While Facility Security Officers, government and military employees do an incredible job at training employees, implementing and directing security programs to protect classified information, a more menacing threat is still left unchecked.
The security industry spends terrific amounts of money fortifying and constructing buildings based on best practices and not entirely on a risk assessment. The NISPOM and other regulations advise on focusing protection and reducing costs. However, without a proper risk assessment, they may fall short of meeting legitimate threats. The current practice makes it very difficult for someone to break in and steal secrets. In light of addressing best practices, the main threat should not be overlooked or neglected. For example, when was the last time you read of buildings being broken into and safes blasted open or being cracked to obtain our nation's secrets? Facility security officers and industrial security professionals should develop measures to safeguard classified information at the highest level indicated. Employees should be trained to perform on these contracts based on NISPOM Guidance. This training includes:
A buzz is sweeping the security community since the industry has been notified of the recent updates to DoD's CUI program based on the presidential memorandum with the subject, Designation and sharing of Controlled Unclassified Information (CUI). This memorandum implements a program designed to encourage the speedy sharing of information to those authorized and to better protect the information, privacy and legal rights of Americans. The CUI program is designed to promote proper safeguarding and dissemination of unclassified information.
Many readers may be familiar with the program CUI has replaced. Sensitive But Unclassified (SBU) information had enjoyed protection to a certain level but was not conducive to the necessary information sharing. Controlled Unclassified Information (CUI) directives provide procedures for a more appropriate Information Sharing Environment.
The Trusted Advisor for Technology Protection, FSO and NISPOM consulting.
After dialing in my craft and many years of honing program protection experiences, I became a trusted advisor. I am currently supporting customers with technology protection and NISPOM compliance topics.
INDUSTRIAL SECURITY TRUSTED ADVISOR
What Trusted Advisor Involves: I partner with executive leadership to design and operate security programs that meet and exceed NISPOM requirements.
Results you can measure immediately:
Prepared commercial organizations for defense contracting and NISPOM compliance
Designed ready to implement security programs before, during and after facility clearance award
Rescued high risk security programs with quick turnaround; usually within 30 days
Achieved Commendable and Superior DCSA review ratings
Developed compliant FOCI mitigation programs
SPEAKER_00
Welcome to DOD Secure, and I'm your host, Jeff Fed. All right, this is where you get the latest and greatest on the National Industrial Security Program, as well as guidance for clear defense contractors on how to get security clearances, how to get classified contracts, and perform on those classified contracts, as well as establish security programs to protect classified information while you are doing it. So today we have a few topics to discuss. Primarily, we'll be looking at controlled and classified information. We'll talk about clear defense contractor performance and how to protect classified information. These are some fundamentals that you might need to know. Protecting classified information from insider threat. And finally, we'll be talking about what defense contractors should consider before appointing their facility security officers. Great topics for discussion and pretty much typically what we discuss at this time. So while facility security officers, and I'll just use the term FSO, and these are what clear defense contractor organizations must establish or appoint. This is just a position. You don't need to hire a new person to do this job unless you know the work requires an additional employee to do the job. Many people assign facility security officers to another individual who already has other work to do. So here at Red Bike Publishing, we like to identify those tasks as well as make your work easier by doing some of those tasks for you. And so I want a big shout out to the people who emailed me throughout the past month and allowed me to help them with their security clearance as well as their National Industrial Security Program operating manual or the NISPOM compliance questions that you've had. Thank you for trusting me to answer those questions. And if any of you have questions out there, I can be reached at editor at redbikepublishing.com. Or if you go to my website, redbikepublishing.com or my new website, Jeffrey, J E F F R E Y, W Bennett, B-E-N-N-E-T-T.com. I have contact information there. So facility security officers, the government, and military employees do an incredible job of training their employees. It's a big job, and there are many requirements. There are at least four basic training requirements that every clear defense contractor must do. Implementing and directing security programs to protect classified information is another part of their job, as well as dealing with a more menacing threat that is still left unchecked. And that is, first and foremost, foreign actors who would like to get our information, as well as the insider that they coerce to get that for them. Now the security industry spends terrific amounts of money. They're trying to fortify and construct buildings based on best practices, and maybe not entirely based on a risk assessment. And I'll give you an example. They're fortified, the construction is tough, there are alarms, there are guards, many other countermeasures to keep outsiders from coming in and stealing that gold or the money. Nothing is foolproof, but I totally agree that they should be focused on keeping bad guys from breaking in. But we also know that that's not the only threat. Um, that is a great opportunity because these buildings are pretty much not government buildings, maybe Fort Knox is, but the typical bank is not, so they're left to their own devices to defend their bank. And so, yes, please build up your infrastructure. Um but what if that's not the primary threat? Are you spending more money than you need to protect developing an infrastructure where your risk assessment um clearly indicates that your biggest threat is not somebody trying to break in, but somebody that is already working there, that has their badge card, the the badges and certifications that they need to get inside and walk out with your information. If you look at the spies that we've had in the past that have been caught, they've all been insiders. They've all been entrusted to that information and walking it out. However, they have not been um many cases of somebody breaking into a secure facility. Um I'm going back to clear defense contractors now and not banks. Banks, I think, is good for them to have these big um countermeasures in place. Uh, but I believe for clear defense contractors, you should do a threat-based risk assessment on what your security in debt looks like. Um I believe a more adequate risk assessment would indicate that your biggest threat is coming through cyber attack or through an insider. So um that's what I would recommend focusing your security efforts on. Now the NISPPOM and other regulations that we're looking at for um clear defense contractors advise on protection and reducing costs. It requires a risk assessment to be able to do this. They may fall short of meeting legitimate threats if they not take an adequate look at what their risk is. The current practice makes it very difficult for somebody to break in and steal your secrets. I I'm I'm I'm I'm agreeable to that. Um, in light of addressing these best practices, the main threat should not be overlooked or neglected. So while you're focusing on your physical security efforts or security in depth, you you need to take a good look at w how you are going to address the insider threat or the nearsider threat. You know, those people who have access but they're not unlimited access to your facility. For example, when was the last time you've read of a building being broke into and safes being blasted open or being cracked open to um get our national secrets? I don't recall many of those. I imagine I could find some, but again, it's the insider threat. The case studies and departments of justice records, where I do my research, um, they fortify the argument that the entrusted employees or insider threats are most probable. And in this case, our secrets are walking right out of our fortified doors. Um the bad guy can't get in, plenty of good guys can get out with the information that they're not authorized to bring outside. You know, the threat, as indicated by um the articles that you'll read or that you'll hear about in this podcast, is well delivered through employee commission or omission. The employee or insider makes up a majority of the root causes of unauthorized disclosure. You know, that being the case, more training emphasis should be focused on preventing unauthorized or inadvertent disclosure. So maybe you're not you're you're not training the uh insider to not do what they're doing, you're training other people to observe questionable behavior by insiders or recognize when they're being contacted by a bad player. Um, and that's why we have the continuous evaluation process. We're looking at ourselves, we're looking at other cleared employees, and we're checking our behavior. Has anything happened within our lives that would make it make us susceptible to um being coerced to provide classified information or even controlled unclassified information in an unauthorized manner? And these are the things that we should be reporting. You know, our businesses um in as a clear defense contractor continues to grow as our customers require more and more of our products and and services, and we're very grateful to our customers, whether it be a prime contractor or the government. So um please check us out, come back to this podcast, join our newsletter, and you'll get more articles about this. Alright, so let's talk about uh controlled unclassified information. You know, controlled unclassified information is different than classified information. At least with classified information, it's marked appropriately. You know that if something says confidential on it, secret or top secret, uh they need to be protected as those um classification levels require. And again, that guidance is found in NISPOM for clear defense contractors. But what about controlled unclassified information? It's harder to identify, but new guidance in uh controlled unclassified information used to be called sensitive but unclassified, FOUO, many other names you might recognize this under. But this is classif this is information that is not classified, but it is required for performance on contracts with the government. And it could be intimate details of how a program is uh run or how the weapon system is acquired, and consists of many, many uh different types of information that should not be publicly available. Additionally, um items that fall under controlled unclassified information may also fall under exports compliance. You know, they may fall under the ITAR, the Intert International Traffic and Arms Regulation, or the EAR. Uh both of which, um, if the item falls under there, cannot be exported without a license. So it's very important also to treat controlled unclassified information not only recognizing that it might be ITAR controllable, but also that it should not be shared outside of the contract agreement. So this is again sensitive information that has something to do with a government contract, and it could be numbers with budgets, personnel actions, um, acquisition strategies, uh intimate details about a weapon system, or whatever. These should be identified and marked appropriately. So we're talking about it a lot about CUI and what I want to understand, what want this audience to understand, it is your responsibility to know what is CUI in your contracts. The government may not adequately spell it out. And I'm saying that because this is so far a very immature um requirement, meaning your customers will probably be catching up and marking their information appropriately. Um controlled and classified information, in my opinion, should also be identified if there is a security classification guide. If the contract is unclassified, um you may get additional information outside of a security classification guidance on how to identify and protect it. But if unsure, always ask. That way you're protecting it adequately. So as this gains momentum, uh we're going to have to apply it more and more in our clear defense contract to organizations. Now the um designation and sharing of controlled unclassified information or CUI is a memorandum put out by um the president. This memorandum implements a program designed to encourage the speedy sharing of information to those authorized and to better protect the information, privacy and legal rights of Americans. So in addition to preventing unauthorized access to this controlled and classified information, the intent is to break down the barriers between agencies and organizations who might well who might mark their um information differently and to a standardized marking so that um the barriers to sharing are removed. Everybody gets on the same standard, and now we have a way to manage and disseminate this controlled unclassified information. And if you think about it, it's similar to what is described in the original classification authority's ability to designate what classified information is. So this is a similar process where the customer should be identifying what is controlled and unclassified information based on a set of criteria. One, it has to be owned and operated by the US government. And two, CUI needs to be easily identified so that the proper protection measures can definitely be put in place. So, what does this mean for clear defense contractor businesses and government agencies? And now a special message for our listeners from our proud sponsor, Sims Software. As Clear Defense contractors, you represent the backbone of innovation, the front line of our national security, and protectors of all that we hold dear. SimSoftware is proud to be your ally in these endeavors. As the most trusted name in industrial security information management for over 38 years, SIM Software equips you with tools to protect the lifeblood of your organization. Our flagship SIMS Suite provides all the features and functionality you need to run an automated, paperless industrial security program. Gain a 360-degree view of every physical, virtual, and human asset inside of your security domain. From classified documents and materials to cleared personnel, facilities, visitor control, information systems, and more. SIMS supports requirements within all security communities. To learn more or schedule a demo, visit www.simssoftware. S-I-M-S-S-O-F-T-W-A-R-E dot com or call 858-481-9292. Now the next topic of discussion is you know how to protect classified information if you are a clear defense contractor. And it's much of the same, a little bit more stringent, of course, than the CUI. But you know, in the performance of classified contracts, the CDC, the clear defense contractors, will use classified information to get their work done. The Department of Defense makes rules and governs how that classified information should be protected. The federal government has put those protections out, as we've taught before, in a policy or procedures described as the National Industrial Security Program Operating Manual, or the NISPOM. Well, this page Turner is sponsored by the Presidential Executive Order 12829, and it discusses the protection of information classified under another executive order, which is 12958. And proper title is 12958 as amended. This is good information to know if you're practicing for security certification, so keep that in mind when I discuss these titles. Now having poured over both publications and the updates, I can definitely and confidently assure you that they take this business very seriously. And who does? Well, the Cognizant Security Office, which in most cases now, especially for the DOD, is the Counterintelligence and Security Agency. They can be found at www.missiondrivenresearch.com. And Mission Driven Research is a growing company providing technical services to U.S. federal government. The goal of MDR is to continuously improve performance and three core values. This mission focus is the core of MDR and fosters a highly satisfying work environment, motivating employees to excellence. And so if you get a chance, go by there. Visit their website at www.missiondrivenresearch.com. Now classified information is or how to perform in a classified information is specified in the DD Form 254 and as well as something called the Security Classification Guide or the SCG. Now the 254 tells clear defense contractors how to perform on classified contracts. It discusses whether or not the classified work will be performed on site or elsewhere. It also discusses the level of classification and more specific information is brought out in that DD Form 254. Think of it as a supplement to a classified contract or a supplement to a contract that discusses the classified performance. Now the security classification guide is usually developed by the government program office and it tells what is classified, specifically what elements of the work is classified, and it gives more information. Now and it also discusses how to protect that classified information. So both documents not only should be available prior to the execution, but should be read and understand and understood by the performing employees. And I always recommend when security training is being conducted, it includes specific elements of the SCG and the 254 so that the training can be tailored to those performing on it. Now classified information again is marked with confidential, secret, and top secret. And these designations should be afforded the protection at the appropriate level. For example, unauthorized disclosure of confidential information could be expected to cause damage to national security. Secret is associated with serious damage to national security, and top secret, the most stringent, would cause exceptionally grave damage to national security. Now prior to discussing or providing any classified data, the cleared employees of the cleared defense contractor organization are required to ascertain the receiving party's clearance level and need to know. That means if you're performing briefings, handing over classified documents, allowing people access to classified information. Otherwise, it is your responsibility as that classified information holder to ensure that they have the need to know as well as a proper clearance level. Now that's important. It's up to the holder of the classified information. You know, that can be applied to our earlier discussion of controlled unclassified information. We're so glad to have Access Commander by MathCraft. At Access Commander by MathCraft, we believe security risks and lack of compliance are threats to a business and its people. We strive to provide our clients with the tools they need to stay compliant and prepare for the next generation of threats. Through comprehensive training, support, and customer resources, we transform our clients into security professionals with the know how. To defend their organizations and maintain comprehensive security programs. We support the mission of the FSOs, CSOs, and other security professionals who stand at the front door of our nation's battle against foreign domestic threats. With software designed to the latest federal standards, we help them to strategize, speed up self-auditing processes, create new workflows, generate reports, and retrieve tactical information at a moment's notice. For more information on ways we can help, visit www.mathcraft.com or call us at 703-729-9022. And in this information, the person holding controlled and classified information is responsible for ensuring who they release it to has a need to know. For example, let's talk about exports compliance. It is a responsibility of a person holding export information to ensure that it does not get into the hands of non-US persons unless that non-US person is involved with an export license. So if you are holding controlled unclassified information that is also controlled under export compliance, and you release that information in an unauthorized manner, you have just conducted an exports violation. So the holder of the controlled unclassified information as well as classified information must ascertain what information is releasable and whether or not the person that will release it to has a proper clearance and the need to know. Sometimes it just happens. In spite of living a life above reproach, you have an event that could put your security clearance in jeopardy. But before you discuss it with anyone at work or your FSO, contact Ron immediately for help to self-report in the best possible way. You can call Ron at 256-713-0221 or visit his website at www.securityclearance defense lawyer.com. So if you are the security manager, you know, whether full-time FSO or part-time facility security officer, you should develop measures to safeguard classified information at the highest level indicated. Employees should be trained to perform on these contracts based on NISPPOM guidance. And again, I recommend that they use the DD Form 254 as well as the Security Class Guide to provide additional training information to tailor it specifically for the job that they're doing. So training includes the non-disclosure agreement that all newly cleared employees should sign, derivative classifier training that all employees who work with classified information and provide a derivative product should be taking. Security awareness initial training and security awareness annual refresher training and insider threat. These are four training requirements identified in the National Industrial Security Program operating manual, and that will be inspected by the Cognizant Security Office, the DCSE. If you're interested, we provide these training topics that you can download and present to your employees at redbikepublishing.com, Red B-I-K-E publishing.com. So that is it for this episode and broadcast, and we're so glad you joined us and hope that you will join us again soon. Again, we'd like to thank our sponsors, Mission Driven Research, Sim Software, Ron Sixtus at Security Clearance Defense Lawyers, and Access Commander. Thank you so much for sponsoring this show and making the podcast the success that it is. And if you'd like to sponsor our show, you'll get access to sponsorship on our podcast as well as our newsletter. Contact me at editor at redbikepublishing.com. So until next time, uh please visit our website, redbikepublishing.com, jeffreywbennett.com, and Bennett Institute.com for the latest in security, clearance, products, and services. Of course, all the links to our sponsors can be found at this podcast links page.
