On Wednesday April 17, 2019, the NIH Center for Information Technology (CIT) implemented important security enhancements for NIH network accounts that affect NIH staff (employees, contractors, fellows, volunteers, etc.). The implementation of enhanced security controls ensures NIH has the necessary tools and procedures in place to protect NIH data as well as ensure NIH is compliant with Homeland Security Presidential Directive 12 (HSPD-12).
What are the changes?
On April 17, 2019, Active Directory (AD) network accounts for new personnel who have yet to be issued a Personal Identity Verification (PIV) badge (also known as HSPD-12 badge) or Restricted Local Access (RLA) badge, will be disabled until the individual completes the required fingerprinting and background investigation requirements, and has been found eligible for a PIV/RLA badge by the ORS Division of Personnel Security and Access Control (DPSAC).
Prior to being granted access to an AD account or to any NIH IT systems, all new personnel must first be issued a PIV/RLA badge. This change is required to enforce existing NIH policy and mitigate the risk of data breaches and negative impacts to personnel and intellectual property that could result from a cybersecurity breach.
How will these changes impact DPSAC?
As a result of this change, DPSAC has experienced a large surge in badge requests and processes related to PIV credentialing. Prior to this change, approximately 1,500 individuals at NIH had been granted access to network accounts who also did not possess a PIV/RLA badge.
As Administrative Officers work to sponsor badges quickly to prevent work-stoppages, DPSAC is faced with processing the hundreds of enrollments and background checks that result. DPSAC is currently facing a substantial backlog as a result, and is mobilizing all available resources to expedite processing.
Average DPSAC processing times have increased from approximately four (4) weeks to six (6) weeks, and will be highly contingent upon the applicant’s timely completion of all required actions. To avoid additional delays in processing, DPSAC urges administrators to sponsor badge requests at least six (6) weeks prior to start date/Entry on Duty.
How does this impact the AO community?
To help new NIH staff obtain access to IT networks in a timely manner, it is very important to enter them into NED before they arrive at NIH. Please begin the sponsorship process for new staff at least
six weeks
prior to the start date. This will help ensure that these individuals have time to complete the necessary steps (fingerprints, photograph, e-QIP, etc.) so they can be eligible for a PIV/RLA badge and should be able to access NIH resources on their start date.
Please know that moving forward, people who need IT network access will require an ID badge. This means that you should request both an ID badge and an NIH network account when completing a Register/Activate task in NED. NIH CIT has advised that administrators should no longer select ‘NIH network account' only, as this will not request a PIV/RLA badge.
How does this impact NIH staff?
NIH staff who work remotely and don’t access NIH facilities (such as the Bethesda campus, RML, NIEHS, etc.) now need ID badges to access IT networks. These individuals will most likely have to visit an
NIH badging location
to obtain a badge.
Remote badging services at other HHS locations are extremely limited and typically reserved for those with extenuating circumstances. These remote facilities do not have the capacity to process all NIH remote staff. For more information on remote processing, click
here
.
Please be advised that DPSAC cannot issue ID badges to foreign nationals located internationally. We can only process individuals currently residing in the U.S. in order to complete their required fingerprinting and background investigation. These individuals will need to work with their IC's IT department on alternatives for access to IT networks.
