February 3, 2025 • 13 mins
description
NISPOM Compliance Consulting and FSO Services: https://www.thriveanalysis.com
NISPOM Books and Training Resources https://www.nispomcentral.com
Contact Jeff: jeff.bennett@nispomcentral.com
Implementing an Effective Insider Threat Program for NISPOM Compliance
Jeff Bennett from Thrive Analysis Group discusses the importance of implementing an aggressive insider threat program to ensure NISPOM compliance. He explains how such a program can protect sensitive information within clear defense contractors, commercial entities, institutions, and nonprofits. The video outlines the identification of sensitive assets, developing countermeasures, and training employees to recognize and report suspicious behavior as focal points of a robust insider threat program. Continuous evaluation, education on adverse information reporting, and practical steps for effective insider threat management are also covered.
00:00 Introduction to Jeff Bennett and Thrive Analysis Group
00:25 Understanding Insider Threat Programs
01:52 Identifying Insider Threat Behaviors
03:28 Implementing a Robust Insider Threat Program
05:27 Continuous Evaluation and Reporting
09:55 Training Employees on Insider Threats
12:36 Conclusion and Contact Information
NISPOM CentralProviding security clearance books, training, and resources for cleared defense contractors.
Clearance, NISPOM, and FSO Consulting
Thrive Analysis Group Inc is your resource for security clearance, NISPOM, and FSO consulting.
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
FSO Consulting:https://thriveanalysis.com
NISPOM Compliance
https://www.nispomcentral.com
https://www.nispom.com
The Trusted Advisor for Technology Protection, FSO and NISPOM consulting.
After dialing in my craft and many years of honing program protection experiences, I became a trusted advisor. I am currently supporting customers with technology protection and NISPOM compliance topics.
INDUSTRIAL SECURITY TRUSTED ADVISOR
What Trusted Advisor Involves:
I partner with executive leadership to design and operate security programs that meet and exceed NISPOM requirements.
Results you can measure immediately:
- Prepared commercial organizations for defense contracting and NISPOM compliance
- Designed ready to implement security programs before, during and after facility clearance award
- Rescued high risk security programs with quick turnaround; usually within 30 days
- Achieved Commendable and Superior DCSA review ratings
- Developed compliant FOCI mitigation programs
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:01):
Welcome to DOD Secure, and I'm your host, Jeff
Bennett.
Well, thanks so much for joiningus.
I decided to put the applausetrack back in because it was so
much fun, and I hope you don'tfind it annoying.
I hope it pumps you up for avery important discussion that
(00:22):
we're going to have in thispodcast.
Hi, I'm Jeff Bennett.
I'm with Thrive Analysis Group,and we are a NISPOM Compliance
and FSO consulting company.
I also have a company calledNISPOM Central, and we have
books, training, and resourcesfor NISPPOM compliance.
(00:43):
I have linked to both in mydescription, and I hope you'll
benefit from the content as wellas you can subscribe to this
channel.
So today's video is aboutengaging your company with an
aggressive insider threatprogram.
And this ensures an excellentcompliant NISPPOM or National
Industrial Security Program.
While this applies to cleardefense contractors, it also
(01:07):
applies to those desiring toprotect sensitive information.
Now this could have commercialapplication, institutional
application, as well asnonprofit organization
application.
Anybody who desires to protectcustomer, proprietary,
intellectual property, privacy,or other types of sensitive
(01:28):
information can benefit fromthis video.
The premise is stopping trustedemployees or trusted persons
from pilfering sensitiveinformation outside of the
organization.
So you might recall news reportsor events about trusted
employees providing unauthorizedinformation to unauthorized
persons.
(01:48):
We typically call these spies.
Sometimes they can also behazardous or hapless victims of
their disorganization.
So a good insider threat programwill also prevent ways that
these employees could eitheraccidentally or purposefully
expose sense of information.
(02:09):
And we want to make sure thatour employees understand what
their roles are and what isrequired of them.
And a robust insider threatprogram can help do that.
Experience demonstrates thatthese employees who have been
caught spying had displayedsigns, habits, and behavior upon
looking back, not predictingbehavior head, but upon looking
(02:31):
back, there's behavior thatindicated that they were indeed
an insider threat conductinginsider threat events.
For example, they were spendingextra time at copy machines
making copies of sensitiveinformation that they were not
authorized to do.
Additionally, they areunauthorized collection of data
on storage devices such as thumbdrives, telephones, or cell
(02:55):
phones, or other collectiondevices, and there are so many
more incidents of people gettingaccess to information that they
did not have a need to know orany other purpose having.
In and of themselves, many ofthese may not be reportable
events, but consolidated thisbehavior proved to be indicators
(03:15):
that should have had furtherinvestigation.
These days, it could be wellunderstood in the National
Industrial Program community, orthose communities operating
under the NISPOM, clear defensecontractors and such, that
employees should be assistingwith the insider threat program.
The NISP has tied such reportingto job performance and future
(03:38):
employment.
To be successful, FSOs provideNISPPOM-based programs and
training to provide trained,knowledgeable, and dedicated
employees.
While some have done this,others could do better and
improve their training programs.
This plan that I am about topresent to you can be applied
(03:59):
again across the board and itwill help prevent insider threat
events.
After all, a cleared contractordetermines whether or not an
employee requires access tosensitive information.
And the way they do that isproviding a security clearance.
The contractor requests a robustsecurity clearance, background
(04:21):
investigation from thegovernment.
The government does theinvestigation and either denies
or approves a securityclearance.
The same way non-governmentorganizations may do a
background check as part of thepre-employment package.
So this can also be applied tovetted employees of other types
(04:43):
of organizations.
Once the contractor submits asecurity clearance request, the
employee is subject to arigorous background check and
they are well vetted.
If results are favorable, thenagain, that employee will be
granted a security clearance.
And again, this process can beused for other applications
outside of DOD.
Now, throughout the employment,vetted employees are required in
(05:08):
the government and under NISPPOMto report any information that
would lead to a decision thatinvolved cleared employees or
lead or they should report anybehavior that would lead to a
decision by either the facilitysecurity officer or the
government that a clearedemployee should become a
(05:30):
security risk.
Now, this is called adverseinformation reporting.
Cleared employees are requiredto report adverse information on
themselves and other clearedemployees.
Some of this information I'llcover in other briefings, but
suffice to know that failure toreport adverse information could
be discovered later during thecontinuous evaluation process
(05:51):
that I'll be describing.
So vetted employees are requiredto go under continuous
evaluation program once they gettheir clearance, and every five
years they'll be reinvestigated.
During this five-year term, andemployees are required to report
on themselves.
Some of it is adverseinformation, but some of it is
just mandatory reporting, suchas foreign travel, a name
(06:13):
change.
In and of themselves, foreigntravel or a name change is a
pretty much normal event.
The reason that the continuousevaluation involves identifying
reportable information is thatit may not indicate an insider
threat activity, but could beapplied to insider threat
programs.
Continuous vetting is used tomaintain security clearance
(06:35):
eligibility, but it may not beenough to determine who an
insider threat might be.
Adverse information such asdrugs, alcohol, and behavioral
issues must be reported becausethey are red flags.
However, it does not mean in andof themselves that those are
insider threat events, but theyjust may be need to be reported.
(06:58):
While these reports may not beenough to determine who an
insider threat might be, theymay require additional
countermeasures and reportingrequirements just to hash out if
there are other events that needto be reported.
Now the reason that thecontinuous evaluation involves
identifying this reportableinformation is that they may or
(07:22):
may not indicate an insiderthreat as discussed earlier.
So why not emphasize a higherdegree of continuous evaluation
topics?
A higher degree meaning somebodyhas demonstrated behaviors of
ignoring security requirements.
That may indicate an insiderthreat and should be looked at
at a higher degree than somebodywho's going through a name
(07:43):
change.
So why not do that?
Why not focus on behaviors thatindicate an insider threat?
Or if your company performssensitive work, you are already
aware of risks to the products.
You understand what yourproducts are, how they're
sensitive, and the impact toyour organization if this
information were to be leakedout or provided to unauthorized
(08:05):
persons.
If your company performssensitive work, you're aware of
the risks to the product, to theproprietary information, to
trade secrets, personalinformation, and so on.
Why go through the excruciatingwork of identifying and
protecting sensitive informationonly to be unable to control
(08:26):
what employees do with it?
What is the best method forinstituting a robust insider
threat program?
There's a few steps.
One, you have to identifysensitive assets.
And what I mean by identifysensitive assets, identify it by
its form, fit, and fashion.
(08:46):
Don't just say, hey, I have goldand it's very sensitive.
But document how the goldexists.
Document if there are anyprocedures that you use that
gold for.
Document the format that thegold exists, the weight, the
purity of it, and where itresides.
(09:07):
Identify it, then document it soeverybody understands where it
resides, and then developadditional countermeasures.
For example, if you havesensitive information and you
desi and you you've identifiedit by form, fit and fashion,
then you might need to considerwho has access to it based on
(09:27):
its form, fit, and fashion andthat employee's work
requirements.
That's called need to know.
Develop those additionalcountermeasures and then develop
steps in place where you wouldidentify when an employee is
gaining access to that sensitiveinformation or item in an
unauthorized manner.
(09:48):
So instead of, for example,spying on employees, waiting to
trip them up in behavior,develop triggers so that you
know an employee is gettingaccess to it.
For example, why is an employeemaking hundreds of thousands of
copies of information?
Why is an employee downloadinginformation into a thumb drive
or a DVD?
(10:08):
These are questions you can askand determine if that's
authorized use of thatequipment.
This unauthorized access or usemay be an indication of a
reportable subject matter that'sfalling under the insider threat
program.
How does training your employeesto be in this part of this
robust program?
Reportable information involvesa long list of events that may
(10:31):
be too much to memorize.
So that's where your NISPOMrequired training comes in, or
that's where your securitytraining comes in, or even
insider threat training.
It's not as so important to beable to recite those reportable
incidents as it would it's justto understand what is reported.
We need to report behavior thatis suspicious.
(10:52):
Getting employees to understandwhat to report and who to report
it to is very important.
Just go through your company andask the question.
If you saw something suspicious,who would you report it to?
Who is your security officer?
Who is your insider threatprotection senior official?
Many people may not be able toanswer your question, even
though you've hammered it inearlier training.
(11:14):
Be sure to make it obvious andclear and coach your employees
through that.
Because if they do seesomething, they need to be able
to report it to a responsibleperson.
In addition to training youremployees on what is reportable,
train them on the topicsexclusive to the insider threat
(11:35):
activity.
Yeah, I understand I need toreport a name change, it may
impact my security clearance.
But I also need to report otherevents such as somebody asking
me for information that theydon't have access to.
That's something I should thinkabout reporting.
And then spell it out for youremployees to be able to
understand it.
In other words, a person whochanges their name or gets
arrested, that's requiredreporting.
(11:57):
But there's also some othernuances that your employees may
not be aware of that you maywant to start in your insider
threat program to help identifywhich activities may need to be
reported.
Once you get that figured out,break out your training into
bite-sized portions.
Lay out categories so thatemployees feel comfortable that
these categories are worthreporting.
(12:18):
Why?
Because the greatest risk tosense of information comes from
within the organization.
Yeah, we can set upcountermeasures to keep bad
outsiders outside oforganization.
We set up alarms, we set uplocks, we set up guards, we put
combinations on things.
But it is rare when somebodybreaks into an organization to
(12:40):
steal.
What is more common is peoplewith access to it, those trusted
employees that are walking outwith it.
Since this is the greatestthreat, why not take time to
develop a program to ensureemployees continue to
demonstrate ethical and legalactivity as well as understand
what to improve report.
(13:02):
If you need any assistance atall on your insider threat
program, training program, oryour security program, feel free
to contact me.
It's in the notes and in thecomments below.
Please feel free to reach out.
Welcome to DOD Secure, and I'm your host, Jeff
Bennett.
Well, thanks so much for joiningus.
I decided to put the applausetrack back in because it was so
much fun, and I hope you don'tfind it annoying.
I hope it pumps you up for avery important discussion that
(00:22):
we're going to have in thispodcast.
Hi, I'm Jeff Bennett.
I'm with Thrive Analysis Group,and we are a NISPOM Compliance
and FSO consulting company.
I also have a company calledNISPOM Central, and we have
books, training, and resourcesfor NISPPOM compliance.
(00:43):
I have linked to both in mydescription, and I hope you'll
benefit from the content as wellas you can subscribe to this
channel.
So today's video is aboutengaging your company with an
aggressive insider threatprogram.
And this ensures an excellentcompliant NISPPOM or National
Industrial Security Program.
While this applies to cleardefense contractors, it also
(01:07):
applies to those desiring toprotect sensitive information.
Now this could have commercialapplication, institutional
application, as well asnonprofit organization
application.
Anybody who desires to protectcustomer, proprietary,
intellectual property, privacy,or other types of sensitive
(01:28):
information can benefit fromthis video.
The premise is stopping trustedemployees or trusted persons
from pilfering sensitiveinformation outside of the
organization.
So you might recall news reportsor events about trusted
employees providing unauthorizedinformation to unauthorized
persons.
(01:48):
We typically call these spies.
Sometimes they can also behazardous or hapless victims of
their disorganization.
So a good insider threat programwill also prevent ways that
these employees could eitheraccidentally or purposefully
expose sense of information.
(02:09):
And we want to make sure thatour employees understand what
their roles are and what isrequired of them.
And a robust insider threatprogram can help do that.
Experience demonstrates thatthese employees who have been
caught spying had displayedsigns, habits, and behavior upon
looking back, not predictingbehavior head, but upon looking
(02:31):
back, there's behavior thatindicated that they were indeed
an insider threat conductinginsider threat events.
For example, they were spendingextra time at copy machines
making copies of sensitiveinformation that they were not
authorized to do.
Additionally, they areunauthorized collection of data
on storage devices such as thumbdrives, telephones, or cell
(02:55):
phones, or other collectiondevices, and there are so many
more incidents of people gettingaccess to information that they
did not have a need to know orany other purpose having.
In and of themselves, many ofthese may not be reportable
events, but consolidated thisbehavior proved to be indicators
(03:15):
that should have had furtherinvestigation.
These days, it could be wellunderstood in the National
Industrial Program community, orthose communities operating
under the NISPOM, clear defensecontractors and such, that
employees should be assistingwith the insider threat program.
The NISP has tied such reportingto job performance and future
(03:38):
employment.
To be successful, FSOs provideNISPPOM-based programs and
training to provide trained,knowledgeable, and dedicated
employees.
While some have done this,others could do better and
improve their training programs.
This plan that I am about topresent to you can be applied
(03:59):
again across the board and itwill help prevent insider threat
events.
After all, a cleared contractordetermines whether or not an
employee requires access tosensitive information.
And the way they do that isproviding a security clearance.
The contractor requests a robustsecurity clearance, background
(04:21):
investigation from thegovernment.
The government does theinvestigation and either denies
or approves a securityclearance.
The same way non-governmentorganizations may do a
background check as part of thepre-employment package.
So this can also be applied tovetted employees of other types
(04:43):
of organizations.
Once the contractor submits asecurity clearance request, the
employee is subject to arigorous background check and
they are well vetted.
If results are favorable, thenagain, that employee will be
granted a security clearance.
And again, this process can beused for other applications
outside of DOD.
Now, throughout the employment,vetted employees are required in
(05:08):
the government and under NISPPOMto report any information that
would lead to a decision thatinvolved cleared employees or
lead or they should report anybehavior that would lead to a
decision by either the facilitysecurity officer or the
government that a clearedemployee should become a
(05:30):
security risk.
Now, this is called adverseinformation reporting.
Cleared employees are requiredto report adverse information on
themselves and other clearedemployees.
Some of this information I'llcover in other briefings, but
suffice to know that failure toreport adverse information could
be discovered later during thecontinuous evaluation process
(05:51):
that I'll be describing.
So vetted employees are requiredto go under continuous
evaluation program once they gettheir clearance, and every five
years they'll be reinvestigated.
During this five-year term, andemployees are required to report
on themselves.
Some of it is adverseinformation, but some of it is
just mandatory reporting, suchas foreign travel, a name
(06:13):
change.
In and of themselves, foreigntravel or a name change is a
pretty much normal event.
The reason that the continuousevaluation involves identifying
reportable information is thatit may not indicate an insider
threat activity, but could beapplied to insider threat
programs.
Continuous vetting is used tomaintain security clearance
(06:35):
eligibility, but it may not beenough to determine who an
insider threat might be.
Adverse information such asdrugs, alcohol, and behavioral
issues must be reported becausethey are red flags.
However, it does not mean in andof themselves that those are
insider threat events, but theyjust may be need to be reported.
(06:58):
While these reports may not beenough to determine who an
insider threat might be, theymay require additional
countermeasures and reportingrequirements just to hash out if
there are other events that needto be reported.
Now the reason that thecontinuous evaluation involves
identifying this reportableinformation is that they may or
(07:22):
may not indicate an insiderthreat as discussed earlier.
So why not emphasize a higherdegree of continuous evaluation
topics?
A higher degree meaning somebodyhas demonstrated behaviors of
ignoring security requirements.
That may indicate an insiderthreat and should be looked at
at a higher degree than somebodywho's going through a name
(07:43):
change.
So why not do that?
Why not focus on behaviors thatindicate an insider threat?
Or if your company performssensitive work, you are already
aware of risks to the products.
You understand what yourproducts are, how they're
sensitive, and the impact toyour organization if this
information were to be leakedout or provided to unauthorized
(08:05):
persons.
If your company performssensitive work, you're aware of
the risks to the product, to theproprietary information, to
trade secrets, personalinformation, and so on.
Why go through the excruciatingwork of identifying and
protecting sensitive informationonly to be unable to control
(08:26):
what employees do with it?
What is the best method forinstituting a robust insider
threat program?
There's a few steps.
One, you have to identifysensitive assets.
And what I mean by identifysensitive assets, identify it by
its form, fit, and fashion.
(08:46):
Don't just say, hey, I have goldand it's very sensitive.
But document how the goldexists.
Document if there are anyprocedures that you use that
gold for.
Document the format that thegold exists, the weight, the
purity of it, and where itresides.
(09:07):
Identify it, then document it soeverybody understands where it
resides, and then developadditional countermeasures.
For example, if you havesensitive information and you
desi and you you've identifiedit by form, fit and fashion,
then you might need to considerwho has access to it based on
(09:27):
its form, fit, and fashion andthat employee's work
requirements.
That's called need to know.
Develop those additionalcountermeasures and then develop
steps in place where you wouldidentify when an employee is
gaining access to that sensitiveinformation or item in an
unauthorized manner.
(09:48):
So instead of, for example,spying on employees, waiting to
trip them up in behavior,develop triggers so that you
know an employee is gettingaccess to it.
For example, why is an employeemaking hundreds of thousands of
copies of information?
Why is an employee downloadinginformation into a thumb drive
or a DVD?
(10:08):
These are questions you can askand determine if that's
authorized use of thatequipment.
This unauthorized access or usemay be an indication of a
reportable subject matter that'sfalling under the insider threat
program.
How does training your employeesto be in this part of this
robust program?
Reportable information involvesa long list of events that may
(10:31):
be too much to memorize.
So that's where your NISPOMrequired training comes in, or
that's where your securitytraining comes in, or even
insider threat training.
It's not as so important to beable to recite those reportable
incidents as it would it's justto understand what is reported.
We need to report behavior thatis suspicious.
(10:52):
Getting employees to understandwhat to report and who to report
it to is very important.
Just go through your company andask the question.
If you saw something suspicious,who would you report it to?
Who is your security officer?
Who is your insider threatprotection senior official?
Many people may not be able toanswer your question, even
though you've hammered it inearlier training.
(11:14):
Be sure to make it obvious andclear and coach your employees
through that.
Because if they do seesomething, they need to be able
to report it to a responsibleperson.
In addition to training youremployees on what is reportable,
train them on the topicsexclusive to the insider threat
(11:35):
activity.
Yeah, I understand I need toreport a name change, it may
impact my security clearance.
But I also need to report otherevents such as somebody asking
me for information that theydon't have access to.
That's something I should thinkabout reporting.
And then spell it out for youremployees to be able to
understand it.
In other words, a person whochanges their name or gets
arrested, that's requiredreporting.
(11:57):
But there's also some othernuances that your employees may
not be aware of that you maywant to start in your insider
threat program to help identifywhich activities may need to be
reported.
Once you get that figured out,break out your training into
bite-sized portions.
Lay out categories so thatemployees feel comfortable that
these categories are worthreporting.
(12:18):
Why?
Because the greatest risk tosense of information comes from
within the organization.
Yeah, we can set upcountermeasures to keep bad
outsiders outside oforganization.
We set up alarms, we set uplocks, we set up guards, we put
combinations on things.
But it is rare when somebodybreaks into an organization to
(12:40):
steal.
What is more common is peoplewith access to it, those trusted
employees that are walking outwith it.
Since this is the greatestthreat, why not take time to
develop a program to ensureemployees continue to
demonstrate ethical and legalactivity as well as understand
what to improve report.
(13:02):
If you need any assistance atall on your insider threat
program, training program, oryour security program, feel free
to contact me.
It's in the notes and in thecomments below.
Please feel free to reach out.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Clay Travis and Buck Sexton Show
The Clay Travis and Buck Sexton Show. Clay Travis and Buck Sexton tackle the biggest stories in news, politics and current events with intelligence and humor. From the border crisis, to the madness of cancel culture and far-left missteps, Clay and Buck guide listeners through the latest headlines and hot topics with fun and entertaining conversations and opinions.