Security Executive Blog

Facility Security Officers (FSO) may find themselves addressing many types of security incidents. How would you handle the following? 1.  You are an FSO of a growing defense contractor. One of the executives approaches you about the need for more space to conduct classified work. He is agreeable to implementing your recommendation to use a restricted area and would like you to prepare a security briefing for his team. Prior to your briefing, you conduct the necessary research. Describe the reason for a restricted area and when cleared employees would use a restricted area. Keep in mind access control and storage requirements. 2. You have just sat down to eat lunch and receive a phone call from a cleared employee. She tells you that the security container’s drawers are closed, but the dial on the combination lock has not been engaged. She explains further that according to the SF 702, the container had been locked and checked...

Facility Security Officers (FSOs) wear many hats. Depending on the size of company and mission, they can be completely dedicated to security or serve as FSOs as one of many additional duties. Regardless of where their responsibilities lie, all FSOs should be very aware of NISPOM requirements . When it comes to training, FSOs should be able to effectively train cleared employees of these NISPOM and Contract Security Classification Specification (DD Form 254) requirements. Training requirements vary not only based on mission, but also depend on whether or not the facility is cleared as possessing or non-possessing. A possessing facility is authorized to store and work classified information in the cleared facility. A non-possessing facility cannot. Objectives of the FSO Program Management Course are to prepare the FSO to implement and direct a NISPOM based security program in their cleared contractor facility. DSS offers online courses to both possessing and non-possessing facilit...

Leaders at all levels can promote a better security environment and professionalism. Whether full time employees devoted to protecting national security or a VP of contracting, leaders set goals for their employees. Part of those goals should help help understand how to create incredible security programs. Focusing on training, interaction with other cleared employees, self-improvement and institutional education should be part of professional development. Those who write security evaluations for direct reports create goals to challenge them to become better at their jobs, more impactful in their careers and hopefully, groomed to become leaders themselves. Challenging employees and team members to achieve personal and professional goals breeds success. The ISP Certificatio n is one goal FSO's could take as a goal as well as encourage other employees to achieve for several reasons. 1. The employee gains from such education and a prestigious career milestone. 2. The defense co...

Classified information should only be reproduced in response to a contractual requirement such as in the performance of a deliverable. Reproduction should not be made as a matter of convenience as it puts classified information at unnecessary risk and it requires dedicated resources. The FSO can enforce resource discipline with: 1.  Creating processes and procedures identifying reproduction only as necessary and using only approved equipment 2. Ensuring only trained and authorized personnel are able to reproduce classified information. 3. Identifying office equipment, copy machines, scanners and other reproduction equipment for classified information reproduction. All other enterprise equipment should be off limits to classified reproduction. This can be accomplished through signs identifying authorized equipment as “Approved for Classified Production at the _______ level”. Other equipment would be identified as “Not au...

Training is increasingly important as those working in the National Industrial Security Program (NISP) employ security measures at cleared contractor facilities under the National Industrial Security Program Operating Manual ( NISPOM ). Challenges emerge as new technology provides increasing levels of difficulty while protecting classified information. The facility security officer (FSO) should foster an environment where training is encouraged and expected. Developing such relationships with cleared employees create an environment of cooperation. This environment facilitates the recruitment of all employees to protect national security. Those working in the enterprise can be the eyes, ears and muscle, acting as force multipliers, and extending the effectiveness of the security department. FSOs should conduct initial and refresher training and file reports as required by the NISPOM. Instead of conducting NISPOM training with compliance as the end goal, the training can be performed ...

Annual DSS Reviews as Metrics Inspections are typically conducted every 12 months for possessing and 18 months for non possessing facilities, but circumstances can require more or less frequent visits. DSS inspects the facility’s security program for the primary purposes of ensuring their programs provide the proper protection of classified information they are charged with protecting. Additionally, the inspection programs are designed to improve the effectiveness of the contractor’s security program. At the conclusion of the inspections, the contractor is given a rating ranging from unsatisfactory to superior:      • Unsatisfactory-indicates that the contractor has lost or is in the process of losing their ability to protect classified material.      • Marginal-indicates that a contractor is not meeting the requirements of NISPOM and has a substandard security program.      • Satisfactory-the m...

How do effective FSOs and security managers develop a culture of compliance with regulations and security programs? Quoting regulations only exasperates cleared employees and the very act does little to foster a climate of cooperation. However, developing relationships based on a good understanding of business, the company mission and influence goes a long way toward implement the successful security program. 1. FSO influences corporate culture-Security of classified information should be part of the organization's DNA. Instead of stove piping security functions, they should tie into the corporate mission. Though each office has a different product, funding or budget item, each fulfills their obligation in a chain of responsibilities necessary to get the product to market. When a business unit breaks down or fails to fulfill its mission, other business units are affected. 2. FSO performs a vital mission of protecting classified informa...

How do effective FSOs and security managers develop a culture of compliance with regulations and security programs? Quoting regulations only exasperates cleared employees and the very act does little to foster a climate of cooperation. However, developing relationships based on a good understanding of business, the company mission and influence goes a long way toward implement the successful security program. 1. FSO influences corporate culture-Security of classified information should be part of the organization's DNA. Instead of stove piping security functions, they should tie into the corporate mission. Though each office has a different product, funding or budget item, each fulfills their obligation in a chain of responsibilities necessary to get the product to market. When a business unit breaks down or fails to fulfill its mission, other business units are affected. 2. FSO performs a vital mission of protecting classified informa...

Category 2 of the NISP Enhancement covers Security Education: Internal Educational Brochures/Products. This focuses on the FSO providing security education to the entire employee population. This is in addition to security awareness training provided to cleared employees (employees with security clearances) required by NISPOM. What is the benefit of training cleared and uncleared employees? Uncleared employees can be the eyes and ears that are needed and add an additional layer of protection.   For example, cleared employees can be trained to recognize classified information. If a classified package is unattended, the cleared employee can be trained to recognize the sensitivity and report the incident to the FSO. Otherwise, they may take possession, read it, throw it away or otherwise cause compromise of classified information.   Here are some recommendations on how to provide that training:   CD/DVD-Defense Security Services, Interagency OPSEC Support Staff and ot...

The Facility Security Officer’s (FSO) successful program depends on developing relationships with employees, managers and executives to facilitate execution of company policies, necessary security awareness training, willful employee self-admittance of security infractions or change of status, and proactive action toward expired, existing and future classified contracts. Any of the above mentioned success measures is difficult to obtain in a changing employee and contract environment, but is simplified through employee and executive buy-in. How to do this: The following 3 points pave the way for a successful security program. 1. Gain executive, manager and work force buy-in. This can be accomplished by first demonstrating a sound understanding of company mission, classified contract requirements and providing sound security policy. Cross cultural buy-in is critical for integrating the security plan into all business units and company operations. 2. Become the “go to” person for...

These standard security forms are used in administering the security classification programs in Government. Industry members should contact their contracting agency for information on how to obtain these forms. The majority of these items are available through the General Services Administration's (GSA) Federal Supply System. Some of the forms are available online at the GSA web site or can be obtained by calling 1(800) 525-8027. *     SF-312 Classified Information Nondisclosure Agreement The SF-312 is a contractual agreement between the U.S. Government and a cleared employee that must be executed as a condition of access to classified information. By signing the SF-312, the cleared employee agrees never to disclose classified information to an unauthorized person. *     SF-700 Security Container Information The SF-700 is a form that contains vital information about the security container in which it is located. This information includes locatio...

Dear FSO, I was wondering if you could have your folks move my desk for me. The executive assistant recommended that I contact you since you are the "facilities officer".  ***** Move M. Emuch Dear Move, Chapter three of the NISPOM lists training requirements that all cleared employees must take. The FSO's challenge is to ensure that the cleared employees understand their requirements, understand the training, implement what they learned and of course sign the training record. When you invest in security training your employees will benefit. Required training topics include NISPOM requirements:   Threat Awareness Defensive Training (foreign travel briefing) Overview of the Security Classification System Employee Reporting Obligations and Requirements Security Procedures and Duties Applicable to the Employee’s Job Marking Classified Material Safeguarding Classified Material Control and Accountability Storage and equipment Transmission Origina...

Dear FSO, I was wondering if you were going to contribute to the coffee fund. I noticed that you were participating, but I need to sign you up. Coffee Joe, Dear Coffee, To have an effective security program it's important to have the organization buy into the security program from the top down. Having the most senior executive support and implement the security program into the entire company culture is key. The NISPOM also requires that the most senior officer of the company and the FSO to be cleared at the highest level of the facility clearance (FCL).

Cleared contractors are required to brief their cleared employees every year. It’s easy when there is a Facility Security Officer (FSO) on site. However, companies consisting of one to a few hundred employees may have FSOs designated in addition to regular duties. COOs, engineers, CFOs, HR and other professionals don’t have time to create and execute training while performing on contract. That’s where Red Bike Publishing can help. An FSO can spend several hours designing training. At $35.00 per manager work hour, that could end up costing at least $150.00, not including the costs associated with brining the FSO off a contract. Our low cost, high value training package allows you to concentrate on your core competencies while we provide your required training. Our  NISPOM Training  contains requirements for the Annual Security Awareness and Initial Security Training. Just download our slides and lead the discussion, the notes are already filled out a...

DoD Security Clearance and Contracts Guidebook — Red Bike Publishing Our Newest Book DoD Security Clearance and Contracts Guidebook - What DoD Contractors Need to Know about Their Need to Know Coming April-Pre-Order your copy now This new book will demystify the security clearance process and help cleared contractors develop security programs to win and keep classified contracts. It is a good companion for all seasoned and novice defense contractors, Facility Security Officers (FSO) and the college student. Defense contractors can confidently pursue classified contracts with: •Step by step guide demonstrating how to meet requirements for security clearances •Senior leader responsibilities in security cleared facilities •Classified contracts administrative responsibilities •Method for reducing costs associated with protecting classified information and NISPOM requirements •Description of exceptional (FSO) qualities Cleared contractors can protect program information th...

An Facility Security Officer (FSO)should put careful consideration into the security budget. This is a primary opportunity in the continuing plan of building credibility. The manager who arbitrarily throws in a number with meritless base is sending the wrong message. However, a well thought out line item count based on risk management, company mission and NISPOM requirements is more apt to impress and build instant respect. The budget contribution should enforce and support a message the FSO is constantly communicating. The budget request should not be first time executives are introduced to figures. Managements support or lack of support of a security budget demonstrates either a well received or an unsupported security program. The intuitive FSO understands business, the company mission and how the role of protecting classified material fits. In that environment, the FSO provides a risk assessment based on the threat appraisal and speaks intelligently of the procedures, e...