FAR 4.1301—Policy.
Plain-English Summary
FAR 4.1301 establishes the governmentwide policy for personal identity verification (PIV) when contractor or subcontractor personnel need routine physical access to a federally controlled facility or routine access to a federally controlled information system. It requires agencies to apply FIPS PUB 201 and the related OMB implementation guidance, and to reflect those requirements in solicitations and contracts so offerors know the identity-verification rules before performance begins. The section also requires agencies to designate an official responsible for verifying contractor employee identity, which supports consistent issuance and control of PIV credentials. In addition, it addresses the return and accountability of government-provided identification products, such as PIV cards or similar badges, when they are no longer needed, when the employee leaves, or when the contract ends. Practically, this section is about controlling physical and logical access, preventing misuse of government credentials, and ensuring agencies and contractors have clear procedures for issuance, tracking, return, and enforcement, including the possibility of delayed final payment if the contractor does not comply.
Key Rules
Apply FIPS 201 Requirements
Agencies must follow FIPS PUB 201 and the associated OMB guidance for contractor and subcontractor personnel who need routine access to federal facilities or information systems. This makes PIV compliance mandatory whenever the contract performance triggers those access needs.
Disclose Requirements in Solicitations
Agencies must include their implementation of FIPS PUB 201 and OMB Guidance M-05-24 in the solicitation and contract. This ensures contractors understand the identity-verification process, credentialing expectations, and any agency-specific procedures before award and performance.
Designate Identity Verification Official
Each agency must designate an official responsible for verifying contractor employee personal identity. That official provides accountability for confirming identity before a PIV credential or similar access device is issued.
Track Government-Issued Credentials
Agency procedures must require contractors to account for all government-provided identification issued to contractor employees, including PIV cards or similar badges. The agency must be able to determine where each credential is and whether it has been properly returned.
Return Credentials Promptly
Contractors must return government-issued identification to the issuing agency as soon as it is no longer needed for contract performance, when the employee’s employment ends, or when the contract is completed or terminated, unless the agency decides otherwise. The rule is designed to prevent unauthorized continued use of access credentials.
Enforce Through Payment Withholding
The contracting officer may delay final payment if the contractor fails to comply with the credential return requirements. This gives the government a practical enforcement tool to ensure all issued identification is accounted for and returned.
Responsibilities
Agency
Follow FIPS PUB 201 and the applicable OMB implementation guidance for covered contractor and subcontractor personnel; incorporate the agency’s PIV implementation requirements into solicitations and contracts; designate an official to verify contractor employee identity; and establish procedures to account for and recover government-issued identification products.
Contracting Officer
Ensure the solicitation and contract include the agency’s PIV implementation requirements; monitor contractor compliance with credential return obligations; and may delay final payment if the contractor does not return government-issued identification as required.
Designated Agency Official
Verify the personal identity of contractor employees who require access and support the agency’s PIV issuance and control process.
Contractor
Ensure affected employees comply with agency PIV and identity-verification requirements; account for all government-issued identification issued to its employees; and return PIV cards or similar badges promptly when they are no longer needed, when employment ends, or when the contract ends or is terminated.
Subcontractor
Comply with the same identity-verification and access-control requirements when its personnel are covered by the contract’s routine access conditions.
Contractor Employee
Provide identity information needed for verification and surrender any government-issued identification when it is no longer needed or when employment or contract performance ends.
Practical Implications
Contractors should plan early for PIV processing because identity verification can delay onboarding and site access if not built into mobilization schedules.
Contracts that involve facility access or system access should clearly state who issues credentials, who verifies identity, and how badges must be returned at offboarding and closeout.
A common pitfall is failing to collect badges from departing employees or subcontractor personnel; agencies may treat that as noncompliance and hold up final payment.
Contractors should maintain a credential inventory and offboarding checklist so every issued PIV card or badge is tracked and returned on time.
Contracting officers should coordinate with security, HR, and program staff to ensure the contract language and local procedures match the agency’s actual PIV implementation.
Official Regulatory Text
(a) Agencies must follow FIPS PUB Number 201 and the associated OMB implementation guidance for personal identity verification for all affected contractor and subcontractor personnel when contract performance requires contractors to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. (b) Agencies must include their implementation of FIPS PUB 201 and OMB Guidance M-05-24 in solicitations and contracts that require the contractor to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. (c) Agencies must designate an official responsible for verifying contractor employee personal identity. (d) (1) Agency procedures for the return of Personal Identity Verification (PIV) products shall ensure that Government contractors account for all forms of Government-provided identification issued to Government contractor employees under a contract, i.e ., the PIV cards or other similar badges, and shall ensure that contractors return such identification to the issuing agency as soon as any of the following occurs, unless otherwise determined by the agency: (i) When no longer needed for contract performance. (ii) Upon completion of a contractor employee’s employment. (iii) Upon contract completion or termination. (2) The contracting officer may delay final payment under a contract if the contractor fails to comply with these requirements.