INDUSTRIAL SECURITY 101 FCL’S, PCL’S AND JOINT VENTURES

2019 NATIONAL HUBZONE CONFERENCE

CHANTILLY, VIRGINIA

SEPTEMBER 4, 2019

TABLE OF CONTENTS

• TERMINOLOGY

• CLEARANCES & ELIGIBILITIES

• CONTINUOUS EVALUATION

• FACILITY SECURITY OFFICER

• INSIDER THREAT PROGRAM SECURITY OFFICER

• JPAS, DISS, NISS & SCATTERED CASTLES

• JOINT VENTURES

SECURITY TERMINOLOGY • FCL – FACILITY CLEARANCE LEVEL

• PCL – PERSONNEL SECURITY LEVEL

• FSO – FACILITY SECURITY OFFICER

• ITPSO – INSIDER THREAT PROGRAM SECURITY OFFICER

• KMP – KEY MANAGEMENT PERSONNEL

• JPAS – JOINT PERSONNEL ADJUDICATION SYSTEM

• DISS – DEFENSE INFORMATION SYSTEM FOR SECURITY

• NISS – NATIONAL INDUSTRIAL SECURITY SYSTEM

• GCA – GOVERNMENT COGNIZANT AGENCY

• DCSA – DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (FORMERLY DSS)

CLEARANCES & ELIGIBILITIES

• CONFIDENTIAL – PERIODIC REINVESTIGATION EVERY 15 YEARS

• SECRET OR T3 – PERIODIC REINVESTIGATION EVERY 10 YEARS. (T3R)

• TOP SECRET OR T5 – PERIODIC REINVESTIGATION EVERY 6 YEARS (T5R)

POLYGRAPHS

• COUNTERINTELLIGENCE SCOPE (CI, CI POLY)

• FULL SCOPE / LIFESTYLE (FSP, FS, LS, LIFESTYLE POLY)

SCI ACCESSSensitive compartmented information (SCI) is a type of classified information controlled through formal systems established by the Director of National Intelligence. To access SCI, one must first have a favorable Tier 5 and be granted SCI eligibility.

CONTINUOUS EVALUATION

• CONTINUOUS EVALUATION (CE) "MEANS A VETTING PROCESS TO REVIEW THE BACKGROUND OF AN INDIVIDUAL WHO HAS BEEN DETERMINED TO BE ELIGIBLE FOR ACCESS TO CLASSIFIED INFORMATION OR TO HOLD A SENSITIVE POSITION AT ANY TIME DURING THE PERIOD OF ELIGIBILITY. CE LEVERAGES A SET OF AUTOMATED RECORD CHECKS AND BUSINESS RULES TO ASSIST IN THE ON-GOING ASSESSMENT OF AN INDIVIDUAL'S CONTINUED ELIGIBILITY.

• CONTINUOUS VETTING' MEANS REVIEWING THE BACKGROUND OF A COVERED INDIVIDUAL

AT ANY TIME TO DETERMINE WHETHER THAT INDIVIDUAL CONTINUES TO MEET APPLICABLE REQUIREMENTS."

FACILITY SECURITY OFFICER

• THE FACILITY SECURITY OFFICER HANDLES ALL THE SECURITY RELATED TASKS FOR A COMPANY INCLUDING ESTABLISHING THE FCL.

• IN MOST SMALL COMPANIES THE FSO CAN WEAR MULTIPLE HATS OR HAVE OTHER JOB

RESPONSIBILITIES.

• AN FSO CAN BE A FULL TIME OR A PART-TIME EMPLOYEE OF THE COMPANY.

• AN FSO DOES NOT HAVE TO BE PHYSICALLY LOCATED AT THE FACILITY ESPECIALLY IF IT IS

NON-POSSESSING FACILITY.

PART-TIME FSO

1099 CONSULTANT• CANNOT BE THE FSO IN TITLE,

• CANNOT BE KEY MANAGEMENT PERSONNEL (KMP)

• CANNOT BE AN ACCOUNT MANAGER IN JPAS

W-2• CAN BE THE FSO IN TITLE

• CAN BE KEY MANAGEMENT PERSONNEL (KMP)

• CAN BE AN ACCOUNT MANAGER IN JPAS

INSIDER THREAT PROGRAM SECURITY OFFICER

• EACH COMPANIES REQUIRED FOR HAVING AN ESTABLISHED INSIDER THREAT PROGRAM.

• THE ITPSO IS RESPONSIBLE FOR ADMINISTERING AND IMPLEMENTING THE INSIDER THREAT PROGRAM.

• THE INSIDER THREAT GROUP SHOULD MEET QUARTERLY AND SHOULD CONSIST OF THE ITPSO, HR, IT, FINANCES, SR. MANAGEMENT AND PROGRAM MANAGERS.

• THE ITPSO DOES NOT HAVE TO BE THE FSO, HOWEVER IN MOST CASES, THE FSO & ITPSO ARE THE SAME PERSON.

• INSIDER THREAT TRAINING IS REQUIRED ANNUALLY OF ALL EMPLOYEES BOTH CLEARED AND UNCLEARED AND ALSO SHOULD BE A PART OF THE EMPLOYEE ON-BOARDING PROCESS.

SECURITY DATABASES

• JPAS - JOINT PERSONNEL ADJUDICATION SYSTEM – THE CURRENT SYSTEM OF RECORD FOR ALL PERSONNEL SECURITY INFORMATION.

• DISS – DEFENSE INFORMATION SYSTEM FOR SECURITY – WILL BECOME THE SYSTEM OF RECORD REPLACING JPAS.

• NISS - NATIONAL INDUSTRIAL SECURITY SYSTEM – THIS SYSTEM HOUSES ALL OF THE FACILITY RELATED DOCUMENTS FOR A COMPANY AND ALL MOVES, ADDS AND CHANGES RELATED TO THE FCL ARE UPDATED HERE.

• NISS CAN ALSO BE USED TO VERIFY FCL INFORMATION FOR OTHER COMPANIES.

• SCATTERED CASTLES – THE EQUIVALENT OF JPAS FOR THE IC COMMUNITY.

JPAS & DISS

• JPAS IS CURRENTLY THE SYSTEM OF RECORD BUT IS GOING TO BE REPLACED WITH DISS.

• JPAS AND DISS IS ARE UP AND RUNNING CONCURRENTLY HOWEVER JPAS IS STILL THE

SYSTEM OF RECORD AND DISS IS PRIMARILY VIEW ONLY (MINOR FUNCTIONALITY).

• BY SOMETIME IN 2020, DISS WILL BE FULLY FUNCTIONAL AND JPAS WILL HAVE GONE AWAY.

• IF YOU OR YOUR FSO HAVE NOT BEEN GIVEN ACCESS TO DISS, MAKE SURE THAT HAPPENS AS

SOON AS POSSIBLE.

JPAS VS SCATTERED CASTLES• JPAS IS A DEPARTMENT OF DEFENSE ENTITY USED ONLY BY DOD AND THE MILITARY. IT HOUSES

INFORMATION FOR COLLATERAL ONLY CLEARANCES AND ELIGIBILITIES .

• INDUSTRY FSO’S CAN HAVE ACCESS TO JPAS TO ENTER INFORMATION, PROCESS

CLEARANCES AND UPDATES PII.

• SCATTERED CASTLES IS FOR THE INTELLIGENCE COMMUNITY (IC) AGENCIES FOR SCI AND SAP

PROGRAM.

• IT IS READ-ONLY TO INDUSTRY. ONLY GOVERNMENT SECURITY EMPLOYEES OF SAID AGENCIES

CAN ENTER INFORMATION INTO SCATTERED CASTLES.

• SCATTERED CASTLES CAN ONLY BE ACCESSED FROM A GOVERNMENT COMPUTER AND

INDUSTRY HAS TO BE GIVEN SPECIAL ACCESS TO THE DATABASE.

FACILITY CLEARANCE PROCESS FAQ

• WHAT IS A FACILITY? THE TERM FACILITY IS USED WITHIN THE NISP AS A COMMON DESIGNATION FOR AN OPERATING ENTITY CONSISTING OF A PLANT, LABORATORY, OFFICE, COLLEGE, UNIVERSITY, OR COMMERCIAL STRUCTURE WITH ASSOCIATED WAREHOUSE, STORAGE AREAS, UTILITIES AND COMPONENTS, WHICH ARE RELATED BY FUNCTION OR LOCATION.

• WHAT IS A FACILITY CLEARANCE? A FACILITY CLEARANCE (FCL) IS AN ADMINISTRATIVE DETERMINATION THAT, FROM A NATIONAL SECURITY STANDPOINT, A FACILITY IS ELIGIBLE FOR ACCESS TO CLASSIFIED INFORMATION AT THE SAME OR LOWER CLASSIFICATION CATEGORY AS THE CLEARANCE BEING GRANTED. THE FCL MAY BE GRANTED AT THE CONFIDENTIAL, SECRET, OR TOP SECRET LEVEL.

• CAN A FACILITY APPLY FOR ITS OWN FACILITY CLEARANCE? NO A PROCURING ACTIVITY OF THE GOVERNMENT, OR CLEARED CONTRACTOR IN THE CASE OF SUBCONTRACTING, MAY REQUEST THE CLEARANCE WHEN A DEFINITE, CLASSIFIED PROCUREMENT NEED HAS BEEN ESTABLISHED.

• WHAT DOES THE FACILITY CLEARANCE COST THE CONTRACTOR? THERE IS NO DIRECT CHARGE TO THE CONTRACTOR FOR PROCESSING A FACILITY CLEARANCE

• HOW LONG DOES THE FACILITY CLEARANCE REMAIN IN EFFECT? REMAIN IN EFFECT AS LONG AS THERE IS A NEED FOR THE CONTRACTOR TO HAVE ACCESS TO CLASSIFIED INFORMATION.

TYPES OF FCL’S

• POSSESSING FACILITY – THIS IS A COMPANY THAT IS AUTHORIZED THROUGH THE ISSUED DD-254 BY THE GOVERNMENT COGNIZANT AGENCY TO MAINTAIN AND POSSESS CLASSIFIED INFORMATION AT THEIR FACILITY.

• NON-POSSESSING FACILITY – NO AUTHORIZATION TO MAINTAIN OR POSSESS CLASSIFIED

MATERIAL.

THE 5 ELEMENTS OF THE FACILITY CLEARANCE PROCESS

• SPONSORSHIP: THE VERY FIRST STEP TO CLEARING A COMPANY IS FOR THEM TO BE SPONSORED FOR A FACILITY CLEARANCE BY EITHER A GOVERNMENT CONTRACTING ACTIVITY (GCA) OR ANOTHER CLEARED COMPANY.

• PREPARE ORGANIZATIONAL DOCUMENTATION/INFORMATION: OBTAIN AND HAVE AVAILABLE THE FOLLOWING DOCUMENTS/INFORMATION FOR YOUR FIRST VISIT FROM YOUR INDUSTRIAL SECURITY REPRESENTATIVE FROM DSS.

• ARTICLES OF INCORPORATION, STOCK RECORDS, MINUTES OF BOARD MEETINGS, AND CORPORATE BY-LAWS.

• FEDERAL TAX ID NUMBER.

• ANY 10K REPORTS FILED WITH THE SECURITIES EXCHANGE COMMISSION.

• KEY MANAGEMENT PERSONNEL LIST. THE SENIOR MANAGEMENT OFFICIAL, THE PROSPECTIVE FACILITY SECURITY OFFICER (FSO), ALL EXECUTIVE COMMITTEE MEMBERS, AND ALL BOARD MEMBERS INCLUDING THE CHAIRMAN SHOULD BE LISTED. NISPOM PARAGRAPH 2-104 PROVIDES SOME GUIDANCE, AND ADDITIONAL GUIDANCE WILL BE PROVIDED BY YOUR INDUSTRIAL SECURITY REPRESENTATIVE DURING THE FIRST VISIT.

• BRIEF SUMMARY OF YOUR COMPANY'S PRIMARY BUSINESS OR SERVICES PROVIDED.

• EMAIL, FAX, AND COMPLETE ADDRESS INFORMATION FOR THE LAST TEN YEARS — INCLUDE THE LAST FOUR NUMBER EXTENSION ON YOUR ZIP CODE.

• PROOF OF US CITIZENSHIP FOR PROSPECTIVE FACILITY SECURITY OFFICER (FSO) (SEE NISPOM PARA 2-207).

• DD FORM 441: THIS IS THE DEPARTMENT OF DEFENSE SECURITY AGREEMENT. IT IS AN AGREEMENT BETWEEN YOUR ORGANIZATION AND THE UNITED STATES GOVERNMENT THAT DETAILS THE SECURITY RESPONSIBILITIES OF BOTH THE CLEARED ORGANIZATION AND THE UNITED STATES GOVERNMENT.

• DF FORM 328: THE CERTIFICATE PERTAINING TO FOREIGN INTEREST IS USED TO REPORT YOUR ORGANIZATION'S FOREIGN INVOLVEMENT.

• PERSONNEL SECURITY CLEARANCE: IN ORDER FOR YOUR COMPANY TO BE CLEARED, SPECIFIED KEY MANAGEMENT PERSONNEL (KMP) MUST BE CLEARED. OTHER KMP MAY BE EXCLUDED, UNLESS THEY WILL REQUIRE ACCESS TO CLASSIFIED INFORMATION. YOUR DEFENSE SECURITY SERVICE INDUSTRIAL SECURITY REPRESENTATIVE WILL HELP YOU IDENTIFY THOSE THAT MUST BE CLEARED AND THOSE THAT MAY BE EXCLUDED.

JOINT VENTURE

A JOINT VENTURE (JV) IS A BUSINESS ARRANGEMENT IN WHICH TWO OR MORE PARTIES AGREE TO POOL THEIR RESOURCES FOR THE PURPOSE OF ACCOMPLISHING A SPECIFIC TASK. THIS TASK CAN BE A NEW PROJECT OR ANY OTHER BUSINESS ACTIVITY. IN A JOINT VENTURE (JV), EACH OF THE PARTICIPANTS IS RESPONSIBLE FOR PROFITS, LOSSES AND COSTS ASSOCIATED WITH IT. HOWEVER, THE VENTURE IS ITS OWN ENTITY, SEPARATE FROM THE PARTICIPANTS' OTHER BUSINESS INTERESTS.

TYPES OF JOINT VENTURES

A JOINT VENTURE CAN BE EITHER POPULATED OR UNPOPULATED.  

• POPULATED JOINT VENTURE ACTS LIKE AN ACTUAL OPERATING COMPANY: IT BRINGS EMPLOYEES ONTO

ITS PAYROLL, AND PERFORMS CONTRACT USING ITS OWN EMPLOYEES.  HAS CLEARED EMPLOYEES

INCLUDING THE KMP

• AN UNPOPULATED JOINT VENTURE, ON THE OTHER HAND, DOES NOT USE ITS OWN EMPLOYEES TO

PERFORM CONTRACTS.  NO CLEARED EMPLOYEES

• UNPOPULATED JOINT VENTURE SERVES AS A VEHICLE BY WHICH THE JOINT VENTURE’S MEMBERS CAN

COLLECTIVELY SERVE AS THE PRIME CONTRACTOR, WITH EACH JOINT VENTURE MEMBER PERFORMING

WORK WITH ITS OWN EMPLOYEES.

UNPOPULATED JOINT VENTURE

• THE ADMINISTRATIVE PERSONNEL EMPLOYED BY AN UNPOPULATED JOINT VENTURE CAN BE THE INDIVIDUALS UPON WHOM THE JOINT VENTURE’S FCL IS BASED. FOR INSTANCE, THE JOINT VENTURE COULD EMPLOY A SINGLE MANAGEMENT POSITION, THE FSO, AND THE JOINT VENTURE’S FCL WOULD BE CONTINGENT ON THE FSO’S PCL. ALTHOUGH THE NISPOM REQUIRES THE FSO TO BE AN EMPLOYEE OF THE CLEARED ENTITY, THERE IS NO REQUIREMENT FOR THE FSO TO BE A FULL-TIME EMPLOYEE, SO THE FSO COULD SPLIT HIS TIME AS THE FSO OF THE JOINT VENTURE AND AS THE FSO OF ONE OF THE VENTURERS. THE FSO COULD NOT PERFORM DIRECT LABOR ON THE JOINT VENTURE’S CONTRACTS, BUT COULD (AND SHOULD) BE PERFORMING ADMINISTRATIVE FUNCTIONS, LIKE SUPERVISING THE JOINT VENTURE’S COMPLIANCE WITH THE NISPOM AND MAINTAINING THE JOINT VENTURE’S RECORDS IN THE JOINT PERSONNEL ADJUDICATION SYSTEM. 

JOINT VENTURES IN REGARDS TO SECURITY

• THERE ARE NO ISSUES IF BOTH COMPANIES THAT ARE IN THE JV ARE BOTH HAVE AN FCL AND ARE

CLEARED AT THE SAME LEVEL.

• IF BOTH COMPANIES HAVE AN FCL THEN A NEW FCL WILL BE ISSUED BASED ON THE LEVEL OF THE

DD-254 .

• THE JV WOULD NEED TO HAVE AT LEAST ONE ADMINISTRATIVE EMPLOYEE WHO COULDN’T DO ANY

BILLABLE WORK BUT WOULD NEED TO BE THERE TO SUPPORT THE JV’S FACILITY CLEARANCE.

• IF ONE OF THE COMPANIES IN THE JV IS NOT CLEARED THE OTHER CLEARED COMPANY WITH THE FCL

HAS TO POTENTIALLY SPONSOR THE OTHER ONE WITH PERMISSION AND JUSTIFICATION FROM THE

GOVERNMENT CUSTOMER.

JOINT VENTURE – FCL REQUIREMENTS

• A JOINT VENTURE WITHOUT ANY PERSONNEL OF ITS OWN CANNOT OBTAIN A FACILITY CLEARANCE (“FCL”) BECAUSE AN FCL ALWAYS DEPENDS ON THE PERSONNEL SECURITY CLEARANCE (“PCL”) OF THE COMPANY’S KEY MANAGEMENT PERSONNEL, INCLUDING THE FACILITY SECURITY OFFICER (“FSO”). IN OTHER WORDS, THE ONLY WAY A CONTRACTOR RECEIVES AN FCL IS IF IT HAS CLEARED EMPLOYEES.

• BUSINESS LICENSE

• FICTITIOUS NAME CERTIFICATE

• JV AGREEMENT

• LEGAL ORGANIZATION CHART

• BOARD/COMPANY MEETING MEETINGS*

• RECENT CHANGES TO COMPANY STRUCTURE

• SMO

• FSO

• JV PARTNERS MUST BE EXCLUDED OR CLEARED IF THEIR DUTIES REQUIRE ACCESS TO CLASSIFIED INFORMATION

• OFFICIALS WORKING ON JV ARE CLEARED IF THEIR DUTIES REQUIRE ACCESS TO CLASSIFIED INFORMATION

THE HAZARDS OF BIDDING AS A JOINT VENTURE

• ARE TWO (OR THREE, OR FOUR) COMPANIES BETTER THAN ONE? NOT NECESSARILY. WHILE JOINT VENTURES BETWEEN MULTIPLE COMPANIES ARE BECOMING MORE POPULAR, PROVIDING PARTICIPANTS WITH THE OPPORTUNITY TO LEVERAGE EACH OTHERS CAPABILITIES AND CERTIFICATIONS, THERE ARE ALSO DIFFICULTIES ASSOCIATED WITH A JV STRUCTURE THAT CAN STOP A CONTRACT AWARD IN ITS TRACKS.

• PROTESTING CONTRACTOR: TORRES INTERNATIONAL, LLC (TI JV), ARLINGTON

• CONTRACTING AGENCY: STATE DEPARTMENT

• PROTEST ISSUE: WHETHER STATE WAS REASONABLE IN DETERMINING THAT TI JV DID NOT QUALIFY TO BID FOR TASK ORDERS UNDER ITS AWARDED INDEFINITE DELIVERY/INDEFINITE QUANTITY CONTRACT, BECAUSE IT FAILED TO OBTAIN A FACILITY SECURITY CLEARANCE FOR THE JV WITHIN THE TIME REQUIRED.

• GAO DECISION, MAY 31, 2011: DENIED.

• POST-MORTEM: IN THIS CASE, THE CONTRACT REQUIRED THAT THE JV RECEIVE A FACILITY CLEARANCE WITHIN 120 DAYS FOLLOWING AWARD OF THE ID/IQ CONTRACT OR IT WOULD NOT BE ALLOWED TO BID ON ANY TASK ORDERS. TORRES AES WAS THE MAJORITY OWNER OF THE JV AND DID HAVE A VALID FACILITY CLEARANCE, BUT THE TWO OTHER MEMBERS DID NOT — AND COULD NOT OBTAIN THEM BY THE DEADLINE.

• IN AN ATTEMPT TO MEET THE REQUIREMENTS, TORRES REMOVED THE OTHER MEMBERS OF THE JV SO THAT THE DEFENSE SECURITY SERVICE COULD THEN AWARD A FACILITY CLEARANCE TO THE THEN ONE-MEMBER JOINT VENTURE, BUT STATE REFUSED TO ACCEPT THAT — ARGUING THAT THE JV AS ORIGINALLY STRUCTURED DID NOT POSSESS THE REQUIRED FACILITY CLEARANCE.

• A JOINT VENTURE, WHICH IN THIS CASE WAS A SEPARATE LLC COMPOSED OF THREE MEMBERS, IS ITS OWN LEGAL ENTITY THAT’S ASSESSED COMPLETELY APART FROM ITS INDIVIDUAL MEMBERS. WHILE SOME AGENCIES WILL ALLOW A JOINT VENTURE TO RELY ON THE CLEARANCES, PAST PERFORMANCE, OR TECHNICAL EXPERTISE OF ITS MEMBERS, THEY DON’T ALWAYS – AS THIS CASE DEMONSTRATES. CONTRACTORS WHO RUSH INTO A JV WITHOUT THINKING THROUGH THE ISSUES AND REQUIREMENTS OR WITHOUT GETTING THE PROPER LEGAL ADVICE ABOUT THE STRUCTURE CAN RUN INTO SERIOUS PROBLEMS WHEN IT COMES TIME FOR AWARD AND PERFORMANCE OF A CONTRACT.

CONTACT INFORMATION

DAVID P. ESSEX

COLLOQUY SECURITY SOLUTIONS

FACILITY SECURITY OFFICER & INSIDER THREAT SECURITY SPECIALIST

(301) 980 – 6543

FSO1ESSEX@GMAIL.COM