Attch_1_Insider_Threat_PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

INSIDER THREAT

1.0 General Information

1.1 Description of Services/Introduction: The Air Force (AF) is currently developing an Insider Threat Program, designed to deter, detect, and respond to insider threats as directed by Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information as well as the National Insider Threat Task Force (NITTF), National, DoD, and Air Force policy. These polices direct the establishment of an Insider Threat program that adheres to the standards set forth in the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs. Contractor support is required to assist the AF in developing a tailored Insider Threat Implementation Plan, manage the Insider Threat Program, develop metrics to track program implementation progress, and coordinate with stakeholders to determine existing AF capabilities to assist the nascent Insider Threat Program. While the Insider Threat Program has been managed with minimal resources to this point, the maturing program will require detailed program analysis in order to reach full capability on schedule and within a reasonable budget.

1.2 Background: Continuing to develop the AF’s capabilities to deter, detect, respond, and mitigate insider threats will require a comprehensive effort to unify and build upon the AFs many disparate capabilities.

The Insider Threat mission touches upon manpower, information systems technology, counterintelligence, law enforcement, and mental health communities. Each of these communities must work together as a system to be effective, meaning they must be carefully reviewed from budgetary, programming, and IT perspectives to integrate them into the Insider Threat Program. Too many or too few resources dedicated to any one aspect of the Insider Threat mission could mean failure to minimize risks or waste program resources for a given level of funding. Integrating data from across the AF will be a primary challenge for the developing Insider Threat Program. The NITTF prescribes a Hub, in which analysts use data fusion capabilities to identify possible insider threat actors from behavioral indicators, as a requirement for all Insider Threat programs. The Hub’s institutional location, role, and business rules must be correctly designed, lest it be ineffective or intrude upon the privacy, civil, or medical rights of AF personnel. The Hub must seamlessly integrate all of the AF’s existing information—such as human resources (HR), medical, disciplinary, criminal, and counterintelligence records—with new data streams, such as information derived from the monitoring of AF information systems. The Hub must work with existing AF response elements to investigate possible threats and take any necessary action. As outlined above, contractor support is needed to focus on the program’s budgetary, organizational, and information systems requirements. A focused round of analysis and consensus-building is needed to shape the Insider Threat Program into an organization capable of effectively executing its mission.

1.3 Objectives:

• A comprehensive strategy, endorsed by the AF leadership, to fund and implement the Insider Threat Program at an agreed-upon level of risk. Will include proposed funding levels for the 18-22 Program Objective Memorandum (POM) cycle.

• A Concept of Operations (CONOP) for the AF Hub that details roles and responsibilities, business practices, coordination with stakeholders, resourcing to include manpower and technology, logistics, policy requirements and other criteria necessary for the establishment of a new operational mission.

• A comprehensive plan from each lead Office of Primary Responsibility (OPR) designated in the Implementation Plan detailing how the OPR will manage and execute its Insider Threat responsibilities.

1.4 General Information

1.4.1 Recognized Holidays:

New Year’s Day Labor Day Birthday of Martin Luther King, Jr. Columbus Day Washington’s Birthday Veterans Day Memorial Day Thanksgiving Day Independence Day Christmas Day Inaguaration Day (for NCR only)

1.4.2 Hours of Operation: The contractor is responsible for conducting business between the hours of 7:00 am and 5:30 pm Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.4.3 Place of Performance: The contractor will perform work at the contractor site. However travel to the customer location (Pentagon) is expected 2-3 times per month for meetings.

1.4.4 Type of Contract: The Government will award a Firm Fixed Price Contract.

1.4.5 Security Requirements: Contractor personnel performing work under this contract within the Air Force Pentagon must have a Top Secret clearance at time of the proposal submission, and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254. Upon contract award, at least one cleared individual must be available to support the Government program office.

1.4.5.1 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured

1.4.6 Post Award Conference/Periodic Progress Meetings: The contractor shall attend all post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer and Contracting Officers Representative (COR), may meet periodically with the contractor to review the contractor's performance.

At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

1.4.7 Identification of Contractor Employees: All contract personnel attending meetings and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All personnel requiring access to the Pentagon will be required to wear a badge at all times identifying their clearance and allowing access to the appropriate areas. This badge will be provided by the government once security clearance has been confirmed.

1.4.8 Records Management: Ensure that all records created are managed, maintained, and disposed of in accordance with the Federal Acquisition Regulation, and the Defense Federal Acquisition Regulation Supplement.

2.0 Government Furnished Items and Services:

2.1 Services: The Government will provide personnel with computer, phone, and desk space at the Pentagon.

3.0 Specific Tasks:

3.1. Basic Services. The contractor shall provide the following services:

• Requirements Analysis and Resourcing o Engage with each individual OPR to assess the requirements needed to comply with its tasks listed in the implementation plan. Examine the resource impacts of staffing, IT solutions, training and certification of employees. Determine the impacts of accelerating, deferring, or partially complying with the implementation plan mandates.

o Generate detailed Courses of Action (COAs) for:

Minimum compliance with the National Insider Threat Task Force (NITTF)

Minimum Standards as outlined in Presidential Memorandum dated 21 Nov 2013, “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs”

Full implementation of an Insider Threat Program that complies with the Minimum Standards

Several intermediate options, representing graduated levels of risk and funding.

o Validate one of these COAs with the Secretary of the Air Force and generate detailed budget recommendations for funding insider threat as a program in the 18-22 POM cycle.

• Integrated Planning, Monitoring, and Communication o Continue developing the AF Insider Threat Program, per the draft AF Insider Threat Implementation Plan, which lays out program objectives and milestones.

o Provide day-to-day support to Secretary of the Air Force, Director of Security, Special Program Oversight and Information Protection (SAF/AAZ), in the form of coordinating meetings of the AF Insider Threat Working Group which is led by SAF/AAZ to facilitate implementation of the Insider Threat program, managing formal Air Force tasks in Task Management Tool (TMT) and liaising with Insider Threat Working Group members and DoD Insider Threat activities.

o Engage component OPRs to assist them in developing their own implementation plans, to be used in achieving Insider Threat Program objectives. Each OPR implementation plan (OPR IP) shall include specific steps and performance metrics, and must be validated through the Insider Threat Program office and the Insider Threat Working Group.

o Conduct frequent weekly stakeholder planning meetings to track actions and identify and address issues and risks.

o The validated OPR IPs will be collected in the previously delivered Performance Tracking Tool to gauge progress on initiative plans, insider threat projects, and overall maturity of the AF Insider Threat Program. This effort will support the development of communications materials (e.g., briefings, simple dashboard tools) for Senior Leadership and stakeholders. The Tracking Tool will document progress in implementing the Insider Threat Implementation Plan, compliance with Insider Threat Minimum Standards, Key Information Sharing and Safeguarding Indicators, and progress in implementing recommendations from the Ft Hood Follow on Review.

o Provide monthly status report documenting work and tasks completed, challenges, and focus areas for the following month.

• Design Hub Concept of Operations o As called for in the AF Implementation Plan, develop a Concept of Operations

(CONOPS) for an integrated AF Hub. The Hub is defined as a capability to “deter, respond to, and mitigate insider threats through the integration of data across the AF.” Develop business rules and process maps which will enable the collection and analysis of various datasets, such as data resulting from User Activity Monitoring, Human Resources data, Counterintelligence and law enforcement investigation data, and medical data. Consult continuously with legal and Privacy Act experts to ensure compliance with all Federal, DoD, and AF regulations.

o Conduct a Tabletop Exercise (TTX), in which several case studies will be used to test the effectiveness and consistency of Hub procedures and processes. With the assistance of stakeholders, participate in the TTX, validate the results, and modify the Hub CONOP as needed to incorporate findings.

4.0 Deliverables

4.1 Deliverables Table

Activity Deliverable Timing

Integrated Planning, Monitoring, Communication

An automated capability (sharepoint/access database)to track progress of the implementation plan

30 days after award

Facilitation materials and process for all working group meetings

Biweekly or Monthly

Facilitation materials and processes for tracking progress of Key Information Sharing and Safeguarding Indicators (KISSI), Implementation Plan status, Insider Threat Minimum Standards and communicating with stakeholders

Quarterly or as tasked by Department of Defense and Director of National Intelligence

Facilitation materials and processes for tracking Fort Hood requirements and communicating with stakeholders

Monthly

Progress/Communications briefings as needed

Weekly

Requirements Analysis and Reporting

Finalized COAs for each individual implementation plan, and overall COAs

Nov 2015

Progress, Communications Briefings as Needed

Dec 2015 - September 2016

Design Hub Concept of Operations

Table Top Exercise October 2015 Hub CONOP March 2016

Personnel Cleared personnel (1) Upon award

Other Monthly Status Reports Every Month by the 8th of each Month, Starting 8 October

4.2. Contractor Management Reporting (CMR)

4.2.1 The contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Insider Threat Program via a secure data collection site. The contractor is required to completely fill in all required data fields at http://www.ecmra.mil.

4.2.2 Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year.

Contractors may direct questions to the Contractor Manpower Reporting Application (CMRA) help desk.

4.2.3 Reporting Period: Contractors are required to input data by 31 October of each year

4.2.4 Uses and Safeguarding of Information: Information from the secure web site is considered to be proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

4.2.5 User Manuals: Data for Air Force service requirements must be input at the Air Force CMRA link.

However, user manuals for government personnel and contractors are available at the Army CMRA link at http://www.ecmra.mil.

Addendum: National Insider Threat Minimum Standards

NATIONAL INSIDER THREAT POLICY

The National Insider Threat Policy aims to strengthen the protection and safeguarding of classified information by: establishing common expectations; institutionalizing executive branch best practices; and enabling flexible implementation across the executive branch.

A. Policy

Executive Order 13587 directs United States Government executive branch departments and agencies (departments and agencies) to establish, implement, monitor, and report on the effectiveness of insider threat programs to protect classified national security information (as defined in Executive Order 13526; herein after classified information), and requires the development of an executive branch program for the deterrence, detection, and mitigation of insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure. Executive Order 12968 promulgates classified information access eligibility policy and establishes a uniform Federal personnel security program for employees considered for initial or continued access to classified information.

Consistent with Executive Orders 13587 and 12968, this policy is applicable to all executive branch departments and agencies with access to classified information, or that operate or access classified computer networks; all employees with access to classified information, including classified computer networks (and including contractors and others who access classified http://www.ecmra.mil/ http://www.ecmra.mil/ information, or operate or access classified computer networks controlled by the federal government); and all classified information on those networks.

This policy leverages existing federal laws, statutes, authorities, policies, programs, systems, architectures and resources in order to counter the threat of those insiders who may use their authorized access to compromise classified information. Insider threat programs shall employ risk management principles, tailored to meet the distinct needs, mission, and systems of individual agencies, and shall include appropriate protections for privacy, civil rights, and civil liberties.

B. General Responsibilities of Departments and Agencies

1) Within 180 days of the effective date of this policy, establish a program for deterring, detecting, and mitigating insider threat; leveraging counterintelligence (CI), security, information assurance, and other relevant functions and resources to identify and counter the insider threat.

2) Establish an integrated capability to monitor and audit information for insider threat detection and mitigation. Critical program requirements include but are not limited to:

(1) monitoring user activity on classified computer networks controlled by the Federal Government; (2) evaluation of personnel security information; (3) employee awareness training of the insider threat and employees' reporting responsibilities; and (4) gathering information for a centralized analysis, reporting, and response capability.

3) Develop and implement sharing policies and procedures whereby the organization's insider threat program accesses, shares, and integrates information and data derived from offices across the organization, including CI, security, information assurance, and human resources offices.

4) Designate a senior official(s) with authority to provide management, accountability, and oversight of the organization's insider threat program and make resource recommendations to the appropriate agency official.

5) Consult with records management, legal counsel, and civil liberties and privacy officials to ensure any legal, privacy, civil rights, civil liberties issues (including use of personally identifiable information) are appropriately addressed.

6) Promulgate additional department and agency guidance, if needed, to reflect unique mission requirements, but not inhibit meeting the minimum standards issued by the Insider Threat Task Force (ITTF) pursuant to this policy.

7) Perform self-assessments of compliance with insider threat policies and standards; the results of which shall be reported to the Senior Information Sharing and Safeguarding Steering Committee (hereinafter Steering Committee).

8) Enable independent assessments, in accordance with Section 2.1 (d) of Executive Order 13587, of compliance with established insider threat policy and standards by providing information and access to personnel of the ITTF.

C. Insider Threat Task Force roles and responsibilities

The JTIF, established under Executive Order 13587, is the principal interagency task force responsible for developing an executive branch insider threat detection and prevention program to be implemented by all departments and agencies covered by this policy. This program shall include development of policies, objectives, and priorities for establishing and integrating security, counterintelligence, user audits and monitoring, and other safeguarding capabilities and practices within departments and agencies.

The ITIF shall:

1) In coordination with appropriate agencies, develop and issue minimum standards and guidance for implementing insider threat program capabilities throughout the executive branch. These standards shall include, but are not limited to, the following:

• Monitoring of user activity on United States Government networks. This refers to audit data collection strategies for insider threat detection, leveraging hardware and/or software with triggers deployed on classified networks to detect, monitor, and analyze anomalous user behavior for indicators of misuse.

• Continued evaluation of personnel security information whereby information is gathered from, including but not limited to, an individual's security background investigation, clearance adjudication, foreign travel reporting, foreign contact reporting, financial disclosure, polygraph examination results (where applicable) or other personnel actions, and made available to authorized insider threat program personnel to assess, in conjunction with anomalous user behavior data, and/or any other insider threat concern or allegation.

• Employee awareness training of the insider threat, the inherent risk posed to classified information by malicious insiders and, specifically, recognition of insider threat behaviors; developing a reporting structure to ensure all employees and contractors

2) Report suspected insider threat activity consistently and securely; informing employees, subject to monitoring, of the policies and processes in place to protect their privacy, civil rights, and civil liberties rights against unnecessary monitoring (to include retaliation against whistleblowers); and, ensuring employee awareness of their responsibility to report, as well as how and to whom to report, suspected insider threat activity.

• Analysis, Reporting and Response: gathering and integrating available information to conduct a preliminary review of any potential insider threat issues; and, where it appears a potential threat may exist, taking action by referring the matter as appropriate to CI, security, information assurance, the Office of Inspector General, or to the proper law enforcement authority.

3) Review and update ITTF standards and guidance, as appropriate.

4) Provide continual assistance to departments and agencies to establish and/or improve insider threat detection and prevention programs. The nature of assistance will involve a collaborative process wherein subject matter expert(s) provide expertise, guidance, and advice through various forums including on site visits.

5) Conduct independent assessments at individual organizations, as directed by the Steering Committee and in coordination with Executive Agent for Safeguarding (EA/S) and the Classified Information Sharing and Safeguarding Office (CISSO) established by Executive Order 13587, to determine the level of organizational compliance with this policy and minimum insider threat standards.

6) Use the results of relevant insider threat data sources to include, but not limited to, the agency's Key Information Sharing and Safeguarding Indicators self-assessments, applicable portions of the Office of the National Counterintelligence Executive Mission Reviews and Program Assessments, and the results of assistance visits and independent assessments to determine the adequacy of insider threat programs at individual agencies, and Government-wide.

7) Coordinate with the Information Security Oversight Office (ISOO), EA/S, and the CISSO to report results of independent assessments to the Steering Committee for use in the annual reports submitted to the President assessing the executive branch's effectiveness in implementing insider threat programs, and to inform related program and budget recommendations.

8) Refer to the Steering Committee for resolution any unresolved issues delaying the timely development and issuance of minimum standards.

9) Provide strategic analysis of new and continuing insider threat challenges facing the United States Government.

D. Definitions Classified information: Information that has been determined pursuant to Executive Order 13526, or any successor order, Executive Order 12951, or any successor order, or the Atomic Energy Act of 1954 ( 42 U .S.C. 2011 ), to require protection against unauthorized disclosure and that is marked to indicate its classified status when in documentary form.

Counterintelligence: Information gathered and activities conducted to identify, deceive, exploit, disrupt or protect against espionage, or other intelligence activities, sabotage, or assassinations conducted for or on behalf of foreign powers, organizations, or persons, or their agents, or international terrorist organizations or activities. (Executive Order 12333, as amended) Departments and agencies: Any "Executive agency," as defined in 5 U.S.C. 105~ any "Military department" as defined in 5 U.S.C. 102; any "independent establishment," as defined in 5 U.S.C. 104(1).

Employee: For purposes of this policy, "employee" has the meaning provided in section l.l(e) of Executive Order 12968; specifically: a person, other than the President and Vice President, employed by, detailed or assigned to, a department or agency, including members of the Armed Forces; an expert or consultant to a department or agency; an industrial or commercial contractor, licensee, certificate holder, or grantee of a department or agency, including all subcontractors; a personal services contractor; or any other category of person who acts for or on behalf of a department or agency as determined by the appropriate department or agency head.

Insider: Any person with authorized access to any United States Government resource to include personnel, faci lities, information, equipment, networks or systems.

Insider Threat: The threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to the security of the United States. This threat can include damage to the United States through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources or capabilities.

Key Information Sharing and Safeguarding Indicators: The Steering Committee developed these key performance indicators to serve as the basis for addressing reporting requirements directed by the President, and to assist in tracking progress and identifying areas for attention or additional funding to continue and strengthen the sharing and safeguarding of classified information on computer networks.

E. General Provisions Nothing in this policy shall be construed to supersede or change the requirements of the National Security Act of 1947, as amended; the Atomic Energy Act of 1954, as amended; the Intelligence Reform and Terrorism Prevention Act of 2004; Executive Order 12333, as amended (2008);

Executive Order 13467, (2008); Executive Order 13526, (2009); Executive Order 12829, as amended, (1993); Executive Order 13549 (2010); and Executive Order 12968, (1995) and their successor orders or directives.

MINIMUM STANDARDS FOR EXECUTIVE BRANCH INSIDER THREAT PROGRAMS

A. AUTHORITY: Executive Order 13587, Structural Reforms to Improve the Security of

Classified Networks and the Responsible Sharing and Safeguarding of Classified Information;

Executive Order 12968, Access to Classified Information; National Policy on Insider Threat.

B. PURPOSE:

1. Executive Order 13587 establishes the Insider Threat Task Force, co-chaired by the Director of National Intelligence and the Attorney General, and requires, in coordination with appropriate agencies, the development of minimum standards and guidance for implementation of a government-wide insider threat policy. This policy provides those minimum requirements and guidance for executive branch insider threat detection and prevention programs.

2. Insider threat programs are intended to: deter cleared employees from becoming insider threats; detect insiders who pose a risk to classified information; and mitigate the risks through administrative, investigative or other response actions as outlined in Section E.2.

3. The standards herein shall serve as minimum requirements for all applicable executive branch agencies. Nothing in this document shall be construed to supersede existing or future Intelligence Community or Department of Defense policy, which may impose more stringent requirements beyond these minimum standards for insider threat programs. Agencies may establish additional standards, provided that they are not inconsistent with the requirements contained herein.

4. Agency heads are ultimately responsible for the establishment and operations of their respective insider threat programs. Designated senior official(s), as described in Section D, shall be responsible for implementing the minimum standards contained herein.

C. APPLICABILITY: These standards shall apply to any "executive agency," as defined in 5 U.S.C. §105; any "military department" as defined in 5 U.S.C. §102; any "independent establishment" as defined in 5 U.S.C. §104(1); any intelligence community element as defined in Executive Order 12333.

D. DESIGNATION OF SENIOR OFFICIAL(S): Each agency head shall designate a senior official or officials, who shall be principally responsible for establishing a process to gather, integrate, and centrally analyze, and respond to Counterintelligence (CI), Security, Information Assurance (lA), Human Resources (HR), Law Enforcement (LE), and other relevant information indicative of a potential insider threat. Senior Official( s) shall:

1. Provide management and oversight of the insider threat program and provide resource recommendations to the agency head.

2. Develop and promulgate a comprehensive agency insider threat policy to be approved by the agency head within 180 days of the effective date ofthe National Insider Threat Policy. Agency policies shall include internal guidelines and procedures for the implementation of the standards contained herein.

3. Submit to the agency head an implementation plan for establishing an insider threat program and annually thereafter a report regarding progress and/or status within that agency. At a minimum, the annual reports shall document annual accomplishments, resources allocated, insider threat risks to the agency, recommendations and goals for program improvement, and major impediments or challenges.

4. Ensure the agency's insider threat program is developed and implemented in consultation with that agency's Office of General Counsel and civil liberties and privacy officials so that all insider threat program activities to include training are conducted in accordance with applicable laws, whistleblower protections, and civil liberties and privacy policies.

5. Establish oversight mechanisms or procedures to ensure proper handling and use of records and data described below, and ensure that access to such records and data is restricted to insider threat personnel who require the information to perform their authorized functions.

6. Ensure the establishment of guidelines and procedures for the retention of records and documents necessary to complete assessments required by Executive Order 13587.

7. Facilitate oversight reviews by cleared officials designated by the agency head to ensure compliance with insider threat policy guidelines, as well as applicable legal, privacy and civil liberty protections.

E. INFORMATION INTEGRATION, ANALYSIS AND RESPONSE: Agency heads shall:

1. Build and maintain an insider threat analytic and response capability to manually and/or electronically gather, integrate, review, assess, and respond to information derived from Cl, Security, lA, HR, LE, the monitoring of user activity, and other sources as necessary and appropriate.

2. Establish procedures for insider threat response action(s), such as inquiries, to clarify or resolve insider threat matters while ensuring that such response action(s) are centrally managed by the insider threat program within the agency or one of its subordinate entities.

3. Develop guidelines and procedures for documenting each insider threat matter reported and response action(s) taken, and ensure the timely resolution of each matter.

F. INSIDER THREAT PROGRAM PERSONNEL: Agency heads shall ensure personnel assigned to the insider threat program are fully trained in:

1. Counterintelligence and security fundamentals to include applicable legal issues;

2. Agency procedures for conducting insider threat response action(s);

3. Applicable laws and regulations regarding the gathering, integration, retention, safeguarding, and use of records and data, including the consequences of misuse of such information;

4. Applicable civil liberties and privacy laws, regulations, and policies; and

5. Investigative referral requirements of Section 811 ofthe Intelligence Authorization Act for FY 1995, as well as other policy or statutory requirements that require referrals to an internal entity, such as a security office or Office of Inspector General, or external investigative entities such as the Federal Bureau oflnvestigation, the Department of Justice, or military investigative services.

G. ACCESS TO INFORMATION: Agency heads shall:

1. Direct CI, Security, lA, HR, and other relevant organizational components to securely provide insider threat program personnel regular, timely, and, if possible, electronic access to the information necessary to identify, analyze, and resolve insider threat matters. Such access and information includes, but is not limited to, the following:

a. Counterintelligence and Security. All relevant databases and files to include, but not limited to, personnel security files, polygraph examination reports, facility access records, security violation files, travel records, foreign contact reports, and financial disclosure filings.

b. Information Assurance. All relevant unclassified and classified network information generated by lA elements to include, but not limited to, personnel usernames and aliases, levels of network access, audit data, unauthorized use of removable media, print logs, and other data needed for clarification or resolution of an insider threat concern.

c. Human Resources. All relevant HR databases and files to include, but not limited to, personnel files, payroll and voucher files, outside work and activities requests disciplinary files, and personal contact records, as may be necessary for resolving or clarifying insider threat matters.

2. Establish procedures for access requests by the insider threat program involving particularly sensitive or protected information, such as information held by special access, law enforcement, inspector general, or other investigative sources or programs, which may require that access be obtained upon request of the Senior Official(s).

3. Establish reporting guidelines for CI, Security, lA, HR, and other relevant organizational components to refer relevant insider threat information directly to the insider threat program.

4. Ensure insider threat programs have timely access, as otherwise permitted, to available United States Government intelligence and counterintelligence reporting information and analytic products pertaining to adversarial threats.

H. MONITORING USER ACTIVITY ON NETWORKS: Agency heads shall ensure insider threat programs include:

1. Either internally or via agreement with external agencies, the technical capability, subject to appropriate approvals, to monitor user activity on all classified networks in order to detect activity indicative of insider threat behavior. When necessary, Service Level Agreements (SLAs) shall be executed with all other agencies that operate or provide classified network connectivity or systems.

SLAs shall outline the capabilities the provider will employ to identify suspicious user behavior and how that information shall be reported to the subscriber's insider threat personnel.

2. Policies and procedures for properly protecting, interpreting, storing, and limiting access to useractivity monitoring methods and results to authorized personnel.

3. Agreements signed by all cleared employees acknowledging that their activity on any agency classified or unclassified network, to include portable electronic devices, is subject to monitoring and could be used against them in a criminal, security, or administrative proceeding. Agreement language shall be approved by the Senior Official(s) in consultation with legal counsel.

4. Classified and unclassified network banners informing users that their activity on the network is being monitored for lawful United States Government-authorized purposes and can result in criminal or administrative actions against the user. Banner language shall be approved by the Senior Official(s) in consultation with legal counsel.

I. EMPLOYEE TRAINING AND AWARENESS: Agency heads shall ensure insider threat programs:

1. Provide insider threat awareness training, either in-person or computer-based, to all cleared employees within 30 days of initial employment, entry-on-duty (EOD), or following the granting of access to classified information, and annually thereafter. Training shall address current and potential threats in the work and personal environment, and shall include, at a minimum, the following topics:

a. The importance of detecting potential insider threats by cleared employees and reporting suspected activity to insider threat personnel or other designated officials;

b. Methodologies of adversaries to recruit trusted insiders and collect classified information;

c. Indicators of insider threat behavior and procedures to report such behavior; and

d. Counterintelligence and security reporting requirements, as applicable.

2. Verify that all cleared employees have completed the required insider threat awareness training contained in these standards. ·

3. Establish and promote an internal network site accessible to all cleared employees to provide insider threat reference material, including indicators of insider threat behavior, applicable reporting requirements and procedures, and provide a secure electronic means of reporting matters to the insider threat program.

J. DEFINITIONS

"Agency Head" means the head of any: "executive agency," as defined in 5 U.S.C. § 1 05;

"military department" as defined in 5 U.S.C. § 102; "independent establishment" as defined in 5 U.S.C. § 104; intelligence community element as defined in Executive Order 12333; and any other entity within the executive branch that comes into the possession of classified information.

"Classified Information" means information that has been determined pursuant to Executive Order 13526, or the Atomic Energy Act of 1954 (42 U.S.C. §2162), to require protection against unauthorized disclosure and that it is marked to indicate its classified status when in documentary form. "Cleared Employee" means a person who has been granted access to classified information, other than the President and Vice President, employed by, or detailed or assigned to, a department or agency, including members of the Armed Forces; an expert or consultant to a department or agency; an industrial or commercial contractor, licensee, certificate holder, or grantee of a department or agency including all subcontractors; a personal services contractor; or any other category of person who acts for or on behalf of a department or agency as determined by the appropriate department or agency head. "Insider Threat" means the threat that an insider will use his or her authorized access, wittingly or unwittingly, to do harm to the security of United States. This threat can include damage to the United States through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources or capabilities. "Insider Threat Response Action(s)" means activities to ascertain whether certain matters or information indicates the presence of an insider threat, as well as activities to mitigate the threat. Such an inquiry or investigation can be conducted under the auspices of CI, Security, LE, or IG elements depending on statutory authority and internal policies governing the conduct of such in each agency. "Subordinate Entity" means an office, command, or similar organization, subordinate to the agency, which manages its own insider threat program.