Security Executive Blog

The term Cleared Defense Contractor ,might conjure images of large complexes, with a healthy security staff, plenty of closed areas, labs and conference rooms. However, there are many, many more contractors that are just a few employees with great ambition, drive and ideas. In some cases, smaller and less experienced defense contractors may not be as proficient in executing security responsibilities. Full time FSOs understand a little about the requirements of a DD Form 254 and how to protect ITAR controlled technical information. But, knowing how to interpret and apply the National Industrial Security Program Operating Manual ( NISPOM) let alone the Federal Acquisitions Regulation it is something that takes time. I travel to many defense contractors working on cutting edge research and development efforts. These defense contractors have been as large as thousands of employees and as small as three scientists in a converted school house. Think Apple in their garage years; state...

One thing an FSO just can't control is how long it takes the US Government to completely investigate, adjudicate and award a security clearance. These investigations rely on trained persons to research a persons background and another set of trained persons to make a decision on the findings. These professionals are charged with determining whether or not a person can be relied on to protect classified information from unauthorized disclosure. Returning or seeking clarification on submitted information is costly. As an  FSO, you can control one critical part of the process. Ensure the applicant fills out the SF86 forms accurately and completely. Any mistakes, omissions or embellishments can cause serious time delays. You can help the applicant understand the content and explain how to complete required forms. Here is great tool to help; the top 6 reasons security clearance decisions are delayed: 1.  Missing or illegible fingerprint cards. The cards must be provided to th...

So, which companies will win the Cogswell Award this year? FSOs who take the time to develop a world class program designed to protect classified information are very deserving of the award. Here are four proven steps to help you demonstrate that your organization is going “above and beyond” NISPOM requirements: 1. Set security goals that everyone understands. These goals help create the organization-wide security culture that everyone can live with. 2.   Conduct institutional training that support these goals. Ensure the training encourages your employees to report any and all security violations, suspicious contacts, and foreign travel, which will further enhance those efforts. 3. Goals should be tracked and institutional training and expectations should be conducted   in preparation for the annual security inspection. Do this by implementing a daily security management process, which includes physical security, visitor control, and security education throughout the ye...

The FSO should ensure all arriving classified information is inspected and received into accountability. This due diligence is conducted to ensure that classified information has not been compromised, is related to a contract, and is properly marked. Regardless of transmission methods of physical items (mail, courier, overnight, hand carry and etc.) classified material should be double wrapped. Each layer serves to protect the classified material from inadvertent and unauthorized disclosure and should be properly addressed. The classified information should be wrapped and sealed in opaque material or envelopes. The NISPOM does not cover seams of wrapped items, but a good practice is to cover seams with rip-proof opaque tape or other material that prevents and detects tampering. All seams of the outer layer should be sealed with opaque tape in an effort to create a solid layer of covering. The item should be wrapped and sealed wit...

How do effective FSOs and security managers develop a culture of compliance with regulations and security programs? Quoting regulations only exasperates cleared employees and the very act does little to foster a climate of cooperation. However, developing relationships based on a good understanding of business, the company mission and influence goes a long way toward implement the successful security program. 1. FSO influences corporate culture-Security of classified information should be part of the organization's DNA. Instead of stove piping security functions, they should tie into the corporate mission. Though each office has a different product, funding or budget item, each fulfills their obligation in a chain of responsibilities necessary to get the product to market. When a business unit breaks down or fails to fulfill its mission, other business units are affected. 2. FSO performs a vital mission of protecting classified informa...

How do effective FSOs and security managers develop a culture of compliance with regulations and security programs? Quoting regulations only exasperates cleared employees and the very act does little to foster a climate of cooperation. However, developing relationships based on a good understanding of business, the company mission and influence goes a long way toward implement the successful security program. 1. FSO influences corporate culture-Security of classified information should be part of the organization's DNA. Instead of stove piping security functions, they should tie into the corporate mission. Though each office has a different product, funding or budget item, each fulfills their obligation in a chain of responsibilities necessary to get the product to market. When a business unit breaks down or fails to fulfill its mission, other business units are affected. 2. FSO performs a vital mission of protecting classified informa...

The Cleared Contractor appoints a Facility Security Officer (FSO) to protect the work on classified contracts and provide important administrative functions to maintain the security clearanc e of the business and cleared employees. However, the FSO can be much more impacting by applying understanding of four important functions: 1.  How to protect classified information as it relates to the cleared contract, organizational growth, enterprise goals, and NISPOM guidance 2.  How to conduct a risk analysis 3.  Demonstrate cost, benefits and impact of supporting a classified contract under the NISPOM requirements and sustain an environment of cooperation and compliance within the enterprise. 4.  Influence and compel the senior leaders to make good decisions, support compliance and integrate security into the corporate culture. After all, good industrial security practices protect against damage to national security, but cou...

Category 7 of the NISP Enhancement is:  Counterintelligence Integration/Cyber Security provides a tool that cleared contractors can use to demonstrate exceeding NISPOM requirements. Injecting this into the security program also enhances security by bringing to light types and frequency of suspicious contacts. 1.       The purposeful execution of Foreign travel pre-briefings-When employees travel to a foreign country, they may be targeted to provide sensitive information. A threat and/or defensive briefing should be provided to all cleared employees per NISPOM Chapter 3 ( NISPOM Training ). The briefings should be documented with signatures, dates and contents of briefings for presentation to Defense Security Services (DSS) industrial security representatives. 2.     Conducting debriefings once the employees return from foreign travel. It is a tool to follow-up with the threat or defensive security briefing presented prior to the foreign tra...

1.  Influence at all levels-A key trait an FSO should demonstrate is the ability to work within organizational structures to gain executive, manager and work force cooperation. An FSO can train and write policy but without the enterprise’s full cooperation, will find it difficult to enforce. 2.  Integrate security at all levels-A well integrated security plan ensures that all business units within an enterprise notify the FSO of any change in disposition of cleared employees or classified contracts. This integrated system will trigger the contracts, program manager, business development and other units to coordinate with and keep the FSO informed of expired, current, and future contract opportunities and responsibilities. 3.  Be fiscally responsible-An important task that an FSO faces is the successful implementation of the security program while supporting the company’s primary mission; to make money while successfully performing on classified contracts. Security eff...

National Industrial Security Program (NISP) Enhancement Category 6 is: Classified Material Controls/Physical Security. DSS can quantify a cleared contractor’s ability to track classified information throughout its lifecycle, implement countermeasures to deny access to sensitive information, and provide accountability of all classified information through this process. The FSO’s ability to demonstrate such capability is impactful and can help DSS determine whether or not the cleared facility is going “above and beyond NISPOM requirements.  Below are three ways an FSO can demonstrate going above and beyond the NISPOM requirements: 1.  Track location and disposition of classified information-This can be done on the cheap or with a decent Information Management System (IMS) such as software provided by vendors like SIMSSoftware . The point is for the FSO to not only know what they know about classified information moving within and without of the cleared facility, but to also de...

Category 3 of the NISP Enhancement covers Security Education: Information/Product Sharing Within the Community.  This focuses on the FSO providing security education peers and other FSOs outside of their organization. This is a security community event where contractors and government managers can learn from each other. Think Society of Industrial Security, American Society of Industrial Security, or other professional organization level event. Or it can be a smaller venue. Either way, involve others outside of your organization. This demonstrates contribution to the community, a pursuit of improving national security, and helps quantify going above and beyond. For example, an FSO uses their facility, creates an agenda and executes a security conference or training event. Or, committees can be formed to share the tasks. Education of this magnitude has tremendous value as the security community learns from experiences and examples of their peers and applies them at their own organ...

Category 3 of the NISP Enhancement continues with Security Education. This category addresses internal security staff professionalization. Specifically, it measures whether or not security staff training exceeds NISPOM  training and DSS FSO certification requirements to include obtaining on-going professional certifications and incorporating the knowledge through the organic security program. There are currently several certifications and training available to the security professional, including some recommendations by DSS: Industrial Security Professional ( ISP) FSOs could set the ISP Certification as a goal and encourage staff employees to achieve. When employees study for the ISP Certification, they learn: how to read and apply the NISPOM, the importance of forming professional relationships with cleared employees, how the cleared contractor and the DSS representatives interact, and much more. DSS also understands the importance of individuals...

Category 2 of the NISP Enhancement covers Security Education: Internal Educational Brochures/Products. This focuses on the FSO providing security education to the entire employee population. This is in addition to security awareness training provided to cleared employees (employees with security clearances) required by NISPOM. What is the benefit of training cleared and uncleared employees? Uncleared employees can be the eyes and ears that are needed and add an additional layer of protection.   For example, cleared employees can be trained to recognize classified information. If a classified package is unattended, the cleared employee can be trained to recognize the sensitivity and report the incident to the FSO. Otherwise, they may take possession, read it, throw it away or otherwise cause compromise of classified information.   Here are some recommendations on how to provide that training:   CD/DVD-Defense Security Services, Interagency OPSEC Support Staff and ot...

Category 1 of the NISP enhancement involves company sponsored events. This is an opportunity that the FSO can use to demonstrate above and beyond adherence to NISPOM Chapter 3. Some of the suggested ideas include: ·          Security fairs-Security fairs are great ways to demonstrate the added value security provides to the cleared defense contractors. The FSO can set up designated booths that functions to provide security solution and awareness. For some examples include: ·          Document wrapping booth to demonstrate how to properly mark and wrap classified packages. You can take the opportunity to brief courier and other classified transport opportunities. ·          Fingerprint booth-As FSO I ordered children’s finger print cards. When we had a company picnic, I invited all the parents to come by to get their children fingerprinted. I then turned the completed...

For those defense contractors who what to perform on classified contracts, there are a few considerations to address. Under the National Industrial Security Program (NISP), a cleared contractor should appoint an FSO to take on this responsibility of directing a security program to protect our classified information. This FSO is the link between the government contractor and the cognizant security agency (CSA). When considering who to appoint as an FSO, the cleared contractor has a few choices: 1.       The senior officer can assume the role. 2.       The cleared contractor can designate an existing employee 3.       The cleared contractor can hire an new employee Whoever assumes the role of FSO must meet two requirements: 1.       Be a United States citizen. Both the facility and the FSO have to be U.S. Entities and must have a history of integrity and conduct that prevents or limit...

Prior to travel, a cleared employee should have a good understanding of their responsibilities to protect sensitive information. This can include classified or unclassified information and military or dual use information. For defense contractors, protection of classified information is addressed in the National Industrial Security Program Operating Manual ( NISPOM ), military technical data is covered by the International Traffic in Arms Regulation ( ITAR) and dual use technical data is protected under the Export Administration Regulation (EAR). Facility Security Officers (FSOs) and Exports Compliance Officers can train their travelling employees to protect technical and help them accept the responsibly to protect themselves, classified information, and technical information. Preparation for travel can be covered in 5 steps: 1. Ensure cleared employees notify their security office of all foreign business well in advance of a proposed travel date. This will prepare the employee ...

In addition to the NISPOM, there is another critical piece of information for creating a lasting and significant security program and good classification management; the DD Form 254. The Contract Security Classification Specification (DD Form 254) authorizes classified work performance and conveys the security classification specifications and guidelines for classification in the performance of a classified contract. The DD Form 254 is provided to both the contractor and cognizant security offices when work is subcontracted to a supplier/vendor requiring access to or generation of classified material. So why is this important to you?   It provides authorization for a contractor company to hold and or perform on classified contracts. The DD 254 justifies the need to access classified information and how and where the contractor is expected to perform. This justification also addresses the level of clearance at which the facility and employees should be approved.   It al...

Experience, commitment and practice are the best qualities to prepare the professional for the necessity of good old fashion networking. Networking is especially necessary in high trust and vulnerability industries like security where peers, colleagues and co-workers closely guard information. A career in security is rewarding and challenging. The work is important, cleared contractor employers count on FSO skills to maintain classified contracts and national security depends on proper protection of classified information. The security professional requires a high degree of interaction as paths cross in training, collaboration or through contractual execution. Security professionals are traditionally somewhat guarded discussing business with new or otherwise unknown persons. Security professionals require time to develop trusting working relationships and getting to know important connections in a timely manner is important. So, how do we accelerate this networking curve? 1. Fost...

Experience, commitment and practice are the best qualities to prepare the professional for the necessity of good old fashion networking. Networking is especially necessary in high trust and vulnerability industries like security where peers, colleagues and co-workers closely guard information. A career in security is rewarding and challenging. The work is important, cleared contractor employers count on FSO skills to maintain classified contracts and national security depends on proper protection of classified information. The security professional requires a high degree of interaction as paths cross in training, collaboration or through contractual execution. Security professionals are traditionally somewhat guarded discussing business with new or otherwise unknown persons. Security professionals require time to develop trusting working relationships and getting to know important connections in a timely manner is important. So, how do we accelerate this networking curve? 1. Fost...

Your company is growing and you find yourself reassessing your security team needs. Or, you find yourself severely lacking the personnel required to effectively perform security functions . In either case, it is up to you to hire the perfect employee. Find the perfect employee? Though a daunting task, it is important that you hire and build a team of excellent security managers. Never, ever settle for a warm body just to get the job done. Many of you know from experience the issues of hiring the wrong candidate bring about. There are a few good observations about potential candidates that can further them into the hiring process. These are 5 considerations you should employ befire hiring a security team member. 1.  All qualified applicants must reflect the company culture. What kind of employee does the company value? You must know this before you begin the search process. If your company values initiative, make sure your prescreen selects thinkers who can execute securi...