Gather, integrate, and report insider threat information

This article addresses the NISPOM based Insider Threat Program (ITP) compliance requirements and is inspired by questions from the Self Inspection Handbook for NISP Contractors. The article uses the handbook’s format to through the self-inspection criteria. We begin the topic question, the NISPOM reference, an explanation of requirements, and finally how to inspect compliance.

Topic Question(s):

Does your program include a capability to gather, integrate, and report relevant and credible information, which falls into one of the 13 adjudicative guidelines indicative of a potential or actual insider threat?

 EVIDENCE: Explain process to gather and integrate data and provide procedures

VALIDATION:

NISPOM Reference(s):

1-202a

a. The contractor will establish and maintain an insider threat program that will gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 (reference (ac)) and the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs (reference (ad)), as required by the appropriate CSA.

One might ask the question of what is reportable as far as insider threat indicators. Aside from actually catching a culprit redhandedly sabotaging company resources or stealing government secrets, the employee is asked to report suspicious but credible observations. The Facility Security Officer (FSO) of the cleared defense contractor organization should develop a methodology for reporting insider threat behavior and training on how to recognize the behavior and then report it.

To do so, there is an existing methodology that leverages a current requirement. The “go to” for a resource for standardized process or policy of relevant and credible information is to follow the 13 Adjudicative Guidelines. Any one of these guidelines can serve as indicators of authorized employees with malicious intent.

A review of the available 13 Adjudicative Guidelines can provide data points for a risk manager to build upon. The guideline topics and a simple description of each topic are provided so that behaviors can be identified and if credible, reported to Insider Threat Program Senior Official.

Employees can be trained to observe certain behavior and recognize them as triggers for whether or not to report. When an employee observes credible high risk behavior they should understand who to and how to report it.

Her the 13 Adjudicative Guidelines that should be employed to recognize reportable behavior.

Guideline A: Allegiance to the U.S.

A cleared employee should demonstrate unquestionable allegiance to the United States. Any behavior or other indications of involvement in, training to commit, support of, or advocacy of any activity that demonstrates loyalty to other countries should be reported. Examples of behavior could include questionable internet searches, club memberships, or charitable donations to organizations with allegiance to other countries that would bring demise on the United States.

Guideline B: Foreign Influence Foreign contacts and interests may be a security concern if a cleared employee demonstrates divided loyalties or foreign financial interests. The concern is they may be influenced to help a foreign person, group, organization, or government in a way that is not in the U.S. interests. The cleared employee could also be vulnerable to pressure or coercion by any foreign interest.

Guideline C: Foreign Preference

Here the cleared employee could be demonstrating behavior that could serve the interests of a foreign person, group, organization, or government that is in conflict with the national security interest.

Guideline D: Sexual Behavior

A cleared employee could be engaged in sexual behavior that involves a criminal offense. Or the behavior could indicate a personality or emotional disorder, reflects lack of judgment or discretion, or which may subject the individual to undue influence or coercion, exploitation, or duress. If in violation of Guideline D, the behavior could raise questions about an individual's reliability, trustworthiness and ability to protect classified information.

Guideline E: Personal Conduct

This is a catch all behavior. Cleared employees demonstrating any personal conduct or concealing information about their conduct. Such behavior creates a vulnerability to exploitation, manipulation, or duress.

Guideline F: Financial Considerations

A cleared employee who is financially overextended could be at risk of having to engage in questionable behavior to improve their situation. This behavior could reflect the other Guidelines.

Guideline G: Alcohol Consumption (

This is one of the more obvious and easier to recognize in most situations. Alcohol-related incidents at work, such as reporting for work or duty in an intoxicated or impaired condition or drinking on the job.

Guideline H: Drug Involvement

The use of illegal drugs or misuse of prescription drugs can raise questions about an individual’s reliability and trustworthiness, both because drug use may impair judgment and because it raises questions about an individual’s willingness to comply with laws, rules, and regulations.

Guideline I: Psychological Conditions

Certain emotional, mental, and personality conditions can impair judgment, reliability, or trustworthiness.

Guideline J: Criminal Conduct

Criminal activity creates doubt about a person’s judgment, reliability, and trustworthiness and calls into question a person’s ability or willingness to comply with laws, rules, and regulations.

Guideline K: Handling Protected Information

This can be accidental, repetitive, as well as malicious. Any situation where a cleared employee mishandles classified information should be addressed per the investigative findings. Forgetful employees can be trained, but problem employees demonstrating repetitive offenses may lose their clearances. Insider threats with malicious intents could be reported to law enforcement.

This behavior can be demonstrated through a long list of NISPOM or ITAR violations such as loading, drafting, editing, modifying, storing, transmitting, or otherwise handling classified reports, data, or other information.

Guideline L: Outside Activities

Any foreign, domestic, or international organization or person engaged in analysis, discussion, or publication of material on intelligence, defense, foreign affairs, or protected technology organization that analyzes, discusses, or publishes material. This can be held in close regard with Guidelines A and B as well as others, depending on motivation.

Guideline M: Use of Information Technology

Cleared employees should handle classified information appropriately and Guideline K demonstrates activity that violates of NISPOM guidance. Here, use of any classified or unclassified information technology system to gain unauthorized access to information or a system. This includes hacking into servers, emails, networks or computers.

The next step is to develop a method of investigating and reporting the behavior. One scenario is that an employee reports suspicious activity to the FSO per earlier NISPOM guidance. The FSO could receive the report and begin an inquiry based on NISPOM requirements. However, with recent NISPOM updates the FSO can now engage the Insider Threat Team as part of that inquiry. Credible violations of the Guidelines can at the very least result in addressing the protection of classified information or be raised to another level of addressing potential insider threat issues.

Ideas to demonstrate compliance:

Develop a reporting process for receiving credible reports of suspicious behavior

Document reports and investigations

Document results of investigations

Create and deliver training to employees

Document training

Jeffrey W. Bennett, ISP is the owner of Red Bike Publishing Red Bike Publishing . He regularly consults, presents security training, and recommends export compliance and intellectual property protection countermeasures. He is an accomplished writer of non-fiction books, novels and periodicals. Jeff is an expert in security and has written many security books including: "Insider's Guide to Security Clearances" and "DoD Security Clearances and Contracts Guidebook", "ISP Certification-The Industrial Security Professional Exam Manual", and NISPOM/FSO Training".