Security Controls

This article continues the series covering the Self-Inspection Handbook For NISP Contractors and guidance found in the National Industrial Security Program Operating Manual (NISPOM) Incorporating Change 2. 

Prior to sending classified information via commercial carriers, the holder of the classified information should gain approval of the intent to ship and the method of shipment.  Once the approval is gained, the shipper should properly prepare the product and coordinate the shipment with the government, shipper, and receiver.

Question:

Do your cleared employees understand their safeguarding responsibilities?

Answer:

NISPOM 5-100. General.

Contractors shall be responsible for safeguarding classified information in their custody or under their control. This includes classified material controls that govern procedures or capabilities that deny, deter, and detect any unauthorized attempt to gain access to classified information.

NISPOM Chapter 5 is a large section that attempts to provide information to protect classified information by format (written document, electronic document, hardware item, information system, etc.) and location (open storage, computer, in transit, at work, etc). Chapter 5 addresses protection of classified information during reception, storage, transmission, destruction, physical security, and more. This protection involves marking, physical security specifications, oral communication, access, hand carrying, need to know, and other measures to prevent unauthorized access.

While other NISP Handbook sections address format and location of classified information, Section Q focuses on controls that are in place to trace and account for classified information at the cleared facility. This safeguarding question addresses a theme that is undercurrent to the entire Chapter 5; the administrative and technical controls in place to document and detect status of classified information. Though some of these controls were covered in other NISP Handbook questions, they are re-visited here to demonstrate a specific security function.

The question again is general and will be further unpacked in in specific application as we work our way through Section Q. The point with this article is to explain the controls at a high level and dig deeper in consecutive articles. The cleared employees should understand how to answer the question in the context of information management system and perimeter controls available to ensure classified information is received, only authorized persons gain access, and any unauthorized attempts to gain access is detected.

Validation:

Policy and procedure in place that describe information management and perimeter controls

Employee acknowledgement of security training and understanding of classified material controls

Provide written authorization for hand carrier to transport classified information

Develop tracking system to ensure receipts are returned in a timely manner

Provide proof of hand carrier or escort briefing

Review and compare signatures of couriers who have attended training and briefings

Hand Carrying Classified Information and Multi-mode Travel

Traveling with classified information.

The other day as I traveled home from work I thought about my coffee pot. Did I turn it off? Am I sure it’s off? How do I know it’s off? The only way I was able to hold anxiety back is to recall my end of day process and determine with conviction that I had indeed turned it off.

Imagine how the anxiety increase if you can’t recall whether or not you secured the security container, removed classified information from the printer, or set alarms. Well, the dedicated security professional understands the need for process, procedure, and end of day check lists. Without these controls, many would have a hard time sleeping.

You may be able to recall news reports, security awareness training, briefings, or other notifications where someone has had unattended sensitive information stolen from their rooms, vehicles, or other location while in transit. These incidents are preventable with application of process and procedure.

This prior planning (processes and procedures) not only helps ensure classified information is protected during transport, but it gives assurance that once planned and rehearsed, it should work well during execution. Even with the many variables that could be faced during travel (weather, delays, re-routing, cancellations, etc.) the process can be tailored and applied with assurance of mission accomplishment.

This planning and rehearsal should be conducted with the mode of transportation in mind. The remainder of this article is from the book “DoD Security Clearance and Contracts Guidebook” and discusses how to protect classified information during travel.

Modes of Travel

Hundreds of thousands of tons of cargo travel our roads, rails, and airspace daily. America depends on transportation to get products to customers safely and on time. When products are lost or damaged, carrier insurance will reimburse either the shipper or receiver. However, there is no insurance for damage to national security. Classified items lost, stolen or exposed during shipment pose a threat. No matter how dependable a carrier’s track record, the government approver, sender, and hand carrier should do everything possible to transport classified information while mitigating any risk of loss or compromise.

The volume of material transported on any given day is staggering. Transportation by any means is reliable but not risk free. Vehicle accidents, traffic jams, break downs or any number of problems with land, air, rail and sea transportation can threaten the security of the classified product. Natural disasters and mechanical failure can cause delays in the reliable movement of items. Air travel also has inherent risks including: late gate departures and arrivals, crowded terminals, and maintenance problems significantly threaten the ability of an escort to keep a close eye on the cargo hold. Those escorting classified material via trains, over the road vehicles, and air carriers should be aware of inconsistencies or events during the shipment that could negatively impact the security of the item. When any event happens to cause an unscheduled delay, the escort should immediately notify the shipper.

Rail

When shipping classified information by train the escort should ride in the same car, keep the package under constant surveillance and remain vigilant during stops and layovers. Experienced travelers understand the frustrations involved when others have retrieved the wrong baggage. Escorts should ensure they maintain their receipts and watch their package to prevent such mistakes from occurring as well as other attempts to pilfer or steal. Shipping classified material in a separate car poses a more difficult challenge. Coordination with railroad employees will significantly reduce the challenges while helping to strengthen security. When freight cars and passenger cars are separated, the FSO should arrange with the railroad for the freight car to be positioned immediately in front of the escort’s car. The biggest threat occurs during stops. When time permits, escorts should leave the train at all stops and perform a physical inspection of the protective measures (seals, locks, etc) applied to the classified items on the shipment cars.

Highway

Overnight escorts should remain alert for security violations, theft, piracy, pilferage, hi-jacking, damage or other incidences that could jeopardize the shipment and compromise the classified information. Rest and overnight stops, regulated driving hours and refueling pose additional risks to the voyage. At every stop the escort should keep the vehicle in view and remains alert to threatening actions. Highly sensitive items, urgency and threat may require a carrier to provide enough escorts to work around the clock shifts.

Air

Airlines also offer unique challenges to transporting classified material. Air carriers are experienced in flying various types of cargo to worldwide locations. Federal marshals fly prisoners, zoo keepers ship exotic animals, and doctors transport donor organs. Those transporting classified materials are also limited to the type of cargo the Federal Aviation Administration and the National Transportation Safety Board authorizes. Prior arrangements with the air carrier help them understand the unique requirements for shipping classified material and will better meet the requests of the consignor.

Passenger travel is a choreographed event. Passengers board when invited, remain in their seats during takeoff and landing and deplane when instructed. When transporting classified material, the escort should request boarding and deplaning services outside of normal operations.

When layovers are expected, the escort should be the first off the plane and wait in an area where they can observe activities on and around the cargo access door. If the cargo is transshipped using another airplane, the escort should observe the process. When the plane is ready to continue the journey the escort is again the last to board. Upon reaching the final destination, the escort becomes the first to deplane.

Cleared employees traveling by commercial aircraft should conduct extensive pre planning. In addition to identification, a courier briefing, and notification to maintain accountability of the classified material at all times, should be coordinated with the Transportation Security Administration (TSA). For example, while traveling by automobile, the courier may only need to drive to the final destination without having to speak to anyone. The route is often direct to the destination with no interruptions. However more vigilance is needed when traveling to and through an airport terminal.

Prior to a cleared employee traveling with classified information on commercial airlines the FSOs should coordinate with the TSA. TSA can help the courier or escort transition security with the least amount of interruption or intrusion for both the courier and TSA agents. TSA agents might examine the classified package with x-ray equipment.

Depending on the size of the airport, urgency and threat level, the arrangements and coordination made with TSA can help make negotiating through to the secure area easier. A good working relationship between the FSO and TSA helps both parties understand the importance of the courier remaining with the classified package at all times. When it is necessary to send the classified material through the x-ray machine, the courier must remain vigilant and know where the item is at all times.

 A risk based approach should be undertaken prior to sending classified information outside of secure facilities. Every effort should be made to plan the trip to protect classified information by format and location along the route. Plan for delays and interruptions in schedules as many travel issues are out of the travelers control. Training, planning, process, procedures, and rehearsal can provide safe travels and keep anxiety levels down.

Red Bike Publishing provides downloadable training and briefings that are helpful in managing security programs that protect classified information. You can find training and briefings that meet your need at our website.

This article is based on the book DoD Security Clearance and Contracts Handbook available at www.redbikepublishing.com

             

Hand Carrying Classified Information-Planning and Execution

This article continues the series covering the Self-Inspection Handbook For NISP Contractors and guidance found in the National Industrial Security Program Operating Manual (NISPOM) Incorporating Change 2. 

Prior to sending cleared employees to courier or escort classified material, the holder of the classified information should gain authorization. Classfied information should not leave the facilities without the authorization to do so, a complete inventory of the items to be removed, and the intent to protect it from unauthorized disclosure, loss, or theft.  

NISPOM 5-410. Use of Couriers, Hand Carriers, and Escorts. Contractors who designate cleared employees as couriers, hand carriers, and escorts shall ensure:

c. The employee retains classified material in his or her personal possession at all times. Arrangements shall be made in advance of departure for overnight storage at a U.S. Government installation or at a cleared contractor's facility that has appropriate storage capability, if needed.

d. If the classified material is being hand carried to a classified meeting or on a visit, an inventory of the material shall be made prior to departure. A copy of the inventory shall be carried by the employee. On the employee's return to the facility, an inventory shall be made of the material for which the employee was charged.

Question:

5-410

Is hand carrying of classified material outside the facility properly authorized, inventoried, and safeguarded during transmission?

Answer:

To help ensure that classified information is protected during shipment, the courier should understand their role and responsibility to protect classified information. The security manager, FSO, holder of classified information, Defense Security Services, and Government Contracting Activity should understand the mission, where the classified information exists, where it will go, the method of transportation, the route, and how it will be protected during transport, and secured once delivered. In this case, the classified information should be properly inventoried, wrapped, and hand carried by a fully briefed cleared employee. All parties should be involved in all phases of transporting classified information to include pre-trip, during transport, and after trip preparations.

Pre-Trip

Travel planning should include mode of travel, route to take, a travel plan to get there, and all necessary credentials for the cleared employee carrier. The involved parties might form a temporary planning team to discuss travel scenarios to prepare for and execute safe transport and protection of classified material. Prior to departure the planning team should also ensure that the classified package to be carried is inventoried and documented, receipted, provided written authorization is available and picture identification and credentials are on hand. A good practice is to issue a memorandum or other written authorization that identify the cleared employee the approved carrier.  

The credentials should be issued only after the cleared employee has acknowledged their understanding of their role and requirements along the way. Practice runs, hands on training or using experienced employees is a preferred way to prepare. Look for threat points and methods of tailoring the travel to protect items by their format, mode of travel, and location along the route. Such confidence, experience, and education help prevent security violations.

During Transport

Courier should adhere to the planned route and not make unnecessary deviations without coordination and approval. Where overnight or long term stops are required, they should be part of a plan with approved locations to store the classified information. The classified information must remain with the courier and should not be opened by unauthorized persons or contents discussed openly. The classified package should never to be left unattended and the courier should not allow themselves to be distracted from protecting the classified material.

If the trip involves an overnight stay, a stop should be scheduled during preparation and arrangements made for approved storage. Plans should also include what to do in case of emergencies, unintended layovers, vehicle breakdowns, or other unplanned events. This approved storage should be coordinated with the GCA or DSS. The courier should not store classified information in lockers, private homes, automobile trunks, hotel safes or other unauthorized areas.

After Trip

A government customer may require a defense contractor to attend a classified visit or meeting at another defense contractor’s cleared facility. The cleared facilities where the meeting occurs may authorize the courier to report directly to the meeting without additional processing. However, the courier should be prepared to introduce the classified information according to the cleared facility’s policies or per instruction from the government sponsor. Prior arrangements and coordination will prevent any delays or surprises.

The courier should expect the receiver to inventory the classified information, sign required receipts, and assume responsibility of the classified information. Once that is established, the courier’s job is complete and they are relieved of possession and responsibilities of protecting the classified information.

Once the courier returns, they should provide signed receipts and close out the travel action. This closeout might include a report of the trip to include any follow up for suspicious contact, incidents, or threats to the classified information.

Validation:

Document planning process with planning team

Provide written authorization for hand carrier to transport classified information

Develop tracking system to ensure receipts are returned in a timely manner

Provide proof of hand carrier or escort briefing

Review and compare signatures of couriers who have attended training and briefings

Red Bike Publishing provides downloadable training and briefings that are helpful in managing security programs that protect classified information. You can find training and briefings that meet your need at our website.

This article is based on the book DoD Security Clearance and Contracts Handbook available at www.redbikepublishing.com