Threat Assessment & Risk Mitigation Flashcards

Who must be designated to establish and oversee the insider threat program at a cleared contractor?

Answer: Insider Threat Program Senior Official (ITPSO)

Cleared contractors must designate a cleared ITPSO who is a U.S. citizen employee and senior official of the company.

Insider threat awareness training for new cleared employees must be completed within what timeframe?

Answer: Within 30 days of initial employment or prior to accessing classified information

Initial insider threat training is required within 30 days of initial employment or prior to accessing classified information.

Which is a potential insider threat indicator that should be reported?

Answer: Unexplained affluence combined with attempts to access information outside need-to-know

Unexplained affluence and need-to-know violations are classic insider threat indicators.

An insider threat program must be able to gather and integrate information from which sources?

Answer: Records such as HR, security, and information assurance

Programs must gather, integrate and report relevant information from HR, security, and information assurance offices.

What is the purpose of self-inspection in the NISP context?

Answer: To evaluate the effectiveness of the security program and correct deficiencies

Self-inspections assess program effectiveness and the results are certified by senior management to DCSA.

Self-inspection results must be briefed to and certified by whom?

Answer: Senior Management Official

The contractor must prepare a formal report and certify the self-inspection to DCSA, with senior management informed.

Which DCSA review rating is the highest result for a security vulnerability assessment?

Answer: Superior

The rating scale is Superior, Commendable, Satisfactory, Marginal, Unsatisfactory, with Superior highest.