What to expect with a brand new security clearance

This blog continues the series describing what happens after the government grants you a security clearance. After receiving a job with a company or agency performing classified work, you’ll receive your onboarding training, which may have included the SF 312 Non-Disclosure Agreement, Initial Security Awareness, Derivative Classifier and other required training events and briefings. Even though the Facility Security Officer (FSO) brought you into the system, awarded your security clearance, and performed the required high-level training, there is still much more work to do to ensure you understand how to perform on classified contracts.

The high-level training and onboarding is enough to get you “authorized” and prepared for the work. The rest of the preparation will come from other sources to include peers, supervisors and program managers. This training is usually provided on the job as you actually begin performing on the classified contract.

This is how it might play out. The Government Contracting Agency (GCA) or program office flows down the classified work in the contract to the Cleared Defense Contractor (CDC). Part of the classified contract is the Contract Security Classification Specification or DD Form 254. According to the information on the DAMI website, the purpose of the DD Form 254 is to “…convey security requirements, classification guidance and provide handling procedures for classified material received and/or generated on a classified contract…” This DD Form 254 provides direct information to complete your training so that you can perform well. Keep in mind that if you will be working on multiple contracts, you should understand the contents for each contract.

The DD Form 254 will explain the classification level that you will be working with. It is important to understand that this level will be at the same level or lower than your security clearance level. Therefore, you would need a Top Secret clearance to work on classified contracts at the Top Secret level or lower. The form may also state any additional classification concerns such as foreign government information, communications security (COMSEC) requirements, and more.

The form also determines where you will perform the classified work. If the CDC facility has a possessing Facility Clearance (FCL), then you might perform work at that location. If the CDC facility has a non-possessing FCL, you will usually performed classified work at another location. For example, a cleared employee may not necessarily perform the classified portion of the work at their location based on guidance in the DD Form 254. As a result, any cleared employees have an office at their headquarters or company property, but perform classified work off-site at a government, research, or other cleared contractor location.

While the FSO will provide the required NISPOM  security training reflecting National Industrial Professional Operating Manual (NISPOM), your supervisor may give you more work specific training as you perform on the classified contract. Your supervisor will teach you how to write documents, assemble subsystems, collect raw data from sensors, or other specific work required by your contract. They will also teach you how to correctly mark, assemble, store and protect the classified work products.

Websites Mentioned:

www.bennettinstitute.com
https://www.redbikepublishing.com/fsocertification/
https://www.amazon.com/-/e/B002BM2LY8

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

Hi, and I'm Jeff Bennett, and welcome to our show. Today's topic is going to be I have a new security clearance now, what? Now, this could be a new security clearance as an employee at a security cleared facility or as a brand new defense contractor that has recently received a facility clearance. So there are some responsibilities. So either way, if you are new to security clearances or getting onboarded with a security clearance at a new company, this show is for you. Welcome to DOD Secure. And again, I'm your host, Jeff Bennett. So we're going to talk about the next steps. So your company is up and running and doing classified work according to the classified contract. And there are some responsibilities that you have to do at this point. The first one is to, of course, assign a facility security officer because they are going to, you know, either full-time execute these security programs to protect classified information, manage the security clearances of the cleared employees, and many, many more tasks. If you want more information, again, I have a book out called The Insider's Guide to Security Clearances. And I have another book out called DOD Security Clearance and Contracts Guidebook. DOD Security Clearance and Contracts Guidebook will show you how to perform on that classified contract. And so the purpose of this podcast is, you know, to talk about that. What happens to a new employee? You know, um, whether the employee is brand new and they're arriving with a security clearance, or an employee just got awarded a brand new security clearance. Either rate, there's some things that need to be done. And it starts with the facility security officer. And for the sake of this podcast, we will call them the um FSO instead of facility security officer, be short, FSO for short. So once the security clearance is granted, the FSO will contact the cleared employee, and that's where things start moving pretty quickly. Um, you may have been waiting a long time for this security clearance to pop up, but once you get the security clearance granted, according to the processes that we have discussed in past um podcasts, um this next part picks up pretty quickly because now the FSO has to get the employee or the newly cleared employee spun up with um their, I guess, in other words, not really certifications, but spun up with what they do once they have the clearance granted. Um primarily if this employee has been sitting in a temporary position waiting for that security clearance to come up, well then now it's time for them to move from that temporary position to that full-time position that they were originally hired to do. All right, so the FSO is managing the security clearances, and they're under the umbrella of the defense contractor's oversight. So the clear defense contractor is overseeing these security clearances, and these security clearances reside on an information system that is provided by in the DOD defense, counterintelligence, and security agency. So they oversee the security clearances from the government point of view, and the clear defense contractor and FSO oversee the individual security clearances from the defense contractor point of view. And so the FSO manages these security clearances. Um, that means the FSO will maintain the facility security clearance status administratively as well as they have a role of meeting requirements or compliance requirements. And we'll get into those a little bit later. But, you know, they start this by providing the required training that the cleared employee has to go through and has to maintain. And so they what they want to do is equip the cleared employee with protecting classified information, you know, with the information they need, the training they need to perform the work designated by the classified contract. So the facility security officer is the one of the first employees in the company that gets a security clearance. And so they have to be, they must be certified as an FSO by going through the defense, counterintelligence and security agencies training. We'll call them Dixa for short. And they'll go through this training and they'll become certified. They'll get a certificate of training and they have to do accomplish this within one year of becoming designated as a facility security officer. And then the Dixa representative will provide the um FSO with their initial security briefings. Um, for example, they'll provide the FSO with their initial security briefing, and then now the FSO can provide these briefings to the cleared employees. It does not have to come through the government anymore. So just as the FSO is certified with their security training, the FSO now trains the cleared employees. Um the FSO will manage the clearances, the training, the classified workspace, the classified documents, all this stuff will be managed by the FSO. So the FSO has to train the cleared employee how to protect it because now the FSO and the cleared defense contractor organization will be undergoing reviews or inspections and vulnerability assessments by the uh Defense Counterintelligence and Security Agency. The training and the briefings that the FSO provides begin with a brand new cleared employee will sign a non-disclosure agreement called the SF 312, which stands for Standard Form 312, and it goes over the classification system, what to expect, when you see classified information, the classification levels, and et cetera. This briefing should be provided to the cleared employee. Then the cleared employee, the brand new cleared employee, will sign the SF 312. Now you don't have to do that one time in your career, because that FSF 312 will go into the um the information system that we talked about earlier and be good for the life of that cleared employee, at least working on classified information. So if the cleared employee were to move and go to another company, they don't have to sign, necessarily sign that 312 again. Um and then after the SF312, um, you know, before you can start your work on classified contracts, the FSO will ensure you meet three criteria. Uh one, you have to sign the SF 312, two, you have a security clearance, and then you have the need to know that classified information. Because as we talked about before, not everybody with secret clearance gets to see all secret information. They have to have that need to know. And usually it's by contract. Um, the first step is you know the most difficult. There are two, the other two are fairly easy. Um, whoever possesses the classified information will determine whether or not to provide access to that classified information. So if you're assigned to work on a classified contract, that contract relationship and the work that's assigned to you are part of that need-to-know process. So let's understand the need-to-know or the non-disclosure agreement. Um, as new cleared employee, you'll be assigning that agreement. Instead of just checking a box to agree, you know, perhaps it might be in the clear defense contractor's best interest to provide a good briefing and pay attention or help the employee pay attention to what is required of them, they should understand exactly what it means to work with that classified information because that is a great responsibility. As we covered before, you know, um the unauthorized disclosure of classified information causes damage to our national security. Um classified information, uh confidential information causes damage. Um, and that damage progresses to secret and then to top secret, of course, causes the most damage out of those three. So we want to make sure the employee understands what is classified and what their responsibilities are for making sure that classified information doesn't get presented to somebody who doesn't have a clearance and somebody who doesn't have that need to know. And then so the SF 312 briefing explains what classified information is, how the government designates this as classified, uh, what the levels are, and how to protect it from unauthorized disclosure. And so that's the cleared employees' first introduction to that topic. After this, they'll be provided something called the initial security awareness briefing. Now, the initial security awareness briefing goes deeper into the NISPPOM, and that is the National Industrial Security Program Operating Manual. So the NISPOM is basically guidance for the clear defense contractor on developing that security program. Um so the initial security awareness training should familiarize the cleared employee with the NISPPOM, as well as requirements under the contract security specification or classification specification or the DD Form 254. Um, this is that classified part, that part of the contract that describes the classified work. And we'll talk about that more in detail at some other point. Um also now we need to look at company policy as applied to protecting classified information, and that's in both in the cleared facility and in um other customer locations. And here you also learn how to travel overseas, um, how to reduce your ability to become a security risk, um, introduce you to the insider threat program and into threat in general, um, how to report um espionage attempts and how to fit into something that we call the continuous evaluation or the continuing evaluation process basically is how do we look at um uh ourselves and other cleared employees and determine whether or not they are at risk or we are at risk to national security. And again, those are on the 13 adjudicative criteria that we talked about earlier. So if there's an event in your life or an event in another cleared employee's life that might make classified information or put classified information at risk of unauthorized disclosure, um you can self-report or report that other person. It's got to be credible information, you can't just make it up. So another part of the um initial security awareness training um is also the um how to secure report security violations. You know, I mentioned espionage attempts. We'll talk about security violations and possible penalties that can occur from a um if you yourself commit a security violation. So it's basically risk management training. What happens if you have classified information? How do you protect it from unauthorized disclosure? And what happens if it is um purposefully or accidentally um disclosed in an unauthorized manner? So another big thing that's that's uh a required training. So these training that I'm reading to you are required as an FSO as a cleared facility. Um this has to be provided to your cleared employees. And one of the difficult things about providing this type of training is one, you've got to find the training, either develop it yourself or um purchase it or get a training expert to come in and provide this for your employees. And another one to wrap up, we had the non-disclosure agreement briefing, the initial security awareness training, uh, and another uh required training is the insider threat training. And here you will learn how to recognize an insider threat, how to recognize what classified information is vulnerable to the insider threat, and how to reduce that threat. Now, keeping in mind that the insider is somebody with a clearance and a need to know, but they are taking that classified information and either sabotaging it or stealing it or providing it to uh a foreign country. And so we want to recognize how that happens, and so we're required to provide that briefing. Another required briefing is the derivative classifier briefing, and this stands for anybody who will be working with classified products and providing a new product. So, for example, making a copy of a classified document is not derivative classification. However, taking um wind tunnel readings or classified raw data and reformatting it into a written document, or doing analysis on written on classified charts and writing a document out of that, or rewriting a document based on five other documents. You're reforming or reformatting classified information into a new format or medium that is called derivative classifier training. And if you're doing that, or if your employees are doing that, they're required to be trained on how to do this every two years. And so all this training that I've been talking about is a requirement and it should be documented. Documented now, there are many ways to provide training. One is through newsletters, one is through plays, another one is through PowerPoint presentations. Um if you want to look at some options for purchasing these presentations, we have some at redbikepublishing.com and you just download them and present them to your employees full blown out required training topics for you. Um, and then finally, there's the exit briefing. Cleared employees should be giving this briefing once they're terminated or once they move on so that they understand for the life of them of their whole life, basically, until things become declassified, they are responsible for protecting that classified information that they learned while on the job. And these responsibilities still continue even though they're no longer working on the job. They still have to protect that classified information. So, in summary, you know, I've discussed very quickly if you're a cleared employee or if you're a um owner of a cleared defense contractor company, and people are coming in to perform classified work there, of the training that needs to be provided to them. One, the FSO should be onboarding all of the cleared employees and maintaining their security clearances and describing to them or training them on how to do this classified work. So the other part of this podcast and video is talking about, you know, um, a clearance has been granted. Um, and we'll cover the DD Form 254 NISPOM and the security training again, but we'll cover it from a different point of view from the government's point of view. And um, this is for you know what happens when the government grants that security clearance. Um, you could be leaving, you could be receiving a job with a company or an agency performing unclassified work in this scenario, and you'll receive your onboard training, which is includes the SF 312 non-disclosure agreement briefing, the initial security briefing, delivered classifier briefing, um, and uh insider threat briefing. You know, even though the FSO brought you into this security clearance system, awarded that award you your security clearance and performed the high-level training, there's still much more to do to ensure that this cleared employee, whether it's you or somebody else, understands how to perform on the classified contracts. So this high-level training and onboarding uh is enough to get you authorized to prepare for the work. Now, the rest of the preparation will come from sources to include peers, supervisors, program managers, and more. So this is more the informal training provided on the job as you actually begin performing on this classified contract. So, you know, here's how it might play out from the top to the bottom. The government contracting agency or program office flows down the classified work to the clear defense contractor. And so part of the contract is the security con the contract security classification specification. Again, that's a T D D form 254. Now, according to the information on the this website, the DAMI website, is the purpose of the 254 is to convey security requirements, classification guidance, and provide handling instructions or procedures for classified material received andor generated on a classified contract. That sounds a lot like derivative classification, right? So this DD Form 254 provides direct information to complete the training that you need to perform your job well and protect that classified information while you're performing it. Again, you do not want to be that person that does not understand how to do their job and puts classified information at risk. We want to keep those types of reports out of the news. Um, we don't want this to accidentally happen. And we also want you to be able to recognize when the cleared employee is an insider threat. You know, if keep in mind, um we have Eric Snowden, we have reality winner and Chelsea Manning. You know, those are the most recent news stories. We also have Bobby Hansen, John Walker, all these people who were authorized to have classified information, but they were able to acquire it in an unauthorized manner, take it out of the classified holding and share it with bad guys, with the world, with unauthorized persons, with the Russians, what have you. This information got out. So we they all had telltale signs. So this training and everything that you are learning on the job as a cleared employee is to prevent you yourself from doing it and for recognizing when this stuff is at risk from cleared employees performing bad things or the insider threat. All right. So while the DD Form 254 explains the classification level and the level that you'll be working on, you know, it's important to understand that this level will be the same level or lower than the security clearance level that you are authorized. So, like if you have a top secret security clearance, you'll be working with top secret information, secret, and confidential. However, if you only have a secret security clearance, you will not be working with top secret information, but you may be working with confidential as well. Um so the form may also state, and this is the DD Form 254, that you may that any additional classification concerns such as foreign government involvement or foreign government information, communication security requirements, and more. These like SAP programs or SCIFs that are necessary, um, those will be spelled on 254. Now the form also determines where the classified work will be performed. So there are possessing facilities and non-possessing clear defense contractor facilities. Possessing means that the classified work can be stored and performed at the clear defense contractor location, but there are many clear defense contractors that put employees sitting with other customer sites. And so the classified um work will not be conducted there at the clear defense contractor facility. It will be conducted off-site. And so that will be covered in that DD Form 254. Um now, while the FSO will be providing the training reflective of the NISPOM, supervisors may give more direct, more info-specific training concerning the technical documents that you'll be working with, how to actually perform your work. So while the security manager or the FSO is managing the classified holdings and the security clearances, the supervisors and the program people working on the classified contract will be providing more of the how-to and how to protect the classified information while you're doing your actual job. Um they'll teach you about marking, assembling, storing, protecting, and interaction and even disposition of classified work products. So, in summary, after the FSO concludes all this training that we talked about, um supervisors and sponsors may guide you through more in-depth contract-specific security training. And this time they'll emphasize your contract-specific performance. And so that's our podcast for today. And I'd like to thank you for joining. I know there are many other podcasts out there, and I know there are many other more interesting topics, but look, you know, I'm here to provide education on how to become a clear defense contractor, how to bid on classified contracts, and how to perform and protect on classified contracts and protect classified information. And I appreciate it if you would visit um uh my website, redbikepublishing.com, or look for my books on Amazon.com. Um, also visit our sponsors. We have several good ones. You know, if you are running into issues with your security clearance or you have an issue that you need to report, you know, why not see a know-about or something has put your security clearance at risk. It happens. If this happens, call Ron Sixtus. He is at 256-713-0221. You can email him at R-S-Y-K-S-T-U-S at B-O-N-D-N-B-O-T-E-S dot com. Or reach him at securityclearance defense lawyer.com, and he will be happy to help you out. Additionally, we're also sponsored by a um a clear defense contractor by all means. They're called the um mission-driven research. And their um core values are to glorify God by empowering employees to fulfill the mission. So every employee is finding fulfillment and joy and actively engaging in what their mission is. And if you'd like to learn more about them, you can find them at mission drivenresearch.com. And again, thank you so much for joining us. And we look forward to seeing you next time.