Cybersecurity plays an essential role in protecting your organization, customers, and national security. October is Cybersecurity Awareness Month, which makes it a great time to strengthen our understanding of common cyber risks and reinforce simple practices that help keep systems, data, and people safe.
Every cleared contractor facility should have clear, actionable cybersecurity policies and procedures in place that guide the secure use of information systems. These protections work best when everyone understands them and follows them every day.
Even simple practices, when performed consistently, help reduce the likelihood of incidents across the entire Defense Industrial Base.
Understanding Cybersecurity Risks
Strong cybersecurity depends on more than technology. It depends on people who pause, question, and make security-minded decisions every day. At every level of your organization, those choices help protect systems, information, and the mission.
As cyber threats evolve, attackers continue to exploit familiar vulnerabilities: a moment of distraction, a rushed response, or a warning sign that goes unnoticed.
Threat actors often use well crafted emails, malicious links, unsafe downloads, or attempts to trick personnel into revealing information or approving access they did not intend to grant. They often research their targets in advance, tailoring their messages or approaches to appear legitimate. These efforts are designed to bypass technical filters and rely on the natural trust and attention of individuals.
Common cybersecurity risks include:
- Phishing emails that appear legitimate but contain malicious links or attachments
- Unexpected requests for passwords or multifactor authentication codes
- Unknown devices connected to networks or systems
- Use of unapproved applications or storage media
- Suspicious activity on accounts or systems
- Attempts to access information without a valid reason
- Misuse or mishandling of sensitive, controlled unclassified, and classified information
Some cyber attacks are designed to be subtle, unfolding in stages over time. Early signs may seem minor or easy to dismiss, which is why awareness and reporting are so important.
You do not need to determine whether an activity is malicious. Your responsibility is to simply take precautions, recognize when something looks unusual, and report it to your security team.
Cybersecurity Best Practices
Consistent everyday actions help reduce the risk of cyber incidents.
Simple steps include:
- Use strong and unique passwords
- Enable multifactor authentication whenever possible
- Lock devices when stepping away
- Avoid connecting unknown USB drives or accessories
- Carefully check the sender address before opening links or attachments
- Use approved storage and communication tools for sensitive information
- Keep systems and applications updated
- Report suspicious requests, emails, or activity immediately
Following your organization’s acceptable use policies, using approved communication channels, and keeping work and personal activities separate on devices are additional steps that help limit opportunities for threat actors. Even routine actions like verifying the legitimacy of requests or checking for unexpected behavior can prevent compromise.
Cybersecurity is a shared responsibility, and small habits make a big difference.
Reporting Cybersecurity Concerns and Incidents
What to Report:
Report anything that seems out of place or unusual within your digital environment, including:
- Suspicious emails or messages asking you to click, download, or share information
- Requests for passwords or authentication codes
- Unexpected account lockouts or login alerts
- System behavior that seems unusual or inconsistent with normal operation
- Missing files or changes you did not make
- Attempts by others to access information or systems without a valid need to know
- Possible spillage or exposure of sensitive, CUI, or classified information
- Any device, cable, or accessory you do not recognize
- Email addresses, websites, links, or attachments that look fraudulent or unsafe
- Reporting small or isolated events may feel insignificant, but even minor anomalies can be important pieces of a much larger picture. Your observation may help prevent a widespread incident or alert the organization to a developing threat.
When in doubt, report it. Small clues can prevent large problems.
Why Reporting is Critical:
Rapid reporting allows security personnel to act quickly, contain risks, and prevent small issues from becoming major incidents. Early notification helps the organization understand what occurred, protect systems and data, assist personnel if needed, and meet federal requirements for cyber incident response.
For cleared contractor facilities, timely reporting is not only a best practice but an important part of maintaining compliance with contractual and regulatory expectations, including safeguarding information and ensuring continuity of operations.
Reporting does not require certainty. You do not need to know whether something was a threat or a mistake. Sharing what you observed ensures your security officials can investigate and determine next steps.
How to Report and Who to Report to:
If you see something that raises concern, report it as soon as possible.
All cybersecurity concerns should be reported to your organization’s Information Technology (IT) Team and Facility Security Officer (FSO) as quickly as possible. If you work at a government site or another contractor location, reporting to your local IT and security office may be more appropriate. If you are unsure who to report cybersecurity concerns to, contact your FSO for guidance.
Never attempt to contain or investigate a suspected cyber incident on your own. Actions such as rebooting devices, deleting suspicious emails, or attempting to troubleshoot issues can interfere with analysis. Report what you observed and allow your IT and security teams to take appropriate action.
When providing a report, provide as much detail as you can, such as what you saw or received, when it occurred, and any actions you took. Your security team will review the information and determine whether additional action is needed.
Resources and Additional Learning
Continued learning is an important part of supporting a strong security program. The resources below offer helpful guidance, job aids, training modules, and official policy documents that reinforce the topics discussed in this newsletter. We encourage all personnel to explore these materials and become familiar with the tools and requirements that govern and support your organization’s industrial security program.
DCSA Cybersecurity Awareness course
32 CFR Part 147 (Adjudicative Guidelines)
As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.
