SFPC Insider Threat Awareness 5

Question 1

Under 32 CFR Part 117 (NISPOM), a cleared contractor is choosing its Insider Threat Program Senior Official (ITPSO). Which set of requirements must that person meet?

Accepted Answer

Must be a U.S. citizen employee of the contractor who is cleared in connection with the FCL; the FSO may hold this role

Answer

The NISPOM requires the ITPSO to be a U.S. citizen employee, cleared in connection with the facility clearance, and part of senior management. The FSO is allowed to serve as the ITPSO; many small contractors do this. The contractor designates the ITPSO, not the CSA, and nothing requires a clearance higher than the FCL level.

Question 2

A cleared analyst under financial stress starts making angry comments about leadership. Their supervisor sees it but decides it's 'not worth the paperwork' and quietly moves the analyst to a project with broader system access, without telling security. In the critical-path model of insider risk, which element does the supervisor's action best illustrate?

Accepted Answer

Problematic organizational responses

Answer

The critical-path model moves through personal predispositions, then stressors, then concerning behaviors, then problematic organizational responses. The analyst's financial stress is a stressor and the angry comments are a concerning behavior. The supervisor ignored the warning signs, didn't refer them to security, and gave the analyst more access. That is a problematic organizational response, which can push someone further toward a hostile act.

Question 3

Executive Order 13587 created the National Insider Threat Task Force (NITTF). Who co-chairs the NITTF?

Accepted Answer

The Attorney General and the Director of National Intelligence

Answer

EO 13587 (October 2011) set up the NITTF under the joint leadership of the Attorney General and the Director of National Intelligence. In practice the FBI and NCSC staff it, which is why those agencies look like plausible distractors. They are not the named co-chairs.

Question 4

A newly hired cleared engineer has a valid eligibility determination and has finished the initial security briefing. Under the NISPOM, when must this employee complete insider threat awareness training?

Accepted Answer

Before being granted access to classified information, and annually after that

Answer

32 CFR 117.12 requires contractors to make sure cleared employees complete insider threat awareness training before they get access to classified information, and every year after that. Grace periods, two-year cycles, and training tied to reinvestigation do not meet the requirement.

Question 5

An experienced, loyal engineer wants help with a design problem. They post detailed but unclassified technical parameters from a classified program's subsystem to a public professional forum. They meant no harm. How should an insider threat program view this?

Accepted Answer

It is a potential insider threat, because the definition covers harm done unwittingly through authorized access, including compilation and aggregation risk

Answer

The NISPOM defines insider threat as the likelihood that an insider will use authorized access, wittingly or unwittingly, to harm national security. Negligent and unintentional disclosures count. Unclassified details from a classified program can also add up to sensitive or classified information through compilation. Intent, proof that a foreign national saw the post, and classification markings are not required.

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC Insider Threat Awareness 5