The FSO budget, classified meetings, and introducing new material into the cleared defense contractor facility

In the course of performing on classified defense contracts, exchange of classified information is inevitable. While, the movement of classified information outside of a secure environment is to be kept to a minimum, there are times it must be moved in fulfillment of requirements.
As the senior industrial security manager in CDCs, the FSO leads the security program designed to protect classified information and prevent unauthorized disclosure. While working in the secure environment, contractors protect classified information under their control and cleared employees protect classified information entrusted to them.
Classified Meetings:

Prior to the start of a classified meeting either the government sponsor or the contractor representative should provide a security briefing notifying attendees of the classification of information to be discussed, whether or not taking notes is permitted and if so, how they will be controlled. For example, when classified notes are permitted, they will have to be properly marked, introduced into accountability and prepared for dissemination (hand carry with the attendee or mailed at a later date). The presentation is controlled to prevent the inadvertent and unauthorized release. Each attendee should also be reminded to remove any cell phones or other electronic devices.
In the National Industrial Security Program Operating Manual (NISPOM), we have a similar package "reveal". Security specialists, document control professionals, facility security officers and others in possessing facilities may receive classified information, depending on the contract. Part of the receipt is the critical inspection of the package during the integration process. 

As they unwrap the package, the inspector is orienting themselves to better understand what they should be receiving. This begins by inspecting the package physically, then comparing the contents with the receipt. They are also searching for evidence of tampering or to otherwise to inspect that there has been no compromise of classified material since leaving the sender’s organization.

I also recommend using current NISPOM for security training and ISP® and ISOC certification.

Resources:
How to Get U.S. Government Contracts and Classified Work.
Insider's Guide to Security Clearances
Security Clearance and NISPOM Training

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

Welcome to our podcast, DoD Secure, and I'm your host, Justin, welcome back to another episode of DoD Secure. Talking about being clear defense contractors, security clearances, getting government contracts, and performing unclassified contracts. And we're so happy that you've joined us today. In this episode, we're going to talk about classified packages, how to receive them, classified discussions, and how to prepare your organization for growth. Again, we're glad to have you and let's get started. You know, in the course of performing on classified defense contracts, the exchange of classified information is pretty much inevitable. You know, while the movement of classified information outside of a secure environment should be kept to minimum, there are times when it should be moved in fulfillment of contractual requirements. Again, this movement should be kept to the minimum amount possible. But when necessary, the party responsible for transmitting the classified information should be determined whether or not that information is necessary at the gaining organization or that the organization is cleared at the appropriate level. And of course, there is an actual or contractual need to know. As a reminder, we just don't send secret documents, for example, to anybody who has a secret clearance. They should also have the need to know. And usually that's found on a contractual basis. So that's the responsibility of the holder of the classified information. So once that need to know and classification level is determined and is acceptable, then the preparer or the holder of that classified information should be provided, should provide that information in the appropriate format using approved methods. For example, if a secret document that is printed out can be hand-carried, it should be provided on a disk, it should be emailed, or it should be faxed. So that's some of the tasks that you should be thinking about. Once the classified information is on-site, the receiving clear defense contractor takes over the responsibilities. And there are many reasons for transporting classified material, and these include conferences, classes, engineering requirements, services, or other environment where there's a contractual need for it. Some examples of transmitting classified information could be from a prime contractor to a subcontractor, from a government program office to a prime contractor, and etc. As long as there's a contractual need and a justification of it, it should be done. But again, as a last resort. The senior industrial security manager and clear defense contractors, these are mostly called facility security officers, they lead the security program designed to protect that classified information and prevent unauthorized disclosure. Now, some of you who may be in our audience may be a full-time facility security clearance officer, I'm sorry, facility security officer, FSO, or they could do it as part of their regular duties, such as the owner of a company pulling these duties. And in these cases, your job just got busier. So you want to do this in the most efficient mean way possible. So when I say FSO, I'm talking about anybody who has this responsibility, whether it's a full-time responsibility or as needed. So while working on the secure environment, contractors should protect classified information under their control, and cleared employees should protect classified information entrusted to them. You know, without this trust and this protection, the national security could face varying degrees of damage depending on what information is disclosed and how it was used. This protection applies to all documents as well as classified discussions. I'd like to take a moment to recognize one of our sponsors, and that's Mission Driven Research. And they can be found at www.missiondrivenresearch.com. And Mission Driven Research is a growing company providing technical services to U.S. federal government. The goal of MDR is to continuously improve performance in three core values. This mission focus is the core of MDR and fosters a highly satisfying work environment, motivating employees to excellence. And so if you get a chance, go by there. Visit their website at www.missiondrivenresearch.com. Okay, so I want to tell you another reason that you might be able to might be bringing classified information into your facility is classified discussions. Now classified verbal communication should only occur in controlled environments. For example, a classified conversation might be authorized in locations where access and need to know have already been verified and approved. They should never take place in hallways, in commons areas, like water coolers around the microwave, in public places, or even car pools where you know everybody in there works on your project. Y'all might have security clearances and need to know, but eavesdropping is possible. And so that should be prevented. And access, you know, it should be prevented so that you're not communicating in areas where people who don't have access, the security clearance or the need to know, might overhear. Because then that's a spillage. Unauthorized access to classified information has just occurred and it will have to be investigated and reported. So just as the holder of classified documents verifies a receiver's need to know and security clearance before handing this classified information over, the same is true for somebody who's going to talk about classified information, you know, give classified information in a verbal form. So we've already talked about, you know, how to ship or hand carry classified information. Other things to consider are classified faxes, um emailing classified information, and those we can talk about later. Right now we're talking about verbally communicating classified information. One area where it is authorized and best controlled or should be is in classified meetings. Classified meetings are better controlled and they are approved by a government customer or prime contractor. It should not be haphazard and just put together. It should be approved and planned well in advance. And this planning includes you know how to verify your attendees have clearances and need to knows, and what information will be presented and what form will it be presented in. Will it be a slideshow? Will it be a classified discussion? Only what materials might be needed. So prior to the start of a classified meeting, either a government sponsor or the contractor representative should provide a security briefing notifying the attendees of the classification of the information to be discussed. Whether or not note-taking is permitted, and if so, how will that note-taking be controlled? You know, for example, when classified notes are permitted, they will should be properly marked, introduced into an accountability or control, and prepared for dissemination. So the holder of that classified information should determine you know, are we going to wrap these contents up so people can hand carry them, or are we going to mail them at a later date? You know, are we going to image them and send them via email? So those things should be determined well in advance. The presentation should be controlled to prevent the inadvertent and unauthorized release of that classified information, either verbally or in document form or material form. Now each attendee should also be reminded to remove any cell phones or other electronic devices that may capture that classified discussion. So then there are those less controlled items such as impromptu discussions. So sometimes when working on classified material, even in an approved location, employees should keep in mind that uncleared persons in the area may be within voice range or within earshot, as we might say. Some companies and security managers may allow cleared employees to take classified work back to their cubicles and their desks and work on them temporarily there. And they should be able to protect that information from prying eyes, but eavesdropping is also a concern and it should be prevented outside of a closed area. Hi everybody, I want to introduce you to a brand new sponsor. We're so glad to have Access Commander by MathCraft. At Access Commander by Mathcraft, we believe security risks and lack of compliance are threats to a business and its people. We strive to provide our clients with the tools they need to stay compliant and prepare for the next generation of threats. Through comprehensive training, support, and customer resources, we transform our clients into security professionals with the know-how to defend their organizations and maintain comprehensive security programs. We support the mission of the FSOs, CSOs, and other security professionals who stand at the front door of our nation's battle against foreign domestic threats. With software designed to the latest federal standards, we help them to strategize, speed up self-auditing processes, create new workflows, generate reports, and retrieve tactical information at a moment's notice. For more information on ways we can help, visit www.mathcraft.com or call us at 703-729-9022. Also, you should limit opportunities for unauthorized access to classified information by limiting opportunities for these discussions. Imprompt 2 discussions should provide un could provide unauthorized employees access to classified information. This can include repair persons, uncleared employees, and others that might be in an area. For example, while everyone in the middle area may be cleared and had the appropriate need to know, somebody could be on a telephone with an uncleared people. I've seen this handled in many ways, you know, with warnings that, hey, the phone is off the hook, limit your discussions, or no phones in the area at all. Another factor to consider is the need to know. While everyone within Earshot may have the appropriate security clearance, they may not be working on the same contract and may not have the need to know the classified information you could possibly discuss. So here's three ideas, or even more. I'm gonna give you like five ideas that you can apply immediately. One is post signs where classified contracts and discussions are authorized, and likewise where these discussions are unauthorized. Another idea is to provide reminders, post them in the areas where work is being conducted, of the dangers of impromptu conversations. Also provide training and guidance on how to introduce classified information to your organization, and this could also cover verbal communication of classified information. So there, there's a few ideas of how you can immediately apply this. And again, we have training at Bennett Institute that goes more further into how to protect classified discussions. And if you want to know more, go to your NISPOM, the National Industrial Security Program Operating Manual, and visit chapter six, which discusses classified conversations, meetings, and other such events. We also have the NISPPOM available for purchase, it's printed and has a nice cover at redbitepublishing.com. Sometimes it just happens. In spite of living a life above reproach, you have an event that could put your security clearance in jeopardy. But before you discuss it with anyone at work or your FSO, contact Ron immediately for help to self-report in the best possible way. You can call Ron at 256-713-0221 or visit his website at www.securityclearance defense lawyer.com. Hey, let's change topics now. You know, last week in our newsletter we sent out an article on how FSOs can be more effective, you know, reduce costs, be more effective in their application of their security programs. So a facility security officer, again, the FSO, should put careful consideration into their security budget. Now, this is a primary opportunity in the continuing plan of building that FSO credibility so that you know if the FSO is not a higher level manager in the company in the hierarchy, they may be able to catch the ear of that higher level manager and be taken seriously and get emphasis put on that security program. The FSO who arbitrarily throws in a number with meritless facts is sending the wrong message. You know, for example, you might say, I need to put in alarms to protect our classified information, but there is really no need to put in alarms because it's not a requirement in the NISPOM for secret and below, um, in many situations, as long as you have the GSA-approved container. So a more thoughtful approach might be to discuss the financial benefits of alarming your company based on the risk to your company in the local area. And we've got more discussions on how to do that, how to do a risk assessment to determine if there's any additional requirements above and beyond NISPOM. But that should be a risk-based decision and discussed appropriately. A well-thought-out line item count based on risk management, company mission and NISPOM requirements is more apt to impress and build instant respect. The budget contribution should enforce and support a message that the FSO is constantly communicating. And the budget request should not be, you know, not be the first time that executives uh are introduced into the budget figures for the security uh program. Management will support or the management support or lack of support you may be get demonstrates either well-received or an unsupported security program. You know, the intuitive FSO, they should understand the business of the company, the company mission, how the role of protecting classified material fits there. You know, you've got your you've got to balance the requirements of NISPOM with how your company executes their classified contract. And they've got to fit very well because it's not a one-size-fit-all. Fits all. It should be discussed and exercised. In a proper environment, the FSO provides a risk assessment based on the threat appraisal and speaks intelligently of the procedures, equipment, and costs associated with developing that security program. For example, an FSO understands how to contract security vendors to install alarms, access control, and other life safety and protective measures. FSO should be able to demonstrate how the expense will benefit the company, either in cost rescuse me, either in cost reduction or other tangible results. For example, I wanted to put um access control in my in my buildings where I was an FSO at one point. The uh leadership, um, I was new there, so the leadership did not want to put those controls in place. They didn't feel like they were necessary. So I went and did this uh a study and a risk assessment, and I found out a shortcut to be able to communicate my message efficiently. Um we we worked in a factory, and classified processing was not done in that factory. However, classified processing was done elsewhere in that building. So they were trying to say they did not fall under NISPOM requirements, and it may have been true, but what we had was a factory where it had eight doors in it right next to each other, but the doors access were not controlled, so we got a lot of people off the streets. We've had trouble with ex-boyfriends, ex-girlfriends, pizza delivery, truck drivers just walking in and causing some trouble. But the managers handle it appropriately, and so it wasn't a big deal. But I wanted to um put some controls in place so that this wouldn't be a regular occurrence. And to make a long story short, I was able to get those access controls put in and limiting access to one door per building instead of eight. And I did this by showing a cost reduction in heating and air conditioning. Um the cost reduction turned out to be greater than the cost of the actual access controls. So that was a win, and hopefully you can take a lesson from that. Now the FSO should present the budget in a matter in a manner that you know all business units can understand and support. For example, if part of the budget line is to provide access control, such as I did, there's a significant associated cost. You know, incorporating the management involvement and better and and their support builds that credibility that you need and puts a company in a better position to provide the funding. You know, not only is a projected return on investment required, but due diligence should be conducted, you know, so that there is no loss and you can show demonstrate that these are countermeasures that are needed to protect the classified information and the employees. So some sample questions that may help you build this up and that the FSO can use to prepare for their budget is you know, why is access control necessary? You might say, well, it prevents unauthorized persons from entering the premises and provides an extra layer of protection for classified and sensitive information. So it's an extra layer above and beyond what is required by NISPPOM. What happens if we do not implement these access controls? So the organization could have to commit persons to controlling the access to the company, and in my case, that's what it did. A manager's salary was between $20 and $30 per hour, and this became expensive over time because the managers were required to check the doors multiple times during the day and it brought them away from their other duties. And I was able to demonstrate that the cost of the access control, against the time the managers take to ensure that you know the doors are being closed properly, and and it reduced the cost of having somebody having uh necessary to observe those doors. So, what is the return on investment for access control? The intangible return, which this was the answer I came up with, the intangible return on investing is the prevention of damage, injury, theft, and other risks inherent to the unauthorized visitors. More tangible is the amount of energy saved while keeping the doors closed and saving the energy. In one study, I found out that the estimated cost reduction of $12,000 per hour. Um I'm sorry, in one such study, I found that the cost reduction was $12,000 per year. And that was the reduction in the um electric bill. That was a little bit more expensive than the access control cost to install. Other questions might be around for the FSO that they should answer depending on you know their situation and who they work for and what kind of answers might be needed. Um and sometimes the vendor that you're talking to to provide the access control in this example can provide statistics and cost reduction advice that you might need for your budget. So speaking the language of the business will best serve the FSO well and ensure that the executives understand the significance of a well-supported security program. Security managers who just quote regulations or use best practices with you know without getting much thought into the cost or talking points may quickly, you know, lose their credibility. So there's some other things to think of. I talked about the last podcast, um, the the new NISPOM requirements that are coming out. Um and this could add to the costs or add to resources and time that the FSO should consider in their budget, is now the new reporting requirements that um includes the contractors submitting reports um and uh that address the SEAD three requirements that I discussed last time. And these reports include reporting ahead of time anything that conflicts with the 13 adjudicative requirements, you know, such as foreign influence, um you know and this includes now we have to report ahead of time anytime we visit for any reason any other country. So that's gonna add an extra layer of reporting requirements that you didn't have to do before. So not only should the FSO be astute in business practices, but they should also be able to predict where we are going in national security and what reports might need to be done. So again, I hope this uh podcast has been very helpful to you. If it has, I'd encourage you to join our newsletter. And you can go to redbike publishing.com and scroll down and fill out our form, and that will get you plugged into our newsletter. Again, we don't take donations or anything like that. Uh I don't charge for this podcast or newsletter or anything, but if you'd like to support our show, please consider visiting our training at Bennett Institute.com or our NISPOM Products at Redbikepublishing.com. Again, we would love to hear from you. A good uh point of contact for me is editor at redbikepublishing.com. Red B I K Epublishing.com. So that's it for our podcast today. I hope you have a great week and we will catch you next time. Thanks again for visiting DOD Secure.