Onboarding Documentation Retention: What to Keep and for How Long

The Audit You Did Not See Coming

A contracting officer calls. An I-9 audit notice arrives. A subcontractor dispute surfaces two years after contract closeout. In each scenario, the first question is the same: do you still have the documentation? For many contractor HR and compliance teams, the honest answer is uncertain. Retention schedules exist, but they are often incomplete, inconsistently applied, or siloed across HR, security, and contracts departments. The result is exposure, not because records were falsified, but because they were purged too early, stored in the wrong format, or never collected in the first place.

This post covers the core onboarding document categories, the governing rules for each, and a practical retention framework you can apply to your program today.

Why Retention Rules Are Not One-Size-Fits-All

Federal contractor onboarding generates documents that fall under at least four distinct regulatory regimes: immigration and employment eligibility (I-9 and E-Verify), federal acquisition and contract performance, personnel security and suitability (SF-85, SF-86, and related adjudication records), and electronic signature law (ESIGN and UETA). Each regime carries its own clock, its own custodian, and its own audit risk. Treating them as a single pile of HR paperwork is where programs go wrong.

I-9 and E-Verify Records

The I-9 is the most audited employment document in the federal contractor space. Under 8 U.S.C. 1324a, employers must retain a completed I-9 for each employee for the later of: three years from the date of hire, or one year after the date employment ends. That formula means a long-tenured employee's I-9 must be kept well past their last day. For a worker hired in 2018 and separated in 2025, the I-9 must be retained until 2026, not 2021.

E-Verify case results are separate. DHS does not mandate a specific private-sector retention period for E-Verify case details, but the USCIS M-274 Handbook for Employers strongly recommends retaining case results alongside the I-9 for the same period. If your organization operates under a Federal Acquisition Regulation (FAR) clause requiring E-Verify (FAR 52.222-54), your subcontracts and prime contract may impose additional recordkeeping obligations. Read the clause, not just the handbook.

Storage format matters. I-9s may be stored on paper, electronically, or in a combination, but electronic storage must meet the standards in 8 C.F.R. 274a.2(f), including audit trail, quality assurance, and reasonable access controls. A scanned PDF sitting in an unindexed shared drive does not automatically satisfy those standards.

Offer Letters, Contractor Agreements, and Compensation Records

Offer letters and independent contractor agreements are employment and contract records. Under the Fair Labor Standards Act (FLSA), payroll and employment records must be kept for three years; records used to compute wages (timesheets, work schedules, piece-rate records) must be kept for two years. For federal contractors subject to the Davis-Bacon Act, Service Contract Act (SCA), or Walsh-Healey Act, the FAR and the Department of Labor impose a three-year retention period for payroll records and supporting documentation from the date of last entry.

Contractor agreements that define the scope of work, compensation structure, and IP ownership should be retained for the life of the contract plus any applicable statute of limitations for contract disputes. Under the Contract Disputes Act, the statute of limitations is six years from the date a claim accrues. Retaining agreements for at least six years after contract closeout is a defensible baseline.

Personnel Security Records: SF-85, SF-86, and Adjudication Files

Security clearance and suitability records are among the most sensitive documents in the onboarding package and among the most misunderstood from a retention standpoint. The SF-85 (Questionnaire for Non-Sensitive Positions) and SF-86 (Questionnaire for National Security Positions) are submitted to the government, not retained by the contractor in their original form. However, contractors often retain copies, supporting documents, and correspondence related to the investigation and adjudication process.

SEAD 3 (Security Executive Agent Directive 3) and agency-specific security policies govern how long contractors and their Facility Security Officers (FSOs) must retain personnel security records. NISPOM (32 C.F.R. Part 117) requires that contractors retain records related to personnel security determinations for a period consistent with agency direction, typically two years after the individual's access is terminated or the clearance is debriefed. FSOs should confirm retention periods with their cognizant security agency (CSA), as agency-specific supplements can extend these requirements.

Do not retain more of the SF-86 than your program requires. The form contains highly sensitive personal information. Retaining unnecessary copies creates both a privacy liability and a potential breach surface.

Electronic Signature Records

If your onboarding program uses electronic signatures for offer letters, NDAs, contractor agreements, or policy acknowledgments, ESIGN (15 U.S.C. 7001 et seq.) and UETA require that the electronic record be retained in a form that is accurate, accessible, and capable of being reproduced for all parties entitled to retain the contract. This is not just about keeping the signed PDF. It means retaining the audit trail: who signed, from what IP address or device, at what timestamp, and what version of the document was signed.

For federal contractor onboarding, where disputes over scope, compensation, or IP can surface years later, retaining the full e-signature audit trail for the life of the agreement plus six years is a reasonable and defensible standard. Confirm that your e-signature platform exports audit trail data in a format you control, not just a format accessible through the vendor's portal. Vendor lock-in on audit data is a real operational risk.

HSPD-12 and PIV Enrollment Records

Contractors working on federal facilities or systems may go through HSPD-12 enrollment, resulting in a PIV credential. PIV enrollment records, including identity proofing documentation and biographic data, are typically retained by the issuing agency or its designated card management system. Contractor HR teams generally do not retain PIV enrollment source documents, but they should retain evidence of the enrollment event (date, credential number, issuing agency) in the employee file for the duration of the contract plus two years, consistent with general personnel recordkeeping practice.

Building a Practical Retention Schedule

A workable retention schedule for federal contractor onboarding should map each document type to its governing authority, retention period, storage format requirement, and designated custodian. The table below summarizes the key categories:

• I-9 and E-Verify case results: Three years from hire or one year from separation, whichever is later. Electronic storage must meet 8 C.F.R. 274a.2(e) standards. Custodian: HR.
• Offer letters and contractor agreements: Life of contract plus six years. Custodian: HR and Contracts.
• Payroll and compensation records (FLSA/SCA/Davis-Bacon): Three years from date of last entry. Custodian: HR/Payroll.
• Personnel security records (SF-85/SF-86 related): Two years after access termination or per CSA direction. Custodian: FSO.
• E-signature audit trails: Life of agreement plus six years. Custodian: HR/Legal, with exported audit data in a non-vendor-dependent format.
• PIV enrollment evidence: Duration of contract plus two years. Custodian: HR or Security.

Common Failure Modes

Three patterns account for most retention failures in contractor onboarding programs. First, no defined destruction schedule: records are kept indefinitely, which creates privacy liability and storage cost without adding compliance value. Second, format drift: paper originals are scanned but the originals are destroyed before confirming the electronic copy meets regulatory standards. Third, custodian ambiguity: HR assumes FSO is keeping security records; FSO assumes HR is keeping them. Neither is keeping them.

Assign a named custodian and a documented destruction date for every document category. Review the schedule annually and after any contract award that introduces new regulatory requirements.

Takeaway

Retention is not an archive problem. It is a compliance posture. The right documents, kept in the right format, for the right duration, with a named custodian and a destruction date, are what separate a defensible onboarding program from an audit liability. Start with the I-9 schedule, layer in your contract and security records, and document the whole thing before the next audit notice arrives.

If you are building or auditing your contractor onboarding documentation program, the team at IT Custom Solution can help you map requirements to your specific contract vehicles and agency relationships. Reach out for a brief consultation to talk through where your current process may have gaps.