Records Retention for Federal Contractor Onboarding Documents: What to Keep, How Long, and Why It Matters

The Decision That Surfaces at Audit Time

A contract ends, a worker separates, and eighteen months later a DOL investigator or contracting officer requests documentation from the onboarding file. At that moment, the question is not whether you should have kept the records. The question is whether you actually did, in a format that is retrievable and legally defensible. Federal contractor onboarding generates a surprisingly wide set of document types, each governed by a different retention clock, a different regulatory authority, and sometimes a different storage requirement. Getting those clocks wrong in either direction creates real exposure: destroy records too early and you cannot defend an audit; retain records too long and you accumulate unnecessary privacy liability.

This post maps the major document categories, the applicable retention rules, and the operational decisions that compliance teams and HR leads need to make before the next contract award or the next separation.

I-9 Employment Eligibility Verification

The I-9 is the most litigated onboarding document in federal contractor HR. Under 8 U.S.C. 1324a, employers must retain a completed I-9 for each employee for the later of: three years from the date of hire, or one year from the date employment ends. In practice, that means a long-tenure employee who works for eight years requires retention until nine years after hire. A short-tenure employee hired and separated within three years requires retention for the full three-year period from hire regardless of separation date.

Storage format matters. Paper I-9s must be kept in a way that allows production within three business days of an ICE or DOL request. Electronic storage is permitted under 8 C.F.R. 274a.2(e) through (f), but the system must produce a legible copy, include an audit trail of creation and changes, and allow for inspection. A scanned PDF sitting in an unindexed shared drive folder does not satisfy the audit trail requirement on its own.

Reverification entries on Section 3 do not restart the retention analysis. The I-9 retention period remains calculated from the original hire date (three years from hire or one year from separation, whichever is later), regardless of when reverification occurs.

E-Verify Records

E-Verify is mandatory for most federal contractors and subcontractors under FAR 52.222-54. The E-Verify Memorandum of Understanding (MOU) that each employer signs requires retention of E-Verify records for a minimum of three years from the date of the query or one year from the date of termination, whichever is later. This mirrors the I-9 floor but is a separate obligation. The case number, the result, and any Tentative Nonconfirmation (TNC) resolution documentation must all be preserved. Deleting E-Verify case records from your system before the retention window closes is an MOU violation independent of any I-9 issue.

Offer Letters and Contractor Agreements

Offer letters and independent contractor agreements are governed primarily by state contract law and federal employment statutes rather than a single uniform federal rule. The practical floor for most federal contractors is the longer of: the contract period of performance plus three years (to cover False Claims Act exposure), or the applicable state statute of limitations for contract claims (commonly three to six years depending on jurisdiction). For contracts subject to the Service Contract Act or Davis-Bacon Act, the Department of Labor requires payroll and employment records for three years from contract completion under 29 C.F.R. 4.6(j) and 29 C.F.R. 5.5(a)(3) respectively. Offer letters that establish pay rates, job classifications, and fringe benefit commitments are directly relevant to wage compliance audits and should be treated as part of that payroll record set.

Key-personnel designations in proposal submissions and contract modifications create an additional layer. If an individual was named as key personnel in an awarded contract, documentation of their qualifications, offer terms, and any substitution approvals should be retained for the life of the contract plus the applicable audit lookback period, typically three years post-closeout under FAR 4.703.

Security Clearance and HSPD-12 Onboarding Records

Personnel security records occupy a separate regulatory universe. The SF-86 (Questionnaire for National Security Positions) and related adjudication records are owned by the government, not the contractor. However, contractors are responsible for retaining their own internal records: visit authorization requests, facility access logs, fingerprint submission confirmations, and interim access approvals. NISPOM (32 C.F.R. Part 117) requires that access records be maintained for two years after access is terminated. Facility Security Officers (FSOs) should maintain a separate retention schedule for these records distinct from the general HR file.

PIV credential issuance records under HSPD-12 and FIPS 201 carry their own audit trail requirements. Agencies and their contractors operating PIV systems must retain identity proofing and enrollment records for the life of the credential plus six months, per NIST SP 800-79-2 guidance. If your firm manages PIV issuance on behalf of an agency, confirm those retention obligations are reflected in your contract and your document management system.

ESIGN and UETA Considerations for Electronic Onboarding Records

Most onboarding workflows have moved to electronic signature platforms. The Electronic Signatures in Global and National Commerce Act (ESIGN) and the Uniform Electronic Transactions Act (UETA) validate electronic records and signatures for most employment documents, but they impose a condition: the electronic record must be capable of retention and accurate reproduction for the period required by the underlying law. If your I-9 or offer letter is signed electronically, the platform must preserve not just the signed document but the audit log showing who signed, when, from what IP or device, and what version of the document was presented. A platform that purges audit logs on a rolling 90-day cycle while the underlying document has a three-year retention requirement creates a compliance gap even if the document itself is retained.

For federal contractors, Winrove, a product of IT Custom Solution LLC, supports subcontractor and key-personnel onboarding for awarded contracts, which means the document trail it generates sits squarely inside these retention obligations. Any electronic onboarding platform used in a federal contracting context should be evaluated against the audit trail and reproduction requirements of ESIGN before deployment.

Building a Retention Schedule That Holds Up

The operational problem is that most onboarding files contain documents from several of the categories above, each with a different clock. A practical retention schedule for federal contractor onboarding should map each document type to its governing authority, its retention trigger (hire date, separation date, contract closeout, or credential termination), and its minimum retention period. The schedule should also assign a destruction authorization step: someone must affirmatively confirm that no litigation hold, open audit, or active investigation prevents destruction before records are purged.

Common failure modes include: using a single flat retention period for all HR documents (typically five years, which is too short for some categories and unnecessarily long for others); failing to account for state law overlays in multi-state workforces; and treating electronic storage as automatically compliant without verifying audit trail preservation.

Takeaway

Retention compliance for onboarding records is not a single policy. It is a matrix of document types, regulatory authorities, and time triggers that must be mapped explicitly. Build the schedule before the audit request arrives, verify that your electronic systems preserve audit trails as well as documents, and assign clear ownership for destruction authorization. Those three steps eliminate most of the exposure that surfaces when investigators come looking.

If you are reviewing your onboarding document workflows for an upcoming contract award or compliance review, the team at IT Custom Solution LLC can help you assess gaps. Reach out through the contact page to start a brief conversation.