EXECUTIVE BRIEF

This article highlights how Facility Security Officers (FSOs) can help small to midsize government contractors streamline compliance efforts, such as:

• Improve record-keeping: Establish clear policies and procedures and implement new tools to automate document classifications.
• Internal audits: design internal audits that align with and prepare your organization for DCSA audits. 
• Facilitate cross-department coordination: oversee processes with HR to mitigate Foreign Ownership Control or Influence (FOCI) risks and implement a centralized security reporting system for all departments to utilize.
• Proactively prepare for change conditions: plan ahead for potential change conditions that could affect your Facility Security Clearance (FCL) status. 

Dig deeper and continue reading below!

5 Ways FSOs Can Streamline Compliance

If you work at a small to midsize government contractor, you understand the difficulty of doing lots of jobs at once. Assigning someone the duties of Facility Security Officer (FSO) can feel like checking off a box on a form: it’s just another responsibility you’ll get to eventually after the seven other things you need to do.

But getting a dedicated FSO – either as a full-time position in your company or through outsourcing duties to a Managed Services Provider – can be a gamechanger for your organization. 

In this blog, we’ll examine 5 ways an FSO can streamline your organization’s compliance requirements.

The Role of a Facility Security Officer (FSO)

Despite the name, a Facility Security Officer (FSO) is typically in charge of managing security not just for a specific facility, but for an entire organization. For contractors working with the Defense Industrial Base (DIB), that means overseeing and implementing a wide array of 32 CFR Part 117 NISPOM requirements and best practices. Perhaps most crucially of all, an FSO is responsible for obtaining and maintaining your organization’s Facility Security Clearance (FCL) to handle classified information.

Thus an FSO’s role encompasses a range of responsibilities, including:

• Access Control Management
• Safety Assurance
• Cyber Security
• Record-Keeping
• Employee Training and Education
• Incident Reporting and Investigation
• Physical Surveillance
• Insider Threat Detection

5 Ways FSO Streamline Compliance

1. FSOs Improve Your Internal Record-Keeping

For most DoD contractors and subcontractors, properly handling CUI is critical to staying in compliance with security regulations like NIST SP 800-171 and CMMC. FSOs can play a crucial role in improving your internal record-keeping practices.

Here are some key ways they accomplish this:

• FSOs work with program managers and other stakeholders to identify and classify all CUI within your organization, and they enforce strict procedures for handling, marking, storing, and transmitting that CUI, ensuring protection throughout its lifecycle.
• They establish clear policies and procedures for creating, storing, and disposing of sensitive information. Defining specific retention periods for different types of records and training employees accordingly helps ensure compliance while avoiding unnecessary storage costs.
• FSOs can help you employ new tools to automatically classify and label CUI, improving efficiency and reducing the risk of human error. New technology can streamline your record-keeping processes, enhance security, and facilitate efficient access to information.

2. FSOs Run Internal Audits that Prepare You for DCSA Security Review

Undergoing a DCSA security review is always stressful. Fortunately, a dedicated FSO can run internal audits to prepare you in advance by conducting comprehensive reviews of security policies, procedures, and practices. These audits simulate the DCSA’s review process, help you identify gaps, and ensure 32 CFR Part 117 NISPOM compliance.

Drawing on their detailed knowledge of current federal protocols and any contract-specific requirements unique to your organization, your FSO will draw up a detailed audit plan – one that covers all areas subject to DCSA scrutiny and that prioritizes areas based on potential risks and vulnerabilities.

Next, they’ll carefully review all security-related documentation (including policies, procedures, plans, training records, and incident reports) and verify that they’re accurate, up-to-date, and aligned with DCSA requirements.

Your FSO can also collect evidence of compliance, such as system logs, access control records, and security awareness training materials.

Finally, by conducting a physical inspection of the facilities and interviews with key personnel, they can comprehensively assess your current security posture, document any gaps or deficiencies, and provide clear and actionable recommendations for remediation prior to an actual federal security review. This process not only leaves you better equipped to meet your compliance requirements, it orients your business toward continuous improvement.

3. FSOs Work with HR to Avoid FOCI Conflicts

In accordance with DFARS, DoD contractors that handle CUI are required to take proactive measures to identify and mitigate any risks from Foreign Ownership Control or Influence (FOCI). This includes conducting due diligence on potential foreign investors, partners, or employees, as well as implementing security measures to protect CUI from unauthorized access or influence.

FSOs work closely with Human Resources to avoid these conflicts by establishing safeguards and compliance mechanisms that ensure national security interests are protected. These measures can include:

• Screening and Vetting Employees - FSOs can oversee thorough background checks and security clearance processes for all employees, especially those with access to classified or sensitive information. They can also help avoid future conflicts by providing guidance on situations that could pose future FOCI risks for new hires.
• Employee Training and Awareness Programs - FSOs ensure that HR includes FOCI and security training as part of the employee onboarding process and in continuous training programs.
• Personnel Security Policies - FSOs work with HR to develop and implement company policies and procedures that address FOCI risks. These policies may include guidelines on foreign travel, acceptance of gifts, or participation in foreign organizations.
• FOCI Mitigation Plans and Foreign Ownership Disclosures - Along with HR and legal teams, FSOs develop FOCI mitigation or negation plans – such as Special Security Agreements (SSA), Board Resolutions, and Proxy Agreements – that protect classified information from foreign influence while allowing the company to operate. FSOs know when employees’ foreign ownership interests, particularly those of senior executives and board members, should be reported to the DCSA to avoid penalties down the road.
• Ongoing Monitoring and Reporting - FSOs and HR maintain open communication channels to share information related to potential FOCI issues. HR can provide the FSO with updates on changes in employees’ circumstances (such as new foreign travel, investments, or relationships) that may warrant further review. FSOs can also alert HR to any security concerns they identify during their monitoring activities.

Contractors are required to report any potential FOCI concerns to the DCSA. Failure to report can result in penalties, loss of contracts, and even loss of your FCL. By working together, FSOs and HR play a critical role in safeguarding sensitive information and protecting defense contractors from the risks associated with these conflicts.

4. FSOs Have a Big Picture View of 32 CFR Part 117 NISPOM Requirements That Lets Them Coordinate Between Departments More Effectively

Facilitating communication between teams is a vital function at any organization. That goes doubly so for DoD contractors navigating a complex landscape of regulatory requirements that affect different departments unevenly. 

That’s where your FSO steps in. FSOs establish a system for centralized security reporting, where employees from different departments can report security issues, insider threats, or potential vulnerabilities. They can even lead cross-department insider threat teams with representatives from HR, IT, Legal, and Operations in order to monitor for red flags, such as unusual behavior, unexplained absences, or IT system anomalies. This leads to quicker and more thorough threat detection and mitigation.

FSOs are also your organization’s primary point of contact with government agencies regarding security matters. They ensure that information regarding any changes or updates to 32 CFR Part 117 NISPOM requirements are disseminated clearly and in a timely manner.

5. FSOs Prepare for Change Conditions that Affect Your FCL

Maintaining your Facility Security Clearance (FCL) is essential to doing business. FSOs play a proactive role in preparing for change conditions that could impact your clearance, such as:

• Changes in Key Management Personnel (KMP) 
• Name or address changes
• Changes in your business structure resulting from mergers or acquisitions
• Significant alterations to your organizational hierarchy or legal designation (such as a corporation becoming an LLC)

Stay Ahead of New Compliance Requirements with ISI’s FSO Services

Here at ISI, we provide FSO support services to contractors of all sizes in the DIB. We address the complex challenges organizations face by offering solutions that reduce your administrative burden while strengthening your security posture.

Our proven track record speaks for itself: over the past two years, 93% of our clients who applied for an FCL received approval, with an average turnaround time of just 115 days in 2023.

Contact us today to find out how we can streamline compliance for your organization!

FAQs about Facility Security Officers and Compliance

What Qualifications Are Required to Become a Facility Security Officer?

The qualifications and requirements to become an FSO vary based on a number of factors, such as your location and employer. A company’s FSO must be a U.S. citizen and a W2 employee. They should generally have at least a bachelor’s degree and some prior experience in security, law enforcement, or military contract work. In order to obtain security clearance to handle classified information, FSOs are required to complete 40 hours of training on the STEPP system. 

Who Does the FSO Report To?

The FSO typically reports to the senior management within the organization: perhaps the CEO, the President, or, in some larger organizations with a dedicated security department, a Chief Security Officer. The FSO also has a functional reporting relationship with their assigned DCSA Industrial Security Representative (ISR).

What Is the Role of a Facility Security Officer in Emergency Preparedness?

The FSO plays an essential role in establishing protocols for security emergencies: everything from cyberattacks to theft, insider threats, or natural disasters. They regularly conduct risk assessments to identify and mitigate potential threats to the facility and its classified information. They train employees how to respond in a crisis, and, in the case of an actual incident, they manage the response.