SUPPLEMENTARY INFORMATION:

I. Background

DoD Inspector General Audit Report No. D-2009-005, entitled “Controls Over the Contractor Common Access Card Life Cycle,” addressed whether Government controls over contractor Common Access Cards (CAC) were in place and worked as intended. A “CAC” is the DoD term for a Personal Identity Verification (PIV) card. A PIV card is required in order to gain access to a Federal facility. The most prevalent issue of the audit report, and the one that DoD, GSA, and NASA are undertaking to resolve with this case, was that the CACs were not adequately accounted for after contract performance or completion.

DoD, GSA, and NASA are amending the FAR by inserting new paragraphs (d)(1) and (d)(2) under FAR 4.1301, Policy. Paragraph (d)(1) provides policy on recovering PIVs. Paragraph (d)(1) requires that agency procedures ensure that Government contractors account for all forms of Government-provided identification issued to Government contractors under a contract, and return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the agency: When no longer needed for contract performance; upon completion of a contractor employee's employment; or upon contract completion or termination. Paragraph (d)(2) authorizes the contracting officer to delay final payment under a contract if the contractor fails to comply with these requirements.

DoD, GSA, and NASA are also modifying FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel, to be consistent with FAR part 4.

DoD, GSA, and NASA published a proposed rule in the Federal Register at 75 FR 28771 on May 24, 2010. Three respondents submitted four comments on the proposed rule, which are addressed below.

Although none of the public comments received caused a change in the FAR text, the FAR text is changed in the final rule as follows:

• FAR 4.1301(d)(1) is revised to clarify that this section applies to agency procedures related to PIV card return.
• FAR 4.1301(d)(1) and 52.204-9(b) are revised to clarify that the rule applies when PIV cards are issued to contractor employees.
• FAR 52.204-9(d) is revised to clarify that the rule flows down to all subcontractor employees when they are required to have access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.
• FAR 52.204-9(d) is also revised to clarify that the prime contractor is responsible for returning all subcontractor PIV cards that have been issued by an agency.

II. Discussion of Public Comments

A. Lost Cards

Comment: Two respondents stated that they have concerns over what happens when a contractor claims to have lost an identity card and therefore cannot return it.

Response: Each agency will establish policies for control of PIV cards. Some agencies, for example, may replace a lost card once, but costs for replacement of any subsequent lost PIV cards may be borne by the contractor. The respondent may be voicing concern that there is a potential for misuse and fraud with lost cards. DoD, GSA, and NASA recommend that agencies program the PIV cards to become inactive if they have not been used after a prolonged period of time.

B. Timing

Comment: Another respondent expressed concern with waiting until the closeout period instead of taking care of the PIV cards at contract completion.

Response: The FAR rule does not authorize waiting until the closeout period, but instead requires the contractor to take action as its employees leave, and again at contract completion. If the contractor fails to take action as its employees leave or at contract completion and the contracting officer does not follow up, then the contracting officer must reconcile the matter at contract closeout.

C. Contractor Involvement in Issuance Process

Comment: Another respondent stated that contractor companies are not typically involved in the PIV card issuance process. Further, contractor responsibility for PIV card retrieval could be improved through involving the contractor/subcontractor in the PIV card issuance process.

Response: The Defense Acquisition Regulation Council and the Civilian Agency Acquisition Council agree that PIV card retrieval could be improved if the contractor was notified when an employee is issued a PIV card. DoD, GSA, and NASA recommend that agencies amend their PIV card procedures, if they are not doing so already, to notify the contractor company when an agency issues a PIV card to a contractor employee. In addition, the rule has been revised to state that the prime contractor is responsible for the return of all PIV cards that have been issued to the subcontractor's employees by the agency.

D. Withholding Payment

Comment: The same respondent had concerns about how long the Government may withhold payment for non-compliance. The respondent stated that the period of time that final payment may be delayed should be specified, e.g., “not to exceed 30 days” or “pending satisfactory resolution of the non-compliance.”

Response: It would be unwise to state a specific date such as “not to exceed 30 days” because the contractor may need a longer time to return the PIV card. Adding language like “pending satisfactory resolution of the non-compliance” is superfluous, as it is a given that the Government would only ( printed page 82576) hold final payment until the non-compliance has been resolved.

III. Executive Order 12866

This is not a significant regulatory action and, therefore, is not subject to review under Section 6(b) of Executive Order 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

IV. Regulatory Flexibility Act

DoD, GSA, and NASA certify that this final rule will not have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the requirements of the actions required and the clause are not significantly burdensome. Currently, it is a common business practice to have procedures in place to revoke and return PIV cards when no longer in use by the contractor.

V. Paperwork Reduction Act

The Paperwork Reduction Act does not apply because the changes to the FAR do not impose information collection requirements that require the approval of the Office of Management and Budget under 44 U.S.C. chapter 35.

Therefore, DoD, GSA, and NASA amend 48 CFR parts 4 and 52 as set forth below:

1. The authority citation for 48 CFR parts 4 and 52 continues to read as follows:

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42 U.S.C. 2473(c).

2. Amend section 4.1301 by adding paragraph (d) to read as follows:

3. Amend section 52.204-9 by revising the date of the clause; redesignating paragraph (b) as paragraph (d); adding a new paragraph (b); adding paragraph (c); and revising newly redesignated paragraph (d) to read as follows: