Security training, export compliance, NISPOM, and working groups

Though not as sinister and espionage riddled as most savvy spy novels, export compliance is an issue that will get defense contractors in trouble. Violating State Department regulations will bring the weight of the US Government on the offending company. According to the International Traffic In Arms Regulation, ITAR, “Any person who engages in the United States in the business of either manufacturing or exporting defense articles or furnishing defense services is required to register”.

Security clearances should be kept to the minimum amount necessary to perform the classified work, access to that classified information must be kept to only those with a valid need to perform on the government work. Security clearance verification cannot provide need to know. Just because one has a clearance doesn’t mean they should be authorized access. Need to know is based on a contractual or work performance basis.

A leader can form an HPT from all business units. Since the FSO is responsible for creating a security program to protect classified information, they may either suggest or take the lead and form the group. Once in the group, the individuals begin to discuss the vision, norms and etc. Such topics to tackle might include policy, security violations, refresher training, emergency operations planning, and communication for starters. A multi organizational HPT can bring depth and breadth to a stagnant security program.Only those working in the National Industrial Security Program for at least 5 years are edible for the ISP Certification and anyone holding the SFPC qualifies for ISOC. Five years experience should make the professional more than capable of passing the exam. However, understanding how to study will make a difference in their success.

Podcast links:

Free NISPOM and ISP Training

www.bennettinstitute.com/courses

My consulting site www.jeffreywbennett.com.
NISPOM fundamentals training perfect for studying and applying to your CDC facility. https://bennettinstitute.com/course/nispomfundamentals/
How to Get U.S. Government Contracts and Classified Work.
ITAR https://www.redbikepublishing.com/itar/
NISPOM https://www.redbikepublishing.com/nispom/
Certification: https://www.redbikepublishing.com/ispcertification/

Government Security Training https://www.cdse.edu/

Jeff's Website
Jeff is available for speaking and consulting

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

Hello and welcome again to another episode of DoD Secure. And I'm your host, Jeff Bennett. DoD Secure is where we talk about government contracts, security clearances, and how to protect national security. As usual, we have a few topics to discuss, starting with four measures to prevent unauthorized export of technical data, two steps in determining need to know, five ways to increase effectiveness with high-powered teams, and five effective ways to study for the security certification exams that are provided by both the government and some professional organizations. So let's get started. So many defense contractors not only are required to protect the classified information on their contract, but they're also required to protect controlled unclassified information or technical data that is subject to export controls. And for the most part, um this article deals with the international traffic and arms regulation that most defense contractors find themselves under. So, you know, though not as sinister and espionage-riddled as most savvy spy novels, you know, export compliance is an issue that will get defense contractors in trouble. Violating State Department regulations as found in the ITAR will bring the weight of the U.S. government on the offending company. Now, according to the ITAR, any person who engages in the United States or who engages the United States in the business of you know either manufacturing, you know, making, providing services, or exporting defense articles or even furnishing defense services is required to register. Defense contractors should have a plan not only to you know protect that classified information, but also prevent the unauthorized transfer of technical information and data. Some of this information, you know, technical data that should be protected may be found in the security classification guide that the government puts out. But for the most part, it's up to the defense contractor to identify the technology that they work with, that they develop, that they build or design, identify it specifically and label it properly and protect it. And this can be done similar to the way that we identify, label, and protect classified information. The unauthorized transfer of technical data can happen in a variety of ways. Right here inside the United States, you or defense contractors can commit an export violation. You know, examples include hosting foreign visitors during meetings, trade shows, during plant tours, chat rooms online, discussions, published articles, any other kind of media where technical data is discussed, viewed, um overseen, you know, somebody's shoulder surfing. Um these violations can occur in the most innocent of ways. It's up to the defense contractor to carve out any occurrence where a non-US person can view or manipulate or uh handle technical data. This technical technical data could be a thing that you produce, a paper, again, a presentation, a speech. It it's up to the defense contractor to weed out that technical data and uh pretty much have a policy of reviewing what technical data will be discussed and approving what technical data will discuss. You would need a communication plan. You can even export technical data items exposed on your desktop, um, on your desk or otherwise revealed when somebody that is a non-US person even tours a facility. So it's really important to identify where this technical data occurs, is stored, isn't work, you know, in use, and make that area a restricted area from non-US persons. Though not covered in the ITAR, think of the term deemed export. That's in the it's in another regulation that handles um commercial items. Where transfer occurs in a simple act such as a briefing or providing that presentation we spoke about earlier. This includes sending or removing technical data out of the US or transferring it to a US or non-US person in the United States. So again, some of these acts could be disclosing technical details through oral email, written, video, or other disclosure. Or transferring this technical data to a foreign person whether not in in the US or abroad, or providing a service to or for the benefit of a foreign person, whether or not they're in the United States or in their own country. So there are some ways to prevent unauthorized disclosure, and you can take these following actions. One, you can help your company understand the requirements to register with the State Department. Um you can find this at the DDTC Delta Delta Tango Charlie website at the State Department. Um, and I'll have these on the show notes as well. Now remind um decision makers in your company of the responsibility to protect technical data. You can do this by helping create a technology control plan. This technical technology control plan simply you know addresses where this technical data may be exposed, and again, you would carve out any accidental or purposeful viewing by a non-US person. If a company is authorized to export or receive technical data, understand that the license or the technical assistance agreement, understand it, because it will have provisos in there that explain how and when the technical data can be exported, as well as identify the only technical data that can be exported by name. You're not allowed to add to that unless you get further licenses or privileges or permissions. Now follow it to the letter. The technology control plan will ensure that only authorized persons have access to that technical data. So you can also provide a briefing to employees that discuss whether or not the U.S. or visiting whether or not the employees in the U.S. or if they're visiting overseas, they should only discuss what is authorized by the licenses or the technical assistant agreements as mentioned above. Now, number four, I've discussed this before. Prior to providing an employee with a laptop to go overseas to make presentations or do their work, ensure only that information technology or data that's on there, only the data authorized by the license is on there. Any other technical data that is on there would be an export violation if there's no license covering it. Even if somebody takes your computer and looks in it without your permission. In that situation, you could still be held responsible for an export violation, even though you did not willingly provide it. So do everything within your power to help others in your enterprise understand that no technical data or service should be given without proper approvals. And again, this means performing that due diligence necessary to identify where that technical data is at work or at rest, receiving non-US person visitors and making sure that they don't have access to that area, and sending business development or program managers or engineers to trade shows without working on teaming agreements, providing proper briefings, and ensuring that they only disclose what they are authorized to disclose. So again, um I will have some links on the show notes as well as a link to my book called How to Get U.S. Government Contracts and Classified Work that does discuss ITAR. I also have copies of ITAR on my website at redbikepublishing.com that you can acquire for yourselves. I recommend that everybody has a copy of this so that they can understand how to set up export compliance with their in their own company. So let's hear a message from one of our sponsors, Sim Software. SIMS Software. As a clear defense contractor, you represent the backbone of innovation, the front line of our national security, and protectors of all that we hold dear. SimS Software is proud to be your ally in these endeavors. As the most trusted name in Industrial Security Information Management for over 38 years, SimS Software equips you with the tools to protect the lifeblood of your organization. Our flagship Sims Suite provides all the features and functionality you need to run an automated, paperless industrial security program. Gain a 360-degree view of every physical, virtual, and human asset inside your security domain. From classified documents and materials to cleared personnel, facilities, visitor control, information systems, and more. SIMS supports requirements within all security communities. To learn more or schedule a demo, visit simsoftware.com or call 858-481-9292 or see my show notes with links and phone numbers. So our next discussion are two ways to determine need to know. Now remember, for access to classified information, you not only need a security clearance at the appropriate level, but should be able to demonstrate the need to know to have access to that classified information. For example, need to know might look like you work on that same contract and you're required to have access to classified information to be able to complete your work. Now it's entirely the responsibility of the holder of that classified information to determine security clearance and need to know. So let's take a look at the following dramatization. Suppose a facility security officer is engaged in an inquiry to determine whether or not a security violation led to the loss, the compromise, or suspected compromise of classified information. A cleared employer had left a classified document out on their desk and asked another cleared employee to keep an eye on this for me. And it was a classified document, and they left for lunch. A short time later, the second employee who agreed to watch that classified information was summoned to their boss's office to answer some questions about a task. They left in a hurry, forgetting about the classified information on the desk. At first glance, the unidentified, unidentified, or unattended classified information is, you know, the most obvious violation. However, once the facility security officer conducted the inquiry and concluded it, they had another issue and it became evident. The coworkers did not work on the same contract or share in any kind of project relationship. The first co-worker entrusted the safeguarding of the classified information to an employee who they know held a proper security clearance at the right level, but did not have that need to know. The holders of the classified information should verify these two things, you know, the proper clearance level and whether or not they have a valid reason to access that in that specific classified information. Determining that security clearance level can easily be accomplished by the FSO. However, that's just half of the requirement. To complete the process, the holder has to identify whether or not the recipient has that need to know. So, how does one determine need to know? Is it the FSO's job? Is it the program manager's job? Whose job is it? So, need to know can be established using two principles. One, who determines that need to know? Need to know is determined exclusively by the holder of that information, as I mentioned earlier. Those in possession of classified information are solely responsible for the proper release or disclosure. So I would recommend that the holders of classified information or the project manager or group that works on the classified information specifically identify the information that they are responsible for and specifically identify the personnel by name who has or should need regular access. Anyone else should be on a case-by-case basis where need to know is uh demonstrated somehow. Now, the second part is how to determine that need to know. Who determines the need to know is the first point. The second point is how to determine that need to know. You can do that by verifying a contract number, verifying performance on a project or program and identifies key players, validation by a project manager, you know, somebody saying, Yes, I need them to work on this project, give them access. A written access roster or other method can be used to determine that need to know. So as security clearances should be kept to the minimum amount necessary to perform the classified work and related to a specific contract, access to that classified information must be kept to only those with a valid need to perform on the government work. Security clearance verification cannot provide need to know. Just because one has a clearance at the proper level doesn't mean that they should be authorized that access. Need to know is based solely, I mean partly on the contractual or work performance basis. So keep those principles in mind as you work this effort. And if you ever have any questions about this, um, I have questions and answers at my consulting website, jeffreywbennett.com. Additionally, you know we do have copies of NISPOM and NISPPOM Fundamentals Training that you can access. Now I will again have those links in our show notes. Our next sponsor is Mission Driven Research. Now, Mission Driven Research is a growing defense contractor company providing technical services in the US federal government. The goal of mission driven research is to continuously improve performance in three core values. The mission focus is the core of mission-driven research and fosters a highly satisfying work environment, motivating employees to excellence. And if you would like to get in contact with mission-driven research and see the services and products they provide, you can go to mission drivenresearch.com or check with our show notes where we will have a listing of all of our sponsors. So let's provide um let's talk about high-powered teams. This is kind of a segue away from our normal discussion about classific um security clearances and classified contracts, but this might be helpful to small teams existing in defense, clear defense contractors working on a project, or an or facility security officer building up a team. You know, maybe you think you're alone, you know, fighting that one-person battle as many leaders face. However, if you might be wrong to assume that the head of security is the only one responsible for the security program. For clear defense contractors, the facility security officer, or FSO, is in charge of the security program, but not the only one with a vested interest in protecting classified contracts. So it'd be a mistake to assume that this FSO has full responsibility for making all classification or classified contract decisions. It takes a team to do this, and it should be instilled within the fabric of your company, with the FSO overseeing the security program to protect classified information, but not the only player. So, how could an FSO create a teaming environment or create a program where everybody works together on this? Again, this may be a single facility security officer solely performing this duty and encouraging other members of the organization to assist with the tasks. Well, high-powered teams are the most effective types of entities. Where groups form, storm, and norm, the high-powered teams go further to create, you know, a body of more capable than any one individual. High-powered teams do this by agreeing to the rules and primarily keeping in mind that throughout any process or problem, it's not about the individual, it's about the group. This allows the organization to benefit as a whole as each member sacrifices their individual desires. These members not only lose or give up the individuality that makes them unique, but it goes, you know, it doesn't stifle individual creativity. What each individual sacrifices are selfish desires and the need for self-importance. So an example of this could be the NISPOM has a requirement of a graduating scale of discipline for those who commit security violations. Now, in many cases, the FSO could put out a policy of discipline, uh employee discipline for those who commit security violations. However, they may not really have the authority without the involvement or the agreement of human resources, vice presidents, or other managers. You know, an FSO cannot just go in and say, sorry, you're no longer allowed access to classified information until you commit this to this training or until blink occurs. This would be a work stoppage that the F and the FSO would cause friction with the other members of the Clear Defense Contractor Organization. So a high-powered work team uh would have members of HR, safety, security, program managers, business development, and they would get together and work on the policies or work on weaving uh the security program to protect classified information into the policies of the organization. So these high-power teams consist of you know a small number of people with complementary skills. Individual members of high-powered teams are committed to common goals and hold themselves mutually accountable. Again, you know, this would be through agreements. And again, using the discipline as an example, um these teams would get together, again, the managers, the HR, the security, and come to an agreement of how um you know training should go to ensure that the that the training requirements from NISPPOM are applied. Applied, how disciplinary action is applied so that it is seamless, and if an event occurs, then the required response will not be a surprise to anybody. So we recommend that you for these higher power teams, you you start a charter that defines and the standards the IPT will perform, the HPT will perform under. It provides a purpose, you know, vision, norms, goals, expectations, and procedures. For example, if someone arrives late or makes fun of another member's contributions, corrections can be made by referring to the charter. Additionally, if the group loses focus, members can refer to the vision and the goals to get everybody back on track. And if any of you have ever run in a working group or a product team, you know you need these charters in place to keep people focused on the task at hand. So teams build on four stages by engaging collective performance, positive environments, holding individuals and entire group accountable for guidelines and decisions that are made. Now, anyone can form a high-powered team or a working group, and especially so for highly effective formal and informal leaders. So let's, for the sake of relativity, or for the sake of relating this, consider a facility security officer and their command security manager or other security specialists. They may start with a charter. The leader can form uh the high-power team from all business units. So since the FSO is responsible for creating that security program, they may either suggest or take the lead and form the group. And this HPT could be focused specifically on protecting classified information and performing on classified contracts. So once the in the group, the individuals begin to discuss that vision, norms, and et cetera, that we talked about earlier. Topics to tackle might include policy, security violations, refresher training, emergency operations planning, and maybe communication for starters. A multi-organizational high-power team can bring depth and breadth to a stagnant security program, or give that new security program the boost that it needs. So the difficulty for some leaders would be to sacrifice their will and turn over their problems for the group to solve. That's natural. But one of the benefits is that now security is part of the organization's DNA and not just overhead or necessary evil. Everybody buys into it because they're the members of that team. The effective group will have the capabilities beyond what just the FSO can do alone. And the trade-off is perfect and the results will be impressive. So here are some recommendations for forming that team. I have five. Engage. Focus. Develop a game plan and respect other members' time. You can increase the effectiveness with a charter as described above. Three is accountability. Have meeting minutes and documents and document the work and the products. Take those notes. Be sure to capture all important decisions and who will act on them. And when the group responds or assigns responsibilities to individuals, they tend to come through. Number four is follow-up. Let the group know you appreciate their efforts. Better yet, assign credit to your group members and ensure that the executives and department leads support this and understand who the members are and buy into these decisions. So five, have fun. Keep it light. This is a time to allow creativity and work within the confines of the government regulations and corporate policy. Allows out-of-the-box thinking, and believe it or not, it does build that teamwork that you desperately need. If you like a transcript of this high-powered team, um I do provide these in article format, and you can see them in um in my blog at redbikepublishing.com. Additionally, you can join our newsletter, and I'll have a link there. Um most of these podcast topics begin as articles, and so I provide a little bit more information. So I invite you to join our newsletter, and you can do that by again selecting that option in our show notes, or or visit redbikepublishing.com. And if you go on there, a pop-up will occur that will allow you to um you know join our our organization's um newsletter. Uh one other thing you could do is just go to redbike publishing.com and and click on the contact us tab, and you'll you'll have a form that you can fill out and and um that will put you right on our newsletter. I'd like to talk to you about our next sponsor, Ron Sixtus. And his website is securityclearance defense lawyer.com, and he is a security clearance lawyer. Now suppose you're filling out your questionnaire in the SF eighty six, and you realize that you have some red flags. In that case, you need a good you need good advice before you submit this SF 86. Get Ron involved as early as possible in your application process and always have him review your problem questions and answers before you submit that SF 86. Now you can reach Ron at 256-713-0221 or email him at R S Y K-S-T-U-S at bond b o n d letter n botes.com. And I'll have a link for him at the show notes. So our as promised, our last topic is about certification. And these are security certifications that a facility security officer or anybody actually working under the NISPOM or doing classified contracts and spend time protecting classified material, they will have the experience necessary to take these tests. And so some of these tests require five years experience, some of these tests require uh other prerequisites. But this article or this topic is most about why you should certify. Um, there are many reasons to certify as a you know with these security certifications, and one of them could be uh you can put that um the employees that'll be writing to the contract are certified to protect classified information. And I've seen people put those on requests for proposals and statements of work. The certification holder demonstrates a high level of knowledge for protecting classified information. Most of these certifications are based on the NISPPOM, but also cover things such as ComSec, operational security, and other topics. The certified professional that communicate to upper management that they are committed to the business, the industry, and protection of natural interests. It puts the cleared defense contractor in a stronger position while bidding on contracts and lends that credibility to relationships with the oversight agencies, such as DCSA Defense Counterintelligence and Security Agency. Most of all, the certification gives that bearer the confidence in their ability to apply their knowledge. As this certification program evolves, more and more employers will require that certification. So there are many different types, but the certification I would like to speak of are the certifications that I already have. So I feel like I have the experience to speak to them. So only those working on the National Industrial Security Program for at least five years are eligible for a certification called Industrial Security Professional Certification. And that is hosted by NCMS. And anyone that holds a security fundamentals professional certification with the Department of Defense, they qualify for another certification called the Industrial Security Oversight Certification. Both of these certifications are based on the NISPPOM. The ISP certification is an open book exam, and the ISOC is a closed book exam. So five years experience in any any case should make the person that would like to take these certifications more than capable of passing these exams. However, understanding how to study will make a huge difference in their success. So I recommend a start a targeted focus about 30 minutes to an hour a day for six months. That can make a huge difference in your preparedness to take these exams. You know, you might be very wise as far as NISPPOM and how to apply it, but that's one thing. Applying the NISPPOM to your organization is a stressful event, but it's less stressful than sitting and answering 110 questions on 122nd, uh 120-minute exam. So the ISP certification allows you to use that NISPPOM and other reference material during the exam, but this isn't easy. Finding the right answers, the way the questions are worded and the choices of answers can be quite daunting. So you would require a broader understanding of where to find the information by topic. Now, on the other hand, the ISOC certification does not allow reference material. This is a closed book exam and requires more memorization and more depth of study. However, in both cases, the tests are tough and the candidates do need to study. The few minutes preparing each day for these certification exams will help and make a huge difference. So some of the topics in both tests include security administration and management, document security, information system security, physical security, personnel security, international security, classification of information, security education, audits, and self-assessments. Now, as a broad scope of study provides a challenge as not every clear defense contractor is experienced in all aspects of the NISPOM. You know, some may only do security clearances and management of security clearances. Others may have document control or personnel security. At any rate, not everybody has all the experience necessary. But there are ways to prepare that will help you pass the exam regardless of how much actual experience you have for any of the topic areas. For example, you can pass all sections, including that the uh the information systems section, even if you do not have an information system to manage in your uh defense contractor organization. An FSO or security manager at a company that only provides security cleared employees can pass that ISP certification exam without ever having marked a classified document, stored a classified document. How? By following five easy study methods that I've developed to gain a better understanding of than this poem. So determine which type of test you want to take and start studying and using those resources. And the important part is to register because this registration will provide you that trigger that you need and cause the clock to start ticking and seal your commitment. I recommend taking the computer exam and using the electronic NISPOM with the any updates. And you can practice on your own by downloading uh an electronic version of the NISPOM. Create your own questions and search for answers using the control F function or similar functions so that you can search that NISPPOM. For example, if a question covers proper uh marking procedures, then you can search NISPOM using keywords such as classification marking, marking, or using actual keywords that come in the question. Method number two is become familiar with the NISPOM. You know, it's not necessary to memorize the NISPPOM, just become familiar with the chapter titles and paragraph topics and understanding their applicability. Now this will help if you can't find the answers using a keyword search. Sometimes questions don't contain the keywords that you need, and you'll have to rely on your intuition, experience, and book knowledge. It's important to know that any information systems and their security is in the current NISPPOM, chapter 8. Security education is in chapter 3, document security is in chapter 5, and so on. If you memorize at least by topic which chat um which chapter the question is covered by, then it will reduce the time you need to search. Um method number three is form a study group. You can contact your local chapter of NCMS or local security organizations and start a study group. You might also join NCMS's exam preparation program and find an industrial security professional or an industrial security oversight certification mentor to help you through this. Method four is try to work outside of your experience. If possible, um, if your experience is primarily personnel security or security clearances, maybe another security professional in your organization works document control. Maybe you can get permission to do some cross-training so that you get experience in other areas of the NISPOM. And then finally, take courses. So all of those topics that I read earlier about personnel security, um, physical security, document control, there are classes already set up that are online that you can go at the CDSE website. Again, I'll put those links in the show notes. And you can practice, um, you can take the courses and then then take those practice exams. And once you take all those topics, retake them, add that to your studies, and you will have few problems when it comes to exam time. Now, if you do take the online exam, I recommend uh using two monitors. Um, currently, I think there you will have that choice. The the online exam is proctored, and in in my experience, last time it's proctored, and and you have to show your ID, and they do a simple search to make sure you're not bringing in any notes, and then they will set you up with the references and the resources that you need to take any of these two exams. Now, there I will include websites that show you how to train. Um, I've also written a book on um with practice questions, uh, it's equal equivalent to four practice exams of 110 questions each. And I also have at redbikepublishing.com other study references and resources that you can use to improve your chances of passing those certification exams. So our next sponsor is Access Commander by Mathcraft. At MathCraft, we believe security risks and lack of compliance are threats to a business and its people. We strive to provide our clients with the tools they need to stay compliant and prepare for the next generation of threats. Through comprehensive training, support, and customer resources, we transform our clients into security professionals with a know-how to defend their organizations and maintain comprehensive security support. We support the mission of the FSOs, the CSOs, and other security professionals who stand in the front line of our nation's battle against foreign and domestic threats. With software designed to the latest federal security standards, we help them to strategize, speed up self-auditing processes, create new workflows, generate reports, and retrieve tactical information at a moment's notice. For more information on ways we can help, visit mathcraft.com or call 703-729-9022. We will also have links to Mathcraft on our notes pages. Thank you for joining DOD Secure for our recent installation of this podcast. Come back often as we will be updating this podcast frequently with the latest and greatest from the Defense, Department of Defense Security, the NISPOM. We'll talk about security clearances and more. And as I invited you earlier, please join our newsletter so that you can get regular installments of articles that talk about or describe the topics that we are talking about on this podcast. Until next time.