Security Executive Blog

  The Facility Security Officer’s (FSO) successful program depends on developing relationships with employees, managers and executives to facilitate execution of company policies, necessary security awareness training, willful employee self-admittance of security infractions or change of status, and proactive action toward expired, existing and future classified contracts. Any of the above mentioned success measures is difficult to obtain in a changing employee and contract environment, but is simplified through employee and executive buy-in. How to do this: The following 3 points pave the way for a successful security program. 1. Gain executive, manager and work force buy-in. This can be accomplished by first demonstrating a sound understanding of company mission, classified contract requirements and providing sound security policy. Cross cultural buy-in is critical for integrating the security plan into all business units and company operations. 2. Become the “go to” person for a...

I've recently received many emails from people who are curious about security clearances and working for foreign owned companies. Though the volume of those questions have increased, I guess the topic is no longer surprising in content as it could have been many years ago. Many years ago, we might automatically assume that working for a foreign owned company would be indicative of highly questionable practices, but maybe not any longer.  Things have changed. More foreign owned companies are opening doors in the U.S. Internet opportunities open doors to employment. Working for foreign companies provides new opportunities regardless of boarders such as: investment, teleworking, and creative content services that allow artists to bid on customer jobs have made this more of a possibility.  But the questions have been pretty vague and hard to answer.  Am I allowed to work for a foreign company if I have a security clearance? Will I be able to get...

I catch myself watching fun Youtube videos. Some of my favorites are watching consumers open my favorite products and orienting me on how to use them. The unpacking causes excitement and the by item unpacking and layout of what to expect helps me understand my product better.  In the National Industrial Security Program Operating Manual ( NISPOM ), we have a similar package "reveal". Security specialists, document control professionals, facility security officers and others in possessing facilities may receive classified information, depending on the contract. Part of the receipt is the critical inspection of the package during the integration process.  As they unwrap the package, the inspector is orienting themselves to better understand what they should be receiving. This begins by inspecting the package physically, then comparing the contents with the receipt. They are also searching for evidence of tampering or to otherwise to inspect that there has been no compromise of ...

Facility Security Officers (FSOs) the security managers for cleared defense contractors, implement and direct security programs to protect classified information . As an FSO or a supporting security professional in this role, have you ever wondered how the classified information you protect gets its designation? We can find the answer in Presidential Executive Order 13292. You may have heard and read reports of how over-classification results in unnecessary costs. You might also understand from similar reports of how under-classification can lead to compromise of sensitive information. To better prevent unauthorized disclosure and ensure that classification is assigned to only that information needing protection, the President has issued special guidelines. In cases where items may be assigned an original classification, four conditions must be met:      An original classification authority (OCA) is classifying the information; Specifically, only the President a...

I receive a lot of emails from people who wonder how to get into the security field.  Many are looking for a career change and are curious about what kind of education and experience is needed to work as a security specialist in the defense and contractor industry.   Others are just starting out in life and looking for a job with challenges and opportunities the security field offers.   There are plenty of great opportunities in with large and small contractor companies providing the venue.  Here is what I have discovered about our industry and some of you may have other experiences and advice you can pass to those who ask about a career in security.       Industrial security is an outstanding field for someone with all ranges of experience to enter into.  Some have been hired at an entry level job and have received promotions and additional responsibilities.  Others have transferred full time to security after enjoying se...

Order your copies from www.redbikepublishing.com /itar A few years back I wrote an article referring to the practice random computer searches occurring as travelers returned to the United States from trips abroad. Now with technology improvements, time, and the shrinking of borders in this well-connected global economy, I thought it would be a great time to revisit the idea of, “what would an adversary with limited resources be able to exploit in our computers?” This is an important question to ask as cyber-attacks are becoming more common. Now an adversary on foreign lands can gather military or dual use technical information governed by the international Traffic in Arms Regulation (ITAR) and commercial information covered in the Export Administration Regulations (EAR). This cyber-attack activity should not be surprising to the well-educated security cleared employee. What may be surprising is the risk to protected sensitive information available on well-connected informatio...

The facility security officer should conduct an assessment of classified holdings to determine vulnerabilities, threats, and risk to classified information. This risk assessment is above and beyond what has been determined by the original classification authority (OCA) and as applies to the National Industrial Security Program Operating Manual (NISPOM). Where the OCA has determined classification level, the NISPOM provides guidance on how to protect the classified information.  The mission piece is the defense contractor and how they protect the classified information by format and location. It's not always good enough to rely on NISPOM requirements as the environment may dictate additional countermeasures. For example, SECRET and CONFIDENTIAL information can be approved for storage in a GSA approved container. However, if the defense contractor is in a high crime area, additional physical security measures may be necessary.  That's where the 6 step risk management pro...

This year is still new, but some expectations never change. One thing that you can expect to do is either undergo a self-inspection, a DSS review or both depending on the audit cycle. A DSS review could also be conducted in your facility when applying for a facility security clearance (FCL). Since the DSS review tests security countermeasures and makes determinations of vulnerability and preparedness, it's best to focus on these areas as you prepare for the visit. Begin with the self-inspection. Once you are set up with a security program, you what to know the status and help determine whether or not your security posture is where you expect it to be. In other words, are you able to protect classified information at the level required. Begin with a pre-inspection to plan out your actions. According to DSS, this can be conducted in six steps: 1) Identify all security elements that apply. Cleared facilities are either possessing or non-possessing. The common denominator is...

Why does everyone have to have the same training? Sure, every cleared employee receives the initial training and the annual refresher training , but do they have to be the same presentations? After all, we are not cut from the same cloth; we've got varying degrees of experience, right? New Employees, New Clearance Great questions and perhaps you have heard them from your employees. I know I have. In response, FSOs could consider dedicating more security awareness training to new employees who will have a security clearance for the first time. The rational is because they will be newly introduced to sensitive and classified government information under the National Industrial Security Program Operating Manual, they should learn the fundamentals: The nature of classified material and how to protect it Notice of their responsibilities to protect classified information and the consequences of unauthorized disclosure Recognizing and protecting U.S. and foreign government ...