Due to limitations that apply to the employment of non-U.S. nationals and the ability to collect background investigation information in locations outside the United States, special considerations apply when a PIV credential is needed for a non-U.S. national.

(1) The employment verification requirements for Non-U.S. national federal employees or contractors are: (a) Verify employment eligibility through E-Verify for non-U.S. nationals living in the U.S. (b) Verify immigration status through the United States Customs and Immigration Service’s (USCIS) Systemic Alien Verification for Entitlements (SAVE)6 system for non-U.S. nationals living in U.S. territories (other than American Samoa).7 (2) The background investigation requirements for non-U.S. national federal employees or contractors are dependent on the residency status and length of time in the U.S. of the non-U.S. national. (a) Non-U.S. nationals living in the U.S. or a U.S. Territory for three or more years continuously and immediately preceding the start of the Federal affiliation require a Tier 1 investigation or equivalent after employment authorization or immigration status is verified. (b) Non-U.S. nationals living in the U.S. or a U.S. Territory for less than three continuous years preceding the start of the Federal affiliation cannot be processed for a Tier 1 investigation. At the Head of Departmental Element’s discretion, based on a risk determination, an LSSO badge, may be issued until the employee or contractor in question has resided for three years in the U.S. or U.S. Territory. If an LSSO is issued; the following checks8 must be completed: 6 https://www.uscis.gov/save 7 The U.S. territory of American Samoa is not included in the "United States" as defined by the Immigration and Nationality Act, and therefore the DHS E-Verify and SAVE verification programs are unable to verify work authorization or immigration status of individuals in American Samoa. Departmental elements should conduct such background investigation as may be possible and appropriate under the circumstances in this territory. 8 The listed checks will provide limited results, does not constitute a Tier 1investigation, and will not be documented as a Tier 1 investigation. https://www.uscis.gov/save Appendix A – Federal Employees Only DOE O 206.2 2-19-2013 Page A-5 1 Federal Bureau of Investigation (FBI) fingerprint based National Criminal History Check (NCHC) must be completed before an LSSO badge is issued; 2 FBI Investigations Files name check; 3 Terrorist Screening database name check; 4 USCIS check against SAVE system; and 5 Any additional checks deemed necessary by the Department or Head of Departmental Element. 4. UNFAVORABLE PIV DETERMINATIONS. a. For cases where the adjudicative process results in an unfavorable credentialing determination, the adjudicating office must do the following: (1) Within two working days of the determination, furnish the individual a comprehensive written explanation of the basis for the denial or revocation of PIV eligibility to the degree that the national security interests of the United States and other applicable law permits; (2) Afford the individual a response opportunity (written) and 30 days to provide information or documentation that may refute or alleviate the concerns; and (3) Evaluate the individual’s response, and, if the concerns are not eliminated or adequately addressed, notify the individual in writing of the final unfavorable determination and apprise the individual of the appeals process available to the individual as detailed below, including contact information.

b. Report unfavorable PIV eligibility determinations to the contract entity that employs or seeks to employ the covered individual. While it is appropriate to advise the contractor that an unfavorable PIV eligibility determination has been made, it may not be appropriate to disclose additional information about the basis for the determination. 5. PIV APPEAL PROCESS. a. The identity verification appeal process does not interfere with DOE's discretion to make suitability or access authorization (security clearance) determinations either before or after a person has entered on duty. b. Upon receipt of the adjudicator’s denial or revocation of HSPD-12 Credential notice, an individual has ten working days to inform the adjudicator in writing, or by electronic means (e.g., email), of the intent to file an appeal. The individual Appendix A – Federal Employees Only Page A-6 DOE O 206.2 2-19-2013 may be represented and advised by counsel or a representative of the individual’s choosing in the appeal process, at the individual’s expense. c. The individual must file the actual written appeal with the adjudicator within 30 working days after notifying the adjudicator of intent to file. The appeal must be submitted in writing and provide a response to the information that formed the basis of the denial or revocation of the HSPD-12 Credential. d. Upon receiving the individual’s notification of intent to file an appeal, the adjudicator will notify the contract entity that employs or seeks to employ the covered individual. e. Upon receiving the individual’s notification of intent to file an appeal, the adjudicator will identify and notify members of the appeal panel. The appeals panel cannot include the individual who made the initial decision to deny or revoke the PIV eligibility. The appeal panel will consist of three members, who must be DOE employees who have been investigated to a level commensurate with the person filing the appeal, as follows: (1) A representative of the Departmental or Field Element having cognizance over the site, appointed by the head of that element; (2) A DOE attorney designated by the General Counsel; and (3) A representative of the security office for the hiring site, appointed by the head of the relevant Departmental or Field Element. f. Upon receipt of the written appeal, the adjudicator prepares an appeal package for each panel member consisting of a copy of all identity proofing documentation, the background investigation, the notification of denial or revocation of the HSPD-12 Credential providing the adjudicator’s rationale for denial or revocation, and the written appeal of the individual. g. Each panel member will review the package and within 30 working days respond to the adjudicator in writing indicating either concurrence or nonconcurrence with the denial or revocation of the HSPD-12 Credential decision. For any nonconcurrence, the panel member will provide a brief rationale. h. The decision of the appeal panel will be determined by simple majority of concurrence or nonconcurrence. This decision is final. The adjudicator will inform the appellant and sponsor of the appeal decision and, in those instances where there is majority nonconcurrence with denial or revocation of the HSPD-12 Credential, the HSPD-12 Credential will be issued in accordance with the PCI Operations plan. 6. TRANFERS FROM OTHER GOVERNMENT AGENCIES. DOE will accept PIV card credentialing determinations made by other Federal agencies under the following conditions:

Appendix A – Federal Employees Only DOE O 206.2 2-19-2013 Page A-7 a. The PIV eligibility determination was a favorably adjudicated final (not interim) determination at the appropriate tier for the new position based on a completed Tier 1 or equivalent or higher level of investigation; b. There has been no break in service (or in a contractor's association with Government contract work) exceeding 24 months following the favorable adjudication of the previously conducted investigation; and c. DOE is not in possession of any new information that calls into question the person's eligibility for a PIV credential.” 7. SUSPENSION OF PIV ELIGIBILITY. a. An individual’s PIV may be suspended (suspending an Active PIV credential and associated access privileges granted by the credential) when DOE is in possession of credible adverse information that a person may pose an unacceptable risk (to the life, safety, property, or health of employees, contractors, vendors, or visitors to a Federal facility; to the Government’s physical assets or information systems; to records, including privileged, proprietary, financial, or medical records; or to the privacy of the individuals whose data the Government holds in its systems), and the nature of the risk must be assessed in accordance with the respective organizations’ implementation guidance. b. Credible adverse information must be referred for other action as necessary and appropriate and in a timely manner, including referral to the Office of Inspector General, as appropriate, pursuant to DOE O 221.1, Reporting Fraud, Waste and Abuse to the Office of Inspector General, current version. Appropriate referrals could be to local law enforcement, a Local Insider Threat Working Group, a physical security office, a counterintelligence office, or the FBI, depending on the circumstances. c. When information is received that suggests the person presents an imminent risk to facilities or information systems or a danger to the occupants and visitors to a facility or to the public, immediate action must be taken to retrieve the PIV credential from the credential holder if the nature of the risk permits. Additionally, the technical features of the credential that enable access to facilities and information systems must be revoked and the individual denied access to facilities and information systems until resolution of the issue. The following examples describing information about a covered individual derived from self-reporting or third-party reporting may warrant immediate suspension of credentials. They are provided for illustrative purposes and are not intended to be exhaustive. They do not replace the measured judgment and consideration of all circumstances surrounding the issue. (1) Known or reasonable suspicion of terrorist activities or involvement. Appendix A – Federal Employees Only Page A-8 DOE O 206.2 2-19-2013 (2) Known or reasonable suspicion of activities demonstrating that the individual has used or intends to use his or her PIV credential or credential tokens to permit access to a Government facility or information system to do harm or permit others to do harm to the facility, its occupants, or its systems. (3) Known activities, or reasonable suspicion or threat of activities, designed to corrupt, destroy, or otherwise affect the operating status and availability of critical Government information systems.

(4) Gaining, attempting to gain, or assisting others in their efforts to gain unauthorized access to classified documents, information protected by the Privacy Act, information that is proprietary in nature, or other sensitive or protected information with intent to compromise the information, commit identity fraud, or to otherwise use the information in a malicious or harmful way. (5) Violent actions or the threat of violent actions at a Federal workplace. (6) Bringing, or attempting to bring, an unauthorized weapon into a Federal workplace. (7) The covered individual’s expression of his or her intent to harm or kill him or herself or others. (8) The covered individual’s behavior or statements that allow a reasonable inference that he or she intends to harm him or herself or others. d. When the risk is not deemed to be imminent, but there is a reasonable basis to believe there may be an unacceptable risk due to issues that potentially impact the individual’s eligibility for a PIV credential, discretion exists to determine if the PIV credential and all associated technical features enabling access to facilities and information systems should be suspended or if the individual should retain access until the matter is fully resolved. e. Derogatory information that results in the suspension of PIV eligibility must also result in the appropriate suspension (or if suspension is not available, the revocation) of the access to physical facilities and information systems. (1) When possible and advisable, all available information should be reviewed, including, but not limited to the PIV credential holder’s explanation, before deciding to suspend (or revoke) the PIV credential. However, there is no requirement to do so if, the delays created by this review would increase risk. The decision maker should err on the side of caution and safety and suspend or revoke the PIV credential if credible information is received that there is an imminent risk or danger. Appendix A – Federal Employees Only DOE O 206.2 2-19-2013 Page A-9 (2) Site-specific procedures to issue emergency notifications when imminent risk calls for immediate suspension or revocation must be established. (3) The suspension or revocation steps are particularly important if the credential cannot be safely recovered from the credential holder. Suspension or revocation protocols must be developed for circumstances when a PIV credential eligibility is to be suspended. The protocols must be designed to effectuate an immediate suspension or revocation of the card’s functionalities, to include physical, logical, and derived accesses. f. Regardless of the means used to suspend or revoke the PIV card, the following must be accomplished in a timely manner to mitigate the unauthorized use of the card: (1) Whenever possible, collect and secure the PIV credential. (2) Immediately alert all access points at the sponsoring Federal facility (and any other facilities where the individual has been granted access) that the PIV credential and credential tokens have been suspended; provide a physical description or picture of the person when there may be an imminent risk or safety concern, if possible. (3) Terminate any existing access privileges to IT systems and applications, including remote access. (4) Report the individual’s PIV credential eligibility as “suspended” in USAccess, Central Verification System (CVS),9 or successor data system, as applicable. The USAccess application is the authoritative source for identifying and executing suspensions and terminations of all PIV credentials.

(5) As appropriate, notify and coordinate with Local Insider Threat Working Groups and/or Federal and local law enforcement offices through established channels, and notify and coordinate with the Office of Inspector General, as appropriate, pursuant to DOE O 221.1, current version. (6) The derogatory information that resulted in suspension of the credential is reportable for national security eligibility or counterintelligence reasons as follows: (a) If the person in question occupies a sensitive position, notify the office which is responsible for determining national security 9 Joint Federal Investigations Notice and Suitability and Credentialing Executive Agent Notice/NBIB Notice No.18- 02 Suit/Cred EA Notice No.18-01 dated April 05, 2018. Appendix A – Federal Employees Only Page A-10 DOE O 206.2 2-19-2013 eligibility, as appropriate, as well as the Local Insider Threat Working Group.10 (b) If the person in question occupies a non-sensitive position, the underlying derogatory information will dictate whether counterintelligence and/or insider threat authorities should be notified.11 (7) When suspending PIV eligibility of contractor employees, the contracting company must be notified of the suspension. While it is appropriate to advise the contractor that a suspension has occurred, it may not be appropriate to disclose additional information about the basis for the determination. 10 See Security Executive Agent Directive 3, Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position (2017). 11 IBID Attachment 1 – CRD, Contractors Only DOE O 206.2 2-19-2013 Page 1-1 ATTACHMENT 1 CONTRACTOR REQUIREMENTS DOCUMENT DOE O 206.2, IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT Regardless of the performer of the work, the contractor is responsible for complying with the requirements of this CRD. The contractor is responsible for flowing down the requirements of this CRD to subcontractors at any tier to the extent necessary to ensure the contractor’s compliance with the requirements. 1. GENERAL. a. DOE facilities and DOE information systems must meet the requirements of Office of Management and Budget (OMB)M-19-17, which requires that agency implementations align with the Federal Chief Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance and the FICAM Architecture and Continuous Diagnostics and Mitigation (CDM). PIV credentials (where applicable in accordance with OPM requirements) are DOE’s primary means of identification and authentication to Federal information systems and Federally controlled facilities and secured areas by Federal employees and contractors. b. HSPD-12 Credentials. HSPD-12 Credentials are the Federal identification credentials that are compliant with National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated 8-2013, or its successor. Contractor employees requiring an HSPD-12 Credential are subject to Personal Identity Verification (PIV) by DOE. (1) This Order establishes the requirement for issuance of PIV to federal employees and contractors. (a) Local implementation of the requirements under the DOE authorization to issue PIV credentials using the DOE provider, USAccess, may be performed by an M&O contractor. (b) An M&O contractor may serve as the sponsor for M&O staff and subcontractors for a PIV credential.

(2) HSPD–12 Credentials must be issued to all Federal employees and contractor employees who require long term (greater than six months) physical access to DOE facilities or information systems. (3) Issuance of HSPD-12 Credentials to DOE employees or contractor employees who are employed or providing services for less than 6 months is at the discretion of the Lead Program Secretarial Officer (LPSO) and based on a risk analysis. Attachment 1 – CRD, Contractors Only Page 1-2 DOE O 206.2 2-19-2013 c. Identity. Contractors may participate in the enterprise identity management service (EIMS) and should determine participation based on business value and risks. If participating, contractors must: (1) Identify their authoritative data sources to the DOE registry of authoritative data sources; and (2) Make available identity information from authoritative data sources to the EIMS. d. Electronic Transactions with DOE. When DOE requires digital signatures or encryption, contractors must enable the use of Public Key Infrastructure (PKI) certificates. (1) The PKI must comply with the current X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework. (2) Contractors should use the PKI certificates that are on the HSPD-12 Credential, when practical. 2. DOE INFORMATION SYSTEMS. When operating a DOE information system as defined in this Order, the contractor must meet the following requirements. a. General. DOE information systems must meet the requirements of Office of Management and Budget (OMB) M-19-17, which requires that agency implementations align with the Federal Chief Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance, and the FICAM Architecture and Continuous Diagnostics and Mitigation (CDM). b. Authentication and Authorization. (1) DOE information systems must ensure that the credential used for authentication meets the minimum level of assurance (LOA) requirements, which are determined by conducting an electronic authentication risk assessment per OMB M-04-04 in conjunction with a FIPS 199 assessment. (a) New systems must accept the following credentials if presented by the user and the credential meets or exceeds the LOA of the system: 1 An HSPD-12 Credential for DOE employees and contractor employees who possess an HSPD-12 Credential as required by this Order; 2 An HSPD-12 Credential for Federal employees and contractor employees from other government agencies; Attachment 1 – CRD, Contractors Only DOE O 206.2 2-19-2013 Page 1-3 (and 1-4) 3 A Personal Identity Verification Interoperability (PIV-I) credential; and 4 A federated identity credential from an identity provider certified under the Trust Framework Provider Adoption Process (TFPAP). (b) Existing DOE information systems must be upgraded to accept the credentials in 2b(1)(a), as appropriate, using the Risk Management Approach per DOE O 205.1, Department of Energy Cyber Security Program, current version. (2) DOE information system owners may issue and manage credentials for authentication ONLY when: (a) The individual does not possess or have access to one of the credentials in 2b(1)(a); or (b) The DOE information system requires individuals to authenticate with a credential in addition to the credentials in 2b(1)(a). 3. DOE FACILITIES. a. Access control decisions are based on risk management principles as required by the current versions of DOE O 473.1, Physical Protection Program, and DOE O 470.4, Safeguards and Security Program.

b. Contractors must recognize the following credentials as an acceptable credential for verifying a person's identity as part of the site’s physical access procedure: (1) An HSPD-12 Credential for DOE employees and contractor employees; (2) An HSPD-12 Credential for Federal employees and contractor employees from other government agencies; and (3) A PIV-I credential. c. Automated access control systems should obtain authoritative data for DOE employees and contractor employees external to the site from the EIMS offered by DOE. d. DOE O 473.1, current version, contains the requirements for access control systems. SUBJECT: IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (ICAM) 1. PURPOSE. 2. CANCELLATION. 3. APPLICABILITY. a. Departmental ApplicabilityDOE Elements. b. DOE Contractors. c. Equivalency/Exemption. 4. REQUIREMENTS. a. General. b. Identity. c. Credentials. d. Authentication and Authorization. e. Privilege Management. f. Public Key Infrastructure (PKI). g. Digital Signatures and Encryption. h. PIV FILES. 5. RESPONSIBILITIES. a. Lead Program Secretarial Officers (LPSOs) b. Heads of Departmental Elements c. DOE Office of the Chief Information Officer (OCIO) d. Office of Environment, Health, Safety, and Security (EHSS) e. DOE ICAM Integrated Project Team (IPT) f. DOE Contracting Officials (1) Incorporate the CRD into affected contracts unless other policy directions are provided by OAPM or OASM under paragraph 5.b.(1) of this Order. (2) Work in partnership with ICAM professionals or the Contracting Officer Representative, as appropriate, to ensure that applicable ICAM scope, clauses, and the CRD are incorporated into contracts; and to ensure contractor compliance with the ICAM re... 6. REFERENCES. 7. DEFINITIONS. a. Adjudicator: b. Applicant c. Authentication: d. Authoritative Data Source: e. Authorization: f. DOE facility: g. DOE information system h. HSPD-12 Credential i. Issuer j. Level of Assurance k. Personal Identity Verification Interoperability (PIV-I) l. Sponsor: 8. CONTACT BY ORDER OF THE SECRETARY OF ENERGY: DAVID M. TURK, Deputy Secretary Deputy Secretary APPENDIX A: PERSONAL IDENTITY VERIFICATION (PIV) 1. DEFERRED PROCESSING 2. HSPD-12 ELIGIBILITY ADJUDICATION. 3. NON-UNITED STATES NATIONALS CREDENTIALING: 4. UNFAVORABLE PIV DETERMINATIONS. 5. PIV APPEAL PROCESS. 6. TRANFERS FROM OTHER GOVERNMENT AGENCIES. 7. SUSPENSION OF PIV ELIGIBILITY. ATTACHMENT 1. CONTRACTOR REQUIREMENTS DOCUMENT 1. GENERAL. 2. DOE INFORMATION SYSTEMS a. General b. Authentication and Authorization. 3. DOE FACILITIES.