System Name:
HSPD-12: Identity Management System (IDMS).
Records relating to the Identity Management System are maintained by a contractor at the contractor’s site. This does not include building or computer access records.
Individuals with authorized USPS law enforcement or emergency response duties, including postal inspectors, Office of Inspector General criminal investigators, and USPS executives and their designees.
- Cardholder information: Records related to issuance of identity management credentials, including name, date of birth, Social Security Number (SSN), organizational and employee affiliations, fingerprints, digital color photograph, work e-mail address, and phone number(s) as well as additional verification and demographic information. Other types of data contained in the system include federal emergency response official status; law enforcement official status; and Personal Identity Verification (PIV) Card issuance location. Records in the IDMS needed for credential management for enrolled individuals in the PIV Program includes: PIV Card serial number (all past and current Card ID numbers are retained); digital certificate(s) serial number; PIV Card issuance and expiration dates; PIV Card personal identification number (PIN); Cardholder Unique Identification Number (CHUID); and card management keys.
- Card-swipe records: Records related to employees and visitors who enter and leave participating federal facilities and disaster recovery areas. This does not include direct tracking of access to USPS facilities.
- Computer access authorization information: Records related to computer users, including logon ID; Social Security Number, Employee Identification Number, or other assigned identifier; employment status information; and extent of access granted.
39 U.S.C. 401, and Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
To assist in making determinations for access to other federal facilities.
Standard routine uses 1 through 9 apply.
Automated database, computer storage media, digital files, and paper files.
- Records about building access are retrieved by name or Cardholder Unique Identifier Number.
- Cardholder information may be retrieved by name, logon ID, or other unique identifier of the individual. Note: While many federal agencies utilize the IDMS, USPS will only have access to data on its employees enrolled in the system (not to any other agency’s data).
All biographic and biometric data collected prior to and during the enrollment process is transmitted to the PIV IDMS over a private network in an encrypted format. Facilities and equipment are secured by limiting physical access to the workspace and system, and by requiring an appropriate verification of identity. Where appropriate, this method uses the PIV card providing up to three factors of authentication. Where necessary, this method also consists of two components (e.g., user ID + password). Physical security measures are employed to protect enrollment equipment, facilities, material, and information systems, including locks, ID badges, fire protection, redundant power and climate control to protect IT equipment. The PIV IDMS sends confirmed enrollment information to the card production facility via a secure FTP connection. Cards that are not active cannot be used for access to federal facilities. Certifications are revoked when they are reported lost, stolen, damaged beyond use, or when a cardholder has failed to meet the terms and conditions of enrollment. Cards will be deactivated upon collection of damaged cards or if the employee no longer requires a PIV card.
- Building access records are retained according to the policies of the agencies visited.
- Records of computer access privileges and authorization information are retained 5 years after the cardholder is separated from the Postal Service.
Data will be disposed of according the requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-88 Guidelines for Media Sanitization. Magnetic media will be degaussed and then destroyed; paper records will be stored in locked bins, transported securely via bonded courier, and shredded.
For collection of cardholder information: Chief Postal Inspector, United States Postal Inspection Service, 475 L’Enfant Plaza SW Fl 3, Washington, DC 20260.
For records relating to the Identity Management System and identification cards: Program Manager, HSPD-12 Managed Service Office, Federal Acquisition Service (FAS), General Services Administration, 10304 Eaton Place Fl 3, Fairfax, VA 22030.
For records of building access to other federal buildings, contact that agency.
Inquiries for records about building access must be addressed to the facility head. Inquiries about access to the IDMS are to be directed to the Program Manager, HSPD-12 Managed Service Office, Federal Acquisition Service (FAS), General Services Administration, 10304 Eaton Place Fl 3, Fairfax, VA 22030. Inquiries regarding collection of cardholder information are to be directed to the Chief Postal Inspector, United States Postal Inspection Service, 475 L’Enfant Plaza SW Fl 3, Washington, DC 20260. Inquiries must include full name, Social Security Number or Employee Identification Number, and period of employment or residency at the location.
Requests for access must be made in accordance with the Notification Procedure above and USPS Privacy Act regulations regarding access to records and verification of identity under 39 CFR 266.6.
See Notification Procedure and Record Access Procedures above.
Employees, subject individuals, former employers, and other systems of records.
