DOE O 206.2 Chg 1 (LtdChg), Identity, Credential, and Access Management (ICAM) - Change Chart

U.S. Department of Energy LIMITED CHANGE Washington, DC Chg 1 (LtdChg): 9-2-2022 SUBJECT: LIMITED CHANGE TO DOE O 206.2, IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (ICAM) 1. EXPLANATION OF CHANGES. This Limited Change aligns the Order with updated national guidance and ensures consistent credentialing adjudication determinations within the Department during the process to issue a Homeland Security Presidential Directive (HSPD)-12 Personal Identity Verification (PIV) credential. 2. LOCATIONS OF CHANGES: Page Paragraph Changed To Throughout DOE O 205.1B, Department of Energy Cyber Security Program, dated 5-16-11 DOE O 205.1, Department of Energy Cyber Security Program, current version Throughout DOE O 206.1, Department of Energy Privacy Program, dated 1-16-09 DOE O 206.1, Department of Energy Privacy Program, current version Throughout DOE O 470.4B, Safeguards and Security Program, dated 7-21-11 DOE O 470.4, Safeguards and Security Program, current version Throughout DOE O 471.3, Identifying and Protecting Official Use Only Information, dated 4-9-03 DOE O 471.7, Controlled Unclassified Information, current version Throughout DOE O 473.3, Protection Program Operations, dated 6-29- 11 DOE O 473.1, Physical Protection Program, current version Throughout Office of Health, Safety and Security (HSS) Office of Environment, Health, Safety and Security (EHSS) 1 1.f. Added. Establishes the credentialing requirements for federal and contractor employees of the Department. 2 3.b.(2)(a) Contractor personnel require routine access to a DOE facility or DOE information system; or Contractor employees require routine access to a DOE facility or DOE information system; or 2 4.a.(1) DOE facilities and DOE information systems must meet the requirements of Office of Management and Budget (OMB) M-11-11, which requires that agency implementations align with the Federal Chief DOE facilities and DOE information systems must meet the requirements of Office of Management and Budget (OMB) M-19-17, which requires that agency implementations align with the Federal Chief Information DOE O 206.2 Page Paragraph Changed To Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance. Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance, and the FICAM Architecture and Continuous Diagnostics and Mitigation (CDM). 4 4.c.(1) – 4.c.(1)(a) HSPD-12 Credentials. HSPD-12 Credentials are the Federal identification credentials that are compliant with National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 201- 1, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated 3-2006, or its successor. [See Appendix A for further information on Personal Identity Verification (PIV).]. Issuance of HSPD-12 Credentials to DOE employees or contractor employees who are employed or providing services for less than 6 months must be based on a risk analysis. (a) HSPD–12 Credentials must be issued to: 1 DOE employees; 2 Cleared contractor employees; 3 Uncleared contractor employees servicing DOE Headquarters; and 4 Other uncleared DOE contractor employees based on a risk analysis.

HSPD-12 Credentials. HSPD-12 Credentials are the Federal identification credentials that are compliant with National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated 8-2013, or its successor. [See Appendix A for further information on Personal Identity Verification (PIV).] The terms “HSPD-12 credentials” and “PIV cards” are used interchangeably within this Order. (a) DOE HSPD-12 credentials (PIV card) are the property of the U.S. Government and must be recovered whenever an individual has terminated employment or their security clearance status changes or otherwise no longer requires a badge. 1 HSPD–12 Credentials must be issued to all Federal employees and contractor employees who require long term (greater than six months) physical access to DOE facilities or information systems. 2 Issuance of HSPD-12 Credentials to DOE employees or contractor employees who are employed or providing services for less than 6 months must be based on a risk analysis. Page Paragraph Changed To 5 4.c.(1)(b)1 FIPS 201-1 specifies required separation of duties relative to the HSPD-12 Credential issuance process. FIPS 201-2 specifies required separation of duties relative to the HSPD-12 Credential issuance process. 5 4.c.(1)(b)3 Authorizing the issuance of HSPD-12 Credentials is a Federal function, except in the case of Management and Operating (M&O) contractors. M&O contractors may authorize credential issuance to their own employees and to their subcontractors’ employees. Authorizing the issuance of HSPD- 12 Credentials is a Federal function. 7 4.d.(3)(b)4 Added. Other badges to include LSSO badges, as specified in DOE O 473.1, current version. 8 4.h. Added. PIV FILES. All documentation created in the PIV process will be retained in files with unique file identification. PIV case files must be distinct from personnel security (access authorization) files. When a PIV decision is linked to a personnel security determination, the personnel security file (PSF) is only used for documentation of the personnel security process, not the identity-proofing process. The System of Record numbers for PIV files are DOE-63, Personal Identity Verification files and GSA/GOVT- 7 HSPD 12 USAccess. 9 5.a. Lead Program Secretarial Officers (LPSOs). Lead Program Secretarial Officers (LPSOs) shall perform risk analysis per paragraph 4.c.(1) to authorize the issuance of HSPD- 12 Credentials to: (1) Federal employees and contractor employees at their sites whose term of service is less than 6 months; and (2) Uncleared contractor employees at their sites. Lead Program Secretarial Officers (LPSOs). Lead Program Secretarial Officers (LPSOs) shall perform risk analysis per paragraph 4.c.(1)(b) to authorize the issuance of HSPD-12 Credentials to Federal employees and contractor employees at their sites whose term of service is less than 6 months. 9 5.b.(1)-(3) Added. (1) Have overall responsibility for the implementation of DOE’s Page Paragraph Changed To identity, credential, and access management program for their respective elements. (2) Establish written procedures within their organizations with clear lines of responsibility for implementing the requirements of this order, including but not limited to: (a) The issuance, use, suspension, recovery, and destruction of the DOE HSPD-12 credential. (b) Maintaining current and accurate employee information in PIV databases.

(c) Frequent verification that access to logical systems and physical facilities has been removed for individuals who no longer have an official relationship with the Department. (3) Approve the issuance of Local Site-Specific Only (LSSO) badges to non-U.S. nationals who have resided in the U.S. for less than three years, based on a risk determination, and after the completion of the required background checks. 9 5.b.(1)-(2) Renumbered. 5.b.(4)-(5) 10 5.d. Oversee issuance and maintenance of the HSPD-12 Credential. Oversee issuance and maintenance of the HSPD-12 Credentials for DOE Headquarters. 11 6.a. Executive Office of the President, Homeland Security Presidential Directive 12, August 27, 2004, (Reference attached to M-05-24) http://www.whitehouse.gov/sites/ default/files/omb/memoranda/fy2 005/m05- 24.pdf Executive Office of the President, Homeland Security Presidential Directive 12, August 27, 2004, https://www.opm.gov/news/reports -publications/management-budget- reports/homeland-security- presidential-directive-hspd-12.pdf 11 6.b. Executive Office of the President, National Strategy for Trusted Identities in Cyberspace Executive Office of the President, National Strategy for Trusted Identities in Cyberspace (NSTIC), http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-%2024.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-%2024.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-%2024.pdf https://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-12.pdf https://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-12.pdf https://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-12.pdf https://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-12.pdf Page Paragraph Changed To (NSTIC), April 2011. http://www.whitehouse.gov/sites/ default/files/rss_viewer/NSTICstr ategy_041511.pdf April 2011. https://obamawhitehouse.archives. gov/sites/default/files/rss_viewer/N STICstrategy_041511.pdf 11 6.c. Executive Office of the President, White House Cyberspace Policy Review, May 2009, http://www.whitehouse.gov/asset s/documents/Cyberspace_Policy_ Review_final.pdf Executive Office of the President, White House Cyberspace Policy Review, May 2009, https://www.energy.gov/sites/defau lt/files/cioprod/documents/Cybersp ace_Policy_Review_final.pdf 11 6.d. Added. Federal Acquisition Regulation 52.204-9, Personal Identity Verification of Contractor Personnel https://www.acquisition.gov/far/5 2.204-9 11 6.d. – 6.f. Renumbered. 6.e. – 6.g. 11 6.e. OMB Memorandum 04-04, E- Authentication Guidance for Agencies, December 2003. http://www.whitehouse.gov/sites/ default/files/omb/memoranda/fy0 4/m04- 04.pdf OMB Memorandum 04-04, E- Authentication Guidance for Agencies, December 2003. https://www.whitehouse.gov/sites/ whitehouse.gov/files/omb/memora nda/2004/m04-04.pdf 11 6.f. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 2005. http://www.whitehouse.gov/sites/ default/files/omb/memoranda/fy2 005/m05- 24.pdf

OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 2005. https://www.whitehouse.gov/sites/ whitehouse.gov/files/omb/memora nda/2005/m05-24.pdf 11 6.g. OMB Memorandum 11-11, Continued Implementation of HSPD-12 Policy for a Common Identification Standard for Federal Employees and Contractors, February 2011. http://www.whitehouse.gov/sites/ default/files/omb/memoranda/20 11/m11-11.pdf OMB Memorandum 11-11, Continued Implementation of HSPD-12 Policy for a Common Identification Standard for Federal Employees and Contractors, February 2011. https://www.whitehouse.gov/sites/ whitehouse.gov/files/omb/memora nda/2011/m11-11.pdf 11 6.h. Added. OMB Memorandum 19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019. http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf http://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.energy.gov/sites/default/files/cioprod/documents/Cyberspace_Policy_Review_final.pdf https://www.acquisition.gov/far/52.204-9 https://www.acquisition.gov/far/52.204-9 http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-%2004.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-%2004.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-%2004.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2004/m04-04.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2004/m04-04.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2004/m04-04.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-%2024.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-%2024.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-%2024.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf

Page Paragraph Changed To https://www.whitehouse.gov/wp- content/uploads/2019/05/M-19- 17.pdf 11 6.g. – 6.j. Renumbered. 6.i. – 6.l. 11 6.i. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006, http://www.whitehouse.gov/sites/ default/files/omb/assets/omb/me moranda/fy2006/m06-18.pdf OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006, https://www.whitehouse.gov/sites/ whitehouse.gov/files/omb/memora nda/2006/m06-18.pdf 12 6.j. OMB Memorandum, Requirements for Accepting Externally-Issued Identity Credentials, October 6, 2011, https://cio.gov/wp- content/uploads/downloads/2012/ 09/OMBReqforAcceptingExterna lly_IssuedIdCred10-6-2011.pdf OMB Memorandum, Requirements for Accepting Externally-Issued Identity Credentials, October 6, 2011, https://obamawhitehouse.archives. gov/sites/default/files/omb/assets/e gov_docs/ombreqforacceptingexter nally_issuedidcred10-6-2011.pdf 12 6.k. FIPS 201-1, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006, http://csrc.nist.gov/publications/ fips/fips201-1/FIPS- 201-1- chng1.pdf FIPS 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013, https://nvlpubs.nist.gov/nistpubs/ FIPS/NIST.FIPS.201-2.pdf 12 6.l. Office of Personnel Management (OPM) memorandum, subject: Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD– 12, July 31, 2008, http://www.opm.gov/investigate/f ins/2010/fin10-05.pdf Office of Personnel Management (OPM) Memorandum, subject: Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD– 12, July 31, 2008, (2008 Final Credentialing Standards) https://www.opm.gov/suitability/su itability-executive- agent/policy/final-credentialing- standards.pdf 12 6.m.-6.p. Added. m. OPM Memorandum, subject: Credentialing Standards Procedures for Issuing Personal Identity Verification Cards under HSPD-12 and New Requirement for Suspension or Revocation of Eligibility for Personal Identity Verification Credentials, December 15, 2020, (2020

https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy200 http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy200 http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy200 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-18.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-18.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-18.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/ombreqforacceptingexternally_issuedidcred10-6-2011.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-%20201-1-chng1.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-%20201-1-chng1.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-%20201-1-chng1.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/final-credentialing-standards.pdf Page Paragraph Changed To Credentialing Standards Procedures) https://www.opm.gov/suitabilit y/suitability-executive- agent/policy/cred- standards.pdf n. Performance Accountability Council (PAC) Memorandum, subject: Guidance on Executive Branch-Wide Requirements for Issuing Personal Identity Verification (PIV) Credentials and Suspension Mechanism, March 02, 2016, (2016 PAC Memorandum) https://www.opm.gov/suitabilit y/suitability-executive- agent/policy/memo-issuing- piv-credentials-and- suspension-criteria.pdf o. Joint Federal Investigations Notice and Suitability and Credentialing Executive Agent Notice/NBIB Notice No.18-02 Suit/Cred EA Notice No.18-01 dated April 05, 2018, https://www.dcsa.mil/Portals/9 1/Documents/pv/GovHRSec/F INs/FY18/fin-18-02.pdf

p. DOE O 221.1, Reporting Fraud, Waste and Abuse to the Office of Inspector General, current version 12 6.k. – 6.o. Renumbered. 6.q. – 6.t. 12 6.p. – 6.q. p. Personal Identity Verification Interoperability (PIV-I) Certification Process, March 8, 2011, http://www.idmanagement.go v/fpkipa/documents/PIVI_Ce rtification_Process.pdf q. Personal Identity Verification Interoperability (PIV-I) For Non-Federal Issuers, July 2010, http://www.idmanagement.go Removed. https://www.opm.gov/suitability/suitability-executive-agent/policy/cred-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/cred-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/cred-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/cred-standards.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.opm.gov/suitability/suitability-executive-agent/policy/memo-issuing-piv-credentials-and-suspension-criteria.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/FINs/FY18/fin-18-02.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/FINs/FY18/fin-18-02.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/FINs/FY18/fin-18-02.pdf http://www.idmanagement.gov/fpkipa/documents/PIVI_Certification_Process.pdf http://www.idmanagement.gov/fpkipa/documents/PIVI_Certification_Process.pdf http://www.idmanagement.gov/fpkipa/documents/PIVI_Certification_Process.pdf http://www.idmanagement.gov/documents/PIV_IO_NonFed_Issuers.pdf Page Paragraph Changed To v/documents/PIV_IO_NonFe d_Issuers.pdf 12 6.r. Renumbered. X.509 Certificate Policy For The U.S. Federal PKI Common Policy Framework, http://www.idmanagement.gov/p ages.cfmpage/Federal-PKI- Policy-Authority-documentation 6.u. X.509 Certificate Policy For The U.S. Federal PKI Common Policy Framework, https://www.idmanagement.gov/do cs/fpki-x509-cert-policy- common.pdf 13 7.a. Adjudicator: The individual authorized to record the adjudication result for an applicant. The Adjudicator enters or updates the adjudication results for applicants in the credential issuance system Adjudicator: The Adjudicator is a federal employee delegated the duty to review and adjudicate all federal employee and contractor background investigations. The Adjudicator enters or updates the adjudication results for applicants in the credential issuance system Appendix A: Personal Identity Verification (PIV) A-1 Intro Paragraph Added. This Appendix provides the credentialing standards and procedures to promote defined goals in DOE eligibility determinations to issue HSPD-12 PIV credentials for access to federally controlled facilities and information systems:1 the protection of the life, safety, property, or health of employees, contractors, vendors or visitors to Federal facilities; the protection of the Government’s physical assets, information systems, records, including privileged, proprietary, financial or medical records; and the privacy of the individuals whose data the Government holds in its systems. 1 The term “federally controlled”, as it relates to facilities and information systems is defined in 48 Code of Federal Regulations §2.101.

A-1 1. PROCEDURES. Procedures for issuing HSPD–12 Credentials, including identity proofing, will be specified in the DOE PIV Card Issuer (PCI) Operations Plan. Removed. http://www.idmanagement.gov/documents/PIV_IO_NonFed_Issuers.pdf http://www.idmanagement.gov/documents/PIV_IO_NonFed_Issuers.pdf http://www.idmanagement.gov/pages.cfmpage/Federal-PKI-Policy-Authority-documentation http://www.idmanagement.gov/pages.cfmpage/Federal-PKI-Policy-Authority-documentation http://www.idmanagement.gov/pages.cfmpage/Federal-PKI-Policy-Authority-documentation https://www.idmanagement.gov/docs/fpki-x509-cert-policy-common.pdf https://www.idmanagement.gov/docs/fpki-x509-cert-policy-common.pdf https://www.idmanagement.gov/docs/fpki-x509-cert-policy-common.pdf Page Paragraph Changed To A-1 2. Renumbered. DEFERRED PROCESSING. If an HSPD-12 Credential applicant is currently awaiting a hearing or trial; is awaiting or serving a form of pre-prosecution probation, suspended or deferred sentencing, probation, or parole in conjunction with an arrest or criminal charges against the individual for a crime that is punishable by imprisonment of 6 months or longer, or has an outstanding warrant, the adjudicator may suspend further processing and notify the sponsor of the cause. At such time as the hearing, trial, criminal prosecution, suspended sentencing, deferred sentencing, probation, or parole has been completed, the applicant may be resubmitted to the identity proofing process to determine eligibility for an HSPD-12 Credential. 1. DEFERRED PROCESSING. If an HSPD-12 Credential applicant is currently awaiting a criminal hearing or trial; is awaiting or serving a form of pre-prosecution probation, suspended or deferred sentencing, probation, or parole in conjunction with an arrest or criminal charges for a crime that is punishable by imprisonment of 6 months or longer, or has an outstanding warrant, the adjudicator may suspend further processing and notify the sponsor of the cause. When the hearing, trial, criminal prosecution, suspended sentencing, deferred sentencing, probation, or parole has been completed, the applicant may be resubmitted to the identity proofing process to determine eligibility for an HSPD-12 Credential. A-1 – A-3 2. New section added. HSPD-12 ELIGIBILITY ADJUDICATION. A-3 – A-5 3. Entire section removed. BACKGROUND INVESTIGATION. New section added. NON-UNITED STATES NATIONALS CREDENTIALING. A-5 4. TRANFERS FROM OTHER GOVERNMENT. Moved to section 6. New section added. UNFAVORABLE PIV DETERMINATIONS. A-5 – A-6 5.b. – 5.c. b. Upon receipt of the adjudicator’s denial of HSPD- 12 Credential notice, the applicant has 10 working days to inform the adjudicator, in writing or by electronic means, of the intent to file an appeal. The applicant may be represented and advised by counsel or a representative of the applicant’s choosing in the b. Upon receipt of the adjudicator’s denial or revocation of HSPD-12 Credential notice, an individual has ten working days to inform the adjudicator in writing, or by electronic means (e.g., email), of the intent to file an appeal. The individual may be represented and advised by counsel or a representative of the individual’s choosing in the Page Paragraph Changed To appeal process, at the applicant’s expense. c. The applicant must file the actual appeal with the adjudicator within 10 working days after notifying the adjudicator of intent to file. The appeal must be in writing and provide a response to the information that formed the basis of the denial of the HSPD-12 Credential.

appeal process, at the individual’s expense. c. The individual must file the actual written appeal with the adjudicator within 30 working days after notifying the adjudicator of intent to file. The appeal must be submitted in writing and provide a response to the information that formed the basis of the denial or revocation of the HSPD-12 Credential. A-6 5.d. Added. Upon receiving the individual’s notification of intent to file an appeal, the adjudicator will notify the contract entity that employs or seeks to employ the covered individual. A-6 5.d. – 5.g. Renumbered. 5.e. – 5.h. A-6 5.e. Upon receiving the individual’s notification of intent to file an appeal, the adjudicator will identify and notify members of the appeal panel. The appeal panel will consist of three members, who must be DOE employees who have been investigated to a level commensurate with the person filing the appeal, as follows: Upon receiving the individual’s notification of intent to file an appeal, the adjudicator will identify and notify members of the appeal panel. The appeals panel cannot include the individual who made the initial decision to deny or revoke the PIV eligibility. The appeal panel will consist of three members, who must be DOE employees who have been investigated to a level commensurate with the person filing the appeal, as follows: A-6 5.f. Upon receipt of the applicant’s written appeal, the adjudicator prepares an appeal package for each panel member consisting of a copy of all identity proofing documentation, the background investigation, the notification of denial of the HSPD-12 Credential providing the adjudicator’s rationale for denial, and the written appeal of the applicant. Upon receipt of the written appeal, the adjudicator prepares an appeal package for each panel member consisting of a copy of all identity proofing documentation, the background investigation, the notification of denial or revocation of the HSPD-12 Credential providing the adjudicator’s rationale for denial or revocation, and the written appeal of the individual. Page Paragraph Changed To A-6 5.g. Each panel member will review the package and within 30 working days respond to the adjudicator in writing indicating either concurrence or nonconcurrence with the denial of the HSPD-12 Credential decision. For any nonconcurrence, the panel member will provide a brief rationale. Each panel member will review the package and within 30 working days respond to the adjudicator in writing indicating either concurrence or nonconcurrence with the denial or revocation of the HSPD-12 Credential decision. For any nonconcurrence, the panel member will provide a brief rationale. A-6 5.h. The decision of the appeal panel will be determined by simple majority of concurrence or nonconcurrence. This decision is final. The adjudicator will inform the applicant and sponsor of the appeal decision and, in those instances where there is majority nonconcurrence with denial of the HSPD-12 Credential, the HSPD-12 Credential will be issued in accordance with the PCI Operations plan. The decision of the appeal panel will be determined by simple majority of concurrence or nonconcurrence. This decision is final. The adjudicator will inform the appellant and sponsor of the appeal decision and, in those instances where there is majority nonconcurrence with denial or revocation of the HSPD-12 Credential, the HSPD-12 Credential will be issued in accordance with the PCI Operations plan. A-6 – A-7

6. TRANFERS FROM OTHER GOVERNMENT. DOE will accept PIV card credentialing determinations made by other Federal agencies if they can be verified. The individual must have undergone the required background investigation. TRANFERS FROM OTHER GOVERNMENT AGENCIES. DOE will accept PIV card credentialing determinations made by other Federal agencies under the following conditions: a. The PIV eligibility determination was a favorably adjudicated final (not interim) determination at the appropriate tier for the new position based on a completed Tier 1 or equivalent or higher level of investigation; b. There has been no break in service (or in a contractor's association with Government contract work) exceeding 24 months following the favorable adjudication of the previously conducted investigation; and c. DOE is not in possession of any new information that calls into Page Paragraph Changed To question the person's eligibility for a PIV credential.” A-7 7. Old section moved to Order section 7.h. PIV FILES. All documentation created in the PIV process will be retained in files with unique file identification. PIV case files must be distinct from personnel security (access authorization) files. When a PIV decision is linked to a personnel security determination, the personnel security file (PSF) is only used for documentation of the personnel security process, not the identity-proofing process. New section added. SUSPENSION OF PIV ELIGIBILITY. Attachment 1: Contractor Requirements Document (CRD) 1-1 1.a. Added. DOE facilities and DOE information systems must meet the requirements of Office of Management and Budget (OMB)M-19-17, which requires that agency implementations align with the Federal Chief Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance and the FICAM Architecture and Continuous Diagnostics and Mitigation (CDM). PIV credentials (where applicable in accordance with OPM requirements) are DOE’s primary means of identification and authentication to Federal information systems and Federally controlled facilities and secured areas by Federal employees and contractors. 1-1 1.a. – 1.c. Renumbered. 1.b. – 1.d. 1-1 1.b. HSPD-12 Credentials. HSPD-12 Credentials are the Federal identification credentials that are compliant with National Institute of Standards and Technology HSPD-12 Credentials. HSPD-12 Credentials are the Federal identification credentials that are compliant with National Institute of Standards and Technology Page Paragraph Changed To (NIST) Federal Information Processing Standard (FIPS) 201- 1, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated 3-2006, or its successor. Contractor employees requiring an HSPD-12 Credential are subject to Personal Identity Verification (PIV) by DOE. Issuance of HSPD-12 Credentials to contractor employees whose term of service is less than 6 months is at the discretion of the Lead Program Secretarial Officer (LPSO) and based on a risk analysis. (1) HSPD-12 Credentials must be issued to: (a) Cleared DOE contractor employees; (b) Uncleared contractor employees servicing DOE Headquarters; and (c) Other uncleared DOE contractor employees at the discretion of the LPSO and based on a risk analysis. (2) M&O contractors may authorize HSPD-12 Credential issuance to their own employees and to their subcontractors’ employees. DOE HSPD-12 Credentials are issued consistent with procedures contained in the DOE PIV Card Issuer (PCI) Operations Plan.

(NIST) Federal Information Processing Standard (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, dated 8-2013, or its successor. Contractor employees requiring an HSPD-12 Credential are subject to Personal Identity Verification (PIV) by DOE. (1) This Order establishes the requirement for issuance of PIV to federal employees and contractors. (a) Local implementation of the requirements under the DOE authorization to issue PIV credentials using the DOE provider, USAccess, may be performed by an M&O contractor. (b) An M&O contractor may serve as the sponsor for M&O staff and subcontractors for a PIV credential. (2) HSPD-12 Credentials must be issued to all Federal employees and contractor employees who require long term (greater than six months) physical access to DOE facilities or information systems. (3) Issuance of HSPD-12 Credentials to DOE employees or contractor employees who are employed or providing services for less than 6 months is at the discretion of the Lead Program Secretarial Officer (LPSO) and based on a risk analysis. 1-2 2.a. General. DOE information systems must meet the requirements of Office of Management and Budget (OMB) M-11-11, which requires that General. DOE information systems must meet the requirements of Office of Management and Budget (OMB) M-19-17, which requires that agency implementations align Page Paragraph Changed To agency implementations align with The Federal Chief Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance. with the Federal Chief Information Officers Council’s Federal Identity Credential Access Management (FICAM) Roadmap and Implementation Guidance, and the FICAM Architecture and Continuous Diagnostics and Mitigation (CDM).