**A SYSTEM FOR GAINING MANAGEMENT SUPPORT**

**FOR YOUR SAFEGUARDS AND SECURITY AWARENESS PROGRAM**

Security Education Special Interest Group

October 2002

**FOREWORD**

How do I gain the management support necessary to ensure that my
Safeguards and Security Awareness Program will be successful? This
question continues to be posed by Safeguards and Security Awareness
Coordinators throughout the DOE community. At the April 1991 Security
Education Special Interest Group (SE SIG) Workshop in Las Vegas, a
presentation and survey on this subject generated the interest that led
to the preparation of a working paper. Since that time, increased use of
technology has impacted many aspects of awareness programs and prompted
the SE SIG to again address this issue.

This paper contains no magic formula that will instantly cause your
management to embrace safeguards and security awareness as its own.
Various presenters at SE SIG workshops have shared ideas, tools, methods
and processes that advanced the support of their individual programs.
This document is a compilation of those things that seemed to have
worked best in gaining management's support of safeguards and security
awareness efforts and we encourage each of you to modify and adapt them
as needed.

The task of updating this material was undertaken by Kaye Hall,
Honeywell FM&T/NM, with support from the members of the SE SIG Steering
Committee, Valerie Anderson, SE SIG Coordinator, and Loren Evenson, DOE
SE SIG Advisor. We are all hopeful this effort will be helpful to you in
gaining your management's support for your program.

Marvin Thompson

Pantex Plant

Chair, Security Education Special Interest Group

**INTRODUCTION**

The purpose of this paper is to provide ideas and suggestions that will
promote management support of Safeguards and Security Awareness
Programs. Related ideas and suggestions are grouped under common topic
areas:

-   Know Your Program

-   Establish an Image: Positive and Visible

-   Keep Management Informed

-   Communicate with Management: Speak Their Language

-   Develop Teamwork to Share Resources

-   Join the Security Education Special Interest Group

The first two topics deal with you and your program, presenting ideas
for the enhancement of the program as well as the perception of the
program by the employees affected. The second two topics present ideas
to help you communicate with your management. The last two topics
contain ideas to enhance your program by working with others - both
personnel at your facility and safeguards and security awareness
professionals from other sites.

**KNOW YOUR PROGRAM**

The first step in getting management support for your Safeguards and
Security Awareness program is to assess the program, identifying its
strengths and weaknesses and using that information to set goals. Until
you know your own program thoroughly, you won't be able to provide the
kind of information needed to influence management support. Regardless
of your program's size, suggestions for a thorough assessment include:

-   Evaluate yourself (your responsibilities and authorities) and your
    program against the requirements in DOE O 470.1, Chapter IV,
    *Safeguards and Security* *Awareness Program* and DOE M 470.1-1,
    *Safeguards and Security Awareness Program*. Correction of any
    noncompliance with requirements usually takes priority over other
    more general awareness needs. Review any local implementing
    directives or other documents that might contain site-specific
    requirements.

-   Review your program documentation to ensure it is adequate and the
    data is current and accurate. Program documentation should include
    at least the following:

    -   [Operating Procedures, Process Descriptions, or Work
        Instructions]{.underline} - It's extremely helpful to you and
        others in your organization to have the mechanics of how your
        program functions clearly outlined in operating procedures,
        process descriptions, or some other type of descriptive
        document. This document should describe, even generally, your
        specific duties and responsibilities as well as that of others
        involved in administering the program. This documentation will
        also be helpful during self-assessments and audits.

    -   [Lesson Plans]{.underline} - The content of your briefings
        (Initial, Comprehensive, etc.) should be identified in lesson
        plans or some similar format that includes briefing content,
        handouts, and tests (if any). Lessons plans help ensure briefing
        information is presented consistently and that all important and
        required topics are addressed. Lesson plans also enable a
        substitute presenter to provide the briefing information if you,
        or the primary briefing presenter, aren\'t available. Lesson
        plans provide documentation of what was presented, which is
        useful evidence if needed to prove that personnel were made
        aware of security requirements.

    -   [Briefing Attendance Records]{.underline} - The accuracy of
        briefing records is an integral part of the success or failure
        of your program. The information this documentation provides
        will help in program planning by allowing you to

> monitor briefing attendance and identify problems. Well-kept records,
> organized and complete, are also important to facilitate your
> self-assessments and audits.

-   Review past security program self-assessments, field office
    assessments and surveys, and Office of Safeguards and Security
    Evaluation reports. Study the findings, recommendations, and
    discrepancies that occurred in specific areas (e.g., handling
    classified documents, securing safes, access control issues).
    Identify those problems that might have been avoided with a stronger
    Safeguards and Security Awareness Program.

-   Review the history of security infractions issued to people at your
    facility. Infractions, even those attributed to carelessness, often
    reflect a general lack of security awareness. Carelessness towards
    security requirements may indicate a need for education on the
    importance of complying with security requirements and the reasons
    why compliance is important both to the individual and the
    organization.

-   Conduct a mini-survey on general security knowledge and awareness
    using a small group of randomly selected employees. This survey can
    be accomplished by phone, at face-to-face meetings, by sending a
    hardcopy survey in the mail, or by electronic communications. You
    will probably get more accurate feedback if you emphasize to
    participants that the survey is for internal use, not to be used
    against them but to make a general evaluation of your program. A
    friendly, nonthreatening tone and an assurance of anonymity will
    solicit the honest and realistic responses you need to evaluate your
    program at the grass-roots level.

Note: You can correct many program weaknesses identified by these
methods without seeking additional management support. You can improve
record-keeping; develop operating procedures; write briefing outlines;
and tailor upcoming briefings, newsletter articles, and security
bulletins to address problem areas. Your identification of program
weaknesses and your self-directed, low-cost, internal methods of
addressing them can lay the groundwork for gaining management support
for your program.

Assessing your current program offers important benefits, such as: 1)
identify areas where management support is most needed, 2) prioritize
your needs so that limited resources may be most efficiently used in
correcting the most potentially devastating problems, and 3) at the end
of this process, be completely knowledgeable about your program, both
its strengths and the weaknesses. When seeking management support, you
can speak with authority and confidence. You will be able to answer
questions about your program from auditors and management. This is
extremely valuable in presenting a positive professional image.

**ESTABLISH AN IMAGE: POSITIVE AND VISIBLE**

Traditionally, management and employees alike have tended to see the
Safeguards and Security Awareness Program only as requirements,
regulations, and rules. But it's a new day. A strong security awareness
program is essential at our Government facilities.

A visible program that gives a positive image for security, raises
employee morale, and encourages the involvement and support of the
general population will also encourage the involvement and support of
management. The following ideas and suggestions based on proven,
visible, positive program activities can be adapted for use at your
facility:

-   Newsletter. Make a regular security awareness contribution to the
    local newsletter or bulletin, or start your own newsletter. Along
    with local security procedures, reminders of security requirements,
    and traditional security-related articles, use tips on personal
    protection, neighborhood security, child protection, and home and
    auto security to improve the visibility of your program and show
    your concern for employees' security and safety at all times, not
    just while at work.

-   Recognition Program. Establish a recognition program for employees
    who assist the local security effort. Note those employees who are
    proactive about security, such as calling to schedule a make-up for
    a missed briefing, reporting unusual occurrences, challenging
    visitors to show badges, or consistently presenting a pleasant and
    cooperative attitude in the workplace. Recognition of their
    contributions in assisting the security effort will encourage
    greater support. Whether recognition is in the form of inexpensive
    giveaways or a list of names in the newsletter, the impact on
    security is invaluable. Don\'t hesitate to include management
    personnel in this recognition program; everyone responds to a
    deserved pat on the back.

-   Positive Language. Avoid negative words and phrases like \"failure
    to comply\" or \"failure to attend\" or \"If you don\'t attend,
    then\" when developing briefing announcements. Some employees view
    statements preceded by such stereotypical negative phrases as
    challenges; others see them as empty threats, and they are offensive
    to those employees who are always cooperative. Encourage attendance,
    expect compliance, and deal with the no-shows later.

-   Memos to Management. Schedule make-up sessions for briefings by
    copying management or supervisory personnel. Prepare a memo to
    recognize employees who have attended a scheduled briefing and list
    delinquent employees; for example:

> Forty-seven employees in your section attended the recently scheduled
> annual refresher briefing. The Security Staff appreciates your support
> in meeting this important DOE requirement by encouraging employee
> attendance. The following individuals will need to attend one of the
> make-up sessions (list names).

A memo such as the one above makes it clear that you are not criticizing
the supervisor. You might not only gain support in scheduling make-up
sessions, but you might also find management\'s encouragement of
attendance increases for future briefings.

-   Professionalism. Conduct briefings in a competent and professional
    manner. This may be best accomplished by incorporating standard
    training practices in the development of your briefings. These
    practices would include:

    -   Determining the needs of your audience.

    -   Developing specific learning objectives to be accomplished
        during each briefing.

    -   Developing comprehensive lesson plans built around your learning
        objectives for each briefing.

    -   Incorporating visual aids into your presentation to enhance
        learning and maintain interest.

    -   Providing evaluation forms to determine strengths and weaknesses
        of your presentation.

This professionalism will help sustain the image you are cultivating and
will enhance the credibility of the information.

-   Incentives/Giveaways. Incorporate a contest, game, puzzle, or
    giveaway program into your program activities. With minimal expense,
    you can generate interest and enthusiasm for security concerns. A
    "word-search" diagram using security-related words; a poster design
    or cartoon caption contest; and notepads, key chains, or coasters
    with a security message are all attention-getters and morale
    builders. Management will note your success and might feel
    encouraged to support future efforts.

The key to the development of a positive image for security is for you
to view [security as a service and employees as customers]{.underline}.
Safeguards and Security Awareness Coordinators must sell security not
only to management, but also to employees.

Joseph A. Grau, former Chief, Information Security Division at the DoD
Security Institute, was an outspoken proponent of the importance of
marketing security. He often pointed out that security customers
actually pay for security services. For example, because of the
requirements to lock a classified document in a safe rather than leaving
it on a desk, managers pay for enforcing this security measure with
labor hours. Other methods of payment are in the form of energy,
attention, and concern for security matters, such as taking time to
identify and report a potential security incident. Even egos are part of
the payment for security when scientists, researchers, technical
specialists, engineers, and management personnel must refrain from
communicating their successes to friends, family, and peers to protect
sensitive, company private, or classified information.

If you acknowledge the reality of this payment process, you will
understand the need to use good marketing techniques to create a
positive image. Security costs something and it's worth it. As employees
begin to view security in a more positive manner, security awareness and
attention to security responsibilities will increase.

**KEEP MANAGEMENT INFORMED**

The old adage "what they don\'t know won\'t hurt them" is true in many
situations, but not this one. When seeking management support, it\'s
more like, "what they don\'t know can hurt you!" This doesn\'t mean that
you need to direct reams of memos to your management each time you
change the wording on a form or revise a briefing. However, finding ways
of keeping management informed about your program efforts and activities
will be an effective pay-off.

-   Establish a working (and workable) relationship with your manager.
    Present your ideas on program direction, needs, and goals; solicit
    your manager\'s views on these subjects; and if necessary,
    compromise to find a common ground. Your manager might be a useful
    channel of communication to upper management to gain support at the
    program level. However, you must provide the information that will
    enable him or her to make informed comments, to respond
    knowledgeably to questions, and to communicate your concerns.

-   Identify management reporting and communication mechanisms (e.g.,
    progress reports, weekly or monthly management briefings, and
    program reviews) and contribute information on security awareness
    program activities. You might not actually deliver these updates;
    they might be provided to management by your manager or supervisor,
    the Security Manager, your Department Manager, or your Division
    Director. The point is that you have opened a channel of
    communication to management. Remember, for management to become
    interested and involved in your program, they have to be aware of
    your existence.

-   If you participate in or attend a workshop, conference, or seminar,
    prepare a written summary of the information presented. Your report
    should be suitable for distribution to management if your supervisor
    feels it is appropriate; a well-written report might be forwarded
    intact rather than rewritten for someone else\'s signature. This
    could increase your visibility and lend more credibility to your
    program. Do not limit the information to security awareness
    concerns. Trends, tips, ideas, and even official gossip (clearly
    identified as such) that relate to other areas might be useful to
    management.

-   Establish and maintain metrics that reflect your program\'s goals
    and show your performance measured against those goals. It\'s
    possible to measure many aspects of a security awareness program
    including infractions and violations, customer satisfaction (use
    annual or semi-annual surveys), processing time for reports or
    clearance paperwork, audit and self-assessment findings and
    observations, and compliance with requirements (briefings,
    reporting, etc).

As much as possible, provide information on your program to management
within established chains of command. You may plan a great program, but
alienating a member of middle management by going over his or her head
without a very good reason will reduce your chances of ever implementing
that program. Be aware that as the level of management increases, the
areas of interest broaden and your program becomes one of many concerns.
Demonstrating an awareness of overall organizational concerns rather
than tunnel vision regarding only security will make you part of the
company team. Management values team players, and your program is more
likely to benefit if management sees you as a valuable asset.

**COMMUNICATE WITH MANAGEMENT:**

**SPEAK THEIR LANGUAGE**

Keeping management informed is vital; however, you might need to avoid a
few pitfalls, especially if you are presenting a briefing that deals
with problems that require management support and approval:

-   Balance negative information with positive aspects to prevent
    management from perceiving your program (and you) as a \"problem
    child.\" Help management understand the program requirements. If
    possible, present reasonable and cost-effective proposals for
    solutions along with problems and areas of concern.

-   When you present a problem, be prepared to answer questions and to
    provide quantifiable data to back up legitimate concerns. Crying
    wolf to management over minor problems will destroy your
    credibility.

-   Avoid criticism of past programs and activities; you never know who
    might have developed that program or supported those efforts.

-   Things happen, plans change, and schedules fluctuate. Verify meeting
    times and management schedules with administrative support staff
    before a management briefing. Prepare both a written and a verbal
    presentation and be flexible enough to condense your verbal
    presentation if necessary. Then, if the situation forces a cut in
    your allotted time, you will be able to shift gears to the
    appropriate format.

-   Never underestimate the power of a manager's administrative
    assistant. Many times, these individuals wield a great deal of
    influence with their bosses. Be courteous, solicit their opinions,
    and listen to their advice.

-   Never forget the budget. Management won\'t. Include the dollars and
    cents involved in your program proposals and, if possible, reflect
    the anticipated return on the investment (i.e., reduction in
    security infractions, increased audit compliance, better protection
    of company proprietary information, or reduction in misappropriation
    and misuse of company equipment, tools, and time).

-   Be aware of the impact of your program on the entire organization
    and its mission. Management has justifiable concerns about the
    amount of time technical employees must spend away from their jobs
    to satisfy administrative requirements. Technical supervisors can
    assist you in the coordination of required briefings to avoid
    conflicts with project requirements and possibly reduce the labor
    hours involved. A little extra time on your part to communicate this
    concern to the technical staff can prevent complaints and animosity
    directed toward your program.

Other effective methods of communicating with management involve the
development of tools and data you can use in support of your proposals.
These tools are sometimes necessary if you are going to obtain support
for additional funding or staffing:

-   [A Requirements Chart]{.underline} - A sample chart is on the
    following page. You can modify this chart to fit your facility's
    needs and requirements. A requirements chart can be useful for
    management to understand your areas of responsibility.

-   [A Time Study]{.underline} - Management cannot be aware of your need
    for additional staffing, task reassignment, or administrative
    support unless you inform them. A time study can support your
    request for assistance, but it must be accurate and complete. Begin
    by defining your tasks, categorizing them under specific briefings,
    topical areas, or any other way that will work for you.

> Here is an example of a task breakdown:

-   Prepare briefing materials (e.g., Xerox copies, handouts, lesson
    plans, etc.).

-   Present briefings.

-   Read and answer correspondence and other required reading.

-   Use telephones (e.g., inquiries, scheduling, etc.).

-   Keep records and maintain database.

-   File.

-   Write, review, and edit policy and procedure documents.

-   Develop program (e.g., think, brainstorm, write articles, and plan
    briefings, etc.).

> Include other areas depending on your duties and responsibilities
> (e.g., foreign visits and assignments, visit control functions,
> badging, quality, physical security, information and document control,
> Personnel Security Assurance Program \[PSAP\], Communication Security
> \[COMSEC\], audits and surveys).
>
> Use your task breakdown to log your time; 2 to 6 months of
> record-keeping translated into percentages should provide an accurate
> account of how you spend your time. A completed time study can also be
> a useful indicator of tasks you need to delegate, procedures you might
> streamline, and areas of responsibility that are not receiving enough
> attention.

-   [A Flowchart]{.underline} - This tool illustrates a process, showing
    all the steps involved from beginning to end, including any
    revisions. This relatively simple tool can outline a proposed
    activity clearly or can justify a revision of an existing procedure.

![](media/image1.jpeg){width="5.497222222222222in"
height="8.654166666666667in"}

DEVELOP TEAMWORK TO SHARE RESOURCES

You can often enhance limited resources and staffing by aligning your
efforts with those of other security-related programs at your site or
facility with similar requirements and responsibilities. Programs that
might lend themselves to a successful collaboration with security
awareness are Operations Security (OPSEC), Computer Security, Classified
Matter Protection and Control (CMPC), Environment, Safety, and Health
(ES&H), and Quality Assurance.

-   Identify programs at your site or facility that have requirements
    and needs that are similar to yours (i.e., regularly scheduled
    briefings, special lectures and presentations, attendance records
    and other documentation, contractor briefings, remote site briefing
    delivery).

-   Outline the benefits of a coordinated effort; for example:

    -   A reduction in labor hours due to shared notification,
        documentation, and scheduling tasks for combined briefings and
        presentations.

    -   A reduction in time off the job for employees (travel once to
        attend combined briefings)

    -   Cost savings in scheduling and set-up of conference rooms and
        video equipment.

    -   Increased attendance by employees who might ignore or postpone
        one briefing but would be reluctant to ignore or postpone a
        briefing in two or more areas. This results in a cost savings by
        reducing the number of make-up sessions required.

> Additional benefits that might affect individual program goals include
> improvements to presentations due to collaboration, and increased
> visibility and improved image from association with a more popular
> program.

-   At various times, management places more emphasis on certain
    required programs, such as ES&H, Quality Assurance, and OPSEC, among
    others. Don\'t let that emphasis be a cause for resentment or
    competition; instead, make an effort to establish a good working
    relationship with the individual in charge of the other program so
    that your program can share the limelight. Offer assistance with a
    briefing or with scheduling; find a way to resolve or ease an
    ongoing conflict between that program and another area of security.
    If the favored program views this association with you and your
    program as an asset, you will have additional support from
    management.

**JOIN THE SECURITY EDUCATION SPECIAL INTEREST GROUP**

One of the objectives of the SE SIG has been to identify the members of
the large safeguards and security awareness community and introduce them
to each other. The members of this community represent diverse
organizations, facilities, and sites, but their common purpose provides
a sense of unity that encourages interaction and cooperation. The
benefits of becoming an active part of SE SIG can assist your program in
many ways:

-   Your attendance at SE SIG Workshops offers an opportunity to
    establish working relationships with others in your field whose
    knowledge and assistance can help you advance your program
    significantly. Help and advice are available simply by placing a
    phone call. Problem situations are rarely unique; security awareness
    coordinators who have resolved similar problems are willing to share
    their experiences. You can brainstorm specific facility concerns
    with peers or suggest them as topics to be included on future
    agendas.

```{=html}
<!-- -->
```
-   The DOE/HQ Safeguards and Security Awareness Quality Panel (SSAQP)
    is comprised of some SE SIG Steering Committee members, and the SE
    SIG Advisor is a representative from DOE/HQ Personnel Security
    Policy. This means the most current and accurate information on
    policy, procedures, practices, and personnel security activities are
    available to workshop attendees. SE SIG Workshops often preview
    anticipated policy and procedure changes and solicit input before
    their implementation. Management will appreciate your knowledge of
    current situations and activities that could impact your
    organization.

```{=html}
<!-- -->
```
-   Workshops feature the TRADEing POST, a source of bulletins,
    handouts, briefing outlines, lesson plans, posters and other
    instructional aids that you can modify for use at your facility.
    Acquiring these sample items for use in your program (or for other
    programs at your facility) encourages continued management support
    for your participation in SE SIG activities.

```{=html}
<!-- -->
```
-   As part of the SE SIG, you identify other Safeguards and Security
    Awareness Coordinators in your geographical area and may explore
    ways to work with them. For example, you could coordinate schedules
    to reduce costs of guest speakers; share tools and instructional
    aids (e.g., films, slides, booklets, handouts, and posters); share
    resources (e.g., security information networks, security magazines,
    and updates); serve on each other\'s self-assessment teams to offer
    different and objective viewpoints.

```{=html}
<!-- -->
```
-   Invite coordinators from other facilities to visit your site when in
    the area; introduce them to management personnel if possible.
    Management realizes the value of networking to all involved and this
    will be another point in your favor.

```{=html}
<!-- -->
```
-   The SE SIG works with the DOE Central Training Academy (CTA) at the
    National Nuclear Security Institute (NNSI) to ensure the Safeguards
    and Security Awareness Coordinators training is current and
    effective. This course offers individuals newly assigned to security
    awareness duties as well as those with extensive experience in the
    field an opportunity to increase their knowledge of Safeguards and
    Security Awareness Program development and administration, and to
    enhance their professional development. Individuals completing this
    course are automatically added to the SE SIG membership database.

**CONCLUSIONS**

All the topics share the goal of providing information to help you
develop and maintain a Safeguards and Security Awareness Program that
will gain the support and encouragement of your management.

Not all of these ideas and suggestions are applicable to all
organizations, sites, or facilities. However, they have proven to be
effective in promoting security awareness. Use those that apply to your
situation. Modify them as necessary to be successful. Use them alone or
in combination to obtain results. The resulting positive effects on the
overall security program will be your basis for requesting continued
management support.

A final note: If you have a technique for ensuring management support
for your Safeguards and Security Awareness Program that is not discussed
in this document, by all means use it. Because that technique might also
be helpful to others who are searching for an answer, please share it.