UNCLASSIFIED DCSA BRIEFING Curtis Cook ISSP Team Lead

UNCLASSIFIED DCSA BRIEFING Curtis Cook, ISSP Team Lead, Huntsville Field Office UNCLASSIFIED

DCSA at a Glance The Defense Counterintelligence and Security Agency provides counterintelligence, personnel vetting, critical technology protection, and training services to ensure a trusted workforce and safeguard national security. 1978 1883 Pendleton Act authorizes the Civil Service Commission (CSC) — now OPM — to conduct background investigations OPM established; Federal Investigations Service (FIS) provides basis for agencies to determine a person’s suitability for security clearances and federal employment 2016 National Background Investigations Bureau (NBIB) replaces FIS 2019 1971 Defense Security Service (DSS) renamed DCSA Defense Investigative Service (DIS) established under Do. D 1965 Do. D CAF (formerly DISCO) becomes Do. D’s adjudicative facility 1980 DICSO transferred to DIS/DSS from DLA 2012 DISCO disestablished, consolidated into Do. D CAF DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 2

UNCLASSIFIED DCSA is the Guardian of our Nation’s Assets Countering threats and vulnerabilities, ensuring trust, and advancing deliver of uncompromised capabilities. Critical Technology Protection Trusted Workforce Vetting & Educating the Workforce Vetting & Educating Industry Monitor Mitigate Revoke Thwarting Adversaries Monitor Mitigate Revoke Detecting Compromised Technology or Information UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 3

UNCLASSIFIED An Overview of DCSA 33 NISP Administration for 33 Fed. Agencies 100+ Personnel Vetting for +100 Gov. Agencies 167 Field Locations 11, 700 DCSA Employees & Contractors 4. 1 M Cleared personnel vetted by DCSA On October 1, 2019, DCSA became the security agency in the federal government dedicated to protecting America’s trusted workforce and trusted workspaces. DCSA joins two critical missions: Personnel Vetting and Critical Technology Protection, supported by the Counterintelligence and Training, Education and Certification missions. Personnel Vetting Critical Technology Protection • DCSA provides full-spectrum personnel security services for nearly the entire federal government, from initial application through investigation, adjudication, and Continuous Vetting. • The Director of National Intelligence is the Executive Agent for Security. Office of Personnel Management is the Executive Agent for Suitability. • DCSA is innovating a risk-based, intelligence-led, asset-focused approach to security oversight for approximately 12, 500 cleared facilities under the National Industrial Security Program (NISP), overseeing the protection of sensitive and classified U. S. government information for over 33 federal agencies. Counterintelligence and Analysis • CI analysis supports Critical Technology Protection and Personnel Vetting. • CI produces 74% of U. S. government intelligence information reporting on entities targeting Do. D critical technology, yet represents 3. 5% of the Do. D CI workforce. Training, Education, and Certification • DCSA provides comprehensive education, professionalization, and training services for security professionals across the federal government and in industry. • Over 1. 4 M courses were completed in FY 18. UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 4

UNCLASSIFIED Mission, Vision, and Guiding Principles Mission DCSA is a strategic asset to the nation and our allies — continuously ensuring a trusted federal, industrial, and affiliated workforce, and enabling industry’s delivery of uncompromised capabilities by leveraging advanced technologies and innovation. We uniquely blend critical technology protection, trusted personnel vetting, counterintelligence, and professional education and certification to advance and preserve America's strategic edge. Vision Guardians of our nation's assets — ensuring trust, countering threats and vulnerabilities, and advancing delivery of uncompromised technology. Guiding Principles Committed to Mission | Passion for Service | Unwavering | Integrity | Empowered to Act | Fiercely Innovative | Invested in People Tagline Trusted Workforce. Trusted Workspaces. Trusted Work. UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 5

UNCLASSIFIED Transfer Elements In January 2019, the Secretary of Defense placed the Do. D CAF and select functions of the Defense Information Systems Agency (DISA) and the Defense Manpower Data Center (DMDC) under the authority, direction, and control of DSS. The CAF transfer was completed by October 1, 2019, while others will be completed by October 1, 2020. On April 24, 2019, Executive Order 13869 transferred the National Background Investigations Bureau (NBIB) to Do. D, with an effective date of Oct. 1, 2019. On Oct 1, the organization grew from 950 personnel to over Defense Security Service National Background Investigations Bureau Do. D Consolidated Adjudications Facility National Background Investigation Service 11, 700 government employees and contractors. Elements of the Defense Manpower Data Center UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 6

UNCLASSIFIED CRITICAL TECHNOLOGY PROTECTION UNCLASSIFIED 7

UNCLASSIFIED Critical Technology Protection Overview U. S. GOVERNMENT DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY Government Contracting Agency requests new critical technology from cleared industry DCSA vets the people, industry, and partners creating the technology UNCLASSIFIED END USER Critical technology is fielded, providing tactical & strategic advantage DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 8

UNCLASSIFIED DCSA and the NISP DCSA Administers the National Industrial Security Program (NISP) for Do. D and 33 Other Federal Agencies Executive Office of the President Cabinet Departments Defense | State | Homeland Security | Commerce | Treasury | Transportation Agriculture | Interior | Labor | Justice | Education | Health & Human Services Housing & Urban Development | Veterans Affairs Other Government Agencies National Aeronautics and Space Administration General Services Administration Federal Reserve System Government Accountability Office National Science Foundation United States Trade Representative Small Business Administration United States International Trade Commission Environmental Protection Agency United States Agency for International Development Nuclear Regulatory Commission Millennium Challenge Corporation Federal Communications Commission Social Security Administration Office of Personnel Management United States Postal Service National Archives and Records Administration Privacy and Civil Liberties Oversight Board Overseas Private Investment Corporation UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 9

UNCLASSIFIED Industry Presence FOR OFFICIAL USE ONLY Cleared Facilities ~12, 500 Companies ~10, 000 Accredited Systems ~14, 000 Cleared Personnel ~940 k DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 10

UNCLASSIFIED NISP AUTHORIZATION OFFICE (NAO) UNCLASSIFIED 11

UNCLASSIFIED Risk Management Framework (RMF) DAAPM 2. 0 Release Date DCSA Assessment & Authorization Process Manual 2. 0 The new version addresses the transition to the Enterprise Mission Assurance Security Service (e. MASS) as the system of record for assessment and authorizations of industry classified systems. Effective Date Areas of interest: • DAAPM 2. 0 reflects the newly revised NIST SP 800 -37, which updates the steps of the RMF process. • DAAPM 2. 0 includes guidance regarding proposal systems. Next Update January 2020 RMF guidance and job aids are available on the DCSA Website under the NISP RMF Resource Center link. UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 12

UNCLASSIFIED Mandatory Use of e. MASS OCT 1 All System Security Plans (SSPs) must be submitted using the e. MASS system OBMS discontinued on 30 September 2019 e. MASS accounts require prerequisite training plus other documents Follow the steps below to acquire training: Go to www. dcsa. mil Search RMF Download Guides & Job Aids Submit Training Certificate and other Required Documents to Mailbox Complete Training Job Aids and NISP-e. MASS Industry Operating Guide now available Contact the NAO NISP-e. MASS mailbox with questions or concerns dcsa. quantico. dcsa. mbx. emass@mail. mil UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 13

UNCLASSIFIED NISP Update: Cyber Vulnerabilities Top 5 Deficiencies DCSA is Seeing in SSPs 1 2 3 4 5 SSP was incomplete or missing attachments Inaccurate or incomplete configuration diagram Sections in general procedures contradict controls Integrity & availability not properly addressed SSP was not tailored to the system Top 5 Vulnerabilities DCSA is Seeing During Visits 1 2 3 4 5 Inadequate auditing controls Security relevant objects not protected Inadequate configuration management Improper session controls Identification & authentication controls UNCLASSIFIED DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY 14

UNCLASSIFIED QUESTIONS? UNCLASSIFIED 15