Security Executive Blog

https://www.bennettinstitute.com/courses NISPOM Fundamentals Webinar Red Bike Publishing is now hosting a webinar with multiple installations. We used to host it at Udemy, but are hosting our own training. Take NISPOM Classes one chapter at a time Currently we have each of the NISPOM Chapters 1-8 available. Each lesson is 1 to 2.5 hour long consisting of lectures, presentations and graded quizzes. Soon I'll be loading the rest, but you can start training now. Or all at once as we have bundled these courses. We now have the NISPOM Fundamentals course ready to go. This course combines chapters 1-8 and is updated regularly with additional chapters and content. Register now and have access to all updates. As we update, we will be charging more depending on the amount of content. However, if you register now, this registration will include all future updates at no additional cost. The fundamentals of NISPOM is $350.00. However, for the next few days, we offer them for th...

NISPOM With Change 1 Available at www.RedBikePublishing.com Well, it’s here, just this side of six years after the release; Change 1 to the National Industrial Security Program Operating Manual. Over the recent three years there have been draft versions of NISPOM submitted, reviewed and resubmitted, but for the most part the NISPOM has remained unchanged. A testimony to an efficient product or policy? Could be. Too many higher level executive order and policy changes? Maybe. Though there has not been a major re-write or even revision, Change 1 does incorporate some important considerations, to include both domestic and international concerns. As programs and research efforts expand globally, Facility security officers (FSO) should know how to protect it in house and train cleared employees to do the same; this includes new markings and storage requirements. The major revision is in NISPOM Chapter 4, Classification Markings, Paragraph 1, Derivative Classification. Prima...

When an employee or potential employee is considered for a security clearance, the employer or sponsor requests a security clearance investigation. An investigation is performed to look into a person’s past and present to gather information. This information is evaluated to determine if the subject can be entrusted with sensitive information. CONFIDENTIAL and SECRET security clearances result in favorable determinations based on a National Agency Check with Law and Credit investigation and for TOP SECRET, the Single Scope Background Investigation. The security clearance request process is finalized during the adjudication period. Here, decisions are made whether or not to grant a clearance based on investigation results as related to the whole person concept and in the best interest of  national  security. The adjudicator evaluates results to determine whether or not an applicant is suited to protect classified information. There are 13 categories of behavior that c...

Gates and guards seem to be the back stop of most security efforts. However, without a real risk or security assessment, these efforts only go so far. Many Facility Security Officers (FSO) and cleared employees work within the walls of impenetrable fortress like structures. These reinforced security bunkers are built to withstand repeated break in attempts as well as maintain state of the art alarms, close circuit television cameras, and card readers that can resist and detect most types of intrusion, but… …when was the last time you’ve read of an intruder breaking into a cleared facility and cracking a security container to run off with secrets? What do DSS, security educators and security practitioners preach as the biggest threat? Sensitive information available in the public sector, trusted employees transferring technical data to adversaries through seminars, emails, or just walking out of secure facilities with it. Without addressing the real threat, the security commun...

The granted security clearance is part of a continuing evaluation process. Once a security clearance is granted the cleared employee will be periodically reevaluated and reinvestigated if the clearance is to remain in effect. When cleared employees require access to classified material beyond the scope of the initial investigation, the facility security office will submit a request for a Periodic Reinvestigation (PR). The adjudicator makes decisions concerning whether or not the subject’s allegiance is still to the United States, they can still be trusted to protect classified information and they will still be able to carry out their duties at all times. The PR for the TOP SECRET clearance is the same level of investigation as was initially conducted. The SSBI-PR is conducted every 5 years as needed. For SECRET, the NACLC is conducted every 10 years and for CONFIDENTIAL the NACLC is conducted every 15 years. Part of the security education process emphasizes the importance of cont...

Cleared employees who perform on classified contracts should be able to recognize what is classified and know how to protect the classified material based on the markings provided. Classified information comes in many forms. Classified objects and products are marked on the top, bottom, sides, front and back. If the item is bulky, odd shaped or otherwise a size and configuration that makes mandatory marking difficult, the markings should be placed as clearly as possible to convey the proper classification level. Multiple page classified documents have many places reserved for classification markings. Additionally, the source of classification, reason for classification, and duration are applied to classified items. Derived classifications will have a statement indicating from where the classified information came. While working with classified items, cleared employees are responsible for challenging any classified information...

If you are a defence contractor, cleared contractor or cleared employee, try these questions. Want more, see http://www.redbikepublishing.com 1. The vice president of business development has just brought up the wonderful opportunity of selling an all weather capability the company produces for medical evacuation flights to a foreign owned company.  a. Suppose this item needs a license prior to export. Describe the first step an organization would take in consideration of a possible export. b. If the item is to be delivered to a foreign company just down the street, will export requirements still apply? 2. You are travelling as an authorized courier to deliver a package that contains classified information at the CONFIDENTIAL level. Upon arrival, the foreign government customs agent wants to take custody of the package. You present your credentials and attempt to talk her out of the idea. She informs you that as a representative of the foreign government, she is authorized to...

Our Newsletter Great Articles on Improtant NISPOM Topics: Clean Desk Policy Information Management Systems Reproducing Classified Information Upcoming Security Books Check the NISPOM newsletter Industrial Security Newsletter - iContact Community

Commerically available IMS use information technology to create a detailed database that helps FSOs track classified material through many dispositions from receipt, inventory requirements and final disposition. Some produce receipts, tie to a barcode scanner, report statistical data that can help determine use and much more. For example, if an inventory reveals missing classified information, the database can provide valuable information to help reconstruct the classified information’s history.   Databases can be tied to scanner software. Barcodes can be printed and applied to classified items for scanning. If an item is destroyed, shipped, filed, loaned or returned, it can be scanned and the status updated. These databases provide reports identifying when and where the barcode on the classified document was scanned and the last disposition. The FSO can use the technology to research dates, methods of receipt, contract number, assigned document number, assigned barcode, title, c...

Five Good Points to Consider In the Reproduction of Classified Information 1. Start at the beginning; establish controls to limit access to classified information. An Information management system, access control system or other means of controlling who accesses classified information, when they access it and what they do with it is the right place to start. 2. Establish policy controlling use of classified reproduction equipment. Copy machines, scanners and other reproduction equipment should be identified and designated for classified information reproduction. Additionally, all other enterprise equipment should be off limits to classified reproduction. 3. Control the use of unclassified reproduction equipment. This will help prevent security violations where authorized employees access classified information and copy it using public copiers, load them to unauthorized disks, fax them using unauthorized machines all in an effort to remove it from the company undetected. 4....

Now you can receive 10% payment by referring customers to Red Bike Publishing. Join our affiliates program and receive 10% of any product sold through the Red Bike Publishing online bookstore. Our products sell from $7.00 to $99.00. That means an earning potential of up to $9.00 for each item sold through our store. Why not enhance your website by offering quality security and compliance books through Red Bike Publishing. How?  1. Simply visit http://www.redbikepublishing.com/affiliates/ 2. Scroll to the bottom of the page and click the link in the yellow box that says “Click here to join Red bike Publishing's’ affiliate program” 3. Login or Register 4. Under “Manage Your Affiliate Account” click “Get Affiliate Code” 5. Select “Red Bike Publishing” as the merchant 6. Click the button “Get Affiliate Code” 7. Copy the link provided in the yellow box. 8. Add the link to your website. That's it...we hope to see you on our team.

The NISPOM  the Cleared Contractor's  Guide to Security Programs Potential for Security Clearance Required Jobs There are more than 12,000 cleared Department of Defense contractor facilities. Considering that organizations can have anywhere from one to thousands of cleared employees, the amount of employees performing classified work is in the hundreds of thousands. Positions requiring security clearances include scientists working on projects to janitorial services and repair providers. Some clearances are based on actually performing classified work or just being cleared to access an area to perform repairs or cleaning services. Even though a job may require a security clearance, an employee does not need a security clearance to apply for the job. The potential employee must only be eligible for the security clearance. Many frequently asked questions in the defense contractor field are from those who want to know how to get a security clearance so that they can app...

Industry Sponsored Certification Certification says a lot about a professional. This individual has dedicated personal time and has committed to intensive study to improve their skills on the required topics. Supervisors and managers may set a goal for employees to reach a level of experience or even challenge them to seek a certification. Employees who have achieved a professional certification have experienced preference in job hiring, retention and promotion. Though a certification does not guarantee an employee such benefits, it does demonstrate a few important qualities to their management. Primarily, those certified convey a commitment to the profession, investment in the enterprise, and a high level of experience and knowledge. Organizations that hire employees with certifications or encourage employees to become certified benefit from the experience. In many cases, employers pay for the certification exams and other fees related to the certification requirements. They reco...

Metrics are tools leaders use to assess the effectiveness of their programs. These metrics indicate success, failures or areas where significant improvement is needed. Metrics data is found in surveys, inspections, and reports and are pulled for the specific purpose of understanding where the program is. The other part is to understand where the organization should be and comparing it to the results. FSOs should make metrics development and use a top priority. Chief security officers, chief information officers and other executive level security managers understand how to read metrics and use them to focus with pinpoint intensity on directing their security programs within their companies. Security managers in lower positions can use the same skills to gain influence in their companies. Because of the nature of compliance with government regulations, the task may be easier for FSOs to accomplish. An FSO has readily available data to determine and communicate the effectiveness of ...

Working on classified projects may seem intimidating at first. Overtime, the work quickly becomes routine and perhaps mundane. The cleared employee can quickly go from being impressed with their responsibilities and alert in their actions to a more relaxed attitude. Soon the classified items and the markings can become invisible and ineffective. Many modern examples of security violations include cleared employees leaving classified information unattended at their desks, lunch rooms and other unsecure areas. Such actions have led to possible compromise as safes have even been left open and unattended or accidentally removed from a cleared facility with classified information still inside. Even security employees have left safes unattended and have misplaced classified materials. REMINDERS Though markings do relay intended information, they should not be the “stand alone” technique. Some industrial security specialists have added even more markings to already cluttered media hopin...

I’ve posted a few articles on risk assessment and using the risk assessment results to implement and direct a security program to protect classified information. I’ve even written about how risk assessment can help you determine whether or not you need alarms, cameras and other protective measures above what may be required of the NISPOM . However, what I have not written about is how to do a risk assessment. You might recall in earlier articles that I’ve emphasized the importance of finding out what the threats to classified information are to your particular organization. One of my concerns is that a lot of FSOs may financially commit their companies to expensive endeavors that may not even be required. Industry standards and common practices may almost seem like requirements. To some, it may be unheard of not to have alarms, cameras or access control systems (door magnets and card readers). However, these are not required in NISPOM (except for intrusion detection systems as identi...