WEBVTT
00:00:04.559 --> 00:00:09.759
Welcome to DOD Secure, and I'm your host, Jeff Bennett.
00:00:13.839 --> 00:00:15.759
Well, thanks so much for joining us.
00:00:16.320 --> 00:00:22.800
I hope it pumps you up for a very important discussion that we're going to have in this podcast.
00:00:28.239 --> 00:00:31.679
Hi, and welcome to our podcast and YouTube video.
00:00:31.839 --> 00:00:39.759
I'm Jeff Bennett with Thrive Analysis Group and with my other companies, Redbite Publishing, aka NISPPOM Central.
00:00:39.920 --> 00:00:47.359
And today we're going to talk about the senior management official and their relationship with the facility security officer.
00:00:47.600 --> 00:00:53.840
So maybe you don't have a good relationship with your senior management official.
00:00:54.079 --> 00:00:56.880
Maybe you don't have a NISPOM problem.
00:00:57.119 --> 00:00:59.200
Maybe you have an influence problem.
00:00:59.439 --> 00:01:06.719
What I mean by that is you have a relationship or requirement to have a relationship with your senior management official.
00:01:06.879 --> 00:01:14.239
And depending on your company and your organization structure, that relationship may be strained or non existent at all.
00:01:14.400 --> 00:01:15.840
Let's talk more about it.
00:01:16.079 --> 00:01:20.719
So FSOs are appointed to execute the cleared facilities security program.
00:01:21.200 --> 00:01:41.359
FSOs ensure that the facility clearance and the personnel clearances, the policies and procedures and programs are in place that allow the company or provide the company with the ability to execute contract deliverables and do so while protecting classified information and being NISPOM compliant.
00:01:41.599 --> 00:01:44.560
I hope to be able to provide you some guidance on here.
00:01:44.799 --> 00:01:50.959
And the next podcast, I'm going to bring a very special guest in, and I'll tell you about it on the next podcast.
00:01:51.200 --> 00:02:06.640
But I'm going to bring him in and see if he has any good recommendations on how the FSOs and the SMO can close any gaps between their ability to communicate and protect classified information at their facilities.
00:02:06.879 --> 00:02:18.560
But in this podcast, we're just going to discuss the roles and responsibilities of the senior management official and indicate any gaps and recommend how to fill those gaps technically.
00:02:18.719 --> 00:02:26.319
And then later we're going to bring in an organizational consultant to give us some ideas on how we can do this.
00:02:26.560 --> 00:02:40.639
So without a good understanding of NISPOM and how to operate under NISPOM requirements, FSOs are potentially positioned to spend many hours building programs that do not live up to their potential.
00:02:40.800 --> 00:02:48.560
Without a good relationship with that senior management official, so think check the box and get a satisfactory rating.
00:02:48.639 --> 00:02:58.560
The FSO can work independently without a good relationship with their senior management official and potentially get that satisfactory rating.
00:02:58.719 --> 00:03:15.919
However, if you want to up your rating, if you want to get a good firm either satisfactory rating and have DCSA have full confidence in you, that senior management official must be engaged and must be able to describe their level of engagement.
00:03:16.240 --> 00:03:25.039
So potentially you could be getting a commendable or superior by applying what is in this podcast.
00:03:25.280 --> 00:03:35.599
Worst case scenario, performance and NISPOM compliance can be strained if the SMO and the FSO and the insider threat program senior official are not in sync.
00:03:35.759 --> 00:03:43.840
And again, this depends fully on the senior management officials' involvement and willingness to engage with the FSO and the ITPSO.
00:03:44.080 --> 00:03:58.159
If you're ever wondering why you're not able to build that cohesive relationship with the SMO, this episode will highlight the challenges that you face and show you what is missing and give you a roadmap to improve that relationship.
00:03:58.400 --> 00:04:15.120
In this podcast, I'll walk through the definitions, relationships, roles, and responsibilities of the senior management official and will also provide recommendations of how to take advantage of this opportunity to have an absolutely unfair advantage in building that SMO FSO relationship.
00:04:15.360 --> 00:04:21.519
The SMO, FSO, and ITPSO, there's general procedures laid out in NISPPOM.
00:04:21.680 --> 00:04:25.600
And I'm telling you, if you don't have a copy of NISPPOM, you need a copy.
00:04:25.680 --> 00:04:31.360
If you're an FSO or senior management official or a key management person, you need a copy of NISPPOM.
00:04:31.600 --> 00:04:32.959
Make sure your employees have it.
00:04:33.199 --> 00:04:36.480
How else are they going to know how to apply the NISPPOM?
00:04:36.720 --> 00:04:39.600
You've got to read this thing, you've got to understand it.
00:04:39.839 --> 00:04:51.040
And you'll see how your organization should engage in their security program through the eyes of the Cognizant Security Agency or DCSA at this point.
00:04:51.279 --> 00:04:55.360
So the senior management official is designated in writing.
00:04:55.600 --> 00:04:59.199
They must be cleared to the level of the security clearance.
00:04:59.360 --> 00:05:07.759
So many FSOs are engaged in their facility clearances and personnel clearances once the company is cleared.
00:05:07.839 --> 00:05:15.439
They might come into a new role as a hired FSO, or they may be engaged as an FSO at an already existing facility.
00:05:15.680 --> 00:05:26.800
But for those of you who have been FSOs from the very get-go, you might remember the process of getting that FCL and working with DCSA on getting your facility clearance.
00:05:27.120 --> 00:05:41.680
You may remember submitting corporate documents, articles of the in corporations, et cetera, that identify key management personnel, especially the senior management official, insider threat program senior official, and the facility security officer.
00:05:41.920 --> 00:05:53.199
The SMO is designated in writing, perhaps in corporate documents, but definitely uploaded in the cognizant security activities or agencies database.
00:05:53.360 --> 00:05:58.560
They are there in NISP, and you should have that information downloaded in your FSO workbook.
00:05:58.720 --> 00:06:02.079
SMOs are appointed security officials, believe it or not.
00:06:02.240 --> 00:06:08.079
So in NISPOM, they're required to oversee the implementation of NISPOM in their organization.
00:06:08.399 --> 00:06:15.839
They undergo the same security training as cleared employees and they undergo position specific training.
00:06:16.000 --> 00:06:17.360
Now I'm going to ask you a question.
00:06:17.519 --> 00:06:18.480
A couple of questions.
00:06:18.720 --> 00:06:22.560
Where does an insider threat program senior official go for training?
00:06:22.800 --> 00:06:26.639
Where do appointed insider threat personnel go for training?
00:06:26.879 --> 00:06:28.720
Where do FSOs go for training?
00:06:28.879 --> 00:06:40.160
If you're in the NO, right, they go to the CSA's, follow CSA's guidance and register on the website and take their required training.
00:06:40.399 --> 00:06:42.240
PSOs take required training.
00:06:42.399 --> 00:06:53.279
FSOs must be certified with their required training and they get a certification and they upload it into their FSO workbooks and display it to DCSA when they come around.
00:06:53.439 --> 00:06:54.959
Let me ask you this question.
00:07:02.639 --> 00:07:05.839
The answer to that question is there is no formal training for SMO.
00:07:06.000 --> 00:07:13.120
Senior management officials are trained by the FSO on the job, and that's why it's important that they have a great relationship.
00:07:13.360 --> 00:07:20.639
Now I recommend that the SMO take training on DCSA's website and understand their roles.
00:07:20.800 --> 00:07:29.839
But if not, we have SMO training at NISPOM Central that will explain to the SMO their roles and procedures.
00:07:30.000 --> 00:07:34.800
I'm going to describe your roles and procedures and maybe you can figure out how to get that training.
00:07:35.040 --> 00:07:43.680
If SMOs are performing these functions, how does the FSO in the organization coordinate efforts with the SMO?
00:07:43.839 --> 00:07:49.920
Now remember, one thing that says in NISPOM that the SMO cannot delegate their accountability.
00:07:50.160 --> 00:07:54.000
That means their role cannot be delegated to the FSO.
00:07:54.240 --> 00:07:59.920
The SMO is accountable for the organization's security posture.
00:08:00.240 --> 00:08:01.759
Let me give you an example of that.
00:08:02.079 --> 00:08:15.680
Every DCSA review that I've attended with my clients, the senior management official who is in the room and present the entire time pretty much has answered all of DCSA's questions.
00:08:15.920 --> 00:08:20.879
And in those cases, they've received commendable or above ratings.
00:08:21.279 --> 00:08:42.639
If there is a technically savvy FSO and a very knowledgeable senior management official in the room, DCSA can ask questions and receive answers that inspires confidence in the clear defense contractor's ability to protect classified information.
00:08:42.879 --> 00:08:55.279
And when that happens, the further asking of questions that fit the gold standard criteria can be applied, and these organizations end up getting commendable or superior ratings.
00:08:55.440 --> 00:09:03.039
Under the NISPPOM, the SMO has tasks that include but are not limited to compliance oversight.
00:09:03.279 --> 00:09:04.240
What compliance?
00:09:04.320 --> 00:09:06.559
What oversight of the NISPPOM?
00:09:06.879 --> 00:09:10.960
Then implementation of security measures and ensuring compliance.
00:09:11.120 --> 00:09:12.240
What does that mean?
00:09:12.559 --> 00:09:19.360
It means that the SMO should know what the policies and procedures and practices of the organization are.
00:09:19.600 --> 00:09:20.879
Guess where those are found?
00:09:21.039 --> 00:09:29.360
In the standard practices and procedures, in insider threat working, insider threat program policies and the seed three reporting policies.
00:09:29.759 --> 00:09:40.480
So the SMO should be able to answer at a very high level the policies and procedures and practices of the company when it comes to protecting classified information.
00:09:40.720 --> 00:09:43.440
Let's talk about security compliance oversight.
00:09:43.679 --> 00:09:48.320
Let me ask some questions about the SMO's accountability.
00:09:48.639 --> 00:09:52.000
Does the SMO support training objectives?
00:09:52.320 --> 00:10:12.080
For example, if employees are not taking their required training and the FSO has been chasing them to complete their training, can they rely on the SMO to back them up or provide some type of support and accountability so that these employees will complete their training in time?
00:10:12.320 --> 00:10:16.960
Does the SMO get the whole organization involved with supporting policies?
00:10:17.200 --> 00:10:27.200
For example, IT or anybody can engage with a learning management system to make sure that the training is uploaded and that there's a way to account for people taking training.
00:10:27.360 --> 00:10:29.600
Does the SMO support foreign travel?
00:10:29.759 --> 00:10:36.000
I've seen instances where the SMO travels constantly and does not notify the FSO.
00:10:36.159 --> 00:10:40.080
The question is, does the SMO re report their own foreign travel?
00:10:40.240 --> 00:10:43.840
Does the senior management official engage with 254 requirements?
00:10:44.159 --> 00:11:01.279
Do they review the 254s, understand what the security clearance requirements are, and assess risk and understand that funding may be necessary for additional resources to protect classified information?
00:11:01.679 --> 00:11:08.879
Or does the FSO have to constantly go to the senior management official about a budget and defend that budget?
00:11:09.120 --> 00:11:16.320
If the FSO and SMO are in sync, it's a better environment to supporting these classified contracts.
00:11:16.559 --> 00:11:21.440
Additional SMO responsibility includes oversight of the insider threat program.
00:11:21.919 --> 00:11:28.240
They oversee the insider threat program senior official, in fact, they appoint them just like they appoint the FSO in writing.
00:11:28.320 --> 00:11:33.840
And they're responsible for developing, implementing, and overseeing the organization's insider threat program.
00:11:34.399 --> 00:11:38.240
Can the SMO describe the insider threat reporting requirements?
00:11:38.559 --> 00:11:41.440
Is the SMO engaged with insider threat working group?
00:11:41.759 --> 00:11:55.519
Does the insider threat program senior official actively engage with the FSO and the SMO to review, consult on, make recommendations for the insider threat policy?
00:11:55.759 --> 00:11:59.600
Can they describe it to a certain degree of detail?
00:11:59.840 --> 00:12:04.240
And when DCSA comes around, can they answer questions about the insider threat program?
00:12:04.799 --> 00:12:11.360
The self-inspection program is an integral part of maintaining that facility clearance.
00:12:11.519 --> 00:12:14.960
It helps identify areas of risk within the organization.
00:12:16.159 --> 00:12:29.600
While the FSO or somebody on the security management staff conducts the self-inspection, they use that booklet called the Self-Inspection Program for NISP contractors, a big checklist.
00:12:29.840 --> 00:12:37.919
You can check yes or no, but I always recommend filling in or completing the narrative area with as much detail as possible.
00:12:38.240 --> 00:12:39.679
Because guess what happens?
00:12:39.919 --> 00:13:03.759
After the self-inspection handbook is completed, the FSO must complete a report and a certification, brief it to the SMO, and the SMO signs that memorandum saying that they understand that the self-inspection was conducted, risks were identified and mitigated, and that they understand the findings of the self-inspection.
00:13:04.000 --> 00:13:07.679
He's going to come and conduct a security review.
00:13:07.840 --> 00:13:13.120
They're going to look at the security education and awareness, they're going to look at insider threat mitigation.
00:13:13.360 --> 00:13:16.879
They're going to look at record keeping and administrative.
00:13:17.440 --> 00:13:23.840
This is where they know inherently how the SMO is engaged, if at all.
00:13:24.320 --> 00:13:30.240
Because when they're asking these questions, they're looking for SMO responses.
00:13:30.480 --> 00:13:33.600
How do you support security, education, and awareness?
00:13:33.840 --> 00:13:36.320
Are there any issues with insider threat?
00:13:36.559 --> 00:13:44.080
Have you been briefed by the counterintelligence agent from DCSA on any risks and have you mitigated those risks?
00:13:44.240 --> 00:13:45.919
What risks were identified?
00:13:46.159 --> 00:14:08.240
It was important that the FSO and the SMO and the ITPSO are engaged and informed of each other's roles, their responsibilities, and how they will respond to the self-inspection, to training requirements, and protecting classified information and be able to relay those responses to DCSA when they come and do their audit.
00:14:08.399 --> 00:14:18.480
If you're having problems with applying NISPOM in your money and getting report support, it may not be an issue of NISPPOM compliance.
00:14:18.639 --> 00:14:20.320
It may be an issue of now.
00:14:41.279 --> 00:14:53.679
And you have your headquarters element, you have your senior management official, FSO, and ITPSO may be the same person, or maybe one or two people, and your workforce, they're all company officers.
00:14:53.840 --> 00:14:55.919
Your key management personnel might be here.
00:14:56.080 --> 00:15:02.240
I know companies with two or three employees, and they're all key management personnel, and they're all the workforce as well.
00:15:02.480 --> 00:15:09.279
So this is a situation where the FSO, the senior management official, and the ITPSO may all be one person.
00:15:09.360 --> 00:15:14.320
So there are usually not any issues with the FSO, ITPSO relationship.
00:15:14.559 --> 00:15:17.600
But something happens when the company starts to grow.
00:15:17.840 --> 00:15:24.960
What is an ideal situation is that the company officers are all represented in this circle still.
00:15:25.120 --> 00:15:35.039
You have your headquarters, and under that headquarters is a senior management official, and they are going to appoint these FSOs and ITPSOs to do their job.
00:15:35.279 --> 00:15:43.840
That's great, especially if these FSOs and ITPSOs are accountable or rated by the SMO.
00:15:44.000 --> 00:15:47.519
Again, the SMO is identified in corporate documents.
00:15:47.679 --> 00:15:51.120
The FSOs and ITPSOs are appointed in writing.
00:15:51.279 --> 00:15:56.960
And since that relationship should be there, maybe they should be there on the organizational structure together.
00:15:57.200 --> 00:16:01.840
Next slide I want to show you is what usually happens, especially in larger corporations.
00:16:02.080 --> 00:16:06.559
You have the company officers, and the SMO is always a key management person.
00:16:06.639 --> 00:16:12.559
They're always a company officer at the highest level, high enough to direct operations, according to NISPOM.
00:16:12.799 --> 00:16:16.399
And they're up there with all the other senior vice presidents.
00:16:16.720 --> 00:16:24.879
But suddenly there are VPs and directors that are outside of the company officer appointments.
00:16:25.120 --> 00:16:26.639
They're not KMP.
00:16:26.960 --> 00:16:29.519
And under them is the workforce.
00:16:29.679 --> 00:16:37.200
All these people are outside of the company officer positions, including the FSO and the ITPSO.
00:16:37.279 --> 00:16:40.879
And it is a long way from the FSO to the SMO.
00:16:41.039 --> 00:16:43.519
And it's unlikely they're going to communicate.
00:16:43.679 --> 00:16:49.679
They may communicate via this VP who communicates with another VP who gets to the SMO.
00:16:49.919 --> 00:16:51.440
We don't want this scenario.
00:16:51.600 --> 00:16:55.840
The FSO must always have a direct line to the SMO.
00:16:56.000 --> 00:17:08.799
So it's important that there is a competent FSO and ITPSO assigned that can communicate confidently and correctly with a senior management official and that there is a certain amount of trust there.
00:17:08.880 --> 00:17:14.160
Because we want to bring this FSO back up into the company officer position.
00:17:14.240 --> 00:17:17.279
So stay with me and we'll discuss some ways to do this.
00:17:17.440 --> 00:17:20.559
And again, my special guest will be here on our next podcast.
00:17:20.640 --> 00:17:22.400
So I hope you will join us.
00:17:58.960 --> 00:18:01.119
And the other question is, how do I get a security clear?
00:18:01.680 --> 00:18:03.119
We are here to help you out.
00:18:03.599 --> 00:18:22.559
And I hope you remember that when you visit our show notes today, you will find those resources, as well as access to my other company, Thrive Analysis Group, where we actually perform NISPOM tasks and as well as FSO or NISPPOM consulting in case you have that need.
00:18:22.799 --> 00:18:25.680
Wish you all the best, and we'll see you next time.
00:00:04.559 --> 00:00:09.759
Welcome to DOD Secure, and I'm your host, Jeff Bennett.
00:00:13.839 --> 00:00:15.759
Well, thanks so much for joining us.
00:00:16.320 --> 00:00:22.800
I hope it pumps you up for a very important discussion that we're going to have in this podcast.
00:00:28.239 --> 00:00:31.679
Hi, and welcome to our podcast and YouTube video.
00:00:31.839 --> 00:00:39.759
I'm Jeff Bennett with Thrive Analysis Group and with my other companies, Redbite Publishing, aka NISPPOM Central.
00:00:39.920 --> 00:00:47.359
And today we're going to talk about the senior management official and their relationship with the facility security officer.
00:00:47.600 --> 00:00:53.840
So maybe you don't have a good relationship with your senior management official.
00:00:54.079 --> 00:00:56.880
Maybe you don't have a NISPOM problem.
00:00:57.119 --> 00:00:59.200
Maybe you have an influence problem.
00:00:59.439 --> 00:01:06.719
What I mean by that is you have a relationship or requirement to have a relationship with your senior management official.
00:01:06.879 --> 00:01:14.239
And depending on your company and your organization structure, that relationship may be strained or non existent at all.
00:01:14.400 --> 00:01:15.840
Let's talk more about it.
00:01:16.079 --> 00:01:20.719
So FSOs are appointed to execute the cleared facilities security program.
00:01:21.200 --> 00:01:41.359
FSOs ensure that the facility clearance and the personnel clearances, the policies and procedures and programs are in place that allow the company or provide the company with the ability to execute contract deliverables and do so while protecting classified information and being NISPOM compliant.
00:01:41.599 --> 00:01:44.560
I hope to be able to provide you some guidance on here.
00:01:44.799 --> 00:01:50.959
And the next podcast, I'm going to bring a very special guest in, and I'll tell you about it on the next podcast.
00:01:51.200 --> 00:02:06.640
But I'm going to bring him in and see if he has any good recommendations on how the FSOs and the SMO can close any gaps between their ability to communicate and protect classified information at their facilities.
00:02:06.879 --> 00:02:18.560
But in this podcast, we're just going to discuss the roles and responsibilities of the senior management official and indicate any gaps and recommend how to fill those gaps technically.
00:02:18.719 --> 00:02:26.319
And then later we're going to bring in an organizational consultant to give us some ideas on how we can do this.
00:02:26.560 --> 00:02:40.639
So without a good understanding of NISPOM and how to operate under NISPOM requirements, FSOs are potentially positioned to spend many hours building programs that do not live up to their potential.
00:02:40.800 --> 00:02:48.560
Without a good relationship with that senior management official, so think check the box and get a satisfactory rating.
00:02:48.639 --> 00:02:58.560
The FSO can work independently without a good relationship with their senior management official and potentially get that satisfactory rating.
00:02:58.719 --> 00:03:15.919
However, if you want to up your rating, if you want to get a good firm either satisfactory rating and have DCSA have full confidence in you, that senior management official must be engaged and must be able to describe their level of engagement.
00:03:16.240 --> 00:03:25.039
So potentially you could be getting a commendable or superior by applying what is in this podcast.
00:03:25.280 --> 00:03:35.599
Worst case scenario, performance and NISPOM compliance can be strained if the SMO and the FSO and the insider threat program senior official are not in sync.
00:03:35.759 --> 00:03:43.840
And again, this depends fully on the senior management officials' involvement and willingness to engage with the FSO and the ITPSO.
00:03:44.080 --> 00:03:58.159
If you're ever wondering why you're not able to build that cohesive relationship with the SMO, this episode will highlight the challenges that you face and show you what is missing and give you a roadmap to improve that relationship.
00:03:58.400 --> 00:04:15.120
In this podcast, I'll walk through the definitions, relationships, roles, and responsibilities of the senior management official and will also provide recommendations of how to take advantage of this opportunity to have an absolutely unfair advantage in building that SMO FSO relationship.
00:04:15.360 --> 00:04:21.519
The SMO, FSO, and ITPSO, there's general procedures laid out in NISPPOM.
00:04:21.680 --> 00:04:25.600
And I'm telling you, if you don't have a copy of NISPPOM, you need a copy.
00:04:25.680 --> 00:04:31.360
If you're an FSO or senior management official or a key management person, you need a copy of NISPPOM.
00:04:31.600 --> 00:04:32.959
Make sure your employees have it.
00:04:33.199 --> 00:04:36.480
How else are they going to know how to apply the NISPPOM?
00:04:36.720 --> 00:04:39.600
You've got to read this thing, you've got to understand it.
00:04:39.839 --> 00:04:51.040
And you'll see how your organization should engage in their security program through the eyes of the Cognizant Security Agency or DCSA at this point.
00:04:51.279 --> 00:04:55.360
So the senior management official is designated in writing.
00:04:55.600 --> 00:04:59.199
They must be cleared to the level of the security clearance.
00:04:59.360 --> 00:05:07.759
So many FSOs are engaged in their facility clearances and personnel clearances once the company is cleared.
00:05:07.839 --> 00:05:15.439
They might come into a new role as a hired FSO, or they may be engaged as an FSO at an already existing facility.
00:05:15.680 --> 00:05:26.800
But for those of you who have been FSOs from the very get-go, you might remember the process of getting that FCL and working with DCSA on getting your facility clearance.
00:05:27.120 --> 00:05:41.680
You may remember submitting corporate documents, articles of the in corporations, et cetera, that identify key management personnel, especially the senior management official, insider threat program senior official, and the facility security officer.
00:05:41.920 --> 00:05:53.199
The SMO is designated in writing, perhaps in corporate documents, but definitely uploaded in the cognizant security activities or agencies database.
00:05:53.360 --> 00:05:58.560
They are there in NISP, and you should have that information downloaded in your FSO workbook.
00:05:58.720 --> 00:06:02.079
SMOs are appointed security officials, believe it or not.
00:06:02.240 --> 00:06:08.079
So in NISPOM, they're required to oversee the implementation of NISPOM in their organization.
00:06:08.399 --> 00:06:15.839
They undergo the same security training as cleared employees and they undergo position specific training.
00:06:16.000 --> 00:06:17.360
Now I'm going to ask you a question.
00:06:17.519 --> 00:06:18.480
A couple of questions.
00:06:18.720 --> 00:06:22.560
Where does an insider threat program senior official go for training?
00:06:22.800 --> 00:06:26.639
Where do appointed insider threat personnel go for training?
00:06:26.879 --> 00:06:28.720
Where do FSOs go for training?
00:06:28.879 --> 00:06:40.160
If you're in the NO, right, they go to the CSA's, follow CSA's guidance and register on the website and take their required training.
00:06:40.399 --> 00:06:42.240
PSOs take required training.
00:06:42.399 --> 00:06:53.279
FSOs must be certified with their required training and they get a certification and they upload it into their FSO workbooks and display it to DCSA when they come around.
00:06:53.439 --> 00:06:54.959
Let me ask you this question.
00:07:02.639 --> 00:07:05.839
The answer to that question is there is no formal training for SMO.
00:07:06.000 --> 00:07:13.120
Senior management officials are trained by the FSO on the job, and that's why it's important that they have a great relationship.
00:07:13.360 --> 00:07:20.639
Now I recommend that the SMO take training on DCSA's website and understand their roles.
00:07:20.800 --> 00:07:29.839
But if not, we have SMO training at NISPOM Central that will explain to the SMO their roles and procedures.
00:07:30.000 --> 00:07:34.800
I'm going to describe your roles and procedures and maybe you can figure out how to get that training.
00:07:35.040 --> 00:07:43.680
If SMOs are performing these functions, how does the FSO in the organization coordinate efforts with the SMO?
00:07:43.839 --> 00:07:49.920
Now remember, one thing that says in NISPOM that the SMO cannot delegate their accountability.
00:07:50.160 --> 00:07:54.000
That means their role cannot be delegated to the FSO.
00:07:54.240 --> 00:07:59.920
The SMO is accountable for the organization's security posture.
00:08:00.240 --> 00:08:01.759
Let me give you an example of that.
00:08:02.079 --> 00:08:15.680
Every DCSA review that I've attended with my clients, the senior management official who is in the room and present the entire time pretty much has answered all of DCSA's questions.
00:08:15.920 --> 00:08:20.879
And in those cases, they've received commendable or above ratings.
00:08:21.279 --> 00:08:42.639
If there is a technically savvy FSO and a very knowledgeable senior management official in the room, DCSA can ask questions and receive answers that inspires confidence in the clear defense contractor's ability to protect classified information.
00:08:42.879 --> 00:08:55.279
And when that happens, the further asking of questions that fit the gold standard criteria can be applied, and these organizations end up getting commendable or superior ratings.
00:08:55.440 --> 00:09:03.039
Under the NISPPOM, the SMO has tasks that include but are not limited to compliance oversight.
00:09:03.279 --> 00:09:04.240
What compliance?
00:09:04.320 --> 00:09:06.559
What oversight of the NISPPOM?
00:09:06.879 --> 00:09:10.960
Then implementation of security measures and ensuring compliance.
00:09:11.120 --> 00:09:12.240
What does that mean?
00:09:12.559 --> 00:09:19.360
It means that the SMO should know what the policies and procedures and practices of the organization are.
00:09:19.600 --> 00:09:20.879
Guess where those are found?
00:09:21.039 --> 00:09:29.360
In the standard practices and procedures, in insider threat working, insider threat program policies and the seed three reporting policies.
00:09:29.759 --> 00:09:40.480
So the SMO should be able to answer at a very high level the policies and procedures and practices of the company when it comes to protecting classified information.
00:09:40.720 --> 00:09:43.440
Let's talk about security compliance oversight.
00:09:43.679 --> 00:09:48.320
Let me ask some questions about the SMO's accountability.
00:09:48.639 --> 00:09:52.000
Does the SMO support training objectives?
00:09:52.320 --> 00:10:12.080
For example, if employees are not taking their required training and the FSO has been chasing them to complete their training, can they rely on the SMO to back them up or provide some type of support and accountability so that these employees will complete their training in time?
00:10:12.320 --> 00:10:16.960
Does the SMO get the whole organization involved with supporting policies?
00:10:17.200 --> 00:10:27.200
For example, IT or anybody can engage with a learning management system to make sure that the training is uploaded and that there's a way to account for people taking training.
00:10:27.360 --> 00:10:29.600
Does the SMO support foreign travel?
00:10:29.759 --> 00:10:36.000
I've seen instances where the SMO travels constantly and does not notify the FSO.
00:10:36.159 --> 00:10:40.080
The question is, does the SMO re report their own foreign travel?
00:10:40.240 --> 00:10:43.840
Does the senior management official engage with 254 requirements?
00:10:44.159 --> 00:11:01.279
Do they review the 254s, understand what the security clearance requirements are, and assess risk and understand that funding may be necessary for additional resources to protect classified information?
00:11:01.679 --> 00:11:08.879
Or does the FSO have to constantly go to the senior management official about a budget and defend that budget?
00:11:09.120 --> 00:11:16.320
If the FSO and SMO are in sync, it's a better environment to supporting these classified contracts.
00:11:16.559 --> 00:11:21.440
Additional SMO responsibility includes oversight of the insider threat program.
00:11:21.919 --> 00:11:28.240
They oversee the insider threat program senior official, in fact, they appoint them just like they appoint the FSO in writing.
00:11:28.320 --> 00:11:33.840
And they're responsible for developing, implementing, and overseeing the organization's insider threat program.
00:11:34.399 --> 00:11:38.240
Can the SMO describe the insider threat reporting requirements?
00:11:38.559 --> 00:11:41.440
Is the SMO engaged with insider threat working group?
00:11:41.759 --> 00:11:55.519
Does the insider threat program senior official actively engage with the FSO and the SMO to review, consult on, make recommendations for the insider threat policy?
00:11:55.759 --> 00:11:59.600
Can they describe it to a certain degree of detail?
00:11:59.840 --> 00:12:04.240
And when DCSA comes around, can they answer questions about the insider threat program?
00:12:04.799 --> 00:12:11.360
The self-inspection program is an integral part of maintaining that facility clearance.
00:12:11.519 --> 00:12:14.960
It helps identify areas of risk within the organization.
00:12:16.159 --> 00:12:29.600
While the FSO or somebody on the security management staff conducts the self-inspection, they use that booklet called the Self-Inspection Program for NISP contractors, a big checklist.
00:12:29.840 --> 00:12:37.919
You can check yes or no, but I always recommend filling in or completing the narrative area with as much detail as possible.
00:12:38.240 --> 00:12:39.679
Because guess what happens?
00:12:39.919 --> 00:13:03.759
After the self-inspection handbook is completed, the FSO must complete a report and a certification, brief it to the SMO, and the SMO signs that memorandum saying that they understand that the self-inspection was conducted, risks were identified and mitigated, and that they understand the findings of the self-inspection.
00:13:04.000 --> 00:13:07.679
He's going to come and conduct a security review.
00:13:07.840 --> 00:13:13.120
They're going to look at the security education and awareness, they're going to look at insider threat mitigation.
00:13:13.360 --> 00:13:16.879
They're going to look at record keeping and administrative.
00:13:17.440 --> 00:13:23.840
This is where they know inherently how the SMO is engaged, if at all.
00:13:24.320 --> 00:13:30.240
Because when they're asking these questions, they're looking for SMO responses.
00:13:30.480 --> 00:13:33.600
How do you support security, education, and awareness?
00:13:33.840 --> 00:13:36.320
Are there any issues with insider threat?
00:13:36.559 --> 00:13:44.080
Have you been briefed by the counterintelligence agent from DCSA on any risks and have you mitigated those risks?
00:13:44.240 --> 00:13:45.919
What risks were identified?
00:13:46.159 --> 00:14:08.240
It was important that the FSO and the SMO and the ITPSO are engaged and informed of each other's roles, their responsibilities, and how they will respond to the self-inspection, to training requirements, and protecting classified information and be able to relay those responses to DCSA when they come and do their audit.
00:14:08.399 --> 00:14:18.480
If you're having problems with applying NISPOM in your money and getting report support, it may not be an issue of NISPPOM compliance.
00:14:18.639 --> 00:14:20.320
It may be an issue of now.
00:14:41.279 --> 00:14:53.679
And you have your headquarters element, you have your senior management official, FSO, and ITPSO may be the same person, or maybe one or two people, and your workforce, they're all company officers.
00:14:53.840 --> 00:14:55.919
Your key management personnel might be here.
00:14:56.080 --> 00:15:02.240
I know companies with two or three employees, and they're all key management personnel, and they're all the workforce as well.
00:15:02.480 --> 00:15:09.279
So this is a situation where the FSO, the senior management official, and the ITPSO may all be one person.
00:15:09.360 --> 00:15:14.320
So there are usually not any issues with the FSO, ITPSO relationship.
00:15:14.559 --> 00:15:17.600
But something happens when the company starts to grow.
00:15:17.840 --> 00:15:24.960
What is an ideal situation is that the company officers are all represented in this circle still.
00:15:25.120 --> 00:15:35.039
You have your headquarters, and under that headquarters is a senior management official, and they are going to appoint these FSOs and ITPSOs to do their job.
00:15:35.279 --> 00:15:43.840
That's great, especially if these FSOs and ITPSOs are accountable or rated by the SMO.
00:15:44.000 --> 00:15:47.519
Again, the SMO is identified in corporate documents.
00:15:47.679 --> 00:15:51.120
The FSOs and ITPSOs are appointed in writing.
00:15:51.279 --> 00:15:56.960
And since that relationship should be there, maybe they should be there on the organizational structure together.
00:15:57.200 --> 00:16:01.840
Next slide I want to show you is what usually happens, especially in larger corporations.
00:16:02.080 --> 00:16:06.559
You have the company officers, and the SMO is always a key management person.
00:16:06.639 --> 00:16:12.559
They're always a company officer at the highest level, high enough to direct operations, according to NISPOM.
00:16:12.799 --> 00:16:16.399
And they're up there with all the other senior vice presidents.
00:16:16.720 --> 00:16:24.879
But suddenly there are VPs and directors that are outside of the company officer appointments.
00:16:25.120 --> 00:16:26.639
They're not KMP.
00:16:26.960 --> 00:16:29.519
And under them is the workforce.
00:16:29.679 --> 00:16:37.200
All these people are outside of the company officer positions, including the FSO and the ITPSO.
00:16:37.279 --> 00:16:40.879
And it is a long way from the FSO to the SMO.
00:16:41.039 --> 00:16:43.519
And it's unlikely they're going to communicate.
00:16:43.679 --> 00:16:49.679
They may communicate via this VP who communicates with another VP who gets to the SMO.
00:16:49.919 --> 00:16:51.440
We don't want this scenario.
00:16:51.600 --> 00:16:55.840
The FSO must always have a direct line to the SMO.
00:16:56.000 --> 00:17:08.799
So it's important that there is a competent FSO and ITPSO assigned that can communicate confidently and correctly with a senior management official and that there is a certain amount of trust there.
00:17:08.880 --> 00:17:14.160
Because we want to bring this FSO back up into the company officer position.
00:17:14.240 --> 00:17:17.279
So stay with me and we'll discuss some ways to do this.
00:17:17.440 --> 00:17:20.559
And again, my special guest will be here on our next podcast.
00:17:20.640 --> 00:17:22.400
So I hope you will join us.
00:17:58.960 --> 00:18:01.119
And the other question is, how do I get a security clear?
00:18:01.680 --> 00:18:03.119
We are here to help you out.
00:18:03.599 --> 00:18:22.559
And I hope you remember that when you visit our show notes today, you will find those resources, as well as access to my other company, Thrive Analysis Group, where we actually perform NISPOM tasks and as well as FSO or NISPPOM consulting in case you have that need.
00:18:22.799 --> 00:18:25.680
Wish you all the best, and we'll see you next time.
