DSS Security Ratings Matrix

1. DSS Security Ratings Matrix Steve Slocum, Manager Operations & Compliance Security Jeff Vaccariello, Industrial Security Rep March 14, 2012

2. Security Ratings Matrix • DSS recognized the importance of a standardized, objective approach to issuing security ratings as part of its security oversight role. • The new security rating process utilizes a calculation worksheet. • The worksheet is a DSS tool, designed to standardize and improve consistency. • Numerically based, quantifiable, and accounts for all aspects of a facility’s involvement in the NISP.

3. Security Ratings Matrix • Uses a numerical based rating system • All facilities start with the same score (700) • Points are added for identified National Industrial Security Program (NISP) Enhancements by Category • Points are subtracted for vulnerabilities by NISPOM reference • Acute/Critical and Non-Acute/Non-Critical vulnerabilities are weighed separately • Points subtracted by NISPOM reference, not by number of occurrences • Accounts for size and complexity of a facility

4. Security Ratings Matrix • Each ratings matrix comes with a “scoring key” that is based on the facility category

5. Security Ratings Matrix • Acute Vulnerability is defined as non-compliance with a NISPOM requirement that puts classified information at imminent risk of compromise. Acute vulnerabilities require immediate corrective action. • Critical Vulnerability is defined as non-compliance with a NISPOM requirement that places classified information in danger of loss or compromise. Once a vulnerability is determined to be acute or critical, it is further categorized as either “Isolated”, “Systemic”, or “Repeat”. • All other Vulnerabilities are defined as non-compliance with a NISPOM requirement that does not place classified information in danger of loss or compromise.

6. Security Ratings Matrix • A NISP enhancement directly relates to and enhances the protection of classified information beyond baseline NISPOM standards. • NISP enhancements will be validated during the assessment as having an effective impact on the overall security program which is usually accomplished through employee interviews and review of process/procedures. • DSS established 13 NISP enhancement Categories, based on practical areas, to simplify and ensure field consistency. • Full credit for a NISP Enhancement (15 or 12 points depending on facility complexity) will be given if a facility completes any action/item in a given category. The facility will only receive a total of 15/12 points per category, regardless of how many NISP enhancements they have in a given category.

7. Ratings Matrix Categories • Category 1 Security Education (Events) • Category 2 Security Education (Products) • Category 3 Security Education (Staff Training) • Category 4 Security Education (Product Sharing) • Category 5 Self Inspection • Category 6 Physical Security/Controls • Category 7 CI Integration/Cyber Security • Category 8 Information Systems • Category 9 FOCI • Category 10 International • Category 11 Security Organization Membership • Category 12 Active Organization Participation • Category 13 Personnel Security

8. How It Works • Rating Matrix Company, Inc. Category C – Mid-Size Possessing Company Previous Rating: Commendable Recent Rating: Superior Vulnerabilities: 2 (Non Acute/Non Critical) NISP Enhancements: 9 Rating Calculation Score: 804

9. Sample Company

10. Sample Company • Vulnerability: • Document Marking Deficiency (Corrected on the Spot) • 2 Points Deducted • Vulnerability: • An original SF312 was not forwarded to DISCO for retention • 2 Points Deducted

11. Sample Company • Category 2: Security Education (Products) • Facility provides monthly security updates/reminders to employees through the monthly corporate newsletter. • 12 Points Added

12. Sample Company Category 3: Security Education (Staff Training) FSO has CPP certification. Security staff training exceeds NISPOM requirements as all security personnel have completed all training requirements for FSO Program Management through the STEPP website and continuously complete additional educational courses. 12 Points Added

13. Sample Company Category 4: Security Education (Product/Information Sharing) The FSO has developed a Protégé/Mentorship relationship with all subcontractors they sponsor into the NISP by reaching out to the newly sponsored facility and providing whatever advice and assistance they require. The FSO often visits with the new facility to provide training and experience to the new FSO. Additionally, the company participated in beta testing a future DSS/CDSE course. 12 Points Added

14. Sample Company Category 5: Self Inspection The facility conducts and records two self-inspections annually. One is completed by the FSO and security staff. The other is conducted as a peer to peer review with the FSO or other security staff member from another location conducting the review. 12 Points Added

15. Sample Company Category 6: Classified Material Controls The FSO and AFSO conduct semi-annual, 100% inventory of all classified holdings and maintains records of the inventories. Their information management system indefinitely reflects history of location and disposition for material in facility at all levels of classified (100% accountability). 12 Points Added

16. Sample Company Category 7: CI Integration All employees going on foreign travel for business are required to be briefed by the Security prior to departure and are debriefed upon return. 12 Points Added

17. Sample Company Category 11: Security Organization Membership The FSO and AFSO are both members of NCMS and a local ISAC. 12 Points Added

18. Sample Company Category 12: Active Security Organization Participation The FSO takes a positive leadership role in the local ISAC and was elected to be the corporate Co-Chairperson. 12 Points Added

19. Sample Company Category 13: Personnel Security The facility manages a corporate wide call center established to support questions and issues related to JPAS and EQIP from other branch/division offices throughout the country. 12 Points Added

20. Sample Company FINAL Score 804 = Superior

21. Sample Company

22. Presentation of Enhancements • Must be presented at the beginning of the assessment • Show how each item enhances the local cage code • DSS must be able to validate the enhancement • i.e. Self Inspection must be documented • www.dss.mil • Industrial Security • Industry Tools • Security Matrix Tool and Frequently Asked Questions

23. Category 1: Security Education (Company Sponsored Events) The facility holds company sponsored events such as: • Security fairs • Interactive designated security focused weeks • Security lunch events • Hosting guest speakers on security related topics • Webinar with security community • Lunch and Learn • Video Teleconference (VTC) • Security Day • OPSEC awareness events

24. Category 2: Security Education: Internal Educational Brochures/Products A security education and awareness program that provides enhanced security education courses or products to the entire employee population: • CD/DVD, web-based interactive tools • newsletters • security games/contests • international security alert system • may include uncleared employees • Facility provides monthly security updates/reminders to employees through the monthly corporate newsletter.

25. Category 2: Security Education: Internal Educational Brochures/Products • Porcelain Press • Security Post • Internal security education brochures • Education pamphlets • E-Learning system with security education topics • Facility provides monthly security updates/reminders to employees through the monthly corporate newsletter.

26. Category 3: Security Education: Security Staff Professionalization Security staff training exceeds NISPOM and DSS requirements to include obtaining on-going professional certifications and incorporating the knowledge through the program. • Certified Protection Professional (CPP) • SPeD Certification additional CDSE courses • Computer Information Systems Security Professional (CISSP), etc.) • ISP (NCMS Prep Course) • Complete courses through the STEPP system

27. Category 4: Security Education: Information/Product Sharing within Community Facility Security Officer (FSO) provides peers training support within the security community and/or shares security products/services with other organizations both within and outside their corporate family. • Presentation at FISWG • Mentoring • Let local security community utilize the classified destruction equipment • You also provide fingerprinting services for local contractors

28. Category 5: Contractor Self Review Effective documented self reviews designed to provide an on-going, continuous evaluation of the security program, and promptly sharing the contractor self review results with DSS, which encourages open dialogue of identified issues and possible resolutions prior to the DSS scheduled assessment. • Multiple reviews of your facility • Must be documented • Conducting a review at another facility

29. Category 6: Classified Material Controls/Physical Security Facility has deployed an enhanced process for managing classified information which has built in countermeasures to identify significant anomalies. Examples include: • 100% inventory on random basis or Information Management System (IMS) indefinitely reflects history of location and disposition for material in facility of all classification (100% accountability) • Inventory on a semi-annual or random basis

30. Category 6: Classified Material Controls/Physical Security • Access card readers • Vehicle plaza • CCTV • Guards

31. Category 7: Counterintelligence Integration/Cyber Security • Foreign travel pre-briefings and debriefings conducted (when not a contractual requirement) or implementation of quality assurance efforts to check and verify training on suspicious contact reporting (SCR), and employee knowledge (e.g., setting up appropriate exercises to validate employee knowledge/situational awareness of SCR reporting process)

32. Category 8: Information Systems • Developing and implementing significant and effective (LAN/WAN based) Information System audit trail reduction/collection or analysis tools/scripts internally and sharing these across the corporation or NISP community at large. • Audit Reduction Tools • VAST (Validate Audit Summary Tool) • SAST (Security Audit Summary Tool) • Automated System Configuration Tools

33. Category 9: FOCI • Facilities under FOCI only! • Security programs that perform significant trend analysis of internal governance processes and interactions with the foreign parent company. (Companies that utilize trend analysis and follow-on audit programs to proactively identify and report attempts of undue influence, identify weaknesses, best practices, and areas for improvement) • Monitor all emails, phone calls, etc. • Track everything, not just a random sampling

34. Category 10: International • Facility voluntarily conducts, or has outside experts conduct, ongoing export compliance audit and shares the results with interested U.S. Government Agencies. • Program briefing specific to International customers • Extra Training • Strengthen ITAR program

35. Category 11: Membership/Attendance in Security Community Events • Security staff are members of and attend meetings of professional NISP or other security organizations such as Industrial Security Awareness Councils, professional societies and associations for security professionals, FOCI working groups, etc. • FISWG • NCMS • ASIS

36. Category 12: Active Participation in the Security Community The FSO or other key security personnel or key management personnel actively participates in and contributes to security related professional organizations beyond merely being a member of the organizations such as being elected on security community boards (i.e., President of ISAC Chapter, committee/board member of ISAC, etc.)

37. Category 12: Active Participation in the Security Community • Steve Abounader, Chair of FISWG • Betty Haynes, NCMS President • Steve Slocum presenting at March 2012 Fall FISWG • Active member of a committee in NCMS

38. Category 13: Personnel Security • Implementation of a corporate wide call center or centralized process established to support employee questions and issues related to Cognizant Security Agency (CSA) designated databases (JPAS, EQIP, etc.) • Your FSO and AFSO conduct an on-going records check of the PCL's and employees working under this cage code both servicing and owning

39. Questions?