Sunday, July 21, 2013

The Top Secret Control Official and the FSO

Certain topics should be provided during TOP SECRET (TS) Personnel Security Clearance (PCL) initial security briefings and annual follow up training to complete the holder’s education. After all, the higher certification lends to tougher standards and more accountability. Full and complete training will enhance national security by empowering the holder to protect information appropriately.
A Single Scope Background Investigation (SSBI) is necessary to ensure an employee is trustworthy and can be awarded a TOP SECRET Clearance. The SSBI investigates a subject’s periods of employment, residences and education institutions attended. Other areas subject to investigation include searching criminal and financial records. The investigators may contact those with social and professional knowledge of the applicant, and divorced spouses.
Though the SSBI for the final TOP SECRET clearance will take up to a year or longer, employees with a clean record can still have access to TOP SECRET information. This is made possible through a temporary or interim clearance as long as there is no immediate evidence of adverse information. The interim TOP SECRET clearance is the approval allowing the employee to have access to TOP SECRET information, Restricted Data, NATO Information, and Communication Security information at the SECRET and CONFIDENTIAL level. Access to compartmentalized and program information is an altogether different process based on the SSBI, but final access determination is made by the granting authority.
A designated original classification authority makes classification determinations based on demonstration of the level of damage to national security per guidelines found in Executive Order 13526- Classified National Security Information. The OCA classifies information meeting requirements as CONFIDENTIAL, SECRET or TOP SECRET, depending on whether potential impact of compromise is rated as: damage, severe damage or extremely grave damage in that order.
Classified information should be conspicuously marked on the top and bottom of object surface areas. For documents, they should be applied to the top and bottom of each page, on portions, graphs, illustrations and photographs. Markings include not only the classification level, but also the CLASSIFIED BY: information lines. Coversheets should be applied when removed from storage. Hardware labels should be color coded to indicate classification level; orange for TOP SECRET, red for SECRET, blue for CONFIDENTIAL, and green for UNCLASSIFIED.
Since the unauthorized disclosure of TOP SECRET information could cause extremely grave damage to national security, the National Industrial Security Program Operating Manual (NISPOM), DoD Manual 5200.01 and other applicable agency regulations require users to implement more stringent countermeasures. These include denying access through accountability, infrastructure and information assurance. These countermeasures are applied as long as the information remains at the TS level or until downgraded, declassified or destroyed.

Cleared contractors that are granted a TS Facility Clearance (FCL) and are authorized to maintain a TS inventory are required to appoint a TOP SECRET control official (TSCO).  All transactions involving TS require access and accountability records. This requirement is for the lifecycle of the TS information and includes reception, transmission, destruction and storage.  Additionally, the contractor is required to perform an annual accountability inventory unless a waiver for the requirement is on file.
For example, all TOP SECRET information and material is documented by numbering them in a series. This allows the contractor and owner of the classified information to know exactly how many there are and what to look for during inventory. Any incoming material, copies generated or faxes transmitted are documented with the number and accounted for by the TOP SECRET control official using the numbering and a continuous receipt system.  
All classified material should be delivered only to the persons authorized for receipt. In the case of TOP SECRET material, that person is the TSCO. Cleared contractors should implement practices that ensure that classified material, regardless of delivery method, is received directly by authorized personnel. Once received, the receiver should examine the classified information for evidence of tampering and compare the contents with the receipt. Once received and inspection completed, the TSCO will sign and return the receipts to the sender, closing out the sender’s requirements to account for that TOP SECRET item.
After documenting the TOP SECRET material’s arrival, the TSCO is responsible for safeguarding it in a GSA-approved security container, an approved vault, or an approved closed area with supplemental controls. These controls include:
a. Intrusion Detection Systems as described in the NISPOM Chapter 5, Section 9 (rather lengthy, so study up). Tamper alarms are necessary for TOP SECRET storage.
b. Cleared contractors with security guards approved as supplemental protection prior to January 1, 1995, can continue to use them. In that case, they are required to patrol every 2 hours for TOP SECRET.
c. In some cases the supplemental controls may not be required. For example, where the CSA determines that the GSA approved security containers and approved vaults are in facilities with security in depth and they are secured with a locking mechanism meeting Federal Specification FF-L-2740.
TOP SECRET Transmission Outside a Facility. The cleared contractor is not authorized to transmit any TOP SECRET material outside of the cleared facility. Only the government contracting activity that provided authorization to work with the TOP SECRET material can authorize the transmission with written permission. Employees should always go through the Facility Security Officer and TSCO before attempting to transmit any TOP SECRET material. For two reasons; to ensure written authorization is on hand, and to account for the status of all existing or to be reproduced TOP SECRET material. When written authorization is provided, TOP SECRET material may be transmitted by the following methods within and directly between the United States and its territorial areas.
a. The Defense Courier Service.
b. A designated courier or escort cleared for access to TOP SECRET information.
c. By electrical means over government cognizant security agency-approved secured communications security circuits, that meets NISPOM standards, the telecommunications security provisions of the contract, or as otherwise authorized by the government contracting activity.
Transmission of TOP SECRET material outside the United States and its territorial areas can be accomplished with the Defense Courier Service, Department of State Courier System, or a courier service authorized by the government contracting activity.
The TSCO should be involved with any activity involving TOP SECRET material including reproduction. Again, not only will they ensure that it is authorized and/or contract related, but they will assign the control number for the new document and account and receipt all activities including its creation, storage, transmission or destruction.  These records should be maintained for at least two years.
According to the NISPOM, cleared contractors can usually retain contract related classified material for a period of 2 years after completion of the contract unless otherwise directed by the government contracting activity. But what if the classified material is still needed beyond that time? The contractor should ask for and receive written authorization identifying the classified information they wish to retain. TOP SECRET material is requested in a list of specific documents or if permitted by the government contracting activity, by subject matter and approximate number of documents.
Destruction Records.
As with other lifecycle activities concerning TOP SECRET material, destruction should be documented in a receipt and with a clear indication of what material was destroyed, by whom, the date, and signed by the individual and witness. These destruction receipts should be on hand for two years. The TSCO and those authorized to destroy the material are required to know, through their personal knowledge, that such material was destroyed.  
There are many responsibilities required of those in charge of classified information. Make sure you know what those responsibilities are. Failure to follow guidelines and national security policy could cause your company to lose contracts. Excelling in security responsibilities leads to award winning performance. For career and performance enhancement ideas, visit

Jeffrey W. Bennett, ISP is the owner of Red Bike Publishing Red Bike Publishing . He regularly consults, presents security training, and recommends export compliance and intellectual property protection countermeasures. He is an accomplished writer of non-fiction books, novels and periodicals. Jeff is an expert in security and has written many security books including: "Insider's Guide to Security Clearances" and "DoD Security Clearances and Contracts Guidebook", "ISP Certification-The Industrial Security Professional Exam Manual", and NISPOM/FSO Training".

No comments: