Classified contracts, security audits, end of day checks and metrics

Red Bike Publishing is pleased to announce the new NISPOM. National Industrial Security Program Operating Manual 32 CFR Part 117. 

 An FSO has readily available data to determine and communicate the effectiveness of the security program. Gathering available information, creating a detailed database and performing solid analysis will determine the program's success.

End of day checks serve as a precaution against leaving classified information unattended.

Feel free to contact us for information on how to promote your business through our newsletter.     

NISPOM Training Topics:

• Insider Threat
• Initial / Annual Security Awareness
• Derivative Classifier
• Non Disclosure Agreement

If you need assistance with FSO or security training please contact me or visit my consulting site www.jeffreywbennett.com. Additionally, we have NISPOM fundamentals training perfect for studying and applying to your CDC facility. https://bennettinstitute.com/course/nispomfundamentals/

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Jeff's Website
Jeff is available for speaking and consulting

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

Hello, and welcome to the DOD Secure, and I'm your host. And welcome back again to DOD Secure. We invite you to join our newsletter at redbite publishing.comslash contact, and you'll get daily tips and information on how to get security clearances and how to work on classified contracts and protect that classified information under your charge. Today's articles will talk about how to go through a DCSA audit, how to get a better rating during their review when they come through. We'll talk about using security metrics to improve your ability to protect classified information and reduce risks while you are performing on classified contracts. And finally, how best to protect classified information from unauthorized disclosure by doing end-of-day security checks. So all of this and just a little bit more by joining our podcast today. And additionally, I'd like to thank our sponsors. Throughout this podcast, you'll hear from them. And please join or visit our show notes, and we'll have links to our sponsors. I think you'll be well pleased with the services they provide. Now, I put this episode later out later than I normally do, and I've had some challenges uh with some personal tasks. Uh primarily I've been involved with building my 1969 Volkswagen bug. When I mean building it, I took it down to the lowest level and um scraped off everything, made it look new, ordered new parts, and now I'm in the process of reassembling it. Putting together the big pieces was really easy. The hard part I'm having now that the big pieces are put together are the intricate pieces that work together to make the doors open and close, to make the windows roll up properly, to make sure the gas flows from the gas tank to the engine. And so that's required me to look at every single part of this thing and make sure that I've put it back together correctly. And it has taken some time to do, and I am still working on it. And so another another thing I've been doing is I put out the most recent edition of the NISPOM, and it's the 32 CFR 117. You might remember last February I put out a podcast on how the NISPOM would not be changing, that it still applied until a new one came out. Well, that new one has been published, and it is available online at the CFR's website, and I'll put a link to that. Additionally, um I've made that available in print copy as I normally do with the National Industrial Security Program operating manual. So this supersedes all the other manuals. So if you have one of the older ones that you bought from us, I really appreciate that. But now a new one is available and you might want to put that in your library. And it's a good idea to make NISPOM available to all of your employees so everybody is on the same sheet of music with the training that you provide to them and improving your ability to reduce risk to. So one of the other challenges that come up with a new NISPPOM is now there might be a new certification test for some of you who work with classified information and are looking at getting certified either through the Industrial Security Oversight Certification or through the Industrial Security Professional Certification. So these tests may be soon updated with the new NISPOM information. I just want to say for the record that there are not any huge changes in how we protect classified information. For example, the training that you've received in the past still applies. By most part, then the new NISPPOM is just reorganized and with an addition of new information and the removal of some older information. This older information that has been removed has just simply been removed. It's the education that you've received on this information still applies. That information may find itself back in the NISPOM, but for the most part, you still need to retain that as you look through the NISPOM and look through the changes that have occurred. Understand that some of the details that are removed still do apply. They're just not listed as detailed as they were in the pre-existing NIST NISPPOM. Now there is additional information put in the NISPOM, but again, the training that you've received already covers this additional information. You'll see new information uh discussing a top secret um control, uh new guidance as far as travel reporting, and new guidance on um key management personnel. Again, it's new guidance, but it's not above and beyond what you have already learned. So having said that, um, all the NISPPOM training that is available still applies, and no need to discount that training that you've given or that you've already provided. The only big change is going to be is in if you refer to a part of NISPPOM, for example, NISPOM chapter three was about training. In the new NISPOM, there is no chapter three, and training is put in a different location. So administratively it has changed significantly, but as far as information, no significant changes except for the removal of explicit details. So let's go in to our uh podcast and talk about the first topic, which is talking about the the Defense Counterintelligence and Security Agency, DCSA, or some people say DICSA. Um, they have an award that they like to provide to clear defense contractors who earn multiple instances of excellences during excellence ratings during the uh DCSA inspections or the audits. Now there are over 13,000 clear defense contractors that DCSA reviews, and all of them do um meet the requirements for getting the award, but only four or five, even fewer some years actually get that reward. And these are the people that stand above and beyond their peers by doing additional um tasks to show DCSA that they are on top of their security management or their risk management for the classified information. Um they have a security risk management program that is worthy of such achievement, and you can bring provide this to yours as well. Many people are satisfied with the rating that they get from DCSA. Um, there are unsatisfactory ratings which you should not be satisfied with. There are repercussions for that, but um there are um satisfactory ratings and there are excellence ratings, and anything satisfactory and above are okay. For those of you who want to go above and beyond, this article may be for you. The hardest part is with the institutional training and getting the rest of the organization on board with the security program. So, for example, meeting on board, everybody understands what the security requirements are. For example, if an auditor walks around and asks you as the you know lead security person or whoever that might be designated in your company about their travel reporting policy, and the response is yes, we train everybody on our travel policy, and it's in line with DCSA requirements. But then uh DCSA walks around and interviews employees and notices somebody has a picture of recent travel and it has them standing in front of the Eiffel Tower with their COVID masks on, and the DCSA um person talks to them, talks about their trip, knows it's recent because they do have their um masks on, and then goes back to the security department and asks specifically about that person, about their travel, and find out there are no records of that travel being reported to the FSO, the facility security officer. Well, that is an instance where the um employee training is not in line with the DCSA requirements. So the organization that goes above and beyond in their training or above and beyond in their security program, everybody will understand that when DCSA comes around and interviews the employees, that that trip to Paris was all had already been reported and executed. Any tasks related to that trip have been executed by the FSO. So being prepared for the annual security inspection, if your organization falls under the annual security inspection requirements, um, you implement your daily security management process. And this is key to receiving that superior rating. One is cross-walking the security inspection requirements with the NISPPOM and with the company policies. An in-depth security process should include physical security, visitor control, security education, and it should be occurring throughout the year and possibly not just a one-time moment where everybody goes into a room and signs a paper. It should be tailored to the employees and their tasks. Now, some methods for this may include developing a security newsletter, displaying security awareness posters around the facility, and maybe sending security-related emails that remind employees about their reporting responsibilities or their responsibilities under NISPOM. And again, it's it's it would be more interesting and more effective to tailor your message, your risk-reduction message to the contract that the employee is working under. So self-inspection records, um, end-of-day checks, as well as organized personnel files, current DD Forms 254, and records management systems will boost your opportunity to and boost your ratings as well. In addition, an approved document control system, for example, if you're using an information management system and a well-managed computer security program, if that applies to you, will demonstrate excellence to your DCSA rep. And as usual, go to the DCSA website and find out what their criteria are. It changes. It just consistently changes. Uh any consistency there is that they do change. The requirements do change, but so does the tools that DCSA posts on their website. Um, there are excellent tools for those of you who are designated to manage the security program that will help you. And if you use these tools and document the use of these tools, that will improve your chances of getting that excellence rating and maybe being referred for the coveted Cogswell award. So all this preparation that you take can be in vain if you don't develop a partnership with your DCSA representative, the one that will be leading the inspection. And it's okay to have a partnership with them. They want you to do so. Here you can set boundaries, introduce them to your security program, and include them in some of your uh decision making, or include them in some of the decisions that you have made and documenting them so that when DCSA comes through, they won't have so many questions. They won't understand and comprehend exactly what your security program to protect classified information looks like. Again, we're talking government oversight of government classified contract information. It doesn't belong to the to the um cleared contractor organization, it belongs to the government, and so they are reviewing and auditing to make sure that you are performing as required. So make that audit job easy on them. So by developing a security program outlined in NISPOM and approved by your DCSA rep, um, organized and um worked out with your company leadership, the Cogswell Award is definitely a reachable goal for your company. Even if you're not getting the Cogswell reward, the the benefits of this collaboration is an excellence rating and confidence uh in your organization by DCSA that you are doing everything in your power to um protect classified information, and that will lead to you continuing to have that um privilege and possibly getting more business. You can also reach out to some fellow security professionals and join security organizations such as NCMS and ASIS and many, many others to further enhance your security program and your security knowledge. Now the process is very rigorous and thorough, but entirely worth the effort. And now a special message for our listeners from our proud sponsor, SimSoftware. As clear defense contractors, you represent the backbone of innovation, the front line of our national security, and protectors of all that we hold dear. SimSoftware is proud to be your ally in these endeavors. As the most trusted name in industrial security information management for over 38 years, SimSoftware equips you with tools to protect the lifeblood of your organization. Our flagship SIMS Suite provides all the features and functionality you need to run an automated, paperless industrial security program. Gain a 360-degree view of every physical, virtual, and human asset inside of your security domain. From classified documents and materials to cleared personnel, facilities, visitor control, information systems, and more. S-I-M-S-S-O-F-W-A-R-E dot com or call 858-481-9292. Let's talk about one of the most common cases of unauthorized disclosure, and that's um leaving classified information unattended. In many scenarios, cleared contractors um do perform classified work on site at their contractor location. And it is possible that in these situations that cleared contractors and cleared employees work alongside with uncleared employees, meaning that there are people with security clearances working on classified work, and in the same location there may be people that do not have security clearances. For example, you might have a group of engineers working on a classified contract building a widget for their government customer, and they have security clearances. But you also might have human resources or graphics artists or custodial staff working in the same building that do not have classified inform uh security clearances and don't have a need to know to see classified information. So, how do you prevent classified information spillage? How do you prevent these uncleared people from getting unauthorized clas access to classified information? And this unauthorized access could be accidental or it could be purposeful. You know, we've must many of us who work in the security field have been there. You know, if you're responsible for security classified information, you might get that call in the middle of the night, or just as you get home, um, someone did not properly secure the classified information. A guard walked around, or some um employee was working late at night and they found some classified information, for example, on a printer, or sitting on a desk. Somebody forgot to secure it, somebody forgot to lock it away. Many times we'll start an investigation and find out if if classified information was compromised, and these investigations include that classified information may not have been compromised. However, we've already spent the time, the energy, the resources to conduct these investigations, find root causes, and retrain you know the person who committed the violation. To prevent the AVUB situation, um the NISPOM recommends end-of-day checks, which are a great idea. Many organizations implement these end-of-day checks. Some require that the person, the last person leaving for today, reviews a checklist to ensure classified information is secured. However, a lot of people have this where they assign an end-of-day roster, and so an a cleared employee may have this responsibility prior to them going home themselves. However, there still may be employees working later and staying later than that employee who has done that check last. To prevent you know, situations of classified information being spilled out, some sort of policy or procedure should be implemented to at least do that one last check to make sure classified information is not left unintended. You know, that person who does a check, um, they'll inspect areas where classified information is used, stored, transmitted, or otherwise accessed, and should follow some kind of routine. The checklist leads the employee to inspect storage containers, tabletops, walking surfaces, printers, copiers, and computers, or anywhere that classified information could possibly be um put down or at some point in use or at rest. While the end-of-the-dack is vital when leaving classified areas unattended, they are not required when an area is manned 24 hours per day or seven days a week because there is always someone there able to watch it. And this is all according to the National Security uh National Industrial Security Operating Manual or the NISPPOM. Though not required by NISPOM, government forms are available online for use or just serve as a model in strengthening current security programs. And these forms can be downloaded and they are actual checklists, and you know, the employee can use it and walk around their area and inspect printers and all those areas that I mentioned earlier. Some people add on here, you know, turn off the coffee pot, shut the windows, turn off the lights, so you can add to the form as necessary. And again, these forms are available online and they may be at the CDSE website or the Defense Counterintelligence and Security Agency website. And one of these forms is called the Standard Form 701 Activity Security Checklist. Again, these, you know, unless the contractor or the government agency requires a use of any specific format, you know, you're free to uh create and adapt your own version. Regardless of the system used, the security checks are actually an effective measure and have proven successful. Unsecured classified information would have otherwise Been susceptible to compromise had these checklists not been used. I mean, I'll admit it, I'm very forgetful. I'll leave and not turn off lights. And these checklists are, again, a proven way to go through methodically and ensure and confirm that uh all the classified information has been locked up. And if you're also like me, you'll drive home wondering. Well, if you review the checklist and sign it, that's just one little piece of, or that's just one way to get some peace as you drive home to know that you've done the right thing and you don't have to turn around just to double check. The biggest threat to national security doesn't arrive when a burglar breaks in. I'm sure that may happen, but unintended classified information provides the greatest vulnerability for accidental or purposeful unauthorized disclosure. Leaving it around, you know, you can't assume that everybody with security clearance has the need to know for that classified information. And you can't assume that unclassified uncleared people or people without security clearances won't find that classified information. So if it's laid out, it's open for anybody to observe. Chances are the classified information that is left out may be compromised by an uncleared employee or at least an employee with no need to know. In either of those situations, if classified information is left out, it has to be investigated to determine whether or not a compromise occurred. And a compromise means somebody had without need to know or without a security clearance was able to read, touch, hold, gain some kind of knowledge about that classified information when they should not have any. Justice Department websites are full of investigations and court cases involving trusted employees leaving um or you know, involving these trusted employees leaving classified information and causing unauthorized disclosures. Improving end-to-day checks, employee security awareness training, and the reporting of security infractions and violations just makes it harder for um unauthorized disclosure to occur. You know, we don't want unauthorized people to steal, copy, or otherwise remove our classified information. When you are on a classified contract, national security is of utmost importance because you're trusted to protect it. So these end-of-day checks, if you get in the habit of them, reduce vulnerabilities and they reduce risk. It's just one cheap and in and very effective way to reduce your risk. I'd like to take a moment to recognize one of our sponsors, and that's Mission Driven Research. And they can be found at www.missiondrivenresearch.com. And Mission Driven Research is a growing company providing technical services to U.S. federal government. The goal of MDR is to continuously improve performance and three core values. This mission focus is the core of MDR and fosters a highly satisfying work environment, motivating employees to excellence. And so if you get a chance, go by there. Visit their website at www.missiondrivenresearch.com. Let's spend a moment talking about security metrics. You know, how do you look at your security program and see what vulnerabilities are? Where do you find those vulnerabilities? Where do you find how you're doing successful security practices? There are ways to do that, and they are called metrics. You measure the way that your security program to protect classified information works. Now metrics are tools that leaders use to assess the effectiveness of their programs. These metrics indicate success, failure, or areas where significant improvement is definitely needed. Metrics data is found in surveys, inspections, reports, and they're pulled for specific purpose. That's one purpose of understanding where the program is as far as protecting classified information. The other part is to understand where the organization should be and comparing that current position with the results gained, you know, from these studies or from reviewing the metrics. The good news is the metrics can be pulled from things that you are already doing. All you need is a way to mine the information. So those designated to be over security programs on classified contracts should make metrics development and use a top priority. Chief security officers, facility security officers, the chief engineer, or whoever the other executive level or management level security managers are, they should understand how to read these metrics and use them to focus with pinpoint intensity on directing these security programs within their companies. You can use these same skills to gain influence in their companies to assist with making the security program even stronger. Because of the nature of compliance with government regulations, the task can be much easier now to accomplish. These regulations and these compliance measures come with their own built-in metrics. You know, the leader of the security program has the readily available data to determine and communicate the effectiveness. Gathering available information, creating a detailed database, or if one already exists, accessing it, and performing solid analysis will help determine the program's success. Whether or not a security program is successful can be determined from information found in the following actions. We talked about security incidents earlier. Well, these incidents, infractions, violations, and reports with compromise or uncompromised or suspected compromise of classified information can be a metric. You know, when you do your investigation, counting the amount of infractions, are there repetitive events? That in itself is a metric that can help you determine how successful your program is and what kind of training you might need to make it more successful, or what countermeasures you might be able to put in place to reduce the vulnerabilities from these security incidents or infractions. The annual DCSA review or audit that comes with its own metrics because you get a report, you find out what your strengths and weaknesses are. Annual self-inspections that you may be conducting, same thing. DCSA comes out with a checklist that you can use to conduct self-inspections. Use that checklist to determine how how effective your security program is and make changes according to your self-inspection. Professional and organizational certifications. These certifications equip the cleared employee with skills necessary to protect that classified information even more. The Industrial Security Professional or the Industrial Security Oversight Certification. Any cybersecurity awareness, any information security system certifications will help. Self-reporting statistics, you know, are clear to employees involved in behavior that you know may hurt their ability to keep classified information. If so, that can be an indicator that you can use as a metric to improve training or improve self-reporting. Security awareness training in itself, a security budget, a contractual requirement. All of these can be used to ascertain the success or failure of your security program, as well as give you the information you need to make improvements. The list I just read off is not at all inclusive, just shows that there is information readily available that directly affects your security program or is affected by your security program or influences your security decisions. So speaking of self-reporting, um like to share a little bit of information from one of our sponsors who can assist if there are, you know, any indications or anything that needs to be self-reported. You know, you might want to get legal counsel before doing that self-reporting. Not that you want to hide it, but you want to report it appropriately. That's where our friend Ron Sixtus comes in. In spite of living a life above reproach, you know, you're doing everything appropriately, you may have an event that could jeopardize your security clearance. So before you discuss it with anyone, contact Ron immediately and he'll help you get through it. You can call Ron at 256-7130221 or email R-S-Y-K-S-T-U-S at bond the letter N B-O-T-E-S dot com or visit his website at securityclearance defense lawyer dot com. And as usual, we'll have our sponsors on our podcast site. Incidents, infractions, violations, and reports of compromise are suspected compromise, our metrics. These should be made at each occurrence and analyzed regularly, meaning, you know, any input that you provide into these violations, reports, infractions, and incidents should should be annotated. And once you annotate them, go back and review them and analyze and see what you can learn from that. Reports indicating that compromise or suspected compromise have occurred are taken seriously and are forwarded to the DCSA, according to NISPOM. They should be forwarded. Many other reports of minor consequences are not required to be reported, they're less serious. If you determine that classified information was left out but did not cause any unauthorized release or compromise in any way, they don't need to be sent out of the organization. But that information, that data collected from that preliminary investigation, is extremely helpful because they are they provide indicators of the organization's security health. And this indicator could be a one-time accidental forgetfulness event, or it could be part of a larger problem, a habit, a lack in training. So let's look at some of these again in a little more detail. The annual DCSA review can be a metric. According to SPOM, the DCSA is responsible for determining the frequency of annual inspections. These audits or inspections are typically conducted every 12 months, but circumstances can require more or less frequent visits. The DCSA inspects the facilities security program for the primary purpose of ensuring that their programs provide the proper protection of classified information that they are charged with overseeing. Additionally, the inspection programs are designed to improve the effectiveness of the contractor's security program. So DCSA will give you a report, and that report in itself provides some metrics that you can use to improve. At the conclusion of the inspection, the contractor is giving a rating ranging from unsatisfactory to superior or some kind of excellence rating. This is important. And speaking of audits, you may, as a clear defense contractor, your organization may be audited by many different government agencies. Some of these audits include quality assurance or cybersecurity awareness or many others. Use these as metrics because that information is transferable. Practices and policies and procedures that you have in place to execute your contracts can be used, transferred over to look at the effectiveness of the security program protecting them. For example, if you are excellent in a procedure in visitor control, that excellence may carry over to inventory management and vice versa. Annual self-inspections as a metrics. The self-inspections offer other exceptional opportunities to improve the security program or measure where your security program is as far as effectiveness. The self-inspection is conducted by security personnel, organic to the company. Or it can be conducted by other employees if security personnel aren't available. These employees who normally work and interact with this classified information. It's a great idea to use them. It's a requirement that affords the opportunity to look into the processes, procedures, review documentation, incidents, conduct classified holdings inventories among a few of the more common tasks. These self-inspections are typically conducted midway between the annual audits given by DCSA and help keep the security team or the team working on the classified contract focused on improvement and compliance. Professional and organization certifications as metrics we've talked about. Quality and other outside agency reviews are performed, you know, to qualify a company for a rating. These reviews are purposefully strenuous and they just bring you through the ringer, and they are thorough in an effort to discover the enterprise's business functions, policies, and procedures. Depending on the type of audit, each outside agency is invited to bring in experts to analyze a company's performance. These inspection visitors they look at every aspect of the organization, measuring the company's compliance, record keeping improvement, and other performance issues, and they make a determination whether or not they are worthy of the certification. Security awareness training as metrics. The attitudes towards security awareness programs are great indicators of an FSO's program, an FSO being a facility security officer. Comments that reflect a desire or loathing of continuing security awareness education speaks volumes. Those who are conscious for the need to protect national security assets and classified information understand the need for training. Refresher training is a requirement identified in the executive orders, Department of Defense, and Federal Agency regulations, including NISPOM. Security budget has metrics. Security budget support or lack of support can either demonstrate a well-received or unappreciated security program. You know, if you're not getting the funding you need, or if if people are not listening to your concerns and providing the resources, then you know you might have a problem with how people perceive the security program. In a functional security manager role, the manager understands the business of the company, how to execute the contracts, what's required. The company mission and how the role of protecting classified material fits should always be a concern. You know, the person reviewing the metrics can provide risk assessment and speak intelligently to the procedures, equipment, and costs associated with protecting classified information. They should understand how to contract outsource, or they should understand how you know how to contract the outsource security resources to install alarms, access control, and other protection measures that are necessary. The FSO or the facility security officer, whoever is managing this, should also be able to demonstrate a return on investment. Contractual requirements as metrics. An FSO or manager who has developed or poor, a reputation for integrity, and considerable influence is instrumental in helping the company achieve its goals. Classified work is identified in the DD Form 254. In other words, this DD Form 254 is provided with the contract and describes how the cleared contractor will perform on the classified contract. The FSO should understand the associated costs inherent to the classified work identified on the contract and what security measures might be needed to execute the contract successfully. Now, what do you do with these data, this data, these matrix or these metrics? A security manager can use these metrics or data and write a white paper, a report, or provide a picture graph to employees, managers, and executives for several purposes. Regardless of the report, media or the type, the objective should be to improve the state of security and better protect classified information from unauthorized compromise, and should be able to communicate these results to the shareholders, the executives, the influential people, or positions within the clear defense contract or organization. Employees can be trained on how to recognize proper procedures and prevent any occurrences or future occurrences of classified unauthorized disclosure of classified information and can change behavior, implement better countermeasures. Managers can use this information to direct changes in their employees to provide better security. Executives can use the information to identify programs or projects with probable risks and use of the data for strategic planning and reducing those risks. Finally, the shareholder, taxpayer, board of director, members, customers, and employees may have a better understanding of their return on investment. And this return on investment continues with the ability to win and perform on classified contracts. We're so glad to have Access Commander by MathCraft. At Access Commander by MathCraft, we believe security risks and lack of compliance are threats to a business and its people. We strive to provide our clients with the tools they need to stay compliant and prepare for the next generation of threats. Through comprehensive training, support, and customer resources, we transform our clients into security professionals with the know-how to defend their organizations and maintain comprehensive security programs. We support the mission of the FSOs, CSOs, and other security professionals who stand at the front door of our nation's battle against foreign domestic threats. With software designed to the latest federal standards, we help them to strategize, speed up, self-auditing processes, create new workflows, generate reports, and retrieve tactical information at a moment's notice. For more information on ways we can help, visit www.mathcraft.com or call us at seven zero three seven two two two two two two two two two two nine nine zero two. I'd like to invite you to visit redbitepublishing.com for the latest in MythsPalm Risk Management Security Training and Articles and resources. From there, if you go to redbitepublishing.com slash contact, you'll be able to register for a newsletter and get um free downloads such as how to get a security clearance or watch videos on how to improve security programs and get classified contracts. Also like to invite you to go to Bennett Institute.com to look at more in-depth security training and certification and um other topics that you might be interested in. They are all NISPPOM-based training and um will help you improve on areas of National Industrial Security Program and performing on classified contracts.com. Have a great, great day. We hope that you subscribe to our podcast and you'll join us for future endeavors. Don't forget, we've had three years of podcasting this month, and so you can go back into our archives as well and listen to our old podcasts.