AJ's Consulting

* Industrial Security * Marketing * Training *

Industrial Security & You
 Tending Your Security Program
 
May 2009 
Greetings! 
 
Here is hoping that April showers are resulting in lots of May flowers.  Flowers result from seeds that were sown either by natural forces or by intelligent design.  Is your security program harvesting a bumper crop of security aware individuals who assist you in protecting national security without hindering your facility's mission?
 
Proper tending to your security program can minimize the surprizes that arise.  How can you properly tend your program?
 
Read on.... 
 
Plant CI
 Ann was very knowledgeable not only in JPAS, but also DISCO information and Reg's, etc.  She conducts the training in a clear & concise manner.
Elizabeth Marcotte
Little Rock, AR
Our Focus This Month
DesigningYour Security Program
Creating the Defense Contracto Security Budget
Compilation of SBU = Classified
Updates & Reminders
The [JPAS] class was outstanding - I really enjoyed the hands-on approach to the class.  I would highly recommend this class and the instructor. 
Kevin Cloud
Austin, TX
Designing Your Security Program
 
Do you design your garden before you plant or as you garden?  There are benefits to doing a little bit of both, especially if your garden, or security program, is growing.
Gardener
 
Whether you are starting from scratch as a new facility or you are picking up the reins from a previous security officer, you must tend your garden. 
 
Start with a baseline determination of where you are and where you wish to be.  Identify your crop, your policies and processes that you wish to nurture, and your weeds or undesirable policies, procedures, actions which drag down your program.  The best resource for assisting you to set a baseline is the Defense Security Services' (DSS) Self-Inspection Handbook.  DSS also has a handout called Suggested Contractor File Folder Headings.  This handout with the Self-Inspection Handbook can assist you in setting up your program.  Along with giving you file folder headings, there is a description of the items your DSS Industrial Security Representative expects to see in these files.  Both resources are usually available for downloading from the www.dss.mil website,  the NCMS Members Resources webpage (www.classmgmt.com), or from your local group of networking Facility Security Officers (FSOs).  If you are unable to find them, feel free to email me at ajsconsulting@earthlink.net.
The Self-Inspection Handbook is basically a checklist that relates every question to a place in the NISPOM, the regulatory basis for our security program.  When you use the Self-Inspection Handbook to set your baseline, you can identify and fix your shortcomings on the spot.  You also know where you are -- in compliance or not, what needs to be done to obtain compliance, and you are now  better prepared to begin planning and verifying the growth of your program is on plan.
 
Education or training also plays a part in designing your security program.  Would you begin planting willy-nilly without learning about the plants you wish to grow in your garden?  That could be very costly.  Especially if you were to choose a plant that does not grow well in the type of soil your garden has, or requires more attention, pruning, watering, then you originally expected.
 
Some research on your part is required to ensure that your program meets both regulatory standards and your company's needs.  Remember that the NISPOM is vague due to the needs of the many agencies and industry contractors that have agreed to abide by it.
 
For more information regarding resources available to assist you in designing your security program register for the FSO/SSO Personnel Security Administration training course or one of the NISPOM Compliance webinars.
 
 
She's fabulous!  I'm so thankful to have had this [JPAS] training.  I would highly recommend her to anyone.
Jennifer Schulmeier
 San Antonio, TX
Creating the Defense Contractor Security Budget
by Jeffrey W. Bennett, ISP  
BudgetA Facility Security Officer (FSO) should put careful consideration into the security budget.  This is a primary opportunity in the continuing plan of building credibility.  The manager who arbitrarily throws in a number with meritless base is sending the wrong message.  However, a well thought out line item count based on risk management, company mission and NISPOM requirements is more apt to impress and build instant respect.  The budget contribution should enforce and support a message the FSO is constantly communicating.  The budget request should not be the first time executives are introduced to the figures.
 
Management's support or lack of support of a security budget demonstrates either a well received or an unsupported security program.  The intuitive FSO understands business, the company mission and how the role of protecting classified material fits.  In that environment, the FSO provides a risk assessment based upon the threat appraisal and speaks intelligently of the procedures, equipment and costs associated with protecting classified information.  For example the FSO understands how to contract with security vendors to install alarms, access control and other life safety and protective measures.  The FSO is also able to demonstrate how the expense will benefit the company either in cost reduction or other tangible results.
 
The FSO should present the budget in a manner that all business units understand.  For example, if part of the budget line is to provide access control, there is a significant associated cost.  Incorporating management involvement and support builds credibility and puts the company in a better position to provide the funding.  Not only is a projected return on investment (ROI) required, due diligence should be conducted.  Sample questions and answer the FSO should be prepared to address are:
  • Why is access control necessary?  Prevents unauthorized persons from entering the premises and gives an extra layer of protection for classified and sensitive information.
  • What happens if we do not implement access controls?  The organization would have to commit persons to controlling the access to the company.  At a manager's salary of between $20.00 - $30.00 per hour, this could become expensive over time.  The FSO could demonstrate the cost of the access controls against the time a manager takes to ensure someone provides visibility of the doors.
  • What is the return on investment for access control?  The intangible return on investment is the prevention of damage, injury, theft, and other risks inherent to unauthorized visitors.  More tangible is the amount of energy save while keeping the doors closed and saving air conditioning.  In one such study and FSO estimated a cost reduction of $12,000 per year cost reductions on the electric bill.

Other questions abound and the FSO should not hesitate to forward such questions to vendors.  These vendors have statistics that they use as selling points for their products.  Speaking the language of business will serve the FSO well and ensure that executives understand the significance of a well supported security program.  Security managers who just quote regulations or use "best practices" without putting much thought into the costs or talking points will quickly lose credibility.

 To read more articles like the one above or to receive sample ISP exam type questions you may want to sign up for Jeff's newsletter.
 Very well organized training material.  Instructor, knowledge and training techniques were the best I've experienced.  I thoroughly appreciate the small class size that allowed personalized training and allowed extra time for specific questions and exercises.
Gail Madriaga
Honolulu, HI
Compilation of SBU = Classified
by John Hille, ISP
McLane Advanced Technologies
 
Jigsaw Puzzle
Ever work on a jig-saw puzzle? Sure you have. Each piece by itself is a part but to a point unidentifiable. However; as pieces begin to interlock with one another the overall picture comes into focus.  In the world of Security, this is called 'compilation'.
 
Picture SBU (sensitive but unclassified): each piece of the puzzle is by itself unclassified, but as the pieces join together the overall is classified information.  Consider SAMS-E and each employee working on the project holding a piece of the puzzle. 
 
By themselves, what they have is SBU.  They could talk about it with their next door neighbor or in a restaurant without too much worry.  But talking with other employees the pieces begin to join together. Developers and lines of code. Testing and a possible vulnerability. Training and how it all works. Data conversion and real facts. Fielding, who, where, when (if that schedule was compromised could cost lives). 
 
Now consider a group discussion in a restaurant and the 'bad guy' listening in. Don't be the employee holding the last piece of the puzzle that the adversary needs to see the whole picture. The warfighter and National Security is depending on you.  You can talk about the forest but don't describe the trees or leaves, because that identifies the nuts. [no pun intended unless the shoe fits]
The [JPAS] class was outstanding - I really enjoyed the hands-on approach to the class.  I would highly recommend this class and the instructor. 
Kevin Cloud
Austin, TX
Updates & Reminders 

DSS Website Updates:

Look 
  • (5/1/09) DSS Special Alert -- e-FOCI: In continuing efforts to better serve Industry, the Defense Security Service (DSS) is partnering with the Department of Energy (DOE) to use the DOE electronic FOCI (e-FOCI) submission site to facilitate and enhance DSS' facility clearance processes.  Effective June 1, 2009, ALL companies in process for a new facility clearance, a facility clearance upgrade, or reporting a material change to FOCI, will be required to use the DOE e-FOCI application to submit their documents to DSS. Read More
  • (4/16/09) Questions and Answers from NSI Impact Conference
  • (4/15/09) DSS Academy announces release of the new Visits and Meetings in the National Industrial Security Program (NISP) Course:
    The Academy is releasing a new course for Visits and Meetings in the National Industrial Security Program (NISP). The 2-hour online course is interactive and covers the rules and procedures for classified visits and meetings for facilities participating in NISP. Course content is derived primarily from chapters 6 and 10 of the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22M. Read More
Verify that you have the correct URL for DSS Webpage to get the above and more announcements --> https://www.dss.mil/GW/ShowBinary/DSS/index.html.
 
Updates From JPAS Train The Trainer:
  • JPAS/JCAVS is a Personnel Clearance Database:
    • System of Record for Eligibility & Accesses for individuals
    • System of Record for Incident Reports
    • Not a Facility Clearance Verifier
    • Not a personnel tracking system for individuals who have not been submitted for an SF 86 (or an SF 85) investigation
  • Industrial Security Facility Database (ISFD):
    • System of Record for Verifying Facility Clearance Levels and Safeguarding Capability
    • Obtain access via the SAR Form
 Announcing

The NCMS Lone Star Chapter's JPAS Experts (Ed Fitzgerald and Ann Martick, ISP) will be manning a JPAS Help Desk on Friday, May 15th from 9 AM to 1 PM at SCCI, 5332 Thunder Creek Road, Austin, TX.  JPAS challenges will be solved for any walk-ins -- no phone calls.  RSVPs are not required, but would be nice to indicate how many may show up --> Ed Fitzgerald and/or Ann Martick, ISP.

 Training was great.  The reference book provided has been a lifesaver.
Joseph Cole
Pepperell, MA
Thank you for reading my newsletter.  If you know of someone who could benefit from the information shared, please pass it on.  If you know of someone who could use my expertise please tell them about me and pass their contact information to me at ajsconsulting@earthlink.net so I may assist them.
 
What I do best is assist you with solutions to difficult industrial security challenges.  How may I assist you today?
 
Sincerely,
 

Ann J. Martick, ISP
AJ's Consulting
 
 Onmymnd
What I Do Best
Consulting
AJ's Consulting
18+ years experience in the Industrial Security arena.
  • On-Demand JPAS & e-QIP Support
  • On-Demand FSO Surrogate Support
  • Industrial Security Training
    • JPAS & e-QIP Immersion
    • JPAS & e-QIP Proficiency & Troubleshooting
    • FSO/SSO Personnel Security Administration
    • Webinars
      • Got JPAS Access - Now What?
      • NISPOM Compliance - Reporting Responsibilites
    • Customized Briefing Packages
  • Marketing
    • Internal Newsletters
    • External Newsletters

Call: (512) 650-4819 or email ajsconsulting@earthlink.net for a solution to your industrial security challenges.

Join Our Mailing List
Quick Links
Security Resources
Networking Opportunities 
Remember it is always who you know...
Questions
Lone Star Chapter's JPAS Help Desk
  • WHEN? 9 AM to 1 PM Friday, 5/15/09
  • WHERE? SCCI, 5332 Thunder Creek Road, Austin
  • WHO? Austin Metro Area FSOs, JPAS Account Holders, NCMS Members... 
  • WHY? To Answer Your Specific JPAS Challenges

Walk-ins only please.  Feel free to RSVP so that we will have an indication of how many will come --> Ed Fitzgerald and Ann Martick, ISP

Questions
AIARG* Brown Bag
 May 19, 2009
10:30 AM Sharp
UT:ARL
 10000 Burnet Road
 Austin, TX
For more information
Contact:  
*Austin Information Awareness Resource Group
 
Brown Bag  
Austin FSO Brown Bag
May 20, 2009
11:30-1:30 PM
 *New Location*
10000 Burnet Road
Austin, TX 
 Topic:
Stepping Through e-QIP
Presenter:
Melanie Wenninger
IE Discovery
 
For more information
Contact: Mary Marsden
Join Our Mailing List
Consulting
 
Looking For Local or Onsite Training?
  • Part-Time FSO
  • On-Demand FSO Support
  • On-Demand JPAS & e-QIP Support

Contact me: ajsconsulting@earthlink.net or (512) 650-4819