Source: https://www.hlregulation.com/2017/05/16/nispom-change-2-deadlines-coming-for-cleared-contractors/
Timestamp: 2020-01-24 05:21:24
Document Index: 321848425

Matched Legal Cases: ['§1', '§2', '§1', '§3', '§1', '§8']

Home > Government Contracts > NISPOM Change 2 Deadlines Coming for Cleared Contractors
As industry comes up on the one-year anniversary of the publication of Change 2 to the National Industrial Security Program Operating Manual (NISPOM)1, a number of implementation deadlines are drawing near. This blog post briefly highlights key industrial security program requirements for cleared contractors to focus on.
Change 2 requires cleared contractors to appoint an Insider Threat Program Senior Official (ITPSO)2 and implement an “insider threat” program3 that will gather, integrate, and report relevant and available information indicative of a potential or actual insider threat.4 Insider threat employee awareness training is now required for all cleared employees before being granted access to classified information and annually thereafter.
After May 31, 2017, all cleared contractor employees must complete the employee awareness training prior to having access to classified information, and thereafter annually.5
A senior management official at the cleared facility must certify annually to DSS in writing that a self-inspection of classified information systems has been completed.6 These self-inspection reports must be available to DSS during the company’s next security vulnerability assessment following the self-inspection.
Contractors must implement certain DSS-provided information system security controls on classified information systems in order to detect activity indicative of insider threat behavior.7
An authorizing official8 is responsible for issuing an operational authorization decision (an “Authorization to Operate” (ATO)) for cleared contractor information systems based on the results of security assessment activities and the implementation of security controls provided in the DAAPM.
Both the NISPOM and the DAAPM have replaced the legacy Certification and Accreditation (C&A) processes applied to information systems with the approach embodied in the NIST Risk Management Framework (RMF).9
Contractor classified information systems with a security authorization package submitted before August 2016 continue using the C&A process in the ODAA Process Manual.10
OPM has issued a new version of the Standard Form (SF) 328,11 which is used to gauge whether a company is under Foreign Ownership, Control, or Influence (FOCI).12 Revisions to the form include:
1 Department of Defense (DoD) 5220.22-M February 2006 (Incorporating Change 2, May 18, 2016).
2 The ITPSO must be identified as Key Management Personnel (KMP) and must have a Personnel Security Clearance (PCL) at the level of the company’s Facility Security Clearance (FCL). NISPOM §1-202; §2-104.
3 Insider threat is defined as “the likelihood, risk, or potential that an insider will use his or her authorized access, wittingly or unwittingly, to do harm to the national security of the United States. Insider threats may include harm to contractor or program information, to the extent that the information impacts the contractor or agency’s obligations to protect classified national security information.” (NISPOM Appendix C)
4 NISPOM §1-202.
5 NISPOM §3-103b; DSS Industrial Security Letter (ISL) 2016-02 at page 4.
6 NISPOM §1-207b.
7 NISPOM §8-100d.
8 The term “authorizing official” (AO) has replaced the legacy term “designated approving authority” (DAA) in the NISPOM. This change is consistent with other RMF changes to DoD cybersecurity publications.
9 National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Risk Management Framework.
10 However, the resulting ATO shall be no greater than 18 months and the contractor must develop a Plan of Action and Milestones (POA&M) for transitioning to the RMF.
11 Issued under OMB Control Number 0704-0194 and expires on Sept. 30, 2019, unless the form is renewed prior to that date. Previous blank SF 328s are obsolete.
12 Available from the GSA forms website here.
Posted in Government Contracts Tags: ATO, CA, DAAPM, DSS, ITPSO, NAO, National Security, NISPOM, ODAA