Gates, Guards and Risk Assessment

Consulting  Services

Red Bike Publishing, LLC is a Service Disabled Veteran Owned Small Business. We have sold thousands of books and training materials to individual customers. However, we would like to provide our manuals books and training to government offices to pass down to employees and contractors. 

Our products include training, books and services:

• Reminder magnets for security containers and safes.
• DODM 5200.01 V 1-3 and study guides for SPeD SFPC certification
• NISPOM and study guides for ISP Certification
• NISPOM Required Training
• FSO Services (facility and personnel security clearances)
• DoD and NISP Security Certification
• Tailored NISP required training

editor@redbikepublishing.com
CAGE: 53JF5 NAICS: 511130, 541690, 611430

Cleared employees are trained how to properly mark, store and disseminate classified information, but not taught how to effectively communicate without inadvertently disclosing sensitive information.

Develop security program based on numbers 1-3. Include the risk and develop countermeasures and implement those countermeasures as well as regulated NISPOM and other requirements.

For more information on conducting risk analysis and creating countermeasures, see our book How to Get U.S. Government Contracts and Classified Work.

The term Cleared Defense Contractor,might conjure images of large complexes, with a healthy security staff, plenty of closed areas, labs and conference rooms. 

If you need assistance with FSO tasks, OPSEC, risk assessments, or security training please contact me or visit my consulting site www.jeffreywbennett.com. Additionally, we have NISPOM fundamentals training perfect for studying and applying to your CDC facility.

Youtube Channel

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Clearance, NISPOM, and FSO Consulting
Thrive Analysis Group Inc is your resource for security clearance, NISPOM, and FSO consulting.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:01

Welcome to DOD Secure, and I'm your host, Jeff Bennett. Today we're going to talk about again three or four topics. The first one's going to be about gates, guards, and risk assessment. What does an FSO need to know about risk assessment concerning classified material? Four ways FSOs of small defense contractors can improve their security posture. Three simple reminders that help reduce the risk of security violations, and this is a great topic for nuclear employees who handle classified information. This will be discussing how best to remind them to protect what they are working with so that there's no cause for error. And it's all about reducing risk to classified information within a United States government organization or within a clear defense contractor. As a reminder, um our audience is are those who are defense contractors who would like to become a clear defense contractor, or people who are considering working for the government or a defense contractor, and wonder about how to get security clearances and perform on classified work. Most of our topics come out of my two books, The Insider's Guide to Security Clearances and How to Win U.S. Government Contracts and Classified Work. Of course, I have a link to all of my books and training resources as well as a few others at the um at the podcast page. So I hope you take a look at that. So for the past month or so, I've been putting out a new book called the SFPC, which is the Security Fundamentals Protection Certification, and that is by the Department of Defense certification for those who protect classified information. This is a test that or a certification that tests your skills and understanding of DODM 5200.01 volumes 1 through 3. And I've been putting this book together for months, pretty much close to a year. And if you're interested in that SFPC certification, as you have been interested in the ISP certification master exam prep that I've written, just want you to understand that this book is chalk full of questions, about 330 questions. Again, 330 questions in this book. It's had good um sales so far, and in a couple of interesting reviews. One review stated that they weren't sure it had any questions in it, and I think they might have bought one of our competitors' books. But just to let you know, as a listening audience, this book has 330 questions. The ISP manual is a little bit longer, it has 440 questions. But with each of the master exam preps, there are four independent practice tests that you can um that you can take part in to kind of simulate the pressures of a test environment. So I recommend you continue studying in your study groups. Um go to the to the um CDSE website and take part in those videos and training that they have there. But if you want practice questions, uh I'd appreciate you going to redbitepublishing.com and taking a look at our books. So let's go on to the first topic, which is called Gates, Guards, and Risk Assessments. So I have a question for you. When was the last time you've read of an intruder breaking into a military facility and cracking a security container to run off with all their secrets? It doesn't happen a lot, does it? And then so what do DCSA or Defense Counterintelligence and Security Agency, security educators, and security practitioners preach as a biggest threat? Sensitive information available in the public sector, the trusted employees, transferring technical data to adversaries through seminars, emails, or just walking out of the facilities with it. For example, um people not knowing what to protect or what the rules are, and they end up publishing sensitive information that makes it available to people who don't have authorization to that information. Another example is um you know, trusted employees walking out the door with a secret. Um, think Eric Snowden, um, and many, many other people that we have seen on post offices. Well, without addressing the complete threat, the security community continuously pumps resources into protecting sensitive information, primarily through physical security means. Now, cleared employees are trained on how to properly mark, store, and disseminate classified information, but they're not taught how to effectively communicate without inadvertently disclosing sensitive information. And again, um I mentioned classified information, but it could be controlled unclassified information. For example, a scientist disclosing intellectual property, proprietary information, or export controlled data at a conference or symposium. In other words, how do sensitive program employees talk about, work with, or demonstrate their technology without transferring protected technical information? Well, that's a rare skill. Um, but recognizing that there are more obvious threats than cat burglars, here are five ways that you can develop real countermeasures and strengthen the security program within your facility. One is you know, perform a risk analysis. Make sure that you know what you know about your area, conduct a crime search by zip code, research the weather, form working groups, and determine what needs to be protected. List the threats and vulnerabilities and the impact, then form your security plan. Step two, determine government requirements. So for if you fall under the National Industrial Program Operating Manual, uh, which is 32 CFR Part 117, HIPAA, or other regulations, these trump your risk assessment and must be considered. So make sure your security plan is equal to or it exceeds the government requirements. 3. Understand the contractual requirements. Facility security officers, senior management officials, and key management personnel can get valuable information about their security program from the DD Form 254 or the statement of work and the security classification guides. Make sure that you and your employees understand what the requirements are. Just makes it so much easier to identify the raw data, test results, or whatever that needs to be protected. Step four, develop a security program based on steps one through three. Include risk and development countermeasures and implement those countermeasures as well as the regulated NISPPOM and other requirements. Identify the threat, determine the risk of the threat, and document the impact and countermeasure costs. Train number five is train employees to meet these security program requirements. A lot of employees understand what markings are, but when they go and generate information that is derived from the original classification or original sensitive item markings, they need to understand what their um what their responsibilities are. They need to carry over the markings, they need to protect the new documents or items the same way as the original ones. So gates and guards are the most visible and popular method of security. Prevent people from unauthorized people from coming into the facility and walking away with sense of information. However, we know the biggest threat is from those inside the organizations that have access, need to know, and can get their hands on the projects. Considering the real threat, they may be the less useful, the least useful of all methods. So while you have physical security measures in place, consider um at least using part of them to the use of denial or deterrence for cleared employees to keep them from making mistakes with the information they have, or making mistakes and communicating it, or breaking the law by walking out with it. It's almost impossible for an adversary to break in these hardened places, but it's very easy for an authorized employee to walk out with a secret sauce. I've been doing this for years. If you or your program or you know somebody who needs assistance with this kind of work of identifying what needs to be protected and then developing countermeasures or at least doing a risk assessment of your facility, just let me know. Editor at redbikepublishing.com, I'll be happy to assist in any way that I can. At Mathcraft, we believe security risks and lack of compliance are threats to a business and its people. We strive to provide our clients with the tools they need to stay compliant and prepare for the next generation of threats. Through comprehensive training, support, and customer resources, we transform our clients into security professionals with the know-how to defend their organizations and maintain comprehensive security programs. For more information or ways we can help, visit mathcraft.com or call 703-729-9022. At MathCraft, we support the mission of FSOs, CSOs, and other security professionals who stand at the front line of our nation's battle against foreign and domestic threats. With software designed to the latest federal security standards, we help them strategize, speed up self-auditing processes, create new workflows, generate reports, and receive technical information at a moment's notice. And again, if you're interested in some of the Mathcraft products and services, check our show notes for a link to Mathcraft. Now, the term clear defense contractor might conjure images of large complexes with healthy security staff, plenty of closed areas, labs, and conference rooms. However, there are many, many more contractors that are just a few employees deep but with great ambition, drive, and ideas. In some cases, smaller and less experienced defense contractors may not be as proficient in executing security responsibilities. They just that's not their full-time job. Their full-time job is developing their product and services for the government, so maybe they just need a little bit of help. But for full-time FSOs, they understand a little about the requirements of DD Form 254 or the contract security classification specification and how to protect information under international trade and arms regulations or international traffic and arms regulation, the ITAR, controlled technical information. But knowing how to interpret and apply the National Industrial Security Program operating manual, let alone the federal acquisition regulation, is something that takes time. So I travel in my business to many defense contractors working on cutting-edge research and development efforts. These defense contractors have been as large as a thousand employees and as small as three people in a converted schoolhouse. You know, think of some of the more successful tech companies in their early garage years. Um the state of art development in primitive settings, maybe. So some things you might be able to do, or or if you are a small company and you want to protect your information that you do have uh per the NISPPOM is address these challenges. Step one. One contractor just received a facility clearance and FSO is the chief operating officer. Another has just a few employees and also had a designated FSO. And in spite of you know, performing uh research, neither could afford the luxury or overhead of a full-time dedicated facility security officer. They had to rely on each other to learn the ropes. You know, one person, the lead scientist or the owner of the company, had to split their duties with the FSO responsibilities. They could not afford to hire an additional employee to just to take care of the FSO work. It just wasn't enough work for them to do either. Um, however, they did understand how to protect their intellectual property. They also had to adapt to learn to protect classified information according to the DD Form 254, the Statement of Work, and the National Industrial Security Program operating manual. So they met that challenge. So now make your priorities. No different than with the large defense contractors, priorities that drive small organizations are cost, performance, and schedule. They've got to perform for their customer. If they don't, they can't be successful. If they miss their performance objectives or miss their schedule or late in delivery, or they go over budget, that's not good. They want to turn a product over to their customer and they want to make a profit. However, the difference is the amount of effort they can afford to spend on protection. So they have to prioritize the cost of the time and the resources. Three, understand risk management and NISPPOM requirements. That's why it's real critical for a leader to make decisions that spend resources on protecting absolutely what is necessary. These decisions should actually be made with a combination of risk assessment models and NISPOM requirements. So an example of this would be the risk model may identify that there is a very low crime rate in where the facility is located. However, classified information can only be stored in a GSA-approved security container that may be locked in a central office. On the other hand, intellectual property may require stepping up security resources. The NISPPOM instructs on minimum protection measures for classified information, while the risk assessment identifies where the more aggressive security measures should exist. So in our earlier example, the DOD security container may be appropriate for protecting classified information in a low crime area. However, information that is an intellectual property or something that may be high value to the contractor, they may need to do offer more protection for it based on the crime rate. If the crime rate is high, might consider putting in alarms cameras to observe the facility. Again, it's not a requirement by NISPOM for storing classified information, but the crime rate may require above and beyond countermeasures. I like number four, and that's called delegating responsibilities. Just because somebody is appointing appointed as an FSO, and NISPOM requires somebody to be appointed as an FSO, not necessarily hired, that person can delegate some FSO tasks. They can't designate or delegate their requirements to be the FSO, but they can delegate administrative tasks. They're still held accountable, but those tasks can be disseminated throughout the other employees. The FSO who also serves as a senior officer should consider delegating these administrative tasks to free up their calendars. The security clearance requests, visit requests, classified storage, and other NISPOM issues can easily be administered by junior employees, while the person appointed FSO makes the policies, the final decisions regarding security programs. So not all defense contractors are the same, and classified contract requirements vary just as much. It's up to the organization to implement security procedures that make sense and meet budget. Focusing efforts based on regulatory guidance and risk management help to do so in an effective and affordable way. And remember with the new issuance of 32 CFR Part 117, a senior management official must be in the loop for every decision, or not every decision, but must be in the loop for the risk management that is being conducted at a contractor company. Chances are when CDSC comes in to do the audits, that they are going to talk to the FSO, but they may have some separate questions for the senior management official. Keeping this in mind, again, I would I would recommend that if you weren't familiar with NISPOM, that you would get some kind of assistance. There are a lot of um consultants out there that can help that are qualified to help. If you'd like a consultant for um these types of tasks, um I'll leave some links in the um on the uh podcast page that you can take a look at and contact. Alright, I would like to tell you now, give you a special message from SIMS Software. S-I-M as a Mike S Software. As clear defense contractors, you represent the backbone of innovation, the front line of our national security and protectors of all that we hold dear. SIMS Software is proud to be your ally in these endeavors. As most trusted name in industrial security information management, for over 38 years, SIM Software equips you with the tools to protect the lifeblood of your organization. Our flagship Sims Suite provides all the features and functionality you need to run an automated, paperless industrial security program. Gain a 360-degree view of every physical, virtual, and human asset inside your security domain. From classified documents and materials to cleared personnel, facilities, visitor control, information systems, and more.com or call 858-8481-9292 or see our show notes for more information. Violations. So we always talk about markings, right? Markings are clearly indicated on items that contain classified information. But what about markings on controlled unclassified information or controlled? Technical information or ITAR or export controlled information, markings should be there. They are important and they warn the user of how to proceed with the information or the item. Markings also warn the user how to proceed with generating products from that original originally marked document. That's called derivative classification. Markings should not be the only security measure in place that prevents unauthorized disclosure of sensitive information. Some might be tempted to add additional markings to already cluttered media, hoping to prevent a user lapse in judgment. You know I'm talking about extra stamps, extra writing, colorful writing. Pretty soon you've got so much clutter that you can't see the real document. It may again, these items are better effective when they're simple and bold and the first thing you look at. Too much clutter, you m might become in invisible and prevent a user from using good judgment. Once again, the effectiveness begins to wear off and man hours are wasted on efforts that may not even increase awareness. To counter these effects, the holder of the classified material should remain vigilant and aware of their surroundings and situations at all times. So if you're looking at a sensitive item where there's ITAR controlled, maybe use that as an example, export controlled. You don't want to be um viewing export controlled material when there's a non-US person present. That would just be an export violation. You don't want to be looking at classified information in an area where people are around that don't have a need to know. That would be a security violation. This is a proactive posture that requires a bit of imagination. Such security accomplishments with solid training and reminders of responsibilities while possessing classified or other sensitive information. Simple solutions can can lead to success. Uh solution one, a clean desk policy has helped reduce security violations. In this situation, an employee removes everything from the tops of their working surface or desk except for the sensitive information. That simple practice should make a busy employee more aware that any articles left on their work surfaces requires extra diligence and should never be left unattended. When no longer le needed, this sensitive information should be put back where it is safely stored and protected. A desk tent or door hanger, these are items that you put on your desk or hang on your door, that has an important reminder that sensitive items are left out. So you might have an export control warning or a CUI statement or a classification warning, say, hey, employees are in this work area working with sensitive information. Do not enter. Number three are end-of-day checks. Using a checklist can help ensure classified information or items are stored properly. So the end-of-day checks, if you're not familiar with them, it is a check sheet where the last employee in the area or the appointed employee walks through the work area and makes sure that there's no sensive information on the printers, on the copy machines, or on top of other people's desks or even in the garbage can. Before ever leaving an area for approved uh work on sensive information, the cleared employees should check the copy machines in other work areas for any sensive information that is left out. So multiple layers of security should be implemented to reduce the risk of a violation. With such systems in place, empty or clean desks, work areas are cleared, security containers are locked, and end-of-day checks are documented. An employee can proceed with confidence that no classified items or sensitive items are out. And I mean in confidence, because I remember many days driving home wondering if I actually put things away. You know that nagging feeling, and you don't know until you go back and check yourself. It's like when you go bed at night and you check the locks and your doors three times before you go to sleep, right? This discipline creates an environment that reduces the chances of the employee leaving any sense of information vulnerable to compromise if they forget to secure it prior to taking a break or leaving for the day. And again, we want to make sure our information is secure, we protect national security, and we go home with a clear conscience. Now I'd like to tell you about our other sponsored, mission-driven research. They're there to glorify God by empowering employees to fulfill their mission. Their vision statement is that every employee finding fulfillment and joy by actively engaging in the mission, their core values are to go the extra mile for their customers, grow our employees personally and professionally, and give generously to our community. In their website, they describe themselves as a growing company providing technical services to the U.S. federal government. If you'd like to know more about mission-driven research, find them at missiondrivenresearch.com. And also in our show notes, I'll include a link to their website and how to contact them. And if you're new here, go through our library. We have a lot of episodes now. We've been on the air for three years, and I'm glad again, glad to be here, glad to help out. If you find this podcast useful, I hope you'll come to our website, which is redbikepublishing.com. RedbikePublishing.com produce training and other materials to help you protect your sensitive information. If you're a clear defense contractor, you might not know this, but um there are uh training requirements stated in this book. And with classifier requirements, three three three every day eighteen hours. So we're here to help you. And if you find that would be useful, please visit redbitepublishing.com and I'll have links to our training in our show notes. We also have the latest version of Nest Palm in the Itar that you can print and provide to your employees as well. Uh, again, I'll have links to those in the show notes. Glad you're here, glad you stopped by and look forward to seeing you next time.