FSO PROS Category: Security Policies & Reporting Requirements

Monthly Newsletter

Foreign Travel Reporting Requirements

April 17, 2026

Traveling outside the United States can expose U.S. citizens to increased risks, including potential targeting—even in low-risk destinations. Taking appropriate precautions is essential to maintaining safety and awareness.

In accordance with Security Executive Agent Directive 3 (SEAD 3), certain personnel—referred to as “covered individuals”—are required to comply with foreign travel reporting requirements, designed to protect personnel, organizations, and national security interests.

All foreign travel by covered individuals is subject to pre- and post-travel reporting requirements, regardless of whether the travel is personal, business related, government contract related, or for any other reason.

Who Foreign Travel Reporting Applies To

“Covered individuals” are required to report foreign travel.

Covered individuals include personnel designated by their agency or organization who, due to their role, access, or affiliation, are subject to foreign travel reporting requirements under SEAD 3. This may include, but is not limited to, individuals with access to classified information, sensitive information, systems, or facilities.

Employees, consultants, and contractors supporting organizations that perform work for the U.S. Government may be designated as covered individuals and therefore subject to foreign travel briefing and reporting requirements.

If you are unsure if you are considered a covered individual, it is your responsibility to contact your Facility Security Officer (FSO) for clarification.

Before You Travel: Pre-Travel Briefing & Reporting

Covered individuals are required to report any planned foreign travel in advance of departure.

Whenever possible, you should notify your FSO at least 30 days in advance. This allows sufficient time for your security team to assess potential risks, provide country-specific guidance, and coordinate any required briefings prior to travel.

What must be reported:

All travel outside the U.S., including to Canada and Mexico, regardless of purpose.

Required Actions:

  • Notify your Facility Security Officer (FSO) at least 30 days in advance of departure, whenever possible.
  • Complete any required pre-travel briefings.
  • Complete all required pre-travel reporting forms.
  • Submit your travel itinerary through the appropriate channels designated by your organization.
  • Review applicable travel advisories or restricted country lists.
  • Ensure your contact and emergency information is current.
  • Report any changes to your travel itinerary to your FSO as soon as possible.

Additional approvals or briefings may be required depending on destination risk level or duration of travel, particularly for high-threat locations.

Special Circumstances:

  • Border travel (Canada and Mexico): Planned travel must still be reported prior to departure. Unplanned or short notice travel must be reported within five (5) days of return.
  • Overseas assignments: If you are assigned or stationed outside the United States, travel outside your country of assignment must be reported in accordance with these requirements.
  • Transits / layovers: Travel that includes layovers or transit through a foreign country is reportable foreign travel.
  • Cruise travel: Cruises that visit foreign ports are considered reportable foreign travel, regardless of whether you disembark.
  • Extended stays or repeated travel: Each instance of foreign travel must be reported, including repeated or short-duration trips.
  • Dual citizenship / foreign residency ties: Travel to a country of dual citizenship or prior residence remains subject to reporting requirements and must be conducted using a U.S. passport in accordance with applicable requirements.
  • Family or personal visits abroad: Travel to visit family, relatives, or personal contacts in a foreign country is reportable foreign travel.

While Traveling: Stay Alert

While outside the United States, you are expected to maintain a heightened level of awareness.

Key considerations:

  • Do not disclose classified, sensitive, proprietary, or controlled information.
  • Do not bring government-furnished or organization-issued equipment without prior written authorization from the appropriate authority.
  • Limit use of government-issued or work devices unless specifically authorized.
  • Be cautious with all electronic devices. Treat foreign networks and systems as potentially unsecure and assume they may be subject to monitoring or compromise.
  • Be alert to and disengage from suspicious interactions or inquiries. Report any suspicious contacts or incidents as soon as feasible.
  • Comply with all local laws while continuing to meet U.S. security expectations.
  • Report any changes to your travel itinerary to your Facility Security Officer (FSO) as soon as possible.

After You Return: Post-Travel Reporting

Post-travel reporting and debriefing is a critical component of SEAD 3 compliance. Covered individuals are expected to report their return from foreign travel within 72 hours of arrival in the United States.

Timely post-travel reporting is required and is just as important as pre-travel reporting.

You are required to:

  • Complete a foreign travel debrief or report.
  • Confirm return from foreign travel within required reporting timelines.
  • Confirm that no government-furnished, organization/company-furnished, or personal devices, systems, or credentials were compromised during travel or as a result of foreign contact.
  • Submit any required post-travel documentation or reporting forms through the appropriate security channel.

You are required to report any notable or unusual incidents, including (but not limited to):

  • Questioning by foreign officials beyond normal customs or immigration procedures.
  • Attempts to elicit classified, sensitive, or controlled information.
  • Attempts to elicit information under casual, social, or indirect pretexts.
  • Attempts by foreign nationals to establish ongoing contact.
  • Casual conversations that evolve into questions about job, access, or organization details.
  • New relationships (of any nature) with foreign nationals with whom you intend to maintain ongoing contact.
  • Offers of gifts, favors, or incentives.
  • Any interaction that was suspicious, persistent, caused concern, or appeared out of the ordinary.
  • Indicators of surveillance, monitoring, or being followed during travel.
  • Suspicious observation, photography, recording, or documentation of you or your activities.
  • Device anomalies or unexpected device behavior, such as unexplained resets, new apps, signs of tampering, loss of device control, forced login prompts, or unexpected lockouts.
  • Unusual financial interactions or inducements, suspicious payments, reimbursements, or attempts to engage you in financial arrangements.
  • Attempts to coerce, pressure, intimidate, blackmail, or influence behavior or decision-making during or after travel.
  • Any travel disruption or interference that appears intentional or unusual.

Timely and accurate post-travel reporting enables security personnel to assess potential risk indicators and take appropriate mitigation actions.

Why Foreign Travel Briefing and Reporting Matters

Foreign travel can increase the risk of targeting by foreign intelligence services, as well as exposure to foreign intelligence collection, exploitation, or coercion. Reporting requirements under SEAD 3 are intended to reduce these risks and ensure appropriate support if issues arise.

Reporting foreign travel also plays an important role in personal safety. In the event of natural disasters, civil unrest, or other emergencies abroad, having your travel on record allows your organization to quickly account for your location and provide assistance if needed. This enables faster coordination of communication, support, and, when necessary, evacuation.

These requirements are not just procedural—they are designed to safeguard personnel and national security.

Failure to comply with reporting obligations may result in administrative or security-related action and could impact your security clearance or eligibility to perform on government contracts.

If you’re unsure whether your travel needs to be reported, contact your FSO or security team before making plans. Reporting travel in advance ensures the appropriate briefing and reporting requirements can be identified and applied to your specific circumstances.

Staying informed and meeting reporting requirements helps reduce risk and ensures appropriate support is available when it matters most.

Resources and Additional Learning

As always, if you have any questions, ask your FSO. Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

Reporting Requirements

March 16, 2026

Understanding your responsibilities under
Security Executive Agent Directive 3 (SEAD 3) and 32 CFR Part 117 (NISPOM Rule)

Organizations that perform work on U.S. Government classified contracts must comply with strict reporting requirements under Security Executive Agent Directive 3 and the 32 CFR Part 117 (NISPOM Rule).These requirements apply not only to cleared facilities, but also to Covered Individuals working within those organizations.

Reporting concerns, incidents, or suspicious behaviors helps protect national security and ensures organizations maintain their ability to perform classified work.

Why Reporting Matters
Security reporting is one of the most important responsibilities of anyone working in a federal contractor environment. Timely reporting:

  • Helps identify and mitigate potential threats to national security
  • Helps safeguard an organization’s ability to perform classified work
  • Supports counterintelligence efforts.
  • Protects sensitive government information.

Key reassurances:

  • Self-reporting concerns about your own situation shows honesty, reliability, and integrity.
  • Reporting does not automatically mean someone has done something wrong or will get in trouble.
  • Following reporting requirements is not tattling — it is a professional responsibility.
  • Reporting allows security professionals to review a situation, provide guidance, and resolve potential issues before they become larger problems.

Who Must Report
Reporting is everyone’s responsibility. Anyone working for or with a cleared contractor facility should report security concerns, incidents, or suspicious behavior to their Facility Security Officer.

Covered Individuals also have specific requirements to self-report certain information about themselves.

A Covered Individual is anyone who:

  • Holds a security clearance
  • Is in the process of obtaining a clearance
  • Occupies a Sensitive Position
  • Occupies a position where reporting requirements have been applied by any U.S. government agency or customer.

Sensitive positions include roles where an individual could potentially impact national security, even if they do not have access to classified information.

If you work for or with a cleared contractor facility, you likely have reporting responsibilities—even if you do not hold a security clearance.

What Must Be Reported
While it is not possible to list every reportable situation, the categories below highlight the most common reporting requirements.

All personnel should report concerns related to:

  • Espionage, sabotage, terrorism, or subversive activities
  • Security incidents or violations
  • Suspicious contacts or information collection attempts
  • Adverse information (criminal activity, financial issues, substance misuse)
  • Insider threat indicators
  • Foreign travel
  • Foreign contacts
  • Foreign influence
  • Foreign financial or business interests
  • Personal status changes
  • Cyber intrusions, incidents, or suspicious online activity

Espionage, Sabotage, Terrorism, Subversive Activities – All personnel must report to the FSO immediately:

  • Any circumstance of actual, probable, or possible espionage, sabotage, terrorism, or subversive activities directed at the United States.

Security Incidents – All personnel must report to the FSO immediately:

  • Any known or suspected security incident, violation, infraction, or vulnerability—regardless of who may be responsible.
    • Spillage, Loss, compromise, or suspected loss or compromise of classified material
    • Physical or technical security vulnerabilities
    • Failure to follow proper security procedures

Suspicious Contact – All personnel must report to the FSO immediately:

  • Any contact with known or suspected intelligence officers from any country
  • Any attempt by any individual, regardless of nationality, to
    • Obtain illegal or unauthorized access to classified or sensitive information
    • Exploit or compromise any personnel
    • Establish unusual relationships

Adverse Information: All personnel must report to the FSO immediately:

  • Any information or activities that could adversely reflect on the integrity, trustworthiness, reliability, or character of an individual or that suggests a person’s access to USG information may not be in the interest of national security. Some examples include:
    • Criminal conduct or arrests
    • Financial difficulties or unexplained affluence
    • Substance abuse/misuse
    • Significant personal conduct issues
    • Behavior indicating poor judgment or unreliability
    • Actions that could make a person vulnerable to exploitation or coercion

Insider Threat Indicators – All personnel must report to the FSO immediately:

  • Any information or behavior that may indicate any other person may be a potential insider threat risk. NOTE: Insider Threat indicators are broad. Your company should have an Insider Threat Plan (ITP) that covers this in depth and should have provided you with insider threat awareness training. If you have not taken Insider Threat Awareness training or you do not have access to your company’s ITP, notify your FSO ASAP.

Foreign Travel

  • Covered individuals must report to the FSO, 30 days prior to departure:
    • All foreign travel, both personal and professional.
  • All personnel must report:
    • Travel to high-threat locations
    • Travel inconsistent with financial resources or official duties
    • Short trips inconsistent with logical vacation travel and that is not part of official duties

Foreign Contacts and Influence – Covered individuals must report to the FSO immediately:

  • Close and continuing contact with any foreign national
    • This includes all relatives/family members, friends, acquaintances, romantic relationships, business relationships, etc., whether by phone, mail, e-mail, internet, social media, or in person
  • Contact with anyone associated with any foreign person or foreign entity (Foreign entity includes: foreign-owned organizations, businesses, or governments including a foreign embassy.)
  • Financial obligations to any foreign person or entity
  • Any attempts to solicit a person to act as a representative of any foreign entity

Foreign Financial or Business Interests – Covered personnel must report to the FSO immediately:

  • Foreign investments
  • Foreign bank accounts
  • Foreign real estate purchases
  • Investments in any foreign entity, stocks, or person
  • Employment or consulting engagements with any foreign entity or person
  • Ownership of foreign state-backed, hosted, or managed cryptocurrency
  • Ownership of cryptocurrency wallets hosted by foreign exchanges

Personal Status Changes – Covered personnel must report to the FSO immediately:

  • Name changes (for any reason) and aliases
  • Change in marital status (Marriage, Separation, or Divorce)
  • Change in cohabitation status (New or ended cohabitation)
  • Engagement to a foreign national
  • New immediate relatives
  • Change in citizenship, including obtaining dual citizenship or citizenship by naturalization
  • Change in employment status or any change in requirements for access to classified

Cyber Intrusions and Incidents – All personnel must report to the FSO immediately:

  • Any actual, possible, or potential penetration of information systems or use of technology to target or exploit covered entities and individuals. Some examples include:
    • Phishing attempts
    • Suspicious network activity
    • Unauthorized credential use
    • Cyber intrusions
    • Spillage
    • Online attempts to target or recruit personnel through elicitation, solicitation and marketing of services, direct requests for information

Note – RAP Back Enrollment: Individuals who undergo fingerprinting for a national security clearance are enrolled in the FBI’s Record of Arrest and Prosecution (RAP) Back Program. This program supports continuous vetting under the Trusted Workforce 2.0 framework by notifying U.S. Government agencies when updates to an individual’s criminal history appear in FBI records.

Even with continuous vetting, Covered Individuals are still required to self-report in accordance with SEAD 3.

Self-reporting concerns before they are identified through automated checks often allows issues to be addressed before they become more serious or impact an individual’s clearance eligibility. Self-reporting is often viewed as a positive indicator of honesty, reliability, and integrity during the adjudicative process.

How to Report
If you see something concerning, learn information that may be reportable, or experience a reportable situation yourself–report it to your Facility Security Officer.

If internal reporting is not possible, certain issues may also be reported to the DoD OIG Hotline. The hotline allows individuals to report: Fraud, Waste, Abuse, Whistleblower reprisal, Bribery, Contract or procurement fraud, Conflicts of interest, and certain other types of information. You can learn more about the DoD Hotline here: https://www.dodig.mil/Hotline

Using the DoD Hotline does not relieve you of your reporting obligations under SEAD 3, 32 CFR Part 117, and contractual requirements. Covered Individuals must still report required information to their Facility Security Officer.

When in doubt–report the concern to your Facility Security Officer.

Resources and Additional Learning
Reporting Requirements at a Glance
DCSA Self-Reporting
NISP Reporting Requirements
SEAD 3 – Reporting
SEAD 3 ISL2021-02
SEAD 3 Short
Adjudications – The Whole Person Concept
Reporting the Threat
Reporting Requirements Crossword
Reporting Requirements Word Search
Security Awareness Games
32 CFR Part 117 (NISPOM Rule)
32 CFR Part 147 (Adjudicative Guidelines)

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.

32 CFR Part 117 (NISPOM)

February 17, 2026

If you hold a U.S. government security clearance, you’ve probably heard the term “NISPOM.” But what exactly is it—and why should you care?

In 2021, the former DoD manual DoD 5220.22-M (NISPOM) was formally codified into federal regulation as 32 CFR Part 117, making it the authoritative rule governing the National Industrial Security Program. 32 CFR Part 117 is issued by the U.S. Department of Defense and applies to all contractors working with classified information under the National Industrial Security Program (NISP).

This rule implements policy, assigns responsibilities, establishes requirements, and provides procedures for the protection of classified information that is disclosed to, or developed by, U.S. Government contractors.

It prescribes industrial security procedures and practices to safeguard U.S. government classified information, including rules, requirements, restrictions, and other safeguards designed to prevent unauthorized disclosure of classified information and protect special classes of classified information.

In simple terms, the NISPOM is the rulebook that tells companies and individuals what they must do to properly protect classified information.

It covers things like:

  • Who can access classified information, when they can access it, and where they can access it
  • How classified information must be handled, stored, and transmitted
  • Required security practices, procedures, and restrictions for contractors and their personnel
  • Security training requirements
  • Reporting requirements
  • Insider threat program requirements

The 32 CFR Part 117 (NISPOM) Origin Story

The 32 CFR Part 117 (NISPOM) rule is based on a myriad of higher-level executive orders, laws, and federal regulations that govern how the U.S. protects national security information.

Here are a few of the key foundations:

The National Industrial Security Program (NISP): Executive Order 12829 established the National Industrial Security Program. This Executive Order:

  • Created a uniform program to safeguard classified information released to contractors
  • Assigned oversight responsibilities to federal agencies
  • Required a standard set of rules for industry

32 CFR Part 117 (NISPOM) is the regulation that implements this Executive Order.

Executive Order 13526 on Classified National Security Information: The main authority for how classified information is handled across the federal government. This Executive Order:

  • Defines what “classified information” is
  • Establishes classification levels (Confidential, Secret, Top Secret)
  • Sets rules for safeguarding and declassification

The NISPOM aligns industry practices with those government-wide rules.

Information Security Oversight Office (ISOO) – 32 CFR Part 2004: Establishes the authorities and responsibilities of the Information Security Oversight Office (ISOO), which operates under the National Archives and Records Administration (NARA). This regulation:

  • Defines ISOO’s role in overseeing the government-wide security classification system
  • Establishes its authority to issue and implement directives for classified national security information
  • Provides oversight of how executive branch agencies protect classified information

32 CFR Part 2004 gives ISOO the authority to issue government-wide policy guidance which agencies, including the Department of Defense, implement through regulations such as 32 CFR Part 117.

Other Supporting Laws and Policies: The NISPOM also reflects requirements from other federal criminal laws related to espionage and unauthorized disclosure, personnel security standards, insider threat policy requirements, and information safeguarding laws.

Federal agencies turn executive orders and laws into enforceable rules through the Code of Federal Regulations (CFR). 32 CFR Part 117 is located in Title 32 (National Defense) of the CFR. Once published in the CFR, it became a binding federal regulation, not just guidance. That means compliance is legally required.

In short: Executive Orders set the direction → Federal agencies create regulations → 32 CFR Part 117 becomes the enforceable rule for industry.

How 32 CFR Part 117 (NISPOM) Applies to You

You don’t need to memorize the regulation. But you do need to understand how it affects you day-to-day. Below we have outlined a few key tenants of NISPOM requirements that apply to you:

Access is Based on “Need-to-Know”

  • Just having a clearance does not mean you can access all classified information. You must have both: The proper clearance level AND a legitimate need-to-know.

Safeguarding Information

  • Classified may not be accessed or discussed in unauthorized areas or on unauthorized devices
  • Both you and your organization bear responsibility for protecting classified from unauthorized disclosure
  • Both you and your organization are responsible for ensuring classified information is properly secured, marked, handled, and stored
  • Failure to protect classified information can result in civil or criminal penalties
  • You are required to complete security training annually
  • Your organization is required to have a written Security Standard Practice Procedures (SPP) manual that is available to all company personnel
  • You are responsible for ensuring that you understand any security requirements that apply to you

Reporting Requirements

  • Your organization has many different types of reporting requirements
  • You also have requirements for reporting relevant information about yourself and others
  • You must complete training regarding your reporting requirements
  • If you are unsure if you should report something, you must contact your organization’s FSO—When in doubt, Report it.

Insider Threat Awareness

  • Your organization is required to have a written Insider Threat Program that is available to all company personnel
  • You are required to complete insider threat awareness training
  • You are responsible for recognizing concerning behaviors and reporting potential insider threat concerns to your organization’s insider threat program senior official (ITPSO)

You don’t have to be a security expert—but you are personally responsible for taking your security training seriously, contacting your organization’s Facility Security Officer (FSO) if you have questions or concerns, and protecting classified information.

Why 32 CFR Part 117 (NISPOM) Matters

The NISPOM applies to all U.S. contractor facilities that have been granted authorization to access classified information (aka facility clearance or FCL) and the individuals that work for these organizations, even if you are not personally handling classified material right now.

When an organization is granted an FCL, they sign the DD Form 441 Department of Defense Security Agreement. By signing the DD-441, the organization agrees to follow all government security requirements for safeguarding classified information, and to ensure its personnel understand and comply with these requirements.

When an individual is granted a personnel security clearance (PCL), they don’t just receive permission to access classified information, they sign the SF-312 Classified Information Nondisclosure Agreement. The SF-312 is a life-long legal agreement. By signing it you agreed that you would:

  • Protect classified information from unauthorized disclosure
  • Follow all government rules for handling classified material
  • Never disclose classified information without proper authorization
  • Accept that violations could result in administrative, civil, or criminal penalties

32 CFR Part 117 (NISPOM) is one of the key regulations that defines what those responsibilities look like, in practice, for contractors and individuals. In other words:

  • The DD-441 is the organization’s formal agreement to follow government security requirements.
  • The SF-312 is your personal legal promise.
  • The NISPOM explains how you keep that promise on the job.

Failing to follow these rules can result in:

  • Suspension or revocation of your clearance
  • Loss of employment
  • Damage to national security
  • Civil or criminal penalties that could include financial penalties and criminal prosecution

Understanding the NISPOM helps you know what is required of you as a person working for or with a cleared contractor facility. Think of the NISPOM as the official playbook for protecting national security information in industry. If you ever have questions, your Facility Security Officer (FSO) is your best resource.

Protecting classified information isn’t just a rule, it’s everyone’s responsibility.

Resources and Additional Learning

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements.

Threat Awareness and Trends

January 16, 2026

Threat awareness is a critical part of annual security training. Effectively countering threats begins with understanding the threats the U.S faces every day.

Three key U.S. government assessments help us understand the scope, complexity, and persistence of threats confronting the United States: the Defense Counterintelligence and Security Agency (DCSA) Protecting U.S. Technologies in the Cleared Industrial Base; the Department of Homeland Security (DHS) Homeland Threat Assessment; and the Office of the Director of National Intelligence (ODNI) Annual Threat Assessment.

Taken together, these reports underscore a central reality: foreign adversaries, criminal networks, and extremist actors are increasingly interconnected, technologically enabled, and willing to exploit U.S. vulnerabilities across domains—from cyber and supply chains to public discourse and physical infrastructure.

DCSA: Targeting U.S. Technologies

DCSA’s Targeting U.S. Technologies report assesses how foreign intelligence entities (FIEs) and other adversaries target the U.S. cleared industrial base and informs us about foreign efforts to compromise technology, classified information, and personnel.

KEY FINDINGS

Rising Threat Volume: Cleared contractor facilities report tens of thousands of suspicious contacts annually, reflecting sustained and persistent attempts to illicitly access sensitive and classified information and technologies.

Targeted Technologies: The most frequently targeted technologies include software, electronics, and aeronautic systems—collectively accounting for over one-third of all reports. Adversaries also pursue microelectronics, AI tools, advanced materials, and export-controlled devices.

Primary Geographical Threat Sources: Entities from the East Asia and Pacific region and the Near East account for the largest share of reported incidents—roughly 62% of all targeting activity.

Evolving Collection Methods: Adversaries increasingly rely on non-traditional collectors, including business partnerships, academic collaboration, supply chains, cyber intrusions, and recruitment of insiders. These methods blur the line between legitimate interactions and covert collection.

Why does this matter? Technological superiority underpins U.S. military readiness and economic strength. Successful exploitation of cleared industry shortens adversary development timelines, erodes deterrence, and introduces long-term strategic risk.

DHS: Homeland Threat Assessment

The Department of Homeland Security (DHS) Homeland Threat Assessment (HTA) examines risks directly affecting the U.S. population and domestic systems—from terrorism to drug trafficking and critical infrastructure attacks.

TOP THREAT AREAS

Terrorism & Violent Extremism: The assessment finds that the overall terrorism threat is expected to remain high, driven by domestic sociopolitical dynamics and international conflicts. Lone actors and small cells continue posing the most immediate risks.

Illegal Drugs & Transnational Crime: Transnational criminal organizations trafficking illegal drugs—especially fentanyl and synthetic opioids—are a severe public safety and national risk.

Influence Operations & Transnational Repression: Foreign state actors use digital platforms and social networks to influence U.S. public opinion, target communities, and undermine trust in institutions.

Border & Immigration Security: While migrant encounters have declined, the risk of individuals posing security threats entering through irregular channels remains a focus of DHS screening and vetting efforts.

Critical Infrastructure Security: Cyber-attacks, physical threats, and preparation for disruptive operations against critical infrastructure persist as priority concerns. Nation-state actors such as China, Russia, and Iran remain principal threats.

DNI: Annual Threat Assessment

The Director of National Intelligence (DNI) Annual Threat Assessment provides a comprehensive evaluation of the most direct and serious threats to U.S. national security.

KEY TAKEAWAYS

Major State Adversaries:

  • China is described as the most comprehensive military and cyber threat, with ambitions to expand regional power and surpass U.S. technological leadership, including in artificial intelligence.
  • Russia is assessed as leveraging its ongoing war in Ukraine and maintaining capabilities that could heighten tensions with NATO.
  • Iran continues to pursue regional influence with missile and proxy capabilities, though it is not currently rebuilding a nuclear weapons program.
  • North Korea advances its strategic weapons and cyber capabilities, posing risks to U.S. allies and interests in the region.

Transnational Criminal Organizations (TCOs): Transnational criminal groups—especially drug cartels—are identified as immediate threats to public safety, with illicit fentanyl and synthetic opioids linked to tens of thousands of U.S. deaths.

Adversarial Cooperation: The assessment notes growing cooperation among these major adversaries, strengthening their collective capabilities and resilience against Western strategies.

Big Picture Threat Awareness

COMMON THEMES

Despite differing missions, the DCSA, DHS, and DNI assessments converge on several critical themes:

Threats are multi-domain: Cyber, economic, ideological, physical, and informational threats are deeply interconnected and reinforce one another.

Technology is both an asset and a vulnerability: AI, cyber tools, and global connectivity accelerate both innovation and exploitation.

State and non-state actors both matter: From sophisticated foreign intelligence services to lone extremists and criminal networks, adversaries exploit vulnerabilities at home and abroad.

Prevention depends on partnership: Effective risk mitigation requires coordination across government agencies, the defense industrial base, academia, private sector partners, and local stakeholders.

LOOKING AHEAD: EMERGING TECHNOLOGIES AND CHALLENGES

Emerging technologies are expected to remain the most attractive targets for adversaries. Artificial intelligence, microelectronics, quantum computing, space systems, advanced manufacturing, and critical software supply chains are increasingly sought after for their military, economic, and strategic value.

Protecting national security will require sustained vigilance, stronger partnerships, and adaptive security strategies across government and industry.

Resources and Additional Learning

As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements.

Safeguarding Our Information: Protecting Classified and Controlled Unclassified Information (CUI)

December 16, 2025

In today’s digital environment, information is one of our most valuable assets. It is also the most targeted. Protecting classified information and controlled unclassified information (CUI) is not just an IT responsibility; it is a shared obligation that applies to every employee, contractor, and partner within your organization.

Understanding What We Protect

Classified Information includes data formally designated as Confidential, Secret, or Top Secret and requires the highest levels of protection due to national security implications.

Controlled Unclassified Information (CUI) is sensitive information that is not classified but must be safeguarded under applicable laws, regulations, and government-wide policies. This includes personally identifiable information (PII), export-controlled data, proprietary information, certain technical or research data, and more.

Correctly identifying and marking information is the first step in ensuring it is protected appropriately.

Why Protection Matters

Threat actors are constantly seeking to exploit weak points—whether through phishing emails, unsecured devices, or improper data handling. A single lapse can result in:

  • Legal and regulatory consequences
  • Loss of trust with partners and stakeholders
  • Operational disruptions
  • Damage to national security or organizational mission

Regulatory Frameworks That Guide Our Security Practices

  • 32 CFR Part 117 (NISPOM): Establishes requirements for safeguarding classified information within cleared contractor facilities, including personnel security, physical security, and information systems security.
  • NIST: NIST Special Publication 800-171 defines the security requirements for protecting CUI in non-federal systems and organizations.
  • CMMC: Cybersecurity Maturity Model Certification builds upon NIST 800-171 and is required for many Department of Defense contracts.
  • EAR (Export Administration Regulations): Controls the access, transfer, and dissemination of certain commercial and dual-use technologies, software, and technical data.
  • ITAR (International Traffic in Arms Regulations): Governs the handling of defense-related technical data and restricts access to authorized U.S. persons.

Everyday Actions That Make a Difference

  • Think before you click: Phishing remains one of the most common attack methods. Be cautious of unexpected emails, links, or attachments.
  • Use approved systems: Store, transmit, and process Classified and CUI data only on authorized networks and devices.
  • Limit and control access: Share information strictly on a need-to-know basis.
  • Secure physical and digital workspaces: Lock screens when away, safeguard physical documents, and properly dispose of sensitive materials.
  • Report incidents promptly: If you suspect a data spill, phishing attempt, or security incident, report it to your FSO immediately.

Why Reporting is Critical & How to Report Concerns

Report to your FSO, immediately, any actual or suspected incident involving Classified Information or Controlled Unclassified Information (CUI), including:

  • Suspected or confirmed data spills or unauthorized disclosures
  • Phishing emails, suspicious links, or social engineering attempts
  • Lost, stolen, or compromised devices (laptops, mobile devices, removable media)
  • Unauthorized access to systems, files, or facilities
  • Improper storage, transmission, or marking of sensitive information
  • Any situation where ITAR-controlled data may have been accessed by an unauthorized person

When in doubt, report the incident. Reporting a concern that turns out to be benign is always preferable to failing to report a real issue.

Resources and Additional Learning

As always, if you have any questions about whether or not a situation requires reporting, ask your FSO!

Security for the Holiday Season

November 18, 2025

The holiday season is approaching quickly! While maintaining strong security practices should be a primary focus throughout the year, it is important to understand the increased threats during the holiday season.

The hustle, bustle, and general spirit of celebration that we experience during the holidays can lead to distraction and lower our guard. Unfortunately, criminals and our adversaries don’t slow their nefarious goals simply because we are busy, distracted, or nurturing kindness during the holidays. In fact, this gives them a better opportunity to exploit us.

Holiday OPSEC

OPSEC (Operations Security) is a five-step process used to identify and protect sensitive information from our adversaries:

  1. Identify What Needs Protection
  2. Analyze the Threat
  3. Analyze Vulnerabilities
  4. Assess Risk
  5. Apply Countermeasures

These same concepts can, and should, be used to protect ourselves, our families, our homes, and our data during the holiday season.

Safety in Public and Crowded Places

  • Situational awareness! No matter where you are, always be mindful of your surroundings.
  • Have an exit plan and know how to contact the authorities if something goes sideways.
  • If anything feels off, say something.
  • Take care when carrying large amounts of cash. Look out for “shoulder surfers” looking to steal your credit card information.
  • When out purchasing gifts, consider bringing items back to your vehicle as you shop and placing them in your trunk, out of sight.

Data Security

  • Always follow all company and government data security protocols.
  • Never use company-issued or government-furnished equipment for online shopping.
  • Consider a personal VPN to help secure your data.
  • Use strong passwords, change them frequently, and never share them with anyone.
  • Whenever possible, use multi-factor authentication.

Online Shopping

  • Know that scams and phishing are especially heightened during the holidays.
  • Know how to identify safe and secure websites.
  • Always follow safe and proper cybersecurity practices.
  • Remember: If it sounds too good to be true, it probably is!

Securing Your Home During the Holidays

  • Protect and control your house keys, door codes, and garage access codes with extreme caution.
  • Keep a light on, even when you are not at home.
  • Keep valuables out of sight.
  • Consider a home security system and video surveillance system.
  • Be wary of canvassers and anyone requesting access to your residence.
  • Mind who is “hanging out” in your neighborhood and report any suspicious activity.
  • Care what you share publicly and on social media.

Protect Your Home When You’re Gone

More than 80 million Americans travel 50+ miles from home during the holidays, leaving personal space vulnerable. Studies show that 40% of burglaries do not involve forced entry and most burglars are deterred by simple safeguards.

Secure your home:

  • Lock every door and window, including your garage door
  • Activate your home security system
  • Put valuables in a safe or safety deposit box
  • Remove “hidden” keys

Don’t make it look like you’re not home:

  • Never post travel plans on social media
  • Consider putting lights, TVs, or radios on intermittent timers
  • Don’t leave trash and trash cans at the curb

Foreign Travel

If you are traveling outside the US, don’t forget to report it to your FSO! For most of us, all personal and professional foreign travel requires reporting. Ideally, foreign travel should be reported 30 days in advance of departure.

Resources and Additional Learning

As always, if you have any questions about whether or not a situation requires reporting, ask your FSO!

Categories

Archives

Learn how FSO PROS® can help
support your security program

Let’s discuss how we can help support your security and compliance needs.
Secret Link