FSO PROS Archives: Security Snippet

Monthly Newsletter

Cybersecurity

October 19, 2026

Cybersecurity plays an essential role in protecting your organization, customers, and national security. October is Cybersecurity Awareness Month, which makes it a great time to strengthen our understanding of common cyber risks and reinforce simple practices that help keep systems, data, and people safe.

Every cleared contractor facility should have clear, actionable cybersecurity policies and procedures in place that guide the secure use of information systems. These protections work best when everyone understands them and follows them every day.

Even simple practices, when performed consistently, help reduce the likelihood of incidents across the entire Defense Industrial Base.

 

Understanding Cybersecurity Risks

Strong cybersecurity depends on more than technology. It depends on people who pause, question, and make security-minded decisions every day. At every level of your organization, those choices help protect systems, information, and the mission.

As cyber threats evolve, attackers continue to exploit familiar vulnerabilities: a moment of distraction, a rushed response, or a warning sign that goes unnoticed.

Threat actors often use well crafted emails, malicious links, unsafe downloads, or attempts to trick personnel into revealing information or approving access they did not intend to grant. They often research their targets in advance, tailoring their messages or approaches to appear legitimate. These efforts are designed to bypass technical filters and rely on the natural trust and attention of individuals.

Common cybersecurity risks include:

  • Phishing emails that appear legitimate but contain malicious links or attachments
  • Unexpected requests for passwords or multifactor authentication codes
  • Unknown devices connected to networks or systems
  • Use of unapproved applications or storage media
  • Suspicious activity on accounts or systems
  • Attempts to access information without a valid reason
  • Misuse or mishandling of sensitive, controlled unclassified, and classified information

Some cyber attacks are designed to be subtle, unfolding in stages over time. Early signs may seem minor or easy to dismiss, which is why awareness and reporting are so important.

You do not need to determine whether an activity is malicious. Your responsibility is to simply take precautions, recognize when something looks unusual, and report it to your security team.

 

Cybersecurity Best Practices

Consistent everyday actions help reduce the risk of cyber incidents.

Simple steps include:

  • Use strong and unique passwords
  • Enable multifactor authentication whenever possible
  • Lock devices when stepping away
  • Avoid connecting unknown USB drives or accessories
  • Carefully check the sender address before opening links or attachments
  • Use approved storage and communication tools for sensitive information
  • Keep systems and applications updated
  • Report suspicious requests, emails, or activity immediately

Following your organization’s acceptable use policies, using approved communication channels, and keeping work and personal activities separate on devices are additional steps that help limit opportunities for threat actors. Even routine actions like verifying the legitimacy of requests or checking for unexpected behavior can prevent compromise.

Cybersecurity is a shared responsibility, and small habits make a big difference.

 

Reporting Cybersecurity Concerns and Incidents

What to Report:

Report anything that seems out of place or unusual within your digital environment, including:

  • Suspicious emails or messages asking you to click, download, or share information
  • Requests for passwords or authentication codes
  • Unexpected account lockouts or login alerts
  • System behavior that seems unusual or inconsistent with normal operation
  • Missing files or changes you did not make
  • Attempts by others to access information or systems without a valid need to know
  • Possible spillage or exposure of sensitive, CUI, or classified information
  • Any device, cable, or accessory you do not recognize
  • Email addresses, websites, links, or attachments that look fraudulent or unsafe
  • Reporting small or isolated events may feel insignificant, but even minor anomalies can be important pieces of a much larger picture. Your observation may help prevent a widespread incident or alert the organization to a developing threat.

When in doubt, report it. Small clues can prevent large problems.

Why Reporting is Critical:

Rapid reporting allows security personnel to act quickly, contain risks, and prevent small issues from becoming major incidents. Early notification helps the organization understand what occurred, protect systems and data, assist personnel if needed, and meet federal requirements for cyber incident response.

For cleared contractor facilities, timely reporting is not only a best practice but an important part of maintaining compliance with contractual and regulatory expectations, including safeguarding information and ensuring continuity of operations.

Reporting does not require certainty. You do not need to know whether something was a threat or a mistake. Sharing what you observed ensures your security officials can investigate and determine next steps.

How to Report and Who to Report to:

If you see something that raises concern, report it as soon as possible.

All cybersecurity concerns should be reported to your organization’s Information Technology (IT) Team and Facility Security Officer (FSO) as quickly as possible. If you work at a government site or another contractor location, reporting to your local IT and security office may be more appropriate. If you are unsure who to report cybersecurity concerns to, contact your FSO for guidance.

Never attempt to contain or investigate a suspected cyber incident on your own. Actions such as rebooting devices, deleting suspicious emails, or attempting to troubleshoot issues can interfere with analysis. Report what you observed and allow your IT and security teams to take appropriate action.

When providing a report, provide as much detail as you can, such as what you saw or received, when it occurred, and any actions you took. Your security team will review the information and determine whether additional action is needed.

 

Resources and Additional Learning

Continued learning is an important part of supporting a strong security program. The resources below offer helpful guidance, job aids, training modules, and official policy documents that reinforce the topics discussed in this newsletter. We encourage all personnel to explore these materials and become familiar with the tools and requirements that govern and support your organization’s industrial security program.

Cyber Awareness Challenge

DCSA Cybersecurity Awareness course

DCSA Cybersecurity Toolkit

CDSE Case Studies

Security Awareness Games

32 CFR Part 117 (NISPOM Rule)

32 CFR Part 147 (Adjudicative Guidelines)

 

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

Insider Threat Awareness

September 18, 2026

Insider Threat

Insider threats may seem unlikely, but they’re one of the most significant risks facing organizations within the defense and national security communities. During Insider Threat Awareness Month, we’re reinforcing key concepts around insider threat and highlighting how each of us plays an important role in identifying and reporting early indicators.

Every cleared contractor facility is required to maintain an organization wide Insider Threat Program Plan. This plan outlines how the organization identifies, responds to, and mitigates insider threat risks, and ensures personnel know how to report potential concerns. All personnel should have access to their facility’s Insider Threat Program Plan. If you have not received information about yours, contact your Facility Security Officer (FSO) or Insider Threat Program Security Official (ITPSO) immediately.

Understanding Insider Threats

Insider threats occur when individuals with authorized access (employees, contractors, or trusted partners) use that access, either intentionally or unintentionally, in ways that could harm national security, the organization, its personnel, or its information. Insider threats are not limited to espionage or classified information compromise. They can also involve the mishandling of CUI, cybersecurity risks, fraud, workplace violence, sabotage, serious negligence, and more.

Insider threat risks often develop gradually over time. In many cases, early indicators are observable long before any damage occurs. These indicators may appear as changes in behavior, attempts to bypass security procedures, unusual access patterns, or signs of personal stressors that could impact judgment.

You are not expected to investigate or diagnose these concerns, only to recognize and report them. The Insider Threat Program is designed to evaluate information, provide support when needed, and ensure risks are addressed early and appropriately.

Indicators of an Insider Threat

Insider threat indicators are observable behaviors, actions, or circumstances that may suggest an individual is at risk of misusing their authorized access. These indicators do not confirm wrongdoing, and they are not intended to diagnose a situation. Instead, they help identify concerns that may warrant further review by your security team. The examples below are not exhaustive, and insider threat indicators can appear in many different ways depending on the situation and the individual involved.

Behavioral Indicators

Behavioral indicators are actions or patterns that appear unusual or inconsistent with normal expectations. Examples include:

  • Attempts to ignore or work around security rules
  • Sudden or unexplained frustration with the organization or coworkers
  • Noticeable changes in reliability or personal conduct
  • Expressions of resentment or hostility toward the workplace
  • Personal stressors such as financial difficulties or legal issues that appear to affect judgment

Information Security and Cyber Indicators

Information security indicators involve suspicious or inappropriate activity related to systems or digital information. Examples include:

  • Attempts to access information without a valid need to know
  • Excessive downloading or transferring of files
  • Use of unauthorized devices, storage media, or applications
  • Repeated failed login attempts or unusual access patterns
  • Attempts to alter or delete data without authorization

Workplace and Professional Indicators

Workplace indicators reflect unusual changes in behavior or performance within the professional environment. Examples include:

  • Repeated conflicts with supervisors or colleagues
  • Efforts to operate outside assigned duties or responsibilities
  • Unexplained decline in work quality or consistency
  • Resistance to feedback or corrective measures
  • Attempts to conceal mistakes or avoid accountability

Physical Security Indicators

Physical security indicators relate to attempts to gain access to areas or information without proper authorization. Examples include:

  • Attempting to enter restricted or classified areas without approval
  • Tailgating or escort issues
  • Leaving badges unattended or allowing others to use access credentials
  • Unusual interest in physical layouts or security procedures

Personal Conduct Indicators

Personal conduct indicators involve circumstances that may impact judgment or increase vulnerability. Examples include:

  • Sudden financial strain or unexplained wealth
  • Substance misuse
  • Threatening statements or conduct
  • Significant life stressors affecting behavior or workplace engagement
  • Expressions of desperation or withdrawal paired with unusual workplace behavior

Reporting Insider Threat Concerns

Reporting insider threat indicators is one of the most effective ways to prevent harm before it occurs. Most insider threat incidents do not happen suddenly. They typically develop over time, and early warning signs are often visible long before any damage is done. When personnel report concerning behaviors or unusual activity early, the security team can review the information, provide support when appropriate, and take steps to reduce risk to national security, the organization, and all personnel.

Reporting concerns does not mean you are accusing someone of wrongdoing. It simply ensures that your security officials can evaluate the situation and determine what actions, if any, may be needed. Even a small observation can be an important part of a larger picture.

It is important to note that we should report information relevant to the concerning behavior or activity and avoid sharing personal details that are not connected to the concern.

How to Report

Reporting insider threat concerns is simple. If you observe behavior or activity that seems unusual, inconsistent with policy, out of place, or otherwise concerning, document what you saw and notify your security officials as soon as possible. Include dates, times, observations, and any context you feel may be helpful. You do not need certainty or proof. You only need to share what you observed.

If you are unsure whether something should be reported, make the report and allow your security officials to determine next steps.

Who to Report To

All insider threat concerns must be reported directly to your Facility Security Officer (FSO) or your Insider Threat Program Security Official (ITPSO). These officials are responsible for reviewing the information, coordinating with other security and counterintelligence personnel when needed, and ensuring all actions align with regulatory requirements. If you work at a government site or a host contractor location, you may also notify their security staff but always ensure your facility FSO or ITPSO is informed.

Resources and Additional Learning

Continued learning is an important part of supporting a strong security program. The resources below offer helpful guidance, job aids, training modules, and official policy documents that reinforce the topics discussed in this newsletter. We encourage all personnel to explore these materials and become familiar with the tools and requirements that govern and support your organization’s industrial security program.

CDSE Insider Threat Awareness course

CDSE Insider Threat for Industry Curriculum

CDSE Insider Threat Toolkit

CDSE Insider Threat Resources

CDSE Case Studies

Security Awareness Games

32 CFR Part 117 (NISPOM Rule)

32 CFR Part 147 (Adjudicative Guidelines)

 

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

 

Understanding and Reporting Security Incidents

August 18, 2026

Understanding security incidents and staying vigilant in our daily work are essential to protecting national security, our organization, our customers, and our data. This month, we’re focusing on how to recognize a security incident, understand the difference between an infraction and a violation, and ensure proper and timely reporting.

 

Defining Security Incidents: Infractions vs. Violations

A security incident is any occurrence that involves, or could reasonably lead to, the loss, compromise, or suspected compromise of classified information or controlled unclassified information (CUI).

While 32 CFR Part 117 (NISPOM) governs classified information requirements, most government contractor organizations operate under multiple federal frameworks (FAR, DFARS, NARA etc.), and incidents involving CUI must also be reported.

Security incidents typically arise when a required security procedure was not followed or was improperly applied. Examples include unsecured classified or CUI documents, improper receipt or handling of information or access credentials, or spillage involving classified information on an unclassified network or CUI on networks not authorized to handle CUI.

Incidents are categorized as either a security infraction or a security violation. It’s easy to confuse these terms, but the distinction is important for determining required responses and reporting.

 

Security Infraction

A Security Infraction is a security incident that does not result in the loss, compromise, or suspected compromise

of classified information. Infractions require an initial inquiry to facilitate immediate actions, identify root causes, and take corrective action to strengthen the security program. Although an infraction is not a security violation, uncorrected or repeated infractions can increase risk and may eventually contribute to a compromise.

 

Security Violation

A Security Violation is a security incident that did or reasonably could result in the loss or compromise of classified information. Violations require a formal investigation, documented analysis, and a final determination.

In either case, Security Incidents can be  intentional, unintentional, or inadvertent and can reveal recent or recurring patterns of questionable judgment, irresponsibility, negligence, or carelessness.

 

How Compromise is Determined

Security incidents are evaluated to determine whether classified information was lost, compromised, suspected of compromise, or not compromised.

Loss: Loss occurs when classified information cannot be physically located or accounted for (for example, material discovered missing during an audit and not immediately located). If classified information is transmitted through unsecure means, it is treated as a loss at a minimum and may be elevated depending on exposure.

Compromise: Compromise occurs when there is an unauthorized disclosure of classified information to an individual who does not possess the appropriate clearance, access authorization, or need‑to‑know.

Suspected Compromise: Suspected compromise occurs when identifiable classified information was made available to unauthorized individuals who may have gained access. Although proving direct access may be difficult, the facts would lead a reasonable person to conclude unauthorized access more than likely occurred. Examples include physical or electronic storage of classified information in unsecured areas for extended periods where unauthorized personnel had unrestricted or unmonitored access.

No compromise: A no‑compromise determination is made when the facts show that no classified information was lost, compromised, or suspected of compromise. Contractors must still produce a final report documenting the incident and determination.

Although compromise determinations under 32 CFR Part 117 (NISPOM) apply primarily to classified information, organizations must make similar assessments related to potential exposure of CUI in accordance with applicable federal requirements.

These determinations guide the required reporting steps and ensure the incident is handled in accordance with 32 CFR Part 117 (NISPOM) requirements.

 

Reporting Security Incidents

 

What to Report

Any event, large or small, that could involve the loss, compromise, or suspected compromise of classified information, or could otherwise affect the confidentiality, integrity, or availability of organizational systems or data, is a security incident and must be reported.

Security incidents may also involve CUI, which must be safeguarded and reported in accordance with federal handling requirements.

Report any occurrence involving:

  • Improper handling, storage, or transmission of classified information or CUI
  • Classified material found in an unapproved or unsecured location
  • Possible loss, compromise, or suspected compromise
  • Unsecure communication channels used for classified discussions or data
  • Spillage of classified onto an unclassified network, system, device, or platform
  • Spillage of CUI onto an unauthorized system, device, network, or platform
  • Improper receipt or handling of classified information or CUI
  • Questionable access situations (e.g., personnel without a verified need‑to‑know near classified material)
  • Passwords, access badges, authentication tokens left out in plain sight
  • Lost or stolen access cards, badges, authentication tokens, materials, etc.
  • Unlocked workstations or devices left unattended
  • Security containers left unlocked in a secured area
  • Anything unusual, unsafe, or out of place involving classified information or security procedures

If you discover anything that may indicate a security procedure was not followed, or may not have been in place, report it immediately. If you’re ever unsure, err on the side of reporting.

 

 

How to Report

All security incidents, whether categorized as infractions or violations, must be reported immediately upon discovery. Prompt reporting allows the security team to:

  • Contain risks before they escalate
  • Investigate root causes, determine the incident category, and determine if classified has been compromised
  • Protect systems, data, and personnel
  • Provide required notifications to the Cognizant Security Agency (CSA) when applicable

A “wait and see” approach creates avoidable gaps that threat actors and environmental factors can easily exploit.

Report all security incidents to the appropriate security POCs immediately upon discovery:

  • Company FSO (always)
  • Host U.S. Government (USG) security staff, if located at a government location
  • Host contractor security staff, if located at another contractor location

Share what you know at the time; additional details can be added as they develop.

You should never be penalized for reporting a concern in good faith. Underreporting introduces far more risk than reporting something that ultimately proves harmless.

Any occurrence that may involve classified information or controlled unclassified information being lost, improperly handled, exposed, accessed by unauthorized individuals, or placed at risk must be reported immediately. If you see something unusual, unsafe, or out of place, report it.

 

 

Why Reporting Matters

Timely reporting is essential to maintaining a secure operating environment. When incidents are reported quickly, security personnel can take immediate action to contain risks, determine whether classified information was exposed, and ensure all requirements under 32 CFR Part 117 are met. Early notification also helps prevent small issues from becoming major vulnerabilities and ensures the organization consistently protects classified information, personnel, and mission objectives. Ultimately, reporting strengthens our overall security posture and supports full compliance with Government standards.

 

Resources and Additional Learning

CDSE Job Aid Special Circumstances for Reporting Security Incidents

CDSE Security Incidents Reporting Requirements

DoD CUI Registry

DoD CUI Policies

NARA CUI References

FAR 52.204-21

DFARS 252.204-7012

CDSE Case Studies

Security Awareness Games

32 CFR Part 117 (NISPOM Rule)

32 CFR Part 147 (Adjudicative Guidelines)

 

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

Unauthorized Disclosure: It’s Not Always Intentional

July 20, 2026

Unauthorized disclosures rarely begin with bad intentions. More often, they happen during quick conversations, fast moving emails, working in the wrong system, or assuming everyone in the room already has the appropriate need to know.

For those of us supporting the National Industrial Security Program (NISP), protecting classified information and Controlled Unclassified Information (CUI) is part of our daily responsibilities. While cyber and physical security tend to get most of the attention, routine interactions can create risks if we aren’t careful.

Understanding Unauthorized Disclosure

An unauthorized disclosure occurs any time classified information or CUI ends up somewhere it shouldn’t—whether shared with someone without proper access, stored on the wrong system, discussed in an uncontrolled environment, or otherwise mishandled.

Authorization requires more than simply holding a clearance. The recipient must have:

  • The appropriate level of clearance (if classified)
  • A valid need to know
  • Authorization to access the specific information

If any one of these elements is missing, the disclosure is NOT authorized. Let’s clear up a common misconception.

Myth: “If someone has a clearance, I can discuss classified information with them.”

Fact: A clearance alone is not enough. Access requires a demonstrated need to know and any program specific authorizations.

CUI: A Frequently Overlooked Risk

Many personnel are comfortable spotting risks involving classified information but overlook CUI—material protected by law, regulation, or government wide policy even though it isn’t classified.

A few examples include, but are not limited to:

  • Procurement sensitive information
  • Export controlled data
  • For Official Use Only (FOUO) or Sensitive but Unclassified (SBU) material
  • Controlled technical information
  • Privacy information (PII)

CUI does not require a clearance, but it does require authorized access, approved systems, and proper safeguarding. We should treat CUI with the same level of care we apply to preventing classified spills.

Everyday Risks: Classified & CUI

Unauthorized disclosures often come from ordinary activities and habits:

  • Forgetting to check if an email thread contains CUI before hitting “Reply All”
  • Pulling up sensitive documents during virtual meetings without verifying participants
  • Mixing classified and CUI discussions without confirming what can be shared
  • Copying/pasting project details into public facing documents
  • Uploading CUI to unapproved collaboration tools or storage locations

Small oversights can create big vulnerabilities.

How Unauthorized Disclosures Happens

Here are a few real world situations we may encounter:

  • Mentioning a milestone schedule in front of visitors, not realizing it is CUI
  • Receiving a draft with embedded CUI that wasn’t marked
  • Getting a “quick context” question from someone whose access level is unclear
  • Moving between networks and saving sensitive files in the wrong location

None of these feel reckless, but they still count as unauthorized disclosures.

Unauthorized disclosures can also occur in everyday environments:

  • Discussing sensitive work in public places such as airports, restaurants, or elevators
  • Forwarding emails without confirming all recipients are authorized
  • Using the wrong collaboration platform or distribution list
  • Leaving sensitive material visible during virtual meetings or screen sharing
  • Assuming a coworker “already knows” without verifying need to know

Most of these situations are preventable with a brief pause to verify before sharing.

Good Habits for Preventing Unauthorized Disclosure

Before sharing sensitive information, ask yourself:

  • Who is receiving this information?
  • Do they have the appropriate authorization and need to know?
  • Is this the correct communication method?
  • Am I sharing only what is necessary for the task?

A few simple behaviors go a long way:

  • Check classification and CUI markings when opening, editing, or sharing documents
  • Verify access and need to know—even when you think someone is read in
  • Keep sensitive conversations in controlled spaces and on approved systems
  • Slow down before sending emails, especially cross organization
  • Properly mark CUI according to DoD or agency specific guidance
  • When uncertain, pause and ask—your security team is here to support you

These habits take only seconds and help prevent reportable security incidents.

Reporting Mistakes

Mistakes happen—and fast reporting is critical.

If you believe protected information may have been disclosed to an unauthorized person:

  • Stop any additional sharing
  • Preserve any relevant information
  • Notify your Facility Security Officer (FSO) immediately
  • Avoid trying to resolve the issue on your own

Prompt reporting allows your security team to assess the situation, limit potential damage, and meet mandatory reporting requirements.

Final Thought

Protecting information isn’t about making work harder—it’s about ensuring sensitive information reaches only those who are authorized to receive it. A quick verification today can prevent a security incident tomorrow.

This Month’s Challenge: Before sending your next sensitive email or discussing a protected project, take five seconds to verify the recipient, the need-to-know, and the communication method. Small habits make a big difference.

Want to Learn More?

Resources and Additional Learning

CDSE Unauthorized Disclosure of Classified and CUI

CDSE Unauthorized Disclosure Student Guide

CDSE Unauthorized Disclosure Toolkit

DNI Unauthorized Disclosure

National Archives Unauthorized Disclosure Prevention and Reporting

CDSE Case Studies

Security Awareness Games

32 CFR Part 117 (NISPOM Rule)

32 CFR Part 147 (Adjudicative Guidelines)

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

AI Driven Social Engineering: The New Threat Targeting Federal Contractors

June 15, 2026

Artificial intelligence driven social engineering is no longer a theoretical concern. It is already being used by adversaries to target federal contractors because of the sensitive information, predictable workflows, and publicly visible roles common in this environment. It is important to understand why this threat deserves your attention and how it affects every cleared and uncleared individual.

AI has made social engineering attacks faster, more convincing, and harder to detect. Federal contractors are now prime targets because adversaries can use AI to mimic coworkers, generate realistic emails, and scrape public data to craft highly personalized attacks.

Bottom line: If you work within the federal government space, whether working directly on a government contract or supporting a federal contractor organization, you are a target…regardless of your role, clearance level, or seniority.

How AI Changes the Threat Landscape

AI tools give attackers new capabilities that make their messages and requests appear legitimate. This section outlines the specific ways AI enhances an attacker’s ability to deceive you and why traditional red flags are becoming harder to spot.

  • AI crafted phishing creates messages that look authentic, match your writing style, and reference real project details.
  • Voice cloning allows attackers to imitate a PM, COR, or FSO with only seconds of audio.
  • Automated reconnaissance lets AI tools scan LinkedIn, company sites, and conference lists to map who works on what.
  • Fake documents and memos can include realistic DD254s, onboarding forms, or urgent tasking requests.

These attacks are designed to look normal. That is what makes them dangerous.

Common AI Driven Attack Scenarios

AI powered attacks often appear as routine work requests. Here are a few short, realistic examples of how these attacks show up in daily operations, so you can recognize them quickly and respond safely.

“I Need This Now”

You receive an email or call with a cloned voice from someone you supposedly know, often someone in a position of authority, asking you to pay an invoice, buy something for them urgently, provide business or contract information, asking for their “forgotten” login credentials, or send a CUI package to a personal email because a portal is down.

 “New Subcontractor Access Request”

A realistic looking onboarding form asks you to grant SharePoint access to a supposed teaming partner.

“Conference Logistics Update”

Before a defense conference, you receive a message asking for passport scans or travel details.

“Security Compliance Reminder”

A fake memo claims to be from your FSO and asks you to go to this new link and complete a training.

These are just a few examples but, you can see how in each scenario they are attempting to exploit trust, urgency, and familiar workflows.

How to Protect Yourself, Your Organization, and Your Program

Even as AI attacks become more sophisticated, the most effective defenses remain simple and consistent. This section focuses on practical steps that anyone can apply immediately, regardless of technical background or job role.

Verify Every Request: Use known contact methods, not the ones provided in the message. Check that the email address or phone number is the one you know to be legitimate for the individual. Verify with the person directly, if you are unsure. If something feels off, it probably is.

Slow Down When You See Urgency: Attacks often rely on pressure. Pause. Confirm. Then act.

Protect Your Online Footprint: Limit what you post about. Attackers will use any data they can find to personalize their approach. You should always avoid posting:

  • Program information, including program names
  • Travel
  • Job duties
  • Clearances

Follow CUI Handling Rules Without Exception: No alternate channels. No quick sends. No personal email. Ever.

Report Suspicious Activity Immediately: Your FSO would rather investigate a false alarm than a real compromise. Always use your organization’s reporting channel or contact your security office directly.

Good security comes from consistent habits. Adopt a “Verify First” mindset. Before sending information, granting access, or clicking a link, confirm the request through a trusted channel.

What to Report and How to Report It

Social engineering attacks succeed when suspicious activity goes unreported. Early reporting allows your security team to stop an incident before it spreads, protect sensitive information, and identify patterns that may indicate a larger targeting effort.

 

Report any activity that feels unusual, unexpected, or inconsistent with normal procedures. This includes:

  • Suspicious emails or messages such as unexpected requests for data, access, or login information.
  • Unusual phone calls including urgent requests, unfamiliar numbers, or voices that do not sound quite right.
  • Unexpected document requests especially those involving CUI, PII, or program details.
  • Strange online contact such as unknown individuals asking about your job, travel, or project.
  • Any suspected impersonation whether by email, phone, or social media.

If you are unsure whether something is reportable, treat it as reportable.

Follow your organization’s established reporting process. In most contractor environments, this includes:

  • Contacting your FSO or security office using a known phone number or email.
  • Submitting an internal security incident report through your organization’s reporting system.
  • Providing copies or screenshots of suspicious messages when possible.
  • Reporting immediately even if you already deleted the message or declined the request.

Your FSO would always rather review a false alarm than miss a real threat.

Resources and Additional Learning

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

Mental Health & Security Clearances

May 15, 2026

Mental health is a critical component of readiness, resilience, and long‑term performance in the federal contracting workforce. Yet one of the most persistent misconceptions is the belief that seeking mental health care jeopardizes a security clearance.

In reality, the modern personnel clearance vetting system recognizes that responsible self‑care strengthens national security, and untreated issues — not treatment — are what raise concerns. In this month’s newsletter, we’ll break down some facts, dispel a few myths, and provide clear guidance on what to report and how to stay compliant.

Understanding Mental Health Factors in Security

The security clearance system evaluates mental health through the lens of judgment, reliability, and trustworthiness. It does not penalize individuals for seeking help. Adjudicators look for signs of stability, insight, and responsible behavior — all of which are demonstrated when someone proactively manages their mental health.

Mental health considerations are evaluated under the national adjudicative guidelines using the “whole-person” concept.

Key points:

  • Treatment is considered a positive indicator of responsibility.
  • Untreated or concealed issues are more concerning than diagnosed, managed conditions.
  • The whole‑person concept means no single factor determines eligibility.

What the Data Shows

Despite official guidance, many contractor personnel still fear that therapy or counseling could threaten their clearance. The data tells a different story.

Psychological conditions alone account for relatively few security clearance denials or revocations.

Cases that do raise concerns typically involve untreated conditions, impaired judgment, lack of compliance with treatment recommendations, failure to comply with reporting requirements, or efforts to conceal relevant issues — not participation in treatment itself.

The system is designed to encourage treatment, not discourage it. This misunderstanding can lead to avoidance of care, which increases stress and decreases mission readiness.

How Adjudicators Evaluate Mental Health Considerations

When mental health information is relevant, adjudicators focus on:

  • Stability over time
  • Consistency in treatment
  • Professional recommendations
  • Impact on daily functioning
  • Demonstrated reliability in work and personal life

Adjudicators focus on whether a condition affects judgment, reliability, or trustworthiness. Proactive treatment and demonstrated stability are generally viewed positively.

Self-Reporting Mental Health Considerations

During completion of the personnel vetting questionnaire and under ongoing personnel security reporting requirements, cleared and covered individuals may be required to report certain mental-health-related situations.

Cleared and covered individuals are required to self-report specific mental‑health‑related situations:

  • Court‑ordered mental health evaluations or treatment
  • Inpatient hospitalizations (voluntary or involuntary)
  • Mental health conditions or behaviors that substantially impair judgment, reliability, or trustworthiness
  • Conditions that substantially affect your ability to function safely or responsibly

You are NOT required to report:

  • Routine outpatient counseling for stress management, grief support, or relationship issues
  • Employee Assistance Program (EAP) sessions

Reporting Mental Health Concerns About Others

In high‑trust environments like the federal contracting workforce, everyone plays a role in safeguarding national security. While individuals are responsible for managing and reporting their own mental health information, there are situations where you may observe behaviors in others that raise legitimate concerns about judgment, reliability, or ability to safeguard information.

This is not about diagnosing someone — it’s about recognizing when a colleague’s behavior may indicate a security concern, whether mental‑health‑related or not.

When Should You Report a Concern?

You should report a concern when you observe behaviors that could reasonably indicate a risk to:

  • Judgment
  • Reliability
  • Emotional stability
  • Safety
  • Ability to protect classified information

Examples include:

  • Sudden or extreme changes in behavior or mood
  • Statements indicating hopelessness, self‑harm, or harm to others
  • Severe emotional distress that interferes with work
  • Erratic or unpredictable behavior in secure environments
  • Substance misuse that affects functioning

These behaviors are security‑relevant regardless of whether they stem from mental health, stress, personal issues, or other causes.

What You Should NOT Do

  • Do not attempt to diagnose the person
  • Do not confront them aggressively or speculate about their condition
  • Do not share your concerns widely with coworkers
  • Your role is to observe and report, not to investigate or intervene clinically.

Why Reporting Matters and How to Report Concerns

Reporting concerns is intended to protect both personnel and national security. Early reporting can help individuals access support, prevent escalation, and reduce risk to the mission. Many issues can be resolved through assistance, counseling, or temporary adjustments.

The goal is to encourage personnel to seek support early, use available resources, and remain compliant with applicable reporting requirements. DCSA emphasizes that the intent is to support personnel, not penalize them.

Reporting is not punitive — it is protective. Early reporting allows:

  • Supportive intervention
  • Access to resources
  • Prevention of escalation
  • Protection of the individual and the mission

Reporting requirements can vary by agency, contract, and employer policy. When in doubt, consult your organization’s Facility Security Officer (FSO). They can get the information into the right hands for evaluation and are trained to protect privacy and support any further action that may be needed.

Mental health concerns or behaviors, about yourself or someone else, should be reported to your FSO. They can evaluate the situation, protect privacy, and determine whether further action is needed.

If there is an immediate safety concern, contact emergency services.

 

Resources and Additional Learning

 

As always, if you have any questions…consult your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate reporting obligations, compliance requirements, and personnel security processes.

Foreign Travel Reporting Requirements

April 17, 2026

Traveling outside the United States can expose U.S. citizens to increased risks, including potential targeting—even in low-risk destinations. Taking appropriate precautions is essential to maintaining safety and awareness.

In accordance with Security Executive Agent Directive 3 (SEAD 3), certain personnel—referred to as “covered individuals”—are required to comply with foreign travel reporting requirements, designed to protect personnel, organizations, and national security interests.

All foreign travel by covered individuals is subject to pre- and post-travel reporting requirements, regardless of whether the travel is personal, business related, government contract related, or for any other reason.

Who Foreign Travel Reporting Applies To

“Covered individuals” are required to report foreign travel.

Covered individuals include personnel designated by their agency or organization who, due to their role, access, or affiliation, are subject to foreign travel reporting requirements under SEAD 3. This may include, but is not limited to, individuals with access to classified information, sensitive information, systems, or facilities.

Employees, consultants, and contractors supporting organizations that perform work for the U.S. Government may be designated as covered individuals and therefore subject to foreign travel briefing and reporting requirements.

If you are unsure if you are considered a covered individual, it is your responsibility to contact your Facility Security Officer (FSO) for clarification.

Before You Travel: Pre-Travel Briefing & Reporting

Covered individuals are required to report any planned foreign travel in advance of departure.

Whenever possible, you should notify your FSO at least 30 days in advance. This allows sufficient time for your security team to assess potential risks, provide country-specific guidance, and coordinate any required briefings prior to travel.

What must be reported:

All travel outside the U.S., including to Canada and Mexico, regardless of purpose.

Required Actions:

  • Notify your Facility Security Officer (FSO) at least 30 days in advance of departure, whenever possible.
  • Complete any required pre-travel briefings.
  • Complete all required pre-travel reporting forms.
  • Submit your travel itinerary through the appropriate channels designated by your organization.
  • Review applicable travel advisories or restricted country lists.
  • Ensure your contact and emergency information is current.
  • Report any changes to your travel itinerary to your FSO as soon as possible.

Additional approvals or briefings may be required depending on destination risk level or duration of travel, particularly for high-threat locations.

Special Circumstances:

  • Border travel (Canada and Mexico): Planned travel must still be reported prior to departure. Unplanned or short notice travel must be reported within five (5) days of return.
  • Overseas assignments: If you are assigned or stationed outside the United States, travel outside your country of assignment must be reported in accordance with these requirements.
  • Transits / layovers: Travel that includes layovers or transit through a foreign country is reportable foreign travel.
  • Cruise travel: Cruises that visit foreign ports are considered reportable foreign travel, regardless of whether you disembark.
  • Extended stays or repeated travel: Each instance of foreign travel must be reported, including repeated or short-duration trips.
  • Dual citizenship / foreign residency ties: Travel to a country of dual citizenship or prior residence remains subject to reporting requirements and must be conducted using a U.S. passport in accordance with applicable requirements.
  • Family or personal visits abroad: Travel to visit family, relatives, or personal contacts in a foreign country is reportable foreign travel.

While Traveling: Stay Alert

While outside the United States, you are expected to maintain a heightened level of awareness.

Key considerations:

  • Do not disclose classified, sensitive, proprietary, or controlled information.
  • Do not bring government-furnished or organization-issued equipment without prior written authorization from the appropriate authority.
  • Limit use of government-issued or work devices unless specifically authorized.
  • Be cautious with all electronic devices. Treat foreign networks and systems as potentially unsecure and assume they may be subject to monitoring or compromise.
  • Be alert to and disengage from suspicious interactions or inquiries. Report any suspicious contacts or incidents as soon as feasible.
  • Comply with all local laws while continuing to meet U.S. security expectations.
  • Report any changes to your travel itinerary to your Facility Security Officer (FSO) as soon as possible.

After You Return: Post-Travel Reporting

Post-travel reporting and debriefing is a critical component of SEAD 3 compliance. Covered individuals are expected to report their return from foreign travel within 72 hours of arrival in the United States.

Timely post-travel reporting is required and is just as important as pre-travel reporting.

You are required to:

  • Complete a foreign travel debrief or report.
  • Confirm return from foreign travel within required reporting timelines.
  • Confirm that no government-furnished, organization/company-furnished, or personal devices, systems, or credentials were compromised during travel or as a result of foreign contact.
  • Submit any required post-travel documentation or reporting forms through the appropriate security channel.

You are required to report any notable or unusual incidents, including (but not limited to):

  • Questioning by foreign officials beyond normal customs or immigration procedures.
  • Attempts to elicit classified, sensitive, or controlled information.
  • Attempts to elicit information under casual, social, or indirect pretexts.
  • Attempts by foreign nationals to establish ongoing contact.
  • Casual conversations that evolve into questions about job, access, or organization details.
  • New relationships (of any nature) with foreign nationals with whom you intend to maintain ongoing contact.
  • Offers of gifts, favors, or incentives.
  • Any interaction that was suspicious, persistent, caused concern, or appeared out of the ordinary.
  • Indicators of surveillance, monitoring, or being followed during travel.
  • Suspicious observation, photography, recording, or documentation of you or your activities.
  • Device anomalies or unexpected device behavior, such as unexplained resets, new apps, signs of tampering, loss of device control, forced login prompts, or unexpected lockouts.
  • Unusual financial interactions or inducements, suspicious payments, reimbursements, or attempts to engage you in financial arrangements.
  • Attempts to coerce, pressure, intimidate, blackmail, or influence behavior or decision-making during or after travel.
  • Any travel disruption or interference that appears intentional or unusual.

Timely and accurate post-travel reporting enables security personnel to assess potential risk indicators and take appropriate mitigation actions.

Why Foreign Travel Briefing and Reporting Matters

Foreign travel can increase the risk of targeting by foreign intelligence services, as well as exposure to foreign intelligence collection, exploitation, or coercion. Reporting requirements under SEAD 3 are intended to reduce these risks and ensure appropriate support if issues arise.

Reporting foreign travel also plays an important role in personal safety. In the event of natural disasters, civil unrest, or other emergencies abroad, having your travel on record allows your organization to quickly account for your location and provide assistance if needed. This enables faster coordination of communication, support, and, when necessary, evacuation.

These requirements are not just procedural—they are designed to safeguard personnel and national security.

Failure to comply with reporting obligations may result in administrative or security-related action and could impact your security clearance or eligibility to perform on government contracts.

If you’re unsure whether your travel needs to be reported, contact your FSO or security team before making plans. Reporting travel in advance ensures the appropriate briefing and reporting requirements can be identified and applied to your specific circumstances.

Staying informed and meeting reporting requirements helps reduce risk and ensures appropriate support is available when it matters most.

Resources and Additional Learning

As always, if you have any questions, ask your FSO. Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

Reporting Requirements

March 16, 2026

Understanding your responsibilities under
Security Executive Agent Directive 3 (SEAD 3) and 32 CFR Part 117 (NISPOM Rule)

Organizations that perform work on U.S. Government classified contracts must comply with strict reporting requirements under Security Executive Agent Directive 3 and the 32 CFR Part 117 (NISPOM Rule).These requirements apply not only to cleared facilities, but also to Covered Individuals working within those organizations.

Reporting concerns, incidents, or suspicious behaviors helps protect national security and ensures organizations maintain their ability to perform classified work.

Why Reporting Matters
Security reporting is one of the most important responsibilities of anyone working in a federal contractor environment. Timely reporting:

  • Helps identify and mitigate potential threats to national security
  • Helps safeguard an organization’s ability to perform classified work
  • Supports counterintelligence efforts.
  • Protects sensitive government information.

Key reassurances:

  • Self-reporting concerns about your own situation shows honesty, reliability, and integrity.
  • Reporting does not automatically mean someone has done something wrong or will get in trouble.
  • Following reporting requirements is not tattling — it is a professional responsibility.
  • Reporting allows security professionals to review a situation, provide guidance, and resolve potential issues before they become larger problems.

Who Must Report
Reporting is everyone’s responsibility. Anyone working for or with a cleared contractor facility should report security concerns, incidents, or suspicious behavior to their Facility Security Officer.

Covered Individuals also have specific requirements to self-report certain information about themselves.

A Covered Individual is anyone who:

  • Holds a security clearance
  • Is in the process of obtaining a clearance
  • Occupies a Sensitive Position
  • Occupies a position where reporting requirements have been applied by any U.S. government agency or customer.

Sensitive positions include roles where an individual could potentially impact national security, even if they do not have access to classified information.

If you work for or with a cleared contractor facility, you likely have reporting responsibilities—even if you do not hold a security clearance.

What Must Be Reported
While it is not possible to list every reportable situation, the categories below highlight the most common reporting requirements.

All personnel should report concerns related to:

  • Espionage, sabotage, terrorism, or subversive activities
  • Security incidents or violations
  • Suspicious contacts or information collection attempts
  • Adverse information (criminal activity, financial issues, substance misuse)
  • Insider threat indicators
  • Foreign travel
  • Foreign contacts
  • Foreign influence
  • Foreign financial or business interests
  • Personal status changes
  • Cyber intrusions, incidents, or suspicious online activity

Espionage, Sabotage, Terrorism, Subversive Activities – All personnel must report to the FSO immediately:

  • Any circumstance of actual, probable, or possible espionage, sabotage, terrorism, or subversive activities directed at the United States.

Security Incidents – All personnel must report to the FSO immediately:

  • Any known or suspected security incident, violation, infraction, or vulnerability—regardless of who may be responsible.
    • Spillage, Loss, compromise, or suspected loss or compromise of classified material
    • Physical or technical security vulnerabilities
    • Failure to follow proper security procedures

Suspicious Contact – All personnel must report to the FSO immediately:

  • Any contact with known or suspected intelligence officers from any country
  • Any attempt by any individual, regardless of nationality, to
    • Obtain illegal or unauthorized access to classified or sensitive information
    • Exploit or compromise any personnel
    • Establish unusual relationships

Adverse Information: All personnel must report to the FSO immediately:

  • Any information or activities that could adversely reflect on the integrity, trustworthiness, reliability, or character of an individual or that suggests a person’s access to USG information may not be in the interest of national security. Some examples include:
    • Criminal conduct or arrests
    • Financial difficulties or unexplained affluence
    • Substance abuse/misuse
    • Significant personal conduct issues
    • Behavior indicating poor judgment or unreliability
    • Actions that could make a person vulnerable to exploitation or coercion

Insider Threat Indicators – All personnel must report to the FSO immediately:

  • Any information or behavior that may indicate any other person may be a potential insider threat risk. NOTE: Insider Threat indicators are broad. Your company should have an Insider Threat Plan (ITP) that covers this in depth and should have provided you with insider threat awareness training. If you have not taken Insider Threat Awareness training or you do not have access to your company’s ITP, notify your FSO ASAP.

Foreign Travel

  • Covered individuals must report to the FSO, 30 days prior to departure:
    • All foreign travel, both personal and professional.
  • All personnel must report:
    • Travel to high-threat locations
    • Travel inconsistent with financial resources or official duties
    • Short trips inconsistent with logical vacation travel and that is not part of official duties

Foreign Contacts and Influence – Covered individuals must report to the FSO immediately:

  • Close and continuing contact with any foreign national
    • This includes all relatives/family members, friends, acquaintances, romantic relationships, business relationships, etc., whether by phone, mail, e-mail, internet, social media, or in person
  • Contact with anyone associated with any foreign person or foreign entity (Foreign entity includes: foreign-owned organizations, businesses, or governments including a foreign embassy.)
  • Financial obligations to any foreign person or entity
  • Any attempts to solicit a person to act as a representative of any foreign entity

Foreign Financial or Business Interests – Covered personnel must report to the FSO immediately:

  • Foreign investments
  • Foreign bank accounts
  • Foreign real estate purchases
  • Investments in any foreign entity, stocks, or person
  • Employment or consulting engagements with any foreign entity or person
  • Ownership of foreign state-backed, hosted, or managed cryptocurrency
  • Ownership of cryptocurrency wallets hosted by foreign exchanges

Personal Status Changes – Covered personnel must report to the FSO immediately:

  • Name changes (for any reason) and aliases
  • Change in marital status (Marriage, Separation, or Divorce)
  • Change in cohabitation status (New or ended cohabitation)
  • Engagement to a foreign national
  • New immediate relatives
  • Change in citizenship, including obtaining dual citizenship or citizenship by naturalization
  • Change in employment status or any change in requirements for access to classified

Cyber Intrusions and Incidents – All personnel must report to the FSO immediately:

  • Any actual, possible, or potential penetration of information systems or use of technology to target or exploit covered entities and individuals. Some examples include:
    • Phishing attempts
    • Suspicious network activity
    • Unauthorized credential use
    • Cyber intrusions
    • Spillage
    • Online attempts to target or recruit personnel through elicitation, solicitation and marketing of services, direct requests for information

Note – RAP Back Enrollment: Individuals who undergo fingerprinting for a national security clearance are enrolled in the FBI’s Record of Arrest and Prosecution (RAP) Back Program. This program supports continuous vetting under the Trusted Workforce 2.0 framework by notifying U.S. Government agencies when updates to an individual’s criminal history appear in FBI records.

Even with continuous vetting, Covered Individuals are still required to self-report in accordance with SEAD 3.

Self-reporting concerns before they are identified through automated checks often allows issues to be addressed before they become more serious or impact an individual’s clearance eligibility. Self-reporting is often viewed as a positive indicator of honesty, reliability, and integrity during the adjudicative process.

How to Report
If you see something concerning, learn information that may be reportable, or experience a reportable situation yourself–report it to your Facility Security Officer.

If internal reporting is not possible, certain issues may also be reported to the DoD OIG Hotline. The hotline allows individuals to report: Fraud, Waste, Abuse, Whistleblower reprisal, Bribery, Contract or procurement fraud, Conflicts of interest, and certain other types of information. You can learn more about the DoD Hotline here: https://www.dodig.mil/Hotline

Using the DoD Hotline does not relieve you of your reporting obligations under SEAD 3, 32 CFR Part 117, and contractual requirements. Covered Individuals must still report required information to their Facility Security Officer.

When in doubt–report the concern to your Facility Security Officer.

Resources and Additional Learning
Reporting Requirements at a Glance
DCSA Self-Reporting
NISP Reporting Requirements
SEAD 3 – Reporting
SEAD 3 ISL2021-02
SEAD 3 Short
Adjudications – The Whole Person Concept
Reporting the Threat
Reporting Requirements Crossword
Reporting Requirements Word Search
Security Awareness Games
32 CFR Part 117 (NISPOM Rule)
32 CFR Part 147 (Adjudicative Guidelines)

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

Categories

Archives

Learn how FSO PROS® can help
support your security program

Let’s discuss how we can help support your security and compliance needs.
Secret Link