|
Industrial Security & You: Briefing Management on Security Responsibilities |
Do you brief management differently than the rest of your staff? Why not? While a regular annual briefing or refresher benefits management as well as your staff, sometimes management needs specific briefings.
What kind of specific briefings? How about briefing them on their responsibilities as a DoD Contractor? Management should be familiar with both their responsibilities and yours. How else can you be sure your security program meshes with the company mission and you receive management support for your security program?
Management has specific responsibilities including bringing in new contracts (classified contracts should always come with a DD-254), hiring, supervising, and terminating employees and consultants, and providing budgetary funds for various departments.
As FSO, your responsibility is to keep management from making decisions which cost them more money than appropriate due to decisions like hiring a new CEO (who happens to be a foreign national), or failing to comply with the NISPOM, ISLs, or contract specifications. This month's newsletter focuses on a few of the specific areas that management should be familiar with. Education benefits both the trainer and the trainee. |
|
|
JPAS Expectations | |
As the Facility Security Officer (FSO), it is your duty to ensure that management understands their and your responsibilities when it comes to JPAS.
What should you include when briefing on JPAS Expectations?
Start with highlights from the Procedures Governing Use of JPAS by Contractors:
- The responsibility to keep accurate records and to "expeditiously" update the JPAS records for employees and consultants -- specifically mentioned is updating records upon termination of employment.
- JPAS accounts are for the exclusive use of the contractor or government agency through who the account was issued.
- JPAS Account Managers must be an employee
- JPAS Users can be either employees or a consultant
- Users must be in your PSM Net
- Users must have had a NACLC investigation and at least an Interim Secret Eligibility
- Users must also have been Indoctrinated with a minimum of Secret Access
- Each user is to have a unique account with unique password -- no sharing.
- Must have policies in place to prevent sharing of accounts and passwords.
- Access to JPAS should be from Company or government-owned equipment with "appropriate security controls in place" and not from home or personal computers.
- Appropriate security controls means anti-virus software, firewalls, etc.
- Don't access from home or personal computers -- a company or government-owned laptop is acceptable.
- Don't access JPAS from areas or internet connections with no protection from viruses, malware, or where unauthorized access is possible.
- Can use JPAS to verify a prospective employee's access to classified prior to issuing an offer of employment, but can not use JPAS as a recruiting tool.
Include the requirements for keeping JPAS Account System Access Request (SAR) forms on file, maintaining and updating your JPAS Account Users (JPAS Account Management Policy) and training your JPAS Account holders on Personnally Identifiable Information (PII). The PII training requirement was first posted on the www.dss.mil website September 2009 and Defense Security Services' (DSS) Industrial Security Representatives (ISRs) will ask if you have certificates proving they passed the training.
Interested in finding out more regarding JPAS? Register now for the Got JPAS -- Now What? webinar, a JPAS & e-QIP training session: JPAS & e-QIP Immersion or JPAS & e-QIP Proficiency & Troubleshooting, or contact me for a On-Demand JPAS Support Services quote at ajsconsulting@earthlink.net. |
|
Complying with the NISPOM & ISLs |
Does management understand their responsibilities and yours as specified in the NISPOM and Industrial Security Letters (ISLs)? How can they support you and assist in promoting your security program with out understanding?
Finding the highlights that would be beneficial or relevant to your management may require your studying the NISPOM, ISLs, and the General Principles of NISPOM Compliance for Cleared Contractors so that you are familiar with them and able to answer any questions that may come up -- especially since the NISPOM is written vague enough to be applied to any industry and to encompass the 32 different government agencies who are signatories to it.
Some general highlights that apply across the board are:
- DD-Form 441 -- Security Agreement between your company and DSS specifies that you will follow the NISPOM and ISLs.
- Name change or Address change must be reported
- Organization change must be reported
- DD-254 -- Contract Specification Form which spells out security guidelines and indicates the level of access the contract will require you or your company to have
- Indicates level of Facility Clearance Required by your company
- Indicates whether you will have Safeguarding or not
- Indicates what accesses you will need -- i.e., NATO, FGI, SCI, non-SCI, etc.
- Indicates whether you will be generating classified and need an accredited information system for processing
- Indicates who will be the Cognizant Security Office (CSO) -- DSS or other government agency
- Facility Security Officer (FSO) -- must be an employee
- Must complete DSS Approved Training within 1 year of appointment (New Online Curriculum for Facility Security Officers)
- Must be listed as Key Management Personnel (KMP)
- Provides oversight of all aspects of security program under DSS' cognizance.
- Liaisons between company and government security representatives
- Information System Security Manager (ISSM) -- must be an employee
- Required for all accredited classified information systems
- Must be trained in the complexities of the accredited classified information system
- Preferably not the same person as the FSO
- Key Management Personnel changes must be reported
- New management structure
- Change in KMP personnel
- Exclusion of KMP personnel
- SF 328 -- Certificate Pertaining to Foreign Influence and Ownership must be kept up-to-date
- Foreign influence or ownership may require specific policies or actions by management
- NISPOM Chapter 2 Section 3
- Protection of sensitive, but unclassified information or Critical Unclassified Information (CUI) may soon fall under DSS' cognizance.
- Cooperate with all government agencies & representatives
- sending a report to another government agency -- be sure and cc your DSS ISR
- send any suspicious contact reports to DSS
- send any reports of intrusions into your company networks to DSS
- Complete surveys sent out by DSS
- PSI Survey -- asking for number of investigations and types you will be requesting over the next 3 years
- Cost Survey -- asking for an estimate in the costs of complying with the NISPOM
When management is knowledgeable about the requirements they and you have, they will contribute to your security program and you can better document management support of your security program. Your security program will also better support the mission of your company, because you will be able to provide assistance rather than roadblocks to profitability.
If I can be of assistance in developing or customizing your security briefings, please do not hesitate to call (512) 650-4819 or email me at ajsconsulting@earthlink.net. |
|
AJ's Consulting's Training Schedule | |
 Why choose AJ's Consulting's training? My training is hands-on, intensive, and customized for the attendees. Whether the number of attendees is one, two, three, or more, the training focuses on specific challenges facing the attendees and incorporates the compliance expectations of DSS Memos: Procedures Governing the Use of JPAS and General Principles of NISPOM Compliance for Cleared Contractors.
Combined FSO & Personnel Security Administration & JPAS & e-QIP Immersion Training Special
2 Days of Training now available for $1,000*
Note: Ann J. Martick, ISP has joined JPW Security Solutions' team as an instructor. Check out the scheduled training here. |
|
Best money spent on consulting services in my career.
Current Customer
|
|
Thank you for reading my newsletter and passing it on to others who may benefit. What I do best is assist you with solutions to challenging industrial security challenges. How may I assist you today?
Regards,
Ann J. Martick, ISP
AJ's Consulting
|
|
|
She's fabulous! I'm so thankful to have had this training. I would highly recommend her to anyone.
Jennifer Schulmeier
San Antonio, TX |
The procedures will be a great help in updating and maintaining my SMO in JPAS.
Vida Castillo
Trinity, FL |
The class was excellent. The small group size was very conducive to learning and the ability to practice with our own data made the session practical.
Michelle Stalder
Charlotte, NC |
|
Hiring Foreign Nationals & Clearing Dual Citizens |
 | | Divided loyalties |
| |
Many DoD Contractors hire foreign nationals and dual citizen employees and consultants. Sometimes they are the solution to a tricky question. Sometimes this type of individual can place your facility in a pickle.
It is difficult for a DoD Contractor to maintain a Facility Clearance Level (FCL) after hiring Key Management Personnel (KMPs) who are foreign nationals. Per the NISPOM, all KMPs must be cleared to the level of the Facility. Another requirement is that a person must be a U.S. Citizen in order to obtain a U.S. Clearance level. If you hire an executive who is a foreign national, be sure it is for a position that can be excluded from having access to classified.
Foreign national preferance, influence, or ownership concerns by the US governent are addressed with the SF 328 Certificate Pertaining to Foreign Influence and Ownership (FOCI) and the special agreements, proxy agreements, etc from NISPOM Chapter 2 Section 3. Currently DSS is focusing pretty hard on how the SF 328 is filled out and how the special agreements are being followed and maintained. FOCI facilities usually have teams of DSS Representatives visiting for 2 or more days during their Security Reviews. Obtaining a FCL with FOCI issues requires a National Interest Determination (NID) in your favor.
Dual citizens must relinquish their passport to the FSO or may have to revoke their foreign citizenship in order to be granted a clearance. Usually the clearance is granted immediately after the FSO certifies one of the above actions.
If you have a special need that can not be met by hiring a U.S. citizen, but can be met by hiring a foreign national and the person must have access to classified -- you are looking at a need for a Limited Access Authorization (LAA). The process for applying for an LAA is on the www.dss.mil website on this page.
One other concern regarding foreign nationals and those who are Representativs of a Foreign Interest (RFI) -- these folks should not have access to any unclassified information marked FOUO, ITAR, or Import/Export restricted.
|
Your newsletters are always great, and I just wanted you to know that I thoroughly enjoyed this past one! Thank you for putting together such helpful information!
Debra Hula
West Lafayette, IN |
|
|
