Onboarding Documentation Retention: What to Keep and for How Long

Editorial correction · 27 September 2026. The guidance below was corrected against the linked primary sources. Apply the current rules and instructions for your circumstances.

The Audit You Did Not See Coming

A contracting officer calls. An I-9 audit notice arrives. A subcontractor dispute surfaces two years after contract closeout. In each scenario, the first question is the same: do you still have the documentation? For many contractor HR and compliance teams, the honest answer is uncertain. Retention schedules exist, but they are often incomplete, inconsistently applied, or siloed across HR, security, and contracts departments. The result is exposure, not because records were falsified, but because they were purged too early, stored in the wrong format, or never collected in the first place.

This post covers the core onboarding document categories, the governing rules for each, and a practical retention framework you can apply to your program today.

Why Retention Rules Are Not One-Size-Fits-All

Federal contractor onboarding generates documents that fall under at least four distinct regulatory regimes: immigration and employment eligibility (I-9 and E-Verify), federal acquisition and contract performance, personnel security and suitability (SF-85, SF-86, and related adjudication records), and electronic signature law (ESIGN and UETA). Each regime carries its own clock, its own custodian, and its own audit risk. Treating them as a single pile of HR paperwork is where programs go wrong.

I-9 and E-Verify Records

Form I-9 has a specific retention rule. Under 8 U.S.C. 1324a, employers must retain a completed I-9 for each employee for the later of: three years from the date of hire, or one year after the date employment ends. That formula means a long-tenured employee's I-9 must be kept well past their last day. For a worker hired in 2018 and separated in 2025, the I-9 must be retained until 2026, not 2021.

For E-Verify, record the case verification number on Form I-9 or attach the case details page, following the official records-retention instructions and current program requirements. Retain the I-9 and required associated records for the applicable period; do not rely on continued access to old cases in the E-Verify system.

I-9s may be retained in permitted paper or electronic formats. Electronic records must meet the applicable retention, documentation, security and signature requirements in 8 CFR 274a.2(e)-(i). Confirm indexing, access, integrity and audit controls before relying on scanned records.

Offer Letters, Contractor Agreements, and Compensation Records

Set retention by record type and governing rule. FLSA rules distinguish three-year records from two-year supporting records. SCA records generally run three years from completion of the work under 29 CFR 4.6(g); Davis-Bacon records run at least three years after all prime-contract work is completed under 29 CFR 5.5(a)(3). Apply any other controlling record-specific requirement.

Set agreement retention from the applicable contract, recordkeeping rules, dispute requirements and preservation holds. The six-year claims period in FAR 33.206 generally runs from claim accrual; it is not a universal six-years-after-closeout retention rule for employment or subcontract agreements. Have the legal or contracts owner document the applicable schedule.

Personnel Security Records: SF-85, SF-86, and Adjudication Files

Separate government investigation records from contractor records needed for authorized security administration. SF-85 and SF-86 information is sensitive; confirm which records the agency permits or requires the contractor to hold, who may access them, and when they must be destroyed. Do not copy complete questionnaires into a general HR file.

Have the FSO identify applicable agency instructions and record-specific retention authority. 32 CFR 117.10(d) limits SF-86 review to designated personnel and specified purposes; it does not establish a blanket two-years-after-access retention schedule. Record the authority and destruction trigger for each permitted security record.

Do not retain more of the SF-86 than your program requires. The form contains highly sensitive personal information. Retaining unnecessary copies creates both a privacy liability and a potential breach surface.

Electronic Signature Records

Where 15 U.S.C. 7001(d)-(e) applies, an electronic record used to satisfy a retention requirement must accurately reflect the information and remain accessible and reproducible for the required period. These provisions do not impose a universal IP-address or device-log requirement. Define appropriate signing evidence for the transaction and applicable state law.

Document the retention period for the signed agreement and necessary signing evidence under the applicable rules and preservation holds. Confirm that records can be exported in a usable format before relying on a vendor portal. A life-of-agreement-plus-six-years policy may be an organizational choice; it is not a universal ESIGN requirement.

HSPD-12 and PIV Enrollment Records

For PIV records, identify the agency custodian and applicable disposition authority. NARA General Records Schedule 5.6 addresses federal credential records; it does not establish a universal contract-plus-two-years schedule for a contractor HR file. Retain only the credential evidence authorized and needed for the program.

Building a Practical Retention Schedule

A workable retention schedule for federal contractor onboarding should map each document type to its governing authority, retention period, storage format requirement, and designated custodian. The table below summarizes the key categories:

• I-9 and required E-Verify documentation: Retain the I-9 until the later of three years after hire or one year after employment ends. Record the E-Verify case number or attach case details as required. Apply electronic retention and security standards in 8 CFR 274a.2(e)-(i). Custodian: HR.
• Offer letters and contractor agreements: Use the documented schedule for the agreement, jurisdiction, contract and preservation holds. Custodian: HR and Contracts.
• Payroll and supporting records: Apply the record-specific FLSA period and applicable SCA or Davis-Bacon completion-based period described above. Custodian: HR/Payroll.
• Personnel security records: Use the agency-authorized, record-specific schedule and privacy restrictions documented by the FSO. Do not apply an assumed two-year default.
• Signing evidence: Retain evidence needed for the applicable agreement and legal requirements; preserve accessible, reproducible records and observe holds. Custodian: HR/Legal.
• PIV credential evidence: Follow issuing agency requirements and applicable record schedule; confirm the permitted contractor copy and custodian.

Common Failure Modes

Three patterns to check in a contractor onboarding program are: First, no defined destruction schedule: records are kept indefinitely, which creates privacy liability and storage cost without adding compliance value. Second, format drift: paper originals are scanned but the originals are destroyed before confirming the electronic copy meets regulatory standards. Third, custodian ambiguity: HR assumes FSO is keeping security records; FSO assumes HR is keeping them. Neither is keeping them.

Assign a named custodian and a documented destruction date for every document category. Review the schedule annually and after any contract award that introduces new regulatory requirements.

Takeaway

Retention is not an archive problem. It is a compliance posture. The right documents, kept in the right format, for the right duration, with a named custodian and a destruction date, are what separate a defensible onboarding program from an audit liability. Start with the I-9 schedule, layer in your contract and security records, and document the whole thing before the next audit notice arrives.

If you are building or auditing your contractor onboarding documentation program, the team at IT Custom Solution can help you map requirements to your specific contract vehicles and agency relationships. Reach out for a brief consultation to talk through where your current process may have gaps.