Security Executive Blog

  Cleared Defense Contractors use classified information during performance of contracts. The Department of Defense makes the rules and governs how the classified contractors protect classified material. The Federal Government has published a policy appropriately titled: The National Industrial Security Program Operating Manual ( NISPOM ). This page turner is sponsored by the Presidential Executive Order (E0)12829 for the protection of information classified under E.O. 12958, As Amended. Having poured over both publications and the updates, I can confidently assure you that they take this business very seriously.     When specific work declares performance objectives on classified efforts, provisions of the applicable DD Form 254 and Security Classification Guide (SCG) shall govern. Both the DD 254 and SCG spell out what specific work a contractor can and cannot perform, what exactly is classified and how to protect it. Both of these document...

A buzz is sweeping the security community since the industry has been notified of the recent updates to DoD's CUI program based on the presidential memorandum with the subject,  Designation and sharing of Controlled Unclassified Information (CUI) . This memorandum implements a program designed to encourage the speedy sharing of information to those authorized and to better protect the information, privacy and legal rights of Americans. The CUI program is designed to promote proper safeguarding and dissemination of unclassified information.       Many readers may be familiar with the program CUI has replaced. Sensitive But Unclassified (SBU) information had enjoyed protection to a certain level but was not conducive to the necessary information sharing. Controlled Unclassified Information (CUI) directives provide procedures for a more appropriate Information Sharing Environment.     CUI is a designation of unclassified informati...

A Facility Security Officer (FSO) should put careful consideration into the security budget. This is a primary opportunity in the continuing plan of building credibility. The manager who arbitrarily throws in a number with meritless base is sending the wrong message. However, a well thought out line item count based on risk management, company mission and NISPOM requirements is more apt to impress and build instant respect. The budget contribution should enforce and support a message the FSO is constantly communicating. The budget request should not be first time executives are introduced to figures. Management support or lack of support of a security budget demonstrates either a well received or an unsupported security program. The intuitive FSO understands business, the company mission and how the role of protecting classified material fits. In that environment, the FSO provides a risk assessment based on the threat appraisal and speaks intelligently of the procedures, equipment and...

The Defense Industrial Security Clearance Office (DISCO) processes security clearances for organizations falling under the National Industrial Security Program ( NISP ). According to Executive Order 12968—Access to Classified Information, employees should not be granted access to classified information unless they possess a security clearance, have a need to know the classified information involved, received an initial security briefing and have signed a nondisclosure agreement. The Facility SecurityOfficer (FSO) is a position that the defense contractor must appoint during the Facility Clearance (FCL) approval process. The FSO implements a security program to protect classified in information. They also request investigations for employees who require a security clearance. What this means is, all cleared contractors must appoint an FSO. It could be the business owner in a small organization or an employee with an additional duty. The primary qualifications of an FSO are to be a US ...

Gates and guards seem to be the back stop of most security efforts. However, without a real risk or security assessment, these efforts only go so far. Many Facility Security Officers (FSO) and cleared employees work within the walls of impenetrable fortress like structures. These reinforced security bunkers are built to withstand repeated break in attempts as well as maintain state of the art alarms, close circuit television cameras, and card readers that can resist and detect most types of intrusion, but… …when was the last time you’ve read of an intruder breaking into a cleared facility and cracking a security container to run off with secrets? What do DSS, security educators and security practitioners preach as the biggest threat? Sensitive information available in the public sector, trusted employees transferring technical data to adversaries through seminars, emails, or just walking out of secure facilities with it. Without addressing the real threat, the security commun...

World class security programs under the National Industrial Security Program (NISP) are run by world class Facility Security Officers (FSO) who continually demonstrate their qualifications. It’s one thing to be good at your job, know the NISPOM well, be technically efficient and capable of personally validating security plans. An FSO should be capable of more than just a security clearance pipeline. It’s quite another to become recognized as a leader, recruit assistance company wide and become recognized for the good work.  In the second example, your efforts perpetuate themselves as others become force multipliers and quickly engage and support your mission. One way to ensure such success is to document your qualifications  through professional certification. Of itself certification is not the answer, but does complete the picture. For example, there are many leaders in the industrial security community who are very influential and well respected; their work stands al...

  The SF 328 is used by the contractor and the government to determine whether or not and to what extent the cleared contractor falls under Foreign Ownership Control and Influence (FOCI). The primary concern is always protecting classified information from unauthorized disclosure. As with determining the amount of control a company officer or board member has over classified contracts , the same holds true of foreign entitie s with which a company may become involved. In today’s changing world it is not unusual for a cleared company to be involved with international business. If classified contracts are under the control of a foreign entity, the classified information could be in jeopardy of unauthorized disclosure. If a contractor falls under FOCI, DSS will work with the GCA to evaluate the contractor’s ability to mitigate the extent of foreign influence concerning classified information and approve, deny or revoke the FCL. The SF 328 only has to be completed once unless cir...