Security Executive Blog

What is A Standard Practice Procedure (SPP)? According to NISPOM,   Appendix C an SPP is a "document prepared by a contractor that implements the applicable requirements of this manual for the contractor's operations and involvement with classified information at the contractor's facility."  In other words it's your process for applying the NISPOM as you conduct classified work as it applies to your unique operation. The SPP should be tailored to your specific organization. To be effective, it should reflect performance requirements on classified contracts as reflected in the statement of work, DD Forms 254 and security classification guides. Who should have an SPP? NISPOM 1-202 states that, "The contractor shall implement all applicable terms of this Manual at each of its cleared facilities. Written procedures shall be prepared when the FSO believes them to be necessary for effective implementation of this Manual or when the CSA determines ...

Several years ago I became aware of a situation where a defense contractor’s export compliance officer was approached by a business development manager about an opportunity. The business manager stated that the company was pursuing a contract with a foreign country to sell them an export regulated material. Though the material was clearly designed for military use, the business manager rationalized that the application was for civil and not military use. She rationalized that since the transaction would not be for defense application, the company should not need to seek an export license. Though there is guidance for what and how to export, many export issues are unique and may not be fully understood, until the export compliance officer asks the right questions and gets the full story. It’s not the intent of the transaction, but the technology, product or item being transferred. Recently a company was fined for violating an export law by shipping a controlled chemical. In an...

Gates and guards seem to be the back stop of most security efforts. However, without a real risk or security assessment, these efforts only go so far. Many Facility Security Officers (FSO) and cleared employees work within the walls of impenetrable fortress like structures. These reinforced security bunkers are built to withstand repeated break in attempts as well as maintain state of the art alarms, close circuit television cameras, and card readers that can resist and detect most types of intrusion, but… …when was the last time you’ve read of an intruder breaking into a cleared facility and cracking a security container to run off with secrets? What do DSS, security educators and security practitioners preach as the biggest threat? Sensitive information available in the public sector, trusted employees transferring technical data to adversaries through seminars, emails, or just walking out of secure facilities with it. Without addressing the real threat, the security commun...

The granted security clearance is part of a continuing evaluation process. Once a security clearance is granted the cleared employee will be periodically reevaluated and reinvestigated if the clearance is to remain in effect. When cleared employees require access to classified material beyond the scope of the initial investigation, the facility security office will submit a request for a Periodic Reinvestigation (PR). The adjudicator makes decisions concerning whether or not the subject’s allegiance is still to the United States, they can still be trusted to protect classified information and they will still be able to carry out their duties at all times. The PR for the TOP SECRET clearance is the same level of investigation as was initially conducted. The SSBI-PR is conducted every 5 years as needed. For SECRET, the NACLC is conducted every 10 years and for CONFIDENTIAL the NACLC is conducted every 15 years. Part of the security education process emphasizes the importance of cont...

Facility Security Officers (FSO) may find themselves addressing many types of security incidents. How would you handle the following? 1.  You are an FSO of a growing defense contractor. One of the executives approaches you about the need for more space to conduct classified work. He is agreeable to implementing your recommendation to use a restricted area and would like you to prepare a security briefing for his team. Prior to your briefing, you conduct the necessary research. Describe the reason for a restricted area and when cleared employees would use a restricted area. Keep in mind access control and storage requirements. 2. You have just sat down to eat lunch and receive a phone call from a cleared employee. She tells you that the security container’s drawers are closed, but the dial on the combination lock has not been engaged. She explains further that according to the SF 702, the container had been locked and checked...

One thing an FSO just can't control is how long it takes the US Government to completely investigate, adjudicate and award a security clearance. These investigations rely on trained persons to research a persons background and another set of trained persons to make a decision on the findings. These professionals are charged with determining whether or not a person can be relied on to protect classified information from unauthorized disclosure. Returning or seeking clarification on submitted information is costly. As an  FSO, you can control one critical part of the process. Ensure the applicant fills out the SF86 forms accurately and completely. Any mistakes, omissions or embellishments can cause serious time delays. You can help the applicant understand the content and explain how to complete required forms. Here is great tool to help; the top 6 reasons security clearance decisions are delayed: 1.  Missing or illegible fingerprint cards. The cards must be provided to th...

Cleared employees who perform on classified contracts should be able to recognize what is classified and know how to protect the classified material based on the markings provided. Classified information comes in many forms. Classified objects and products are marked on the top, bottom, sides, front and back. If the item is bulky, odd shaped or otherwise a size and configuration that makes mandatory marking difficult, the markings should be placed as clearly as possible to convey the proper classification level. Multiple page classified documents have many places reserved for classification markings. Additionally, the source of classification, reason for classification, and duration are applied to classified items. Derived classifications will have a statement indicating from where the classified information came. While working with classified items, cleared employees are responsible for challenging any classified information...

Test your Knowledge with Problems From Chapter 6 DoD Security Clearance and Contracts Guidebook 1. As a document custodian, your responsibilities include receiving and inspecting documents for proper classification markings. You receive a properly wrapped classified document from a Government agency with the following characteristics:         • Contains UNCLASSIFIED, CONFIDENTIAL and SECRET information      • Created on June 21, 2007      • Reason for Classification is 1.4 (a)      • Contains 400 pages      • Classified by: Jon Wain, RBP, 1022 DDMA      • Classification guidance is found in the Gravy Security Classification Guide 1a. Based on the above description, what are the major areas you would expect to see classification markings? 1b. Write out the “By:” line describing who classified the material, reason for classification and the decla...

Experience, commitment and practice are the best qualities to prepare the professional for the necessity of good old fashion networking. Networking is especially necessary in high trust and vulnerability industries like security where peers, colleagues and co-workers closely guard information. A career in security is rewarding and challenging. The work is important, cleared contractor employers count on FSO skills to maintain classified contracts and national security depends on proper protection of classified information. The security professional requires a high degree of interaction as paths cross in training, collaboration or through contractual execution. Security professionals are traditionally somewhat guarded discussing business with new or otherwise unknown persons. Security professionals require time to develop trusting working relationships and getting to know important connections in a timely manner is important. So, how do we accelerate this networking curve? 1. Fost...

Experience, commitment and practice are the best qualities to prepare the professional for the necessity of good old fashion networking. Networking is especially necessary in high trust and vulnerability industries like security where peers, colleagues and co-workers closely guard information. A career in security is rewarding and challenging. The work is important, cleared contractor employers count on FSO skills to maintain classified contracts and national security depends on proper protection of classified information. The security professional requires a high degree of interaction as paths cross in training, collaboration or through contractual execution. Security professionals are traditionally somewhat guarded discussing business with new or otherwise unknown persons. Security professionals require time to develop trusting working relationships and getting to know important connections in a timely manner is important. So, how do we accelerate this networking curve? 1. Fost...

As a Facility Security Officer, you take the lead in creating a security program designed to protect classified information. You are at the cutting edge of your cleared contractor organization's capability of getting and keeping classified contracts. As such, you should also be the senior executive's right hand and have successfully established the required relationship to provide sage security council. Some topics relevant to your organization might be: Where are we heading? What type of classified storage might this require? What will be the cost and impact to the company? How is my security program poised to support current and new contracts? If a new or existing contract requires dedicated space to perform on and store classified information, a "Closed Area" may be required. A closed area is used to safeguard classified material of unusual "size, nature, or operational necessity, and cannot be adequately protected by the normal safeguards or stored during n...

Dear FSO, I was wondering if you could have your folks move my desk for me. The executive assistant recommended that I contact you since you are the "facilities officer".  ***** Move M. Emuch Dear Move, Chapter three of the NISPOM lists training requirements that all cleared employees must take. The FSO's challenge is to ensure that the cleared employees understand their requirements, understand the training, implement what they learned and of course sign the training record. When you invest in security training your employees will benefit. Required training topics include NISPOM requirements:   Threat Awareness Defensive Training (foreign travel briefing) Overview of the Security Classification System Employee Reporting Obligations and Requirements Security Procedures and Duties Applicable to the Employee’s Job Marking Classified Material Safeguarding Classified Material Control and Accountability Storage and equipment Transmission Origina...

There is a lot of debate about professional certification. Currently, the drive and motivation for facility security officers (FSO) and security specialists to become Industrial Security Professional (ISP) certified is still determined by them. There are few real requirements for security professionals to devote time, money and other valuable resource necessary to getting the ISP certification. NCMS is performing the monumental task of creating a credible and viable certification program, but the industry as a whole does not seem to buy in to the benefits. There are few job announcements and job positions that actually require the ISP Certification. The Department of Defense has not recognized the ISP certification as a requirement, but has instead created a certification for their security employees called Security Professional Education Development Program (SPeD) (pronounced speed). Some agencies do require the CISSP, but none have specifically called out the ISP Certification. Sinc...

     “I’d like you to move my desk from the window to the inside wall. I keep getting a glare on my computer screen.” Our friendly executive assistant said to me.       “Wow, thanks for the vote of confidence. However, I’m not as strong as I look and don’t think I should tackle that project alone. Have you sent a request to facilities?” I replied.      “Well that’s what I thought I was doing. Aren’t you the Facility Officer?”       That was a humbling but eye opening experience from my first three months on the job as a Facility Security Officer (FSO) at a small cleared defense contractor. At the time, we only had one contract and very little classified work. However, as small as we were I still had to establish a security system to protect classified information. A major part of the job was institutionalizing my position so that everyone understood the role of the FSO .      I wasn’t above helping. Sometimes eve...

     The risk assessment helps FSOs focus countermeasures to protect classified information from actual identifiable threats by probability. Risk management helps the FSO determine how to protect the classified information above and beyond the NISPO M guidance. The same approach should be used in determining which parts of the NISPOM apply to an FSO’s facility. For example, a non possessing facility that performs classified work at another facility should not focus security efforts on protecting classified processing.                 However, they should focus their efforts on NISPOM chapters 1, 2, 3 and 6 parts of chapter 5 and Appendices A and C; the parts of NISPOM that apply to ALL cleared contractors.       The NISPOM’s first chapter is dedicated to general industrial security concerns. The chapter is divided into three sections which provide the introduction, general and reporting requirements.    ...

If you are a defence contractor, cleared contractor or cleared employee, try these questions. Want more, see http://www.redbikepublishing.com 1. The vice president of business development has just brought up the wonderful opportunity of selling an all weather capability the company produces for medical evacuation flights to a foreign owned company.  a. Suppose this item needs a license prior to export. Describe the first step an organization would take in consideration of a possible export. b. If the item is to be delivered to a foreign company just down the street, will export requirements still apply? 2. You are travelling as an authorized courier to deliver a package that contains classified information at the CONFIDENTIAL level. Upon arrival, the foreign government customs agent wants to take custody of the package. You present your credentials and attempt to talk her out of the idea. She informs you that as a representative of the foreign government, she is authorized to...

The defense industry is booming and cleared contractors are benefiting. Those who know how to execute classified contracts are in demand. Additionally, the Departments of Defense, Department of Energy, the Nuclear Regulatory Commission, Central Intelligence Agency and many other Federal and supporting contractors are in great need of experienced and qualified security specialists, managers and Facility Security Officers. As the industry becomes more demanding and positions more competitive, today’s security specialists need to be on top of their game. Go beyond the Presidential Executive Orders and the National Industrial Security Program Operating Manual. Being technically proficient is great, but building an award winning security program gets you noticed. Make the move from being an administrator to becoming the "go to" security manager. Learn everything you can to better understand what it takes to get security clearances and move to the next step of protecting classif...

Commerically available IMS use information technology to create a detailed database that helps FSOs track classified material through many dispositions from receipt, inventory requirements and final disposition. Some produce receipts, tie to a barcode scanner, report statistical data that can help determine use and much more. For example, if an inventory reveals missing classified information, the database can provide valuable information to help reconstruct the classified information’s history.   Databases can be tied to scanner software. Barcodes can be printed and applied to classified items for scanning. If an item is destroyed, shipped, filed, loaned or returned, it can be scanned and the status updated. These databases provide reports identifying when and where the barcode on the classified document was scanned and the last disposition. The FSO can use the technology to research dates, methods of receipt, contract number, assigned document number, assigned barcode, title, c...

  Excerpt From Our Newest Book  Becoming a cleared defense contractor demands more than just a defense contractor getting a security clearance. It's more to do with, what to do once the clearance is awarded; specifically, protecting classified information. This protection involves physical, classified processing, and information security. It's more than just buying safes, installing access controls and getting employees security clearances. Primarily, the cleared contractor must appoint a Facility Security Officer (FSO) responsible for implementing a program to protect classified information. To better answer frequently asked questions, I've written several times on the topic of selecting the right Facility Security Officer (FSO) qualifications. According to the National Industrial Security Program Operating Manual (NISPOM), the FSO must be a US Citizen and be cleared to the level of the facility (security) clearance (FCL); period. This provides a lot of room ...

Now you can receive 10% payment by referring customers to Red Bike Publishing. Join our affiliates program and receive 10% of any product sold through the Red Bike Publishing online bookstore. Our products sell from $7.00 to $99.00. That means an earning potential of up to $9.00 for each item sold through our store. Why not enhance your website by offering quality security and compliance books through Red Bike Publishing. How?  1. Simply visit http://www.redbikepublishing.com/affiliates/ 2. Scroll to the bottom of the page and click the link in the yellow box that says “Click here to join Red bike Publishing's’ affiliate program” 3. Login or Register 4. Under “Manage Your Affiliate Account” click “Get Affiliate Code” 5. Select “Red Bike Publishing” as the merchant 6. Click the button “Get Affiliate Code” 7. Copy the link provided in the yellow box. 8. Add the link to your website. That's it...we hope to see you on our team.