[Federal Register: August 23, 2006 (Volume 71, Number 163)]
[Proposed Rules]
[Page 49405-49407]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr23au06-32]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
GENERAL SERVICES ADMINISTRATION
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
48 CFR Part 4
[FAR Case 2005-017; Docket 2006-0020; Sequence 6]
RIN 9000-AK53
Federal Acquisition Regulation; FAR Case 2005-017, Requirement to
Purchase Approved Authentication Products and Services
AGENCIES: Department of Defense (DoD), General Services Administration
(GSA),
[[Page 49406]]
and National Aeronautics and Space Administration (NASA).
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The Civilian Agency Acquisition Council and the Defense
Acquisition Regulations Council (Councils) are proposing to amend the
Federal Acquisition Regulation (FAR) to address the acquisition of
products and services for personal identity verification that comply
with requirements in Homeland Security Presidential Directive (HSPD)
12, ``Policy for a Common Identification Standard for Federal Employees
and Contractors,'' and Federal Information Processing Standards
Publication (FIPS PUB) 201, ``Personal Identity Verification of Federal
Employees and Contractors''.
DATES: Interested parties should submit written comments to the FAR
Secretariat on or before October 23, 2006 to be considered in the
formulation of a final rule.
ADDRESSES: Submit comments identified by FAR case 2005-017 by any of
the following methods:
Federal eRulemaking Portal: http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.regulations.gov.
Search for this document at the ``Federal Acquisition Regulation''
agency and review the ``Document Title'' column; click on the Document
ID number. Click on ``comments''.
You may also search for any document using the ``Advanced search/
document search'' tab, selecting from the agency field ``Federal
Acquisition Regulation'', and typing the FAR case number in the keyword
field.
Fax: 202-501-4067.
Mail: General Services Administration, Regulatory
Secretariat (VIR), 1800 F Street, NW, Room 4035, ATTN: Laurieann
Duarte, Washington, DC 20405.
Instructions: Please submit comments only and cite FAR case 2005-
017 in all correspondence related to this case. All comments received
will be posted without change to http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.regulations.gov, including
any personal and/or business confidential information provided.
FOR FURTHER INFORMATION CONTACT: For clarification of content, contact
Mr. Michael Jackson, Procurement Analyst, at (202) 208-4949. For
information pertaining to status or publication schedules, contact the
FAR Secretariat at (202) 501-4755. Please cite FAR case 2005-017.
SUPPLEMENTARY INFORMATION:
A. Background
Increasingly, contractors are required to have physical access to
federally controlled facilities and information systems in the
performance of Government contracts. On August 27, 2004, in response to
the general threat of unauthorized access to physical facilities and
information systems, the President issued Homeland Security
Presidential Directive (HSPD) 12. The primary objectives of HSPD-12 are
to establish a process to enhance security, increase Government
efficiency, reduce identity fraud, and protect personal privacy by
establishing a mandatory, Governmentwide standard for secure and
reliable forms of identification issued by the Federal Government to
its employees and contractors. In accordance with HSPD-12, the
Secretary of Commerce issued on February 25, 2005, Federal Information
Processing Standards Publication (FIPS PUB) 201, Personal Identity
Verification of Federal Employees and Contractors, to establish a
Governmentwide standard for secure and reliable forms of identification
for Federal and contractor employees. FIPS PUB 201 is available at
http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.smartcardalliance.org/pdf/industry_info/FIPS_201_022505.pdf.
The associated Office of Management and Budget (OMB)
guidance, M-05-24, dated August 5, 2005, can be found at http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf
.
In accordance with requirements in HSPD-12 and OMB Memorandum M-05-
24, agencies must--
(a) Issue and require the use of identity credentials that are
compliant with the technical requirements of FIPS PUB 201 and
associated guidance issued by the National Institute for Standards and
Technology in the areas of personal authentication, access controls and
card management; and
(b) Agencies may acquire authentication products and services that
are approved to be compliant with the FIPS PUB 201 through Special Item
Number (SIN) 132-62, HSPD-12 Product and Service Components, made
available by GSA under Federal Supply Schedule 70. GSA is developing an
informational Web site (idmanagement.gov) that will provide a one-stop
shop for citizens, businesses, and government entities interested in
identity management activities. The site will provide information on
HSPD-12 and eAuthentication acquisition vehicles and processes.
This proposed rule revises Subpart 4.13 by adding two new sections
on the scope of the subpart, and the acquisition of approved products
and services; the existing sections are revised and renumbered. This is
not a significant regulatory action and, therefore, was not subject to
review under Section 6(b) of Executive Order 12866, Regulatory Planning
and Review, dated September 30, 1993. This rule is not a major rule
under 5 U.S.C. 804.
B. Regulatory Flexibility Act
The changes may have a significant economic impact on a substantial
number of small entities within the meaning of the Regulatory
Flexibility Act, 5 U.S.C. 601, et seq. HSPD-12 requires agencies to
procure PIV products and services that comply with the FIPS PUB 201
standard. NIST has established the NIST Personal Identity Verification
Program (NPIVP) (http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://csrc.nist.gov/npivp) to validate Personal
Identity Verification (PIV) components and sub-systems required by
Federal Information Processing Standards Publication (FIPS PUB) 201
that meet the NPIVP requirements. The validation tests are performed by
third party laboratories that are accredited through NIST's National
Voluntary Laboratory Accreditation Program.
Vendors are required to obtain validation testing and certification
from an accredited laboratory. The testing is performed on a fee basis.
The number and extent of testing will depend on the nature of the
product or service being tested. The test protocols are still under
development. The impact on small entities will, therefore, be variable
depending on the nature of the product/service being validated. These
standards and testing policies may affect small business concerns in
terms of their ability to compete and win Federal contracts. The extent
of the effect and impact on small business concerns is unknown and will
vary by product and service due to the wide variances among product and
service functionality and design. An Initial Regulatory Flexibility
Analysis (IRFA) has been prepared. The analysis is summarized as
follows:
1. Description of the reasons why the action is being taken.
This proposed rule amends the Federal Acquisition Regulation to
implement the provisions of Homeland Security Presidential Directive
12 (HSPD-12) and Federal Information Processing Standards
Publication Number 201 (FIPS PUB 201).
2. Succinct statement of the objectives of, and legal basis for,
the rule.
The rule implements the provisions of HSPD-12 that require
agencies to purchase PIV products and services that are approved to
comply with the FIPS PUB 201 standard and that are interoperable
among agencies.
3. Description of and, where feasible, estimate of the number of
small entities to which the rule will apply.
[[Page 49407]]
The FAR rule requires that agencies acquire PIV products and
services that comply with the FIPS PUB 201 standard. The impact on
small entities will, therefore, vary depending on the approval
process for vendor products and services.
4. Description of projected reporting, recordkeeping, and other
compliance requirements of the rule, including an estimate of the
classes of small entities which will be subject to the requirement
and the type of professional skills necessary for preparation of the
report or record.
The rule does not impose any new reporting, recordkeeping, or
compliance requirements.
5. Identification, to the extent practicable, of all relevant
Federal rules which may duplicate, overlap, or conflict with the
rule.
The rule does not duplicate, overlap, or conflict with any other
Federal rules.
6. Description of any significant alternatives to the rule which
accomplish the stated objectives of applicable statutes and which
minimize any significant economic impact of the rule on small
entities.
There are no practical alternatives that will accomplish the
objectives of HSPD-12.
The FAR Secretariat has submitted a copy of the IRFA to the Chief
Counsel for Advocacy of the Small Business Administration. A copy of
the IRFA may be obtained from the FAR Secretariat. The Councils will
consider comments from small entities concerning the affected FAR Part
4 in accordance with 5 U.S.C. 610. Comments must be submitted
separately and should cite 5 U.S.C 601, et seq. (FAR case 2005-017), in
correspondence.
C. Paperwork Reduction Act
The Paperwork Reduction Act does not apply because the proposed
changes to the FAR do not impose information collection requirements
that require the approval of the Office of Management and Budget under
44 U.S.C. 3501, et seq.
List of Subjects in 48 CFR Part 4
Government procurement.
Dated: August 17, 2006.
Ralph De Stefano,
Director, Contract Policy Division.
Therefore, DoD, GSA, and NASA propose amending 48 CFR part 4 as set
forth below:
PART 4--ADMINISTRATIVE MATTERS
1. The authority citation for 48 CFR part 4 continues to read as
follows:
Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42
U.S.C. 2473(c).
2. Revise Subpart 4.13 to read as follows:
Subpart 4.13--Personal Identity Verification
Sec.
4.1300 Scope of subpart.
4.1301 Contractual implementation of personal identity verification
requirement.
4.1302 Acquisition of approved products and services for personal
identity verification.
4.1303 Contract clause.
4.1300 Scope of subpart.
This subpart provides policy and procedures associated with
Personal Identity Verification as required by--
(a) Federal Information Processing Standards Publication (FIPS PUB)
Number 201, ``Personal Identity Verification of Federal Employees and
Contractors''; and
(b) Office of Management and Budget (OMB) guidance M-05-24, dated
August 5, 2005, ``Implementation of Homeland Security Presidential
Directive (HSPD) 12--Policy for a Common Identification Standard for
Federal Employees and Contractors''.
4.1301 Contractual implementation of personal identity verification
requirement.
(a) Agencies must follow FIPS PUB 201 and the associated OMB
implementation guidance for personal identity verification for all
affected contractor and subcontractor personnel when contract
performance requires contractors to have physical access to a
federally-controlled facility or access to a Federal information
system.
(b) Agencies must include their implementation of FIPS PUB 201 and
OMB guidance M-05-24, in solicitations and contracts that require the
contractor to have physical access to a federally-controlled facility
or access to a Federal information system.
(c) Agencies must designate an official responsible for verifying
contractor employee personal identity.
4.1302 Acquisition of approved products and services for personal
identity verification.
(a) In order to comply with FIPS PUB 201, agencies must only
purchase approved personal identity verification products and services.
Agencies may acquire the approved products and services from the GSA,
Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12
Product and Service Components.
(b) When acquiring personal identity verification products and
services not using the process in paragraph (a) of this section,
agencies must ensure that the applicable products and services are
approved as compliant with FIPS PUB 201 including--
(1) Certifying the products and services procured meet all
applicable Federal standards and requirements;
(2) Ensuring interoperability and conformance to applicable Federal
standards for the lifecycle of the components; and
(3) Maintaining a written plan for ensuring ongoing conformance to
applicable Federal standards for the lifecycle of the components.
4.1303 Contract clause.
The Contracting Officer shall insert the clause at 52.204-9,
Personal Identity Verification of Contractor Personnel, in
solicitations and contracts when contract performance requires
contractors to have physical access to a federally-controlled facility
or access to a federally-controlled information system.
[FR Doc. 06-7088 Filed 8-22-06; 8:45 am]
BILLING CODE 6820-EP-S