Security Executive Blog

A few times I've had a similar conversation with a few leaders in the security industry. They had been experiencing the same reaction from their enterprize leadership and were frustrated to the point of looking for another job. Their joint frustration revolved around a lack of support for their security vision. They could not seem to get past the barriers in perception that they did much more than request and manage security clearances and facilities. This may be a common issue facing many FSOs throughout the National Industrial Security Program cleared defense contractor base.  These issues could stem from from three possible challenges facing cleared defense contractor companies. The first is that the FSO has not developed a reputation of a corporate leader with effective strategies to ensure the organization is prepared to compete, win, and maintain classified contracts. The second is the cause of the first in that that the company has grown, and the original FSO may not posses...

Once a security clearance is granted, the Facility Security Officer (FSO) will contact you and several things will happen real fast. Primarily, if you have been sitting in a temporary position while awaiting your clearance, things are about to get real. The FSO will manage the security clearance under the umbrella of the cleared defense contractor’s oversight. This means that the FSO will  maintain the facility security clearance (FCL)  status administratively as well as meeting compliance requirements. They do this primarily training you and through that training, equipping you to protect classified information and perform work designated by the classified contract. Just as the FSO is certified or provided FSO training, you will also receive required training from the FSO. The FSO manages the clearances, training, classified workspace, etc. and documents the all actions for future reviews by the  Defense Counterintelligence Security Agency (DCSA) . ...

When an uncleared employee is hired to perform on classified contracts, the Facility Security Officer (FSO) requests a security clearance investigation. If a new employee already has an active security clearance, then the action is administrative; just a transfer. In the case of a security clearance request, the applicant completes and submits the SF-86 with the security officer’s assistance and the investigation begins. Next, the adjudicators apply the “whole person” concept to determine suitability and make a security clearance decision. The applicant has some control over the timeliness of the application and duration of investigation when they put in the effort to prepare ahead of time with all the references necessary to answer questions accurately and completely. Additionally they can also gather references that may help the adjudicators understand whether or not any derogatory information can be overcome. Any answers to the questions indicating a risk should be explained i...

Try these NISPOM based questions and see how you do. You may find some answers in the NISPOM, but some you might just have to think about. 1. TOP SECRET information can be transmitted by which of the following methods within the U.S. and its territories? a. Defense Courier Service, if authorized by GCA b. A courier cleared at the SECRET level c. By electrical means over FSO approved secured communication devices d. By government vehicle e. By U.S. Postal Service Registered Mail 2. SECRET information can be transmitted by which of the following means? a. Registered mail b. Cleared commercial carrier c. As designated in writing by GCA d. Commercial company approved by CSA e. All the above 3. Contractors who designate cleared employees as couriers shall ensure all EXCEPT: a. They are briefed on responsibilities to safeguard classified information b. They p...

Try these NISPOM based questions and see how you do. You may find some answers in the NISPOM, but some you might just have to think about. Whether  you are working on NISPOM training, FSO certification, or security awareness training, these questions can help.   Problems 1. You are an FSO of a growing defense contractor. One of the executives approaches you about the need for more space to conduct classified work. He is agreeable to implementing your recommendation to use a restricted area and would like you to prepare a security briefing for his team. Prior to your briefing, you conduct the necessary research. Describe the reason for a restricted area and when cleared employees would use a restricted area. Keep in mind access control and storage requirements. 2. You have just sat down to eat lunch and receive a phone call from a cleared employee. She tells you that the securi...

Social media is a great way to stay connected. Before social media, when the world was so big, we relied on letters and phone calls. These were time consuming endeavors to keep each other informed. If I went on a trip to Europe, I might be back stateside before friends and family ever receive my postcards. Now that we have social media, the world has shrunken significantly and it only takes moments to share information. And, we do that willingly. As we go forward with the topic of security clearances and social media, let’s leave the more direct investigation process behind for a moment and discuss the continuous evaluation, the Defense Security Services annual review, or other less direct, but just as impacting ways social media can effect a cleared employee’s security clearance. The continuous evaluation process is in place to ensure a cleared employee remains eligible for their clearance. Just think about how this system has been challenged as ineffective. Both military, gove...

It’s true, cleared defense contractors have uncleared employees. In larger organizations, these employees may work in shipping and receiving, maintenance, human resources and other non-program development areas. The organization should develop policy and training to incorporated into the procedures to protect classified information. How would an uncleared employee have access to classified information? Hopefully never, but mistakes happen when such instances are not identified. Cleared employees could possibly find unattended classified information, unlocked security containers or stumble into classified conversations. Sometimes classified information is delivered to the wrong recipient, absent minded cleared employees might leave classified information on a printer or in the common areas and cleared employees may have approved classified meetings but forget to verify clearance and need to know. Things happen and damage control as a last resort is all too prevalent in these situati...

The Self-Assessment Handbook for NISP Contractors provided by the Defense Security Services (DSS) provides an excellent way for a cleared defense contractor to prepare for the annual DSS inspection, form the enterprise self-inspection policy and assess the status of the organization's security plan to protect classified information. This is a great tool for many as it's probably the only way to measure aside from the inspection that counts. When I served in the Army , we had plenty of opportunities to assess our war fighting capability. One of those opportunities was provided by headquarters as an "assistance" visit. This usually preceded the much dreaded Inspector General (IG) inspections. These assistance visits were painful, but gladly received as we could have a "freebie" inspection before enduring the one that counted. My rule of thumb for these assistances visits was for everyone to do the proper work all the time. I never allowed any sol...

I spend a lot of time writing about the security clearance process and how to protect classified information. I write the security clearance process with the newly cleared or yet to be cleared defense contractors in mind. The latter, I write for established contractors as they maintain their classified contracts.  Though I’ve covered it in DoD Security Clearance and Contracts Guidebook , I’ve not yet published an article about what happens after you get the new facility security clearance (FCL.) Once the security clearance is awarded and you begin to work on classified information, your responsibility is to establish the security program and protect classified information the way you promised your government customer you would. Soon enough, your industrial security representative from Defense Security Services (DSS) will be by to verify those security practices. Preparation for the visit begins with understanding your responsibility to prepare the facility to safeguard ...

Derivative classification is a required training event. Defense contractors who use classified source material to generate a new product perform derivative classification. According to the National Industrial Security Program Operating Manual (NISPOM) all derivative classifiers must receive this training every two years. Contractor personnel make derivative classification decisions when they incorporate, paraphrase, restate, or generate in new form, information that is already classified; then mark the newly developed material consistently with the classification markings that apply to the source information. Derivative classification includes the classification of information based on guidance, which may be either a source document or classification guide. Order your training here: Derivative decisions are made through: Incorporating-Programs that assemble classified parts or use integration of classified processes assemble those already classified parts into a new classified  pr...

W hat has changed? According to NISPOM Change 1, the cleared defense contractor has the responsibility to provide training for cleared employees who make derivative classification decisions. Where   NISPOM   used to state that training is the FSO’s responsibility, Change 1 omits the FSO as the responsible party and identifies only the contractor entity. Mere oversight or purposeful instruction? This designation represents an important distinction. Now the FSO can strengthen their role in the enterprise and ship from administrator to leader. It is great opportunity for the FSO to shift the training responsibility from performance to oversight. Who should perform the training? At a technical level, the derivative classification training is best provided by the subject matter experts actually performing on   classified contracts , programs and projects. For example, an experienced FSO or designated trainer with a strong security background may be ...

Currently, there are a little over 13,000 cleared defense contractor facilities supporting classified contracts. These contracts range from services to providing products. Some perform security clearance and classified contracts work at the contractor location and others at customer locations. Some are authorized to store classified material at the locations, while others perform on classified work elsewhere. Each cleared defense contractor is as unique as the statement of work and  Contract Security Classification Specification ( DD Form 254) requirements. What doesn’t change is the requirement to protect classified information while performing. Many large and well known cleared facilities have centralized document control areas, open storage, rooms cleared for classified conversations, open storage, and large areas built especially for working on classified projects. In other words, their entire budget, success and capabilities are supported by infrastructure dedicated t...