Security Executive Blog

This article continues the series covering the Self-Inspection Handbook For NISP Contractors and guidance found in the National Industrial Security Program Operating Manual (NISPOM) Incorporating Change 2. This is the second article under the topic of Insider Threat Training . The earlier article addressed the requirement to training, who to train and when. This article addresses what to train. NISPOM 3-103 b states: NISPOM 3-103 b states: All cleared employees must be provided insider threat awareness training before being granted access to classified information, and annually thereafter. Training will address current and potential threats in the work and personal environment and will include at a minimum: (1) The importance of detecting potential insider threats by cleared employees and reporting suspected activity to the insider threat program designee. (2) Methodologies of adversaries to recruit trusted insiders and collect classified information, in particular with...

NO, I will not move your office furniture. The misunderstanding. Not because I’m not a nice guy or a helpful employee, but you just came to the wrong office. Ever have one of those days? A few years ago while serving diligently as an FSO an employee came by my office. She shot the breeze for a few moments, then floored me with a question. “Could you help me move my desk out of my office? I’m getting it replaced.” I thought it a strange request as I was still kind of new and we hadn't built up the kind of relationship where she should ask for those kind of involved favors. Sure, I could grab someone and we  can come over and move it. “That would be great,” she responded. “But, better yet,” I said on second thought, trying to protect my back from sure injury. “Why don’t I call the facilities manager and we can get someone with the right equipment.” “That’s what I meant,” she responded. “You are the facilities guy…” Ooooo...

Try your knowledge of the NISPOM and industrial security with these challenging questions: 1.      Which of the following can the CSA approve when no other alarm response options are available: a.            Response by neighborhood watch b.            Monitor by hidden camera c.             Guarded by working dogs d.            Installation of wire security e.             Response by cleared employee 2.      In the Protection Profile Table for Confidentiality, which Data Transmission is required for PL2? a.            Trans 1  b.         ...

NISPOM topics applying to the cleared contractor facility should be addressed as often as possible. Cleared employees may be very familiar with classified performance requirements, but may not always remember countermeasures implemented at the facility to protect classified information. Though they may be excellent at marking documents or using deriviative classification techiques to properly transfer a classification from a security classification guide to a classified report, they may still need to be reminded to attend security training, report suspicious information, or attend threat briefings. Excellence comes from day to day exposure. As their daily performance makes cleared employees experts in their fields, FSOs play a large role in bringing them to that same level of NISPOM compliance. Take the time to understand what training is needed and try to meet that need. Three effective ways to communicate your security message: 1. Group presentations-a popular and fast wa...

We can apply the “Elements of Inspection” that are common to ALL cleared companies participating in the NISP. There are a few more elements that might be applied at unique cleared facilities, but facility security officers in those situations can adapt these articles to those specific needs. According to DSS’ The Self-Inspection Handbook for NISP Contractors, the five elements are: (A) Facility Security Clearance (FCL) (B) Access Authorizations (C) Security Education, (D) FOCI (E) Classification This third article in the series will address how to integrate the access authorizations into the overall security program designed to protect classified information. Here are some questions from the handbook and ways to address the topics: Are the numbers of clearances held to a minimum consistent with contractual requirements? The facility security clearance is tied to a contract. Typically this tie-in is carried down to the cleared employee. However tying in a personnel security clearance...

It’s true, cleared defense contractors have uncleared employees. In larger organizations, these employees may work in shipping and receiving, maintenance, human resources and other non-program development areas. The organization should develop policy and training to incorporated into the procedures to protect classified information. How would an uncleared employee have access to classified information? Hopefully never, but mistakes happen when such instances are not identified. Cleared employees could possibly find unattended classified information, unlocked security containers or stumble into classified conversations. Sometimes classified information is delivered to the wrong recipient, absent minded cleared employees might leave classified information on a printer or in the common areas and cleared employees may have approved classified meetings but forget to verify clearance and need to know. Things happen and damage control as a last resort is all too prevalent in these situati...

NISPOM As mentioned in an earlier article, NISPOM Change 1 requires Derivative Classification Training and Record keeping Guidance. This guidance requires that the cleared contractor provide cleared personnel with initial Derivative Classification Training and follow up and at least once every 2 years. The training topics are vital to the cleared contractor performing on classified contracts.  Properly trained employees reduce the risk of unauthorized disclosure of classified information. Currently this training can be put in place at the cleared contractor’s initiative. The sooner training is implemented the better. The Defense Security Services will be publishing an Industrial Security Letter (ISL) that provides instruction for conducting training including a “trained by” date to meet the requirements of the recent NISPOM changes. Why not begin the training now and be prepared for success before DSS gives the deadline for conducting training. Remember, if not trained, ...

Derivative classification is a required training event. Defense contractors who use classified source material to generate a new product perform derivative classification. According to the National Industrial Security Program Operating Manual (NISPOM) all derivative classifiers must receive this training every two years. Contractor personnel make derivative classification decisions when they incorporate, paraphrase, restate, or generate in new form, information that is already classified; then mark the newly developed material consistently with the classification markings that apply to the source information. Derivative classification includes the classification of information based on guidance, which may be either a source document or classification guide. Order your training here: Derivative decisions are made through: Incorporating-Programs that assemble classified parts or use integration of classified processes assemble those already classified parts into a new classified  pr...

Change 1 to the National Industrial Security Program Operating Manual ( NISPOM ) outlines requirements for derivative classification. Where the original classification authority receives training on the same topics annually, NISPOM requires derivative classification once every two years. According to NISPOM derivative classifiers should be trained…in the proper application of the derivative classification principles, with an emphasis on avoiding over-classification, at least once every 2 years. .. not authorized to conduct derivative classification until they receive such training. Here’s the important part, no derivative classifier training , no work. Proper NISPOM training and documentation is the difference between performing on classified work and not being able to meet contractual requirements. Make sure your cleared contractors performing derivative classification responsibilities are trained to standard. The standard is listed below with a few ideas on how to meet each of the cr...