SSO_Automation_Automation_Vision.pdf

USCYBERCOM Special Security Office SSO Automation

March 30, 2018

Inprocessing/First Contact

• New affiliate gets link via email w/ secure login

• Affiliate is prompted with information about the process

• Privacy Act information provided

• Asked whether they want to proceed with the process (notification to SSO)

• Affiliate is prompted to enter personal information (If they proceed)

• Name/SSN/Required security questions

• Information is provided to help answer the questions

• Additional information required, depending on the answer

• Request availability for follow-on interview/briefings/polygraphs/etc.

• Resend every 5 months for updated information, recertification

• Request status update/Request clarification on question (email/phone/system message)

• Information is saved to the database and used to populate security forms

• Data sent to USCC SSO for review

• Ability to kick back certain questions for additional detail with notes

• Ability to upload substantiating documentation (i.e. pdf/jpg)

• Tool should provide an ability for affiliate to digitally sign

• Some of the forms generated need to have digital signatures/initials

Required Forms/Scheduling

• Information from the questions used to automatically populate forms

• Polygraph dates/times stored in database

• Affiliate assigned to individual by SSO

• Automated email with info/directions w/ a link to confirm date

• Automated reminder email (days out TBD) with link to cancel/reschedule

• Interview date/time selected by SSO

• Email to confirm/cancel/reschedule with option to recommend new time

• Indoctrination dates/times stored in database

• Affiliate assigned to indoctrination date when approved

• Automated email with info/directions w/ a link to confirm date

• Automated reminder email (days out TBD) with link to cancel/reschedule

• Automate SSO rotation for indoctrination w/ reminder emails to office

• System automatically prints personalized forms for affiliates scheduled for indoctrination the day before indoctrination, i.e. the briefers name, affiliates’ names, SSN, org, date

• SSO conducting indoctrination can print required forms with data populated from the database i.e.

Status

• Once the link is sent to the individual they should be able to click the link to see their status at the top (Welcome Letter Sent to start)

• There are 4 separate and necessary processes that should be represented via Red/Yellow/Green

• Background Investigation (Green if current, Yellow if pending, Red if not started)

• Clearance Adjudication (Green if current, Yellow if pending, Red if no clearance)

• Polygraph Examination (Green if current, yellow if scheduled, Red if not scheduled/failed)

• NSA Access (Green once approved, Yellow if submitted, Red if waiting on affiliate to provide information, if SSO is noted it will take 12+ months, or if denied)

• Each of the process areas should have updates provided on a regular basis

• System prompts SSO to update records at a minimum of every 2 weeks

• The Status should be viewable to the SSO in a spreadsheet like format, which can be sorted by user prefences.

• Additionally, the onboarding affiliate’s Chain of Command should be able to view the status.

• The requirements are recurring while assigned at USCC, requiring new BI, Adjudication, Poly, and process for NSA access.

• After individuals are approved they should be able to view their status and supervision should be able to see a list of everyone’s status within their purview.

Office Workflow

• Once the individual submits the information, it goes into a queue for review by SSO

• The queue should label the directorate, affiliate type (military, civilian, contractor)

• After final review, generation of PDF forms

• Data is transferred to other systems as necessary

• SSO schedules BI/poly as necessary

• SSO checks with various organizations to update the system with the current status

• After approval, SSO schedules indoctrination briefings

• Maintenance of BI, clearance, polygraph of access

• Get reports on statuses, reinitiate processes, provide updates

Office Workflow – Reporting/Incidents

• Affiliates report incidents or status updates

• SSO provides kickback/schedule interview as necessary

• After information is reviewed, update the database with that information

• If adverse action is taken, tracking of the status by SSO only (i.e. report written, submitted for review, in adjudication)

• SSO provides notes on the incident to update processing

• Status updated to resolved when complete and stored in database

• Need to be able to view the affiliates in-processing documents to look for trends

• Update information on reported foreign contacts

• Submit Foreign Travel Requests

• Pull/lookup incidents based on type or person with reports on trend analysis (i.e. uptick in cell phone violations or DUIs)

• View all pending incidents separately from past ones

Out-processing

• Affiliate provides notification of their last day

• Debrief documentation provided to the individual

• Affiliated place on the schedule for their last day

• Forms/Memos generated automatically the day of by the

SSO

• Audit log on who did what in each case file

• Timelines for each step in the process broken down by month/year/etc. (i.e. how long does it take affiliate to fill out forms, how long to review)

• Productivity Statistics for Security personnel

• Which questions get kicked back to the user

Reports

Future Functionality

• Integration with other databases (Joint Verification System, e-QIP, etc.)

• Event Management

• Online registration for participants with security questions

• Assigned managers who are prompted with questions about their event

• Number of participants/location/classification level/foreign partners

• Based off the results of the questions, emails get sent to the members of the command who would have involvement (FDO, CAO, Site Security, SSO) and a basic security concept of operations is drafted based of a predetermined and approved SSO template

• Status of visit requests (inputted by SSO) viewable by participants and manager

• This includes outgoing and incoming VRs as necessary

• DD254 Management

• Approve DD254s in the system/track contractors associated with DD254

• Export information in XML and other formats to inject into other systems

• Accept Inject of information on affiliates’ statuses

• Verify dates are accurate, update dates with verification by user (SSO)

• Integration with USCC J6 network accounts tracking and approval

• Request user feedback on usability of the forms and recommendations