OMB SuptStmt Questions 2013 v3

USDA HSPD 12 Personal Identity Verification Phase I and II

OMB # 0505-0022

Purpose:

Personal Identity Verification (PIV) Phase I and Phase II

The purpose of this information collection request (ICR) is to obtain approval of the information that must be provided by Federal contractors and other applicable individuals when applying for a USDA credential (identification card). This information collection is necessary to comply with the requirements outlined in Homeland Security Presidential Directive (HSPD) 12, and Federal Information Processing Standard (FIPS) 201-1, Personal Identity Verification (PIV) Phase I and Phase II. This request is an update to previously submitted and approved supporting statement, OMB Control Number: 0505-0022.

USDA has completed Phase I, implementing an identity proofing, registration, and issuance process consistent with the requirements outlined in FIPS 201-1. The information collection form was required as part of USDA’s PIV I identity proofing and registration process and no longer will be utilized during Phase II except for circumstances requiring individuals to obtain a short-term USDA site badge identification card.

To comply with PIV II, USDA has implemented an automated identity proofing, registration, and issuance process consistent with the requirements outlined in FIPS 201-1. This information collection has been automated to the extent possible as part of USDA’s PIV II identity proofing and registration process. PIV II is now known as simply PIV or full PIV implementation according to OMB.

Terms of Clearance:

A. Justification

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

FIPS 201-1 and OMB Memorandum M-05-24 (now part of P.L. 110-53) assert that all governmental agencies must implement a secure identity proofing, registration, and issuance process by October 27, 2005. This process must ensure secure personal identity verification prior to granting federal and non-federal employees access to federally controlled facilities and/or information systems. This phase of the initiative was known as PIV I.

The second phase of the initiative, known as PIV II, calls for agencies to issue cards to applicable individuals who will begin using them for electronically validated access government computer systems and facilities no later than October 27, 2006. The information collected on form AD 1197 utilized in Phase I enable the personal identity verification process to be secure and consistent with the electronic system that is now implemented as part of PIV II. The form will no longer be used as part of PIV except to grant short-term access to individuals through a site badge. All Federal and non-Federal employees requiring long-term access (greater than 6 months) to federally controlled facilities and/or information systems are subject to the PIV process. Applicability of PIV to other individuals is a USDA sub-agency decision based on the risk assessment referenced in USDA Departmental Manual/Departmental Regulation #4620-002.

2. Indicate how, by whom, how frequently, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

Personal Identity Verification (PIV)

PIV I required the use of internal form AD 1197 which is no longer necessary as the same information is collected electronically on behalf of Federal, non-Federal, and other applicable individuals requiring long term access to federally controlled facilities and/or information systems after October 27, 2006. All current USDA Federal, non-Federal employees, and other applicable individuals must complete the PIV process. Form AD 1197 will now only rarely be used to issue a site badge to grant individuals short-term access to facilities, based on the USDA Agency’s internal processes.

An automated HSPD-12 system is now in place for credentialing the federal workforce as required by FIPS 201-1. USDA has chosen to use GSA’s USAccess program for HSPD-12 credentialing and identity management. The automated system includes six separate and distinct roles to ensure no one single individual can issue a credential without further validation from another authorized role holder. An automated notification process provides streamlined communications between role holders and the applicant, notifying each as to the respective steps in the process.

An Applicant has information collected and entered by Human Resources personnel or designees into the HR systems. When complete, HR personnel serving in the “Sponsor” role validate the information and initiate and automated transaction to populate the HSPD-12 system. Applicants are also required to complete an automated background investigation form (e-QIP) which will be sent to the FBI and/or OPM for analysis. The Applicant is then required to appear in person to an enrollment station so a Registrar can scan and save the documents (two approved identity source documents) and validate the identity of the Applicant. The Registrar will also capture biometrics; a facial image of the Applicant for future identity verification and the Applicant’s fingerprints to submit to OPM as part of the background investigation. Once all required identity and information submissions are complete and a background investigation has been conducted, a notification of the results will be sent to an Adjudicator. The Adjudicator will either approve or deny the credential application. Once approved by an Adjudicator, a central printing office prints the Personal Identity Verification (PIV) Card and mails it to a Card Issuer (or “Activator”) at a specified pick-up location. The Applicant is notified via e-mail that the PIV Card is ready for pickup and appears in front of Card Issuer. The Card Issuer performs a 1:1 biometric match by scanning Applicant’s primary and secondary fingers and matching them against the fingerprint record stored in the HSPD-12 system and to those stored on the PIV Card. After all identity verification steps are complete and successful, the card is activated and issued to the Applicant.

The responsibilities of the Applicant comprise the burden that the Applicant will bear with regard to the information collection process. With the elimination of USDA form AD 1197, Applicants must complete the PIV Enrollment Package, which consists of forms required by OMB and OPM including:

OF-306, Declaration for Federal Employment (OMB Control Number: 3206-0182)

Fair Credit Reporting Release

FD-258, Fingerprint Chart

SF-85 (most non-Federal employees, OMB Control Number: 3206-0005), SF-85P (those in a position of “Public Trust” OMB Control Number: 3206-0191), or SF-86 (those requiring a national security clearance; complete using e-QIP system, OMB Control Number: 3206-0007).

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also, describe any consideration of using information technology to reduce burden.

USDA has implemented an electronic, automated system to support identity proofing, registration, and issuance as part of PIV. The PIV system eliminates the need for much of the paper-based collection of information utilized in the past. USDA further integrates physical and logical security through the one-time collection of information as all the systems are integrated to communicate and share this information in real time. This system serves as a central repository that automatically collects information from several authoritative HR databases, eAuthentication, and background investigation sources. At USDA this system is known as the Enterprise Identity Management System (EIMS) or more recently, the Enterprise Entitlements Management System (EEMS). Process schematics and screenshots are available upon request.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purpose described in item 2 above.

To the extent possible, USDA’s EIMS/EEMS eliminates a great deal of duplication by consolidating information from systems that already exist. The standards set by HSPD-12 and through its implementation, USDA eliminates the need for sub-agency or facility specific forms for other credential (identification card) applications. Information required for HSPD-12 is only entered one time.

5. If the collection of information impacts small businesses or other small entities, describe any methods used to minimize burden.

HSPD-12 requires that contractors and other non-Federal employees needing unescorted access to facilities or access to government computer systems must have a compliant card. In order to be issued a card, a background investigation must be performed. Small business vendors may submit previously performed OPM (e-QIP) investigations to meet this requirement. If a background investigation must be initiated, it is the responsibility of USDA to submit and pay for the service.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

USDA is required to comply with HSPD 12 and FIPS 201-1, which mandate the collection of this information. If this information is not collected, Federal and non-Federal employees may not be permitted in some facilities and will not be allowed access to government computer systems.

7. Explain any special circumstances that would cause an information collecti­on to be con­ducted in a manner:

• requiring respondents to report informa­tion to the agency more often than quarterly;

• requiring respondents to prepare a writ­ten response to a collection of infor­ma­tion in fewer than 30 days after receipt of it;

• requiring respondents to submit more than an original and two copies of any docu­ment;

• requiring respondents to retain re­cords, other than health, medical, governm­ent contract, grant-in-aid, or tax records for more than three years;

• in connection with a statisti­cal sur­vey, that is not de­signed to produce valid and reli­able results that can be general­ized to the uni­verse of study;

• requiring the use of a statis­tical data classi­fication that has not been re­vie­wed and approved by OMB;

• that includes a pledge of confiden­tiali­ty that is not supported by au­thority estab­lished in statute or regu­la­tion, that is not sup­ported by dis­closure and data security policies that are consistent with the pledge, or which unneces­sarily impedes shar­ing of data with other agencies for com­patible confiden­tial use; or

• requiring respondents to submit propri­etary trade secret, or other confidential information unless the agency can demon­strate that it has instituted procedures to protect the information's confidentiality to the extent permit­ted by law.

The information collected is consistent with provisions of the Paperwork Reduction Act of 1995 (PRA, 44 U.S.C. chapter 35), set forth in 5 CFR 1320.6.

8. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments.

The 60 day Federal Register notice was published March 26, 2013, page 18305. There were no comments received in response to Federal Register notice.

Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting form, and on the data elements to be recorded, disclosed, or reported.

USDA consults with GSA and other participants in the USAccess program to learn of other data collection practices and policies.

9. Explain any decision to provide any payment or gift to respondents, other than reenumeration of contractors or grantees.

The agency does not provide any payments or gifts to respondents for any information collected.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.

All information collected will be treated as confidential in compliance with the Privacy Act and Freedom of Information Act.

10. Provide additional justification for any questions of a sensitive nature, such as sexual behavior or attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

The information requested for HSPD-12 is not considered of a sensitive nature (such as religious beliefs, sexual behavior and attitude, etc.).

12. Provide estimates of the hour burden of the collection of information. The statement should:

• Indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated. If this request for approval covers more than one form, provide separate hour burden estimates for each form and aggregate the hour burdens in Item 13 of OMB Form 83-I.

• Provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories.

Personal Identity Verification (PIV)

The USDA has an estimated 100,000 Federal employees and 11,026 non-Federal employees. All Federal and non-Federal employees, contractors, and other applicable individuals requiring long term access to federally controlled facilities and/or information systems who begin working at USDA after October 27, 2006 are required to follow USDA’s PIV process. All employees, contractors, and other applicable individuals are now affected. For PIV, all new and existing Federal and non-Federal employees must undergo the process to receive a PIV Credential.

Estimated Annual Number of Respondents: PIV respondents: 12,000.

Estimated Number of Responses per Respondent: Each respondent should complete one response.

Estimated Total One-Time Burden on Respondents: PIV: 30,000 hours.

	PIV Phase I (Beginning 10/27/06)	PIV Phase II (Beginning 10/27/07)
Provide identity information and documentation	1.25 hours	.5 hours
Complete and Submit Background Investigation Forms (electronic)	.5 hours	.5 hours
Biometrics Capture (Facial Image and Fingerprints) for PIV II	.5 hours	.25 hours
Adjudication Appeals (Applicable to 1% of applicants)	1 hour	1 hour
Receive PIV Credential	.25 hours	.25 hours
TOTAL	3.5 hours	2.5 hours
Approximately 100 applicants may complete form AD-1197 based on Agency policy. It is no longer required for issuing the PIV credential.		.25 hours

There are seven parts of the information collection burden, listed below:

• Provide applicant information and documentation: 12,000 Applicants will provide personal information not associated with a standard form. Applicants will need to locate identity source documents, from the list of acceptable documents on Form I-9, Employment Eligibility Verification. At least one identification document must be a state- or federally-issued form of identification. This is estimated to take 1 hour per Applicant, one time only. That becomes 12,000 hours per year.

• Complete and submit background investigation: 12,000 Applicants will complete and submit background investigation forms electronically. As all of the background investigation documents are currently being used within USDA, there is no undetermined burden to report for this process. The information captured on the AD 1197 in PIV I, will now be captured electronically by individuals other than the Applicant, eliminating any burden to the Applicant.

• Biometrics capture; photograph and fingerprint capture: 12,000 Applicants will need to be photographed and fingerprinted. This is estimated to take 15 minutes per applicant, one time only and occurs at the same time the Applicant provides identity information and documentation so there is no additional travel to report. The added total for biometrics capture for 12,000 Applicants is 3,000 hours.

• Adjudication Appeals (Applicable to 1% of Applicants): An estimated 1% of 12,000 applicants will undergo adjudication appeals. This process is estimated to take 1 hour per applicant, one time only. 100 Applicants lead to an estimated burden of 100 hours.

• Receive PIV credentials: 12,000 Applicants will need to pick up their PIV credential. The Applicants will be required to verify their biometrics and identity to activate their card. This is estimated to take .25 hours per Applicant, one time only. That becomes 3,000 hours per year.

• The estimated cost is based on requiring the total time: 30,000 hours (hours multiplied by an estimated contractor income of $41,600 per year or $20 per hour ($41,600/2080 hours per year)). The total estimated cost of the burden: $900,000.

• In some cases, Agencies may require the use of form AD-1197 for short-term access to facilities. In these cases the applicant will NOT receive a PIV credential so the total burden to the individual is approximately 15 minutes. There are an estimated 100 applicants per year that may utilize the AD-1197 for a total of 25 hours.

For the AD 1197, there is no record keeping costs associated for this process as the PIV credential will not be issued based on this document.

For the PIV issuance process, public reporting burden for this collection of information is estimated to average 2.5 hours. The Burden is estimated based on the three prerequisites for PIV Credential issuance as well as the receipt of the PIV Credential itself.

13. Provide estimates of the total annual cost burden to respondents or record keepers resulting from the collection of information, (do not include the cost of any hour burden shown in items 12 and 14). The cost estimates should be split into two components: (a) a total capital and start-up cost component annualized over its expected useful life; and (b) a total operation and maintenance and purchase of services component.

The information collection and reporting burden does not impose any capital or start-up costs to respondents. The information requested is already available to respondents and there are no ongoing or follow-up requirements that impose costs except for the one-time collection.

14. Provide estimates of annualized cost to the Federal government. Also, provide a description of the method used to estimate cost and any other expense that would not have been incurred without this collection of information.

Personal Identity Verification (PIV)

The annualized cost to the federal government is based on the identity verification and biometrics captured during enrollment, and identity verification and activation of the PIV card during issuance that must be completed. Each task will take approximately 15 minutes (enrollment and issuance, respectively) to complete, for each applicant. Total responses are equal to the number of Applicants (10,000 Federal and 2,000 non-Federal applicants per year). Thus an estimated 30 minutes per Applicant is needed for the information collection from the Federal government. This becomes a burden of 6,000 hours. The estimated cost is based on requiring the total time: 6,000 hours multiplied by an average salary of the GS-7 (step 5) through GS-9 (step 5) income of $42,578 per year or $20.47 per hour ($42,578/2080 hours per year). The estimated cost of the burden: $307,080.

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-1.

Since the last approval, we have now entered the burden for full PIV implementation. As a result of that implementation being automated, the burden per response is reduced. However the number of contractors increased, resulting in an increase in responses. The burden hours increased due to reevaluation of per response time for PIV forms.

16. For collections of information whose results are planned to be published, outline plans for tabulation and publication.

The information collected is not planned for publication. It will only be used to provide the Applicant with a USDA credential (identification card).

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

The PIV Form agrees to display the expiration date for OMB approval of the information collection.

18. Explain each exception to the certification statement identified in Item 19 "Certification for Paperwork Reduction Act."

There are no exceptions to the certification statement.