Security Executive Blog

The term Cleared Defense Contractor ,might conjure images of large complexes, with a healthy security staff, plenty of closed areas, labs and conference rooms. However, there are many, many more contractors that are just a few employees with great ambition, drive and ideas. In some cases, smaller and less experienced defense contractors may not be as proficient in executing security responsibilities. Full time FSOs understand a little about the requirements of a DD Form 254 and how to protect ITAR controlled technical information. But, knowing how to interpret and apply the National Industrial Security Program Operating Manual ( NISPOM) let alone the Federal Acquisitions Regulation it is something that takes time. I travel to many defense contractors working on cutting edge research and development efforts. These defense contractors have been as large as thousands of employees and as small as three scientists in a converted school house. Think Apple in their garage years; state...

Going above and beyond requirements of NISP Enhancement Category 11 includes membership and attendance in Security Community Events. Enrollment and attendance in security community and professional organization events demonstrates contribution and growth. For inspection purposes, be sure to collect sign-in sheets, training handouts and more importantly demonstrate application of lessons learned to show proof of your involvement. Monthly lunch meetings, working groups and other opportunities are places where members of a similar community meet to learn or solve common problems. The National Industrial Security Program organizations include: Industrial Security Awareness Council (ISAC)  ISAC- ISAC is an informal, non-profit association of defense contractor, Defense Security Service, and Federal Bureau of Investigation personnel. It was formed to assist defense contractors in compliance with the National Industrial Security program and with the protection of classified and ...

Acronyms BL Bill of Lading CAGE Commercial and Government Entity CIA Central Intelligence Agency CM Configuration Management COMSEC Communications Security CSA Cognizant Security Agency CSO Cognizant Security Office DAA Designated Accrediting/Approving Authority DGR Designated Government Representative DNI Director of National Intelligence DoD Department of Defense DoE Department of Energy DSS Defense Security Service EAA Export Administration Act FBI Federal Bureau of Investigation FCL Facility (Security) Clearance FGI Foreign Government Information FOCI Foreign Ownership, Control or Influence FSO Facility Security Officer GCA Government Contracting Activity GSA General Services Administration IS Information System ISOO Information Security Oversight Office ISSM Information System Security Manager ISSO Information System Security Officer ITAR International Traffic in Arms Regulations LAA Limited Access Authorization MFO Multiple Facility Organization NACLC ...

Classified information should only be reproduced in response to a contractual requirement such as in the performance of a deliverable. Reproduction should not be made as a matter of convenience as it puts classified information at unnecessary risk and it requires dedicated resources. The FSO can enforce resource discipline with: 1.  Creating processes and procedures identifying reproduction only as necessary and using only approved equipment 2. Ensuring only trained and authorized personnel are able to reproduce classified information. 3. Identifying office equipment, copy machines, scanners and other reproduction equipment for classified information reproduction. All other enterprise equipment should be off limits to classified reproduction. This can be accomplished through signs identifying authorized equipment as “Approved for Classified Production at the _______ level”. Other equipment would be identified as “Not au...

The facility clearance is required to be in place prior to the contractor performing on classified work. After the GCA or prime contractor submits the sponsorship letter, the company can begin the process of applying for the clearance. A contractor has to meet five requirements before it can be processed for an FCL. • Be Sponsored • Sign Department of Defense Security Agreement • Complete a Certificate Pertaining to Foreign Interests • Provide Organization Credentials • Identify Key Management Personnel clearances Sponsorship-A company cannot apply for a security clearance for business development purposes or to be more competitive. The security clearanc e process begins with a need which is supported by a legitimate U.S. Government or foreign government requirement and the classified contract will be offered to meet that need. Department of Defense Security Agreement (DD Form 441)-A security agreement is signed between the US Gover...

Annual DSS Reviews as Metrics Inspections are typically conducted every 12 months for possessing and 18 months for non possessing facilities, but circumstances can require more or less frequent visits. DSS inspects the facility’s security program for the primary purposes of ensuring their programs provide the proper protection of classified information they are charged with protecting. Additionally, the inspection programs are designed to improve the effectiveness of the contractor’s security program. At the conclusion of the inspections, the contractor is given a rating ranging from unsatisfactory to superior:      • Unsatisfactory-indicates that the contractor has lost or is in the process of losing their ability to protect classified material.      • Marginal-indicates that a contractor is not meeting the requirements of NISPOM and has a substandard security program.      • Satisfactory-the m...

FSOs should understand more than just the technical aspects of administering a security program.  Understanding how to mark, safeguard and disseminate classified information is important. However, the FSO should reach beyond the description of implementing a security program to safeguard classified material. The position also requires: 1.  Assessing risks to the classified material 2.  Interpreting safeguarding requirements 3.  Communicating and incorporating a culture of compliance within the organization 4.  Projecting the impact of classified contracts on the enterprise. To do this, the FSO should possess the vision and skills to see where the security program needs to go, how to get there and encourage a security vision from the senior executive level downward. Without the proper influence, the FSO is may not be able to run a program to protect classified material Effective tools include: • Helping form...

1.  Influence at all levels-A key trait an FSO should demonstrate is the ability to work within organizational structures to gain executive, manager and work force cooperation. An FSO can train and write policy but without the enterprise’s full cooperation, will find it difficult to enforce. 2.  Integrate security at all levels-A well integrated security plan ensures that all business units within an enterprise notify the FSO of any change in disposition of cleared employees or classified contracts. This integrated system will trigger the contracts, program manager, business development and other units to coordinate with and keep the FSO informed of expired, current, and future contract opportunities and responsibilities. 3.  Be fiscally responsible-An important task that an FSO faces is the successful implementation of the security program while supporting the company’s primary mission; to make money while successfully performing on classified contracts. Security eff...

Category 3 of the NISP Enhancement covers Security Education: Information/Product Sharing Within the Community.  This focuses on the FSO providing security education peers and other FSOs outside of their organization. This is a security community event where contractors and government managers can learn from each other. Think Society of Industrial Security, American Society of Industrial Security, or other professional organization level event. Or it can be a smaller venue. Either way, involve others outside of your organization. This demonstrates contribution to the community, a pursuit of improving national security, and helps quantify going above and beyond. For example, an FSO uses their facility, creates an agenda and executes a security conference or training event. Or, committees can be formed to share the tasks. Education of this magnitude has tremendous value as the security community learns from experiences and examples of their peers and applies them at their own organ...

The Facility Security Officer’s (FSO) successful program depends on developing relationships with employees, managers and executives to facilitate execution of company policies, necessary security awareness training, willful employee self-admittance of security infractions or change of status, and proactive action toward expired, existing and future classified contracts. Any of the above mentioned success measures is difficult to obtain in a changing employee and contract environment, but is simplified through employee and executive buy-in. How to do this: The following 3 points pave the way for a successful security program. 1. Gain executive, manager and work force buy-in. This can be accomplished by first demonstrating a sound understanding of company mission, classified contract requirements and providing sound security policy. Cross cultural buy-in is critical for integrating the security plan into all business units and company operations. 2. Become the “go to” person for...

Take a look at the following dramatization. A Facility Security Officer (FSO) is engaged in an inquiry to determine whether or not a security violation led to the loss, compromise or suspected compromise of classified information. A cleared employee had left classified information out on his desk. A cleared employee asked another cleared employee to “keep an eye” on a classified document while she left for lunch. A short time later, the second employee was summoned to his bosses office to answer some questions. He left in a hurry, forgetting about the classified information on the desk. At first glance, the unattended classified information is the most obvious violation. However, once the inquiry concluded another issue became evident. The co-workers did not work on the same contract or share in any kind of project relationship. The first co-worker entrusted the safeguarding of classified information to an employee who held the proper security clearance, but who did not have need to kn...

Cleared contractors are required to brief their cleared employees every year. It’s easy when there is a Facility Security Officer (FSO) on site. However, companies consisting of one to a few hundred employees may have FSOs designated in addition to regular duties. COOs, engineers, CFOs, HR and other professionals don’t have time to create and execute training while performing on contract. That’s where Red Bike Publishing can help. An FSO can spend several hours designing training. At $35.00 per manager work hour, that could end up costing at least $150.00, not including the costs associated with brining the FSO off a contract. Our low cost, high value training package allows you to concentrate on your core competencies while we provide your required training. Our  NISPOM Training  contains requirements for the Annual Security Awareness and Initial Security Training. Just download our slides and lead the discussion, the notes are already filled out a...

The defense industry is booming and cleared contractors are benefiting. Those who know how to execute classified contracts are in demand. Additionally, the Departments of Defense, Department of Energy, the Nuclear Regulatory Commission, Central Intelligence Agency and many other Federal and supporting contractors are in great need of experienced and qualified security specialists, managers and Facility Security Officers. As the industry becomes more demanding and positions more competitive, today’s security specialists need to be on top of their game. Go beyond the Presidential Executive Orders and the National Industrial Security Program Operating Manual. Being technically proficient is great, but building an award winning security program gets you noticed. Make the move from being an administrator to becoming the "go to" security manager. Learn everything you can to better understand what it takes to get security clearances and move to the next step of protecting classif...

DoD Security Clearance and Contracts Guidebook — Red Bike Publishing Our Newest Book DoD Security Clearance and Contracts Guidebook - What DoD Contractors Need to Know about Their Need to Know Coming April-Pre-Order your copy now This new book will demystify the security clearance process and help cleared contractors develop security programs to win and keep classified contracts. It is a good companion for all seasoned and novice defense contractors, Facility Security Officers (FSO) and the college student. Defense contractors can confidently pursue classified contracts with: •Step by step guide demonstrating how to meet requirements for security clearances •Senior leader responsibilities in security cleared facilities •Classified contracts administrative responsibilities •Method for reducing costs associated with protecting classified information and NISPOM requirements •Description of exceptional (FSO) qualities Cleared contractors can protect program information th...

Red Bike Publishing's NISPOM Anytime an employee travels abroad, they should expect to be liberated from their computer at the host country's customs. They should also expect to have the hard drive duplicated, files read and etc. These are the contingencies for which astute technology control officers, export compliance officers and security specialists plan. Sensitive, and protected technology should not be contained within computer and related media without proper permissions. Foreign governments want US Technology and aggressively seek it and defense contractors should make the information very difficult to get. However, they may spend too many resources on actions that don't address the real threat. For example physical security efforts may focus on fortifying businesses with barriers, alarms, access control, cameras and etc. Risk assessments indicate that technology is leaked through careless or malicious employee behavior or actions taken due to poorly understoo...

Red Bike Publishing's ITAR Defense Contractors providing defense items or services have the tremendous responsibility of keeping the technology out of the wrong hands. As identified in the ITAR, unauthorized release of technical information can affect the US military's fighting capability. Licenses and agreements provide a checks and balances between the US Government and the US Company desiring to export the technology. The company identifies the technology and application and submits export requests to the State Department. The State Department reviews the application and further researches military application and how the export could affect national defense. Without such checks and balances, other countries could gain a technological advantage. Consider the GPS and night vision technology. No other nation has the abilities as the US does to operate at all times and in all weather. The US military's technological lead creates the ability to determine, where, when an...