Applicants' Personal and Citizenship Data Entered in NED must be Accurate
The Division of Personnel Security (DPS) wants to share information regarding the critical importance of ensuring the accuracy of applicants' Personally Identifiable Information (PII) and citizenship data entered into the NIH Enterprise Directory (NED).
DPS has uncovered multiple discrepancies involving applicant's personal and citizenship information entered into the NED system during the registration and badge sponsorship process. Within one week, DPS identified 13 instances of incorrect citizenship data submissions for new badge requests in NED, which can negatively impact both NIH's security posture and national security.
At the NIH, sponsorship of PIV/RLA badges is inherently a government function and therefore, must be completed by a federal employee (FTE). This responsibility is critical for ensuring that individuals who are seeking to obtain access to NIH's property, information and staff are properly vetted.
Due to applicants being able to enter their own PII into NED, it is critical this information is verified before attesting to its correctness and prior to approving the NED record or sponsoring a badge.
This includes:
- The applicant's PII, citizenship, position and employment data.
- Validating and attesting to the need for access to NIH facilities and information systems (including email, network and VPN) based on an authorized business requirement.
- Supporting NIH security and compliance requirements.
Information entered into NED becomes part of the chain of trust and the official security audit record. Entering incorrect or unverified PII, citizenship or other personal or position information into NED poses a significant security risk to the NIH. Additionally, the input of incorrect data can cause significant delays to the onboarding and badging processes.
NED Citizenship Field
It is important to be especially diligent in verifying an applicant's citizenship information in NED prior to sponsoring a badge. Failure to verify the citizenship data entered in NED can result in incorrect citizenship status being submitted, potentially allowing records to bypass critical security checks and processes, thereby leading to an issuance of an incorrect badge type and putting the NIH at risk. These checks and processes include the Visitor Access Management Initiative (VAMI) process and the NIH Division of International Services (DIS) validation of employment authorization.
All non-U.S. Persons (defined as non-U.S. citizens and non-U.S. Lawful Permanent Residents) must be pre-registered and approved by HHS under VAMI requirements, and have their employment authorization validated by NIH DIS. If an individual is a U.S. Lawful Permanent Resident (LPR) (a.k.a. green card holder), the individual must be listed as an LPR in NED. For more information on LPRs, please refer to the Department of Homeland Security (DHS).
For all non-U.S. Persons, the “Date Entered in the U.S." field in NED must reflect the accurate date of entry into the United States.
Before the authority is granted to sponsor an NIH badge, a sponsor must complete NED Portal Training and HSPD-12 Sponsorship training. As part of this training, it is stated that: “Under Title 18 of the U.S. Code, it is a federal offense to counterfeit, alter or misuse the HHS ID Badge and system, and AOs have a responsibility to contribute to privacy, security, and protection in the PIV system." Furthermore, it is a criminal offense to knowingly enter an applicant's personal information incorrectly into NED or any system as an attempt to bypass security checks to expedite the individual gaining access to the NIH.
DPS truly appreciates your cooperation in ensuring the NIH workforce is comprised of suitable federal employees, contractors and affiliates who promote the efficiency and integrity of the NIH mission and service.
Thank you!
