# Presentation: 765740

## Laws, Executive Orders, and GuidelinesThe Catalysts for Personnel Security In IT Contracts

- Presented by
- Thomas L. Mitchell
- Information Security Awareness Office, ODCIO/NIH
- NIH AMC Symposium Workshop
- November 8, 2004

## Objectives

- Review relevant statutes, regulations, policies and procedures
- Define relevant terms and concepts
- Review categories of safeguarded agency information
- Outline the process of obtaining a background investigation

## Statutory Requirements and Executive Orders

- Where did it start?
- 	Executive Order 10450
*Security Requirements for Government Employment*
- Issued by President: Eisenhower
- 		 in April 1953

## Statutory Requirements and Executive Orders

**Executive Order 10450**
- “Sec. 3. (a) The appointment of each civilian officer or employee in any department or agency of the Government shall be made subject to investigation. The scope of the investigation shall be determined in the first instance according to the degree of adverse effect the occupant of the position sought to be filled could bring about, by virtue of the nature of the position, on the national security, but in no event shall the investigation include less than a national agency check (including a check of the fingerprint files of the Federal Bureau of Investigation), and written inquiries to appropriate local law-enforcement agencies, former employers and supervisors, references, and schools attended by the person under investigation”

## Federal Statutes and Policies

- _Civil Service Regulations (5 CFR 731, 732, 736)_
- Employment Suitability for Federal and Contract
- _Executive Orders_:
- 12968 (Aug 1995), *Access to Classified Information*

## Federal Statutes and Policies (cont.)

- OPM Manual IS-15 (May 2001), *Requesting OPM Personnel Investigations*
- Federal Acquisition Regulation (FAR) Part 39 – Acquisition of Information Technology
- Privacy Act of 1974

## Federal Statutes and Policies (cont.)

- Computer Security Act of 1987 (P.L. 100-235)
- 	**http://csrc.ncsl.nist.gov/secplcy/csa87.txt**
- Information Technology Management Reform Act of 1996 (ITMRA)
- Government Information Security Reform Act of 2000
- 	(P.L. 106-398)
- 	**http://www.itpolicy.gsa.gov/itpolicy/ndaa2001.doc**

## Federal Statutes and Policies (cont.)

- OMB Circular A-130 – Management of Federal Information Resources (Revised 06-21-95)
**http://www.whitehouse.gov/omb/circulars/a130/a130.html**
- Including *Appendix III, Security of Federal Automated Information Resources*

## Federal Statutes and Policies (cont.)

- _Department Guidelines_:
- HHS Automated Information Systems Security Program (AISSP) Handbook (May 1994)
- HHS Personnel Manual Instruction 731-1 (Jan 1998), *Personnel Security/Suitability Program*

## Categories of Safeguarded Information

- Three Broad Categories
- Non-Sensitive
- Sensitive
- Classified

## Categories of Safeguarded Information(continued)

**Non-Sensitive Information:  **agency information that is not “sensitive” or “classified” and generally is available to the public.
**Sensitive Information: ** agency information of which the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under the Privacy Act, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy,  (Computer Security Act of 1987)

## Categories of Safeguarded Information(Continued)

**Classified Information: ** agency information that is classified as:  (Executive Order 12958)
-  **Confidential:**  unauthorized disclosure which reasonably could be expected to cause damage to the national security.
**Secret:**  unauthorized disclosure which reasonably could be expected to cause serious damage to the national security.
**Top Secret:**  unauthorized disclosure which reasonably could be expected to cause exceptionally grave damage to the national security.
**Special Access:**  a special class of classified information that imposes safeguarding and access requirements that exceed those normally required for information at the same classification level.

## Information Category & Type of Background Investigation

**Non-Sensitive Information Sensitivity Level 1:  **Non-Sensitive (Suitability Determination)  (NACI)
**Sensitive Information Public Trust Designations**
**Sensitivity Level 5:**  Sensitive – Moderate Risk (Suitability Determination)  (NACIC, MBI or LBI)
**Sensitivity Level 6:**  Sensitive – High Risk (Suitability Determination)  (BI)
**Classified Information (Security Clearance)**
**Sensitivity Level 2:  **Classified - Confidential or Secret (Clearance)  (LBI)
**Sensitivity Level 3:**  Classified - Top Secret (Clearance)  (SSBI)
**Sensitivity Level 4:**  Classified - Special Access (Clearance)  (SSBI)

## Definitions

**INFORMATION TECHNOLOGY:**  any equipment, or interconnected system(s) or subsystem(s) of equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency.  (FAR 2.1)  (Also see ITMRA).
- Includes equipment that the agency uses directly or is used by a contractor under a contract with the agency that (1) requires its use or (2) to a significant extent, requires its use in the performance of a service or the furnishing of a product.
- Includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources.
- DOES NOT INCLUDE:  any equipment that (1) is acquired by a Federal contractor incidental to a Federal contract or (2) contains embedded information technology that is used as an integral part of the product, but the principal function of which is not the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data.
_**Service Contract**_ – “a contract that directly engages the time and effort of a contractor whose primary purpose is to perform an identifiable task rather than furnish an end item of supply” (FAR 37.101)

## Definitions (Continued)

**INFORMATION:**  any knowledge that can be communicated or documentary material, regardless of its physical form or characteristics, that is owned by, produced by or for, or is under the control of the United States Government.  (Executive Order 12958)
**AUTOMATED INFORMATION SYSTEM (AIS):**  the organized collection, processing, transmission, and dissemination of automated information in accordance with defined procedures (OMB A-130).  An agency’s AIS security program applies to all AISs, including application systems and databases; AIS facilities, including mainframe, minicomputer, and microcomputer platforms; and to all information technology utilities (ITUs), local area networks (LANs), and wide area networks (WANs).  An AIS includes any assembly of computer hardware, software or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information (Executive Order 12958).
**EMPLOYEE:**  a person, other than the President and Vice President, employed by, detailed or assigned to, an agency, including members of the Armed Forces; an expert or consultant to an agency; an industrial or commercial contractor, licensee, certificate holder, or grantee of an agency, including all subcontractors; a personal services contractor; or any other category of person who acts for or on behalf of an agency as determined by the appropriate agency head. (Executive Order 12968)

## Definitions (Continued)

**ACCESS TO CLASSIFIED INFORMATION:**  shall be granted to employees who are United States citizens for whom an appropriate investigation has been completed and whose personal and professional history affirmatively indicates loyalty to the United States, strength of character, trustworthiness, honesty, reliability, discretion, and sound judgment, as well as freedom from conflicting allegiances and potential for coercion, freedom from conflicting allegiances and regulations governing the use, handling, and protection of classified information.  The guidelines also allow for non-United States citizens to have access to classified information where there are compelling reasons. (Executive Order 12968)
**ADEQUATE SECURITY:**  a level of security that is commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information. (OMB Circular A-130)
**SUITABILITY:**  identifiable character traits and past conduct that are sufficient to determine whether an individual is likely or unlikely to efficiently and effectively perform job tasks.
**ACQUISITION:**  Any type of acquisition of IT services, regardless of award instrument (e.g., contract, small purchase, task/delivery order, record of call, interagency agreement/other).

## Laws, Executive Orders, and Guidelines

- Questions?

## Laws, Executive Orders, and Guidelines

- I thank you for your time.
- Thomas L. Mitchell
- (301) 594-2750