10.2.5. Identification Media

(1) IRS ID media is issued solely for use by authorized IRS employees and contractor employees, other Federal agency employees and contractors, in the performance of official duties, and visitors (official or unofficial).

(1) Office of Management and Budget (OMB) M-05-24: Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors

(2) Federal Information Processing Standards (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors

(3) 18 United States Code (USC) 499: Military, naval, or official passes

(4) 18 USC 701: Official badges, identification cards, other insignia

(5) HSPD-12 - Policy for a Common Identification Standard for Federal Employees and Contractors

(6) Delegation Order 1-51, Authority to Prescribe Identification Media

(1) The Chief, FMSS, is authorized to prescribe ID media for use within the IRS per Delegation Order 1-51, Authority to Prescribe Identification Media, located in IRM 1.2.2, Servicewide Policies and Authorities, Servicewide Delegations of Authority.

(2) The AD, Security, is responsible for oversight of ID media for use within the IRS.

(3) The Chief, Access & Identification Management (AIM), is responsible for oversight of the planning, developing, implementing, evaluating, and controlling the ID Media Program.

(4) The Chief, Identity Credential and Access Management (ICAM), is responsible for planning, developing, implementing, evaluating, and controlling the ID Media Program.

(5) FMSS Territory Managers (TM) are responsible for ensuring FMSS Security Section Chief(s) (SSC) follow IRS policy and provide oversight in the implementation and enforcement of the ID Media Program.

(6) FMSS SSC are responsible for implementing and enforcing the ID Media Program within their assigned territory, ensuring that IRS policy and procedures are followed.

(7) All IRS managers, Contracting Officer’s Representatives (COR), and Government Officials with personnel administrative functions have a responsibility for:

1. Informing all employees in their span of control of the importance of following ID media practices.

2. Verifying only authorized employees and contractor employees are in the work area for which they are responsible.

3. Immediately challenging and reporting the presence of suspected unauthorized persons in a work area to their local security office.

4. Ensuring that authorized employees in their span of control are issued the appropriate ID media, use, and display their ID media in accordance with the requirements of this IRM.

5. Recovering ID media of employees and contractor employees who separate or are placed in non-work status on their last workday and immediately sending the recovered ID media to the local FMSS security office for disposition or retention.

6. Reporting unrecovered ID media of employees and contractor employees who separate or are placed in non-work status to the local FMSS security office and the Situational Awareness Management Center (SAMC) in accordance with IRM 10.2.8, Incident Reporting.

7. Certifying the disposition of issued ID media items to include the return of recovered ID media items to the local FMSS security office, using the automated Human Resources (HR) Connect Separating Employee Clearance (SEC) module for employees, and attaching Form 14604, Contractor Separation Checklist, to the Separating Contractor Clearance (SCC) module for contractor employees.

8. Completing a request for a replacement ID media for their employees and contractor employees by scheduling an appointment at a local credentialing office.

9. Ensuring staff-like access eligibility requirements are met, as per IRM 10.2.18, Physical Access Control.

10. Ensuring all contractor employees in their span of control complete Security Awareness Training (SAT) timely in accordance with IRM 10.23.2, Personnel Security, Contractor Investigations, and ensuring it is documented in Integrated Talent Management (ITM).

(8) All personnel issued ID media are responsible for:

1. Safeguarding their ID media.

2. Displaying their ID media in accordance with this IRM while in IRS facilities or performing work duties.

3. Presenting their ID card when requested by their manager, the COR, or the local FMSS security office to allow for IRS accountability of ID media.

4. Returning their ID media to their manager or COR or Government Official with personnel administrative functions when placed in a non-work status or upon separation from the IRS.

5. Promptly reporting lost or stolen ID media to their manager or COR, the local FMSS security office, and to SAMC in accordance with IRM 10.2.8, Incident Reporting.

(1) Program Reports:

1. HRConnect Personal Identity Verification (PIV) Data Synchronization

2. USAccess Applicant Status Report

(2) Program Effectiveness:

1. Timely revocation of physical access

2. Recovery of all ID media from unauthorized persons

3. Timely completion of all SmartID card maintenance requirements

4. Issuance of ID media only to authorized employees and contractor employees

(1) Annual Review: ICAM conducts annual reviews to assess all processes of the program and ensures the program operates in compliance with laws and regulations of the Department of the Treasury ("Treasury").

(2) Track ID card issuance and lifecycle maintenance in accordance with established procedures and controls.

(1) Access - The permissions granted to employees and contractor employees that provide opportunity to physically come into contact with (including, but not limited to reading, transporting, and/or transcribing/interpreting) Sensitive But Unclassified (SBU) data in the performance of official duties, entering an IRS controlled facility or space, and to login to IRS systems with approved credentials.

(2) Alpha Files - Alphabetized files that are stored in the local security office that may include various ID media forms.

(3) Card Stock - Blank cards that have no picture that are stored in a lockable cabinet in the FMSS security office.

(4) Compromised - ID media in the possession of an unauthorized user or ID cards believed to be tampered with including unauthorized physical alterations or hacked.

(5) Contracting Officer’s Representative (COR) - An individual designated and authorized by the Contracting Officer (CO) to perform contract administration activities on their behalf within the limits of delegated authority for a specific acquisition or contract.

(6) Contractor Employee - An individual, not a federal employee, who performs work for or on behalf of the Federal Government.

(7) Escorted Access - Access given to an individual (such as a contractor employee, visitor, or vendor) who is not approved for staff-like access and must be accompanied by a "qualified escort" during work performance and/or entry and movement throughout the facility.

(8) ID Card - A form of ID media that may include the bearer's photograph, name, agency affiliation, and card number, that verifies the identity of the bearer and may designate the type of authorized access granted.

(9) ID Card Designations - Verbiage that appears on ID cards that indicates a specified privilege or level of physical access, including concealed weapon, federal emergency response official, visitor or escort only.

(10) ID Media - IRS ID media includes any photo or non-photo ID card, pocket commission, or similar items, which contain the IRS name, seal, or symbol, that is issued to and displayed by the bearer.

(11) IRS Employee - a federal employee, employed by the IRS.

(12) Limited Area - A space or room to which access is limited to authorized personnel only.

(13) Logical Access - Access to IRS information systems or to Information Technology (IT) resources.

(14) Lost ID Card - ID cards that currently have no known location.

(15) Non-Work Status - A temporary non-pay status such as a seasonal or intermittent worker, extended Leave Without Pay (LWOP), extended Absence Without Leave (AWOL), furlough, suspension, military leave, or other non-pay status.

(16) Physical Access Control (PAC) Card - A photo ID card issued that verifies the identity of the bearer for facility access only.

(17) Proxy/Access Cards - Non-photo, electronic cards that work with the access control system to unlock a door or a similar structure, replacing a traditional key and lock.

(18) Pseudonym - A fictitious name. The use of a pseudonym is issued to an IRS employee for the protection of personal safety and the prevention of harm or danger.

(19) Qualified Escort - An authorized (designated) IRS employee or a contractor employee approved for final staff-like access at the same or higher position risk level as the individual who requires escorting, and with knowledge of the task or activity to be performed.

(20) Recovered - A classification for ID media returned to the manager or COR and forwarded to the local FMSS security office for final disposition.

(21) Routine Access - Access to facilities on a consistent basis, generally multiple times per week.

(22) SmartID - A photo ID card issued in accordance with HSPD-12 that verifies the identity of the bearer through visible and embedded biometric data. The SmartID card provides logical and facility access.

(23) Staff-like Access - Authorized unescorted access to IRS-owned or controlled facilities, IT systems, security items and products, or areas storing/processing SBU data as determined by Treasury/bureau officials. Staff-like access may be interim or final. Staff-like access is granted to an individual who is not an IRS employee and is approved upon required completion of a favorable suitability/fitness determination conducted by IRS Personnel Security.

(24) Unescorted Access - Staff-like access granted to a contractor employee to IRS facilities, IT systems, and SBU data without escort.

(25) Visitor - A person seeking access to an IRS facility who has not been issued a SmartID or may not be in possession of a SmartID. Visitors may include contractor employees who have not been approved for staff-like access, other federal agency employees and contractors, the general public, and employees or contractor employees when then are not in possession of their ID card.

(26) Visitor Management System (VMS) ID Cards - ID cards that include the bearer’s photograph and expiration date that will automatically erase the photograph once expiration date is reached. To obtain a VMS card, please contact the local security office.

(27) Unrecoverable - A classification for ID media not returned to the local FMSS security office, manager or COR after attempts have been made for its return.Acronyms

(1) Document 12829, The General Records Schedules (GRS)

(2) Form 14604, Contractor Separation Checklist

(3) Form 3210, Document Transmittal

(4) Form 4589, Lost or Forgotten Identification (ID) Media Record

(5) Form 6662, Daily ID Card Inventory Report

(6) IRM 1.2.2, Servicewide Policies and Authorities

(7) IRM 1.17.7, Use of the Official IRS Seal, IRS Logo, Program Logos and Internal Logos

(8) IRM 1.22.3, Addressing and Packaging

(9) IRM 9.11.3, Investigative Property

(10) IRM 10.2.6, Pocket Commissions

(11) IRM 10.2.8, Incident Reporting

(12) IRM 10.2.14, Methods of Providing Protection

(13) IRM 10.2.18, Physical Access Control

(14) IRM 10.5.1.5.1, Clean Desk Policy

(15) IRM 10.5.7, Use of Pseudonyms by IRS Employees

(16) IRM 10.8.1, Policy and Guidance

(17) IRM 10.23.2, Contractor Investigations

(1) Employees and contractor employees must contact their manager or COR to request a replacement card if the:

1. Current ID card has expired

2. ID card is lost, stolen, or compromised

3. Cardholder’s name has changed

4. ID card is worn or damaged

5. Image of the cardholder no longer accurately depicts the cardholder

(2) Cardholders must immediately report lost, stolen, or compromised ID cards to:

1. Their manager or COR

2. The local FMSS security office by submitting Form 4589, Lost or Forgotten Identification (ID) Media Record

3. SAMC in accordance with IRM 10.2.8, Incident Reporting

(3) IRS employees and contractor employees who require a replacement ID card must schedule an appointment at their local credentialing office to be issued a replacement ID card.

(4) The COR is responsible for ensuring that contractor employees meet the unescorted access eligibility requirements at time of appointment.

(5) Local security offices must complete revocation procedures within 18 hours of notification of lost, stolen, or compromised ID cards or proxy cards. In emergency situations where there is suspicion the missing ID card could be misused, the local FMSS security office must take immediate action to disseminate the information to SAMC to prevent unauthorized access to IRS facilities and systems.

(1) The authorized non-photo ID cards are Visitor and Visitor Escort Only. Individuals who require non-photo ID cards must have ID designations on the front of the ID card. The ID designations are as follows:

1. "V" in a red field – Visitor

2. "E" in a red field – Visitor Escort Only

3. "R" in a yellow field – Visitor Limited Area

(2) Visitors and federal or non-federal personnel who have met the eligibility requirements for staff-like access as set forth in IRM 10.2.18, Physical Access Control must be issued non-photo Visitor ID cards by the local FMSS security office for unescorted access.

(3) Visitors who have not met the eligibility requirements for staff-like access must:

1. Be escorted by a qualified escort, who must request their placement on the facility visitor access list in accordance with IRM 10.2.18.

2. Present a government or state issued photo ID card for identity verification.

3. Submit to facility entry screening procedures.

4. Be issued a non-photo Visitor Escort Only ID card.

(4) Limited Area Monitors will follow access procedures as set forth in IRM 10.2.18.

(5) Employees and contractor employees who report to IRS facilities without their IRS issued photo ID card must complete and submit Form 4589, Lost or Forgotten Identification (ID) Media Record to the local FMSS security office and must be issued a Visitor ID card if a SmartID replacement card is not available.

(6) Non-photo ID cards cannot be removed from the issuing facility and should never be used as access authorization to a facility. Non-photo ID cards must be returned to local FMSS security office or guard post by the individual assigned the card when the individual departs the facility or controlled area.

(7) Contractor employees who have been denied final staff-like access by Personnel Security, Human Capital Office cannot be allowed entry.

(1) IRS employees and contractor employees who require a proxy/access card must meet the access eligibility requirements per IRM 10.2.18, Physical Access Control, and schedule an appointment at their local FMSS security office.

(2) Proxy/access cards must be issued by the local FMSS security office for applicable IRS controlled facilities or space. Proxy/access cards must be returned to the local FMSS security office upon separation or non-work status by the individual assigned the card or their manager.

(3) The local security office is responsible for assigning access and timely removing access from the local access control system upon separation or non-work status in accordance with IRM 10.2.5.7(2), Recovery of ID Media, and IRM 10.2.5.8(4), Records and Accountability.