GMOS/SMS Badging Procedure

Desktop Instruction
Approved by: __________________________________________________________________________________________ (Title) / Date

BADGE ISSUE AND ACCOUNTABILITY

Responsibilities: The GMOS/SMS Facility Security Officer (FSO) is responsible for the overall administration of the Badge Issue and Accountability Program and for accurately maintaining the access control database. The FSO (or designated representative) shall conduct periodic reviews and purging of the database, compile a report, and maintain accurate photo badge accountability records. General Badge Issuing Procedures: GMOS/SMS photo badges shall be issued to individuals requiring recurring access to GMOS/SMS Aiken facilities and other GMOS/SMS facilities as needed. A completed Information Access Service Request (IASR) Form or Badge Request Form is required for issuance of a GMOS/SMS photo badge. See instructions on creating a photo badge (Reference Attachment A), Process for Manufacturing Photo Badges. The security representative issuing the GMOS/SMS badge shall provide instructions to the individual receiving the badge. At a minimum, the following topics shall be addressed: Proper use of the badge Entering/exiting requirements during normal and non-business hours Policy regarding "tailgating" Wearing and safeguarding the badge Reporting lost, damaged (to include picture fading), or malfunctioning badges Challenging others observed not wearing a badge within the facility Prohibited items Emergency response rally points Handling and protection requirements for Controlled Unclassified Information (CUI)

Accountability Records: Applicable information from the IASR or Badge Request Form shall be entered into the access control database as specified below.

Page 1 of 14

File the completed IASR or Badge Request Form in a 90-day suspense file upon issuance of a photo badge. When not in use, GMOS/SMS unissued blank badges shall be filed non-programmed and in numerical order in a locked cabinet. The purchase order reflecting the card numbers available for issue shall be maintained with the stock of blank badges. Badges reported lost or stolen shall be entered and maintained in the database as lost or stolen. Destruction: Unserviceable/Defective badges, replaced badges, and retired badges shall be destroyed and removed from the database. Access Control Alarm Reviews: The FSO or designated representative shall review the access control database alarm history report daily and resolve alarm conditions. This review shall consist of monitoring unauthorized entry attempts, identifying malfunctioning cards, and identifying employee's failing to use proper procedures when entering/exiting which results in an alarm condition. Action shall be taken to resolve each alarm condition and appropriate corrective action initiated.

PHOTO BADGE REQUEST AUTHORIZATION

The IASR Form (Reference Attachment B) is the primary source document for identifying personnel who may be issued a GMOS/SMS photo badge. This form is initiated either by GMOS/SMS Human Resources for employees or Procurement for contractors/ subcontractors. Personnel responsible for manufacturing GMOS/SMS badges and receiving an electronic IASR Form should note the type request indicated on the form (e.g., New, Update or Termination) and take the following action: For IASR Forms indicating a New Account, a GMOS/SMS badge with the standard SMS access level may be issued without completing a Badge Request Form. However, when additional access levels are required, a completed Badge Request Form (Reference Attachment C) or e-mail from the employees sponsoring manager must be obtained. The Badge Request Form may be transmitted electronically by the receptionist or hand-carried by the employee to the individuals sponsoring manager for completion. Upon receipt of the signed Badge Request Form indicating the required access levels, a GMOS/SMS photo badge can be manufactured. Badges for subcontractors or affiliates must indicate employee type (e.g., contractor, affiliate, etc.) along with the sponsoring manager. NOTE: Enter the employee type in the Employee Type field and enter the host/supervisors name in the Vehicle field in the database. If employee type is a

Page 2 of 14

contractor/subcontractor, enter the expiration date of the contract in the expiration date field. For forms indicating update, the form must be reviewed by the person making or changing the badge to determine what information on the form was updated (e.g., company name, start and end dates, etc.). Changes indicated on the form should then be made to the access control database, as appropriate. For forms indicating termination, the card database record shall be updated to include an expiration date for the badge (reference note below on expiration dates). The badge should be returned during out-processing and at that point can be deleted from the database. Once the record has been deleted, the badge should be destroyed. If the badge was not recovered upon out-processing, every attempt shall be made to recover the badge by contacting the sponsoring manager noted in the database. The recovered badge shall be forwarded to Security Services for destruction. Badges that cannot be recovered shall be deleted from the database.

NOTE for entering expiration dates: The badge will expire midnight prior to the date entered in the database. For example, if the expiration date is entered as 12/31/2011, the badge will expire on 12/30/2011 at 24:00. Therefore, if the contract end date is 12/31/2011, enter the expiration date in the database as 1/1/2012. In cases where an IASR Form is not generated, a GMOS/SMS sponsor must complete and sign a Badge Request Form and obtain approval from the sponsoring manager and GMOS/SMS Facility Security Officer (FSO) or designated representative. As an alternative to the Badge Request Form, the sponsoring manager may send an e-mail to the FSO or designee indicating the required access levels for the individual who, in turn, will forward the e-mail to the person making the badge. All photo badges issued must indicate the sponsoring managers name in the Vehicle field of the database along with a badge expiration date (reference note above on expiration dates). Both the sponsor and person receiving the badge shall be instructed that the badge must be returned when no longer needed. Returned badges shall be removed from the database and destroyed. The GMOS Proposal Center Manager or designated representative must authorize facility security badges for personnel requesting access to the GMOS Proposal Center located in CCC-2.

TYPES OF PHOTO BADGES

GMOS/SMS Employees Photo badge with no red letter reflected below the picture. This badge shall be issued to GMOS/SMS personnel who have signed the Employee Intellectual Property Agreement. GMOS/SMS Affiliates Photo badge reflects a red letter A below the picture on the left side. This type badge shall be issued to personnel employed by GMOS/SMS affiliate companies who require frequent (at least weekly) access to the facility.

Page 3 of 14

Contractor/Consultant Photo badge reflects a red letter C below the picture on the left side. This badge shall be issued to contractors/consultants who have signed the GMOS/SMS Agents and Consultants & Personal Services Contractors Intellectual Property Agreement. GMOS Foreign National/Affiliate Employees Photo badge has brown vertical stripes down both sides of the badge and reflects a red letter A (for affiliates) below the picture on the left side. GMOS Foreign National/Affiliate employee badges require both management and FSO approval.

VISITORS
Personnel not in possession of a GMOS/SMS photo identification badge are considered visitors and must process into the facility at receptionist desks located at the front lobby doors for GMOS Proposal Center, the GMOS Finance at Building CCC-2, or CCC-3. All visitors shall be sponsored by a GMOS/SMS employee possessing a GMOS/SMS photo identification badge, complete the Visitor Access Log, and be briefed by the sponsor on their emergency response responsibilities (rally points) and visitor conditions for access (Reference Attachment D) prior to granting entry. The receptionist may issue a visitor badge once a GMOS/SMS sponsor arrives at the receptionist desk, verifies the identity of the visitor, and ensures the visitor log is completed. Visitors shall be instructed to display a personal photo identification credential along with the visitor badge (e.g., drivers license, DOE badge, military ID, etc.). NOTE: Verification by a GMOS/SMS sponsor may be waived for individuals whose name appears on an approved access authorization letter maintained at the receptionist desk (Reference Attachment E). This authorization letter shall be prepared by the GMOS/SMS member sponsoring recurring visits in support of vending, maintenance, and other company-related activities where the issuance of a photo badge is not warranted and be approved by the FSO prior to the visit. The authorization letter shall include the purpose of the visit, duration of the visit, persons name(s), drivers license number, citizenship, and company name. When entry is granted based on an approved access authorization, the following shall be accomplished: Receptionists shall verify the identity of the visitor by comparing the individuals identification with the information contained on the authorization letter. Once the visitors identity is verified, the visitor shall sign the GMOS/SMS Visitor Log and be issued a no escort required visitor badge reflecting a Green V (see below). Visitors shall be instructed to display personal photo identification (e.g., drivers license, DOE/Federal credential, military ID, etc.) along with the visitor badge and to wear the badge while within the facility.

Page 4 of 14

TYPES OF VISITOR BADGES Green V

This badge shall be issued to U. S. Citizen Visitors of GMOS/SMS affiliate companies and other personnel listed on an approved access authorization letter. Personnel issued a Green V badge are not required to be escorted. The receptionist shall inform the visitor that tailgating is prohibited and they must prox when entering and exiting the facility. The Green V badges are operable only during business hours (7:00AM - 6:00PM); however, the visitor may remain in the facility during non-business hours (6:01PM 6:59AM) provided a GMOS/SMS sponsor remains with the visitor to ensure the capability exists to arm the alarm system prior to departure. Examples to whom Green V badges may be issued: URS Corporation URS Energy & Construction Global Management & Operations Services Personnel participating in GMOS Bid Proposals Representatives of the Federal Government (e.g., DOE, DOD, DSS, and OPM) Subcontracting companies such as Pinnacle (formerly ACTS), E2, etc. Personnel whose name appears on an approved access authorization letter Employees that forgot their badge Employees that have misplaced their badge (visitor badges can be issued until either the badge is recovered and/or replacement picture badge can be issued)

Yellow V
This badge shall be issued to U. S. Citizen Visitors of companies that are not affiliated with GMOS/SMS and require infrequent (less than weekly) access to the facility. A GMOS/SMS sponsor must escort visitors issued a Yellow V badge while within the facility. Escort Required Badges do not have any access levels assigned and cannot be used to unlock doors. Receptionists shall instruct the visitor not to use the badge to prox at any card readers as this action will result in an access control alarm condition. Examples include: Vending machine service personnel Copy machine service personnel Contractors without a picture badge or who do not have an access authorization letter in place

Page 5 of 14

Visitors from business competitors Relatives of GMOS/SMS employees

NOTE: An exception to the issuance of a Yellow V badge may be granted by the FSO or designated facility security personnel on a case-by-case basis or when documented on the approved access authorization letter. Visitor badges are not to be removed from the facility except when traveling between Buildings CCC-2 and CCC-3. Either the sponsor/escort or the visitor must return the visitor badge to the receptionist (or badge deposit box) at the conclusion of the visit and whenever they must depart the facility for short durations (e.g., lunch breaks, transport to Newberry, retrieve items from vehicle, etc.). Note: It is preferred that the badge be returned to the facility from which it was checked out. The receptionist shall inventory all visitor badges at the start of each work day and initiate action to recover any missing badges. Visitor badges that are missing or unaccounted for shall be reported to the FSO (or designated representative), who will take action to code the badge as inactive in the database while attempts to locate the badge are made. An additional notification shall be made to the FSO (or designated representative) of any badge that cannot be located within five days, who in turn will remove the lost badge from the database. If a replacement is needed, one will be provided. Visitor logs shall be reviewed for completeness and accuracy at the beginning of each work day and completed logs shall be maintained for 90-days. Additionally, the receptionist shall conduct and document a monthly physical inventory of all visitor badges. The results of this monthly inventory will be forwarded to the FSO (or designated representative).

DATABASE MAINTENANCE
Periodic reviews and purging of the database is a vital element in maintaining an effective access control system. The use of company employee rosters/locators, where possible, should be used for this review. The assignment of access levels must be based on the individuals specific job requirements and approved by the managing member and/or facility manager. Badges shall be deleted whenever an employee is terminated or at the end of his/her contract. The IASR Form should be used to identify personnel in these categories. Use the lost/stolen category for cards reported as lost/stolen. This action places the card in an inactive status and cannot be used to enter URS facilities. Any attempt to use the card for entry will result in an alarm condition in the database.

Page 6 of 14

When entering Visitor Badges into the database, the word Visitor should be entered in the first name field along with the visitor badge number. The location and visitor badge type (e.g., Green V/Yellow V/FN) shall be recorded in the first name column. Expiration dates must be entered in the database for contractors, affiliates, and personnel on temporary assignment. NOTE: A card history report shall be generated monthly to identify expired badges. Badges expired greater than 90 days shall be deleted from the database.

RECORDS RETENTION:
IASR Forms shall be maintained in a 90-day suspense file Photo Badge Request Forms shall be maintained for 90 days Visitor logs shall be maintained for 90 days

ATTACHMENTS:
A: B: C: D: E: Process for Manufacturing Photo Badges Sample IASR Form Badge Request Form Conditions of Visitor Access Sample Authorization Letter

Page 7 of 14

ATTACHMENT A PROCESS FOR MANUFACTURING PHOTO BADGES

The issuing security representative shall load blank card stock into the badging printer with the card number facing downward and towards the left side. Loaded cards shall be entered into the database numerically but without any access levels assigned. Cards received from the manufacturer are loaded in reverse order and must be reloaded with lowest number at the bottom of the stack. TAKING PHOTOGRAPH 1. Verify individuals employment status (e.g., GMOS/SMS member, Subcontractor, Affiliate). Ensure that an IASR Form has been issued or the proper authorization received. 2. Position personnel approximately five feet from the camera. 3. Turn on camera (on/off switch located on top of camera). Unplug the 1st USB cord on right side of camera. 4. Press the silver button on top of the camera. Adjust zoom (button top right) and center subject in the LCD screen. 5. Advise personnel that there will be a flash from the camera. 6. Take photo and review by pressing the review setting. 7. If taking multiple photographs, record the name of the subject on a log and indicate the number reflected on the LCD screen for the photo. TRANSFERRING PHOTO FROM CAMERA TO COMPUTER 1. Ensure camera is turned on. 2. Plug the USB back into the first USB port located on the right side of the camera. 3. One touch transfer pop-up will appear and Kodak Easy Share will automatically move photo from camera to monitor. 4. Highlight the photo to be transferred and select file, save as, desktop, pictures folder, corresponding alphabetical letter, and type last name, first name.

Page 8 of 14

MANUFACTURING A NEW BADGE 1. Open WINPAK Pro User Interface software and enter user name and password. 2. Check the database to ensure the person is not already listed to avoid duplications. 3. Select card on the menu bar and then select cardholder. 4. Select ADD from the Operations column (right column top). 5. Enter the first, then last name of the person to be issued the badge. 6. Select Vehicle tab from the card holder menu. In the Employee Type field, enter affiliate or contractor as appropriate. If the badge is for a GMOS/SMS member, leave this field blank. 7. If the badge is for an affiliate or contractor, select the Visitor tab from the card holder menu and enter the GMOS/SMS sponsors name in the Employee Type field. 8. If the badge is for the Oak Ridge, Los Alamos, Newberry Street facilities or another facility, enter the facility name in the Visitor Type field. 9. Select card biometrics tab from the card holder menu. Select Import, then open. Locate the file name of the persons photo from the alphabetical files in C:\pictures and double click the appropriate file name. 10. The Import Photo dialog screen will open. Crop the photo (use the mouse to move the white border toward the center of the photo, then select OK. The photo will be displayed on the card holder record (card biometrics tab). 11. Double click on the cards tab and select Attach. This will open the select window. On this window, select the find button and the next card number to be issued will be displayed. NOTE: It is important to check this number with the next card number in the badge printer. Select OK to enter the card number to the card holder record. 12. Double click on the card number, and the card record screen will open (showing the card number, status, cardholder, and access level). Ensure the approved access level(s) is/are selected from the pull down menu (e.g., executive access level, URS only-24 hours, URS only-contractor, Proposal Center, etc.) and the status is indicated active. If the badge is for other GMOS/SMS locations, ensure the status indicated is inactive and the name of the facility is indicated in the first name field of the database along with the badge number. If the person requires customized

Page 9 of 14

access to the GMOS Proposal Area, the CCC-3 Closed, Secured or Computer Support Areas, or other access levels, select add by Custom Access Level and select the appropriate access level. Enter a four digit numeric PIN if person is a GMOS/SMS employee. Advise person that the PIN cannot begin with a zero and should not contain all the same numbers when selecting the PIN. If the person is a contractor or affiliate, enter an expiration date and name of sponsor. The expiration date for contractors shall be their contract expiration date. The expiration date for badges issued to affiliates/visitors should be provided by their sponsor. 13. Click on the badge tab and open the pull down menu for the front side and select the type badge to be issued to the individual (e.g., Contractor, Affiliate, URS member, GMOS employee, etc.). 14. Once the badge is displayed, review for accuracy and click on the OK button. 15. To print the badge, highlight the card number indicated on the card record screen and select the print option. This will bring up the print badge preview screen. Review for correctness and select Print. 16. Verify the correct number of the badge is reflected and issue the badge. 17. Brief the person(s) on procedures for entering and exiting the facility and if a GMOS/SMS employee, brief them on arming and disarming the alarm system. NOTE: Use the training guide to ensure all pertinent information is provided and ensure the individual understands their responsibilities. 18. Provide subcontractors and personnel who do not participate in onboarding training a copy of the security handout and instruct them to read it and address any questions to the FSO or designated representative.

Page 10 of 14

ATTACHMENT B Sample IASR Form

Rev. 1/11/2012

Information Access Service Request Form

Account Mailbox Machine Phone No Action

Please fill in all blanks of the form. Once the form is authorized, distribute to the following: Computer Support (Network Accounts, Email, Phones, Pagers) Facilities (Cube Assignment, Nameplates) Finance (ET Setup) Operations (Locator Updates) Security (Security Badges, Building Access) Request Date: Type: Citizenship: New Account United States Update Other WGS Contract #: Contractor: Company: Org Code: Termination

Status: WSMS Employee _______________________ Proposal Center Personnel _______________________

ET Account Number a unique 9-digit number in the form XXX-XX-XXXX. (Contract Personnel Only) Last Name Start Date Phone (If Known) Manager/SOR Managers 1st Alternate Managers 2nd Alternate Assignment Location Computer Account Computer Equipment Clearance Required URS Security Badge Required CCC3 Used to complete timesheets. While it is NOT required, many use their SSN. First Name End Date Pager (If Known) Phone Phone Phone CCC2 SRS Newberry SMS Email Laptop Q(DOE) Secret (DOD) Top Secret(DOD) Cube # (If Known) Cube # Cube # Cube # TrlRidge MidAm Other WebET Middle (I)

SMS Network Account None None Yes Desktop L(DOE) No

VPN/Secure ID

Page 11 of 14

ATTACHMENT C

URS-SMS BADGE REQUEST FORM

From: ____________________________ To: URS-SMS Badge Office SUBJECT: URS-SMS Badge Request Date: _______________

A. Request an SMS Photo Identification Badge with access to the facilities indicated below be
issued to ______________________________ (_____________________________________).
(Print or type name) Company Name and Department (if a contractor or affiliate)

B. This individual is an: (circle one)

SMS Employee, SMS Contractor, GMOS Employee, GMOS Contractor, URS Affiliate, or Other (specify):

C. This individuals contract (and access) Expiration date is

Indefinite access is requested to the following FACILITIES:

____/____/____ , or

D. Sponsor must indicate 1) facility accesses and 2) access times-(circle appropriate) URS-SMS
CCC-3 06:30 18:00 (M-F) 24hrs CCC-2 (GMOS Finance) 06:30 18:00 (M-F) 24hrs SPONSOR

PES
(TRAIL RIDGE BUILDING)

GMOS
PROPOSAL CENTER Zones? 1 2 3 BD YES- Alarm Control -NO Foreign Natl Area 24 hrs 06:30 18:00 (M-F)

TR-Second Floor 24 hrs 06:30 18:00 (M-F) TR-First Floor 24 hrs 06:30 18:00 (M-F) and APPROVAL

______________________ SMS/GMOS Sponsor,

-or-

________________________________ Facility Security Officer

______________________ PROPOSAL Sponsor (A. CURRY, A. JOSLIN, CAPTURE MANAGER)

Page 12 of 14

ATTACHMENT D GMOS/SMS Conditions of Visitor Access

As a visitor, your entry into facilities of URS Safety Management Solutions, LLC (GMOS/SMS) and its subsidiary companies is conditioned upon your agreement, as consummated by your signature upon the Visitors Access Log, to granting GMOS/SMS the following rights and to your compliance with the following obligations: Visitor Obligations 1. Contraband is specifically prohibited within the GMOS/SMS facilities. Contraband shall mean any of the following items of any kind: 2. 3. Weapons (including concealed weapons authorized by permit: concealed weapons, whether authorized by permit or otherwise, are specifically prohibited within GMOS/SMS facilities), ammunition and explosives; Alcohol; Drugs (other than those prescribed or over the counter and necessary for your own personal health and welfare), and; Recording equipment (other than that which has been pre-approved by GMOS/SMS).

4.

Visitor shall comply with all Federal, State, or local laws, regulations, rules, orders, directives and other requirements governing information to which Visitor is provided access while within the GMOS/SMS facilities. Visitor shall not engage in any verbal or other harassment of any kind of any GMOS/SMS employee, agent, consultant, contractor or other visitor on the basis of race, color, sex, religion, age, national origin, handicap or disability, or status as a veteran. Visitor shall comply with GMOS/SMS instructions in the event of an emergency. (The GMOS/SMS Emergency Response Guidelines are posted for your review).

GMOS/SMS Rights 1. GMOS/SMS shall possess the right to terminate Visitors access to the GMOS/SMS facilities at any time for any reason. GMOS/SMS shall possess the right to search the Visitor and his/her possessions while within the GMOS/SMS facilities for any reason, with or without cause, for the limited purposes of determining whether Visitor (i) is carrying contraband as defined under Obligation No. 1 above, (ii) has taken or possessed information to which he/she has not been authorized access, and/or (iii) has taken or possessed property to which he/she has not been authorized access. Page 13 of 14

2.

ATTACHMENT E Sample Authorization Letter

TO: CC: GMOS/SMS Facility Security Officer FROM: LOCATION:

SUBJECT:

Request for Visitor/Vendor Access

Request the below listed individual(s) be granted unescorted entry to the GMOS/SMS controlled facility indicated below and issued a No Escort Required Visitor Badge (Green V). Either a company representative or a GMOS/SMS sponsor must include the purpose and duration of the visit below and provide an updated list as new or additional personnel are added or when extending the visit duration. Access area: CCC-3 SMS / CCC-2 GMOS Finance / CCC-2 GMOS Proposal / Trail Ridge / Other (specify) Purpose: Duration (not to exceed one year): NAME OF PERSON COMPANY DRIVERS LICENSE CITIZENSHIP

_________________________________ Company Representative/GMOS/SMS Sponsor _______________________________ GMOS/SMS Facility Security Approval __ / / EXPIRATION DATE

Page 14 of 14