How to Ensure Security Program Stays in Step with Corporate Growth.

     In this issue, we've provided real world security discussions. These occasions have proven to be good opportunities to clarify understanding of security policies and the reasons we do what we do.
     Preparing for growth involves the FSO not only training and hiring security employees, but accurately calculating classified inventory storage and work performance needs. Meeting legitimate growth is another area where an FSO should be injected into strategic planning. Classified contract opportunities present themselves in many variations.
     Potential security professionals should not only be U.S. citizens with security clearances, but demonstrate competence in the tasks they are asked to do and a desire to perform. They should also have the ability to grasp and teach concepts of security to help keep the security fresh in the corporate culture.
     During the certification training, the new employee can enroll in government provided on-line and residence training, lessons provided by company personnel and directly under their manager's supervision.
       The end of day security checklists play a critical role in protecting classified items as well as personal, proprietary and company sensitive material. The end of day checklist is a procedure required in the NISPOM and other federal agency regulations. However, they could be implemented in any situation where privileged or sensitive items prove vulnerable to theft or espionage.
           "What defines this room as approved for open storage?" I had asked while consulting on a project a few years ago.    I had been in the middle of a deep security application discussion. The whole time I realized that the security employees I consulted understood their responsibilities, but did not know why the security measures were in place or where to find the guidance.

Resources:
How to Get U.S. Government Contracts and Classified Work.
Insider's Guide to Security Clearances
Security Clearance and NISPOM Training

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

Welcome to another episode of DoD Secure, and I'm your host, Jeff Finn. I'd like to welcome you into DOD Secure, our podcast. And we'd like to thank all of our new listeners that are here today. And again, I am Jeff Bennett. I'm with Redbite Publishing, and we continue to focus on equipping security managers with skills and experiences necessary to earn their ISP certification, develop security programs, as well as help new employees and new companies get their security clearances. And this is the place to go for those discussions. And much of what we talk about is in our book, How to Win U.S. Government Contracts Classified Work and Insider's Guide to Security Clearances and more. And we'll give references to our books and training a little bit later in this podcast. In this issue, we're going to talk about real-world security discussions, such as having your security program grow as your corporation grows. And there's some legitimate concerns and issues that you should be prepared to adjust for, including who is your security manager and do they have the skills necessary to grow. And if you are a security manager, there's some great hints in this discussion that will help you grow as your company grows so you can continue to lead your security program designed to protect classified information, no matter how many employees you have or how large the security holdings grow. So we hope you stay with us and get ready for the discussion. So what we want to talk about here is how the FSO can manage growth or predict the budget that they need to reduce risks and continue to allow the cleared employees to perform on classified projects with the proper resources and projected growth. Now the defense contractor, as it grows, the engaged cleared facility security officer, or FSO as we call them, is should be prepared for that growth. They don't want to be the bottleneck to that growth, so they want to continue to predict growth and have the skills necessary to be able to discuss if a new new contract, classified contract comes in, or the new DD Form 254 that describes the type of work that's going to be on that classified contract. They should be able to predict storage space for classified information, training necessary, or additional rooms that need to be built, and determine those costs. Factor in the costs ahead of time before it's too late. Sometimes, if these costs are predicted after the contract is awarded, the defense contractor could be behind the power curve and end up spending money that they did not budget for. The constant development and maintenance of relationships with employees and key business units allows the FSO to forecast requirements for the storage of that classified material, performance of classified work, and protection of the enterprise employees, their production, and their capital. So the preparing for growth involves the security manager FSO not only training and hiring security employees, but accurately calculating classified inventory, storage, and work performance needs, such as, you know, do you need classified computing devices? Do you need storage for those classified computing devices? What kind of alarms do you need? So there's a lot of physical security, classified processing security, personnel security needs that should be projected. You know, meeting legitimate growth is another area where an FSO should be injected into strategic planning. They should be part of the planning and not the backup. For example, if business development is looking for an opportunity to bid on a classified contract, team up with another clear defense contractor, or otherwise commit the clear defense contractor to classified work, that FSO should be part of those discussions and not engaged after the contract has been won and leaving that FSO to figure out the best way to proceed, you know, after the work is already conducted and the security resources need to be committed. That can be a very expensive endeavor. So meeting legitimate growth is an area where the FSO should be injected into the strategic planning as soon as possible. These classified contract opportunities present themselves in many variations. As I mentioned, they could be classified contracts, building new facilities, alternate locations where classified work will be conducted and physical security needs, and there's an increase in classified storage or volume. They're all concerns that FSO should be able to address, but not address too late. Such growth impacts the security department, and such impact from the FSO benefits the organization in its entirety. So this could be a positive impact if the FSO is brought in early, or a negative impact where uh budgetary restraints are impacted because the FSO is left to fix the problem. Um, again, when it's too late to plan for, but it's a reactive kind of situation. If the FSO doesn't um have the influence or capabilities, they won't be prepared for that project growth, and they'll need to constantly be trying to catch up with the work, uh, such as such a posture, you know, again costs plenty of money and company overhead. And another example, additional contracts or change in performance requirements may require additional security personnel as well. You know, suddenly growth, a sudden growth in security storage, additional cleared projects, or added facilities may require more personnel to support the increased workload. So now we're not just talking about new rooms, um, new storage capability, new alarms, we're talking about hiring or acquiring more personnel at an hourly rate, additional um benefits and everything else. So that can be a cost that can be prepared for, but it would be hard if it was a cost that you have to adjust to suddenly. You know, just as the organization lists job requirements for FSOs, such as professional growth, management potential, technical competence, and skills, um the FSOs should be considered the same traits when preparing to hire additional help. The FSO should consider what kind of traits they are looking for based on the work requirements. If it's classified processing, then they should consider traits or work skills that an information system security officer or information system security manager have to be able to address risks with classified processing. The FSO and the security specialists should work towards establishing you know operating procedures and job performance description. New employees can become successful, maybe faster with formalized certification. Um certification training for FSOs could reflect the company's policies as they support the NISPOM requirements and the overall enterprise culture. So there are a couple certifications that the cleared employees can get. Such applicable security certification are um anything with the American Society of Industrial Security, ASIS. Um they have CPP certification and many others. NCMS has the Industrial Security Professional Certification and the Defense, Security and Counterintelligence Agency has um certifications such as industrial security, oversight certification, and many others. So these are some things that industrial security professionals that work for an FSO or an FSO can um inspire to get. Once again, the removal of classified information in an unauthorized manner. You know, finally approval from the cognizant security agency is necessary once the plan is complete. Not only that, so the cognizant security agency or office is DCSA, but it also might need to go for you from your government contracting activity or you know, program executive office or whoever your government customer is. And so the FSO should also look into their security organization to address any internal growth. They could conduct research on where the largest growth potential uh concerning classified holdings would come from. Some resources or tools would be maybe perhaps an inventory database where classified information is logged in. Such information could be you know used for a quick peek at where the company is in five years at the current growth rate. You know, so for example, if the current growth rate is in DVDs or or some kind of storage, you know, these are much smaller and thinner than a 500-page document that has been printed out. So it's easier to project the right type of growth if you knew where the growth is coming from. It would be terrible to buy um large bookshelves at hundreds of dollars or maybe thousands of dollars each when you don't need that much room because all of your growth is in some site, some sort of computing media. So, you know, the database research can prevent hasty and accurate and inaccurate decisions. For example, an untrained employee might assume that growth would be require the additional storage shelves for paper documents, as I mentioned earlier. But you know that the security department may be generating and receiving more DVD media and fewer paper products. And again, this example would have you ordering the Rollin type of material. So the uh the security staff should be trained on how to project growth and costs. So then the entire security department or one person, you know, if the FSO is just one person deep, or if they have a whole team, they need to dig deep to find the information that they need. A good database can break down inventory by year, by quarter, or other necessary date range useful for the projecting of future needs. This research could help identify classified information that can be destroyed or otherwise eliminated from storage, and would of course free space and save expenses for future storage and inventory. You know, a move like this can save tens of thousands of dollars annually in employee and storage costs. So again, consider the cost before you make any plans. And uh insert FSOs should insert themselves in strategic planning and corporate executives and business development teams should require request the assistance of the facility security officer in strategic meetings, especially if it talks about um growth or increase in classified contracts. As a manager of a vital business department, the FSO should be credible and influential in their decision making. When the FSO does save on costs by reducing time, saving electricity, or finding other alternatives while remaining compliant to the National Industrial Security Program operating manual, these cost reductions should be reported as a success. So, you know, in conclusion of this discussion, understanding the costs, contribution, and business helps the FSO gain credibility with executives who value their input. They can be found at www.missiondrivenresearch.com. And Mission Driven Research is a growing company providing technical services to U.S. federal government. The goal of MDR is to continuously improve performance in three core values. This mission focus is the core of MDR and fosters a highly satisfying work environment, motivating employees to excellence. And so if you get a chance, go by there and visit their website at www. So we just talked about something very strategic, such as budgeting and planning ahead. Well, let's talk about something very tactical, such as some of the skills and tasks that security department people should have. And this is one I love is the end-of-the-day checklist. Is this a check-the-block thing or is this something that should be looked into and practiced? For example, um many people take the end-of-the-day checklist and apply it according to NISPOM, which says, you know, if you have work shifts, you need to do an end-of-the-day checklist when the last person leaves. I paraphrased it, but end-of-day checklists are to be performed at the end of the work day. So this means at the end of a shift when everything before everything gets locked down and everybody leaves. If there are continuous 24-hour operations, there is no need for an end-of-the-day checklist. So so the end-of-day checklist is to make sure that classified information is locked up prior to everybody leaving so that it does not fall into the wrong hands. This is a very serious act that a lot of people don't um really enforce. Um plays a critical critical role in protecting classified items, as well as it can be applied for safety, health, and welfare, and um the protection of proprietary, maybe even company-sensitive material. The end of the day checklist is a procedure that's required, as we talked about by the NISPPOM, and other federal agency regulations. However, this should be implemented in any situation where privileged or sensitive items prove vulnerable to theft or espionage. And again, it can be applied as a safety precaution, such as to make sure things are unplugged, windows are closed, alarms are set, um, the coffee pot is turned off, for example. So it is intended for the last person leaving to conduct the security check. However, as a standard practice, usually a person is assigned to do the end-of-the-day security check well before the person who is working late every day wants to go home. So keep that in mind. Um you know, we always talk about the insider threat as the person that comes in the earliest and stays the latest and makes extra copies. So keep that in mind when the person assigned as the end-of-the-day security checker is leaving before the last person ever leaves. Sometimes the last person leaving is not the one doing the end-of-the-day security check. So keep that in mind and adjust properly. The checklist should be signed daily, but it should be not signed not just for the sake of compliance or just checking the block. The signature should only be annotated as a result of completing the activity. Okay, so let's talk about check the block. Okay, I had a discussion with a security employee who indicated that they signed the end-of-the-day checks because only because they're required to do so. We'd observed him walking up to the SF 701, which is the end-of-the-day checklist, checking the boxes indicating that the coffee pot had been turned off, the windows had been locked, the printer and the desktops had been cleared of sensitive items, and the security container had been locked. However, they never actually performed the checks. They just shine signed the sheet. So at the end of every work shift or prior to leaving an area where sensitive items would otherwise be left unattended, employees should ensure that the security checks are conducted. And of course, this means physically checking the items, walking up to trash cans, making sure there are no classified items in there, walking up to printers, making sure that nothing is left on there, locking windows and doors, not just saying that you checked that they were locked, and implementing physical security procedures. So each activity should be performed with equal enthusiasm as on the first day on the job. The checklist provides such a tool to ensure classified information is not left out for unauthorized observance or theft or we call it unauthorized access. So our security roles can easily become routine. If we lose focus, this lack of focus could lead us to forget why we are there and what we are performing on. We as security managers, or we as clear defense contractors work on classified contracts, are pointed to implement and direct security programs. The second part of our job description is the most important to protect classified information. Unfortunately, too many people believe they're there just to pass an inspection. So I hope that motivates you to do the right things. Sometimes it just happens. In spite of living a life above reproach, you have an event that could put your security clearance in jeopardy. But before you discuss it with anyone at work or your FSO, contact Ron immediately for help to self-report in the best possible way. You can call Ron at 256-713-0221 or visit his website at www.securityclearance defense lawyer.com. Wow. Have you ever been in a circular discussion where nothing is solved? You just keep going around and around while you're either trying to teach something or somebody's trying to teach you something and you're refusing to learn it, or you just can't comprehend. I had such a discussion when I was trying to teach somebody how to secure a closed area when it was temporarily uninhabited. Basically, somebody kept leaving a closed area unsecured when they went to lunch. And it went something like this. What defines this room as approved for open storage? I had asked while consulting on a project just a few years ago. I had been in the middle of a deep security application discussion with some employees, and the whole time I realized that the security employees I consulted with understood their responsibilities, but did not know why the security measures were in place or where to find that guidance. And so I realized as we discussed, they were lacking on skills and understanding. They told me that this is this area is approved for open storage. So when we leave, we don't have to set the alarm or spin the dial. They said again, I had observed them leaving for lunch and just Shutting the door. And I said, Well, so does that mean yet your document control people in the other area can leave their safe open as long as they shut the door to the office? You know, I'd asked that, trying to pick up on their logic and try to make sense. But they said, no, they're not approved for open storage, they have to lock the security containers in their office prior to leaving them unattended. So again, if you're familiar with the situation, you know what I'm talking about. If you're new, I'll kind of explain a little bit. Closed area means that you do not have to have a what you call a safe. It is a GSA approved container. In the closed area situation, the room is the GSA-approved container. So there's no need for to have additional safes inside the room. You can keep that classified information at the right level on a shelf. All you have to do, all that's required is that when you leave that room, that the door, that the room and the door are certified to protect classified information, and it has the right type of lock, the right type of material, and it has the alarms, cameras, and physical security measures in place to protect that classified material. When you leave that room unattended, doesn't matter if it's 10 minutes or not, you should lock that door and set the alarm. So I was trying to make the argument that, hey, if you're in a room that has safes in there, those safes are what's protecting that classified information. So if you leave that room, you have to lock and close the safe. And so they were not getting the connection. So the story goes further. I said, correct, classified items should be secured prior to leaving the area. However, an area approved for open storage should be secured before ever leaving for any duration of time. That means that you set the alarm, spin the dial of the combination lock prior to leaving for any length of time. Not just after hours, but when you go to lunch, when you go to the bathroom. So I asked them, what defines open storage? And I could see they were having trouble with this one. Open storage, they said, is simply having the government permission to keep classified information on shelves. They continue that, however, only as long as it contained in an area or in an approved room that can be secured with a GSA approved lock and approved alarms. And they said during working hours, the supplanting access control devices such as badge readers and pin numbers or biore readers are employed. I said that's right. And they agreed with me. But I told them, you know, you say that now, but you didn't say that earlier. You said that you could just shut the door and leave for lunch without locking it or setting an alarm. We can, they said, because it's approved for open storage. And around and around we went. So how do I fix that? What is a fix in such situations? Well, doing just what I recommended to the security manager because I went and visited their boss. The industrial security is a complex profession. There are many, many moving parts that require in-depth thinking and proactive protection measures based on threat assessments, vulnerability assessments, risk assessments, operational security. You should develop security training and certification for the security employees and clear employees working on classified information. So there can be no instance of misunderstanding, and everybody understands what their roles are. So if the company is a clear defense contractor or a government agency, set its side time to train them on security measures to protect classified information. This could include program presidential executive orders, the NISPOM, agency policies, DOD documents, whatever. You know, develop the employee certification that can be validated, especially concerning new employees. And then so only after they have proven that they understand how to protect security, support a security program, I'm sorry, that's designed to protect classified information, then they can be turned loose to do so. And as a manager, I recommend that you be curious, ask the right questions, so that you know what declared employees are thinking and how they're applying that knowledge to their jobs. You know, once you do, then you'll be better postured to help clarify the security requirements. Well, that's our discussion for today. We appreciate you being here. And you know, as a way to support us, I invite you to go to www.redbikepublishing.com, and there we have security books and training that that address these specific topics that we talk about on our podcast. And please come back next time, subscribe to our podcast so that you'll be notified when the next podcast is coming out. And by all means, research our library, listen to our past podcasts, because we're glad you're here.