FAR 52.204-9—Personal Identity Verification of Contractor Personnel.
Plain-English Summary
FAR 52.204-9, Personal Identity Verification of Contractor Personnel, sets the rules for contractor compliance with federal identity credentialing requirements when contractor employees need access to federally controlled facilities or information systems. It ties contract performance to agency personal identity verification procedures that implement HSPD-12, OMB Memorandum M-05-24, and FIPS PUB 201, which together establish the federal standard for secure identity verification and issuance of government credentials. The clause also requires contractors to account for and return any government-provided identification cards or badges issued to their employees, and it gives the contracting officer authority to delay final payment if the contractor does not comply. In addition, it flows down to subcontracts when subcontractor employees need routine physical access to a federally controlled facility or routine access to a federally controlled information system. Practically, this clause is about controlling access, protecting federal facilities and systems, and ensuring government credentials are tracked and recovered promptly when no longer needed. It matters because failure to manage badges and identity credentials can create security risks, administrative delays, and payment consequences for the contractor.
Key Rules
Follow agency PIV procedures
The contractor must comply with the agency’s personal identity verification procedures identified in the contract. Those procedures implement HSPD-12, OMB M-05-24, and FIPS 201, so the contractor must follow the specific credentialing, vetting, and access-control requirements the agency has adopted.
Account for government IDs
The contractor must keep track of all government-provided identification issued to its employees for contract performance. This includes ensuring the credentials are controlled, not lost, and can be returned when required.
Return IDs promptly
Government-issued identification must be returned to the issuing agency at the earliest of three events: when it is no longer needed for contract performance, when the employee’s employment ends, or when the contract ends or is terminated, unless the Government determines אחרת.
Payment may be withheld
If the contractor does not comply with the clause’s requirements, the contracting officer may delay final payment. This creates a financial incentive to manage credentials and returns correctly.
Flow down to covered subcontracts
The contractor must insert the substance of the clause, including paragraph (d), in subcontracts where subcontractor employees need routine physical access to a federally controlled facility and/or routine access to a federally controlled information system.
Prime contractor remains responsible
For subcontractor-issued government identification, the prime contractor is responsible for returning the identification to the issuing agency under paragraph (b), unless the contracting officer approves another arrangement in writing.
Responsibilities
Contracting Officer
Identify the applicable agency personal identity verification procedures in the contract, monitor contractor compliance, and may delay final payment if the contractor fails to comply. The contracting officer may also approve in writing an alternative arrangement for returning subcontractor identification.
Contractor
Comply with the agency’s PIV procedures, account for all government-provided identification issued to contractor employees, return credentials when no longer needed or when employment or the contract ends, and ensure the clause is flowed down to covered subcontracts.
Prime Contractor
When subcontractor employees receive government identification, ensure those credentials are returned to the issuing agency in accordance with paragraph (b), unless the contracting officer approves a different written process.
Subcontractor
If its employees need routine access to a federally controlled facility or information system, comply with the flowed-down clause and support the prime contractor in controlling, tracking, and returning any government-issued identification.
Agency
Establish and apply the personal identity verification procedures that implement HSPD-12, OMB guidance, and FIPS 201, and issue and recover government identification in accordance with those procedures.
Practical Implications
Contractors should build badge and credential tracking into onboarding and offboarding processes, because the return obligation is triggered by multiple events and not just contract closeout.
A common pitfall is failing to recover badges from employees who leave early or move off the contract; that can lead to security issues and delayed final payment.
Prime contractors need a subcontract management process for PIV-related flowdown, especially where subcontractor staff work on-site or access federal systems.
The clause is operational, not just administrative: it affects physical access, system access, and the handling of government property in the form of identification cards.
Contracting officers should verify that the contract identifies the agency procedures clearly, because the contractor’s compliance obligation depends on those procedures being incorporated into the contract.
Official Regulatory Text
As prescribed in 4.1303 , insert the following clause: Personal Identity Verification of Contractor Personnel (Jan 2011) (a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201. (b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government: (1) When no longer needed for contract performance. (2) Upon completion of the Contractor employee’s employment. (3) Upon contract completion or termination. (c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. (d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer. (End of clause)