Senior Company Official. Appoints the ITPSO, signals their support of the ITSP through written memorandum, and provides senior management support for the implementation and execution of the ITSP. Facility Security Officer. Coordinates with the ITPSO at all stages of the implementation and execution of the ITSP. Assists with investigations, reports on any actions or activities which could be indicative of Insider Threat activity, and provides information which affects individual risk categories. Human Resources Department. Provides guidance to the ITPSO regarding relevant changes to labor and employment laws, regulations, and policies which could affect information gathering. Assists with investigations into potential violations or malicious activity. Refers information to the ITSP team that is relevant to risk categories. Works with the ITPSO to develop organizational policies which aid in the reduction of Insider Threat activity. Legal Department. Provides guidance to the ITPSO regarding legal considerations of the ITSP and assists with investigations into potential violations or malicious activity. Information Technologies Department. Assists the ITPSO with necessary access to Company systems as needed to conduct authorized investigations. Reports unauthorized access to Company systems along with detected deviations within the systems. Supports the ITSP by monitoring any information system based analytic detection tools. Works with the ITPSO to develop policies, controls, training tools, and safeguards to mitigate the risk of unauthorized access to Information Systems. Managers & Supervisors. Submit information to the ITPSO that is relevant to risk categories. Reports incidents and violations in regards to Company policies or activities which could be indicative of Insider Threats. Support the ITPSO when conducting investigations into potential Insider Threat activity. Employees & Company Personnel. Submit information to the ITPSO that is relevant to risk categories. Reports incidents and violations in regards to Company policies or activities which could be indicative of Insider Threats. Note that cleared employees have required reporting obligations established under the National Industrial Security Program. DETERRING INSIDER THREAT. Deterrence is most effective when a comprehensive detection program is in place and employees are encouraged to act as stakeholders in the protection of Company resources. The best way to achieve this goal is to ensure that employees receive sufficient training in order to understand the full scope of how Insider Threats affect the government, the Company, their co-workers, and themselves. Employees should be made aware of the ITSP and the steps taken by the ITPSO to prevent the risk of Insider Threats. Initial Insider Threat Awareness Briefings will include a basic overview of what
Medium Calculated Range (521-1599). This would result in an Individual Risk Level of ‘Medium’. Individual Risk Categories Targeting Risk Categories Calculated Risk Range Rating Level Weighted Rating Level Weighted Rating Calculated Range Low 1 0 Low 1 0 Negligible 0 - 150 2 30 2 150 Low 151 - 520 3 70 Medium 3 750 Medium 521 - 1599 4 130 High 4 2000 High 1600 - 4499 Medium 5 250 5 4500 Very High 4500 - ∞ 6 400 High 7 700 8 1600 9 3000 10 4500 Fig.1 - Baseline Risk Levels and Calculated Risk Range IN CONJUNCTION WITH ADJUDICATIVE GUIDELINES. In conjunction with DoD 5220.22-M and ISL 2016-02, the ITSP must have procedures in place for cleared personnel in order to identify and report relevant information covered by the thirteen (13) personnel security adjudicative guidelines that may be indicative of a potential or actual Insider Threat. The Personal and Work Risk Categories associated with the ITSP can be utilized to identify issues which correspond with specific adjudicative guidelines. These corresponding areas (fig.2) ensure that the ITSP Team can effectively notify the cognizant organization regarding indicators of potential or actual Insider Threat by cross-referencing the specific category and guideline. Note that this is only a guide and certain activities may span multiple categories or affect adjudicative guidelines outside the listed guide. Personal Risk Categories Work Risk Categories Adjudicative Guidelines Money Ideology Conscience Ego Nationalism Sexual Activity Connections Performance Violations Security Weakness A Allegiance to the Unites States ● ● ● ● B Foreign Influence ● ● ● ● ● ● C Foreign Preference ● ● ● ● D Sexual Behavior ● E Personal Conduct ● ● ● F Financial Considerations ● G Alcohol Consumption ● ● ● H Drug Involvement ● ● I Psychological Conditions ● ● ● J Criminal Conduct ● ● K Handling Protected Information ● ● L Outside Activities ● ● ● ● M Use of Information Technology Systems ● ● Fig.2 - Adjudicative Guidelines Cross-Reference Guide
ATTACHMENT 1 (continued): RISK CATEGORIES AND GUIDELINES Category Level Guidelines Nationalism 1 No issues identified or any issues are effectively mitigated. 2 Has ties to a foreign country due to dual-citizenship, family relations, or presents some other personal connection to a foreign country. 3 4 5 Expresses feelings of connection with a foreign country or government equal to, or above that, of the United States. 6 7 Has made verbal, written, or implied statements identifying a desire to aid a foreign country or government. 8 9 10 Expresses great regard for foreign country or government and demonstrates a strong desire or intent to provide them aid without regard for policies. Category Level Guidelines Sexual Activity 1 No issues identified or any issues are effectively mitigated. 2 Minor issues due to natural age or maturity, or more serious issues are partially mitigated. 3 4 5 Potential for manipulation or coercion due to personal proclivities for non-traditional activities, or hidden lifestyle. 6 7 High risk due to hidden lifestyle or potential for manipulation or coercion. Involved with illegal sexual activities such as prostitution (note that involvement may not necessarily include direct participation). 8 9 10 Very high risk of being manipulated or coerced due to sexual activities or behavior. Routinely engages in illegal sexual activities. Category Level Guidelines Connections 1 No issues identified or any issues are effectively mitigated. 2 Has connections to individual(s) working at competing companies or with foreign ties. 3 4 5 Has personal connections with individual(s) working at competing companies or with foreign ties. These connections exceed basic friendship and may be associated with shared history, goals, or needs. 6 7 Has very strong connections with individual(s) working at competing companies or with foreign ties. These connections may be deeply emotional in nature or associated with a long term relationship. 8 9 10 Has extreme bonds of obligation or connections to individual(s) working at competing companies or with foreign ties. Category Level Guidelines Performance 1 No issues identified or any issues are effectively mitigated. 2 Minimal issues, concerns, or more serious issues are partially mitigated. 3 4 5 Some issues or concerns. 6 7 Above average issues that have the potential to result in termination. 8 9 10 Serious performance issues which could result in termination or individual has submitted resignation or has been scheduled for termination.
ATTACHMENT 2: ITSP ACCESS/ACTION REQUEST FORM ITSP Request Form Date: Requestor Name: Request Type: □ Information/Records □ Action For Department: □ Human Resources □ Information Technology □ Legal □ Facility Security □ Other: ______________________ DESCRIPTION OF REQUEST REASON FOR REQUEST PREREQUISITE REVIEWS/APPROVALS (IF APPLICABLE) Department: Date: Representative: Signature: ____________________ ---------------------------------------- Department: Date: Representative: Signature: ____________________ (FOR APPROVING DEPARTMENT) Request: □ Approved □ Denied Remarks: Date: Completed By: Signature: ____________________