- cypherpunks-legacy - lists.cpunks.org

Annual Self-Inspection Report
by None 06 Jul '18

06 Jul '18

(a) OUSD(I) Memorandum, Annual Senior Agency Official (SAO) Self-Inspection Program Report for Classified National Security Information, 2 October 2012 (b) Memorandum of Agreement between the Secretary of Defense and the Director of National Intelligence concerning the National Reconnaissance Office, 21 September 2010 (c) DoDI 5200.01, DoD Information Security Program and Protection of Sensitive Compartmented Information, 9 October 2008 The National Reconnaissance Office (NRO) is providing the attached Self-Inspection Report as requested in reference (a). In accordance with Director, National Reconnaissance Office authorities in reference (b) and (c) it should be noted that the NRO does not administer a standard DoD Information Security Program based on DoDM 5200.01-V1 thru V3 and, therefore, some of the items in the attached checklist are not applicable and have been noted as such. My point of contact for questions concerning this submission is (b)(3) 10 USG 44- . Jamieson Burnett irector, Office of Security and Counterintelligence Attachment: NRO Annual Self - Inspection Report for 2012 UNCLASSIFIED UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACMATWFUNCRONAL AREA Information Security Program Self-Inspection Checklist NO. STEM NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office 045 R DATE Security Manager 11 October 2012 EO 13526 CLASSIFIED NATIONAL SECURITY INFORMATION AND IMPLEMENTING DIRECTIVE REQUIREMENTS PART 1. DESCRIPTION OF SELF-INSPECTION PROGRAM: A description of the DoD Components self- inspection program should include activities assessed, program areas covered, and methodology utilized. The description must demonstrate how the self-inspection program provides the senior agency official with the information necessary to assess the effectiveness of the classified national security information program within the individual Component activities and the Component as a whole. It should include the following: 1. Responsibility for the program: (1) Whom does the senior agency official designate to assist in directing and administering the self-inspection program? Answer . The Director of Security and Counterintelligence (DOS&CI) is provided a Letter of Instruction by the Director, NRO which assigns his responsibilities. (2) How is the program structured to provide the senior agency official with the information necessary to assess the agency's classified national security information program? Answer: The DOS&CI advises the Senior Agency Official (SAO) when the DOS&CI believes events warrant advising the SAO. The NRO Integrated Security Assessment Program (ISAP) results are also reported to the SAO thru the annual Management Control Plan Statement of Assurance (MCPSOA). (b)(3) 10 USC 424 (3) Who conducts the self-inspections? Answer: NRO self-inspections are part of the NRO ISAP. Because contractors make upgAof the total NRO workforce and have the overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identifi , and address security vulnerabilities, provide datfornlysi,findings e tmcuriyseand.Th may lead to identification and definition of risk mitigation practices, and enable sharing of best security practices across government and industry. The primary purpose of the ISAP is to ensure the proper safeguarding of classified information through a single comprehensive review by various components of the Office of Security and Counterintelligence (OS&CI). ISAP integrates reviews utilizing program security, classification management, transportation and transmission of classified information, physical and technical accreditation, information systems security, personnel security, and Counterintelligence (CI) perspectives. The integrated assessment evaluates implementation of and ensures compliance with, established security policies, procedures, and plans at all NRO government and contractor location& Site personnel conduct/document security self-assessments per requirements stated in the NRO Security Manual (NSM). Security Officers will conduct self-assessments of their SCIFs at least annually. For the reporting period there were 343 site self-assessments. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required OS&CI stakeholders represent the major OS&CI divisions and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers, and Security Certification Officers. Stakeholders will develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board Sites are selected based on ring proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. An out-briefing is provided to site security site - and other site senior management identfying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actionsto be taken within 90 days of the date of UNCLASSIFIED 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLESUBJECT/ACTIVITY/FUNCT1 ONAL AREA Information Security Program Self-Inspection Checklist NO. I NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 16 formal team assessments were performed An additional 9 formal specific-issue reviews were conducted There were an additional 1,491 visits by OS&CI stakeholders to contractor SCIFs. (4) How is the senior agency official involved in the program? Answer: The DOS&CI keeps the SAO advised of trends and issues developed by the ISAP. The NRO ISAP results are also reported to the SAO thru the annual MCPSOA. 2. Approach: (1) What means and methods are employed in conducting self-inspections? Answer: For formal assessments, the Assessment Team evaluates implementation, and ensures compliance with, established NRO security policies, procedures, and plans. (2) Are different types of self-inspections conducted? If so, describe each of them. Answer: Formal assessments will vary based on the experience of the lead PSO and the stakeholders with the facility and items noted in the self-evaluation report as well as the areas of responsibility of the attending subject matter experts. However, the objective for all is to identify and address security vulnerabilities, provide data for analysis, and identift system security issues and trends. (3) Do the self-inspections evaluate adherence to the principles and requirements of E.O. 13526 and its implementing directive and the effectiveness of agency programs covering: â€¢ Original classification? Answer: Since Original Classification items only apply to 13 government employees who are Original Classification Authorities (OCA) at NRO Headquarters, a formal tasking is sent to Program Security Officers supporting the OCA to determine the date the OCA received their annual briefing and the number of original classification decisions they made during the reporting period. Experience has shown that not all of the OCAs make individual OCA decisions every year but most require their authority to sign classification guides for their area of responsibility. For the reporting period there, nine OCA decisions were made. â€¢ Derivative classification? Answer: Included. In NRO Implementing Instructions released on 31 May 2011, derivative classifiers were instructed to include in the classification block a personal identification number rather than their name to protect their identity and association with the NRO. This "Classification ID (CLID)" number exists in the NRO Access Database so the specific individual with that number can always be identyled Employees of other agencies, who already have an ID number assigned by their parent agency, will use that number instead Headquarters NRO derivative classifiers have their PSO available for questions regarding classification and marking and to review their derivatively classified documents for format and accuracy of classffication and marking. Available on the OS&CI website are the Order, Information Security Oversight Office (IS00) Implementing Directive and Marking booklet, videos and documents that explain the correct way to classify and mark documents, the Controlled Access Program Coordination Office (CAPCO) register and manual, over 120 Frequently Asked Questions with answers that are posted about portion marking a Security Policy hotline that will answer their questions in real-time, and numerous other experts who are available to answer their questions. Once the document is distributed, they face additional scrutiny from any security or classification management officer who reads it or from subject matter experts who point out classification and marking errors to security officers. The ISAP team visiting a site will review a sample of derivatively classified documents to point out errors in classification and marking, omissions of required information, and to make suggestions for improvement. â€¢ Declassification? Answer: The NRO has a formal declassification program which restricts to one office the authority to officially declassify NRO information and release it to the public, and which is not included in the self-inspection program. The results of this program are reported in the SF 311 report provided to USD(I) in October 2012. The NRO Declassification Guide (known as the Review and Redaction Guide) is updated and approved by the UNCLASSIFIED 2 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUEWECT/AC71VITY/FUNCT1ONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 1 1 October 2012 ITEM DNRO each year. It is currently undergoing review by the Interagency and is expected to be approved by the end of 2012. â€¢ Security Classification Appeals Panel Safeguarding? Answer: Included â€¢ Security violations? Answer: Included â€¢ Security education and training? Answer: Included â€¢ Management and oversight? Answer: Included (4) Do the self-inspections include a review of relevant security directives and instructions, as well as interviews with producers and users of classified information? Answer: All directives and instructions are issued by the DOS&Cl and are reviewed and updated annually. All directives and instructions are maintained on-line and are accessible to all government employees and contractors. (5) Do the self-inspections include reviews of representative samples of your Component's original and derivative classification actions? â€¢ Do these reviews encompass all Component activities that generate classified information? Answer: There are hundreds of individual activities that can generate classified information. While the annual self-assessment questionnaire covers 343 of these activities, the ISAP formal assessment inspects only a small percentage of these activities yearly. However, the Program Security Officers, Contractor Program Security Officers, and Classification Specialists review hundreds of classified documents yearly and provide direction to originators to correct those that are improperly marked. o How do you identify the activities to which this applies? Answer: Site personnel conduct/document security self-assessments per requirements stated in the NSM â€¢ Do the reviews include a sampling of various types of classified information in document and electronic formats? o How do you ensure that the materials reviewed provide a representative sample of the Component's classified information? Answer: Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. o How do you determine that the sample is proportionally sufficient to enable a credible assessment of your Component's classified product? Answer: We do not attempt to do this as it would increase costs to the NRO (as explained above). â€¢ Who conducts the review of the classified products? o Are they knowledgeable of the classification and marking requirements of E.O. 13526 and its implementing directive? Answer: Yes o Do they have access to pertinent security classification guides? Answer: Yes â€¢ Have appropriate personnel been designated to correct misclassification actions? If so, identify. Answer: All Program Security Officers and Classification Managemeni Specialists are authorized to correct misclassification, incorrect use of SCI channels, and incorrect dissemination restrictions. 3. Frequency: (1) How frequently are self-inspections conducted? Answer: Annually. (2) What factors were considered in establishing this time period? Answer: Time period is defined in the NSM. UNCLASSIFIED 3 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office CPR DATE Security Manager 11 October 2012 ITEM 4. Coverage: (1) How do you determine what program elements and Component activities are covered by your self-inspection program? Answer: Self-assessments are to be completed on each contractor SCIF. (2) What Component activities are assessed? Answer: All contractor activities are assessed. (3) How is the program structured to assess individual Component activities and the Component as a whole? Answer: Contractor locations far outnumber government locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractorfacilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. (4) If your Component has any special access programs (SAP), are self-inspections of the SAP programs conducted annually? Answer: Most SAPs are reviewed as part of the ISAP program. The ISAP formal assessment team has PSOs assigned that are briefed for most SAPs. In addition. the NRO conducts special annual reviews (in some cases. semi-annual) of the entire Sensitive Activities portfolio. o o Do the self-inspections confirm that the Component head or principal deputy has reviewed each special access program annually to determine if it continues to meet the requirements of E.O. 13526? Answer: The NRO's entire Sensitive Activities portfolio is reviewed and briefed annually to the DNI's Senior Review Group (SRG) who then reports to Congress. Do the self-inspections determine if officers and employees are aware of the prohibitions and sanctions for creating or continuing a special access program contrary to the requirements of E.O. 13526? Answer: Yes. In keeping with E.O. 13526, all Sensitive Activities' compartments that are established terminated, or transitioned (to another program or lower classification) require NRO Special Activities Management Board review and approval, followed by notification to the DNI's Senior Review Group/Controlled Access Program Oversight Committee. 5. Reporting: (1) What format for documenting self-inspections in your Component? Answer: Self assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an out-briefing is provided to site security staff and other site senior management identi&ing security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. (2) Who receives the reports? Answer: The OS&CI ISAP Manager. (3) Who compiles/analyzes the reports? Answer: The ISAP Manager and the responsible PSO analyze the report. (4) How are the findings analyzed to determine if there are problems of a systemic nature? Answer: The ISAP Manager provides to the sponsoring Government Program Security Officer (GPSO) for review and subsequent action. (5) How and when are the results of the self-inspections reported to the senior agency official? Answer: The DOS&CI determines when results warrant informing the SAO. (6) How is it determined if corrective actions are required? Answer: The GPSO and security stalceholder(s) review. UNCLASSIFIED 4 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECTIACTIVITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security ITEM DATE Manager 11 October 2012 I I (7) Who takes the corrective actions? Answer: The assessed site. (8) How are the findings from your Component's self-inspection program distilled for the annual report to the Director o f ISOO? Answer: The OS&CI Security Policy Staff (SPS) tasks the ISAP Manager to distill the findings and provide them to SPS for inclusion in the annual report. Self-Inspection Program Description here: Description include in italics under questions above. PART 2. ASSESSMENT & SUMMARY: ASSESSMENT The assessment is an evaluation of the state of each element of your componenVs classified national security information program based on an analysis of the findings of the selfinspection program. It should consider if the program element is being effectively implemented in accordance with the Order and Directive and DoD 5200.01-M. It should consider whether the findings indicate that the regulation or other policies or procedures may need to be updated, and it should take into account other program information such as the Standard Form 311, "Agency Security Classification Management Program Data." If a particular element does not apply to a component (e.g., original classification authority) the report should explain this. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations: Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory SUMMARY: The summary should report the findings from the self-inspection program within each of the program areas. This information should support the assessment. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory Assessment & Summary here: included in italics under headings above. UNCLASSIFIED 5 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACT1VITYIFU KnONAL AREA Information Security NO. Program Self-Inspection Checklist NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 201 2 ITEM PART 3. FOCUS QUESTIONS: FOCUS QUESTIONS: Answer the following focus questions. (1) Training for original classification authorities. (This applies only to Components with original classification authority). (1) Original classification authorities are required to receive training in proper classification and declassification each calendar year (5200.01-V?). What percentage of the original classification authorities at your Component has received this training? (2) Have any waivers to this requirement been granted? Answer: 100% of NRO OCAs have received training. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (2) Training for persons who apply derivative classification markings. (1) Persons who apply derivative classification markings are required to receive training in the proper application of the derivative classification principles of the E0 13526 prior to derivatively classifying information and at least once every two years thereafter. What percentage of the derivative classifiers at your Component has received this training? (2) Have waivers to this requirement been granted? Answer: Percentage unknown. The DSS and CAPCO Derivative Classifier training is available through the NRO computer network; however, NRO has not made this training mandatory because of the cost of two hours of direct labor charged by each contractor. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (3) Initial training. (1) All cleared agency personnel are required to receive initial training on basic security policies, principles, practices, and criminal, civil, and administrative penalties. What percentage of these personnel at your Component has received this training? Answer: 100% of new employees have received initial training. FOCUS QUESTIONS: Answer the following focus questions. (4) Refresher training. (1) Components are required to provide annual refresher training to all employees who create, process, or handle classified information. What percentage of these employees at your Component has received this training? Answer: 100% of employees have received refresher training. FOCUS QUESTIONS: Answer the following focus questions. (5) Identity of persons who apply derivative classification markings. (1) Derivative classifiers must be identified by name and position, or by personal identifier on each classified document. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: NRO personnel are directed to use a personal identifier. 100% of documents have met this requirement. The number of documents reviewed is unknown. FOCUS QUESTIONS: Answer the following focus questions. (6) List of multiple sources. (1) A list of sources must be included on or attached to each derivatively classified document that is classified based on more than one source document or classification guide. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: 100% of documents have met this requirement. The number of documents reviewed is unknown. UNCLASSIFIED 6 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST T1 TLEPAIBJECT/ACT1VITY1FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM FOCUS QUESTIONS: Answer the following focus questions. (7) Performance evaluations. (1) The performance contract or other rating system of original classification authorities, security managers, and other personnel whose duties significantly involve the creation or handling of classified information must include a critical element to be evaluated relating to designation and management of classified information. What percentage of such personnel at your Component has this element in their performance contracts? Answer: The NRO is comprised of government individuals from various agencies. Parent agencies set the rules for their performance contract or rating system. Based on the rules for each parent agency, approximately 40% have this element in their performance contract PART 4. DISCREPANCIES: Specific information with regard to the findings of the annual review of the Component's original and derivative classification actions to include the volume of classified materials reviewed and the number and type of discrepancies identified. 1. "Discrepancies" are instances when the classification and/or marking requirements of the Order, Directive and Agency regulation are not met. Among these are: (1) Overclassification: information does not meet the standards for classification. (2) Overgraded/Undergraded: Information classified at a higher/lower level than appropriate. (3) Declassification: Improper or incomplete declassification instructions or no declassification instructions. (4) Duration: A shorter duration of classification would be appropriate. (5) Unauthorized classifier: A classification action taken by someone not authorized to do so. (6) "Classified By" line: A document does not identify the OCA or derivative classifier by name and position or by personal identifier. (7) "Reason" line: An originally classified document does not cite a reason from section 1.4 of the Order. (8) "Derived From" line: A document fails to cite, or cites improperly, the classification source. The line should include type of document, date of document, subject, and office/agency of origin. (9) Multiple sources: A document cites "Multiple Sources" as the basis for classification, but list of these sources is not included on or attached to the document. (l0)Marking: A document lacks overall classification markings or has improper overall classification markings. (I 1 ) Portion Marking: The document lacks required portion markings. (12) Instructions from a classification guide are not properly applied. For additional information on marking, consult the l)oDM 5200.01-V2. List identified program deficiencies here. Also list actions taken or are planned to correct identified program deficiencies, marking discrepancies, or misclassification actions, and to deter their reoccurrence: Answer: Improper application of portion marking. Individuals will receive additional training and review of their documents by security officers. PART 5. BEST PRACTICES: List best practices that were identified during self inspections here: - Comprehensive security database developed which reflects final adjudication and investigation of security incidents - SCIF decertification process assembled consisting of: -- SCIF decertification checklist -- Sanitization steps for offices -- SCIF decertification roles and responsibilities - The self-assessments, methodology, and supporting application is a model for other industry sites - Comprehensive Open/Close procedures - Plexiglas inspection window and inspection ports for checking penetration of perimeter by HVAC, wiring, etc. - DoD SELF INSPECTION PROGRAM REQUIREMENTS: This portion of the checklist meets specific - requirements for a standard DoD Information Security Program based on the DoDM 5200.01-V1 thru V3. Please answer the following questions below. NO.PROGRAM MANAGEMENT (EO 13526 REQUIREMENTS) I YES I NO I N/A UNCLASSIFIED 7 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. IL National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager ITEM Has the head of each activity in the Component appointed a security manager to manage and implement the activity's information security program which implements the provisions of DoDM 5200.01-M? (DoDM 5200.01-M, Vol 1, End 2, para 8.b & 9.a) Does the Component Head develop and implement, through the security manager, security instructions necessary for program implementation? (DoDM 5200.01-M, Vol 1, Encl 2, para 9.d) Are sufficient resources and personnel committed to implement the classified national security information security program? (DOOM 5200.01-M, Vol 1, Encl 2, para 6.d) Are OCAs delegated classification authorities in writing? (DoDM 5200.01-M, Vol 1, Encl 4, para 5.c) Has the security manager attended the required training? Note: Training and education shall be provided before, concurrent with, or not later than six months following appointment. (DoDM 5200.01-M, Vol 3, End 5, paras 4.a and 10) Does the security manager conduct security inspections (self-inspections)? (DoDM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Is the Component Head informed of the results of such inspection? Does the security manager establish, implement and maintain an effective security education program as required by DoDM 5200.01-M, Volume 3, Enclosure 5, to include initial orientation and continuing/refresher training for assigned members? (DoDM 5200.01-M, Vol 1, End 2, para 7.g & 9.f; Vol 1, Encl 3, Para 6.c; and Vol 3, Encl 5, para 7 & 8) â€¢ Do security managers document all security-related training? (DoDM 5200.01-M, Vol 3, End 5, para 11) Are procedures established to prevent unauthorized access to classified information? (DOOM 5200.01-M, Vol 1, End 2, para 7.e) â€¢ Note: Examples include implementing visitor controls, restricting combinations to cleared members, establishing end-of-day security checks, etc) Are emergency plans developed for the protection, removal, or destruction of classified material in case of fire, natural disaster, civil disturbance, or terrorist activities to minimize the risk of compromise? (DOOM 5200.01-M, Vol 1, Encl 2, para 9.d) Are procedures established for ensuring that all persons handling classified material are properly cleared and have a need-to-know? (DOOM 5200.01-M, Vol 1, End 3, para 11.a) Does the security manager maintain a continuity handbook? DATE 11 October 2012 x x x x x x x x x x x x x x ORIGINAL CLASSIFICATION (EO 13526 REQUIREMENTS) 12. Are Original Classification Authorities (OCAs) trained on the process and requirements for original classification (DOOM 5200.01-M, Vol 1, Encl 4, para 6), to include? x Applicable standards and categories for classification? (D0DM 5200.01-m, x UNCLASSIFIED 8 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST ITTLE/SUBJECT/ACTIVITYTUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM 1, Encl 4, para 1) Levels of classification and damage criteria associated with each one? (DoDM 5200.01-M, Vol 1, Encl 4, para 3) â€¢ Avoidance of over - classification? (DoDM 5200.01-M, Vol 1, End 4, para 6.f) â€¢ Classification prohibitions and limitations? (DoDM 5200.01-M, Vol 1, Encl 4, para 2) â€¢ Required markings, including those for dissemination and handling? (DoDM 5200.01-M, Vol 1, Encl 4, para 6.h; Vol 2, Ends 3 & 4) â€¢ Determination of declassification instructions? (DoDM 5200.01-M, Vol 1, Encl 4, para 13.a) â€¢ Delegations of OCA responsibilities? (DoDM 5200.01-M, Vol 1, Encl 4, para 5 & 5.c) â€¢ Classification challenges? (DoDM 5200.01-M, Vol 1, Encl 4, para 22) 13. Have OCAs prepared, as appropriate, classification guides to facilitate the proper and uniform derivative classification of information? (DoDM 5200.01, Vol 1, Encl 4, para 6.h; Vo11, Encl 6, para 1) 14. Do the guides meet the requirements of section 2.2 of E.O. 13526 and section 2001.15 of title 32, Code of Federal Regulations (CFR)? Vol â€¢ X X X x x X x X DERIVATIVE CLASSIFICATION (EO 13526 REQUIREMENTS) 15. Are persons who apply derivative classification markings trained on the process and requirements for derivative classification (DoDM 5200.01-M, Vol 1, Encl 4, para 11 & 12), to include? â€¢ Identity of derivative classifier? (DoDM 5200.01-M, Vol 2, End 3, para 7 & 8.c. (1)(a)) â€¢ Use of source documents, including classification guides? (DoDM 5200.01M, Vol 2, Encl 3, para 8.c.(1)(b), 8.c.(2) & 8.c.(3)) â€¢ Declassification instructions? (DoDM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(d), 8.c.(4)-(9) & 9) â€¢ Proper application of markings? See Classification Markings/Document Review section below. (DoDM 5200.01-M, Vol 2, Encl 3 & 4) â€¢ Classification challenges (DoDM 5200.01-M, Vol 1, Encl 4, para 22) x x X X X CLASSIFICATION MARKINGS/DOCUMENT REVIEW (EO 13526 REQUIREMENTS) 16. Reviews of original and derivative classification actions shall be conducted in accordance with section 2001.60(c)(2) of title 32, CFR, and should evaluate the classification and marking of documents to include: (DOOM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Have the standards of classification been met? (DoDM 5200.01, Vol 1, Encl 4, para 1 & 2) â€¢ Could damage to the national security be reasonably expected in the event of unauthorized disclosure? (DoDM 5200.01, Vol 1, Encl 4, para 3) â€¢ Have the requirements for original classification of Part 1 of E.0.13526 or for derivative classification in Part 2 of E.O. 13526 been met? â€¢ Have the required markings been applied in accordance with E.O. 13526 and Subpart C of title 32, CFR? (DOOM 5200.01-M, Vol 2, para 3) UNCLASSIFIED 9 x X x x X 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTIVITY/FUNcnONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ Overall classification level (DoDM 5200.01-M, Vol 2, Encl 3, para 5) "Reason for Classification" line (originally classified documents only) (DoDM 5200.01-M, Vol 2, Encl 3, para 3.b.(1)(b) & 3.b.(4)) The Agency, Office or Origin, and Date (DoDM 5200.01-M, Vol 2, Encl 3, para 7) â€¢ â€¢ 17. 18. 19. 20. 21. 22. 23. 24. A "Derived From" line (DOOM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(b)) A "Classified By" line (DoDM 5200.01-M, Vol 2, Encl 3, para 8.b.(1)(a) & 8.c.(1)(a)) â€¢ identification of the sources of classification (DoDM 5200.01-M, Vol 2, End 3, para 8.c.(1)(b), 8.c(2), & 8.c.(3)) â€¢ "Declassify On" line (DoDM 5200.01-M,Vol 2, Encl 3, para 8.c.(d)) â€¢ Downgrading instructions, if required (DoDM 5200.01-M, Vol 2, Encl 3, para 8.a.(4)) â€¢ Page and Portion Markings (DoDM 5200.01-M, Vol 2, Encl 3, para 5 & 6) â€¢ Have any unauthorized or invalid markings been applied to documents? Are Agency personnel who conduct reviews of the agency's original and derivative classification actions trained on the classification and marking requirements of E.O. 13526, part 2001 of title 32, CFR, and DoDM 5200.01; and do they have access to pertinent security classification guides? Are "subjects" or "titles" of classified documents marked with the appropriate symbol (TS), (S), (C), or (U) following and to the left of the title or subject? (DoDM 5200.01-M, Vol 2, Encl 3. Para 6.e.(2) & 14) Is each section, part, paragraph, or similar portion of a classified document marked to show the highest level of classification of information it contains, or that it is unclassified? Portion of text shall be marked with the appropriate abbreviations (TS, S, C, or U). (DOOM 5200.01-M, Vol 2, Encl 3, para 6) Are portions within documents containing Restricted Data and Formerly Restricted Data marked with the abbreviation "RD" or "FRO" (e.g. S//RD or TS//FRD)? (DoDM 5200.01-M, Vol 2, Encl 4, para 8.a & 8.b) Are portions within documents containing foreign government or North Atlantic Treaty Organization (NATO) information marked with the foreign classification or NATO and the appropriate classification level (e.g. //GBR S or //NATO C)? (DoDM 5200.01-M, Vol 2, Encl 4, para 4) Is the abbreviation "FOUO" used to designate unclassified portions that contain information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA)? (DoDM 5200.01-M, Vol 2, Encl 4, para 10.b & Vol 4, End 3, para 2.c) Are charts, graphs, photographs, illustrations, figures, and similar items within classified documents marked to show their classification? (DoDM 5200.01-M, Vol 2, Encl 3, para 6.a & 18) Are the markings placed within the chart, graph, photograph, illustration, figure, etc. or next to the item? (DoDM 5200.01-M, Vol 2, End 3, para 6.e.(3) & 18) UNCLASSIFIED 10 .. x X X x x x x x x X x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE /SUBJECT/ACTIVITWFUNCTI ONAL AREA Information Security Program Self-Inspection Checklist NO. 25. 26. 27. 28. 29. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR Security Manager ITEM Is the highest classification level placed on the top and bottom of each page containing classified information or marked "unclassified"? (This is called the "banner line") â€¢ Do the markings stand out from the balance of the information on the page (must be readily visible)? (DoDM 5200.01-M, Vol 2, Encl 3, para 5) Are TRANSMITTAL documents properly marked to include either its highest classification or a notation "Unclassified when separated from classified enclosures"? (DoDM 5200.01-M, Vol 2, Encl 3, para 15) For ELECTRONIC documents: â€¢ Are e-mails, blog entries, bulletin board postings, and other electronic documents marked as finished documents, not working papers? (DoDM 5200.01-M, Vol 2, Enc 3, para 17.a.(2)) â€¢ Do e-mails include the appropriate banner line, portion markings, and classification authority block? Is the subject line portion mark the classification of the subject, not the overall classification of the e-mail? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.b) â€¢ Do classified URLs contain embedded portion marks? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.d) â€¢ Are briefing slides, including any speaker notes and hidden slides, marked as required for text documents? (DoD 5200.01-M, Vol 2,Encl 3, para 16) â€¢ Are maps, charts, blueprints, photographs, and other special types of materials marked in the same fashion as for documents, to the extent feasible? (DoD 5200.01, Vol 2, Encl 3, para 18) Are Files, Folders, and Groups of documents clearly marked on the outside of the file or folder (attaching a classified document cover sheet to the front of the folder or holder will satisfy this requirement)? (DoDM 5200.01-M, Vol 2, Encl 2, para 4.a) Are removable storage media (e.g. magnetic tape reels, disk packs, diskettes, CD-ROMS, removable hard disks, disk cartridges, tape cassettes, etc.) marked with the appropriate Standard Form label (SF 706/707/708/710)? (DoDM 5200.01-M,Vol 2, Encl 2, para 4.b) DATE 11 October 2012 x X x x x x x x x x DECLASSIFICATION (EO 13526 REQUIREMENTS) 30. 31. Is there a records management system to facilitate public release of declassified documents? Are procedures established for automatic, systematic, discretionary, and mandatory declassification review? x x SAFEGUARDING AND STORAGE (EO 13526 REQUIREMENTS) 32. 33. 34. 35. Is the program designed and maintained to optimize safeguarding of classified information? Are there control measures to prevent unauthorized access to classified information? Are personnel aware of procedures for identifying, reporting, and processing unauthorized disclosures of classified information? Are there procedures to ensure that appropriate management action is UNCLASSIFIED 11 x x x x 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM taken to correct identified problems? Are there methods for transmitting classified information, preparing it correctly for mailing, and for hand carrying or escorting classified material? 37. Is classified information removed from storage kept under constant surveillance of authorized persons? (DoDM 5200.01-M, Vol 3, Encl 2, para 8) 38. Are cover sheets placed on all documents removed from storage? (DoDM 5200.01-M, Vol 3, End 2, para 8) 39. Are end-of-day security checks established for areas that process or store classified information to ensure the area is secure at the close of each working day? (DOOM 5200.01-M, Vol 3, Encl 2, para 9) 40. Is the SF 701, Activity Security Checklist, used to record end-of-day checks? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 41. is the SF 702, Security Container Check Sheet, used to record the closing of each vault, secure room, or container used for storage of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 42. Is the SF 700, Security Container Information, properly completed and posted inside the LOCKING drawer of the security container, or inside the door of vault and similar facilities? (DoDM 5200.01-M, Vol 3, Encl 3, para 10) 43. Are storage containers (safes) that may have been used to store classified information inspected by properly cleared personnel before removal from protected areas or before unauthorized persons are allowed access to them? (DoDM 5200.01-M, Vol 3, Encl 3, para 13) 44â€¢ Are combinations to security containers changed at the required intervals? (DoDM 5200.01-M, Vol 3, Encl 3, para 11.b) 45. If written records of the combination are maintained, are they marked and protected at the highest classification of the material stored therein? (DOOM 5200.01-M, Vol 3, Encl 3, para 11.a) â€¢ Is the combination stored in a security container other than the one for which it is being used? 46. Are entrances to secure rooms or areas under visual control at all times during duty hours to prevent unauthorized access or equipped with electric, mechanical or electromechanical access control devices to limit access during duty hours? (DoDM 5200.01-M, Vol 3, Encl 3, para 12.a) 47. Does each vault or container bear an external marking for identification purpose? NOTE: The level of classification stored therein must NOT be marked on the outside of the container(s). (DoDM 5200.01-M, Vol 3, Encl 3, Para 9) 48. is Top Secret material stored only in a GSA approved security container (safe) having one of the following supplemental controls: (DOOM 5200.01-M, Vol 3, Encl 3, para 3.a) â€¢ Guard or duty personnel cleared to the Secret level inspect the security container once every two hours â€¢ An Intrusion Detection System (alarm system) meeting requirements of para 2 of the Appendix to Encl 3 of DoDM 5200.01-M, Vol 3. 36. UNCLASSIFIED 12 x x x x x x x x x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL ARE A Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ 49. so. 51. 52. 53. 3, 54. Combination lock meeting Federal Specification FF-L-2740 (X0-7) with security-in-depth Is Secret material stored in a GSA approved security container (safe) without supplemental controls or in the same manner as Top Secret? (NOTE: Approved containers will have a certification label on the container itself) (DOOM 5200.01-M, Vol 3, Encl 3, para 3.b) Is Confidential material stored in a GSA approved security container? (DoDM 5200.01-M,Vol 3, End 3, para 3.c) Are security container repairs (e.g. drilled because of a forgotten combination) done in accordance with FED-STD 809? (DoDM 5200.01-M, Vol 3, Encl 3, para 14) Is equipment (e.g. copiers, facsimile machines, AIS equipment and peripherals, electronic typewriters and word processing systems) used for processing classified information protected from unauthorized access? (DoDM 5200.01-M, Vol 3, Encl 2, para 14.a) Do appropriately cleared and technically knowledgeable personnel inspect the equipment and media used for processing classified information before the equipment is removed from the protected areas? (DoDM 5200.01-M, Vol Encl 2, para 14.d) Are GSA approved field safes and special purpose one and two drawer lightweight security containers securely fastened to the structure or under sufficient surveillance to prevent their theft? (DoDM 5200.01-M, Vol 3, End 3, para 6.a) x x x x X x x TELECOMMUNICATIONS, AUTOMATION INFORMATION SYSTEMS, AND NETWORK SECURITY MO 13526 REQUIREMENTS) 55. 56. Consistent with section 4.1(f) of E.O. 13526 and section 2001.50 of title 32, CFR, have uniform procedures been established to ensure that automated information systems that collect, create, communicate, compute, disseminate, process or store classified or controlled unclassified information are protected in accordance with applicable DoD policy issuances? Have procedures been established and implemented to: â€¢ Prevent access by unauthorized persons; â€¢ Ensure the integrity of the information; â€¢ TO the maximum extent practicable, use: 1) Common information technology standards, protocols, and interfaces that maximize the availability of, and access to, the information in a form and manner that facilitates its authorized use; and 2) Standardized electronic formats to maximize the accessibility of information to persons who meet the criteria set forth in section 4.1(a) of E.O. 13526. UNCLASSIFIED 13 x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TULE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. 57. 58. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM Have procedures been established to ensure that unclassified copiers connected to the Internet are not used for classified reproduction? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are modems, telecommunications capabilities and network connections disabled on copiers approved for classified reproductions? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are classified hard drives removed from classified reproduction equipment prior to maintenance? (DOOM 5200.01-M, Vol 3, End 7, para 10) Are cameras and microphones disabled on all hardware used for classified processing, in classified spaces, or connected to networks in classified spaces? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) x x x X REPRODUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) 59. Are procedures established to oversee and control the reproduction of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b ) 60. Are personnel, who reproduce classified, aware of the risks involved with the specific reproduction equipment and the appropriate countermeasures they are required to take? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(2)) 61. Are waste products generated during reproduction properly protected and disposed of? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(6)) 62. Is reproduction equipment specifically designated for the reproduction of classified material? (DoDM 5200.01-M, Vol 3, End 2, para 5.b.(7)) 63. [Optional] Are RULES POSTED on or near the designated equipment authorized for the reproduction of classified? (DoDM 5200.01-M, Vol 3, Encl 2, para 15) 64. [Optional) Are NOTICES prohibiting reproduction of classified POSTED on equipment used only for the reproduction of unclassified material? (DoDM 5200.01-M, vol 3, Encl 2, para 15) â– 65. 66. x x x X x x DISPOSITION AND DESTRUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) Has each activity with classified holdings set aside at least one "Clean-Out" day each year when specific attention and effort is focused on disposition of unneeded classified material? (DoDM 5200.01-M, VoI3, Encl 3, para 17.b) Is classified materials properly destroyed by approved methods? (DOOM 5200.01-M, Vol 3, Encl 3, para 17 &18) x x TRANSMISSION AND TRANSPORTATION OF CLASSIFIED INFORMATION (EO 13526 REQUIREMENTS) 67. Whenever classified information is transmitted outside of the activity is it enclosed in two opaque sealed envelopes or similar wrappings or containers durable enough to properly protect the material from accidental exposure and facilitate detection of tampering? (DOOM 5200.01-M, Vol 3, Encl 4, para 9) â€¢ NOTE: When classified material is hand-carried outside an activity, a locked briefcase may serve as the outer wrapper. UNCLASSIFIED 14 x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTNITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM 68. Is the outer wrapper addressed to an official government activity or to a DOD contractor with a facility clearance and appropriate storage capability with a complete return address of the sender? (DoDM 5200.01-M, Vol 3, Encl 4, para 9.a.(1)) 69. Is the inner wrapper or container marked with the following information: sender's and receiving activity's address and highest classification level of the contents (including where appropriate, any special markings)? (DoDM 5200.01-M, Vol 3, End 4, para 9.a.(2)) â€¢ NOTE: The inner envelope may have an "attention line" with a person's name. 70. Are procedures established to limit the hand carrying of classified information to only when other means of transmission or transportation cannot be used? (DoDM 5200.01-M, Vol 3, End 4, para 11.a) 71. Are hand-carrying officials briefed on and have they acknowledged their responsibilities for protecting classified information? (DoDM 5200.01-M, Vol 3, Encl 4, para 11.c) 72. Are courier officials provided a written statement authorizing such hand carrying transmission? (DOOM 5200.01-M, Vol 3, Encl 4, para 12) â€¢ [Optional] Does the activity list all classified carried or escorted by traveling personnel? (DoDM 5200.01-M, VoI3, Encl 4, para 11) â€¢ [Optional] Does the activity keep this list until all material reaches the recipient's activity? (DoDM 5200.01-M, Vol 3, End 4, para 11) 73. When "Confidential" classified information is sent U.S. Postal Service "First Class" mail between DOD Components within the United States, is the outer envelope or wrapper endorsed "POSTMASTER: RETURN SERVICE REQUESTED"? (DOOM 5200.01-M, Vol 3, Encl 4, para 5.d 1 74. Do recipients of First Class mail bearing the "Postmaster" notice protect it as Confidential material? x x x x x X x x x SECURITY EDUCATION (E0 13526 REQUIREMENTS) 75. 76. 77. 78. 79. 80. , Has the Component Senior Agency Official established a Security Education program? (DoDM 5200.01-M,Vol 1, Encl 2, para 7.g ) Has the activity security manager implemented the security education and training program within the activity? (DoDM 5200.01, Vol 1, Encl 2, para 9.f) Have all personnel been trained on policies for classification, safeguarding and declassification? Do all personnel who perform derivative classification receive training every 2 years? (DoDM 5200.01-M, Vol 3, Encl 5, para 7.c) All original classification authorities (OCA) must receive training in proper classification and declassification at least once a calendar year. (DoDM 5200.01-M Volt, Encl 4, para 5.d and Vol 3, Encl 5, para 5) Does this training program include an "Initial Orientation" for all assigned personnel who are cleared for access to classified information? (DoDM 5200.01-M, Vol 3, End 5, para 3) Does this orientation include the: (DOOM 5200.01-M, Vol 3, End 5, para 3) UNCLASSIFIED 15 x x x x x . UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITYIRJ NicnomAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OP R DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ â– x x x x â€¢ x x x x x x x x x x x SECURITY INCIDENTS AND VIOLATIONS TO INCLUDE COMPROMISES MO 13526 REQUIREMENTS) 88. Are assigned members trained on of their responsibilities to report security violations concerning classified information? (DOOM 5200.01-M, Vol 3, End 6, para 3.b) 89 Are there procedures to conduct an inquiry/investigation of a loss, possible compromise, or unauthorized disclosure of classified information? (DoDM 5200.01-M, Vol 3, Encl 6, para 6) - UNCLASSIFIED 16 x x 7 Roles and responsibilities of assigned members and key personnel? Elements of safeguarding classified information? Elements of classifying and declassifying information? 81 . Is additional training provided for members who: (DOOM 5200.01-M, Vol 3, End 5, para 4.b & c) â€¢ Are members of deployable organizations, to provide enhanced security training to meet the needs of the operational environment? â€¢ Will be traveling to foreign countries? â€¢ Will be escorting, hand carrying, or serving as a courier for classified material? â€¢ Will use automated information systems to store, process, or transmit classified? â€¢ Will have access to information requiring special control or safeguarding measures? â€¢ Will be using Foreign Government Information or work in coalition or bilateral environments? â€¢ Submit information to OCAs for original classification decisions? 82. Is Refresher training provided at least annually to assigned members? (DOOM 5200.01-M, Vol 3, Encl 5, para 7.a) 83. Is Refresher training tailored to the mission needs and address policies, principles and procedures covered in initial training? (DoDM 5200.01-M, Vol 3, End 5, para 7.a) 84. Does Refresher training address concerns identified during Component SelfInspections? (DOOM 5200.01-M, Vol 3, End 5, para 7.a) 85. Are procedures established to ensure cleared employees who leave the organization or whose clearance Is terminated receives a termination briefing? (DoDM 5200.01-M, Vol 3, End 5, para 9) 86. Are records maintained to show the names of members who participated in "Initial" and "Refresher" training? (DoDM 5200.01-M,Vol3, Encl 5, para 11 ) 87. Do training programs for "Uncleared" members include: (DoDM 5200.01-M, Vol 3, Encl 5, para 3) â€¢ The nature and importance of classified information? â€¢ Actions to take if they discover classified information unprotected? â€¢ The need to report suspected contact with a foreign intelligence collector? UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST IITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 90. 91. 92. National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM Are appropriate and prompt corrective actions taken when a violation or infraction occurs? (DoD 5200.01-M, Vol 3, Encl 6) Are inquiries and/or investigations promptly conducted to ascertain the facts surrounding reported incidents? (DoDM 5200.01-M, VoI3, Encl 6, para 6) Are individuals who commit violations or infractions subject to appropriate sanctions? (DOOM 5200.01-M, Vol1, Encl 3, para 17 and VoI3, Encl 6, para 8.b & 14) UNCLASSIFIED 17 x X x UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 NRO Explanation of N/A Responses on 2012 Information Security Program Self-inspection Checklist Item 1. Comment The DNRO appoints the DOS&CI as responsible for NRO security. The DOS&CI appoints a Government Program Security Officer (GPSO) as the head of each Directorate or Office activity who implements the provisions of the NRO Security Program. For each contractor, an NRO Contractor Program Security Officer (NCPSO) is nominated by the contractor and approved by the DOS&CI. The NCPSO is a senior Contractor PSO responsible and accountable for the security oversight of all NRO program activities at their company or corporation. 2. All security instructions are signed by the DOS&CI 5. Equivalent training is provided 6. Security evaluations and self-inspections are centrally managed under the DOS&CI. The DOS&CI is informed of the results of such inspections. 7. Security-related training will be documented in the Personnel Security File or in a listing of all personnel who completed the training 9. Yes, in areas where political instability, terrorism, host country attitude, or criminal activity suggests the possibility that a SCIF may be overrun by hostile forces. 11. If the security manager has a COOP mission, essential materials are in place at the alternate location. 12. The NRO cannot approve OCAs so we cannot delegate OCA responsibilities. 16. The NRO does not use Downgrading markings. 21. NRO personnel do not have the authority to create NATO information. 28. Most SCIFs are open storage and do not require the use of cover sheets. 38. Most SCIFs are open storage and do not require the use of cover sheets. 40. SF 701 may be used or locally designed forms may be used 41. SF 702 may be used or locally designed forms may be used 45. Yes, at the SCI level, except for SAR where the holder does not have access to the SAR compartment nor the physical area housing the container. UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Please note: The best way to view the report "Agency Annual Self-Inspection Program Data: FY 2013" (attached to this explanation) is in softcopy because several of the expandable fields have text that is hidden when viewed in hardcopy. The full text of entries that exceed the viewable space of expandable fields is included below for ease of reading, however, only the softcopy form will be submitted to OUSD(I). 3. Enter the name, title, address, phone, fax, and e-mail address of the Senior Agency Official (SAO) (as defined in E.O. 13526, section 5.4(d)) responsible for this report. Mr. Frank Calvelli Principal Deputy Director, NRO Room 14675 Lee Road, Chantilly, VA 20151 (b)(3) 10 USC 424 FAX (b)(3) 10 USC 424 (b)(3) 10 USC 424 13. What means and methods are employed in conducting self inspections? (For example: interviews, surveys, data calls, checklists, analysis, etc.) - NRO self-inspections are part of the NRO ISAP. Because of the total NRO workforce and have the contractors make up overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identify and address security vulnerabilities, provide data for analysis, and identify system security issues and trends. Site personnel conduct/document security self-assessments, per requirements stated in the NRO Security Manual (NSM) at least annually. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, 1 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. After the on-site assessment, an out-briefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of the report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 291 selfassessments were received and 10 formal team assessments were performed. No additional formal specific-issue reviews were conducted. There were an additional 742 visits by OS&CI stakeholders to contractor SCIFs. In addition, a data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 20. Describe below how the agency identifies activities and offices whose documents are to be included in the sample of classification actions. (Indicate if NA.) Based on the 291 site self-assessments submitted, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal 2 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. Additionally, several types of documents at NRO headquarters are reviewed annually by CMOs and PSOs for proper classification and marking. A data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 22. How do you ensure that the materials reviewed provide a representative sample of the agency's classified information? (Indicate if NA.) Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. The data call conducted with NRO Headquarters PSOs and CMOs for item 87 and 88 represents all documents they reviewed during FY 2013. 31. How is the self-inspection program structured to assess individual agency activities and the agency as a whole? Contractor SCIF locations far outnumber government SCIF locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractor facilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. 3 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 35. What is the format for documenting self-inspections in your agency? Self-assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an outbriefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. 47. Safeguarding: Regular conduct of exercises provides vital feedback to the physical security program. Exercises identify areas for corrective measures, enhancements, validate current tactics, techniques and procedures (TTP) and the adoption/employment of new TTP to meet a dynamic threat environment. Regular inspections/audits are essential to ensuring status and validity of issued IC badges and conformity to physical security requirements. Risk assessments/physical security assessments provide a helpful "outside" perspective to site security offices. NRO government and contractor personnel work in SCIFs equipped with secure telephones, FAX, and teleconferencing equipment, badges and badge readers, guard forces in several locations, document shredders and other features to ensure compromises of classified information do not occur. While the insider threat is always a possibility, we take every precaution to prevent security incidents from occurring. The NRO applies uniform procedures established by the Intelligence Community Directive (ICD)-503 family of policy and guidance for Information Technology Systems Security Risk Management and Assessment and Authorization (A&A) activities. 4 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 48. Security Violations: The ISAP program is the formal mechanism by which we corroborate self - inspections. Included in these formal reviews is an assessment of the respective security violation program and trends. In addition, each component Security team evaluates Security incidents and violations by tracking them according to general broad categories. During this past FY, the majority (63%) of incidents/violations were related to categories within personnel electronic devices in SCIFs. Other categories that have multiple occurrences indicating potential trends are data spills (9%) and inadvertent removal of classified information (12%). Personal cell phones and prohibited electronic devices are not allowed in SCIFs. While we have installed lockers outside SCIFs to secure cell phones, entry of prohibited electronic devices into SCIFs is still a problem. Visitor attendance to NRO conferences/facilities result in numerous cell phones being brought into the conference even by individuals with security duties who should know better. 49. Security Education and Training: 100% of personnel assigned to the NRO are required to complete an SCI indoctrination briefing to include signing a NonDisclosure Agreement. E.O. 13526 is called out specifically so that personnel fully understand their responsibilities and requirements to protect classified information. This message is repeated by the release of awareness videos and reminders throughout the year; to include presentations, written materials, and training. Specifically, OS&CI incorporates classification management questions within the Annual Security Refresher (ASR) web-based training (WBT). In 2014 ASR will include additional Derivative Classification questions. With as many contractors as the NRO employs, training can be a major expense. Every contractor and government employee with a secure computer account is required to take the Annual Security Refresher training otherwise they lose their computer connection. There are numerous additional courses and specialized security training available on-line even though sequestration has reduced training manpower overall to include elimination of the Information Management Branch which ran the OS&CI web site and security-specific applications. 5 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 50. Management and Oversight: Government oversight of NRO-sponsored SCIFs is achieved in a multi-faceted manner. Program Security Officers, Physical/Technical, and Computer Security Officers review selfassessment results and participate in on-site reviews. Some program findings for FY 13 were identified in the following areas: â€¢ Standard Operating Procedures (SOPs) require more detail and more frequent revision to stay up-to-date with security requirements. â€¢ Foreign travel and contact reporting were not always accomplished using the mandated NRO Counterintelligence Network (CINet). â€¢ There are undocumented information systems within facilities. â€¢ Not all employees with AIS privileged user type access have been identified and tracked. â€¢ Facility alarm test records are not always maintained for the required time period. â€¢ Red/Black cabling is not labeled for identification. 54. Safeguarding: Awareness and education programs are vital to ensuring the workforce maintains awareness of security policy and procedures. Regular and aperiodic exercises, inspections, and audits provide crucial inputs that are indispensable to ensuring that the physical security program is current and effective. Key challenges are maintaining adequate funding to replace aging, malfunctioning, and obsolete security equipment and training and education for new personnel. The NRO has an organization-level process for the Assessment and Authorization (A&A) of Information Systems and a Directive 51-1, "Information Technology, Information Assurance, and Information Management Architecture and Strategy for Certification and Accreditation" to ensure automated information systems that collect, create, communicate, compute, disseminate, process or store classified information are protected in accordance with applicable national policy issuances. 6 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 55. Security Violations: The NSM details the NRO process for reporting and investigating security incidents, infractions and violations. Appropriate and prompt corrective actions were taken to.mitigate the severity of the infraction/violation, and to sanction the offender via management, counterintelligence, and personnel security processes. Infractions and violations are centrally tracked in the Security Log (the NRO incident/violation database). This database is managed by the Program Security Officers in each directorate and office, and enables the PSO to automatically notify Counterintelligence Division and Personnel Security Division, via a system generated e-mail, of infractions/violations that require immediate CI and/or personnel security attention. The database also enables both OS&CI management as well as individual PSOs to track and analyze trends linked to the various categories of security infractions/violations. 56. Security Education and Training: OS&CI works closely with PSOs, Counterintelligence personnel, and the Integrated Self Assessment Program to determine any trends or specific areas that need an additional educational awareness campaign. Security communications are then targeted, utilizing large scale efforts, per a topic area and audience for best impact results. The NRO is adding additional classification management questions to the Annual Security Refresher to better satisfy the derivative classification training requirement. OCAs complete yearly training provided by NRO/OS&Cl/Policy Branch with direct knowledge of current CAPCO guidelines. 57. Management and Oversight: The NRO has a very mature Security management and oversight program. Over the past FY, much greater emphasis has been placed on ensuring all sites and facilities accomplished the self-assessments and submited the findings to the Government within the mandated time requirements. This improved management oversight has made an impact. Our self-inspection program coupled with security officer visits, and formal team 7 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessments provide managers a report card on the health of our security programs. When negative trends are identified, managers from across industry and the Government develop corrective action plans to reverse the trends and ensure security requirements are met. Impacts are being felt to overall security programs due to reductions in security resources. While security requirements are increasing, especially in the area of information systems management, resources are being reduced. Additionally, some sites assessed have made decisions not to fully comply with a security requirement because of resource constraints. 8 UNCLASSIFIED

1 0

Annual Self-Inspection Report
by None 06 Jul '18

06 Jul '18

(a) OUSD(I) Memorandum, Annual Senior Agency Official (SAO) Self-Inspection Program Report for Classified National Security Information, 2 October 2012 (b) Memorandum of Agreement between the Secretary of Defense and the Director of National Intelligence concerning the National Reconnaissance Office, 21 September 2010 (c) DoDI 5200.01, DoD Information Security Program and Protection of Sensitive Compartmented Information, 9 October 2008 The National Reconnaissance Office (NRO) is providing the attached Self-Inspection Report as requested in reference (a). In accordance with Director, National Reconnaissance Office authorities in reference (b) and (c) it should be noted that the NRO does not administer a standard DoD Information Security Program based on DoDM 5200.01-V1 thru V3 and, therefore, some of the items in the attached checklist are not applicable and have been noted as such. My point of contact for questions concerning this submission is (b)(3) 10 USG 44- . Jamieson Burnett irector, Office of Security and Counterintelligence Attachment: NRO Annual Self - Inspection Report for 2012 UNCLASSIFIED UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACMATWFUNCRONAL AREA Information Security Program Self-Inspection Checklist NO. STEM NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office 045 R DATE Security Manager 11 October 2012 EO 13526 CLASSIFIED NATIONAL SECURITY INFORMATION AND IMPLEMENTING DIRECTIVE REQUIREMENTS PART 1. DESCRIPTION OF SELF-INSPECTION PROGRAM: A description of the DoD Components self- inspection program should include activities assessed, program areas covered, and methodology utilized. The description must demonstrate how the self-inspection program provides the senior agency official with the information necessary to assess the effectiveness of the classified national security information program within the individual Component activities and the Component as a whole. It should include the following: 1. Responsibility for the program: (1) Whom does the senior agency official designate to assist in directing and administering the self-inspection program? Answer . The Director of Security and Counterintelligence (DOS&CI) is provided a Letter of Instruction by the Director, NRO which assigns his responsibilities. (2) How is the program structured to provide the senior agency official with the information necessary to assess the agency's classified national security information program? Answer: The DOS&CI advises the Senior Agency Official (SAO) when the DOS&CI believes events warrant advising the SAO. The NRO Integrated Security Assessment Program (ISAP) results are also reported to the SAO thru the annual Management Control Plan Statement of Assurance (MCPSOA). (b)(3) 10 USC 424 (3) Who conducts the self-inspections? Answer: NRO self-inspections are part of the NRO ISAP. Because contractors make upgAof the total NRO workforce and have the overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identifi , and address security vulnerabilities, provide datfornlysi,findings e tmcuriyseand.Th may lead to identification and definition of risk mitigation practices, and enable sharing of best security practices across government and industry. The primary purpose of the ISAP is to ensure the proper safeguarding of classified information through a single comprehensive review by various components of the Office of Security and Counterintelligence (OS&CI). ISAP integrates reviews utilizing program security, classification management, transportation and transmission of classified information, physical and technical accreditation, information systems security, personnel security, and Counterintelligence (CI) perspectives. The integrated assessment evaluates implementation of and ensures compliance with, established security policies, procedures, and plans at all NRO government and contractor location& Site personnel conduct/document security self-assessments per requirements stated in the NRO Security Manual (NSM). Security Officers will conduct self-assessments of their SCIFs at least annually. For the reporting period there were 343 site self-assessments. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required OS&CI stakeholders represent the major OS&CI divisions and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers, and Security Certification Officers. Stakeholders will develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board Sites are selected based on ring proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. An out-briefing is provided to site security site - and other site senior management identfying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actionsto be taken within 90 days of the date of UNCLASSIFIED 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLESUBJECT/ACTIVITY/FUNCT1 ONAL AREA Information Security Program Self-Inspection Checklist NO. I NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 16 formal team assessments were performed An additional 9 formal specific-issue reviews were conducted There were an additional 1,491 visits by OS&CI stakeholders to contractor SCIFs. (4) How is the senior agency official involved in the program? Answer: The DOS&CI keeps the SAO advised of trends and issues developed by the ISAP. The NRO ISAP results are also reported to the SAO thru the annual MCPSOA. 2. Approach: (1) What means and methods are employed in conducting self-inspections? Answer: For formal assessments, the Assessment Team evaluates implementation, and ensures compliance with, established NRO security policies, procedures, and plans. (2) Are different types of self-inspections conducted? If so, describe each of them. Answer: Formal assessments will vary based on the experience of the lead PSO and the stakeholders with the facility and items noted in the self-evaluation report as well as the areas of responsibility of the attending subject matter experts. However, the objective for all is to identify and address security vulnerabilities, provide data for analysis, and identift system security issues and trends. (3) Do the self-inspections evaluate adherence to the principles and requirements of E.O. 13526 and its implementing directive and the effectiveness of agency programs covering: â€¢ Original classification? Answer: Since Original Classification items only apply to 13 government employees who are Original Classification Authorities (OCA) at NRO Headquarters, a formal tasking is sent to Program Security Officers supporting the OCA to determine the date the OCA received their annual briefing and the number of original classification decisions they made during the reporting period. Experience has shown that not all of the OCAs make individual OCA decisions every year but most require their authority to sign classification guides for their area of responsibility. For the reporting period there, nine OCA decisions were made. â€¢ Derivative classification? Answer: Included. In NRO Implementing Instructions released on 31 May 2011, derivative classifiers were instructed to include in the classification block a personal identification number rather than their name to protect their identity and association with the NRO. This "Classification ID (CLID)" number exists in the NRO Access Database so the specific individual with that number can always be identyled Employees of other agencies, who already have an ID number assigned by their parent agency, will use that number instead Headquarters NRO derivative classifiers have their PSO available for questions regarding classification and marking and to review their derivatively classified documents for format and accuracy of classffication and marking. Available on the OS&CI website are the Order, Information Security Oversight Office (IS00) Implementing Directive and Marking booklet, videos and documents that explain the correct way to classify and mark documents, the Controlled Access Program Coordination Office (CAPCO) register and manual, over 120 Frequently Asked Questions with answers that are posted about portion marking a Security Policy hotline that will answer their questions in real-time, and numerous other experts who are available to answer their questions. Once the document is distributed, they face additional scrutiny from any security or classification management officer who reads it or from subject matter experts who point out classification and marking errors to security officers. The ISAP team visiting a site will review a sample of derivatively classified documents to point out errors in classification and marking, omissions of required information, and to make suggestions for improvement. â€¢ Declassification? Answer: The NRO has a formal declassification program which restricts to one office the authority to officially declassify NRO information and release it to the public, and which is not included in the self-inspection program. The results of this program are reported in the SF 311 report provided to USD(I) in October 2012. The NRO Declassification Guide (known as the Review and Redaction Guide) is updated and approved by the UNCLASSIFIED 2 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUEWECT/AC71VITY/FUNCT1ONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 1 1 October 2012 ITEM DNRO each year. It is currently undergoing review by the Interagency and is expected to be approved by the end of 2012. â€¢ Security Classification Appeals Panel Safeguarding? Answer: Included â€¢ Security violations? Answer: Included â€¢ Security education and training? Answer: Included â€¢ Management and oversight? Answer: Included (4) Do the self-inspections include a review of relevant security directives and instructions, as well as interviews with producers and users of classified information? Answer: All directives and instructions are issued by the DOS&Cl and are reviewed and updated annually. All directives and instructions are maintained on-line and are accessible to all government employees and contractors. (5) Do the self-inspections include reviews of representative samples of your Component's original and derivative classification actions? â€¢ Do these reviews encompass all Component activities that generate classified information? Answer: There are hundreds of individual activities that can generate classified information. While the annual self-assessment questionnaire covers 343 of these activities, the ISAP formal assessment inspects only a small percentage of these activities yearly. However, the Program Security Officers, Contractor Program Security Officers, and Classification Specialists review hundreds of classified documents yearly and provide direction to originators to correct those that are improperly marked. o How do you identify the activities to which this applies? Answer: Site personnel conduct/document security self-assessments per requirements stated in the NSM â€¢ Do the reviews include a sampling of various types of classified information in document and electronic formats? o How do you ensure that the materials reviewed provide a representative sample of the Component's classified information? Answer: Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. o How do you determine that the sample is proportionally sufficient to enable a credible assessment of your Component's classified product? Answer: We do not attempt to do this as it would increase costs to the NRO (as explained above). â€¢ Who conducts the review of the classified products? o Are they knowledgeable of the classification and marking requirements of E.O. 13526 and its implementing directive? Answer: Yes o Do they have access to pertinent security classification guides? Answer: Yes â€¢ Have appropriate personnel been designated to correct misclassification actions? If so, identify. Answer: All Program Security Officers and Classification Managemeni Specialists are authorized to correct misclassification, incorrect use of SCI channels, and incorrect dissemination restrictions. 3. Frequency: (1) How frequently are self-inspections conducted? Answer: Annually. (2) What factors were considered in establishing this time period? Answer: Time period is defined in the NSM. UNCLASSIFIED 3 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office CPR DATE Security Manager 11 October 2012 ITEM 4. Coverage: (1) How do you determine what program elements and Component activities are covered by your self-inspection program? Answer: Self-assessments are to be completed on each contractor SCIF. (2) What Component activities are assessed? Answer: All contractor activities are assessed. (3) How is the program structured to assess individual Component activities and the Component as a whole? Answer: Contractor locations far outnumber government locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractorfacilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. (4) If your Component has any special access programs (SAP), are self-inspections of the SAP programs conducted annually? Answer: Most SAPs are reviewed as part of the ISAP program. The ISAP formal assessment team has PSOs assigned that are briefed for most SAPs. In addition. the NRO conducts special annual reviews (in some cases. semi-annual) of the entire Sensitive Activities portfolio. o o Do the self-inspections confirm that the Component head or principal deputy has reviewed each special access program annually to determine if it continues to meet the requirements of E.O. 13526? Answer: The NRO's entire Sensitive Activities portfolio is reviewed and briefed annually to the DNI's Senior Review Group (SRG) who then reports to Congress. Do the self-inspections determine if officers and employees are aware of the prohibitions and sanctions for creating or continuing a special access program contrary to the requirements of E.O. 13526? Answer: Yes. In keeping with E.O. 13526, all Sensitive Activities' compartments that are established terminated, or transitioned (to another program or lower classification) require NRO Special Activities Management Board review and approval, followed by notification to the DNI's Senior Review Group/Controlled Access Program Oversight Committee. 5. Reporting: (1) What format for documenting self-inspections in your Component? Answer: Self assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an out-briefing is provided to site security staff and other site senior management identi&ing security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. (2) Who receives the reports? Answer: The OS&CI ISAP Manager. (3) Who compiles/analyzes the reports? Answer: The ISAP Manager and the responsible PSO analyze the report. (4) How are the findings analyzed to determine if there are problems of a systemic nature? Answer: The ISAP Manager provides to the sponsoring Government Program Security Officer (GPSO) for review and subsequent action. (5) How and when are the results of the self-inspections reported to the senior agency official? Answer: The DOS&CI determines when results warrant informing the SAO. (6) How is it determined if corrective actions are required? Answer: The GPSO and security stalceholder(s) review. UNCLASSIFIED 4 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECTIACTIVITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security ITEM DATE Manager 11 October 2012 I I (7) Who takes the corrective actions? Answer: The assessed site. (8) How are the findings from your Component's self-inspection program distilled for the annual report to the Director o f ISOO? Answer: The OS&CI Security Policy Staff (SPS) tasks the ISAP Manager to distill the findings and provide them to SPS for inclusion in the annual report. Self-Inspection Program Description here: Description include in italics under questions above. PART 2. ASSESSMENT & SUMMARY: ASSESSMENT The assessment is an evaluation of the state of each element of your componenVs classified national security information program based on an analysis of the findings of the selfinspection program. It should consider if the program element is being effectively implemented in accordance with the Order and Directive and DoD 5200.01-M. It should consider whether the findings indicate that the regulation or other policies or procedures may need to be updated, and it should take into account other program information such as the Standard Form 311, "Agency Security Classification Management Program Data." If a particular element does not apply to a component (e.g., original classification authority) the report should explain this. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations: Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory SUMMARY: The summary should report the findings from the self-inspection program within each of the program areas. This information should support the assessment. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory Assessment & Summary here: included in italics under headings above. UNCLASSIFIED 5 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACT1VITYIFU KnONAL AREA Information Security NO. Program Self-Inspection Checklist NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 201 2 ITEM PART 3. FOCUS QUESTIONS: FOCUS QUESTIONS: Answer the following focus questions. (1) Training for original classification authorities. (This applies only to Components with original classification authority). (1) Original classification authorities are required to receive training in proper classification and declassification each calendar year (5200.01-V?). What percentage of the original classification authorities at your Component has received this training? (2) Have any waivers to this requirement been granted? Answer: 100% of NRO OCAs have received training. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (2) Training for persons who apply derivative classification markings. (1) Persons who apply derivative classification markings are required to receive training in the proper application of the derivative classification principles of the E0 13526 prior to derivatively classifying information and at least once every two years thereafter. What percentage of the derivative classifiers at your Component has received this training? (2) Have waivers to this requirement been granted? Answer: Percentage unknown. The DSS and CAPCO Derivative Classifier training is available through the NRO computer network; however, NRO has not made this training mandatory because of the cost of two hours of direct labor charged by each contractor. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (3) Initial training. (1) All cleared agency personnel are required to receive initial training on basic security policies, principles, practices, and criminal, civil, and administrative penalties. What percentage of these personnel at your Component has received this training? Answer: 100% of new employees have received initial training. FOCUS QUESTIONS: Answer the following focus questions. (4) Refresher training. (1) Components are required to provide annual refresher training to all employees who create, process, or handle classified information. What percentage of these employees at your Component has received this training? Answer: 100% of employees have received refresher training. FOCUS QUESTIONS: Answer the following focus questions. (5) Identity of persons who apply derivative classification markings. (1) Derivative classifiers must be identified by name and position, or by personal identifier on each classified document. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: NRO personnel are directed to use a personal identifier. 100% of documents have met this requirement. The number of documents reviewed is unknown. FOCUS QUESTIONS: Answer the following focus questions. (6) List of multiple sources. (1) A list of sources must be included on or attached to each derivatively classified document that is classified based on more than one source document or classification guide. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: 100% of documents have met this requirement. The number of documents reviewed is unknown. UNCLASSIFIED 6 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST T1 TLEPAIBJECT/ACT1VITY1FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM FOCUS QUESTIONS: Answer the following focus questions. (7) Performance evaluations. (1) The performance contract or other rating system of original classification authorities, security managers, and other personnel whose duties significantly involve the creation or handling of classified information must include a critical element to be evaluated relating to designation and management of classified information. What percentage of such personnel at your Component has this element in their performance contracts? Answer: The NRO is comprised of government individuals from various agencies. Parent agencies set the rules for their performance contract or rating system. Based on the rules for each parent agency, approximately 40% have this element in their performance contract PART 4. DISCREPANCIES: Specific information with regard to the findings of the annual review of the Component's original and derivative classification actions to include the volume of classified materials reviewed and the number and type of discrepancies identified. 1. "Discrepancies" are instances when the classification and/or marking requirements of the Order, Directive and Agency regulation are not met. Among these are: (1) Overclassification: information does not meet the standards for classification. (2) Overgraded/Undergraded: Information classified at a higher/lower level than appropriate. (3) Declassification: Improper or incomplete declassification instructions or no declassification instructions. (4) Duration: A shorter duration of classification would be appropriate. (5) Unauthorized classifier: A classification action taken by someone not authorized to do so. (6) "Classified By" line: A document does not identify the OCA or derivative classifier by name and position or by personal identifier. (7) "Reason" line: An originally classified document does not cite a reason from section 1.4 of the Order. (8) "Derived From" line: A document fails to cite, or cites improperly, the classification source. The line should include type of document, date of document, subject, and office/agency of origin. (9) Multiple sources: A document cites "Multiple Sources" as the basis for classification, but list of these sources is not included on or attached to the document. (l0)Marking: A document lacks overall classification markings or has improper overall classification markings. (I 1 ) Portion Marking: The document lacks required portion markings. (12) Instructions from a classification guide are not properly applied. For additional information on marking, consult the l)oDM 5200.01-V2. List identified program deficiencies here. Also list actions taken or are planned to correct identified program deficiencies, marking discrepancies, or misclassification actions, and to deter their reoccurrence: Answer: Improper application of portion marking. Individuals will receive additional training and review of their documents by security officers. PART 5. BEST PRACTICES: List best practices that were identified during self inspections here: - Comprehensive security database developed which reflects final adjudication and investigation of security incidents - SCIF decertification process assembled consisting of: -- SCIF decertification checklist -- Sanitization steps for offices -- SCIF decertification roles and responsibilities - The self-assessments, methodology, and supporting application is a model for other industry sites - Comprehensive Open/Close procedures - Plexiglas inspection window and inspection ports for checking penetration of perimeter by HVAC, wiring, etc. - DoD SELF INSPECTION PROGRAM REQUIREMENTS: This portion of the checklist meets specific - requirements for a standard DoD Information Security Program based on the DoDM 5200.01-V1 thru V3. Please answer the following questions below. NO.PROGRAM MANAGEMENT (EO 13526 REQUIREMENTS) I YES I NO I N/A UNCLASSIFIED 7 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. IL National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager ITEM Has the head of each activity in the Component appointed a security manager to manage and implement the activity's information security program which implements the provisions of DoDM 5200.01-M? (DoDM 5200.01-M, Vol 1, End 2, para 8.b & 9.a) Does the Component Head develop and implement, through the security manager, security instructions necessary for program implementation? (DoDM 5200.01-M, Vol 1, Encl 2, para 9.d) Are sufficient resources and personnel committed to implement the classified national security information security program? (DOOM 5200.01-M, Vol 1, Encl 2, para 6.d) Are OCAs delegated classification authorities in writing? (DoDM 5200.01-M, Vol 1, Encl 4, para 5.c) Has the security manager attended the required training? Note: Training and education shall be provided before, concurrent with, or not later than six months following appointment. (DoDM 5200.01-M, Vol 3, End 5, paras 4.a and 10) Does the security manager conduct security inspections (self-inspections)? (DoDM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Is the Component Head informed of the results of such inspection? Does the security manager establish, implement and maintain an effective security education program as required by DoDM 5200.01-M, Volume 3, Enclosure 5, to include initial orientation and continuing/refresher training for assigned members? (DoDM 5200.01-M, Vol 1, End 2, para 7.g & 9.f; Vol 1, Encl 3, Para 6.c; and Vol 3, Encl 5, para 7 & 8) â€¢ Do security managers document all security-related training? (DoDM 5200.01-M, Vol 3, End 5, para 11) Are procedures established to prevent unauthorized access to classified information? (DOOM 5200.01-M, Vol 1, End 2, para 7.e) â€¢ Note: Examples include implementing visitor controls, restricting combinations to cleared members, establishing end-of-day security checks, etc) Are emergency plans developed for the protection, removal, or destruction of classified material in case of fire, natural disaster, civil disturbance, or terrorist activities to minimize the risk of compromise? (DOOM 5200.01-M, Vol 1, Encl 2, para 9.d) Are procedures established for ensuring that all persons handling classified material are properly cleared and have a need-to-know? (DOOM 5200.01-M, Vol 1, End 3, para 11.a) Does the security manager maintain a continuity handbook? DATE 11 October 2012 x x x x x x x x x x x x x x ORIGINAL CLASSIFICATION (EO 13526 REQUIREMENTS) 12. Are Original Classification Authorities (OCAs) trained on the process and requirements for original classification (DOOM 5200.01-M, Vol 1, Encl 4, para 6), to include? x Applicable standards and categories for classification? (D0DM 5200.01-m, x UNCLASSIFIED 8 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST ITTLE/SUBJECT/ACTIVITYTUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM 1, Encl 4, para 1) Levels of classification and damage criteria associated with each one? (DoDM 5200.01-M, Vol 1, Encl 4, para 3) â€¢ Avoidance of over - classification? (DoDM 5200.01-M, Vol 1, End 4, para 6.f) â€¢ Classification prohibitions and limitations? (DoDM 5200.01-M, Vol 1, Encl 4, para 2) â€¢ Required markings, including those for dissemination and handling? (DoDM 5200.01-M, Vol 1, Encl 4, para 6.h; Vol 2, Ends 3 & 4) â€¢ Determination of declassification instructions? (DoDM 5200.01-M, Vol 1, Encl 4, para 13.a) â€¢ Delegations of OCA responsibilities? (DoDM 5200.01-M, Vol 1, Encl 4, para 5 & 5.c) â€¢ Classification challenges? (DoDM 5200.01-M, Vol 1, Encl 4, para 22) 13. Have OCAs prepared, as appropriate, classification guides to facilitate the proper and uniform derivative classification of information? (DoDM 5200.01, Vol 1, Encl 4, para 6.h; Vo11, Encl 6, para 1) 14. Do the guides meet the requirements of section 2.2 of E.O. 13526 and section 2001.15 of title 32, Code of Federal Regulations (CFR)? Vol â€¢ X X X x x X x X DERIVATIVE CLASSIFICATION (EO 13526 REQUIREMENTS) 15. Are persons who apply derivative classification markings trained on the process and requirements for derivative classification (DoDM 5200.01-M, Vol 1, Encl 4, para 11 & 12), to include? â€¢ Identity of derivative classifier? (DoDM 5200.01-M, Vol 2, End 3, para 7 & 8.c. (1)(a)) â€¢ Use of source documents, including classification guides? (DoDM 5200.01M, Vol 2, Encl 3, para 8.c.(1)(b), 8.c.(2) & 8.c.(3)) â€¢ Declassification instructions? (DoDM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(d), 8.c.(4)-(9) & 9) â€¢ Proper application of markings? See Classification Markings/Document Review section below. (DoDM 5200.01-M, Vol 2, Encl 3 & 4) â€¢ Classification challenges (DoDM 5200.01-M, Vol 1, Encl 4, para 22) x x X X X CLASSIFICATION MARKINGS/DOCUMENT REVIEW (EO 13526 REQUIREMENTS) 16. Reviews of original and derivative classification actions shall be conducted in accordance with section 2001.60(c)(2) of title 32, CFR, and should evaluate the classification and marking of documents to include: (DOOM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Have the standards of classification been met? (DoDM 5200.01, Vol 1, Encl 4, para 1 & 2) â€¢ Could damage to the national security be reasonably expected in the event of unauthorized disclosure? (DoDM 5200.01, Vol 1, Encl 4, para 3) â€¢ Have the requirements for original classification of Part 1 of E.0.13526 or for derivative classification in Part 2 of E.O. 13526 been met? â€¢ Have the required markings been applied in accordance with E.O. 13526 and Subpart C of title 32, CFR? (DOOM 5200.01-M, Vol 2, para 3) UNCLASSIFIED 9 x X x x X 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTIVITY/FUNcnONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ Overall classification level (DoDM 5200.01-M, Vol 2, Encl 3, para 5) "Reason for Classification" line (originally classified documents only) (DoDM 5200.01-M, Vol 2, Encl 3, para 3.b.(1)(b) & 3.b.(4)) The Agency, Office or Origin, and Date (DoDM 5200.01-M, Vol 2, Encl 3, para 7) â€¢ â€¢ 17. 18. 19. 20. 21. 22. 23. 24. A "Derived From" line (DOOM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(b)) A "Classified By" line (DoDM 5200.01-M, Vol 2, Encl 3, para 8.b.(1)(a) & 8.c.(1)(a)) â€¢ identification of the sources of classification (DoDM 5200.01-M, Vol 2, End 3, para 8.c.(1)(b), 8.c(2), & 8.c.(3)) â€¢ "Declassify On" line (DoDM 5200.01-M,Vol 2, Encl 3, para 8.c.(d)) â€¢ Downgrading instructions, if required (DoDM 5200.01-M, Vol 2, Encl 3, para 8.a.(4)) â€¢ Page and Portion Markings (DoDM 5200.01-M, Vol 2, Encl 3, para 5 & 6) â€¢ Have any unauthorized or invalid markings been applied to documents? Are Agency personnel who conduct reviews of the agency's original and derivative classification actions trained on the classification and marking requirements of E.O. 13526, part 2001 of title 32, CFR, and DoDM 5200.01; and do they have access to pertinent security classification guides? Are "subjects" or "titles" of classified documents marked with the appropriate symbol (TS), (S), (C), or (U) following and to the left of the title or subject? (DoDM 5200.01-M, Vol 2, Encl 3. Para 6.e.(2) & 14) Is each section, part, paragraph, or similar portion of a classified document marked to show the highest level of classification of information it contains, or that it is unclassified? Portion of text shall be marked with the appropriate abbreviations (TS, S, C, or U). (DOOM 5200.01-M, Vol 2, Encl 3, para 6) Are portions within documents containing Restricted Data and Formerly Restricted Data marked with the abbreviation "RD" or "FRO" (e.g. S//RD or TS//FRD)? (DoDM 5200.01-M, Vol 2, Encl 4, para 8.a & 8.b) Are portions within documents containing foreign government or North Atlantic Treaty Organization (NATO) information marked with the foreign classification or NATO and the appropriate classification level (e.g. //GBR S or //NATO C)? (DoDM 5200.01-M, Vol 2, Encl 4, para 4) Is the abbreviation "FOUO" used to designate unclassified portions that contain information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA)? (DoDM 5200.01-M, Vol 2, Encl 4, para 10.b & Vol 4, End 3, para 2.c) Are charts, graphs, photographs, illustrations, figures, and similar items within classified documents marked to show their classification? (DoDM 5200.01-M, Vol 2, Encl 3, para 6.a & 18) Are the markings placed within the chart, graph, photograph, illustration, figure, etc. or next to the item? (DoDM 5200.01-M, Vol 2, End 3, para 6.e.(3) & 18) UNCLASSIFIED 10 .. x X X x x x x x x X x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE /SUBJECT/ACTIVITWFUNCTI ONAL AREA Information Security Program Self-Inspection Checklist NO. 25. 26. 27. 28. 29. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR Security Manager ITEM Is the highest classification level placed on the top and bottom of each page containing classified information or marked "unclassified"? (This is called the "banner line") â€¢ Do the markings stand out from the balance of the information on the page (must be readily visible)? (DoDM 5200.01-M, Vol 2, Encl 3, para 5) Are TRANSMITTAL documents properly marked to include either its highest classification or a notation "Unclassified when separated from classified enclosures"? (DoDM 5200.01-M, Vol 2, Encl 3, para 15) For ELECTRONIC documents: â€¢ Are e-mails, blog entries, bulletin board postings, and other electronic documents marked as finished documents, not working papers? (DoDM 5200.01-M, Vol 2, Enc 3, para 17.a.(2)) â€¢ Do e-mails include the appropriate banner line, portion markings, and classification authority block? Is the subject line portion mark the classification of the subject, not the overall classification of the e-mail? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.b) â€¢ Do classified URLs contain embedded portion marks? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.d) â€¢ Are briefing slides, including any speaker notes and hidden slides, marked as required for text documents? (DoD 5200.01-M, Vol 2,Encl 3, para 16) â€¢ Are maps, charts, blueprints, photographs, and other special types of materials marked in the same fashion as for documents, to the extent feasible? (DoD 5200.01, Vol 2, Encl 3, para 18) Are Files, Folders, and Groups of documents clearly marked on the outside of the file or folder (attaching a classified document cover sheet to the front of the folder or holder will satisfy this requirement)? (DoDM 5200.01-M, Vol 2, Encl 2, para 4.a) Are removable storage media (e.g. magnetic tape reels, disk packs, diskettes, CD-ROMS, removable hard disks, disk cartridges, tape cassettes, etc.) marked with the appropriate Standard Form label (SF 706/707/708/710)? (DoDM 5200.01-M,Vol 2, Encl 2, para 4.b) DATE 11 October 2012 x X x x x x x x x x DECLASSIFICATION (EO 13526 REQUIREMENTS) 30. 31. Is there a records management system to facilitate public release of declassified documents? Are procedures established for automatic, systematic, discretionary, and mandatory declassification review? x x SAFEGUARDING AND STORAGE (EO 13526 REQUIREMENTS) 32. 33. 34. 35. Is the program designed and maintained to optimize safeguarding of classified information? Are there control measures to prevent unauthorized access to classified information? Are personnel aware of procedures for identifying, reporting, and processing unauthorized disclosures of classified information? Are there procedures to ensure that appropriate management action is UNCLASSIFIED 11 x x x x 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM taken to correct identified problems? Are there methods for transmitting classified information, preparing it correctly for mailing, and for hand carrying or escorting classified material? 37. Is classified information removed from storage kept under constant surveillance of authorized persons? (DoDM 5200.01-M, Vol 3, Encl 2, para 8) 38. Are cover sheets placed on all documents removed from storage? (DoDM 5200.01-M, Vol 3, End 2, para 8) 39. Are end-of-day security checks established for areas that process or store classified information to ensure the area is secure at the close of each working day? (DOOM 5200.01-M, Vol 3, Encl 2, para 9) 40. Is the SF 701, Activity Security Checklist, used to record end-of-day checks? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 41. is the SF 702, Security Container Check Sheet, used to record the closing of each vault, secure room, or container used for storage of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 42. Is the SF 700, Security Container Information, properly completed and posted inside the LOCKING drawer of the security container, or inside the door of vault and similar facilities? (DoDM 5200.01-M, Vol 3, Encl 3, para 10) 43. Are storage containers (safes) that may have been used to store classified information inspected by properly cleared personnel before removal from protected areas or before unauthorized persons are allowed access to them? (DoDM 5200.01-M, Vol 3, Encl 3, para 13) 44â€¢ Are combinations to security containers changed at the required intervals? (DoDM 5200.01-M, Vol 3, Encl 3, para 11.b) 45. If written records of the combination are maintained, are they marked and protected at the highest classification of the material stored therein? (DOOM 5200.01-M, Vol 3, Encl 3, para 11.a) â€¢ Is the combination stored in a security container other than the one for which it is being used? 46. Are entrances to secure rooms or areas under visual control at all times during duty hours to prevent unauthorized access or equipped with electric, mechanical or electromechanical access control devices to limit access during duty hours? (DoDM 5200.01-M, Vol 3, Encl 3, para 12.a) 47. Does each vault or container bear an external marking for identification purpose? NOTE: The level of classification stored therein must NOT be marked on the outside of the container(s). (DoDM 5200.01-M, Vol 3, Encl 3, Para 9) 48. is Top Secret material stored only in a GSA approved security container (safe) having one of the following supplemental controls: (DOOM 5200.01-M, Vol 3, Encl 3, para 3.a) â€¢ Guard or duty personnel cleared to the Secret level inspect the security container once every two hours â€¢ An Intrusion Detection System (alarm system) meeting requirements of para 2 of the Appendix to Encl 3 of DoDM 5200.01-M, Vol 3. 36. UNCLASSIFIED 12 x x x x x x x x x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL ARE A Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ 49. so. 51. 52. 53. 3, 54. Combination lock meeting Federal Specification FF-L-2740 (X0-7) with security-in-depth Is Secret material stored in a GSA approved security container (safe) without supplemental controls or in the same manner as Top Secret? (NOTE: Approved containers will have a certification label on the container itself) (DOOM 5200.01-M, Vol 3, Encl 3, para 3.b) Is Confidential material stored in a GSA approved security container? (DoDM 5200.01-M,Vol 3, End 3, para 3.c) Are security container repairs (e.g. drilled because of a forgotten combination) done in accordance with FED-STD 809? (DoDM 5200.01-M, Vol 3, Encl 3, para 14) Is equipment (e.g. copiers, facsimile machines, AIS equipment and peripherals, electronic typewriters and word processing systems) used for processing classified information protected from unauthorized access? (DoDM 5200.01-M, Vol 3, Encl 2, para 14.a) Do appropriately cleared and technically knowledgeable personnel inspect the equipment and media used for processing classified information before the equipment is removed from the protected areas? (DoDM 5200.01-M, Vol Encl 2, para 14.d) Are GSA approved field safes and special purpose one and two drawer lightweight security containers securely fastened to the structure or under sufficient surveillance to prevent their theft? (DoDM 5200.01-M, Vol 3, End 3, para 6.a) x x x x X x x TELECOMMUNICATIONS, AUTOMATION INFORMATION SYSTEMS, AND NETWORK SECURITY MO 13526 REQUIREMENTS) 55. 56. Consistent with section 4.1(f) of E.O. 13526 and section 2001.50 of title 32, CFR, have uniform procedures been established to ensure that automated information systems that collect, create, communicate, compute, disseminate, process or store classified or controlled unclassified information are protected in accordance with applicable DoD policy issuances? Have procedures been established and implemented to: â€¢ Prevent access by unauthorized persons; â€¢ Ensure the integrity of the information; â€¢ TO the maximum extent practicable, use: 1) Common information technology standards, protocols, and interfaces that maximize the availability of, and access to, the information in a form and manner that facilitates its authorized use; and 2) Standardized electronic formats to maximize the accessibility of information to persons who meet the criteria set forth in section 4.1(a) of E.O. 13526. UNCLASSIFIED 13 x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TULE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. 57. 58. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM Have procedures been established to ensure that unclassified copiers connected to the Internet are not used for classified reproduction? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are modems, telecommunications capabilities and network connections disabled on copiers approved for classified reproductions? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are classified hard drives removed from classified reproduction equipment prior to maintenance? (DOOM 5200.01-M, Vol 3, End 7, para 10) Are cameras and microphones disabled on all hardware used for classified processing, in classified spaces, or connected to networks in classified spaces? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) x x x X REPRODUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) 59. Are procedures established to oversee and control the reproduction of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b ) 60. Are personnel, who reproduce classified, aware of the risks involved with the specific reproduction equipment and the appropriate countermeasures they are required to take? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(2)) 61. Are waste products generated during reproduction properly protected and disposed of? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(6)) 62. Is reproduction equipment specifically designated for the reproduction of classified material? (DoDM 5200.01-M, Vol 3, End 2, para 5.b.(7)) 63. [Optional] Are RULES POSTED on or near the designated equipment authorized for the reproduction of classified? (DoDM 5200.01-M, Vol 3, Encl 2, para 15) 64. [Optional) Are NOTICES prohibiting reproduction of classified POSTED on equipment used only for the reproduction of unclassified material? (DoDM 5200.01-M, vol 3, Encl 2, para 15) â– 65. 66. x x x X x x DISPOSITION AND DESTRUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) Has each activity with classified holdings set aside at least one "Clean-Out" day each year when specific attention and effort is focused on disposition of unneeded classified material? (DoDM 5200.01-M, VoI3, Encl 3, para 17.b) Is classified materials properly destroyed by approved methods? (DOOM 5200.01-M, Vol 3, Encl 3, para 17 &18) x x TRANSMISSION AND TRANSPORTATION OF CLASSIFIED INFORMATION (EO 13526 REQUIREMENTS) 67. Whenever classified information is transmitted outside of the activity is it enclosed in two opaque sealed envelopes or similar wrappings or containers durable enough to properly protect the material from accidental exposure and facilitate detection of tampering? (DOOM 5200.01-M, Vol 3, Encl 4, para 9) â€¢ NOTE: When classified material is hand-carried outside an activity, a locked briefcase may serve as the outer wrapper. UNCLASSIFIED 14 x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTNITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM 68. Is the outer wrapper addressed to an official government activity or to a DOD contractor with a facility clearance and appropriate storage capability with a complete return address of the sender? (DoDM 5200.01-M, Vol 3, Encl 4, para 9.a.(1)) 69. Is the inner wrapper or container marked with the following information: sender's and receiving activity's address and highest classification level of the contents (including where appropriate, any special markings)? (DoDM 5200.01-M, Vol 3, End 4, para 9.a.(2)) â€¢ NOTE: The inner envelope may have an "attention line" with a person's name. 70. Are procedures established to limit the hand carrying of classified information to only when other means of transmission or transportation cannot be used? (DoDM 5200.01-M, Vol 3, End 4, para 11.a) 71. Are hand-carrying officials briefed on and have they acknowledged their responsibilities for protecting classified information? (DoDM 5200.01-M, Vol 3, Encl 4, para 11.c) 72. Are courier officials provided a written statement authorizing such hand carrying transmission? (DOOM 5200.01-M, Vol 3, Encl 4, para 12) â€¢ [Optional] Does the activity list all classified carried or escorted by traveling personnel? (DoDM 5200.01-M, VoI3, Encl 4, para 11) â€¢ [Optional] Does the activity keep this list until all material reaches the recipient's activity? (DoDM 5200.01-M, Vol 3, End 4, para 11) 73. When "Confidential" classified information is sent U.S. Postal Service "First Class" mail between DOD Components within the United States, is the outer envelope or wrapper endorsed "POSTMASTER: RETURN SERVICE REQUESTED"? (DOOM 5200.01-M, Vol 3, Encl 4, para 5.d 1 74. Do recipients of First Class mail bearing the "Postmaster" notice protect it as Confidential material? x x x x x X x x x SECURITY EDUCATION (E0 13526 REQUIREMENTS) 75. 76. 77. 78. 79. 80. , Has the Component Senior Agency Official established a Security Education program? (DoDM 5200.01-M,Vol 1, Encl 2, para 7.g ) Has the activity security manager implemented the security education and training program within the activity? (DoDM 5200.01, Vol 1, Encl 2, para 9.f) Have all personnel been trained on policies for classification, safeguarding and declassification? Do all personnel who perform derivative classification receive training every 2 years? (DoDM 5200.01-M, Vol 3, Encl 5, para 7.c) All original classification authorities (OCA) must receive training in proper classification and declassification at least once a calendar year. (DoDM 5200.01-M Volt, Encl 4, para 5.d and Vol 3, Encl 5, para 5) Does this training program include an "Initial Orientation" for all assigned personnel who are cleared for access to classified information? (DoDM 5200.01-M, Vol 3, End 5, para 3) Does this orientation include the: (DOOM 5200.01-M, Vol 3, End 5, para 3) UNCLASSIFIED 15 x x x x x . UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITYIRJ NicnomAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OP R DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ â– x x x x â€¢ x x x x x x x x x x x SECURITY INCIDENTS AND VIOLATIONS TO INCLUDE COMPROMISES MO 13526 REQUIREMENTS) 88. Are assigned members trained on of their responsibilities to report security violations concerning classified information? (DOOM 5200.01-M, Vol 3, End 6, para 3.b) 89 Are there procedures to conduct an inquiry/investigation of a loss, possible compromise, or unauthorized disclosure of classified information? (DoDM 5200.01-M, Vol 3, Encl 6, para 6) - UNCLASSIFIED 16 x x 7 Roles and responsibilities of assigned members and key personnel? Elements of safeguarding classified information? Elements of classifying and declassifying information? 81 . Is additional training provided for members who: (DOOM 5200.01-M, Vol 3, End 5, para 4.b & c) â€¢ Are members of deployable organizations, to provide enhanced security training to meet the needs of the operational environment? â€¢ Will be traveling to foreign countries? â€¢ Will be escorting, hand carrying, or serving as a courier for classified material? â€¢ Will use automated information systems to store, process, or transmit classified? â€¢ Will have access to information requiring special control or safeguarding measures? â€¢ Will be using Foreign Government Information or work in coalition or bilateral environments? â€¢ Submit information to OCAs for original classification decisions? 82. Is Refresher training provided at least annually to assigned members? (DOOM 5200.01-M, Vol 3, Encl 5, para 7.a) 83. Is Refresher training tailored to the mission needs and address policies, principles and procedures covered in initial training? (DoDM 5200.01-M, Vol 3, End 5, para 7.a) 84. Does Refresher training address concerns identified during Component SelfInspections? (DOOM 5200.01-M, Vol 3, End 5, para 7.a) 85. Are procedures established to ensure cleared employees who leave the organization or whose clearance Is terminated receives a termination briefing? (DoDM 5200.01-M, Vol 3, End 5, para 9) 86. Are records maintained to show the names of members who participated in "Initial" and "Refresher" training? (DoDM 5200.01-M,Vol3, Encl 5, para 11 ) 87. Do training programs for "Uncleared" members include: (DoDM 5200.01-M, Vol 3, Encl 5, para 3) â€¢ The nature and importance of classified information? â€¢ Actions to take if they discover classified information unprotected? â€¢ The need to report suspected contact with a foreign intelligence collector? UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST IITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 90. 91. 92. National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM Are appropriate and prompt corrective actions taken when a violation or infraction occurs? (DoD 5200.01-M, Vol 3, Encl 6) Are inquiries and/or investigations promptly conducted to ascertain the facts surrounding reported incidents? (DoDM 5200.01-M, VoI3, Encl 6, para 6) Are individuals who commit violations or infractions subject to appropriate sanctions? (DOOM 5200.01-M, Vol1, Encl 3, para 17 and VoI3, Encl 6, para 8.b & 14) UNCLASSIFIED 17 x X x UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 NRO Explanation of N/A Responses on 2012 Information Security Program Self-inspection Checklist Item 1. Comment The DNRO appoints the DOS&CI as responsible for NRO security. The DOS&CI appoints a Government Program Security Officer (GPSO) as the head of each Directorate or Office activity who implements the provisions of the NRO Security Program. For each contractor, an NRO Contractor Program Security Officer (NCPSO) is nominated by the contractor and approved by the DOS&CI. The NCPSO is a senior Contractor PSO responsible and accountable for the security oversight of all NRO program activities at their company or corporation. 2. All security instructions are signed by the DOS&CI 5. Equivalent training is provided 6. Security evaluations and self-inspections are centrally managed under the DOS&CI. The DOS&CI is informed of the results of such inspections. 7. Security-related training will be documented in the Personnel Security File or in a listing of all personnel who completed the training 9. Yes, in areas where political instability, terrorism, host country attitude, or criminal activity suggests the possibility that a SCIF may be overrun by hostile forces. 11. If the security manager has a COOP mission, essential materials are in place at the alternate location. 12. The NRO cannot approve OCAs so we cannot delegate OCA responsibilities. 16. The NRO does not use Downgrading markings. 21. NRO personnel do not have the authority to create NATO information. 28. Most SCIFs are open storage and do not require the use of cover sheets. 38. Most SCIFs are open storage and do not require the use of cover sheets. 40. SF 701 may be used or locally designed forms may be used 41. SF 702 may be used or locally designed forms may be used 45. Yes, at the SCI level, except for SAR where the holder does not have access to the SAR compartment nor the physical area housing the container. UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Please note: The best way to view the report "Agency Annual Self-Inspection Program Data: FY 2013" (attached to this explanation) is in softcopy because several of the expandable fields have text that is hidden when viewed in hardcopy. The full text of entries that exceed the viewable space of expandable fields is included below for ease of reading, however, only the softcopy form will be submitted to OUSD(I). 3. Enter the name, title, address, phone, fax, and e-mail address of the Senior Agency Official (SAO) (as defined in E.O. 13526, section 5.4(d)) responsible for this report. Mr. Frank Calvelli Principal Deputy Director, NRO Room 14675 Lee Road, Chantilly, VA 20151 (b)(3) 10 USC 424 FAX (b)(3) 10 USC 424 (b)(3) 10 USC 424 13. What means and methods are employed in conducting self inspections? (For example: interviews, surveys, data calls, checklists, analysis, etc.) - NRO self-inspections are part of the NRO ISAP. Because of the total NRO workforce and have the contractors make up overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identify and address security vulnerabilities, provide data for analysis, and identify system security issues and trends. Site personnel conduct/document security self-assessments, per requirements stated in the NRO Security Manual (NSM) at least annually. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, 1 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. After the on-site assessment, an out-briefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of the report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 291 selfassessments were received and 10 formal team assessments were performed. No additional formal specific-issue reviews were conducted. There were an additional 742 visits by OS&CI stakeholders to contractor SCIFs. In addition, a data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 20. Describe below how the agency identifies activities and offices whose documents are to be included in the sample of classification actions. (Indicate if NA.) Based on the 291 site self-assessments submitted, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal 2 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. Additionally, several types of documents at NRO headquarters are reviewed annually by CMOs and PSOs for proper classification and marking. A data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 22. How do you ensure that the materials reviewed provide a representative sample of the agency's classified information? (Indicate if NA.) Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. The data call conducted with NRO Headquarters PSOs and CMOs for item 87 and 88 represents all documents they reviewed during FY 2013. 31. How is the self-inspection program structured to assess individual agency activities and the agency as a whole? Contractor SCIF locations far outnumber government SCIF locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractor facilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. 3 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 35. What is the format for documenting self-inspections in your agency? Self-assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an outbriefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. 47. Safeguarding: Regular conduct of exercises provides vital feedback to the physical security program. Exercises identify areas for corrective measures, enhancements, validate current tactics, techniques and procedures (TTP) and the adoption/employment of new TTP to meet a dynamic threat environment. Regular inspections/audits are essential to ensuring status and validity of issued IC badges and conformity to physical security requirements. Risk assessments/physical security assessments provide a helpful "outside" perspective to site security offices. NRO government and contractor personnel work in SCIFs equipped with secure telephones, FAX, and teleconferencing equipment, badges and badge readers, guard forces in several locations, document shredders and other features to ensure compromises of classified information do not occur. While the insider threat is always a possibility, we take every precaution to prevent security incidents from occurring. The NRO applies uniform procedures established by the Intelligence Community Directive (ICD)-503 family of policy and guidance for Information Technology Systems Security Risk Management and Assessment and Authorization (A&A) activities. 4 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 48. Security Violations: The ISAP program is the formal mechanism by which we corroborate self - inspections. Included in these formal reviews is an assessment of the respective security violation program and trends. In addition, each component Security team evaluates Security incidents and violations by tracking them according to general broad categories. During this past FY, the majority (63%) of incidents/violations were related to categories within personnel electronic devices in SCIFs. Other categories that have multiple occurrences indicating potential trends are data spills (9%) and inadvertent removal of classified information (12%). Personal cell phones and prohibited electronic devices are not allowed in SCIFs. While we have installed lockers outside SCIFs to secure cell phones, entry of prohibited electronic devices into SCIFs is still a problem. Visitor attendance to NRO conferences/facilities result in numerous cell phones being brought into the conference even by individuals with security duties who should know better. 49. Security Education and Training: 100% of personnel assigned to the NRO are required to complete an SCI indoctrination briefing to include signing a NonDisclosure Agreement. E.O. 13526 is called out specifically so that personnel fully understand their responsibilities and requirements to protect classified information. This message is repeated by the release of awareness videos and reminders throughout the year; to include presentations, written materials, and training. Specifically, OS&CI incorporates classification management questions within the Annual Security Refresher (ASR) web-based training (WBT). In 2014 ASR will include additional Derivative Classification questions. With as many contractors as the NRO employs, training can be a major expense. Every contractor and government employee with a secure computer account is required to take the Annual Security Refresher training otherwise they lose their computer connection. There are numerous additional courses and specialized security training available on-line even though sequestration has reduced training manpower overall to include elimination of the Information Management Branch which ran the OS&CI web site and security-specific applications. 5 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 50. Management and Oversight: Government oversight of NRO-sponsored SCIFs is achieved in a multi-faceted manner. Program Security Officers, Physical/Technical, and Computer Security Officers review selfassessment results and participate in on-site reviews. Some program findings for FY 13 were identified in the following areas: â€¢ Standard Operating Procedures (SOPs) require more detail and more frequent revision to stay up-to-date with security requirements. â€¢ Foreign travel and contact reporting were not always accomplished using the mandated NRO Counterintelligence Network (CINet). â€¢ There are undocumented information systems within facilities. â€¢ Not all employees with AIS privileged user type access have been identified and tracked. â€¢ Facility alarm test records are not always maintained for the required time period. â€¢ Red/Black cabling is not labeled for identification. 54. Safeguarding: Awareness and education programs are vital to ensuring the workforce maintains awareness of security policy and procedures. Regular and aperiodic exercises, inspections, and audits provide crucial inputs that are indispensable to ensuring that the physical security program is current and effective. Key challenges are maintaining adequate funding to replace aging, malfunctioning, and obsolete security equipment and training and education for new personnel. The NRO has an organization-level process for the Assessment and Authorization (A&A) of Information Systems and a Directive 51-1, "Information Technology, Information Assurance, and Information Management Architecture and Strategy for Certification and Accreditation" to ensure automated information systems that collect, create, communicate, compute, disseminate, process or store classified information are protected in accordance with applicable national policy issuances. 6 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 55. Security Violations: The NSM details the NRO process for reporting and investigating security incidents, infractions and violations. Appropriate and prompt corrective actions were taken to.mitigate the severity of the infraction/violation, and to sanction the offender via management, counterintelligence, and personnel security processes. Infractions and violations are centrally tracked in the Security Log (the NRO incident/violation database). This database is managed by the Program Security Officers in each directorate and office, and enables the PSO to automatically notify Counterintelligence Division and Personnel Security Division, via a system generated e-mail, of infractions/violations that require immediate CI and/or personnel security attention. The database also enables both OS&CI management as well as individual PSOs to track and analyze trends linked to the various categories of security infractions/violations. 56. Security Education and Training: OS&CI works closely with PSOs, Counterintelligence personnel, and the Integrated Self Assessment Program to determine any trends or specific areas that need an additional educational awareness campaign. Security communications are then targeted, utilizing large scale efforts, per a topic area and audience for best impact results. The NRO is adding additional classification management questions to the Annual Security Refresher to better satisfy the derivative classification training requirement. OCAs complete yearly training provided by NRO/OS&Cl/Policy Branch with direct knowledge of current CAPCO guidelines. 57. Management and Oversight: The NRO has a very mature Security management and oversight program. Over the past FY, much greater emphasis has been placed on ensuring all sites and facilities accomplished the self-assessments and submited the findings to the Government within the mandated time requirements. This improved management oversight has made an impact. Our self-inspection program coupled with security officer visits, and formal team 7 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessments provide managers a report card on the health of our security programs. When negative trends are identified, managers from across industry and the Government develop corrective action plans to reverse the trends and ensure security requirements are met. Impacts are being felt to overall security programs due to reductions in security resources. While security requirements are increasing, especially in the area of information systems management, resources are being reduced. Additionally, some sites assessed have made decisions not to fully comply with a security requirement because of resource constraints. 8 UNCLASSIFIED

1 0

Annual Self-Inspection Report
by None 06 Jul '18

06 Jul '18

(a) OUSD(I) Memorandum, Annual Senior Agency Official (SAO) Self-Inspection Program Report for Classified National Security Information, 2 October 2012 (b) Memorandum of Agreement between the Secretary of Defense and the Director of National Intelligence concerning the National Reconnaissance Office, 21 September 2010 (c) DoDI 5200.01, DoD Information Security Program and Protection of Sensitive Compartmented Information, 9 October 2008 The National Reconnaissance Office (NRO) is providing the attached Self-Inspection Report as requested in reference (a). In accordance with Director, National Reconnaissance Office authorities in reference (b) and (c) it should be noted that the NRO does not administer a standard DoD Information Security Program based on DoDM 5200.01-V1 thru V3 and, therefore, some of the items in the attached checklist are not applicable and have been noted as such. My point of contact for questions concerning this submission is (b)(3) 10 USG 44- . Jamieson Burnett irector, Office of Security and Counterintelligence Attachment: NRO Annual Self - Inspection Report for 2012 UNCLASSIFIED UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACMATWFUNCRONAL AREA Information Security Program Self-Inspection Checklist NO. STEM NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office 045 R DATE Security Manager 11 October 2012 EO 13526 CLASSIFIED NATIONAL SECURITY INFORMATION AND IMPLEMENTING DIRECTIVE REQUIREMENTS PART 1. DESCRIPTION OF SELF-INSPECTION PROGRAM: A description of the DoD Components self- inspection program should include activities assessed, program areas covered, and methodology utilized. The description must demonstrate how the self-inspection program provides the senior agency official with the information necessary to assess the effectiveness of the classified national security information program within the individual Component activities and the Component as a whole. It should include the following: 1. Responsibility for the program: (1) Whom does the senior agency official designate to assist in directing and administering the self-inspection program? Answer . The Director of Security and Counterintelligence (DOS&CI) is provided a Letter of Instruction by the Director, NRO which assigns his responsibilities. (2) How is the program structured to provide the senior agency official with the information necessary to assess the agency's classified national security information program? Answer: The DOS&CI advises the Senior Agency Official (SAO) when the DOS&CI believes events warrant advising the SAO. The NRO Integrated Security Assessment Program (ISAP) results are also reported to the SAO thru the annual Management Control Plan Statement of Assurance (MCPSOA). (b)(3) 10 USC 424 (3) Who conducts the self-inspections? Answer: NRO self-inspections are part of the NRO ISAP. Because contractors make upgAof the total NRO workforce and have the overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identifi , and address security vulnerabilities, provide datfornlysi,findings e tmcuriyseand.Th may lead to identification and definition of risk mitigation practices, and enable sharing of best security practices across government and industry. The primary purpose of the ISAP is to ensure the proper safeguarding of classified information through a single comprehensive review by various components of the Office of Security and Counterintelligence (OS&CI). ISAP integrates reviews utilizing program security, classification management, transportation and transmission of classified information, physical and technical accreditation, information systems security, personnel security, and Counterintelligence (CI) perspectives. The integrated assessment evaluates implementation of and ensures compliance with, established security policies, procedures, and plans at all NRO government and contractor location& Site personnel conduct/document security self-assessments per requirements stated in the NRO Security Manual (NSM). Security Officers will conduct self-assessments of their SCIFs at least annually. For the reporting period there were 343 site self-assessments. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required OS&CI stakeholders represent the major OS&CI divisions and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers, and Security Certification Officers. Stakeholders will develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board Sites are selected based on ring proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. An out-briefing is provided to site security site - and other site senior management identfying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actionsto be taken within 90 days of the date of UNCLASSIFIED 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLESUBJECT/ACTIVITY/FUNCT1 ONAL AREA Information Security Program Self-Inspection Checklist NO. I NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 16 formal team assessments were performed An additional 9 formal specific-issue reviews were conducted There were an additional 1,491 visits by OS&CI stakeholders to contractor SCIFs. (4) How is the senior agency official involved in the program? Answer: The DOS&CI keeps the SAO advised of trends and issues developed by the ISAP. The NRO ISAP results are also reported to the SAO thru the annual MCPSOA. 2. Approach: (1) What means and methods are employed in conducting self-inspections? Answer: For formal assessments, the Assessment Team evaluates implementation, and ensures compliance with, established NRO security policies, procedures, and plans. (2) Are different types of self-inspections conducted? If so, describe each of them. Answer: Formal assessments will vary based on the experience of the lead PSO and the stakeholders with the facility and items noted in the self-evaluation report as well as the areas of responsibility of the attending subject matter experts. However, the objective for all is to identify and address security vulnerabilities, provide data for analysis, and identift system security issues and trends. (3) Do the self-inspections evaluate adherence to the principles and requirements of E.O. 13526 and its implementing directive and the effectiveness of agency programs covering: â€¢ Original classification? Answer: Since Original Classification items only apply to 13 government employees who are Original Classification Authorities (OCA) at NRO Headquarters, a formal tasking is sent to Program Security Officers supporting the OCA to determine the date the OCA received their annual briefing and the number of original classification decisions they made during the reporting period. Experience has shown that not all of the OCAs make individual OCA decisions every year but most require their authority to sign classification guides for their area of responsibility. For the reporting period there, nine OCA decisions were made. â€¢ Derivative classification? Answer: Included. In NRO Implementing Instructions released on 31 May 2011, derivative classifiers were instructed to include in the classification block a personal identification number rather than their name to protect their identity and association with the NRO. This "Classification ID (CLID)" number exists in the NRO Access Database so the specific individual with that number can always be identyled Employees of other agencies, who already have an ID number assigned by their parent agency, will use that number instead Headquarters NRO derivative classifiers have their PSO available for questions regarding classification and marking and to review their derivatively classified documents for format and accuracy of classffication and marking. Available on the OS&CI website are the Order, Information Security Oversight Office (IS00) Implementing Directive and Marking booklet, videos and documents that explain the correct way to classify and mark documents, the Controlled Access Program Coordination Office (CAPCO) register and manual, over 120 Frequently Asked Questions with answers that are posted about portion marking a Security Policy hotline that will answer their questions in real-time, and numerous other experts who are available to answer their questions. Once the document is distributed, they face additional scrutiny from any security or classification management officer who reads it or from subject matter experts who point out classification and marking errors to security officers. The ISAP team visiting a site will review a sample of derivatively classified documents to point out errors in classification and marking, omissions of required information, and to make suggestions for improvement. â€¢ Declassification? Answer: The NRO has a formal declassification program which restricts to one office the authority to officially declassify NRO information and release it to the public, and which is not included in the self-inspection program. The results of this program are reported in the SF 311 report provided to USD(I) in October 2012. The NRO Declassification Guide (known as the Review and Redaction Guide) is updated and approved by the UNCLASSIFIED 2 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUEWECT/AC71VITY/FUNCT1ONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 1 1 October 2012 ITEM DNRO each year. It is currently undergoing review by the Interagency and is expected to be approved by the end of 2012. â€¢ Security Classification Appeals Panel Safeguarding? Answer: Included â€¢ Security violations? Answer: Included â€¢ Security education and training? Answer: Included â€¢ Management and oversight? Answer: Included (4) Do the self-inspections include a review of relevant security directives and instructions, as well as interviews with producers and users of classified information? Answer: All directives and instructions are issued by the DOS&Cl and are reviewed and updated annually. All directives and instructions are maintained on-line and are accessible to all government employees and contractors. (5) Do the self-inspections include reviews of representative samples of your Component's original and derivative classification actions? â€¢ Do these reviews encompass all Component activities that generate classified information? Answer: There are hundreds of individual activities that can generate classified information. While the annual self-assessment questionnaire covers 343 of these activities, the ISAP formal assessment inspects only a small percentage of these activities yearly. However, the Program Security Officers, Contractor Program Security Officers, and Classification Specialists review hundreds of classified documents yearly and provide direction to originators to correct those that are improperly marked. o How do you identify the activities to which this applies? Answer: Site personnel conduct/document security self-assessments per requirements stated in the NSM â€¢ Do the reviews include a sampling of various types of classified information in document and electronic formats? o How do you ensure that the materials reviewed provide a representative sample of the Component's classified information? Answer: Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. o How do you determine that the sample is proportionally sufficient to enable a credible assessment of your Component's classified product? Answer: We do not attempt to do this as it would increase costs to the NRO (as explained above). â€¢ Who conducts the review of the classified products? o Are they knowledgeable of the classification and marking requirements of E.O. 13526 and its implementing directive? Answer: Yes o Do they have access to pertinent security classification guides? Answer: Yes â€¢ Have appropriate personnel been designated to correct misclassification actions? If so, identify. Answer: All Program Security Officers and Classification Managemeni Specialists are authorized to correct misclassification, incorrect use of SCI channels, and incorrect dissemination restrictions. 3. Frequency: (1) How frequently are self-inspections conducted? Answer: Annually. (2) What factors were considered in establishing this time period? Answer: Time period is defined in the NSM. UNCLASSIFIED 3 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office CPR DATE Security Manager 11 October 2012 ITEM 4. Coverage: (1) How do you determine what program elements and Component activities are covered by your self-inspection program? Answer: Self-assessments are to be completed on each contractor SCIF. (2) What Component activities are assessed? Answer: All contractor activities are assessed. (3) How is the program structured to assess individual Component activities and the Component as a whole? Answer: Contractor locations far outnumber government locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractorfacilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. (4) If your Component has any special access programs (SAP), are self-inspections of the SAP programs conducted annually? Answer: Most SAPs are reviewed as part of the ISAP program. The ISAP formal assessment team has PSOs assigned that are briefed for most SAPs. In addition. the NRO conducts special annual reviews (in some cases. semi-annual) of the entire Sensitive Activities portfolio. o o Do the self-inspections confirm that the Component head or principal deputy has reviewed each special access program annually to determine if it continues to meet the requirements of E.O. 13526? Answer: The NRO's entire Sensitive Activities portfolio is reviewed and briefed annually to the DNI's Senior Review Group (SRG) who then reports to Congress. Do the self-inspections determine if officers and employees are aware of the prohibitions and sanctions for creating or continuing a special access program contrary to the requirements of E.O. 13526? Answer: Yes. In keeping with E.O. 13526, all Sensitive Activities' compartments that are established terminated, or transitioned (to another program or lower classification) require NRO Special Activities Management Board review and approval, followed by notification to the DNI's Senior Review Group/Controlled Access Program Oversight Committee. 5. Reporting: (1) What format for documenting self-inspections in your Component? Answer: Self assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an out-briefing is provided to site security staff and other site senior management identi&ing security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. (2) Who receives the reports? Answer: The OS&CI ISAP Manager. (3) Who compiles/analyzes the reports? Answer: The ISAP Manager and the responsible PSO analyze the report. (4) How are the findings analyzed to determine if there are problems of a systemic nature? Answer: The ISAP Manager provides to the sponsoring Government Program Security Officer (GPSO) for review and subsequent action. (5) How and when are the results of the self-inspections reported to the senior agency official? Answer: The DOS&CI determines when results warrant informing the SAO. (6) How is it determined if corrective actions are required? Answer: The GPSO and security stalceholder(s) review. UNCLASSIFIED 4 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECTIACTIVITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security ITEM DATE Manager 11 October 2012 I I (7) Who takes the corrective actions? Answer: The assessed site. (8) How are the findings from your Component's self-inspection program distilled for the annual report to the Director o f ISOO? Answer: The OS&CI Security Policy Staff (SPS) tasks the ISAP Manager to distill the findings and provide them to SPS for inclusion in the annual report. Self-Inspection Program Description here: Description include in italics under questions above. PART 2. ASSESSMENT & SUMMARY: ASSESSMENT The assessment is an evaluation of the state of each element of your componenVs classified national security information program based on an analysis of the findings of the selfinspection program. It should consider if the program element is being effectively implemented in accordance with the Order and Directive and DoD 5200.01-M. It should consider whether the findings indicate that the regulation or other policies or procedures may need to be updated, and it should take into account other program information such as the Standard Form 311, "Agency Security Classification Management Program Data." If a particular element does not apply to a component (e.g., original classification authority) the report should explain this. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations: Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory SUMMARY: The summary should report the findings from the self-inspection program within each of the program areas. This information should support the assessment. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory Assessment & Summary here: included in italics under headings above. UNCLASSIFIED 5 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACT1VITYIFU KnONAL AREA Information Security NO. Program Self-Inspection Checklist NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 201 2 ITEM PART 3. FOCUS QUESTIONS: FOCUS QUESTIONS: Answer the following focus questions. (1) Training for original classification authorities. (This applies only to Components with original classification authority). (1) Original classification authorities are required to receive training in proper classification and declassification each calendar year (5200.01-V?). What percentage of the original classification authorities at your Component has received this training? (2) Have any waivers to this requirement been granted? Answer: 100% of NRO OCAs have received training. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (2) Training for persons who apply derivative classification markings. (1) Persons who apply derivative classification markings are required to receive training in the proper application of the derivative classification principles of the E0 13526 prior to derivatively classifying information and at least once every two years thereafter. What percentage of the derivative classifiers at your Component has received this training? (2) Have waivers to this requirement been granted? Answer: Percentage unknown. The DSS and CAPCO Derivative Classifier training is available through the NRO computer network; however, NRO has not made this training mandatory because of the cost of two hours of direct labor charged by each contractor. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (3) Initial training. (1) All cleared agency personnel are required to receive initial training on basic security policies, principles, practices, and criminal, civil, and administrative penalties. What percentage of these personnel at your Component has received this training? Answer: 100% of new employees have received initial training. FOCUS QUESTIONS: Answer the following focus questions. (4) Refresher training. (1) Components are required to provide annual refresher training to all employees who create, process, or handle classified information. What percentage of these employees at your Component has received this training? Answer: 100% of employees have received refresher training. FOCUS QUESTIONS: Answer the following focus questions. (5) Identity of persons who apply derivative classification markings. (1) Derivative classifiers must be identified by name and position, or by personal identifier on each classified document. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: NRO personnel are directed to use a personal identifier. 100% of documents have met this requirement. The number of documents reviewed is unknown. FOCUS QUESTIONS: Answer the following focus questions. (6) List of multiple sources. (1) A list of sources must be included on or attached to each derivatively classified document that is classified based on more than one source document or classification guide. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: 100% of documents have met this requirement. The number of documents reviewed is unknown. UNCLASSIFIED 6 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST T1 TLEPAIBJECT/ACT1VITY1FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM FOCUS QUESTIONS: Answer the following focus questions. (7) Performance evaluations. (1) The performance contract or other rating system of original classification authorities, security managers, and other personnel whose duties significantly involve the creation or handling of classified information must include a critical element to be evaluated relating to designation and management of classified information. What percentage of such personnel at your Component has this element in their performance contracts? Answer: The NRO is comprised of government individuals from various agencies. Parent agencies set the rules for their performance contract or rating system. Based on the rules for each parent agency, approximately 40% have this element in their performance contract PART 4. DISCREPANCIES: Specific information with regard to the findings of the annual review of the Component's original and derivative classification actions to include the volume of classified materials reviewed and the number and type of discrepancies identified. 1. "Discrepancies" are instances when the classification and/or marking requirements of the Order, Directive and Agency regulation are not met. Among these are: (1) Overclassification: information does not meet the standards for classification. (2) Overgraded/Undergraded: Information classified at a higher/lower level than appropriate. (3) Declassification: Improper or incomplete declassification instructions or no declassification instructions. (4) Duration: A shorter duration of classification would be appropriate. (5) Unauthorized classifier: A classification action taken by someone not authorized to do so. (6) "Classified By" line: A document does not identify the OCA or derivative classifier by name and position or by personal identifier. (7) "Reason" line: An originally classified document does not cite a reason from section 1.4 of the Order. (8) "Derived From" line: A document fails to cite, or cites improperly, the classification source. The line should include type of document, date of document, subject, and office/agency of origin. (9) Multiple sources: A document cites "Multiple Sources" as the basis for classification, but list of these sources is not included on or attached to the document. (l0)Marking: A document lacks overall classification markings or has improper overall classification markings. (I 1 ) Portion Marking: The document lacks required portion markings. (12) Instructions from a classification guide are not properly applied. For additional information on marking, consult the l)oDM 5200.01-V2. List identified program deficiencies here. Also list actions taken or are planned to correct identified program deficiencies, marking discrepancies, or misclassification actions, and to deter their reoccurrence: Answer: Improper application of portion marking. Individuals will receive additional training and review of their documents by security officers. PART 5. BEST PRACTICES: List best practices that were identified during self inspections here: - Comprehensive security database developed which reflects final adjudication and investigation of security incidents - SCIF decertification process assembled consisting of: -- SCIF decertification checklist -- Sanitization steps for offices -- SCIF decertification roles and responsibilities - The self-assessments, methodology, and supporting application is a model for other industry sites - Comprehensive Open/Close procedures - Plexiglas inspection window and inspection ports for checking penetration of perimeter by HVAC, wiring, etc. - DoD SELF INSPECTION PROGRAM REQUIREMENTS: This portion of the checklist meets specific - requirements for a standard DoD Information Security Program based on the DoDM 5200.01-V1 thru V3. Please answer the following questions below. NO.PROGRAM MANAGEMENT (EO 13526 REQUIREMENTS) I YES I NO I N/A UNCLASSIFIED 7 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. IL National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager ITEM Has the head of each activity in the Component appointed a security manager to manage and implement the activity's information security program which implements the provisions of DoDM 5200.01-M? (DoDM 5200.01-M, Vol 1, End 2, para 8.b & 9.a) Does the Component Head develop and implement, through the security manager, security instructions necessary for program implementation? (DoDM 5200.01-M, Vol 1, Encl 2, para 9.d) Are sufficient resources and personnel committed to implement the classified national security information security program? (DOOM 5200.01-M, Vol 1, Encl 2, para 6.d) Are OCAs delegated classification authorities in writing? (DoDM 5200.01-M, Vol 1, Encl 4, para 5.c) Has the security manager attended the required training? Note: Training and education shall be provided before, concurrent with, or not later than six months following appointment. (DoDM 5200.01-M, Vol 3, End 5, paras 4.a and 10) Does the security manager conduct security inspections (self-inspections)? (DoDM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Is the Component Head informed of the results of such inspection? Does the security manager establish, implement and maintain an effective security education program as required by DoDM 5200.01-M, Volume 3, Enclosure 5, to include initial orientation and continuing/refresher training for assigned members? (DoDM 5200.01-M, Vol 1, End 2, para 7.g & 9.f; Vol 1, Encl 3, Para 6.c; and Vol 3, Encl 5, para 7 & 8) â€¢ Do security managers document all security-related training? (DoDM 5200.01-M, Vol 3, End 5, para 11) Are procedures established to prevent unauthorized access to classified information? (DOOM 5200.01-M, Vol 1, End 2, para 7.e) â€¢ Note: Examples include implementing visitor controls, restricting combinations to cleared members, establishing end-of-day security checks, etc) Are emergency plans developed for the protection, removal, or destruction of classified material in case of fire, natural disaster, civil disturbance, or terrorist activities to minimize the risk of compromise? (DOOM 5200.01-M, Vol 1, Encl 2, para 9.d) Are procedures established for ensuring that all persons handling classified material are properly cleared and have a need-to-know? (DOOM 5200.01-M, Vol 1, End 3, para 11.a) Does the security manager maintain a continuity handbook? DATE 11 October 2012 x x x x x x x x x x x x x x ORIGINAL CLASSIFICATION (EO 13526 REQUIREMENTS) 12. Are Original Classification Authorities (OCAs) trained on the process and requirements for original classification (DOOM 5200.01-M, Vol 1, Encl 4, para 6), to include? x Applicable standards and categories for classification? (D0DM 5200.01-m, x UNCLASSIFIED 8 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST ITTLE/SUBJECT/ACTIVITYTUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM 1, Encl 4, para 1) Levels of classification and damage criteria associated with each one? (DoDM 5200.01-M, Vol 1, Encl 4, para 3) â€¢ Avoidance of over - classification? (DoDM 5200.01-M, Vol 1, End 4, para 6.f) â€¢ Classification prohibitions and limitations? (DoDM 5200.01-M, Vol 1, Encl 4, para 2) â€¢ Required markings, including those for dissemination and handling? (DoDM 5200.01-M, Vol 1, Encl 4, para 6.h; Vol 2, Ends 3 & 4) â€¢ Determination of declassification instructions? (DoDM 5200.01-M, Vol 1, Encl 4, para 13.a) â€¢ Delegations of OCA responsibilities? (DoDM 5200.01-M, Vol 1, Encl 4, para 5 & 5.c) â€¢ Classification challenges? (DoDM 5200.01-M, Vol 1, Encl 4, para 22) 13. Have OCAs prepared, as appropriate, classification guides to facilitate the proper and uniform derivative classification of information? (DoDM 5200.01, Vol 1, Encl 4, para 6.h; Vo11, Encl 6, para 1) 14. Do the guides meet the requirements of section 2.2 of E.O. 13526 and section 2001.15 of title 32, Code of Federal Regulations (CFR)? Vol â€¢ X X X x x X x X DERIVATIVE CLASSIFICATION (EO 13526 REQUIREMENTS) 15. Are persons who apply derivative classification markings trained on the process and requirements for derivative classification (DoDM 5200.01-M, Vol 1, Encl 4, para 11 & 12), to include? â€¢ Identity of derivative classifier? (DoDM 5200.01-M, Vol 2, End 3, para 7 & 8.c. (1)(a)) â€¢ Use of source documents, including classification guides? (DoDM 5200.01M, Vol 2, Encl 3, para 8.c.(1)(b), 8.c.(2) & 8.c.(3)) â€¢ Declassification instructions? (DoDM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(d), 8.c.(4)-(9) & 9) â€¢ Proper application of markings? See Classification Markings/Document Review section below. (DoDM 5200.01-M, Vol 2, Encl 3 & 4) â€¢ Classification challenges (DoDM 5200.01-M, Vol 1, Encl 4, para 22) x x X X X CLASSIFICATION MARKINGS/DOCUMENT REVIEW (EO 13526 REQUIREMENTS) 16. Reviews of original and derivative classification actions shall be conducted in accordance with section 2001.60(c)(2) of title 32, CFR, and should evaluate the classification and marking of documents to include: (DOOM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Have the standards of classification been met? (DoDM 5200.01, Vol 1, Encl 4, para 1 & 2) â€¢ Could damage to the national security be reasonably expected in the event of unauthorized disclosure? (DoDM 5200.01, Vol 1, Encl 4, para 3) â€¢ Have the requirements for original classification of Part 1 of E.0.13526 or for derivative classification in Part 2 of E.O. 13526 been met? â€¢ Have the required markings been applied in accordance with E.O. 13526 and Subpart C of title 32, CFR? (DOOM 5200.01-M, Vol 2, para 3) UNCLASSIFIED 9 x X x x X 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTIVITY/FUNcnONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ Overall classification level (DoDM 5200.01-M, Vol 2, Encl 3, para 5) "Reason for Classification" line (originally classified documents only) (DoDM 5200.01-M, Vol 2, Encl 3, para 3.b.(1)(b) & 3.b.(4)) The Agency, Office or Origin, and Date (DoDM 5200.01-M, Vol 2, Encl 3, para 7) â€¢ â€¢ 17. 18. 19. 20. 21. 22. 23. 24. A "Derived From" line (DOOM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(b)) A "Classified By" line (DoDM 5200.01-M, Vol 2, Encl 3, para 8.b.(1)(a) & 8.c.(1)(a)) â€¢ identification of the sources of classification (DoDM 5200.01-M, Vol 2, End 3, para 8.c.(1)(b), 8.c(2), & 8.c.(3)) â€¢ "Declassify On" line (DoDM 5200.01-M,Vol 2, Encl 3, para 8.c.(d)) â€¢ Downgrading instructions, if required (DoDM 5200.01-M, Vol 2, Encl 3, para 8.a.(4)) â€¢ Page and Portion Markings (DoDM 5200.01-M, Vol 2, Encl 3, para 5 & 6) â€¢ Have any unauthorized or invalid markings been applied to documents? Are Agency personnel who conduct reviews of the agency's original and derivative classification actions trained on the classification and marking requirements of E.O. 13526, part 2001 of title 32, CFR, and DoDM 5200.01; and do they have access to pertinent security classification guides? Are "subjects" or "titles" of classified documents marked with the appropriate symbol (TS), (S), (C), or (U) following and to the left of the title or subject? (DoDM 5200.01-M, Vol 2, Encl 3. Para 6.e.(2) & 14) Is each section, part, paragraph, or similar portion of a classified document marked to show the highest level of classification of information it contains, or that it is unclassified? Portion of text shall be marked with the appropriate abbreviations (TS, S, C, or U). (DOOM 5200.01-M, Vol 2, Encl 3, para 6) Are portions within documents containing Restricted Data and Formerly Restricted Data marked with the abbreviation "RD" or "FRO" (e.g. S//RD or TS//FRD)? (DoDM 5200.01-M, Vol 2, Encl 4, para 8.a & 8.b) Are portions within documents containing foreign government or North Atlantic Treaty Organization (NATO) information marked with the foreign classification or NATO and the appropriate classification level (e.g. //GBR S or //NATO C)? (DoDM 5200.01-M, Vol 2, Encl 4, para 4) Is the abbreviation "FOUO" used to designate unclassified portions that contain information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA)? (DoDM 5200.01-M, Vol 2, Encl 4, para 10.b & Vol 4, End 3, para 2.c) Are charts, graphs, photographs, illustrations, figures, and similar items within classified documents marked to show their classification? (DoDM 5200.01-M, Vol 2, Encl 3, para 6.a & 18) Are the markings placed within the chart, graph, photograph, illustration, figure, etc. or next to the item? (DoDM 5200.01-M, Vol 2, End 3, para 6.e.(3) & 18) UNCLASSIFIED 10 .. x X X x x x x x x X x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE /SUBJECT/ACTIVITWFUNCTI ONAL AREA Information Security Program Self-Inspection Checklist NO. 25. 26. 27. 28. 29. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR Security Manager ITEM Is the highest classification level placed on the top and bottom of each page containing classified information or marked "unclassified"? (This is called the "banner line") â€¢ Do the markings stand out from the balance of the information on the page (must be readily visible)? (DoDM 5200.01-M, Vol 2, Encl 3, para 5) Are TRANSMITTAL documents properly marked to include either its highest classification or a notation "Unclassified when separated from classified enclosures"? (DoDM 5200.01-M, Vol 2, Encl 3, para 15) For ELECTRONIC documents: â€¢ Are e-mails, blog entries, bulletin board postings, and other electronic documents marked as finished documents, not working papers? (DoDM 5200.01-M, Vol 2, Enc 3, para 17.a.(2)) â€¢ Do e-mails include the appropriate banner line, portion markings, and classification authority block? Is the subject line portion mark the classification of the subject, not the overall classification of the e-mail? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.b) â€¢ Do classified URLs contain embedded portion marks? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.d) â€¢ Are briefing slides, including any speaker notes and hidden slides, marked as required for text documents? (DoD 5200.01-M, Vol 2,Encl 3, para 16) â€¢ Are maps, charts, blueprints, photographs, and other special types of materials marked in the same fashion as for documents, to the extent feasible? (DoD 5200.01, Vol 2, Encl 3, para 18) Are Files, Folders, and Groups of documents clearly marked on the outside of the file or folder (attaching a classified document cover sheet to the front of the folder or holder will satisfy this requirement)? (DoDM 5200.01-M, Vol 2, Encl 2, para 4.a) Are removable storage media (e.g. magnetic tape reels, disk packs, diskettes, CD-ROMS, removable hard disks, disk cartridges, tape cassettes, etc.) marked with the appropriate Standard Form label (SF 706/707/708/710)? (DoDM 5200.01-M,Vol 2, Encl 2, para 4.b) DATE 11 October 2012 x X x x x x x x x x DECLASSIFICATION (EO 13526 REQUIREMENTS) 30. 31. Is there a records management system to facilitate public release of declassified documents? Are procedures established for automatic, systematic, discretionary, and mandatory declassification review? x x SAFEGUARDING AND STORAGE (EO 13526 REQUIREMENTS) 32. 33. 34. 35. Is the program designed and maintained to optimize safeguarding of classified information? Are there control measures to prevent unauthorized access to classified information? Are personnel aware of procedures for identifying, reporting, and processing unauthorized disclosures of classified information? Are there procedures to ensure that appropriate management action is UNCLASSIFIED 11 x x x x 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM taken to correct identified problems? Are there methods for transmitting classified information, preparing it correctly for mailing, and for hand carrying or escorting classified material? 37. Is classified information removed from storage kept under constant surveillance of authorized persons? (DoDM 5200.01-M, Vol 3, Encl 2, para 8) 38. Are cover sheets placed on all documents removed from storage? (DoDM 5200.01-M, Vol 3, End 2, para 8) 39. Are end-of-day security checks established for areas that process or store classified information to ensure the area is secure at the close of each working day? (DOOM 5200.01-M, Vol 3, Encl 2, para 9) 40. Is the SF 701, Activity Security Checklist, used to record end-of-day checks? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 41. is the SF 702, Security Container Check Sheet, used to record the closing of each vault, secure room, or container used for storage of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 42. Is the SF 700, Security Container Information, properly completed and posted inside the LOCKING drawer of the security container, or inside the door of vault and similar facilities? (DoDM 5200.01-M, Vol 3, Encl 3, para 10) 43. Are storage containers (safes) that may have been used to store classified information inspected by properly cleared personnel before removal from protected areas or before unauthorized persons are allowed access to them? (DoDM 5200.01-M, Vol 3, Encl 3, para 13) 44â€¢ Are combinations to security containers changed at the required intervals? (DoDM 5200.01-M, Vol 3, Encl 3, para 11.b) 45. If written records of the combination are maintained, are they marked and protected at the highest classification of the material stored therein? (DOOM 5200.01-M, Vol 3, Encl 3, para 11.a) â€¢ Is the combination stored in a security container other than the one for which it is being used? 46. Are entrances to secure rooms or areas under visual control at all times during duty hours to prevent unauthorized access or equipped with electric, mechanical or electromechanical access control devices to limit access during duty hours? (DoDM 5200.01-M, Vol 3, Encl 3, para 12.a) 47. Does each vault or container bear an external marking for identification purpose? NOTE: The level of classification stored therein must NOT be marked on the outside of the container(s). (DoDM 5200.01-M, Vol 3, Encl 3, Para 9) 48. is Top Secret material stored only in a GSA approved security container (safe) having one of the following supplemental controls: (DOOM 5200.01-M, Vol 3, Encl 3, para 3.a) â€¢ Guard or duty personnel cleared to the Secret level inspect the security container once every two hours â€¢ An Intrusion Detection System (alarm system) meeting requirements of para 2 of the Appendix to Encl 3 of DoDM 5200.01-M, Vol 3. 36. UNCLASSIFIED 12 x x x x x x x x x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL ARE A Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ 49. so. 51. 52. 53. 3, 54. Combination lock meeting Federal Specification FF-L-2740 (X0-7) with security-in-depth Is Secret material stored in a GSA approved security container (safe) without supplemental controls or in the same manner as Top Secret? (NOTE: Approved containers will have a certification label on the container itself) (DOOM 5200.01-M, Vol 3, Encl 3, para 3.b) Is Confidential material stored in a GSA approved security container? (DoDM 5200.01-M,Vol 3, End 3, para 3.c) Are security container repairs (e.g. drilled because of a forgotten combination) done in accordance with FED-STD 809? (DoDM 5200.01-M, Vol 3, Encl 3, para 14) Is equipment (e.g. copiers, facsimile machines, AIS equipment and peripherals, electronic typewriters and word processing systems) used for processing classified information protected from unauthorized access? (DoDM 5200.01-M, Vol 3, Encl 2, para 14.a) Do appropriately cleared and technically knowledgeable personnel inspect the equipment and media used for processing classified information before the equipment is removed from the protected areas? (DoDM 5200.01-M, Vol Encl 2, para 14.d) Are GSA approved field safes and special purpose one and two drawer lightweight security containers securely fastened to the structure or under sufficient surveillance to prevent their theft? (DoDM 5200.01-M, Vol 3, End 3, para 6.a) x x x x X x x TELECOMMUNICATIONS, AUTOMATION INFORMATION SYSTEMS, AND NETWORK SECURITY MO 13526 REQUIREMENTS) 55. 56. Consistent with section 4.1(f) of E.O. 13526 and section 2001.50 of title 32, CFR, have uniform procedures been established to ensure that automated information systems that collect, create, communicate, compute, disseminate, process or store classified or controlled unclassified information are protected in accordance with applicable DoD policy issuances? Have procedures been established and implemented to: â€¢ Prevent access by unauthorized persons; â€¢ Ensure the integrity of the information; â€¢ TO the maximum extent practicable, use: 1) Common information technology standards, protocols, and interfaces that maximize the availability of, and access to, the information in a form and manner that facilitates its authorized use; and 2) Standardized electronic formats to maximize the accessibility of information to persons who meet the criteria set forth in section 4.1(a) of E.O. 13526. UNCLASSIFIED 13 x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TULE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. 57. 58. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM Have procedures been established to ensure that unclassified copiers connected to the Internet are not used for classified reproduction? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are modems, telecommunications capabilities and network connections disabled on copiers approved for classified reproductions? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are classified hard drives removed from classified reproduction equipment prior to maintenance? (DOOM 5200.01-M, Vol 3, End 7, para 10) Are cameras and microphones disabled on all hardware used for classified processing, in classified spaces, or connected to networks in classified spaces? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) x x x X REPRODUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) 59. Are procedures established to oversee and control the reproduction of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b ) 60. Are personnel, who reproduce classified, aware of the risks involved with the specific reproduction equipment and the appropriate countermeasures they are required to take? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(2)) 61. Are waste products generated during reproduction properly protected and disposed of? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(6)) 62. Is reproduction equipment specifically designated for the reproduction of classified material? (DoDM 5200.01-M, Vol 3, End 2, para 5.b.(7)) 63. [Optional] Are RULES POSTED on or near the designated equipment authorized for the reproduction of classified? (DoDM 5200.01-M, Vol 3, Encl 2, para 15) 64. [Optional) Are NOTICES prohibiting reproduction of classified POSTED on equipment used only for the reproduction of unclassified material? (DoDM 5200.01-M, vol 3, Encl 2, para 15) â– 65. 66. x x x X x x DISPOSITION AND DESTRUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) Has each activity with classified holdings set aside at least one "Clean-Out" day each year when specific attention and effort is focused on disposition of unneeded classified material? (DoDM 5200.01-M, VoI3, Encl 3, para 17.b) Is classified materials properly destroyed by approved methods? (DOOM 5200.01-M, Vol 3, Encl 3, para 17 &18) x x TRANSMISSION AND TRANSPORTATION OF CLASSIFIED INFORMATION (EO 13526 REQUIREMENTS) 67. Whenever classified information is transmitted outside of the activity is it enclosed in two opaque sealed envelopes or similar wrappings or containers durable enough to properly protect the material from accidental exposure and facilitate detection of tampering? (DOOM 5200.01-M, Vol 3, Encl 4, para 9) â€¢ NOTE: When classified material is hand-carried outside an activity, a locked briefcase may serve as the outer wrapper. UNCLASSIFIED 14 x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTNITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM 68. Is the outer wrapper addressed to an official government activity or to a DOD contractor with a facility clearance and appropriate storage capability with a complete return address of the sender? (DoDM 5200.01-M, Vol 3, Encl 4, para 9.a.(1)) 69. Is the inner wrapper or container marked with the following information: sender's and receiving activity's address and highest classification level of the contents (including where appropriate, any special markings)? (DoDM 5200.01-M, Vol 3, End 4, para 9.a.(2)) â€¢ NOTE: The inner envelope may have an "attention line" with a person's name. 70. Are procedures established to limit the hand carrying of classified information to only when other means of transmission or transportation cannot be used? (DoDM 5200.01-M, Vol 3, End 4, para 11.a) 71. Are hand-carrying officials briefed on and have they acknowledged their responsibilities for protecting classified information? (DoDM 5200.01-M, Vol 3, Encl 4, para 11.c) 72. Are courier officials provided a written statement authorizing such hand carrying transmission? (DOOM 5200.01-M, Vol 3, Encl 4, para 12) â€¢ [Optional] Does the activity list all classified carried or escorted by traveling personnel? (DoDM 5200.01-M, VoI3, Encl 4, para 11) â€¢ [Optional] Does the activity keep this list until all material reaches the recipient's activity? (DoDM 5200.01-M, Vol 3, End 4, para 11) 73. When "Confidential" classified information is sent U.S. Postal Service "First Class" mail between DOD Components within the United States, is the outer envelope or wrapper endorsed "POSTMASTER: RETURN SERVICE REQUESTED"? (DOOM 5200.01-M, Vol 3, Encl 4, para 5.d 1 74. Do recipients of First Class mail bearing the "Postmaster" notice protect it as Confidential material? x x x x x X x x x SECURITY EDUCATION (E0 13526 REQUIREMENTS) 75. 76. 77. 78. 79. 80. , Has the Component Senior Agency Official established a Security Education program? (DoDM 5200.01-M,Vol 1, Encl 2, para 7.g ) Has the activity security manager implemented the security education and training program within the activity? (DoDM 5200.01, Vol 1, Encl 2, para 9.f) Have all personnel been trained on policies for classification, safeguarding and declassification? Do all personnel who perform derivative classification receive training every 2 years? (DoDM 5200.01-M, Vol 3, Encl 5, para 7.c) All original classification authorities (OCA) must receive training in proper classification and declassification at least once a calendar year. (DoDM 5200.01-M Volt, Encl 4, para 5.d and Vol 3, Encl 5, para 5) Does this training program include an "Initial Orientation" for all assigned personnel who are cleared for access to classified information? (DoDM 5200.01-M, Vol 3, End 5, para 3) Does this orientation include the: (DOOM 5200.01-M, Vol 3, End 5, para 3) UNCLASSIFIED 15 x x x x x . UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITYIRJ NicnomAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OP R DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ â– x x x x â€¢ x x x x x x x x x x x SECURITY INCIDENTS AND VIOLATIONS TO INCLUDE COMPROMISES MO 13526 REQUIREMENTS) 88. Are assigned members trained on of their responsibilities to report security violations concerning classified information? (DOOM 5200.01-M, Vol 3, End 6, para 3.b) 89 Are there procedures to conduct an inquiry/investigation of a loss, possible compromise, or unauthorized disclosure of classified information? (DoDM 5200.01-M, Vol 3, Encl 6, para 6) - UNCLASSIFIED 16 x x 7 Roles and responsibilities of assigned members and key personnel? Elements of safeguarding classified information? Elements of classifying and declassifying information? 81 . Is additional training provided for members who: (DOOM 5200.01-M, Vol 3, End 5, para 4.b & c) â€¢ Are members of deployable organizations, to provide enhanced security training to meet the needs of the operational environment? â€¢ Will be traveling to foreign countries? â€¢ Will be escorting, hand carrying, or serving as a courier for classified material? â€¢ Will use automated information systems to store, process, or transmit classified? â€¢ Will have access to information requiring special control or safeguarding measures? â€¢ Will be using Foreign Government Information or work in coalition or bilateral environments? â€¢ Submit information to OCAs for original classification decisions? 82. Is Refresher training provided at least annually to assigned members? (DOOM 5200.01-M, Vol 3, Encl 5, para 7.a) 83. Is Refresher training tailored to the mission needs and address policies, principles and procedures covered in initial training? (DoDM 5200.01-M, Vol 3, End 5, para 7.a) 84. Does Refresher training address concerns identified during Component SelfInspections? (DOOM 5200.01-M, Vol 3, End 5, para 7.a) 85. Are procedures established to ensure cleared employees who leave the organization or whose clearance Is terminated receives a termination briefing? (DoDM 5200.01-M, Vol 3, End 5, para 9) 86. Are records maintained to show the names of members who participated in "Initial" and "Refresher" training? (DoDM 5200.01-M,Vol3, Encl 5, para 11 ) 87. Do training programs for "Uncleared" members include: (DoDM 5200.01-M, Vol 3, Encl 5, para 3) â€¢ The nature and importance of classified information? â€¢ Actions to take if they discover classified information unprotected? â€¢ The need to report suspected contact with a foreign intelligence collector? UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST IITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 90. 91. 92. National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM Are appropriate and prompt corrective actions taken when a violation or infraction occurs? (DoD 5200.01-M, Vol 3, Encl 6) Are inquiries and/or investigations promptly conducted to ascertain the facts surrounding reported incidents? (DoDM 5200.01-M, VoI3, Encl 6, para 6) Are individuals who commit violations or infractions subject to appropriate sanctions? (DOOM 5200.01-M, Vol1, Encl 3, para 17 and VoI3, Encl 6, para 8.b & 14) UNCLASSIFIED 17 x X x UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 NRO Explanation of N/A Responses on 2012 Information Security Program Self-inspection Checklist Item 1. Comment The DNRO appoints the DOS&CI as responsible for NRO security. The DOS&CI appoints a Government Program Security Officer (GPSO) as the head of each Directorate or Office activity who implements the provisions of the NRO Security Program. For each contractor, an NRO Contractor Program Security Officer (NCPSO) is nominated by the contractor and approved by the DOS&CI. The NCPSO is a senior Contractor PSO responsible and accountable for the security oversight of all NRO program activities at their company or corporation. 2. All security instructions are signed by the DOS&CI 5. Equivalent training is provided 6. Security evaluations and self-inspections are centrally managed under the DOS&CI. The DOS&CI is informed of the results of such inspections. 7. Security-related training will be documented in the Personnel Security File or in a listing of all personnel who completed the training 9. Yes, in areas where political instability, terrorism, host country attitude, or criminal activity suggests the possibility that a SCIF may be overrun by hostile forces. 11. If the security manager has a COOP mission, essential materials are in place at the alternate location. 12. The NRO cannot approve OCAs so we cannot delegate OCA responsibilities. 16. The NRO does not use Downgrading markings. 21. NRO personnel do not have the authority to create NATO information. 28. Most SCIFs are open storage and do not require the use of cover sheets. 38. Most SCIFs are open storage and do not require the use of cover sheets. 40. SF 701 may be used or locally designed forms may be used 41. SF 702 may be used or locally designed forms may be used 45. Yes, at the SCI level, except for SAR where the holder does not have access to the SAR compartment nor the physical area housing the container. UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Please note: The best way to view the report "Agency Annual Self-Inspection Program Data: FY 2013" (attached to this explanation) is in softcopy because several of the expandable fields have text that is hidden when viewed in hardcopy. The full text of entries that exceed the viewable space of expandable fields is included below for ease of reading, however, only the softcopy form will be submitted to OUSD(I). 3. Enter the name, title, address, phone, fax, and e-mail address of the Senior Agency Official (SAO) (as defined in E.O. 13526, section 5.4(d)) responsible for this report. Mr. Frank Calvelli Principal Deputy Director, NRO Room 14675 Lee Road, Chantilly, VA 20151 (b)(3) 10 USC 424 FAX (b)(3) 10 USC 424 (b)(3) 10 USC 424 13. What means and methods are employed in conducting self inspections? (For example: interviews, surveys, data calls, checklists, analysis, etc.) - NRO self-inspections are part of the NRO ISAP. Because of the total NRO workforce and have the contractors make up overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identify and address security vulnerabilities, provide data for analysis, and identify system security issues and trends. Site personnel conduct/document security self-assessments, per requirements stated in the NRO Security Manual (NSM) at least annually. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, 1 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. After the on-site assessment, an out-briefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of the report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 291 selfassessments were received and 10 formal team assessments were performed. No additional formal specific-issue reviews were conducted. There were an additional 742 visits by OS&CI stakeholders to contractor SCIFs. In addition, a data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 20. Describe below how the agency identifies activities and offices whose documents are to be included in the sample of classification actions. (Indicate if NA.) Based on the 291 site self-assessments submitted, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal 2 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. Additionally, several types of documents at NRO headquarters are reviewed annually by CMOs and PSOs for proper classification and marking. A data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 22. How do you ensure that the materials reviewed provide a representative sample of the agency's classified information? (Indicate if NA.) Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. The data call conducted with NRO Headquarters PSOs and CMOs for item 87 and 88 represents all documents they reviewed during FY 2013. 31. How is the self-inspection program structured to assess individual agency activities and the agency as a whole? Contractor SCIF locations far outnumber government SCIF locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractor facilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. 3 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 35. What is the format for documenting self-inspections in your agency? Self-assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an outbriefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. 47. Safeguarding: Regular conduct of exercises provides vital feedback to the physical security program. Exercises identify areas for corrective measures, enhancements, validate current tactics, techniques and procedures (TTP) and the adoption/employment of new TTP to meet a dynamic threat environment. Regular inspections/audits are essential to ensuring status and validity of issued IC badges and conformity to physical security requirements. Risk assessments/physical security assessments provide a helpful "outside" perspective to site security offices. NRO government and contractor personnel work in SCIFs equipped with secure telephones, FAX, and teleconferencing equipment, badges and badge readers, guard forces in several locations, document shredders and other features to ensure compromises of classified information do not occur. While the insider threat is always a possibility, we take every precaution to prevent security incidents from occurring. The NRO applies uniform procedures established by the Intelligence Community Directive (ICD)-503 family of policy and guidance for Information Technology Systems Security Risk Management and Assessment and Authorization (A&A) activities. 4 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 48. Security Violations: The ISAP program is the formal mechanism by which we corroborate self - inspections. Included in these formal reviews is an assessment of the respective security violation program and trends. In addition, each component Security team evaluates Security incidents and violations by tracking them according to general broad categories. During this past FY, the majority (63%) of incidents/violations were related to categories within personnel electronic devices in SCIFs. Other categories that have multiple occurrences indicating potential trends are data spills (9%) and inadvertent removal of classified information (12%). Personal cell phones and prohibited electronic devices are not allowed in SCIFs. While we have installed lockers outside SCIFs to secure cell phones, entry of prohibited electronic devices into SCIFs is still a problem. Visitor attendance to NRO conferences/facilities result in numerous cell phones being brought into the conference even by individuals with security duties who should know better. 49. Security Education and Training: 100% of personnel assigned to the NRO are required to complete an SCI indoctrination briefing to include signing a NonDisclosure Agreement. E.O. 13526 is called out specifically so that personnel fully understand their responsibilities and requirements to protect classified information. This message is repeated by the release of awareness videos and reminders throughout the year; to include presentations, written materials, and training. Specifically, OS&CI incorporates classification management questions within the Annual Security Refresher (ASR) web-based training (WBT). In 2014 ASR will include additional Derivative Classification questions. With as many contractors as the NRO employs, training can be a major expense. Every contractor and government employee with a secure computer account is required to take the Annual Security Refresher training otherwise they lose their computer connection. There are numerous additional courses and specialized security training available on-line even though sequestration has reduced training manpower overall to include elimination of the Information Management Branch which ran the OS&CI web site and security-specific applications. 5 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 50. Management and Oversight: Government oversight of NRO-sponsored SCIFs is achieved in a multi-faceted manner. Program Security Officers, Physical/Technical, and Computer Security Officers review selfassessment results and participate in on-site reviews. Some program findings for FY 13 were identified in the following areas: â€¢ Standard Operating Procedures (SOPs) require more detail and more frequent revision to stay up-to-date with security requirements. â€¢ Foreign travel and contact reporting were not always accomplished using the mandated NRO Counterintelligence Network (CINet). â€¢ There are undocumented information systems within facilities. â€¢ Not all employees with AIS privileged user type access have been identified and tracked. â€¢ Facility alarm test records are not always maintained for the required time period. â€¢ Red/Black cabling is not labeled for identification. 54. Safeguarding: Awareness and education programs are vital to ensuring the workforce maintains awareness of security policy and procedures. Regular and aperiodic exercises, inspections, and audits provide crucial inputs that are indispensable to ensuring that the physical security program is current and effective. Key challenges are maintaining adequate funding to replace aging, malfunctioning, and obsolete security equipment and training and education for new personnel. The NRO has an organization-level process for the Assessment and Authorization (A&A) of Information Systems and a Directive 51-1, "Information Technology, Information Assurance, and Information Management Architecture and Strategy for Certification and Accreditation" to ensure automated information systems that collect, create, communicate, compute, disseminate, process or store classified information are protected in accordance with applicable national policy issuances. 6 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 55. Security Violations: The NSM details the NRO process for reporting and investigating security incidents, infractions and violations. Appropriate and prompt corrective actions were taken to.mitigate the severity of the infraction/violation, and to sanction the offender via management, counterintelligence, and personnel security processes. Infractions and violations are centrally tracked in the Security Log (the NRO incident/violation database). This database is managed by the Program Security Officers in each directorate and office, and enables the PSO to automatically notify Counterintelligence Division and Personnel Security Division, via a system generated e-mail, of infractions/violations that require immediate CI and/or personnel security attention. The database also enables both OS&CI management as well as individual PSOs to track and analyze trends linked to the various categories of security infractions/violations. 56. Security Education and Training: OS&CI works closely with PSOs, Counterintelligence personnel, and the Integrated Self Assessment Program to determine any trends or specific areas that need an additional educational awareness campaign. Security communications are then targeted, utilizing large scale efforts, per a topic area and audience for best impact results. The NRO is adding additional classification management questions to the Annual Security Refresher to better satisfy the derivative classification training requirement. OCAs complete yearly training provided by NRO/OS&Cl/Policy Branch with direct knowledge of current CAPCO guidelines. 57. Management and Oversight: The NRO has a very mature Security management and oversight program. Over the past FY, much greater emphasis has been placed on ensuring all sites and facilities accomplished the self-assessments and submited the findings to the Government within the mandated time requirements. This improved management oversight has made an impact. Our self-inspection program coupled with security officer visits, and formal team 7 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessments provide managers a report card on the health of our security programs. When negative trends are identified, managers from across industry and the Government develop corrective action plans to reverse the trends and ensure security requirements are met. Impacts are being felt to overall security programs due to reductions in security resources. While security requirements are increasing, especially in the area of information systems management, resources are being reduced. Additionally, some sites assessed have made decisions not to fully comply with a security requirement because of resource constraints. 8 UNCLASSIFIED

1 0

Annual Self-Inspection Report
by None 06 Jul '18

06 Jul '18

(a) OUSD(I) Memorandum, Annual Senior Agency Official (SAO) Self-Inspection Program Report for Classified National Security Information, 2 October 2012 (b) Memorandum of Agreement between the Secretary of Defense and the Director of National Intelligence concerning the National Reconnaissance Office, 21 September 2010 (c) DoDI 5200.01, DoD Information Security Program and Protection of Sensitive Compartmented Information, 9 October 2008 The National Reconnaissance Office (NRO) is providing the attached Self-Inspection Report as requested in reference (a). In accordance with Director, National Reconnaissance Office authorities in reference (b) and (c) it should be noted that the NRO does not administer a standard DoD Information Security Program based on DoDM 5200.01-V1 thru V3 and, therefore, some of the items in the attached checklist are not applicable and have been noted as such. My point of contact for questions concerning this submission is (b)(3) 10 USG 44- . Jamieson Burnett irector, Office of Security and Counterintelligence Attachment: NRO Annual Self - Inspection Report for 2012 UNCLASSIFIED UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACMATWFUNCRONAL AREA Information Security Program Self-Inspection Checklist NO. STEM NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office 045 R DATE Security Manager 11 October 2012 EO 13526 CLASSIFIED NATIONAL SECURITY INFORMATION AND IMPLEMENTING DIRECTIVE REQUIREMENTS PART 1. DESCRIPTION OF SELF-INSPECTION PROGRAM: A description of the DoD Components self- inspection program should include activities assessed, program areas covered, and methodology utilized. The description must demonstrate how the self-inspection program provides the senior agency official with the information necessary to assess the effectiveness of the classified national security information program within the individual Component activities and the Component as a whole. It should include the following: 1. Responsibility for the program: (1) Whom does the senior agency official designate to assist in directing and administering the self-inspection program? Answer . The Director of Security and Counterintelligence (DOS&CI) is provided a Letter of Instruction by the Director, NRO which assigns his responsibilities. (2) How is the program structured to provide the senior agency official with the information necessary to assess the agency's classified national security information program? Answer: The DOS&CI advises the Senior Agency Official (SAO) when the DOS&CI believes events warrant advising the SAO. The NRO Integrated Security Assessment Program (ISAP) results are also reported to the SAO thru the annual Management Control Plan Statement of Assurance (MCPSOA). (b)(3) 10 USC 424 (3) Who conducts the self-inspections? Answer: NRO self-inspections are part of the NRO ISAP. Because contractors make upgAof the total NRO workforce and have the overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identifi , and address security vulnerabilities, provide datfornlysi,findings e tmcuriyseand.Th may lead to identification and definition of risk mitigation practices, and enable sharing of best security practices across government and industry. The primary purpose of the ISAP is to ensure the proper safeguarding of classified information through a single comprehensive review by various components of the Office of Security and Counterintelligence (OS&CI). ISAP integrates reviews utilizing program security, classification management, transportation and transmission of classified information, physical and technical accreditation, information systems security, personnel security, and Counterintelligence (CI) perspectives. The integrated assessment evaluates implementation of and ensures compliance with, established security policies, procedures, and plans at all NRO government and contractor location& Site personnel conduct/document security self-assessments per requirements stated in the NRO Security Manual (NSM). Security Officers will conduct self-assessments of their SCIFs at least annually. For the reporting period there were 343 site self-assessments. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required OS&CI stakeholders represent the major OS&CI divisions and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers, and Security Certification Officers. Stakeholders will develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board Sites are selected based on ring proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. An out-briefing is provided to site security site - and other site senior management identfying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actionsto be taken within 90 days of the date of UNCLASSIFIED 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLESUBJECT/ACTIVITY/FUNCT1 ONAL AREA Information Security Program Self-Inspection Checklist NO. I NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 16 formal team assessments were performed An additional 9 formal specific-issue reviews were conducted There were an additional 1,491 visits by OS&CI stakeholders to contractor SCIFs. (4) How is the senior agency official involved in the program? Answer: The DOS&CI keeps the SAO advised of trends and issues developed by the ISAP. The NRO ISAP results are also reported to the SAO thru the annual MCPSOA. 2. Approach: (1) What means and methods are employed in conducting self-inspections? Answer: For formal assessments, the Assessment Team evaluates implementation, and ensures compliance with, established NRO security policies, procedures, and plans. (2) Are different types of self-inspections conducted? If so, describe each of them. Answer: Formal assessments will vary based on the experience of the lead PSO and the stakeholders with the facility and items noted in the self-evaluation report as well as the areas of responsibility of the attending subject matter experts. However, the objective for all is to identify and address security vulnerabilities, provide data for analysis, and identift system security issues and trends. (3) Do the self-inspections evaluate adherence to the principles and requirements of E.O. 13526 and its implementing directive and the effectiveness of agency programs covering: â€¢ Original classification? Answer: Since Original Classification items only apply to 13 government employees who are Original Classification Authorities (OCA) at NRO Headquarters, a formal tasking is sent to Program Security Officers supporting the OCA to determine the date the OCA received their annual briefing and the number of original classification decisions they made during the reporting period. Experience has shown that not all of the OCAs make individual OCA decisions every year but most require their authority to sign classification guides for their area of responsibility. For the reporting period there, nine OCA decisions were made. â€¢ Derivative classification? Answer: Included. In NRO Implementing Instructions released on 31 May 2011, derivative classifiers were instructed to include in the classification block a personal identification number rather than their name to protect their identity and association with the NRO. This "Classification ID (CLID)" number exists in the NRO Access Database so the specific individual with that number can always be identyled Employees of other agencies, who already have an ID number assigned by their parent agency, will use that number instead Headquarters NRO derivative classifiers have their PSO available for questions regarding classification and marking and to review their derivatively classified documents for format and accuracy of classffication and marking. Available on the OS&CI website are the Order, Information Security Oversight Office (IS00) Implementing Directive and Marking booklet, videos and documents that explain the correct way to classify and mark documents, the Controlled Access Program Coordination Office (CAPCO) register and manual, over 120 Frequently Asked Questions with answers that are posted about portion marking a Security Policy hotline that will answer their questions in real-time, and numerous other experts who are available to answer their questions. Once the document is distributed, they face additional scrutiny from any security or classification management officer who reads it or from subject matter experts who point out classification and marking errors to security officers. The ISAP team visiting a site will review a sample of derivatively classified documents to point out errors in classification and marking, omissions of required information, and to make suggestions for improvement. â€¢ Declassification? Answer: The NRO has a formal declassification program which restricts to one office the authority to officially declassify NRO information and release it to the public, and which is not included in the self-inspection program. The results of this program are reported in the SF 311 report provided to USD(I) in October 2012. The NRO Declassification Guide (known as the Review and Redaction Guide) is updated and approved by the UNCLASSIFIED 2 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUEWECT/AC71VITY/FUNCT1ONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 1 1 October 2012 ITEM DNRO each year. It is currently undergoing review by the Interagency and is expected to be approved by the end of 2012. â€¢ Security Classification Appeals Panel Safeguarding? Answer: Included â€¢ Security violations? Answer: Included â€¢ Security education and training? Answer: Included â€¢ Management and oversight? Answer: Included (4) Do the self-inspections include a review of relevant security directives and instructions, as well as interviews with producers and users of classified information? Answer: All directives and instructions are issued by the DOS&Cl and are reviewed and updated annually. All directives and instructions are maintained on-line and are accessible to all government employees and contractors. (5) Do the self-inspections include reviews of representative samples of your Component's original and derivative classification actions? â€¢ Do these reviews encompass all Component activities that generate classified information? Answer: There are hundreds of individual activities that can generate classified information. While the annual self-assessment questionnaire covers 343 of these activities, the ISAP formal assessment inspects only a small percentage of these activities yearly. However, the Program Security Officers, Contractor Program Security Officers, and Classification Specialists review hundreds of classified documents yearly and provide direction to originators to correct those that are improperly marked. o How do you identify the activities to which this applies? Answer: Site personnel conduct/document security self-assessments per requirements stated in the NSM â€¢ Do the reviews include a sampling of various types of classified information in document and electronic formats? o How do you ensure that the materials reviewed provide a representative sample of the Component's classified information? Answer: Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. o How do you determine that the sample is proportionally sufficient to enable a credible assessment of your Component's classified product? Answer: We do not attempt to do this as it would increase costs to the NRO (as explained above). â€¢ Who conducts the review of the classified products? o Are they knowledgeable of the classification and marking requirements of E.O. 13526 and its implementing directive? Answer: Yes o Do they have access to pertinent security classification guides? Answer: Yes â€¢ Have appropriate personnel been designated to correct misclassification actions? If so, identify. Answer: All Program Security Officers and Classification Managemeni Specialists are authorized to correct misclassification, incorrect use of SCI channels, and incorrect dissemination restrictions. 3. Frequency: (1) How frequently are self-inspections conducted? Answer: Annually. (2) What factors were considered in establishing this time period? Answer: Time period is defined in the NSM. UNCLASSIFIED 3 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office CPR DATE Security Manager 11 October 2012 ITEM 4. Coverage: (1) How do you determine what program elements and Component activities are covered by your self-inspection program? Answer: Self-assessments are to be completed on each contractor SCIF. (2) What Component activities are assessed? Answer: All contractor activities are assessed. (3) How is the program structured to assess individual Component activities and the Component as a whole? Answer: Contractor locations far outnumber government locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractorfacilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. (4) If your Component has any special access programs (SAP), are self-inspections of the SAP programs conducted annually? Answer: Most SAPs are reviewed as part of the ISAP program. The ISAP formal assessment team has PSOs assigned that are briefed for most SAPs. In addition. the NRO conducts special annual reviews (in some cases. semi-annual) of the entire Sensitive Activities portfolio. o o Do the self-inspections confirm that the Component head or principal deputy has reviewed each special access program annually to determine if it continues to meet the requirements of E.O. 13526? Answer: The NRO's entire Sensitive Activities portfolio is reviewed and briefed annually to the DNI's Senior Review Group (SRG) who then reports to Congress. Do the self-inspections determine if officers and employees are aware of the prohibitions and sanctions for creating or continuing a special access program contrary to the requirements of E.O. 13526? Answer: Yes. In keeping with E.O. 13526, all Sensitive Activities' compartments that are established terminated, or transitioned (to another program or lower classification) require NRO Special Activities Management Board review and approval, followed by notification to the DNI's Senior Review Group/Controlled Access Program Oversight Committee. 5. Reporting: (1) What format for documenting self-inspections in your Component? Answer: Self assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an out-briefing is provided to site security staff and other site senior management identi&ing security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the DOS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. (2) Who receives the reports? Answer: The OS&CI ISAP Manager. (3) Who compiles/analyzes the reports? Answer: The ISAP Manager and the responsible PSO analyze the report. (4) How are the findings analyzed to determine if there are problems of a systemic nature? Answer: The ISAP Manager provides to the sponsoring Government Program Security Officer (GPSO) for review and subsequent action. (5) How and when are the results of the self-inspections reported to the senior agency official? Answer: The DOS&CI determines when results warrant informing the SAO. (6) How is it determined if corrective actions are required? Answer: The GPSO and security stalceholder(s) review. UNCLASSIFIED 4 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECTIACTIVITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security ITEM DATE Manager 11 October 2012 I I (7) Who takes the corrective actions? Answer: The assessed site. (8) How are the findings from your Component's self-inspection program distilled for the annual report to the Director o f ISOO? Answer: The OS&CI Security Policy Staff (SPS) tasks the ISAP Manager to distill the findings and provide them to SPS for inclusion in the annual report. Self-Inspection Program Description here: Description include in italics under questions above. PART 2. ASSESSMENT & SUMMARY: ASSESSMENT The assessment is an evaluation of the state of each element of your componenVs classified national security information program based on an analysis of the findings of the selfinspection program. It should consider if the program element is being effectively implemented in accordance with the Order and Directive and DoD 5200.01-M. It should consider whether the findings indicate that the regulation or other policies or procedures may need to be updated, and it should take into account other program information such as the Standard Form 311, "Agency Security Classification Management Program Data." If a particular element does not apply to a component (e.g., original classification authority) the report should explain this. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations: Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory SUMMARY: The summary should report the findings from the self-inspection program within each of the program areas. This information should support the assessment. â€¢ Original classification Rating: Satisfactory â€¢ Derivative classification Rating: Document creation: Satisfactory Training: Deficient due to cost â€¢ Declassification Rating: Satisfactory â€¢ Safeguarding Rating: Satisfactory â€¢ Security violations Rating: Satisfactory â€¢ Security education and training Rating: Satisfactory except for Derivative Classifier training which is not required due to cost â€¢ Management and oversight Rating: Satisfactory Assessment & Summary here: included in italics under headings above. UNCLASSIFIED 5 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACT1VITYIFU KnONAL AREA Information Security NO. Program Self-Inspection Checklist NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 201 2 ITEM PART 3. FOCUS QUESTIONS: FOCUS QUESTIONS: Answer the following focus questions. (1) Training for original classification authorities. (This applies only to Components with original classification authority). (1) Original classification authorities are required to receive training in proper classification and declassification each calendar year (5200.01-V?). What percentage of the original classification authorities at your Component has received this training? (2) Have any waivers to this requirement been granted? Answer: 100% of NRO OCAs have received training. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (2) Training for persons who apply derivative classification markings. (1) Persons who apply derivative classification markings are required to receive training in the proper application of the derivative classification principles of the E0 13526 prior to derivatively classifying information and at least once every two years thereafter. What percentage of the derivative classifiers at your Component has received this training? (2) Have waivers to this requirement been granted? Answer: Percentage unknown. The DSS and CAPCO Derivative Classifier training is available through the NRO computer network; however, NRO has not made this training mandatory because of the cost of two hours of direct labor charged by each contractor. No waivers have been granted. FOCUS QUESTIONS: Answer the following focus questions. (3) Initial training. (1) All cleared agency personnel are required to receive initial training on basic security policies, principles, practices, and criminal, civil, and administrative penalties. What percentage of these personnel at your Component has received this training? Answer: 100% of new employees have received initial training. FOCUS QUESTIONS: Answer the following focus questions. (4) Refresher training. (1) Components are required to provide annual refresher training to all employees who create, process, or handle classified information. What percentage of these employees at your Component has received this training? Answer: 100% of employees have received refresher training. FOCUS QUESTIONS: Answer the following focus questions. (5) Identity of persons who apply derivative classification markings. (1) Derivative classifiers must be identified by name and position, or by personal identifier on each classified document. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: NRO personnel are directed to use a personal identifier. 100% of documents have met this requirement. The number of documents reviewed is unknown. FOCUS QUESTIONS: Answer the following focus questions. (6) List of multiple sources. (1) A list of sources must be included on or attached to each derivatively classified document that is classified based on more than one source document or classification guide. What percentage of the documents sampled meet this requirement? (Also, indicate the number of documents reviewed for this requirement.) Answer: 100% of documents have met this requirement. The number of documents reviewed is unknown. UNCLASSIFIED 6 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST T1 TLEPAIBJECT/ACT1VITY1FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM FOCUS QUESTIONS: Answer the following focus questions. (7) Performance evaluations. (1) The performance contract or other rating system of original classification authorities, security managers, and other personnel whose duties significantly involve the creation or handling of classified information must include a critical element to be evaluated relating to designation and management of classified information. What percentage of such personnel at your Component has this element in their performance contracts? Answer: The NRO is comprised of government individuals from various agencies. Parent agencies set the rules for their performance contract or rating system. Based on the rules for each parent agency, approximately 40% have this element in their performance contract PART 4. DISCREPANCIES: Specific information with regard to the findings of the annual review of the Component's original and derivative classification actions to include the volume of classified materials reviewed and the number and type of discrepancies identified. 1. "Discrepancies" are instances when the classification and/or marking requirements of the Order, Directive and Agency regulation are not met. Among these are: (1) Overclassification: information does not meet the standards for classification. (2) Overgraded/Undergraded: Information classified at a higher/lower level than appropriate. (3) Declassification: Improper or incomplete declassification instructions or no declassification instructions. (4) Duration: A shorter duration of classification would be appropriate. (5) Unauthorized classifier: A classification action taken by someone not authorized to do so. (6) "Classified By" line: A document does not identify the OCA or derivative classifier by name and position or by personal identifier. (7) "Reason" line: An originally classified document does not cite a reason from section 1.4 of the Order. (8) "Derived From" line: A document fails to cite, or cites improperly, the classification source. The line should include type of document, date of document, subject, and office/agency of origin. (9) Multiple sources: A document cites "Multiple Sources" as the basis for classification, but list of these sources is not included on or attached to the document. (l0)Marking: A document lacks overall classification markings or has improper overall classification markings. (I 1 ) Portion Marking: The document lacks required portion markings. (12) Instructions from a classification guide are not properly applied. For additional information on marking, consult the l)oDM 5200.01-V2. List identified program deficiencies here. Also list actions taken or are planned to correct identified program deficiencies, marking discrepancies, or misclassification actions, and to deter their reoccurrence: Answer: Improper application of portion marking. Individuals will receive additional training and review of their documents by security officers. PART 5. BEST PRACTICES: List best practices that were identified during self inspections here: - Comprehensive security database developed which reflects final adjudication and investigation of security incidents - SCIF decertification process assembled consisting of: -- SCIF decertification checklist -- Sanitization steps for offices -- SCIF decertification roles and responsibilities - The self-assessments, methodology, and supporting application is a model for other industry sites - Comprehensive Open/Close procedures - Plexiglas inspection window and inspection ports for checking penetration of perimeter by HVAC, wiring, etc. - DoD SELF INSPECTION PROGRAM REQUIREMENTS: This portion of the checklist meets specific - requirements for a standard DoD Information Security Program based on the DoDM 5200.01-V1 thru V3. Please answer the following questions below. NO.PROGRAM MANAGEMENT (EO 13526 REQUIREMENTS) I YES I NO I N/A UNCLASSIFIED 7 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. IL National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager ITEM Has the head of each activity in the Component appointed a security manager to manage and implement the activity's information security program which implements the provisions of DoDM 5200.01-M? (DoDM 5200.01-M, Vol 1, End 2, para 8.b & 9.a) Does the Component Head develop and implement, through the security manager, security instructions necessary for program implementation? (DoDM 5200.01-M, Vol 1, Encl 2, para 9.d) Are sufficient resources and personnel committed to implement the classified national security information security program? (DOOM 5200.01-M, Vol 1, Encl 2, para 6.d) Are OCAs delegated classification authorities in writing? (DoDM 5200.01-M, Vol 1, Encl 4, para 5.c) Has the security manager attended the required training? Note: Training and education shall be provided before, concurrent with, or not later than six months following appointment. (DoDM 5200.01-M, Vol 3, End 5, paras 4.a and 10) Does the security manager conduct security inspections (self-inspections)? (DoDM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Is the Component Head informed of the results of such inspection? Does the security manager establish, implement and maintain an effective security education program as required by DoDM 5200.01-M, Volume 3, Enclosure 5, to include initial orientation and continuing/refresher training for assigned members? (DoDM 5200.01-M, Vol 1, End 2, para 7.g & 9.f; Vol 1, Encl 3, Para 6.c; and Vol 3, Encl 5, para 7 & 8) â€¢ Do security managers document all security-related training? (DoDM 5200.01-M, Vol 3, End 5, para 11) Are procedures established to prevent unauthorized access to classified information? (DOOM 5200.01-M, Vol 1, End 2, para 7.e) â€¢ Note: Examples include implementing visitor controls, restricting combinations to cleared members, establishing end-of-day security checks, etc) Are emergency plans developed for the protection, removal, or destruction of classified material in case of fire, natural disaster, civil disturbance, or terrorist activities to minimize the risk of compromise? (DOOM 5200.01-M, Vol 1, Encl 2, para 9.d) Are procedures established for ensuring that all persons handling classified material are properly cleared and have a need-to-know? (DOOM 5200.01-M, Vol 1, End 3, para 11.a) Does the security manager maintain a continuity handbook? DATE 11 October 2012 x x x x x x x x x x x x x x ORIGINAL CLASSIFICATION (EO 13526 REQUIREMENTS) 12. Are Original Classification Authorities (OCAs) trained on the process and requirements for original classification (DOOM 5200.01-M, Vol 1, Encl 4, para 6), to include? x Applicable standards and categories for classification? (D0DM 5200.01-m, x UNCLASSIFIED 8 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST ITTLE/SUBJECT/ACTIVITYTUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM 1, Encl 4, para 1) Levels of classification and damage criteria associated with each one? (DoDM 5200.01-M, Vol 1, Encl 4, para 3) â€¢ Avoidance of over - classification? (DoDM 5200.01-M, Vol 1, End 4, para 6.f) â€¢ Classification prohibitions and limitations? (DoDM 5200.01-M, Vol 1, Encl 4, para 2) â€¢ Required markings, including those for dissemination and handling? (DoDM 5200.01-M, Vol 1, Encl 4, para 6.h; Vol 2, Ends 3 & 4) â€¢ Determination of declassification instructions? (DoDM 5200.01-M, Vol 1, Encl 4, para 13.a) â€¢ Delegations of OCA responsibilities? (DoDM 5200.01-M, Vol 1, Encl 4, para 5 & 5.c) â€¢ Classification challenges? (DoDM 5200.01-M, Vol 1, Encl 4, para 22) 13. Have OCAs prepared, as appropriate, classification guides to facilitate the proper and uniform derivative classification of information? (DoDM 5200.01, Vol 1, Encl 4, para 6.h; Vo11, Encl 6, para 1) 14. Do the guides meet the requirements of section 2.2 of E.O. 13526 and section 2001.15 of title 32, Code of Federal Regulations (CFR)? Vol â€¢ X X X x x X x X DERIVATIVE CLASSIFICATION (EO 13526 REQUIREMENTS) 15. Are persons who apply derivative classification markings trained on the process and requirements for derivative classification (DoDM 5200.01-M, Vol 1, Encl 4, para 11 & 12), to include? â€¢ Identity of derivative classifier? (DoDM 5200.01-M, Vol 2, End 3, para 7 & 8.c. (1)(a)) â€¢ Use of source documents, including classification guides? (DoDM 5200.01M, Vol 2, Encl 3, para 8.c.(1)(b), 8.c.(2) & 8.c.(3)) â€¢ Declassification instructions? (DoDM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(d), 8.c.(4)-(9) & 9) â€¢ Proper application of markings? See Classification Markings/Document Review section below. (DoDM 5200.01-M, Vol 2, Encl 3 & 4) â€¢ Classification challenges (DoDM 5200.01-M, Vol 1, Encl 4, para 22) x x X X X CLASSIFICATION MARKINGS/DOCUMENT REVIEW (EO 13526 REQUIREMENTS) 16. Reviews of original and derivative classification actions shall be conducted in accordance with section 2001.60(c)(2) of title 32, CFR, and should evaluate the classification and marking of documents to include: (DOOM 5200.01-M, Vol 1, Encl 2, para 7.d) â€¢ Have the standards of classification been met? (DoDM 5200.01, Vol 1, Encl 4, para 1 & 2) â€¢ Could damage to the national security be reasonably expected in the event of unauthorized disclosure? (DoDM 5200.01, Vol 1, Encl 4, para 3) â€¢ Have the requirements for original classification of Part 1 of E.0.13526 or for derivative classification in Part 2 of E.O. 13526 been met? â€¢ Have the required markings been applied in accordance with E.O. 13526 and Subpart C of title 32, CFR? (DOOM 5200.01-M, Vol 2, para 3) UNCLASSIFIED 9 x X x x X 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTIVITY/FUNcnONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ Overall classification level (DoDM 5200.01-M, Vol 2, Encl 3, para 5) "Reason for Classification" line (originally classified documents only) (DoDM 5200.01-M, Vol 2, Encl 3, para 3.b.(1)(b) & 3.b.(4)) The Agency, Office or Origin, and Date (DoDM 5200.01-M, Vol 2, Encl 3, para 7) â€¢ â€¢ 17. 18. 19. 20. 21. 22. 23. 24. A "Derived From" line (DOOM 5200.01-M, Vol 2, Encl 3, para 8.c.(1)(b)) A "Classified By" line (DoDM 5200.01-M, Vol 2, Encl 3, para 8.b.(1)(a) & 8.c.(1)(a)) â€¢ identification of the sources of classification (DoDM 5200.01-M, Vol 2, End 3, para 8.c.(1)(b), 8.c(2), & 8.c.(3)) â€¢ "Declassify On" line (DoDM 5200.01-M,Vol 2, Encl 3, para 8.c.(d)) â€¢ Downgrading instructions, if required (DoDM 5200.01-M, Vol 2, Encl 3, para 8.a.(4)) â€¢ Page and Portion Markings (DoDM 5200.01-M, Vol 2, Encl 3, para 5 & 6) â€¢ Have any unauthorized or invalid markings been applied to documents? Are Agency personnel who conduct reviews of the agency's original and derivative classification actions trained on the classification and marking requirements of E.O. 13526, part 2001 of title 32, CFR, and DoDM 5200.01; and do they have access to pertinent security classification guides? Are "subjects" or "titles" of classified documents marked with the appropriate symbol (TS), (S), (C), or (U) following and to the left of the title or subject? (DoDM 5200.01-M, Vol 2, Encl 3. Para 6.e.(2) & 14) Is each section, part, paragraph, or similar portion of a classified document marked to show the highest level of classification of information it contains, or that it is unclassified? Portion of text shall be marked with the appropriate abbreviations (TS, S, C, or U). (DOOM 5200.01-M, Vol 2, Encl 3, para 6) Are portions within documents containing Restricted Data and Formerly Restricted Data marked with the abbreviation "RD" or "FRO" (e.g. S//RD or TS//FRD)? (DoDM 5200.01-M, Vol 2, Encl 4, para 8.a & 8.b) Are portions within documents containing foreign government or North Atlantic Treaty Organization (NATO) information marked with the foreign classification or NATO and the appropriate classification level (e.g. //GBR S or //NATO C)? (DoDM 5200.01-M, Vol 2, Encl 4, para 4) Is the abbreviation "FOUO" used to designate unclassified portions that contain information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA)? (DoDM 5200.01-M, Vol 2, Encl 4, para 10.b & Vol 4, End 3, para 2.c) Are charts, graphs, photographs, illustrations, figures, and similar items within classified documents marked to show their classification? (DoDM 5200.01-M, Vol 2, Encl 3, para 6.a & 18) Are the markings placed within the chart, graph, photograph, illustration, figure, etc. or next to the item? (DoDM 5200.01-M, Vol 2, End 3, para 6.e.(3) & 18) UNCLASSIFIED 10 .. x X X x x x x x x X x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE /SUBJECT/ACTIVITWFUNCTI ONAL AREA Information Security Program Self-Inspection Checklist NO. 25. 26. 27. 28. 29. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR Security Manager ITEM Is the highest classification level placed on the top and bottom of each page containing classified information or marked "unclassified"? (This is called the "banner line") â€¢ Do the markings stand out from the balance of the information on the page (must be readily visible)? (DoDM 5200.01-M, Vol 2, Encl 3, para 5) Are TRANSMITTAL documents properly marked to include either its highest classification or a notation "Unclassified when separated from classified enclosures"? (DoDM 5200.01-M, Vol 2, Encl 3, para 15) For ELECTRONIC documents: â€¢ Are e-mails, blog entries, bulletin board postings, and other electronic documents marked as finished documents, not working papers? (DoDM 5200.01-M, Vol 2, Enc 3, para 17.a.(2)) â€¢ Do e-mails include the appropriate banner line, portion markings, and classification authority block? Is the subject line portion mark the classification of the subject, not the overall classification of the e-mail? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.b) â€¢ Do classified URLs contain embedded portion marks? (DoDM 5200.01-M, Vol 2, Encl 3, para 17.d) â€¢ Are briefing slides, including any speaker notes and hidden slides, marked as required for text documents? (DoD 5200.01-M, Vol 2,Encl 3, para 16) â€¢ Are maps, charts, blueprints, photographs, and other special types of materials marked in the same fashion as for documents, to the extent feasible? (DoD 5200.01, Vol 2, Encl 3, para 18) Are Files, Folders, and Groups of documents clearly marked on the outside of the file or folder (attaching a classified document cover sheet to the front of the folder or holder will satisfy this requirement)? (DoDM 5200.01-M, Vol 2, Encl 2, para 4.a) Are removable storage media (e.g. magnetic tape reels, disk packs, diskettes, CD-ROMS, removable hard disks, disk cartridges, tape cassettes, etc.) marked with the appropriate Standard Form label (SF 706/707/708/710)? (DoDM 5200.01-M,Vol 2, Encl 2, para 4.b) DATE 11 October 2012 x X x x x x x x x x DECLASSIFICATION (EO 13526 REQUIREMENTS) 30. 31. Is there a records management system to facilitate public release of declassified documents? Are procedures established for automatic, systematic, discretionary, and mandatory declassification review? x x SAFEGUARDING AND STORAGE (EO 13526 REQUIREMENTS) 32. 33. 34. 35. Is the program designed and maintained to optimize safeguarding of classified information? Are there control measures to prevent unauthorized access to classified information? Are personnel aware of procedures for identifying, reporting, and processing unauthorized disclosures of classified information? Are there procedures to ensure that appropriate management action is UNCLASSIFIED 11 x x x x 1 UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM taken to correct identified problems? Are there methods for transmitting classified information, preparing it correctly for mailing, and for hand carrying or escorting classified material? 37. Is classified information removed from storage kept under constant surveillance of authorized persons? (DoDM 5200.01-M, Vol 3, Encl 2, para 8) 38. Are cover sheets placed on all documents removed from storage? (DoDM 5200.01-M, Vol 3, End 2, para 8) 39. Are end-of-day security checks established for areas that process or store classified information to ensure the area is secure at the close of each working day? (DOOM 5200.01-M, Vol 3, Encl 2, para 9) 40. Is the SF 701, Activity Security Checklist, used to record end-of-day checks? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 41. is the SF 702, Security Container Check Sheet, used to record the closing of each vault, secure room, or container used for storage of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 9) 42. Is the SF 700, Security Container Information, properly completed and posted inside the LOCKING drawer of the security container, or inside the door of vault and similar facilities? (DoDM 5200.01-M, Vol 3, Encl 3, para 10) 43. Are storage containers (safes) that may have been used to store classified information inspected by properly cleared personnel before removal from protected areas or before unauthorized persons are allowed access to them? (DoDM 5200.01-M, Vol 3, Encl 3, para 13) 44â€¢ Are combinations to security containers changed at the required intervals? (DoDM 5200.01-M, Vol 3, Encl 3, para 11.b) 45. If written records of the combination are maintained, are they marked and protected at the highest classification of the material stored therein? (DOOM 5200.01-M, Vol 3, Encl 3, para 11.a) â€¢ Is the combination stored in a security container other than the one for which it is being used? 46. Are entrances to secure rooms or areas under visual control at all times during duty hours to prevent unauthorized access or equipped with electric, mechanical or electromechanical access control devices to limit access during duty hours? (DoDM 5200.01-M, Vol 3, Encl 3, para 12.a) 47. Does each vault or container bear an external marking for identification purpose? NOTE: The level of classification stored therein must NOT be marked on the outside of the container(s). (DoDM 5200.01-M, Vol 3, Encl 3, Para 9) 48. is Top Secret material stored only in a GSA approved security container (safe) having one of the following supplemental controls: (DOOM 5200.01-M, Vol 3, Encl 3, para 3.a) â€¢ Guard or duty personnel cleared to the Secret level inspect the security container once every two hours â€¢ An Intrusion Detection System (alarm system) meeting requirements of para 2 of the Appendix to Encl 3 of DoDM 5200.01-M, Vol 3. 36. UNCLASSIFIED 12 x x x x x x x x x x x x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITY/FUNCTIONAL ARE A Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM â€¢ 49. so. 51. 52. 53. 3, 54. Combination lock meeting Federal Specification FF-L-2740 (X0-7) with security-in-depth Is Secret material stored in a GSA approved security container (safe) without supplemental controls or in the same manner as Top Secret? (NOTE: Approved containers will have a certification label on the container itself) (DOOM 5200.01-M, Vol 3, Encl 3, para 3.b) Is Confidential material stored in a GSA approved security container? (DoDM 5200.01-M,Vol 3, End 3, para 3.c) Are security container repairs (e.g. drilled because of a forgotten combination) done in accordance with FED-STD 809? (DoDM 5200.01-M, Vol 3, Encl 3, para 14) Is equipment (e.g. copiers, facsimile machines, AIS equipment and peripherals, electronic typewriters and word processing systems) used for processing classified information protected from unauthorized access? (DoDM 5200.01-M, Vol 3, Encl 2, para 14.a) Do appropriately cleared and technically knowledgeable personnel inspect the equipment and media used for processing classified information before the equipment is removed from the protected areas? (DoDM 5200.01-M, Vol Encl 2, para 14.d) Are GSA approved field safes and special purpose one and two drawer lightweight security containers securely fastened to the structure or under sufficient surveillance to prevent their theft? (DoDM 5200.01-M, Vol 3, End 3, para 6.a) x x x x X x x TELECOMMUNICATIONS, AUTOMATION INFORMATION SYSTEMS, AND NETWORK SECURITY MO 13526 REQUIREMENTS) 55. 56. Consistent with section 4.1(f) of E.O. 13526 and section 2001.50 of title 32, CFR, have uniform procedures been established to ensure that automated information systems that collect, create, communicate, compute, disseminate, process or store classified or controlled unclassified information are protected in accordance with applicable DoD policy issuances? Have procedures been established and implemented to: â€¢ Prevent access by unauthorized persons; â€¢ Ensure the integrity of the information; â€¢ TO the maximum extent practicable, use: 1) Common information technology standards, protocols, and interfaces that maximize the availability of, and access to, the information in a form and manner that facilitates its authorized use; and 2) Standardized electronic formats to maximize the accessibility of information to persons who meet the criteria set forth in section 4.1(a) of E.O. 13526. UNCLASSIFIED 13 x x x x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TULE/SUBJECT/ACTIVITY/FUNCTIONAL AREA Information Security Program Self-Inspection Checklist NO. 57. 58. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OPR DATE Security Manager 11 October 2012 ITEM Have procedures been established to ensure that unclassified copiers connected to the Internet are not used for classified reproduction? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are modems, telecommunications capabilities and network connections disabled on copiers approved for classified reproductions? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) â€¢ Are classified hard drives removed from classified reproduction equipment prior to maintenance? (DOOM 5200.01-M, Vol 3, End 7, para 10) Are cameras and microphones disabled on all hardware used for classified processing, in classified spaces, or connected to networks in classified spaces? (DoDM 5200.01-M, Vol 3, Encl 7, para 10) x x x X REPRODUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) 59. Are procedures established to oversee and control the reproduction of classified material? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b ) 60. Are personnel, who reproduce classified, aware of the risks involved with the specific reproduction equipment and the appropriate countermeasures they are required to take? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(2)) 61. Are waste products generated during reproduction properly protected and disposed of? (DoDM 5200.01-M, Vol 3, Encl 2, para 5.b.(6)) 62. Is reproduction equipment specifically designated for the reproduction of classified material? (DoDM 5200.01-M, Vol 3, End 2, para 5.b.(7)) 63. [Optional] Are RULES POSTED on or near the designated equipment authorized for the reproduction of classified? (DoDM 5200.01-M, Vol 3, Encl 2, para 15) 64. [Optional) Are NOTICES prohibiting reproduction of classified POSTED on equipment used only for the reproduction of unclassified material? (DoDM 5200.01-M, vol 3, Encl 2, para 15) â– 65. 66. x x x X x x DISPOSITION AND DESTRUCTION OF CLASSIFIED MATERIAL (EO 13526 REQUIREMENTS) Has each activity with classified holdings set aside at least one "Clean-Out" day each year when specific attention and effort is focused on disposition of unneeded classified material? (DoDM 5200.01-M, VoI3, Encl 3, para 17.b) Is classified materials properly destroyed by approved methods? (DOOM 5200.01-M, Vol 3, Encl 3, para 17 &18) x x TRANSMISSION AND TRANSPORTATION OF CLASSIFIED INFORMATION (EO 13526 REQUIREMENTS) 67. Whenever classified information is transmitted outside of the activity is it enclosed in two opaque sealed envelopes or similar wrappings or containers durable enough to properly protect the material from accidental exposure and facilitate detection of tampering? (DOOM 5200.01-M, Vol 3, Encl 4, para 9) â€¢ NOTE: When classified material is hand-carried outside an activity, a locked briefcase may serve as the outer wrapper. UNCLASSIFIED 14 x UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST 11TLEISUBJECTIACTNITY/FUNCTIONAL AREA National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM 68. Is the outer wrapper addressed to an official government activity or to a DOD contractor with a facility clearance and appropriate storage capability with a complete return address of the sender? (DoDM 5200.01-M, Vol 3, Encl 4, para 9.a.(1)) 69. Is the inner wrapper or container marked with the following information: sender's and receiving activity's address and highest classification level of the contents (including where appropriate, any special markings)? (DoDM 5200.01-M, Vol 3, End 4, para 9.a.(2)) â€¢ NOTE: The inner envelope may have an "attention line" with a person's name. 70. Are procedures established to limit the hand carrying of classified information to only when other means of transmission or transportation cannot be used? (DoDM 5200.01-M, Vol 3, End 4, para 11.a) 71. Are hand-carrying officials briefed on and have they acknowledged their responsibilities for protecting classified information? (DoDM 5200.01-M, Vol 3, Encl 4, para 11.c) 72. Are courier officials provided a written statement authorizing such hand carrying transmission? (DOOM 5200.01-M, Vol 3, Encl 4, para 12) â€¢ [Optional] Does the activity list all classified carried or escorted by traveling personnel? (DoDM 5200.01-M, VoI3, Encl 4, para 11) â€¢ [Optional] Does the activity keep this list until all material reaches the recipient's activity? (DoDM 5200.01-M, Vol 3, End 4, para 11) 73. When "Confidential" classified information is sent U.S. Postal Service "First Class" mail between DOD Components within the United States, is the outer envelope or wrapper endorsed "POSTMASTER: RETURN SERVICE REQUESTED"? (DOOM 5200.01-M, Vol 3, Encl 4, para 5.d 1 74. Do recipients of First Class mail bearing the "Postmaster" notice protect it as Confidential material? x x x x x X x x x SECURITY EDUCATION (E0 13526 REQUIREMENTS) 75. 76. 77. 78. 79. 80. , Has the Component Senior Agency Official established a Security Education program? (DoDM 5200.01-M,Vol 1, Encl 2, para 7.g ) Has the activity security manager implemented the security education and training program within the activity? (DoDM 5200.01, Vol 1, Encl 2, para 9.f) Have all personnel been trained on policies for classification, safeguarding and declassification? Do all personnel who perform derivative classification receive training every 2 years? (DoDM 5200.01-M, Vol 3, Encl 5, para 7.c) All original classification authorities (OCA) must receive training in proper classification and declassification at least once a calendar year. (DoDM 5200.01-M Volt, Encl 4, para 5.d and Vol 3, Encl 5, para 5) Does this training program include an "Initial Orientation" for all assigned personnel who are cleared for access to classified information? (DoDM 5200.01-M, Vol 3, End 5, para 3) Does this orientation include the: (DOOM 5200.01-M, Vol 3, End 5, para 3) UNCLASSIFIED 15 x x x x x . UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST TITLE/SUBJECT/ACTIVITYIRJ NicnomAL AREA Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 National Reconnaissance Office OP R DATE Security Manager 11 October 2012 ITEM â€¢ â€¢ â€¢ â– x x x x â€¢ x x x x x x x x x x x SECURITY INCIDENTS AND VIOLATIONS TO INCLUDE COMPROMISES MO 13526 REQUIREMENTS) 88. Are assigned members trained on of their responsibilities to report security violations concerning classified information? (DOOM 5200.01-M, Vol 3, End 6, para 3.b) 89 Are there procedures to conduct an inquiry/investigation of a loss, possible compromise, or unauthorized disclosure of classified information? (DoDM 5200.01-M, Vol 3, Encl 6, para 6) - UNCLASSIFIED 16 x x 7 Roles and responsibilities of assigned members and key personnel? Elements of safeguarding classified information? Elements of classifying and declassifying information? 81 . Is additional training provided for members who: (DOOM 5200.01-M, Vol 3, End 5, para 4.b & c) â€¢ Are members of deployable organizations, to provide enhanced security training to meet the needs of the operational environment? â€¢ Will be traveling to foreign countries? â€¢ Will be escorting, hand carrying, or serving as a courier for classified material? â€¢ Will use automated information systems to store, process, or transmit classified? â€¢ Will have access to information requiring special control or safeguarding measures? â€¢ Will be using Foreign Government Information or work in coalition or bilateral environments? â€¢ Submit information to OCAs for original classification decisions? 82. Is Refresher training provided at least annually to assigned members? (DOOM 5200.01-M, Vol 3, Encl 5, para 7.a) 83. Is Refresher training tailored to the mission needs and address policies, principles and procedures covered in initial training? (DoDM 5200.01-M, Vol 3, End 5, para 7.a) 84. Does Refresher training address concerns identified during Component SelfInspections? (DOOM 5200.01-M, Vol 3, End 5, para 7.a) 85. Are procedures established to ensure cleared employees who leave the organization or whose clearance Is terminated receives a termination briefing? (DoDM 5200.01-M, Vol 3, End 5, para 9) 86. Are records maintained to show the names of members who participated in "Initial" and "Refresher" training? (DoDM 5200.01-M,Vol3, Encl 5, para 11 ) 87. Do training programs for "Uncleared" members include: (DoDM 5200.01-M, Vol 3, Encl 5, para 3) â€¢ The nature and importance of classified information? â€¢ Actions to take if they discover classified information unprotected? â€¢ The need to report suspected contact with a foreign intelligence collector? UNCLASSIFIED INFORMATION SECURITY PROGRAM SELF-INSPECTION CHECKLIST IITLE/SUBJECT/ACTIVITY/FUNCTIONAL AREA 90. 91. 92. National Reconnaissance Office OPR Information Security Program Self-Inspection Checklist NO. NRO APPROVED FOR RELEASE 28 August 2014 Security Manager DATE 11 October 2012 ITEM Are appropriate and prompt corrective actions taken when a violation or infraction occurs? (DoD 5200.01-M, Vol 3, Encl 6) Are inquiries and/or investigations promptly conducted to ascertain the facts surrounding reported incidents? (DoDM 5200.01-M, VoI3, Encl 6, para 6) Are individuals who commit violations or infractions subject to appropriate sanctions? (DOOM 5200.01-M, Vol1, Encl 3, para 17 and VoI3, Encl 6, para 8.b & 14) UNCLASSIFIED 17 x X x UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 NRO Explanation of N/A Responses on 2012 Information Security Program Self-inspection Checklist Item 1. Comment The DNRO appoints the DOS&CI as responsible for NRO security. The DOS&CI appoints a Government Program Security Officer (GPSO) as the head of each Directorate or Office activity who implements the provisions of the NRO Security Program. For each contractor, an NRO Contractor Program Security Officer (NCPSO) is nominated by the contractor and approved by the DOS&CI. The NCPSO is a senior Contractor PSO responsible and accountable for the security oversight of all NRO program activities at their company or corporation. 2. All security instructions are signed by the DOS&CI 5. Equivalent training is provided 6. Security evaluations and self-inspections are centrally managed under the DOS&CI. The DOS&CI is informed of the results of such inspections. 7. Security-related training will be documented in the Personnel Security File or in a listing of all personnel who completed the training 9. Yes, in areas where political instability, terrorism, host country attitude, or criminal activity suggests the possibility that a SCIF may be overrun by hostile forces. 11. If the security manager has a COOP mission, essential materials are in place at the alternate location. 12. The NRO cannot approve OCAs so we cannot delegate OCA responsibilities. 16. The NRO does not use Downgrading markings. 21. NRO personnel do not have the authority to create NATO information. 28. Most SCIFs are open storage and do not require the use of cover sheets. 38. Most SCIFs are open storage and do not require the use of cover sheets. 40. SF 701 may be used or locally designed forms may be used 41. SF 702 may be used or locally designed forms may be used 45. Yes, at the SCI level, except for SAR where the holder does not have access to the SAR compartment nor the physical area housing the container. UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Please note: The best way to view the report "Agency Annual Self-Inspection Program Data: FY 2013" (attached to this explanation) is in softcopy because several of the expandable fields have text that is hidden when viewed in hardcopy. The full text of entries that exceed the viewable space of expandable fields is included below for ease of reading, however, only the softcopy form will be submitted to OUSD(I). 3. Enter the name, title, address, phone, fax, and e-mail address of the Senior Agency Official (SAO) (as defined in E.O. 13526, section 5.4(d)) responsible for this report. Mr. Frank Calvelli Principal Deputy Director, NRO Room 14675 Lee Road, Chantilly, VA 20151 (b)(3) 10 USC 424 FAX (b)(3) 10 USC 424 (b)(3) 10 USC 424 13. What means and methods are employed in conducting self inspections? (For example: interviews, surveys, data calls, checklists, analysis, etc.) - NRO self-inspections are part of the NRO ISAP. Because of the total NRO workforce and have the contractors make up overwhelming number of Sensitive Compartmented Information Facilities (SCIFs), ISAP is a collaborative process between Government and industry to identify and address security vulnerabilities, provide data for analysis, and identify system security issues and trends. Site personnel conduct/document security self-assessments, per requirements stated in the NRO Security Manual (NSM) at least annually. The ISAP Manager or designee reviews the site assessments and enters a copy into an NRO database listing each NRO sponsored facility. Based on the self-assessments, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, 1 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. The Assessment Team will, at a minimum, consist of a Government PSO and an OS&Cl/Facilities and Information Security Division (F&ISD) representative. Additional team members will be added as needed based on site size, mission, facility risk, and subject areas being assessed. After the on-site assessment, an out-briefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of the report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. For the reporting period, 291 selfassessments were received and 10 formal team assessments were performed. No additional formal specific-issue reviews were conducted. There were an additional 742 visits by OS&CI stakeholders to contractor SCIFs. In addition, a data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 20. Describe below how the agency identifies activities and offices whose documents are to be included in the sample of classification actions. (Indicate if NA.) Based on the 291 site self-assessments submitted, the ISAP Manager, Program Security Officers (PSOs) and stakeholders discuss findings and formulate recommendations for a formal 2 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessment, if required. OS&CI stakeholders represent the major OS&CI directorates and program office security staffs, including, but not limited to, PSOs, Physical/Technical Certification Officers and Security Certification Officers. Stakeholders develop and provide ISAP candidates to the ISAP Selection Board. Each ISAP recommendation shall contain detailed factors used to formulate the recommendation. Recommendation for site visits is then provided to the selection board. Sites are selected based on risk, proximity, resources, budgetary constraints, time since last assessment, and random sampling. A team composition is proposed for each site visit and a Lead PSO is selected. Additionally, several types of documents at NRO headquarters are reviewed annually by CMOs and PSOs for proper classification and marking. A data call was conducted with all PSOs and CMOs in NRO Headquarters to answer items 87 and 88. 22. How do you ensure that the materials reviewed provide a representative sample of the agency's classified information? (Indicate if NA.) Documents are selected for review in cooperation with site personnel who are familiar with the type of materials produced by the site. However, contractors are not required to count classified pages produced because of the additional costs that would be incurred by the NRO, so the documents reviewed may not be a representative sample. The data call conducted with NRO Headquarters PSOs and CMOs for item 87 and 88 represents all documents they reviewed during FY 2013. 31. How is the self-inspection program structured to assess individual agency activities and the agency as a whole? Contractor SCIF locations far outnumber government SCIF locations in the NRO. Government locations are relatively few in number and have professional government security officers assigned who can monitor safeguarding and classified information production and correct errors as they occur. We chose to concentrate on contractor facilities which are visited relatively infrequently. The conditions at contractor locations are not directly applicable to government locations. 3 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 35. What is the format for documenting self-inspections in your agency? Self-assessments are documented using the self-assessment review tool in the NSM, Appendix B. For formal assessments, an outbriefing is provided to site security staff and other site senior management identifying security program successes, observations, and any security "best practices" discovered during the formal assessment. The results are then loaded into the facility database that contains information from all previous visits with any problem areas or "best practices" noted. A final report requiring corrective actions to be taken within 90 days of the date of report is issued by the D/OS&CI. The assessed site is required to provide follow-up reports of corrective action to the responsible PSO and the ISAP Manager every 90 days until all corrective actions are complete. The responsible PSO monitors all mitigation actions. Reports of corrective action are loaded into the NRO facilities database for historical purposes. 47. Safeguarding: Regular conduct of exercises provides vital feedback to the physical security program. Exercises identify areas for corrective measures, enhancements, validate current tactics, techniques and procedures (TTP) and the adoption/employment of new TTP to meet a dynamic threat environment. Regular inspections/audits are essential to ensuring status and validity of issued IC badges and conformity to physical security requirements. Risk assessments/physical security assessments provide a helpful "outside" perspective to site security offices. NRO government and contractor personnel work in SCIFs equipped with secure telephones, FAX, and teleconferencing equipment, badges and badge readers, guard forces in several locations, document shredders and other features to ensure compromises of classified information do not occur. While the insider threat is always a possibility, we take every precaution to prevent security incidents from occurring. The NRO applies uniform procedures established by the Intelligence Community Directive (ICD)-503 family of policy and guidance for Information Technology Systems Security Risk Management and Assessment and Authorization (A&A) activities. 4 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 48. Security Violations: The ISAP program is the formal mechanism by which we corroborate self - inspections. Included in these formal reviews is an assessment of the respective security violation program and trends. In addition, each component Security team evaluates Security incidents and violations by tracking them according to general broad categories. During this past FY, the majority (63%) of incidents/violations were related to categories within personnel electronic devices in SCIFs. Other categories that have multiple occurrences indicating potential trends are data spills (9%) and inadvertent removal of classified information (12%). Personal cell phones and prohibited electronic devices are not allowed in SCIFs. While we have installed lockers outside SCIFs to secure cell phones, entry of prohibited electronic devices into SCIFs is still a problem. Visitor attendance to NRO conferences/facilities result in numerous cell phones being brought into the conference even by individuals with security duties who should know better. 49. Security Education and Training: 100% of personnel assigned to the NRO are required to complete an SCI indoctrination briefing to include signing a NonDisclosure Agreement. E.O. 13526 is called out specifically so that personnel fully understand their responsibilities and requirements to protect classified information. This message is repeated by the release of awareness videos and reminders throughout the year; to include presentations, written materials, and training. Specifically, OS&CI incorporates classification management questions within the Annual Security Refresher (ASR) web-based training (WBT). In 2014 ASR will include additional Derivative Classification questions. With as many contractors as the NRO employs, training can be a major expense. Every contractor and government employee with a secure computer account is required to take the Annual Security Refresher training otherwise they lose their computer connection. There are numerous additional courses and specialized security training available on-line even though sequestration has reduced training manpower overall to include elimination of the Information Management Branch which ran the OS&CI web site and security-specific applications. 5 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 50. Management and Oversight: Government oversight of NRO-sponsored SCIFs is achieved in a multi-faceted manner. Program Security Officers, Physical/Technical, and Computer Security Officers review selfassessment results and participate in on-site reviews. Some program findings for FY 13 were identified in the following areas: â€¢ Standard Operating Procedures (SOPs) require more detail and more frequent revision to stay up-to-date with security requirements. â€¢ Foreign travel and contact reporting were not always accomplished using the mandated NRO Counterintelligence Network (CINet). â€¢ There are undocumented information systems within facilities. â€¢ Not all employees with AIS privileged user type access have been identified and tracked. â€¢ Facility alarm test records are not always maintained for the required time period. â€¢ Red/Black cabling is not labeled for identification. 54. Safeguarding: Awareness and education programs are vital to ensuring the workforce maintains awareness of security policy and procedures. Regular and aperiodic exercises, inspections, and audits provide crucial inputs that are indispensable to ensuring that the physical security program is current and effective. Key challenges are maintaining adequate funding to replace aging, malfunctioning, and obsolete security equipment and training and education for new personnel. The NRO has an organization-level process for the Assessment and Authorization (A&A) of Information Systems and a Directive 51-1, "Information Technology, Information Assurance, and Information Management Architecture and Strategy for Certification and Accreditation" to ensure automated information systems that collect, create, communicate, compute, disseminate, process or store classified information are protected in accordance with applicable national policy issuances. 6 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED 55. Security Violations: The NSM details the NRO process for reporting and investigating security incidents, infractions and violations. Appropriate and prompt corrective actions were taken to.mitigate the severity of the infraction/violation, and to sanction the offender via management, counterintelligence, and personnel security processes. Infractions and violations are centrally tracked in the Security Log (the NRO incident/violation database). This database is managed by the Program Security Officers in each directorate and office, and enables the PSO to automatically notify Counterintelligence Division and Personnel Security Division, via a system generated e-mail, of infractions/violations that require immediate CI and/or personnel security attention. The database also enables both OS&CI management as well as individual PSOs to track and analyze trends linked to the various categories of security infractions/violations. 56. Security Education and Training: OS&CI works closely with PSOs, Counterintelligence personnel, and the Integrated Self Assessment Program to determine any trends or specific areas that need an additional educational awareness campaign. Security communications are then targeted, utilizing large scale efforts, per a topic area and audience for best impact results. The NRO is adding additional classification management questions to the Annual Security Refresher to better satisfy the derivative classification training requirement. OCAs complete yearly training provided by NRO/OS&Cl/Policy Branch with direct knowledge of current CAPCO guidelines. 57. Management and Oversight: The NRO has a very mature Security management and oversight program. Over the past FY, much greater emphasis has been placed on ensuring all sites and facilities accomplished the self-assessments and submited the findings to the Government within the mandated time requirements. This improved management oversight has made an impact. Our self-inspection program coupled with security officer visits, and formal team 7 UNCLASSIFIED NRO APPROVED FOR RELEASE 28 August 2014 UNCLASSIFIED assessments provide managers a report card on the health of our security programs. When negative trends are identified, managers from across industry and the Government develop corrective action plans to reverse the trends and ensure security requirements are met. Impacts are being felt to overall security programs due to reductions in security resources. While security requirements are increasing, especially in the area of information systems management, resources are being reduced. Additionally, some sites assessed have made decisions not to fully comply with a security requirement because of resource constraints. 8 UNCLASSIFIED

1 0

Future Development on Hidden Services
by Karsten Loesing 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, as some of you may know, there have been several improvements to hidden services lately. First, hidden services publish their descriptors to a distributed directory [1] consisting of currently 71 nodes. Second, hidden services may require client authorization already during connection establishment to block unauthorized requests as early as possible [2]. Third, hidden service performance has been improved with respect to advertising and accessing hidden services [3,4]. Certainly, there are still things that can (and should) be improved. This is an attempt to compile a good list of future development tasks on hidden services. Comments are most welcome. If there are other things with hidden services that need improvement, please let us know. - --Karsten 1. Further improve performance and reliability - ---------------------------------------------- In the current NLnet project on speeding up hidden services [3] we found and fixed a lot of performance-related bugs, identified the likely bottlenecks of the protocol, and added the most important performance improvements to the code [4]. But there are still some possible improvements left that require evaluation and possibly coding if they turn out to be useful: a. Descriptor fetches on client side are an issue. Most failed connection establishment occur when trying to fetch the descriptor of a hidden service. We could parallelize this step as well (maybe also in combination with a certain delay to avoid extensive network load), just as we do with client-side requests to introduction points [4]. This might speed things up and lead to better reliability (at the price of increasing the number of requests to the distributed directory). b. The client-side request timeout of 60 seconds could be improved. It doesn't make sense to have a 60-seconds timeout for 5 substeps and stick to it even when realizing that the first substep has already taken 55 seconds. The other 4 steps (that are invisible to the client) simply cannot succeed in that time. This would also improve reliability, because we are otherwise giving up on requests that succeed soon after. c. The INTRODUCE1 cells could be combined with the first BEGIN cell to initialize an application stream. After establishing a 6-hop circuit from client to service, the client still needs to initialize an application stream over it which takes another 6 seconds in the mean. Maybe there is a chance to send the stream initialization message already as part of the introduction request. Or the hidden service could initialize the first stream back to the client. There might be security implications that prevent this, so more thoughts are needed here. d. Adapt the protocol to low-bandwidth environments: The effects of low-bandwidth connections on either accessing or running hidden services has not been investigated so far. Maybe such environments require us to change parameters like timeouts when we realize that our connection is bad. Jvrg Lenhard is currently working on measurements using telephone and cell phone connections that hopefully give us some new insights. e. One of the big performance issues is general Tor circuit-building performance. This comes in two pieces: First, extending a circuit in Tor has a nontrivial chance of timing out or failing. Second, extending a circuit in Tor takes too long, both in terms of mean and in terms of variance. These problems are magnified for hidden service use, a) because the path is twice as long, and b) because some components of the path really do need to be made on demand, whereas for normal Tor circuits you make the whole circuit beforehand. So, if this improves for general circuits in Tor, hidden services should inherit these performance gains 'for free'. 2. Improve hidden services with client authorization - ---------------------------------------------------- Beginning with version 0.2.1.6-alpha, hidden services support client authorization. That means that hidden services can restrict access to a small set of clients and prevent other clients (or introduction points/directory nodes) from establishing a connection. When client authorization is applicable, it reduces the risk of certain attacks on locating hidden servers [6] or denial of service. Once this feature is more tested, people should be told that it exists and how to use it. a. Make client authorization for hidden services easier to use: Domenik Bork has made a start on making Vidalia support configuration of hidden services with client authorization in his GSoC project [7]. His changes will hopefully be merged into Vidalia trunk quite soon. The question is whether people understand the interface, or if this needs improvement. b. Write good howtos for both service operators and clients: First, explain to the service operator what steps are required to add or remove authorization for a given client. Second, help end users understand how to configure their clients, what protection they get, and a brief idea of how it all works; we may reuse some parts from the current documentation and FAQ, but the client authorization features are rather new and not documented. c. Work on advanced client authorization protocols: The two available protocols for client authorization are based on exchanging a secret between service provider and client. This could be extended to other protocol types as required. The question is what users need. 3. Simplify setting up a hidden service - --------------------------------------- One option to make it easier for people to run hidden services is to make a Tor Webserver Bundle: Given the success of the Tor Browser Bundle, we could create a Windows/Mac OS bundle that contains Tor, Vidalia, and a tiny webserver. The bundle could have a directory "put-your-files-here/" where people can drop HTML (or other) files that are served by the hidden service automatically. The bundle could live on a USB stick without the need to be installed. This bundle could be developed as an extension of the current TBB. Maybe this could also go into the new auto updater [5] as an optional package. [1] https://svn.torproject.org/svn/tor/trunk/doc/spec/proposals/114-distributed… [2] https://svn.torproject.org/svn/tor/trunk/doc/spec/proposals/121-hidden-serv… [3] https://www.torproject.org/projects/hidserv [4] https://svn.torproject.org/svn/tor/trunk/doc/spec/proposals/155-four-hidden… [5] https://www.torproject.org/projects/google [6] http://www.freehaven.net/anonbib/#hs-attack06 [7] http://code.google.com/soc/2008/eff/appinfo.html?csaid=86500DD2D78BB5D9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJDkbN0M+WPffBEmURAswDAKCVzkN/mr+5IpT/F4eRzGWK2d4HiwCgqZiB 2fpktR6KApl+bziOXIv0q08= =BbIk -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Bush quietly gives himself power to open our regular mail !!!
by Peter Langston 06 Jul '18

06 Jul '18

From: David Michael <harp(a)olympus.net> [You know those "signing statements" that Bush always signs following his signing of new legislation? (the ones that give him the right to break the law he just signed) Well on Christmas day he just gave himself the right to open our mail (regular snail mail now!) with no warrant from a judge! The following paragraph is the text of the specific offensive paragraph...(I know, it helps if you're a lawyer). Below that is the entire text....dm] [Admittedly it's alarming, but the thing that stands out to me is that we know GWB can barely string a subject and verb together on his own, so who's actually writing these things? And I doubt it's just a language problem, so who's actually coming up with the concepts? -psl] **************************************************** "The executive branch shall construe subsection 404(c) of title 39, as enacted by subsection 1010(e) of the Act, which provides for opening of an item of a class of mail otherwise sealed against inspection, in a manner consistent, to the maximum extent permissible, with the need to conduct searches in exigent circumstances, such as to protect human life and safety against hazardous materials, and the need for physical searches specifically authorized by law for foreign intelligence collection." ***************************************** President's Statement on H.R. 6407, the "Postal Accountability and Enhancement Act" [2006-20] -- 42 WCPD, p. 2196 (December 25, 2006) Today I have signed into law H.R. 6407, the "Postal Accountability and Enhancement Act." The Act is designed to improve the quality of postal service for Americans and to strengthen the free market for delivery services. The executive branch shall construe sections 3662 and 3663 of title 39, United States Code, as enacted by section 205 of the Act, not to authorize an officer or agency within the executive branch to institute proceedings in Federal court against the Postal Regulatory Commission, which is another part of the executive branch, as is consistent with the constitutional authority of the President to supervise the unitary executive branch and the constitutional limitation of Federal courts to deciding cases or controversies. The executive branch shall construe subsection 409(h) of title 39, as enacted by section 404 of the Act, which relates to legal representation for an element of the executive branch, in a manner consistent with the constitutional authority of the President to supervise the unitary executive branch and to take care that the laws be faithfully executed. The executive branch shall construe section 407 of title 39, as enacted by section 405 of the Act, in a manner consistent with the President's constitutional authority to conduct the Nation's foreign affairs, including the authority to determine which officers shall negotiate for the United States and toward what objectives, to make treaties by and with the advice and consent of the Senate, and to supervise the unitary executive branch. The executive branch shall construe subsections 202(a) and 502(a) of title 39, as enacted by subsections 501(a) and 601(a) of the Act, which purport to limit the qualifications of the pool of persons from whom the President may select appointees in a manner that rules out a large portion of those persons best qualified by experience and knowledge to fill the positions, in a manner consistent with the Appointments Clause of the Constitution. The executive branch shall also construe as advisory the purported deadline in subsection 605(c) for the making of an appointment, as is consistent with the Appointments Clause. The executive branch shall construe subsection 404(c) of title 39, as enacted by subsection 1010(e) of the Act, which provides for opening of an item of a class of mail otherwise sealed against inspection, in a manner consistent, to the maximum extent permissible, with the need to conduct searches in exigent circumstances, such as to protect human life and safety against hazardous materials, and the need for physical searches specifically authorized by law for foreign intelligence collection. The executive branch shall construe provisions of the Act that call for executive branch officials to submit legislative recommendations to the Congress in a manner consistent with the constitutional authority of the President to supervise the unitary executive branch and to recommend for congressional consideration such measures as the President shall judge necessary and expedient. Such provisions include subsection 504(d) and section 2009 of title 39, as amended by section 603 of the Act, and sections 701(a)(2), 702(b), 703(b), 708(b), and 709(b)(2) of the Act. GEORGE W. BUSH THE WHITE HOUSE, December 20, 2006. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Big Brother
by David Farber 06 Jul '18

06 Jul '18

[1]http://www.engadget.com/ Computer and behavioral scientists at the University of Buffalo are developing a system that will allow authorities to track faces, voices, bodies and various other biometrical data to create a score for how likely an individual is to commit a terrorist act. Sound like the scariest Big Brother plot since China's [2]ID card scheme? Well, rest assured, Winston Smith, the researchers only have your best interests in mind. "The goal is to identify the perpetrator in a security setting before he or she has the chance to carry out the attack," says Venu Govindaraju, professor of computer science and engineering at the university, who was recently awarded $800,000 by the National Science Foundation to create such a system. "We are developing a prototype that examines a video in a number of different security settings, automatically producing a single, integrated score of malfeasance likelihood," adding that the system will incorporate machine "learning" capabilities, which will allow it to adapt over time. "Human screeners have fatigue and bias, but the machine does not blink," the researcher said, just before remarking that he was late for an appointment at the Ministry of Truth. _________________________________________________________________ [3]Archives [4][feed-icon-10x10.jpg] [5]Powered by Listbox References 1. http://www.engadget.com/ 2. http://www.engadget.com/2007/08/13/china-outdoes-itself-with-unprecedented-… 3. http://v2.listbox.com/member/archive/247/=now 4. http://v2.listbox.com/member/archive/rss/247/ 5. http://www.listbox.com/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Future Development on Hidden Services
by Karsten Loesing 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, as some of you may know, there have been several improvements to hidden services lately. First, hidden services publish their descriptors to a distributed directory [1] consisting of currently 71 nodes. Second, hidden services may require client authorization already during connection establishment to block unauthorized requests as early as possible [2]. Third, hidden service performance has been improved with respect to advertising and accessing hidden services [3,4]. Certainly, there are still things that can (and should) be improved. This is an attempt to compile a good list of future development tasks on hidden services. Comments are most welcome. If there are other things with hidden services that need improvement, please let us know. - --Karsten 1. Further improve performance and reliability - ---------------------------------------------- In the current NLnet project on speeding up hidden services [3] we found and fixed a lot of performance-related bugs, identified the likely bottlenecks of the protocol, and added the most important performance improvements to the code [4]. But there are still some possible improvements left that require evaluation and possibly coding if they turn out to be useful: a. Descriptor fetches on client side are an issue. Most failed connection establishment occur when trying to fetch the descriptor of a hidden service. We could parallelize this step as well (maybe also in combination with a certain delay to avoid extensive network load), just as we do with client-side requests to introduction points [4]. This might speed things up and lead to better reliability (at the price of increasing the number of requests to the distributed directory). b. The client-side request timeout of 60 seconds could be improved. It doesn't make sense to have a 60-seconds timeout for 5 substeps and stick to it even when realizing that the first substep has already taken 55 seconds. The other 4 steps (that are invisible to the client) simply cannot succeed in that time. This would also improve reliability, because we are otherwise giving up on requests that succeed soon after. c. The INTRODUCE1 cells could be combined with the first BEGIN cell to initialize an application stream. After establishing a 6-hop circuit from client to service, the client still needs to initialize an application stream over it which takes another 6 seconds in the mean. Maybe there is a chance to send the stream initialization message already as part of the introduction request. Or the hidden service could initialize the first stream back to the client. There might be security implications that prevent this, so more thoughts are needed here. d. Adapt the protocol to low-bandwidth environments: The effects of low-bandwidth connections on either accessing or running hidden services has not been investigated so far. Maybe such environments require us to change parameters like timeouts when we realize that our connection is bad. Jvrg Lenhard is currently working on measurements using telephone and cell phone connections that hopefully give us some new insights. e. One of the big performance issues is general Tor circuit-building performance. This comes in two pieces: First, extending a circuit in Tor has a nontrivial chance of timing out or failing. Second, extending a circuit in Tor takes too long, both in terms of mean and in terms of variance. These problems are magnified for hidden service use, a) because the path is twice as long, and b) because some components of the path really do need to be made on demand, whereas for normal Tor circuits you make the whole circuit beforehand. So, if this improves for general circuits in Tor, hidden services should inherit these performance gains 'for free'. 2. Improve hidden services with client authorization - ---------------------------------------------------- Beginning with version 0.2.1.6-alpha, hidden services support client authorization. That means that hidden services can restrict access to a small set of clients and prevent other clients (or introduction points/directory nodes) from establishing a connection. When client authorization is applicable, it reduces the risk of certain attacks on locating hidden servers [6] or denial of service. Once this feature is more tested, people should be told that it exists and how to use it. a. Make client authorization for hidden services easier to use: Domenik Bork has made a start on making Vidalia support configuration of hidden services with client authorization in his GSoC project [7]. His changes will hopefully be merged into Vidalia trunk quite soon. The question is whether people understand the interface, or if this needs improvement. b. Write good howtos for both service operators and clients: First, explain to the service operator what steps are required to add or remove authorization for a given client. Second, help end users understand how to configure their clients, what protection they get, and a brief idea of how it all works; we may reuse some parts from the current documentation and FAQ, but the client authorization features are rather new and not documented. c. Work on advanced client authorization protocols: The two available protocols for client authorization are based on exchanging a secret between service provider and client. This could be extended to other protocol types as required. The question is what users need. 3. Simplify setting up a hidden service - --------------------------------------- One option to make it easier for people to run hidden services is to make a Tor Webserver Bundle: Given the success of the Tor Browser Bundle, we could create a Windows/Mac OS bundle that contains Tor, Vidalia, and a tiny webserver. The bundle could have a directory "put-your-files-here/" where people can drop HTML (or other) files that are served by the hidden service automatically. The bundle could live on a USB stick without the need to be installed. This bundle could be developed as an extension of the current TBB. Maybe this could also go into the new auto updater [5] as an optional package. [1] https://svn.torproject.org/svn/tor/trunk/doc/spec/proposals/114-distributed… [2] https://svn.torproject.org/svn/tor/trunk/doc/spec/proposals/121-hidden-serv… [3] https://www.torproject.org/projects/hidserv [4] https://svn.torproject.org/svn/tor/trunk/doc/spec/proposals/155-four-hidden… [5] https://www.torproject.org/projects/google [6] http://www.freehaven.net/anonbib/#hs-attack06 [7] http://code.google.com/soc/2008/eff/appinfo.html?csaid=86500DD2D78BB5D9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJDkbN0M+WPffBEmURAswDAKCVzkN/mr+5IpT/F4eRzGWK2d4HiwCgqZiB 2fpktR6KApl+bziOXIv0q08= =BbIk -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Obama administration revives Draconian communications intercept plans
by Perry E. Metzger 06 Jul '18

06 Jul '18

[Moderator's note: there are messages still in the queue that will go out later today, but I felt this had to go out ASAP --Perry] >From the New York Times, word that the Obama administration wants to compel access to encrypted communications. http://www.nytimes.com/2010/09/27/us/27wiretap.html Excerpt: U.S. Wants to Make It Easier to Wiretap the Internet By CHARLIE SAVAGE Published: September 27, 2010 WASHINGTON b Federal law enforcement and national security officials are preparing to seek sweeping new regulations for the Internet, arguing that their ability to wiretap criminal and terrorism suspects is b going darkb as people increasingly communicate online instead of by telephone. Essentially, officials want Congress to require all services that enable communications b including encrypted e-mail transmitters like BlackBerry, social networking Web sites like Facebook and software that allows direct b peer to peerb messaging like Skype b to be technically capable of complying if served with a wiretap order. The mandate would include being able to intercept and unscramble encrypted messages. -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Obama administration revives Draconian communications intercept plans
by Perry E. Metzger 06 Jul '18

06 Jul '18

[Moderator's note: there are messages still in the queue that will go out later today, but I felt this had to go out ASAP --Perry] >From the New York Times, word that the Obama administration wants to compel access to encrypted communications. http://www.nytimes.com/2010/09/27/us/27wiretap.html Excerpt: U.S. Wants to Make It Easier to Wiretap the Internet By CHARLIE SAVAGE Published: September 27, 2010 WASHINGTON b Federal law enforcement and national security officials are preparing to seek sweeping new regulations for the Internet, arguing that their ability to wiretap criminal and terrorism suspects is b going darkb as people increasingly communicate online instead of by telephone. Essentially, officials want Congress to require all services that enable communications b including encrypted e-mail transmitters like BlackBerry, social networking Web sites like Facebook and software that allows direct b peer to peerb messaging like Skype b to be technically capable of complying if served with a wiretap order. The mandate would include being able to intercept and unscramble encrypted messages. -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0