Industrial Security: DOD Cannot Provide Adequate Assurances That Its Oversight Ensures the Protection of Classified Information
Published: 2004-03-03T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Department of Defense (DOD) contractors perform numerous services that require access to classified information. With access comes the possibility of compromise, particularly as foreign entities increasingly seek U.S. military technologies. To ensure the protection of classified information, the National Industrial Security Program (NISP) establishes requirements that contractors must meet. In administering the NISP for DOD and 24 other government agencies, DOD's Defense Security Service (DSS) monitors whether 11,000- plus contractor facilities' security programs meet NISP requirements. In response to a Senate report accompanying the National Defense Authorization Act for Fiscal Year 2004, GAO assessed DSS's oversight and examined DSS's actions after possible compromises of classified information.
section_title: What GAO Found
paragraphs: DSS cannot provide adequate assurances to government agencies that its oversight of contractor facilities reduces the risk of information compromise. DSS is unable to provide this assurance because its performance goals and measures do not relate directly to the protection of classified information. While DSS maintains files on contractor facilities' security programs and their security violations, it does not analyze this information. Further, the manner in which this information is maintained--geographically dispersed paper-based files--does not lend itself to analysis. By not analyzing information on security violations and how well classified information is being protected across all facilities, DSS cannot identify systemic vulnerabilities and make corrective changes to reduce the risk of information compromise. When a contractor facility reports a violation and the possible compromise of classified information, DSS does not always follow established procedures. After receiving a report of a possible information compromise, DSS is required to determine whether compromise occurred and to notify the affected government agency so it can assess any damage and take actions to mitigate the effects of the suspected compromise, compromise, or loss. However, DSS failed to make determinations in many of the 93 violations GAO reviewed and made inappropriate determinations in others. In 39 of the 93 violations, DSS made no determinations regarding compromise. For 30 of the remaining 54 violations, DSS's determinations were not consistent with established criteria. As a result, government agencies are not being kept informed of possible compromises of their information. In addition, weeks or months can pass before government agencies are notified by DSS of possible information compromises because of difficulties in identifying the affected agencies. In 11 out of 16 instances GAO reviewed, it took DSS more than 30 days to notify the affected agency that its information had been lost or compromised. DSS relies on contractor facilities to identify the affected government agencies, but some facilities cannot readily provide DSS with this information because they are subcontractors that have to obtain the identity of the government agency from the prime contractors. In one case, 5 months passed before a subcontractor facility could provide DSS with the identity of the government agency whose information was suspected of being compromised. Such delays limit the government agencies' opportunity to assess and mitigate any damage from loss or compromise.

section_title: Letter
paragraphs: Contractors for the Department of Defense (DOD) perform a multitude of  services, ranging from designing advanced weapons used by U.S. forces  around the world to providing translation services for prisoner  interrogations at Guantanamo Bay, Cuba. Because a large portion of their  work is vital to national security, contractors often require access to  classified information. However, with contractor access comes the  possibility that classified information will be compromised and national  security will be harmed. Over the last several years, there have been  several reported incidents of contractors handling classified information  carelessly, losing it, and even providing it to unauthorized persons. These  incidents have occurred at a time when foreign entities are increasing their  attempts to obtain information from U.S. industry on militarily critical  technologies, such as encryption devices or target recognition components  for missiles. Further, the risk of compromise has grown with the increased  use of the Internet to transfer information almost anywhere in the world.
Given the risk of information compromise, contractors are required to  have security programs that provide DOD and other agencies with  assurances that classified information will be appropriately safeguarded.  The National Industrial Security Program (NISP) establishes requirements  that contractors’ programs must meet and a process for ensuring that  contractors adhere to the requirements. DOD’s Defense Security Service  (DSS) administers the NISP on behalf of DOD and 24 other federal  agencies. DSS grants clearances to contractor facilities so they can access  and, in some cases, store classified information. DSS then monitors over  11,000 facilities’ security programs to ensure that they meet NISP  requirements and to assure government customers that their classified  information is appropriately safeguarded.
In a report accompanying the National Defense Authorization Act for  Fiscal Year 2004, the Senate Committee on Armed Services directed us to  review the NISP and DOD’s oversight of contractors’ programs to protect  sensitive information and technology. In response, we assessed (1) DSS’s  oversight of contractor facilities’ implementation of the NISP and  (2) DSS’s adherence to required procedures after a security violation and  possible compromise of classified information. Details on the scope and  methodology of our review can be found in appendix I.
subsections: section_title: Background
paragraphs: Industrial security integrates information, personnel, and physical security  to protect classified information entrusted to contractors. The goal is to  ensure that contractors’ security programs detect and deter espionage and  counter the threat posed by adversaries seeking classified information.  According to DSS, attempts by foreign agents to obtain information from  contractors have increased over the last several years and are expected to  increase further. The NISP is the governmentwide program to assure  federal agencies that contractors adequately protect classified  information. The NISP was established by executive order in 1993 to  replace industrial security programs operated by various federal agencies.  Under the national program, contractor facilities must be cleared prior to  accessing classified information and must implement certain safeguards to  maintain their clearance. DOD is responsible for clearing facilities and  monitoring contractors’ protection of classified information. DOD, with  concurrence from the Department of Energy, Nuclear Regulatory  Commission, and Central Intelligence Agency, issued the National  Industrial Security Program Operating Manual (NISPOM) in 1995. The  NISPOM prescribes the requirements, restrictions, and safeguards that  contractors are to follow to prevent the unauthorized disclosure—or  compromise—of classified information.
DSS administers the NISP on behalf of DOD and 24 other agencies through  its Industrial Security Program. DSS’s Industrial Security Program, which  is one of DSS’s three core mission areas, oversees more than 11,000  contractor facilities to assure U.S. government customers that their  classified information is protected. By clearing a facility, DSS has  determined that the contractor facility is eligible to access classified  information at the same or lower classification level as the clearance  granted—Confidential, Secret, or Top Secret. Under the NISP, a facility is  a grouping of buildings related by function and location that form an  operating entity. Facilities include manufacturing plants, laboratories,  offices, and universities. They range in size from small offices that are  owned and operated by one person to huge manufacturing complexes that  are one of many owned by a large corporation. According to DSS, about  half of the cleared facilities have been approved by DSS to store classified  information on site, while the other facilities access classified information  at a government site or at another facility approved for storage.
DSS’s industrial security representatives serve as the primary points of  contact with cleared facilities and are responsible for ensuring that  contractors have security programs that comply with the NISPOM. The  240 industrial security representatives are assigned to 23 field offices  spread throughout the country, where field office chiefs supervise their  work. Representatives’ oversight involves educating facility personnel on  security requirements, accrediting information systems that process  classified information, approving classified storage containers, and  assisting contractors with security violation investigations. DSS  representatives also conduct periodic security reviews to assess whether  contractor facilities are adhering to NISPOM requirements and to identify  actual and potential security vulnerabilities. Security reviews are  scheduled annually for facilities that store classified information and every  18 months for facilities that do not have classified information on site. In  overseeing and assisting contractors, the representatives are to follow the  procedures contained in the Industrial Security Operating Manual, which  DSS issued to guide its personnel in administering the NISP. For example,  the manual specifies how representatives should conduct security reviews  to evaluate the quality of a facility’s security program and how contractor  facilities’ reports of security violations should be handled.
section_title: DSS Does Not Evaluate the Effectiveness of Its Oversight
paragraphs: DSS relies on performance goals and measures that do not provide it a  basis for assuring government customers that its oversight of contractor  facilities mitigates the risk of information compromise. Instead of focusing  on the overall results of its oversight and the protection of classified  information, DSS evaluates its performance in terms of indicators, such as  the number of security reviews completed on time. Further, while  industrial security representatives maintain paper files on the quality of  contractor security programs and the types of security violations that  result in compromises of classified information, DSS does not analyze this  information, and the manner in which it is maintained does not lend itself  to such analysis. Without this analysis, DSS is limited in its ability to detect  trends in the protection of classified information across facilities, to  determine sources of security vulnerabilities, and to identify those  facilities with the greatest risk of compromise.
subsections: section_title: DSS’s Performance Goals and Measures Do Not Indicate If Mission Is Being Achieved
paragraphs: Although DSS has reported that it has met or exceeded many of its  performance goals, DSS has no basis for determining whether it is  fulfilling its overall industrial security mission. DSS’s industrial security  mission, as stated in its current Fiscal Year 2000-2005 strategic plan, is to  (1) ensure that all contractor facilities overseen by DSS properly protect  classified information in their possession and (2) assure government  customers that facilities are eligible to receive classified information and  have systems in place to protect the classified information. However, DSS  currently does not have performance goals and measures that would  indicate whether DSS is fulfilling this mission.
DSS assesses its industrial security program based on the:    percentage of security reviews completed,    percentage of security reviews that covered all pertinent areas of  contractors’ security programs,  length of time needed to clear contractor facilities for access to  classified information, and  length of time needed to clear contractor personnel for access to  classified information.
Such indicators are important. For example, according to DSS officials,  the indicator pertaining to the completion of security reviews provides  government customers assurances that industrial security representatives  are monitoring their contractors. The timeliness of clearances also matters  because the facility and its personnel cannot access classified information  in support of a government contract until DSS has cleared them. For each  of the indicators, DSS established specific performance goals. While DSS  did not meet all of its goals related to the timeliness of contractor facility  and personnel clearances, it met or exceeded the goals related to security  reviews. For example, DSS’s goal is to conduct annual security reviews of  98 percent of the facilities that store classified information on site. In fiscal  year 2002, the most recent year for which data are available, DSS reported  meeting this goal.
DSS also reported that it exceeded the goal of having 75 percent of its  security reviews cover all pertinent areas within contractor facilities’  security programs. Based on a review of selected security review reports,  DSS determined that 86 percent of its security reviews conducted in fiscal  year 2002 covered all pertinent areas and accurately reflected the  contractor facilities’ overall security posture. However, DSS measured its  achievement of this goal based on field office chiefs’ selection and review  of about 550 of the approximately 9,000 reports completed by industrial  security representatives. This review does not focus on the quality of the  facilities’ security programs or the representatives’ review of those  programs. Instead, it is used to determine the completeness of the reports.
These current goals and measures alone do not enable DSS to determine  whether its oversight is effectively ensuring that contractors protect  classified information. There are no goals related to how well facilities are  protecting classified information, which would provide an indication as to  whether DSS is achieving its mission. For example, while DSS evaluates  the completeness of security review reports submitted by industrial  security representatives, it does not evaluate its performance in terms of  the ratings and number of findings that result from security reviews. Nor  does DSS evaluate its performance in terms of the frequency of security  violations and information compromises occurring at contractor facilities.  By not assessing its performance based on factors such as facility  compliance with NISPOM requirements, DSS cannot determine whether  its oversight efforts are contributing to an increase or decrease in  facilities’ compliance and the protection of classified information.
section_title: DSS’s Lack of Analysis Limits Its Ability to Determine If Its Oversight Reduces the Risk of Information Compromise
paragraphs: DSS maintains records on how well contractor facilities protect classified  information but does not analyze these records. There are no programwide  analyses of violations reported by facilities or results of DSS’s reviews of  facilities. Further, the manner in which DSS maintains records on  facilities’ security programs—geographically dispersed paper-based files— does not lend itself to analysis. Industrial security representatives maintain  a file folder on each facility they oversee. According to DSS officials, the  information contained in these file folders represents the official record on  each contractor facility. The folders are the primary means for  documenting information on facilities’ security programs and  representatives’ interactions with those facilities. The folders contain, in  paper copy form, information such as the facility’s clearance level, identity  of the facility owner, results of the last two security reviews, and facility’s  reports on security violations. Folders are kept with their respective  industrial security representatives throughout the country.
An analysis of the types of security violations reported by facilities, their  causes, or corrective actions taken would require a manual review of each  file folder. According to DSS officials, DSS has not conducted such an  analysis in recent years nor has it made any other attempt to identify the  most common violations of the NISPOM or their causes. As a result, DSS  does not know whether certain types of violations are increasing or  decreasing or why such changes may be occurring. For example, DSS  officials told us that anecdotal evidence indicates that there are an  increasing number of security violations involving unsecured e-mail  transmission of classified information. However, DSS has no basis for  knowing what percentage of facilities have had such violations or how  significant any increase has been.
By not analyzing the information contained in the file folders, DSS is  unable to identify patterns of security violations across all facilities based  on factors such as the type of work conducted at the facility, the facility’s  government customer, or the facility’s corporate affiliation. Officials at  several contractor facilities informed us that their security procedures are  developed and managed at the corporate level and, therefore, all facilities  owned by the corporation follow the same procedures. As a result,  security problems at one facility may indicate a more general,  corporatewide vulnerability. For example, an industrial security  representative attributed a series of violations at a facility owned by a  large corporation to that facility’s inadequate security education program.  However, facility security officials told us that their education program  was developed at the corporate level, rather than by that facility. Because  DSS does not track violations and their causes across facilities, there was  no way to readily determine whether use of the corporate security  education program resulted in violations at other facilities.
DSS recently created a new database to track the number of security  violations reported by facilities. Industrial security representatives are  required to enter into the database which facility reported the violation,  which field office is responsible for the facility, and the industrial security  representative’s determination regarding whether information was  compromised. According to DSS officials, DSS will use the new database  to calculate the number of security violations nationwide and by region  and to track the amount of time representatives take to make a  determination after receiving facilities’ violation reports. However,  because of the limited data it will contain, the database cannot be used to  identify common types and causes of security violations reported by  facilities.
DSS also does not analyze information on the quality of facility security  programs, such as ratings and the number and types of findings from  DSS’s security reviews. While DSS officials expressed interest in  eventually analyzing security review ratings and findings, they told us the  new database currently lacks this capability. DSS has not manually  reviewed the file folders and analyzed security review ratings to  determine, for example, whether the number of facilities meeting NISPOM  requirements is increasing or if security programs for facilities owned by  one corporation have consistently lower ratings than those owned by  another corporation. DSS also has not analyzed the security review  findings to identify the number and most common types of findings. As a  result, DSS cannot identify patterns of security review findings across all  cleared facilities on the basis of the type of work they perform, their size,  or corporate ownership.
section_title: DSS Does Not Always Comply with NISP Requirements after a Possible Compromise of Information
paragraphs: Industrial security representatives often failed to determine whether  security violations by facilities resulted in the loss, compromise, or  suspected compromise of classified information or made determinations  that were not in accordance with approved criteria. Such determinations  are important because if classified information is lost, compromised, or  suspected of being compromised, the affected government customer must  be notified so it can evaluate the extent of damage to national security and  take steps to mitigate that damage. Even when representatives made an  appropriate determination, they often took several weeks and even  months to notify the government customer because of difficulties in  identifying the customer. As a result, the customer’s opportunity to take  necessary corrective action was delayed.
subsections: section_title: Industrial Security Representatives Failed to Make Appropriate Determinations for Many Reported Security Violations
paragraphs: The NISPOM requires a facility to investigate all security violations. If  classified information is suspected of being compromised or lost, the  facility must provide its DSS industrial security representative with  information on the circumstances of the incident and corrective actions  taken to prevent future occurrences. The industrial security representative  is to then review this information and, using the criteria specified in DSS’s  Industrial Security Operating Manual, make one of four final  determinations: no compromise, suspected compromise, compromise, or  loss. Table 1 outlines the criteria for each determination.
If a determination other than no compromise is made, the Industrial  Security Operating Manual directs the representative to inform the  government customer about the violation so a damage assessment can be  conducted. However, as shown in figure 1, for 39 of the 93 security  violations that we reviewed, industrial security representatives made no  determinations regarding the compromise or loss of classified  information. For example, in two cases where the same facility reported  the improper transmission of classified information via e-mail, DSS made  no determinations even though the facility reported the possibility of  compromise in both cases. In eight cases at another facility, employees  repeatedly failed to secure a safe room to ensure the protection of  classified information. DSS made no determinations in any of the eight  cases. In the absence of a determination, the industrial security  representatives did not notify the government customers of these  violations. The government customers, unaware of the violations, could  not take steps to assess and mitigate any damage that may have resulted.
For 54 of the 93 violations we reviewed, representatives made  determinations regarding the compromise or loss of information, but the  majority were not consistent with the criteria contained in DSS’s Industrial  Security Operating Manual. As figure 1 further illustrates, representatives  made 24 determinations regarding compromise or loss that were  consistent with the criteria contained in the manual. However,  representatives made 30 inappropriate determinations, such as  “compromise cannot be precluded” or “compromise cannot be  determined.” Neither of these is consistent with the determinations in the  manual—no compromise, suspected compromise, compromise, or loss.  For example, in nine cases, the same facility reported that classified  material was left unsecured, and the facility did not rule out compromise.  In each of these cases, the industrial security representative did not rule  out compromise but used an alternative determination. Senior DSS  officials informed us that industrial security representatives should not  make determinations other than the four established in the Industrial  Security Operating Manual because the four have specific meanings based  on accepted criteria. By not following the manual, representatives have  introduced variability in their determinations and, therefore, their  decisions of whether to notify the government customer of a violation.
Among the 30 reported violations for which inappropriate determinations  were made, industrial security representatives notified the affected  government customers in 5 cases so the customers could assess and  mitigate any resulting damage. These cases included three violations  involving classified material that was left unsecured at the same facility.  For the remaining 25 reported violations, the customers were not made  aware of the violations even when the violations were similar to those  reported to other customers.
The failure of representatives to always make determinations consistent  with the Industrial Security Operating Manual is at least partially  attributable to inadequate oversight. The Standards and Quality Branch is  the unit within DSS responsible for ensuring that industrial security  representatives properly administer the NISP. Branch officials regularly  test and review field office chiefs and representatives on NISP  requirements, particularly those related to granting clearances and  conducting security reviews. According to DSS officials, the results of  these tests and reviews are used to design training courses that address  weaknesses in job skills. However, the Standards and Quality Branch does  not test or review how representatives respond to reported violations and  make determinations regarding compromise. As a result, DSS does not  know the extent to which representatives understand and are consistently  applying Industrial Security Operating Manual requirements related to  violations and, therefore, cannot make necessary revisions to training and  guidance.
In addition, field office chiefs are responsible for supervising and ensuring  the quality of industrial security representatives’ day-to-day oversight of  contractors. However, there is no specific requirement in the Industrial  Security Operating Manual for field office chiefs to review their industrial  security representatives’ determinations regarding reported security  violations. We found no evidence that chiefs reviewed the cases in which  the representatives either did not make determinations or made  determinations that were inconsistent with the manual. Further, chiefs  may not fully understand the manual’s criteria for determinations. For  example, one field office chief we met with tracked the industrial security  representatives’ processing of reported security violations by using a  categorization sheet containing the inappropriate determination  “compromise not precluded.”
section_title: DSS Is Not Always Able to Quickly Notify Government Customers about Violations
paragraphs: While the Industrial Security Operating Manual does not specify a time  requirement for notifying government customers when classified  information has been lost or compromised, DSS is frequently unable to  notify customers quickly because of difficulties in identifying the affected  customers. DSS notified government customers regarding 16 of the 54  reported violations for which representatives made determinations. Figure  2 shows that for 11 of these 16 violations, DSS did not notify the customer  for more than 30 days after the contractor reported that information was  lost, compromised, or suspected of being compromised. In one case,  5 months passed before an industrial security representative was able to  notify a government customer that its information was suspected of being  compromised. This delay was a result of the facility’s inability to readily  determine which government customer was affected by the compromise.
When a loss, compromise, or suspected compromise has been determined,  the industrial security representative generally relies on the facility to  identify the affected government customer. However, when the facility is  operating as a subcontractor, it may not be aware of the government  customer’s identity. In such instances, the subcontractor may have to  work with the prime contractor to identify the government customer to  provide the industrial security representative with this information. In one  case we reviewed, a subcontractor made repeated attempts over a 5- month period to obtain the affected government customer’s identity from  the prime contractor. In another case, an official with a subcontractor  facility informed us that it was extremely difficult and time-consuming for  him to identify the affected government customer, which took  approximately 2 months. Such delays limit the government customer’s  opportunity to assess the extent of potential damage to national security.
section_title: Representatives Often Do Not Notify Facilities of Their Determinations Even Though It May Be Useful to Do So
paragraphs: While the Industrial Security Operating Manual requires industrial security  representatives to notify government customers of loss or compromise  determinations, there is no requirement for representatives to inform  facilities of their final determinations. However, senior DSS officials told  us that they expect representatives to provide facilities with their final  determinations. They explained that this helps facility officials understand  what constitutes loss, compromise, or suspected compromise. Contractor  security officials at one facility confirmed this by telling us that receiving  determinations enables them to better understand which violations must  be reported to DSS. Yet, industrial security representatives provided  facilities with determinations for only 34 of the 93 reported violations we  reviewed, and 18 of the 34 were inappropriate determinations. As a result  of both inappropriate determinations and determinations not being  provided by DSS, facility officials may misunderstand what constitutes a  violation that must be reported to DSS and whether they have taken  appropriate actions to contain any possible compromise and prevent  future incidents.
section_title: Conclusions
paragraphs: By granting contractors access to classified information, the government  has entrusted them with protecting national security. Ensuring that  contractors safeguard classified information is DSS’s mission, yet DSS  cannot provide adequate assurances that it is fulfilling this mission.  Through its oversight, DSS cannot prevent every incident of information  compromise, but unless DSS knows whether its oversight minimizes the  risk of information compromise, it does not have an informed basis for  managing its oversight. By not evaluating the information it maintains on  how well contractors protect classified information, DSS may not realize  where the risks and systemic vulnerabilities exist. Further, DSS has no  basis for adjusting its resources to address emerging security weaknesses,  such as the electronic transmission of classified information. Although  DSS’s inability to assess its performance as well as evaluate and make  changes to its oversight does not necessarily mean that contractors are not  fulfilling their responsibilities under the NISP, the effectiveness of DSS’s  oversight is diminished and the assurances it provides to government  customers regarding the protection of their information cannot be relied  on.
Likewise, by not making appropriate determinations regarding  compromise or loss, DSS does not always notify government customers  that their information has been lost or compromised, thereby, limiting  corrective actions and possibly increasing the damage to national security.  Inappropriate determinations may also confuse contractors’  understanding of the reporting requirements and result in contractors not  reporting incidents that should be reported.
section_title: Recommendations for Executive Action
paragraphs: To enable DSS to evaluate whether its oversight reduces the risk of  information compromise, we recommend that the Secretary of Defense  direct the Director, Defense Security Service, to take the following three  actions:    establish results-oriented performance goals and measures that would  enable DSS to assess the extent to which it is achieving its industrial  security mission,  identify the information that needs to be analyzed to detect systemic  vulnerabilities and identify trends regarding how contractor facilities  protect classified information, and  regularly analyze that information to make informed management  decisions about the use of resources for its oversight activities and  make any needed changes to those activities or procedures to reduce  the risk of information compromise.
In carrying out these actions, DSS will need to evaluate alternatives for  creating a new system or further developing an existing system to record  and analyze standard information on how well contractors protect  classified information.
We also recommend that the Secretary of Defense direct the Director of  DSS to take the following four actions to ensure that appropriate  determinations are made regarding possible information compromises and  that government customers are notified of such situations in a timely  manner:    evaluate industrial security representatives and field office chiefs’  understanding of the criteria for making determinations regarding the  compromise of classified information and revise training and guidance  for representatives and chiefs based on the results of that evaluation,  revise Industrial Security Operating Manual requirements to emphasize  the need to apply the established determinations regarding the  compromise or loss of classified information,    explore the effects of establishing specific time-based criteria in the  Industrial Security Operating Manual for representatives to make  determinations and notify government customers, and    establish mechanisms that create accountability for knowing the  identity of government customers so that industrial security  representatives can readily notify those customers of any loss or  compromise. This could be accomplished by requiring representatives  to maintain such information in their file folders or ensuring that  contractors, particularly when they are subcontractors, know the  identity of their government customers before an incident resulting in  compromise or loss occurs.
Additionally, to improve contractors’ understanding of which security  violations must be reported to DSS, we recommend that the Secretary of  Defense direct the Director of DSS to revise the Industrial Security  Operating Manual to require industrial security representatives to inform  facilities of the official determinations regarding the loss or compromise of  classified information.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, DOD concurred with our  recommendations. However, DOD stated that the report’s conclusion— that DSS cannot provide adequate assurances that its oversight ensures  the protection of classified information by contractors—is not supported  because we did not evaluate how well contractors protect classified  information. While agreeing that its performance measures are not results- oriented, DOD stated that DSS is able to provide assurances regarding the  protection of classified information through its security reviews. For  99 percent of security reviews, according to DOD, contractors were found  to be satisfactorily protecting classified information. Additionally, DOD  indicated that the problems we identified with security violations and  possible information compromises were purely administrative. DOD stated  it assumes that DSS’s current processes for handling security violations  and possible information compromises did not leave classified information  at risk.
While contractors are ultimately responsible for protecting the classified  information entrusted to them, DSS is charged with ensuring that  contractors fulfill this obligation. Our review focused on how effectively  DSS’s oversight ensures that contractors protect classified information. As  explained in our report, DSS does not assess the effectiveness of its  oversight based on how well contractors are protecting information from  compromise nor does it analyze data to identify systemic vulnerabilities in  contractors’ protection of classified information. Therefore, DSS cannot  provide adequate assurances that its oversight ensures the protection of  classified information. DSS is also hindered in its ability to identify and  implement corrective changes to reduce the risk of information  compromises resulting from security violations. In its comments, DOD  stated that DSS does not have the ability to identify and analyze trends  regarding how contractors protect classified information because it lacks  the information technology infrastructure to conduct such analyses.
We are uncertain of the basis for DOD’s statement that 99 percent of the  facilities received satisfactory security review ratings because DSS  officials told us during the course of our review that they do not track the  facilities’ ratings. Also, by focusing only on security review ratings, DOD is  overlooking other indicators—such as security review findings and  incidents of possible compromise—that could enable DSS to improve its  oversight. Further, the rating may not be an adequate measure of  effectiveness. First, an industrial security representative can rate a  facility’s security program as satisfactory even if the facility does not fully  comply with the NISPOM and its failure to do so could logically lead to  information compromise. Second, because DSS does not track information  on security review ratings and violations, it cannot establish whether there  is a correlation between a facility’s rating and the frequency and  seriousness of that facility’s violations and information compromises.  Finally, as we noted in our report, DSS’s security review quality metric is  based not on the quality of reviews, but rather on the completeness of  industrial security representatives’ reports. Also, the manner in which field  office chiefs select reports for the quality review is not statistically valid  and, therefore, DSS cannot draw conclusions about the quality of security  review reports nationwide based on that quality review.
The problems we identified with DSS’s response to security violations and  possible information compromises go beyond administrative processing.  Our findings focus on whether DSS has fulfilled its oversight  responsibilities. As DOD noted in its comments, DSS is responsible for  determining whether a violation has resulted in compromise, ensuring that  the contractor took corrective action, and notifying the government  customer. Yet, as discussed in our report, industrial security  representatives failed, in 39 of the 93 security violations we reviewed, to  determine whether the violations resulted in the loss, compromise, or  suspected compromise of classified information. For an additional 30  violations, representatives made inappropriate determinations, which  created variability in their decisions on whether to notify the government  customer of a violation. Absent a determination consistent with the  Industrial Security Operating Manual, one cannot draw conclusions on  whether the contractor conducted an adequate inquiry into the violation  and took corrective action to prevent its recurrence. Therefore, we cannot  agree with DOD’s assumption that weaknesses in DSS’s handling of  security violations did not leave classified material at risk. DOD’s  comments are reprinted in appendix II, along with our evaluation of them.
We are also sending copies of this report to interested congressional  committees; the Secretary of Defense; the Director, Defense Security  Service; the Assistant to the President for National Security Affairs; and  the Director, Office of Management and Budget. We will make copies  available to others upon request. In addition, this report will be available  at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions regarding this report, please  contact me at (202) 512-4841. Key contributors to this report are listed in  appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To assess the Defense Security Service’s (DSS) oversight of contractors’  implementation of the National Industrial Security Program (NISP), we  reviewed Department of Defense (DOD) regulations and guidance on  industrial security, including the National Industrial Security Program  Operating Manual, as well as DSS policies, procedures, and guidance for  overseeing contractor facilities. We also assessed DSS’s performance goals  and measures contained in its strategic plan and annual report against our  reports related to the Government Performance and Results Act and  internal controls. We discussed the development of DSS goals, objectives,  and performance metrics with DSS officials. To become more familiar  with the roles and responsibilities of DSS staff, particularly as they relate  to maintaining information on facility security programs, we reviewed  DSS’s training materials, the Industrial Security Operating Manual, and  selected facility file folders. We also discussed with DSS officials at  headquarters and field locations how they use the information in the  facility file folders to manage the industrial security program and oversee  contractor facilities.
To assess adherence to required procedures by DSS after a security  violation and possible compromise of classified information, we used a  case study approach. Using DSS’s Facilities Database, we selected cases  from all facilities participating in the NISP as of March 2003. We reviewed  the data and identified facilities that reported to DSS security violations  since January 1, 2001, and selected 13 cleared facilities that varied  according to size, clearance level, and geographic location. For those  13 facilities, we reviewed DSS’s official facility file folders and identified  93 reported violations. For those violations, we examined DSS’s actions to  determine whether industrial security representatives and field office  chiefs handled these reports in accordance with the Industrial Security  Operating Manual. We also spoke with representatives and chiefs  regarding the actions they take after receiving violation reports. We  analyzed the information in DSS’s files on the 13 facilities and their  violations to identify the determinations made by industrial security  representatives, how frequently government customers were contacted,  and the timeliness of government customer notification. In addition, we  visited the facilities selected for our case study and interviewed those  facilities’ security officials to obtain clarification and additional  information about the reported security violations and actions taken by  DSS. Because we did not take a statistical sample of facilities, the results  from our analyses cannot be generalized. We also did not assess the  reliability of the Facilities Database as a whole. However, we confirmed  that the data used to select the 13 cases, specifically the facility size and  clearance level, were consistent with the information in the facility files  we reviewed.
We performed our review from March 2003 through January 2004 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Comments from the Department of Defense
paragraphs: The following are GAO’s comments on the Department of Defense’s letter  dated February 12, 2004.
subsections: section_title: GAO’s Comments
paragraphs: 1. Our report recognizes that contractors are responsible for protecting  classified information entrusted to them. However, the focus of the report  is how well DSS is fulfilling its mission to ensure that contractors are  protecting classified information. We clearly state that DSS’s inability to  assess whether it is fulfilling its mission does not necessarily mean that  contractors are not protecting the classified information entrusted to  them.  2. We are uncertain of how DOD determined that 99 percent of cleared  contractors were awarded satisfactory ratings nor do we know what time  period this percentage covers and whether it has varied over time.  However, for DSS to effectively manage its oversight, it needs to regularly  analyze data and examine trends regarding the protection of classified  information over time instead of producing the data to fulfill a one-time  information request.  3. The results of our case studies can and do indicate serious weaknesses  in how DSS oversees contractor facilities even though they cannot be  generalized because, as discussed in appendix I, we did not take a  statistical sample.   4. Our report identifies shortcomings in DSS’s ability to evaluate whether it  is fulfilling its mission, make informed management decisions, and ensure  that industrial security representatives properly resolve security violations  and possible information compromises. Our report offers specific  recommendations for improvement, all of which DOD agreed to  implement.   5. It is unclear from DOD’s comments what other measures DSS relies on  to determine success in accomplishing its mission. Our review assessed  the goals and measures established by DSS and found that they do not  provide a basis for determining whether DSS is fulfilling its mission.  6. Maintaining the prime contract numbers for all tiers of contracts in a  new information management system may not be sufficient to ensure that  government customers are readily notified of a loss or compromise. In at  least two cases we reviewed, industrial security representatives informed  subcontractor facility officials that, in addition to the prime contract  number, the name and complete address of the government customer and  a point of contact needed to be provided before DSS could process the  violation. In one case, an official at a subcontractor facility informed the  representative that such information was not readily available on the  DD Form 254, which is designed to provide a contractor with the security  requirements and classification guidance needed for the performance of a  classified contract.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the individual named above, Johana R. Ayers; Ronald T.  Bell, Jr.; Lily J. Chin; Brendan S. Culley; Ian A. Ferguson; Kenneth E.  Patton; and Eric E. Petersen made key contributions to this report.