Protecting Classified Information: Defense Security Service Should Address Challenges as New Approach Is Piloted

Industrial security addresses the information systems, personnel, and physical security of facilities and their cleared employees who have access to or handle classified information. The National Industrial Security Program was established in 1993 to safeguard federal government classified information that may be or has been released to contractors, among others. GAO last reported on this program in 2005 and the Department of Defense has since implemented 13 of the 16 related recommendations.

GAO was asked to examine how DSS administers the program. This report assesses to what extent DSS: 1) changed how it administers the program since GAO's last report; and 2) addressed challenges as it pilots a new approach to monitoring contractors with access to classified information.

GAO reviewed guidance and regulations since 2005, including the program's operating manual. GAO analyzed data from DSS's electronic databases and also selected a non-generalizable sample of contractor facilities based on clearance level, geographic location, and type of agreement to address foreign influence. We also reviewed documents and interviewed relevant government and contractor officials.

The Defense Security Service (DSS) has upgraded its capabilities but also faces challenges in administering the National Industrial Security Program, which applies to all executive branch departments and agencies, and was established to safeguard federal government classified information that current or prospective contractors may access. Since we last reported on this program in 2005, DSS has:

streamlined facility clearance and monitoring processes, and

strengthened the process for identifying contractors with potential foreign influence.

However, under its current approach, DSS officials indicated that they face resource constraints, such as an inability to manage workloads and complete training necessary to stay informed on current threats and technologies. In its most recent report to Congress, DSS stated that it was unable to conduct security reviews at about 60 percent of cleared facilities in fiscal year 2016. Further, DSS recently declared that the United States is facing the most significant foreign intelligence threat it has ever encountered. As a result, in 2017, DSS announced plans to transition to a new monitoring approach to address emerging threats at facilities in the program. For a comparison of the current and new approaches, see below.

DSS has not addressed immediate challenges that are critical to piloting this new approach. For example, GAO found it is unclear how DSS will determine what resources it needs as it has not identified roles and responsibilities. Moreover, DSS has not established how it will collaborate with stakeholders—government contracting activities, the government intelligence community, other government agencies, and contractors—under the new approach. Federal Internal Control Standards establish the importance of coordinating with stakeholders, including clearly defining roles and responsibilities. In addition, GAO's leading practices for interagency collaboration state that it is important for organizations to identify the resources necessary to accomplish objectives. Until DSS identifies roles and responsibilities and determines how it will collaborate with stakeholders for the piloting effort, it will be difficult to assess whether the new approach is effective in protecting classified information.

GAO recommends DSS determine how it will collaborate with stakeholders, including identifying roles and responsibilities and related resources, as it pilots a new approach. DSS concurred with the recommendation.

Protecting classified information from compromise and exploitation is  essential for the U.S. government to maintain its technological advantage  over potential adversaries. In recent years, there have been high profile  leaks of classified information by contractors, and there are heightened  concerns about foreign adversaries’ ability to access classified  information and evade detection. Industrial security addresses the  information systems, personnel, and physical security of facilities and  their cleared employees who have access to or handle classified  information. In 1993, the National Industrial Security Program, which  applies to all executive branch departments and agencies, was  established to safeguard federal government classified information that  may be or has been released to current, prospective, or former  contractors, among others, and is administered by the Defense Security  Service (DSS) within the Department of Defense. DSS determines the  eligibility of contractors to access classified information, known as the  facility security clearance process, and contractors may have one or  multiple facilities that participate in the program. Once a contractor is  cleared and enters the program, DSS is responsible for ensuring that  cleared contractors meet the requirements to safeguard classified  information through periodic security reviews.

You requested that we examine how the Department of Defense, through  DSS, administers the National Industrial Security Program to protect  classified information. This report assesses to what extent DSS: 1)  changed how it administers the program since our last report in 2005; and  2) addressed challenges as it pilots a new approach to monitoring  contractors with access to classified information.

To determine the extent to which DSS changed how it administers the  National Industrial Security Program, we reviewed relevant guidance and  regulations including changes made since we last reported in 2005, such  as DSS’s Industrial Security Operating Manual. We also reviewed the  National Industrial Security Program Operating Manual (operating  manual), which describes the requirements for contractors to safeguard  classified information under the program. We also viewed  demonstrations of DSS’s various electronic systems, including the  Industrial Security Facilities Database. To learn about changes to how  DSS processes facility security clearances, we selected a non- generalizable sample of 13 contractor facilities based on 3 criteria:  security clearance level, geographic location, and type of mitigation  agreements. Mitigation agreements that address foreign ownership,  control, or influence are intended to prevent situations in which a foreign  interest has the power to decide matters affecting a contractor’s  operations and that could result in unauthorized access to U.S. classified  information or adversely affect the performance of classified contracts.  For the purposes of this report, we will use “foreign influence” when  referring to contractors with foreign ownership, control, or influence. Our  sample included at least two contractor facilities from each of DSS’s four  regions (Capital, North, South, and West) with active secret or top secret  clearances (as of June 29, 2017) that were operating with mitigation  agreements to address foreign influence.

We reviewed documents from DSS’s facility clearance process, including  the agency’s analysis of potential foreign influence along with mitigation  agreements and supplemental plans. We conducted site visits at all four  regional offices and met with industrial security representatives, regional  leadership staff, counterintelligence special agents, and information  system security professionals who worked with these facilities. We also  analyzed data from DSS’s Industrial Security Facilities Database,  including the number of clearances granted to facilities with contractor  mitigation agreements from fiscal year 2007 through 2016. We took steps  to assess the reliability of the data, including comparing selected data  fields against DSS documentation and conducting interviews with DSS  officials. We determined that the data were sufficiently reliable to  understand how many facility clearances DSS processed for facilities with  and without contractor mitigation agreements during this period.

To assess the extent to which DSS has addressed challenges as it pilots  a new approach to monitoring contractors with access to classified  information, we reviewed documents, analyzed DSS data, and conducted  interviews with officials involved in DSS’s monitoring process. We  reviewed documents related to DSS’s current process, such as security  reviews, and DSS’s new approach (DSS in Transition), including  documents distributed to cleared contractors. We also conducted  interviews with officials from DSS headquarters, including those involved  with DSS in Transition, DSS field offices, government contracting  activities, cleared contractor facilities, and defense industrial trade  associations.

We conducted this performance audit from February 2017 to May 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The goal of federal government industrial security is to ensure that  contractors’ security programs detect, deter, and counter the threat posed   by adversaries seeking classified information. The National Industrial   Security Program was established by executive order in 1993 to replace  industrial security programs operated separately by various federal  agencies and ensure that contractors, among others, were adequately  protecting classified information. For the purposes of this report, we will  use “contractor” to refer to any party that the program applies to, including  contractors, grantees, licensees, certificate holders, and their respective  employees.

DSS is responsible for administering the National Industrial Security  Program on behalf of the Department of Defense and, by mutual  agreement, 32 other federal departments and agencies. Headquartered  in Quantico, Virginia, and with staff in 26 field offices across four regions,  DSS provides oversight, advice, and assistance to more than 12,000 U.S.  facilities that are cleared for access to classified information under the  program. Facilities can range in size and be located anywhere in the  United States, and include manufacturing plants, laboratories, and  universities. In addition, they can also include contractor personnel who  travel to U.S. government sites to access classified information but do not  store any classified information at their facility. There are multiple reasons  why a contractor may need access to classified government information.  For example, a factory may produce parts for a major weapons system  using a production process that is classified, or a contractor may have  employees who deliver their technical expertise in a classified  environment at a military installation.

National Industrial Security Program Operating Manual

As part of the facility clearance process, DSS is responsible for ensuring  that cleared contractors safeguard classified information under the  program by meeting requirements, which are outlined in the National  Industrial Security Program Operating Manual. The Secretary of  Defense, in consultation with all affected agencies and with the  concurrence of the Secretary of Energy, the Nuclear Regulatory  Commission, the Director of National Intelligence, and the Secretary of  Homeland Security, issues and maintains the operating manual. The  operating manual addresses the contractors’ key responsibilities such as  reporting incidents of suspected loss of classified information. The  Information Security Oversight Office of the National Archives and  Records Administration, an agency separate from the Department of  Defense, monitors the National Industrial Security Program and issues  implementing directives for agencies. The Information Security Oversight  Office also chairs the program’s policy advisory council, which is  comprised of government and industry representatives who recommend  changes to industrial security policy. The Department of Defense,  including DSS, has periodically issued information for contractors in the  program, such as industrial security letters, to clarify the operating  manual.

The operating manual states that a contractor or prospective contractor is  eligible for a facility clearance if it has a need for access to classified  information in connection with a legitimate U.S. government contracting  requirement. A facility clearance is an administrative determination that,  from a national security standpoint, a contractor or prospective contractor  is eligible to access classified information at a specified level. A  contractor’s employees cannot begin accessing classified information  until the facility clearance has been granted, even if that results in  delayed performance of a contract.

According to the operating manual, in order for a contractor or  prospective contractor to enter the program, it may be sponsored by an  already cleared contractor or the government contracting activity. DSS  requires information about the contract, subcontract, or solicitation that  necessitates a clearance, such as level of safeguarding required and a  brief description of the procurement. Within the government contracting  activity, the information may be provided by the contracting office,  program office, or security office. DSS begins its facility clearance  process once it receives the information and assigns the case to an  industrial security representative at a local DSS field office. The industrial  security representative serves as the primary point of contact for the  sponsored facility during the clearance process and once the contractor is  eligible to access classified information. Across DSS field offices and  headquarters, multiple people are involved in the facility clearance  process, including those who specialize in information systems or others  who have experience with analyzing contractors for indicators of foreign  influence. See figure 1 for more details about how DSS processes a  facility clearance.

As shown in the figure above, DSS also reviews the contractor’s  ownership and business structure to assess whether foreign interests  indicate a contractor is under foreign influence, which could lead to  disclosure of classified information to foreign nationals. Contractors are  required to answer questions about whether there is foreign involvement  in their ownership, board composition, debt, source of revenues, and any  other situations where foreign nationals might be in a position to influence  their operations. If DSS determines that there is a risk for foreign  influence, the contractor is ineligible for a facility clearance unless, and  until, security measures are put in place, such as negotiating a mitigation  agreement with DSS. As of June 2017, approximately 630 of the over  12,000 cleared facilities in the program have mitigation agreements in  place to address foreign influence.

As part of the facility clearance process, certain personnel, such as the  facility security officer, must receive personnel clearances to the level of  the facility clearance. In the personnel clearance process, specialists at  DSS headquarters grant interim clearances to U.S. citizens based on  national security standards and information from background  investigations conducted by the Office of Personnel Management, if there  is no adverse information of material significance. Before the facility  clearance can be granted, a DSS industrial security representative  verifies that the key management personnel have received their  permanent clearance.

Contractor Responsibilities for Cleared Facilities

After DSS completes the facility clearance process and determines that a  contractor is eligible to access classified information and grants the facility  security clearance, the cleared contractor officially enters the National  Industrial Security Program. Once in the program, contractors establish a  security program at cleared facilities or implement security measures  required by the Department of Defense security agreement, as well as  any elements required by DSS. Depending on the facility, security  measures may address a variety of industrial security issues. For  example, a contractor may be required to start using visitor logs or  badges to track every person with physical access to a facility or establish  separate computer systems for the sole purpose of storing classified  information. In addition, contractors are required to implement insider  threat programs, which are meant to prevent persons with approved  access to classified information, such as contractor employees, from  causing harm to national security through unauthorized disclosures. The  insider threat programs may include activities such as training programs  about reporting requirements or monitoring classified information  systems.

DSS monitors cleared contractor facilities to determine their compliance  with the program’s requirements for protecting classified information by  conducting periodic security reviews. DSS determines the frequency of  these reviews, although they generally cannot take place more than once  in a 12-month period, according to the operating manual. The duration of  security reviews and the size of the team conducting them vary by facility.  For example, a single industrial security representative can perform a  review of a small facility with no classified information stored on site in  one day. By comparison, a large facility may require a lengthier review  that involves additional DSS officials, such as information system security  professionals who review a facility’s information systems if they are  needed to store or process classified information. Moreover,  counterintelligence officials may also participate and provide threat  information about the facility. Security reviews are generally led by staff  located in DSS’s 26 field offices across the country. A contractor’s facility  clearance may be subject to invalidation or revocation if DSS identifies  certain vulnerabilities, among other things. See figure 2 for more  information about DSS’s process for monitoring contractor facilities in the  program.

In addition to administering the facility clearance process and conducting  security reviews at cleared facilities, DSS also collects information from  cleared contractors about suspicious contacts, which may involve efforts  by an individual to obtain illegal or unauthorized access to classified  information, among other things. DSS aggregates this information to  identify counterintelligence trends among cleared contractors and refers  cases to the relevant agency for further investigation or action.

We last issued reports about the National Industrial Security Program in  2004 and 2005. In 2004, we made eight recommendations for DSS to  improve its processes for conducting security reviews, such as taking  steps to quickly notify government contracting activities when classified  information has been lost or compromised. The Department of Defense  agreed with our recommendations. In 2005, we made eight  recommendations about DSS’s oversight of contractors under foreign  influence. For example, we recommended that DSS collect and analyze  data about foreign business transactions in order to improve its oversight  of contractors under foreign influence. The Department of Defense  partially agreed with our recommendations and subsequently took action  to address them. As of April 2018, 13 of 16 of the recommendations have  been implemented. For more detail on our prior recommendations, please  see appendix II.

DSS Upgraded Capabilities for the National Industrial Security Program but Faces Challenges Monitoring Contractors Streamlined Clearance Processes

Since 2005, when we last reviewed how DSS administered the National  Industrial Security Program, it has streamlined its facility clearance  process in order to make it more efficient. DSS has also strengthened the  process to analyze contractors for foreign influence and the Department  of Defense issued a rule to clarify policies and procedures for mitigating  foreign influence concerns. Despite upgrading its capabilities, DSS  continues to face challenges in monitoring cleared contractors with  access to classified information.

In 2004 and 2005, we reported that DSS did not collect and analyze data  on contractors operating in the National Industrial Security Program. For  example, DSS was not able to analyze data to make informed resource  decisions or track key changes that affect contractors operating under  foreign influence. In our 2005 report, we recommended that DSS collect  and analyze data about foreign business transactions, among other  things. As a result, DSS streamlined its facility clearance process by  developing two electronic systems for tracking the facility clearance  requests and maintaining information on cleared facilities.  1.  The Electronic Facility Clearance System is a web-based system that  contractors or prospective contractors use to submit their required  information, such as key management personnel and other staff who  need to be cleared for access as well as business-related items like  articles of incorporation, bylaws, and other supporting documentation.  2.  The Industrial Security Facilities Database is another web-based  system that serves as a repository for information about cleared  facilities.

DSS field office and contractor officials we spoke with noted that the web- based systems help them do their job more efficiently. For example,  DSS’s industrial security representatives stated that these systems make  the facility clearance and monitoring process more efficient because it is  easier to track the status of documentation received. Industrial security  representatives also track conditions that may require changes to their  monitoring process through this database, such as a change in ownership  or key management personnel. Industrial security representatives noted  that being able to track this information electronically is helpful because  the facility clearance and monitoring processes involve numerous officials  within DSS, as well as other parties, such as the government contracting  activity and the contractor. For example, a government contracting activity  can use the database to check whether a facility has been cleared to  store classified information onsite before sending materials to them.

In 2017, DSS started the process of modernizing these systems by  developing two new systems. DSS officials stated that these two new  systems will provide additional automation that can be used in the facility  clearance and monitoring processes. The new systems are:

National Industrial Security Program Contracts Classification  System. This system collects detailed information about classified  contract(s) a facility will support during the initial clearance  process as well as throughout the duration of the facility’s  clearance, to include the facility’s assets (e.g. technology  produced or expertise provided), and enables the government  contracting activity to gain visibility into the subcontractors  performing work for each classified contract.

National Industrial Security System. This system will be the  official repository for data on cleared facilities. DSS officials noted  that the system will help identify foreign influence concerns, such  as changes in a contractor’s ownership, because they will be more  centrally tracked.

Further, in 2017, DSS also issued a manual to reflect an updated process  for assessing and authorizing cleared contractors’ information systems  that process classified information. DSS changed its process to align with  the intelligence community, the Department of Defense, and other federal  government agencies’ standards. DSS previously reviewed systems on  regular cycles and is shifting to reflect practices in the intelligence  community that are based on assessed threats and target the information  systems that pose the most significant risk of losing information. DSS  information security system professionals told us that this new  authorization process is helping them clarify and communicate the nature  of security risks to the contractor. The updated process is intended to  include the identification of cybersecurity concerns earlier than the prior approach and enables DSS’s information system security professionals to  adjust their monitoring to meet emerging cyber threats.

Centralized Support and Strengthened Its Process to Identify Foreign Influence

In response to recommendations we made in 2005, DSS has centralized  its support related to identifying and mitigating foreign influence and  strengthened its process, including issuing a rule to make the process of  mitigation of foreign influence clearer to contractors. Since our last review  of the program in 2005, DSS has centralized staff expertise in  headquarters to improve the identification and mitigation of foreign  influence concerns. Whereas DSS used to rely primarily on field staff to  negotiate and oversee individual facilities in their respective regions, it  now has staff in headquarters, including specialists in law and other  areas, who have an agency-wide view of threats and who understand the  portfolio of contractors that may be at risk of foreign influence. DSS  officials said that this is important because a contractor may have multiple  cleared facilities across several regions. They noted that an agency-wide  view helps DSS identify trends across facilities that may be tied to a  single contractor. The headquarters staff: negotiate and put in place mitigation agreements that require  contractors under foreign influence to acknowledge and mitigate  foreign influence risks, including the development of protective  measures to reduce the risk of foreign interests gaining access to  classified information;  identify foreign influence within cleared contractors and provide  written analysis to DSS field offices when foreign influence concerns  are identified, such as when a foreign contractor acquires a majority  or substantial minority position in a U.S. contractor with a cleared  facility; and provide subject matter expertise in the areas of business, acquisition,  intelligence, and international law to develop a comprehensive  understanding of companies, their industries and technologies, as well  as the regulatory environments in foreign countries.

DSS officials acknowledged that the establishment of a headquarters  division in 2008 focused on analyzing foreign influence and issuing  related publications was in response to recommendations we made in  2005. DSS’s field office industrial security representatives said that the  written products and specialized foreign influence analysis prepared and  disseminated by DSS headquarters has resulted in more timely  identification and mitigation of these issues. Examples include:

NISP in the News, an internal weekly publication that provides a  summary of business transactions that may result in the need for a  mitigation agreement to address foreign influence. Industrial security  representatives we spoke with said this publication helps them identify  and proactively address issues with their contractors. DSS officials  told us the publication is helpful because it can result in more timely  identification and initiate the process for negotiating a mitigation  agreement, particularly in cases where a foreign company acquires a  facility previously owned by a U.S. contractor. Copies of NISP in the  News that we reviewed also included information that may affect  contractors that are not under a mitigation agreement for foreign  influence, such as changes in key management personnel. We  previously reported that DSS had challenges identifying these  transactions or facility security officers would neglect to report them,  which led to delays in putting protective measures in place to prevent  unauthorized access to classified information.

Assessments of new contractors that have been sponsored for  clearances, which are used to identify and mitigate foreign influence.  DSS industrial security representatives stated that this analysis used  to be performed in the field but now they can use time previously  spent preparing analysis of foreign influence to work with contractors  to implement security measures. Further, the assessments help them  work more effectively with contractors because they draw upon  expertise across different disciplines. For example, 7 of the 13 facility  case files we reviewed contained a summary of analysis conducted by  specialists in DSS headquarters. The summaries also noted that the  specialists reviewed classified and unclassified information on the  contractor, including counterintelligence information and other U.S.  government information, as applicable.

In April 2014, the Department of Defense issued a rule about policies and  procedures for mitigating foreign ownership, control, or influence. This  rule was issued in order to ensure maximum uniformity and effectiveness  in the Department of Defense implementation of the National Industrial  Security Program. The rule detailed specific mitigation approaches for  addressing concerns about foreign ownership, control, or influence, which  we cover in detail in appendix I. The rule clarified the role of DSS, the  government contracting activity, and the contractor during the process  when DSS determines that the contractor needs to mitigate potential  foreign ownership, control, or influence. The rule also documented  policies and procedures regarding how decisions will be made on the  appropriate method to mitigate foreign ownership, control, or influence.  These include the timing of agency and contractor actions involved in  mitigation of foreign ownership, control, or influence and how to proceed  in cases where the contractor had not worked out a mitigation agreement  with DSS before changed conditions (e.g. indebtedness, ownership, or  foreign intelligence threat) occurred, among other things. The rule further  stated that DSS, in consultation with the government contracting activity,  has discretion to modify or reject the contractor’s outlined action plan to  mitigate foreign ownership, control, or influence.

Despite upgrading its capabilities, DSS officials indicated that they face  resource constraints, such as an inability to manage workloads and  complete training necessary to stay informed on current threats and  technologies. DSS’s current resource challenges include:

Managing staff workloads. DSS field officials acknowledged that  they have historically faced workload challenges. DSS officials said  that their limited staff carry heavy workloads and, according to DSS’s  most recent biennial report to Congress, were unable to conduct  security reviews at about 60 percent of cleared facilities in fiscal year  2016. In addition to their official security reviews, industrial security  representatives also conduct informal “advise and assist” efforts when  facility officials inquire about a range of security issues, from  preparing employees for overseas travel to providing training on  reporting suspicious contacts. In fiscal year 2016, industrial security  representatives conducted about 22,000 “advise and assist” efforts.  DSS officials attribute the heavy workload to the current staffing levels  of their field offices and frequent turnover among the industrial  security representatives.

DSS officials noted that both hiring and retention are difficult and that  these challenges are exacerbated by the fact that it is a relatively  small agency with field offices with limited staff. For example, an  average field office oversees about 470 facilities and has about 8  industrial security representatives on staff. As a result, if a person  leaves, it adds strain to the remaining staff. Most of the contractors’  facility security officers we spoke with noted that DSS field officials  have heavy workloads that could affect their ability to respond to  threats at cleared facilities. Further, DSS indicated that it has limited  resources to analyze, process, and distribute counterintelligence to  the cleared facilities. For example, DSS received more than 46,000  reports from cleared contractors about suspicious contacts in fiscal  year 2016, which was an almost 18 percent increase over the prior  year. In comparison, during the same time period, DSS’s  counterintelligence directorate, which analyzes suspicious contact  reports, grew by 7 percent. In addition, DSS’s ability to distribute  counterintelligence is limited by the geographic distribution of over  12,000 cleared facilities and each facility’s capability to receive or  store classified communication.

Developing foreign influence mitigation agreements. Multiple DSS  industrial security representatives and contractors’ facility security  officers stated that mitigation agreements to address the risk of  foreign influence, including supplemental plans, have become more  detailed and the process to develop and implement them has required  additional time and resources. For example, DSS may require a  contractor to develop an electronic communications plan, which must  include details about which networks will be protected from access by  a foreign parent contractor, including monitoring, maintaining, and  establishing separate email servers, as appropriate. DSS reported in  its 2015 biennial report to Congress that the average amount of time  to approve and implement a foreign influence mitigation plan was 93  days. The length of time to approve and implement a foreign  influence mitigation plan more than doubled to 204 days, according to  the 2017 biennial report. DSS officials stated that this increase is  due, in part, to increased complexity of the agreements and the  amount of coordination required between the government contracting  activity, DSS, and the contractor. A DSS official also noted that over  time, the agency has incorporated more information in its analysis and  sometimes needs more time to review all the information that may be  relevant.

Attending relevant trainings. DSS officials in three of four regions  noted that staffing challenges affect their ability to take training, even  though industrial security matters continue to become more  sophisticated. Information system security professionals said they  face challenges in learning technology that continues to evolve. For  example, they cited the multiple software products such as operating  systems and configurations of information networks that are used in a  facility’s daily operations. In addition, they need to understand other  technologies that can pose risks to industrial security, such as devices  that are capable of transmitting data, like cellular phones, and  therefore might need to be prohibited from areas where classified  information is discussed. As a result, the lack of expertise in multiple  technologies hampers their ability to identify vulnerabilities that might  leave a facility at risk for loss of classified information. We have  previously reported that training staff in new skills, such as  cybersecurity, remains an ongoing challenge for the federal  government. For example, in 2016, we found that chief information  officers throughout the government identified difficulties related to  recruiting, hiring, and retaining qualified personnel, as well as  ensuring they have the appropriate skills and expertise.

DSS Has Not Determined How It Will Collaborate with Stakeholders As It Pilots a New Approach

In 2017, DSS announced its plans to transition to a new approach to  monitoring cleared facilities in order to address emerging threats to  classified information. DSS faces challenges as it pilots its new  approach—DSS in Transition. DSS has taken steps to begin addressing  challenges, including scheduling training for its staff, but has not  documented how it will collaborate with its stakeholders or identified the  resources needed to monitor cleared facilities.

New Approach to Monitoring Cleared Facilities

In 2017, DSS announced that it would begin transitioning to an asset-and- threat-based monitoring approach. DSS has reported that the United  States is facing the most significant foreign intelligence threat it has ever  encountered and adversaries are attacking cleared facilities at  unprecedented rates. In fact, adversaries are varying their methods and  adjusting their priorities based on the targeted information they need. The  new approach is expected to involve DSS working collaboratively with  contractors and government contracting activities to design a customized  security plan for each facility based on threats specific to its assets rather  than using a standardized worksheet to perform security reviews. DSS  officials said that customized security plans will be developed based on  assets at the specific facilities. For example, a contractor providing  information technology services may need the latest software to thwart  cyberattacks while a contractor that engineers weapons systems may  need additional secure storage facilities and work areas to ensure an  adversary cannot physically extract classified information or technology.  As a result, according to agency officials, these customized security plans  represent a departure from a “one size fits all” or schedule-driven  approach to overseeing contractors’ protection of classified information.  According to DSS officials, this new approach, DSS in Transition will use  the Department of Defense’s list of critical technologies and programs,  along with counterintelligence, to prioritize facilities for security reviews  based on their assets and the severity of the threats to them. See table 1  for more information about the monitoring approaches.

After announcing DSS in Transition in 2017, DSS began taking steps to  develop its methodology for the new approach, including prioritization of  facilities and developing procedures for executing customized security  plans. In a January 2018 letter to industry, DSS stated that it plans to pilot  the new approach by working with one facility in each of its four regions to  develop a customized security plan and use the lessons learned to refine  the process. While it is piloting the approach at four facilities, DSS notified  contractors not participating in the pilot that DSS would partner with  selected facilities to identify and document their critical assets. Industry,  including contractors and prospective contractors that are interested in  U.S. government contract awards in the future, are awaiting more details  on how DSS plans to implement DSS in Transition, including who would  be responsible for the costs of additional security requirements, according  to a March 2018 statement from the industry spokesperson of the  National Industrial Security Program Policy Advisory Committee.

Collaboration Needed with Stakeholders As It Pilots the New Approach

Although DSS began piloting DSS in Transition in January 2018, it has  not determined how it will collaborate with government contracting  activities, the intelligence community, other federal agencies, and  contractors. In particular, DSS has not identified its stakeholders’ roles  and responsibilities in terms of who needs to communicate and  coordinate with whom and when, which is necessary to successfully  implement the new approach. For example, DSS needs to establish  agreed-upon criteria for what information a government contracting  activity would need to provide to DSS in order to develop a customized  security plan for a facility. GAO’s Federal Internal Control Standards  establish the need to coordinate with stakeholders and clearly define  roles and responsibilities, among other things. In addition, our leading  practices for interagency collaboration state that successful collaborative  working relationships require organizations to agree on roles and  responsibilities and identify the resources necessary to accomplish  objectives. For example, GAO found it is unclear how DSS will  determine what resources it needs as it has not identified the necessary  roles and responsibilities. DSS has taken steps to begin addressing these  challenges by establishing an office dedicated to documenting processes  and procedures for how DSS in Transition will be implemented, providing  a concept of operations, and scheduling training for its staff. However, to  monitor cleared facilities, DSS needs information from the various  National Industrial Security Program stakeholders, including:

Government contracting activity. DSS officials stated that, under  the new approach to monitoring cleared facilities, they will need to  better communicate and coordinate with the government contracting  activity. For example, in some circumstances, DSS officials will have  to collaborate with government contracting activities to determine  when a security plan is no longer sufficient as threats and mitigation  methods evolve. DSS officials stated that communication and  coordination with government contracting activities has been a  challenge because industrial security is often considered an added  duty on top of their contract management responsibilities. Further,  DSS officials indicated that staff turnover at government contracting  activities and the lack of clear roles and responsibilities have led to  delays in resolving a facility’s vulnerabilities. According to DSS  officials, it is difficult to determine whether they have the correct point  of contact at the government contracting activity to discuss  vulnerabilities at a facility, which, if left unaddressed, can leave  classified information at risk for loss. There are no formal agreements  about how a case should be elevated and resolved if DSS identifies  vulnerabilities and is unable to elicit a response from the government  contracting activity about further action, according to DSS officials. In  addition, DSS officials stated that they will need to work with the  government contracting activity to assess the risk of security  vulnerabilities that involve subcontractors working on contracts  containing classified information. In the past, a government  contracting activity might not know the identities of subcontractors if  they were sponsored by a cleared contractor. Given the adversaries’  ability to vary its methods to target information it needs, the  government needs to know who—regardless of subcontracting tier—is  accessing classified information.

Government intelligence community. We found DSS has not  established how it will collaborate with the intelligence community,  including formalizing roles and responsibilities for its new approach. A  DSS counterintelligence official told us that DSS currently relies on a  combination of its own counterintelligence staff and informal  coordination with other agencies, such as the Federal Bureau of  Investigation. Another DSS official stated that they have worked with  the Federal Bureau of Investigation to deliver counterintelligence  when a facility does not have the capacity to receive classified  information electronically. According to DSS field officials, the current  process is handled on a case-by-case basis, depending on the  availability of resources. Although DSS’s Counterintelligence  Directorate recently became part of the intelligence community and  will potentially have greater access to counterintelligence data, it will  need to determine how to regularly communicate with the intelligence  community to fully understand their products and share current threats  and vulnerabilities with certain contractors under DSS in Transition.

Other government agencies. DSS relies on collaborating with other  cognizant security agencies to develop a complete picture of the  threats to contractors. In addition to the Department of Defense, there  are four other federal agencies that have authority to inspect and  monitor facilities to ensure the protection of classified information.  DSS may only conduct security reviews for facilities performing  contracts awarded by these agencies if the Department of Defense is  the cognizant security agency for that facility. Contracts where  another agency is the cognizant security agency may involve  information coveted by adversaries, but DSS industrial security  representatives have acknowledged that they may not know why the  information is coveted or that it exists. Given the new approach to  develop a complete picture of threats to a facility, DSS will need  additional information from other cognizant security agencies that it  may not have sought in the past. As a result, DSS needs to establish  how best to collaborate with other agencies, such as identifying  appropriate points of contacts and specific time frames to conduct  outreach, to effectively implement DSS’s new approach to monitor  contractors.

Cleared contractors. DSS officials said that DSS in Transition will  require contractors to identify assets in a greater level of detail than  what was previously expected of them. In order to develop a security  plan unique to the facility, the contractor’s facility security officers will  need to understand these assets and why adversaries would want to  target them in order to develop and implement specific security  measures. Since DSS officials cannot be onsite every day, they have  to rely on the contractor’s facility security officer or other key  management personnel at cleared facilities to identify and report  potential problems. However, DSS officials noted that convincing  facility staff to spend more time on security-related matters may be  difficult at facilities where one employee may serve as the contractor’s  facility security officer in addition to having other responsibilities. In  addition, DSS officials stated that contractors’ security costs are  typically not profit-generators and realize that DSS in Transition may  require the contractor to expend more time, money, and energy to  address vulnerabilities or enact policies to safeguard against  adversaries.

DSS recognizes the need to keep industry informed and its  implementation plans for DSS in Transition need to address what  level of communication and coordination is required. For example,  DSS currently uses a rating system to indicate how well a contractor  is meeting the requirements of the operating manual as a metric for  how it is protecting classified information. As DSS moves toward  developing customized security plans that are unique to each facility’s  threats and assets, it needs to formalize new approaches to  communicate with contractors how well they are protecting classified  information.

In addition to piloting DSS in Transition, DSS is reassuming responsibility  for conducting background and security investigations for the Department  of Defense, which could potentially magnify its workload challenges.  DSS previously held these responsibilities but they were transitioned to  the Office of Personnel Management in 2005. The National Defense  Authorization Act of Fiscal Year 2018 required DSS to reassume this  background and security investigations mission by implementing a  phased transition by October 1, 2020. This phased transition will overlap  with DSS’s piloting of DSS in Transition and may create disruptions as an  agency of over 700 employees assumes responsibility for a background  and security investigations mission that currently has more than 7,000  employees and contractors. In January 2018, we added personnel  security clearances to our high-risk list, a list of federal areas in need of  either broad-based transformation or specific reforms to prevent waste,  fraud, and abuse. This issue is on the list because we identified: (1) a  significant backlog of background investigations; (2) a lack of long-term  goals for increasing federal and contractor-provided investigator capacity  to address the backlog; and (3) delays in the timely processing of security  clearances among other factors. DSS officials have identified potential  benefits and challenges with reassuming the background investigations  mission, and, in August 2017, the Department of Defense submitted a  plan for a 3-year phased transition to assume the background and  security investigations mission. In March 2018, we reported that this  transition could potentially affect the timely processing of personnel  security clearances, the backlog, and other reform initiatives but the effect  is unknown at this time.

Given the changing nature of threats to classified information, DSS needs  to ensure that classified information is protected from unauthorized  access. While DSS has upgraded its capabilities for identifying foreign  influence, DSS officials acknowledged that adversaries continue to  evolve, and classified information and technologies remain vulnerable to  exploitation. In response, in 2017, DSS launched a new approach (DSS  in Transition) to change how it oversees contractors with access to  classified information. As DSS pilots the new approach, it will need to  work with government contracting activities, the intelligence community,  other agencies, and cleared contractors to determine their roles and  responsibilities in protecting classified information at every facility in the  program. Without the necessary information—that is gained through  communicating and coordinating with stakeholders—to assess the threats  to the nation’s most critical technologies and programs, DSS will be  unable to provide appropriate oversight that addresses the most  significant threats to industrial security. Also, DSS has not identified the  resources necessary, including the number of personnel needed to  implement its new approach, which will add pressure to an agency  accepting a background and security investigations mission that has  significant backlog and timeliness challenges. Until DSS identifies roles  and responsibilities and determines how it will collaborate with  stakeholders for the pilot, it will be difficult to assess whether the new  approach is effective in protecting classified information.

We are making one recommendation to the Director of the Defense  Security Service:  Determine how it will collaborate with stakeholders as it pilots a new  approach to overseeing contractors with cleared facilities (DSS in  Transition), including identifying roles and responsibilities and the related  resources needed. (Recommendation 1)

We provided a draft of this report for review and comment to DSS.

DSS provided written comments, which are reproduced in appendix III. In  its comments, DSS concurred with the recommendation and summarized  actions it is taking to pilot its new approach (DSS in Transition). DSS also  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, Director of DSS, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IV.

Appendix I: Methods for Mitigating Foreign Influence

Since our July 2005 report, the Defense Security Service (DSS) has  taken additional steps to address oversight of contractors with foreign  influence. In April 2014, the Department of Defense issued a rule that  clarified policies for oversight of contractors under foreign ownership,  control, or influence. The rule detailed specific mitigation approaches for  addressing foreign ownership, control, or influence concerns. The rule  provided detail regarding the terms of each of these types of foreign  ownership, control, or influence mitigation agreements and the  circumstances under which each may be appropriate. The types of  mitigation specified in the rule are:

Board Resolution. The board resolution may be used when a foreign  entity does not own voting interests sufficient to elect a representative  to the company’s governing board.

Security Control Agreement. The security control agreement is a  tailored foreign ownership, control, or influence mitigation agreement,  often used when a foreign interest does not effectively own or control  a company or corporate family but the foreign interest is entitled to  representation on the company’s board.

Special Security Agreement. The special security agreement may be  used when a company is effectively owned or controlled by a foreign  interest. Access to certain proscribed classified information by a  company cleared under this agreement may require that the  government contracting activity complete a National Interest  Determination to determine that the release of proscribed information  to the company is consistent with the national security interests of the  United States.

Voting Trust Agreement and Proxy Agreement. These foreign  ownership, control, or influence mitigation agreements may be used  when a foreign interest effectively owns or controls a company or  corporate family. Under these agreements, the foreign owner  relinquishes most rights associated with ownership of the company to  cleared United States citizens approved by the U.S. government.

DSS has clarified the types of supplemental plans that companies must  submit to document specific steps that it will take to mitigate foreign  influence. Table 2 describes the types of plans and provides examples of  how they mitigate foreign influence.

Appendix II: Status of Prior GAO Recommendations Related to the National Industrial Security Program

In 2004 and 2005, GAO issued reports about the National Industrial  Security Program and made 16 recommendations. Prior to the start of  our review, the Department of Defense, through the Defense Security  Service (DSS), implemented two of the recommendations. Below is our  assessment of whether DSS addressed the remaining 14  recommendations that had been previously recorded as “closed – not  implemented”.

Table 3 provides a summary of those recommendations and the actions  that DSS has taken in response to the recommendations. A number of  the recommendations we made were aimed at clarifying policies related  to contractors under foreign influence that were part of the National  Industrial Security Program. The primary evidence to support our  conclusions is cited in the last column.

In GAO-04-332, we made eight recommendations that were recorded as  closed not implemented prior to the start of this review. Based on  information obtained during this review, seven of the recommendations  will be closed as implemented. The recommendation that remains closed  as not implemented was outside of the scope of the current review.

In GAO-05-681, we made eight recommendations and two of the  recommendations were closed as implemented prior to this review. Based  on information obtained during this review, four of the remaining six  recommendations will be closed as implemented. We were unable to  close two of the six recommendations as implemented based on the  information provided during this review.

Appendix III: Comments from the Department of Defense

Appendix IV: GAO Contact and Staff Acknowledgments

Marie A. Mak, (202) 512-4841 or makm@gao.gov.

In addition to the contact named above, Penny Berrier (Assistant  Director), Lorraine Ettaro, Gina Flacco, Stephanie Gustafson, John  Rastler, Sylvia Schatz, Roxanna Sun, Alyssa Weir, and Jocelyn Yin made  key contributions to this report.

DOD's Defense Security Service determines government contractors' eligibility to access classified information and monitors over 12,000 contractor facilities. It is facing new challenges as adversaries try to steal national security information and technology at unprecedented rates.

DSS is piloting a new approach that requires collaboration with stakeholders such as other federal agencies and contractors. However, we found that it has not established how it will do this.

We recommended that DSS work with stakeholders to determine roles and responsibilities as it pilots its new approach.