Security Compliance Inspection Process Webinar

Transcription

1 Security Compliance Inspection Process Webinar Good afternoon and thank you for standing by. All lines will be in listen only throughout the entire call today. And the call is being recorded if you have any objections you may disconnect at this time. Mr. Akers you may now begin. Randy: Thank you very much operator. Before we get started, please be aware that the video portion of this webinar is being recorded. Once I get the red recording light we will begin. And I do have the light, so welcome everyone to today s webinar Security Compliance Inspection Process-Help! I just want to let you know I m sitting here with my little headphone on and I was Air Force so I feel like a pilot. The flight today will be about 30 minutes long so sit back and hopefully we won t encounter any turbulence so buckle up and keep your trays in the upright position. Before I pass you over to Ms. Rachel Mojo who will give you a tour of the DCO meeting room, I would like to tell you a little about myself. I joined the Air Force in 1978 and worked my entire career in information, personnel, industrial and physical security until I retired in And then from I earned my Identity Theft Risk Management Certification from the Institute of Fraud Examiners, presented seminars to companies and private organizations. I also served as the Security Manager for the Barry M. Goldwater Bombing Range in Arizona, and supervised a guard force at the Phoenix Children s Hospital. In August of 2010 I was brought on board as an instructor here at the Center for Development of Security Excellence, and for the first two and a half years I served as the DoD Security Specialist Course Manager. At the start of this year I was fortunate enough to have the opportunity to join the Special Access Program team where I am currently assigned as the Course Manager for the SAP Mid-Level Security Management and Orientation to the SAP Security Compliance Inspection Courses. I have sat in your seat as either the person getting inspected or the person conducting the inspection. I have over 15 years of experience throughout my career and it s been dedicated to conducting security compliance inspections for various security programs. So my goal today is to give you some tips on how you can be successful regardless if you re getting inspected or if you re conducting the inspection. Now I d like to introduce our producer Ms. Rachel Mojo who will provide you with a tour of the DCO meeting room and tell you about a few activities we ll be doing during the webinar.

2 Rachel: Well thank you Randy. As you can see on your screen there are two note boxes, one gives you audio information, how to dial in and the other contains some commonly used acronyms that Randy will be referring to today. You ll see that that box scrolls, there s a bar on the side you can move it to see all the acronyms in the box there are five total. We also have a file share box where you can download materials related to today s presentation including; a check list, two appendices and some slides, feel free to download those, print them up and take notes as we go. You ll also see there s a Q&A box on the side, if you have any questions please enter them there. You won t see them come up but we will get them, we can t get to them during the webinar we will post them online. There s also a full screen button, if you select this you ll get a more detailed view of the screen, select it again to get back and answer any questions and answer any poll questions. We re going to try something different today, you ll see there s a stick figure at the top of your screen and then there s a drop down box next to it, you ll see there s a way to raise your hand to respond to what Randy may be saying during the presentation. Go ahead and do that and also after you finish lower your hand or set your status back to how it was before so that you can continue to respond. We ll be doing this pretty frequently during the webinar. This is an example of a poll question, you ll see a couple of these, they re multiple choice questions; just go ahead and respond and we ll provide some feedback. There will also be one chat question and it s similar to Q&A, you just enter your responses into the box and we ll discuss. Well without further ado I m going to turn it back over to Randy and he ll start the presentation. Randy: Okay thank you Rachel. Ladies and gentlemen the two-phase security compliance inspection process consists of self-inspections and compliance inspections. Now the standard we are going to be using today are based on the JAFAN 6/0, Revision 1. However, you must follow your component or agency criteria if it differs from the JAFAN 6/0 standard. Now to help with this first phase, Self-Inspections, you should have Appendix F of JAFAN 6/0 Revision 1 open. If you don t, you can download the appendix from our Files Share at the bottom of the screen. The core compliance inspection consists of validating the self-inspection on-site and inspecting the core compliance and special emphasis items. Special emphasis items are established by your Service SAPCOs annually and they are distributed down through the PSO.

3 But before we get started, I have a couple of poll questions I d like to ask. The first one is: Given the choices below, which do you think people would rather do? I remember when I first started out in my security profession I d rather do mandatory online training any day then to go to a compliance inspection. And it looks like everybody feeling the love with me here because over 90 percent of you are saying the same thing that you would rather go through mandatory online training and hopefully by the end of this you ll have a different feeling. So, let s see where we go from here. So, I have another question I d like to follow this one up with. Why do you think people would rather do anything other than a compliance inspection? Answer this poll question! Which best describes why you think people would want to avoid a compliance inspection? Like I said earlier, I didn t have a lot of confidence and I think I would choose inexperienced from this list. The numbers are starting to come in pretty quickly here and I m getting a lot of folks they say they are afraid. And hopefully once again if you follow what I instruct during this webinar we can overcome some of those fears and we can get you more prepared. Okay thank you all for participating in these polls. To get started, let s take a look at why we have a two-phased approach to the inspection process. The reason we do a two-phased approach is because it saves time, manpower, and funds. It provides a standard and consistent approach, and it holds all the major players in the process accountable. Now a breakdown in either the self-inspection or compliance process could mean the loss of vital national security assets or better yet, technological superiority. So let s start off by taking a look at the security inspection checklist, and the first phase, selfinspection. The Security Inspection Checklist is a 13 page document. It is used to conduct not only your self-inspections but also your compliance inspections. Now self-inspections are conducted annually and normally by CPSO/GSSOs. The CPSO or GSSO will inspect all the items on this checklist; self-inspection items, core-compliance items, and special emphasis items. So you re probably asking, so how do the CPSOs and GSSOs recognize what is a self-inspection item verses a core compliance or special emphasis items. Note the items in black on your checklist are your self-inspection items. Just like the instructions up here say, your core-compliance items are going to be identified in blue italic. Now what I want to do is, I want to take a quick look at item A-8 and you will see that this item here is in blue italicized font indicating that this a core-compliance inspection item. So there you should be able to tell immediately the difference between a self-inspection and a core-compliance inspection item.

4 Now special emphasis items are identified annually by your service component SAPCO. Some programs with have them and some don t. So for those that do have them place them in section O of the checklist which is located on the last page. The bottom line is don t forget to inspect all the items on the checklist. So as the CPSO or GSSO how do you use this checklist? Well we use a concept called read, observe, talk and take notes. You want to read the item and you want to check the reference for each one of them, so on this item the very first item, you want to read the item and you want to check the reference and you want to make sure you read so that you fully understand what is the compliance issue involving that item. You want to walk around your facility and observe people performing the process you have put in place. Now talk to people as well in the workplace and ask questions to see if they know, understand and can perform the processes that have been put in place. Take notes to identify weaknesses, corrective actions and effective processes so you can adjust as needed. For example one time I was conducting a self-inspection and one item said, could people operate the STE in secure mode? For those not familiar with the terms STE is a secure phone. The first thing I did was read the instructions on how to do it and practiced several times to make sure I could do it myself because I knew if someone couldn t I was going to have to put on my trainer hat and show them how. Then I walked around and I observed people using the STE in the secure mode. Then I came up on one employee who had a STE and I began talking to her and discovered she had never used the STE that s on her desk and she had the instructions but had never actually performed the task to put it in secure mode. So I showed her how to put the STE in secure mode, then had her demonstrate how to perform the task several times and then made a note to include this in my training program. So you can see by reading, observing, talking and taking notes you will increase your program effectiveness. Now this process also gets you on the way to become the subject matter expert. Most importantly though it helps you identify why an inspection item is in compliance, not in compliance, or not applicable to your checklist. Don t just take this checklist and answer your items as yes, no, or not applicable. Provide justification for each of your responses. What would you think if you were a PSO and your CPSO gave you this 13-page self-inspection checklist with only Yes, No, or Not Applicable blocks annotated? Go ahead and enter your responses in the chat box. As you can see here the items are just marked yes, no, and not applicable, what would you think if you were the PSO and you saw this. Yea gun decked I like that, it was pencil whipped. Nice going! I m getting a lot of folks saying it was pencil whipped. Nice! So probably not really done, lack the experience, pencil whipped, just went through, let me get to the process. Very good! Let me tell you what the moral of the story is about this

5 type of self- inspection report. Don t ever give one to your PSO. If you were the PSO and thought this self-inspection was pencil whipped how many of you would rate this selfinspection below satisfactory? Go ahead and raise your hand. I m getting almost 100 percent of you saying that yes that this would definitely be below satisfactory because it appears to be pencil whipped. So let me ask you this, What does a good self- inspection look like? Let s take a look at an example. Here are the first three items from Section A, the Security Management, and as you can see all three items are considered to be in compliance by the CPSO or GSSO because they answered yes to the items and here they are. The difference between answering yes though in this checklist versus yes in the previous example is that they provided some justification with supporting remarks. And here you can see the first item is brought out and this item has been marked yes and they re telling me exactly why this is in compliance. If this item had been marked no the CPSO or the GSSO would also explain why the item is not in compliance and would develop a corrective action plan to get the item into compliance. So how many of you by a show of hands would be willing to rate this checklist as satisfactory if you were the PSO? I m getting almost 100 percent compliance, folks are saying yes I would rate it satisfactory. You know what I have to agree. Now this is a little over simplification though of the validation, of the self-inspection and I don t want you to think this is how it s done, so we will explain how it s done in Phase 2 of the Compliance Inspection Process. What I want you to understand first is what happens if the selfinspection is considered below satisfactory or if it s satisfactory. Once a self-inspection is submitted the PSO will review it and the PSO will determine if the self-inspection is satisfactory or below satisfactory. If below satisfactory, the PSO will schedule a full scope inspection within 90 days, and the PSO will coordinate with the CPSO/GSSO to determine available dates for the inspection. Once the PSO gets the dates the SAPCO will issue a letter informing the GPM/CPSO/GSSO of the scheduled inspection dates. And a full scope inspection consists of inspecting all items in the 13-page self-inspection checklist. However if your self-inspection is rated satisfactory, the SAPCO will send a data call letter to schedule the Compliance Inspection. A sample data call letter is located in the File Share box or you can find it in Appendix I of the JAFAN 6/0 so let me see real quick. Raise your hands if your tracking so far. Let me see a raise of hands, is everybody following? Nice! Excellent! Thank you very much. Yes you re all getting on a track, very participating audience. Rachel I may have to take these folks on the road with me for my future performances. Sounds good. That ends the Phase 1 of the self-inspection.

6 Now we re going to move on to Phase 2 of the Compliance Inspection Process. Before we go let s take a poll to see what experience level I have in the audience. How would you rate your inspection experience? Okay, I m getting a lot of folks are between the 0-12 months, I do have some very experienced people with more than eight years, so thank you very much for attending this. That goes to show the folks with less experience that you can always pick up a good nugget, so training is very vital. Okay before I get into the compliance inspection phase let s look at how inspection teams are organized. An inspection may be organized on one of three ways. The first type is an inspection conducted by the PSO, and this inspection is normally reserved for small programs and the PSO assigns all the final ratings. Team inspections are used with multiple programs. Team Chiefs assign all the ratings and some of the members of the inspection team may include PSOs, information assurance, and counterintelligence and more team members may be added depending on the program complexity or the size of the operations. Joint inspections are used with multiple service/agency programs. They have a Joint Team Chief and each service or agency on the team will have a team chief. Now the difference here is the Joint Inspection team chief does not assign ratings. Ratings are assigned by the service or agency Team Chief. So regardless of the type of inspection team you are assigned, remember that any time that there is a significant finding that could result in less than a satisfactory rating the SAPCO must be notified. So how do inspectors get all their logistics together, assemble teams, inspect, and do reporting writing in such a short period of time? The answer is simple. They use a pre-inspection checklist, so if you don t have one of these and you re an inspector or going to be assigned to an inspection team you may want to develop one. A pre-inspection checklist should guide you through the entire inspection process from scheduling the submission of the final all the way through the scheduling to submission of the final report. Now this is just a small list of what you see on the slide that needs to be completed prior to conducting an inspection, but what I want to point out the most is about scheduling an inspection is to be sure to check with the host and community boards to determine if local events are taking place. Events can have a huge impact on lodging arrangements and traffic flow; for example every year here in Baltimore we have a Grand Prix and it may be a bad time to conduct an inspection in Baltimore during this event because the hotels are booked and the roads are used for the race. So just a word of caution about paying particular attention to events when planning your inspection dates. Alright so if you re ready to get started with the inspection let s go ahead, raise your hands or type in I m

7 Ready. Very good everybody s ready, excellent. Good job everyone you re doing a great job. Hang in there for just a few more minutes then we ll get your questions answered. Okay, so now the inspection team is onsite and we re ready to execute the inspection. Here are actions that will be taken once the team is onsite. An in-brief will be conducted. Now if you want to learn more about how to develop and conduct an in-brief, attend the instructor-led Orientation to SAP Security Compliance Inspections course, and we go into depth on how to do that. After the in-brief the PSO is going to sit down with the CPSO or the GSSO to review any inconsistencies with the self-inspection. We will discuss core inspection and special emphasis items, out-briefs and report writing later in this webinar. But what I want to do next is demonstrate how the PSO will conduct an onsite review/validation of an inspection item. To show you how to validate a self-inspection I have selected item A-26 from a self-inspection checklist that I received from the CPSO. The item states: Are security infractions documented and made available for review by the PSO during visits? Now I m doing my document review and I don t remember five, I only remember four. So I check my log and sure enough my log only shows four incidents, so I have an inconsistency. So when I arrive onsite I begin my validation process I m going to discuss this item with the CPSO or the GSSO, and here s how I m going to proceed. Remember when I said we read, observe, talk and take notes during the selfinspection? The same process applies when you are inspecting. I just want to mention that it does not have to be in the exact order. The first thing I m going to do is talk to the CPSO or GSSO. I am going to ask them to explain the notification process, and if they have a Standard Operating Procedure (SOP). Then I am going to read their SOP and security infraction reports. Next I want to observe or check where they store the reports. Is there something in there that they didn t report? And then lastly, I want to note what the inconsistency is. Is it my fault or did they miss a step? Once I determine what caused the inconsistency I ll move on to the next item until I validated all the items I selected from the self-inspection checklist. Now for items marked no I want to see a corrective action plan and where the facility is at in the process of getting the item in compliance. And once I ve completed the onsite review and validation of all inspection items with inconsistencies then I will rate the self-inspection as either below satisfactory or satisfactory. Now for the purpose of this webinar I rated the self-inspection as satisfactory. Now I will move to inspecting the core compliance and special emphasis items using the exact same process.

8 During the inspection of the core compliance and special emphasis items you will make notes and start categorizing your notes into deficiencies, observations, and government action items. I want to emphasize though here the importance of the how goes it meetings during multiple day inspections. These should be conducted toward the end-of-the-day before you depart the facility. These meetings help you: Build rapport, they help you get buy-in, and they give the organization an opportunity to explain maybe a deficiency or finding that you ve noted. I found that if I discovered an item that was not in compliance, the organization will be able to tell me what they are going to do to bring the item into compliance. Sometimes they don t know how to bring the item into compliance so based on my expertise I can share some of my expertise and then give them recommendations on how to bring an item into compliance. This is called validating your deficiencies, observations, and Government action items. This process is one method that will help you as an inspector to leave the program in better shape than you found it. I just want to spend a minute on findings, observations, and Government action items so you understand what they are, but I can t make you an expert on them in this webinar. Deficiencies are broken down into two categories: findings and deviations. Findings are further broken down as critical or repeat. A deviation is an administrative compliance issue. But remember multiple deviations could lead to a finding. Observations do not require corrective action, however, if not corrected could result in a future deficiency. Observations could be based on your experience or maybe you observed a process that is not mandatory, but is a good process that makes the program better. You can note this and share the information with other facilities or program managers. Now Government action items are discrepancies caused by the Government, for example, you don t have an approval letter signed and on hand for a copier. You received verbal permission, but the PSO hasn t sent you the signed copy of the letter. This would be a deficiency and I know this gets program managers, CPSOs, GSSOs upset, but remember what I said about this two-phased process at the beginning: it holds everyone involved in the process accountable, which is why everyone involved in the program needs to be working together like a well- oiled machine. As I said I can t make you an expert on how to categorize these in this webinar, but they are discussed extensively during the instructor-led Orientation to SAP Security Compliance Inspection course. We give you several scenarios and you decide whether a process is a deficiency, observation, or a Government action item. Once all the deficiencies and observations are documented, it is time to assign a rating.

9 Ratings are assigned to each category in the checklist. In addition, an overall rating is assigned to the program. One poor rating in any section could affect the overall rating of the program. Now the rating definitions are found in the JAFAN 6/0 page 9. If your component uses a different rating system, follow that guidance. Now based on my experience, superior and commendable ratings are very difficult to achieve, but not impossible if you follow the instructions I have provided for this webinar. Next, you will conduct the out-brief and just like the in-brief we can t spend a whole lot of time on how to do that but we do give you the opportunity to develop and conduct out-briefs in the instructor-led Orientation to SAP Security Compliance Inspections course, so I won t spend a lot of time on this but I do encourage you to attend the course. What I want to stress is the importance of the Senior Management Summary Briefing. Senior management likes to know what is coming: good, bad, or indifferent. It is out of respect and courtesy they are briefed before the formal out-brief. Blind siding a senior official only destroys all the good effort you put in to establishing rapport throughout the inspection process, so make sure you conduct a Senior Management Summary Briefing. Lastly, you write and submit the final report and it should be submitted within 7 to 10 business days and documented on the SAP format 19. You can download that from the File Share at the bottom to get a glimpse of one. You will see it emphasizes all the categories on the selfinspection checklist. This is another area we provide extensive training on during the Orientation to SAP Security Compliance Inspections course, that s report writing. Now that you participated in this webinar and you have some tools to make you successful during your self-inspections and compliance inspections, answer this question. Which would you rather do now? Now I m seeing that many of you would prefer to be in a one-hour compliance inspection and in fact I m getting there it goes. Still there s some folks who would rather write their performance appraisal report and it is that time of year to do that so I understand, and there s still that couple that would like to do mandatory on-line training, but almost 90 percent of you say you would rather do a one hour compliance inspection. So thank you all very much and with that I m going to give you a big high five; so go ahead and raise those hands and give me one back! Nice! Thank you all very much. Now let s see what questions we have.

10 I got a question that says: What happens if during the onsite review and validation of the selfinspection it is rated less than satisfactory and unacceptable? Per the JAFAN 6/0, the PSO is going to depart and schedule the organization for a full scope inspection and return within 90 days. So if we paid attention during this webinar we re not going to be in that status. What would be included and not included in security files? And here I believe we are talking about personnel security files and there s a list of minimum required documentation that can be found in the JAFAN 6/0, paragraph Another question I have here: Is there a minimum link to the security refresher? Once again according to the JAFAN 6/0, paragraph it talks about training topics. They are listed on the SAP format 17. There is no minimum link of how long the training has to be. The requirement is that all the topics on the list have to be completed. So the JAFAN does not address the length of the training time only that it s required. That s all the questions I have for right now. There were several other questions that came in and we will respond to those in a frequently asked questions letters that we will be posting after the seminar today. So once again thank you for participating and attending this webinar. Be sure to visit the CDSE website for information about upcoming webinars and other security-related training resources. We will be posting those frequently asked questions related to this webinar at the address posted on your screen. You can find out more about the Orientation to SAP Security Compliance Inspections course at the address posted on the screen as well, and the next course will be held August here in Linthicum, Maryland. You may also SAP security training-related questions to us at the address provided. Additionally, we will be sending out a thank you which will include a link enabling you to provide feedback on today s webinar. Your feedback is very helpful to us and is greatly appreciated. If you have just a few minutes please take the brief survey. You are able to also suggest additional webinar topics in that survey. Ladies and gentlemen, once again thank you for your participation and for attending today s webinar. We have landed, this concludes the webinar and I wish you all a very pleasant day!

11