SECNAVINST 5510.30C.pdf

DEPARTMENT OF THE NAVY

OFFICE OF THE SECRETARY

1000 NAVY PENTAGON

WASHINGTON, D.C. 20350-1000

SECNAVINST 5510.30C

DUSN

24 Jan 2020

SECNAV INSTRUCTION 5510.30C

From: Secretary of the Navy

Subj: DEPARTMENT OF THE NAVY PERSONNEL SECURITY PROGRAM

Ref: See enclosure (1)

Encl: (1) References

(2) Responsibilities

(3) Department of the Navy Personnel Security Program Supplement

(4) Command Security Program

(5) Counterintelligence Matters

(6) Security Education

(7) National Security Investigations

(8) Adjudication and Eligibility Determinations

(9) Unfavorable Eligibility Determinations and Restrictions

(10) Access to Classified Information

(11) Visitor Access to Classified Information

(12) Continuous Evaluation

1. Purpose

a. This instruction establishes the Department of the Navy (DON) Personnel Security Program (PSP) under the authority of references (a) and (b) in compliance with references (c) through (s). It supplements reference (b), where needed. When applying guidance of this instruction, the user must consult reference (b) to ensure proper application of DON and Department of Defense (DoD) PSP standards.

b. Provide DON commands, activities, and personnel with regulations and guidance governing the DON PSP in accordance with references (a) through (af) and enclosures (3) through (12).

This is a major revision and should be read in its entirety.

2. Cancellation. SECNAVINST 5510.30B, SECNAV M-5510.30, and ALNAV’s 075/11, 058/13, 079/13, 073/14, 083/14, and 005/16.

24 Jan 2020

3. Definitions. For DoD definitions for the PSP see reference (b). Reference (b) can be obtained by accessing the Deputy Under Secretary of the Navy Security and Intelligence (DUSN (S&I)) Directorate Microsoft SharePoint Portal at:

https://portal.secnav.navy.mil/Pages/default.aspx.

4. Applicability. This Instruction applies to the Offices of the Secretary of the Navy (SECNAV), the Chief of Naval Operations (CNO), the Commandant of the Marine Corps (CMC), and all United States (U.S.) Navy (USN) and U.S. Marine Corps (USMC) installations, commands, activities, field offices, and all other organizational entities within the DON. This policy shall not alter or supersede the existing authorities delegated to the Director, DON Special Access Program (SAP) Central Office for SAP, or those delegated to the USMC Director of Intelligence (DIRINT) and the Director of Naval Intelligence (DNI) regarding the protection of intelligence sources, methods, and activities pursuant to reference (c) or the authorities delegated by the DNI to the Head of the Community Element (HICE).

5. Policy

a. This policy ensures maximum uniformity and effectiveness in the application of PSP policies within the DON and accomplishes the purpose of references (a) and (b).

This instruction and the references complement each other and have been coordinated to achieve maximum compatibility.

b. The objective of the PSP is to authorize initial and continued access to classified information and/or initial and continued assignment to sensitive duties to those persons whose loyalty, reliability, and trustworthiness are such that entrusting them with classified information or assigning them to sensitive duties are clearly consistent with the interests of national security. Additionally, the PSP ensures that no final unfavorable personnel security determination will be made without compliance with all procedural requirements.

6. Responsibilities. See enclosure (2).

https://portal.secnav.navy.mil/Pages/default.aspx

7. Records Management

a. Records created as a result of this instruction, regardless of format or media, must be maintained and dispositioned according to the records disposition schedules found on the Directives and Records Management Division (DRMD) portal page:

https://portal.secnav.navy.mil/orgs/DUSNM/DONAA/DRM/SitePages/Ho me.aspx.

b. For questions concerning the management of records related to this instruction or the records disposition schedules, please contact your local Records Manager or the DRMD program office.

8. Forms

a. The following DoD Forms are available for download from the DoD Forms Management Program website:

https://www.dtic.mil/whs/directives/infomgt/forms/index.htm/.

(1) DD Form 4414, Sensitive Compartmented Information Nondisclosure Agreement.

(2) DD Form 254, Contract Security Classification Specification.

b. The following forms are available for download from the U.S. General Services Administration Forms Library website:

https://www.gsa.gov/portal/forms/:

(1) Optional Form (OF) 8, Position Description.

(2) Standard Form (SF) 312, Classified Information Nondisclosure Agreement.

(3) SF 86, Questionnaire for National Security Positions.

(4) SF 87, Fingerprint Card.

(5) SF 86A, Continuation Sheet for Questionnaires.

https://portal.secnav.navy.mil/orgs/DUSNM/DONAA/DRM/SitePages/Home.aspx https://portal.secnav.navy.mil/orgs/DUSNM/DONAA/DRM/SitePages/Home.aspx https://www.dtic.mil/whs/directives/infomgt/forms/index.htm/ https://www.gsa.gov/portal/forms/

(6) SF 1847-1, Sensitive Compartmented Information (SCI) Non-Disclosure Agreement.

(7) SF 714, Financial Disclosure Report.

c. The following forms are available for download from the National Background Investigations Bureau (NBIB) Forms website:

https://nbib.opm.gov/hr-security-personnel/reference-materials/nbib-access-forms:

(1) Investigations (INV) Form 79A, Report of Agency Adjudicative Action on NBIB Personnel Investigations.

(2) Personnel Investigation Processing System (PIPS) Form 12, Submitting Office Number (SON) Creation and Amendment Form.

(3) PIPS Form 11, Security Office Identifier (SOI) Creation and Amendment Form.

d. Department of Energy (DOE) Visitor Request 5631.20, Request for Visit or Access Approval, is available for download at the DOE website: https://www.energy.gov/cio/office-chief-information-officer/services/forms.

9. Information Management Control. The reporting requirements throughout this instruction are exempt from Information Management Control, per reference (t), Part IV, paragraph 7c, 7i, 7n, and 7o.

THOMAS B. MODLY

Acting

Distribution:

Electronic only, via Department of the Navy Issuances website https://www.secnav.navy.mil/doni/default.aspx.

https://nbib.opm.gov/hr-security-personnel/reference-materials/nbib-access-forms https://nbib.opm.gov/hr-security-personnel/reference-materials/nbib-access-forms https://www.energy.gov/cio/office-chief-information-officer/services/forms https://www.energy.gov/cio/office-chief-information-officer/services/forms https://www.secnav.navy.mil/doni/default.aspx

Enclosure (1)

REFERENCES

(a) DoD Instruction 5200.02 of 21 March 2014

(b) DoDM 5200.02, Procedures for the DoD Personnel Security Program of 3 April 2017

(c) SECNAVINST 5500.36A

(d) SECNAVINST 5510.36B

(e) SECNAVINST 5510.34B

(f) SECNAV M-5210.1

(g) SECNAVINST 5510.35D

(h) SECNAVINST 5312.12D

(i) SECNAVINST S5460.3H

(j) SECNAV M-5239.2

(k) DoDM 5105.21 Volume 3, SCI Administrative Security Manual:

Administration of Personnel Security, Industrial Security, and Special Activities of 5 April 2018

(l) ICPG 704.1 of 2 October 2008

(m) DoD Directive 5240.06 of 21 July 2017

(n) DoD Instruction 5210.91 of 12 August 2010

(o) SECNAVINST 5213.12D

(p) DoD Instruction 5200.46 of 9 September 2014

(q) 5 CFR 731

(r) Office of the Under Secretary of Defense Intelligence Memorandum of 12 June 18: Implementation of Security Executive Agent Directive 4: National Security Adjudicative Guidelines (10 December 2016)

(s) OPNAVINST 5400.45

(t) SECNAV M-5214.1

(u) Title 5, U.S.C.

(v) Title 10, U.S.C.

(w) DoDM 5220.22, National Industrial Security Program (NISP):

Operating Manual of 18 May 2016

(x) SECNAVIST 5740.26B

(y) DoD Directive 5220.6 of 2 January 1992

(z) DoD Directive 5220.22R of 4 December 1985

(aa) Under Secretary of Defense for Intelligence (USD (I)) Memorandum (NOTAL) of 31 May 2009

(ab) DoD Directive 5100.55 of 27 February 2006

(ac) DoD Directive 5210.2 of 3 June 2011

(ad) DoD Instruction 6490.08 of 17 August 2011

(ae) DoD Directive 5210.48 of 24 April 2015

(af) DoD Directive 5230.11 of 16 June 1992

Enclosure (2)

RESPONSIBILITIES

1. SECNAV is responsible for oversight, management, readiness, and compliance of the PSP.

2. The Under Secretary of the Navy (UNSECNAV) is responsible for implementing the PSP, in compliance with Presidential Directives and the provisions of Executive Orders, public laws, and directives issued by the DNI, Secretary of Defense (SECDEF), and other program authorities.

3. Assistant Secretary of the Navy Manpower and Reserve Affairs (ASN (M&RA)) provides oversight to ensure personnel security requirements for DON civilian personnel are properly identified in Joint Personnel Adjudication System (JPAS) or successor system, and that matters relating to the DON’s civilian PSP and sensitive position designation are appropriately coordinated with DUSN (S&I).

4. The CNO is responsible for implementing an effective Navy PSP and complying with all directives issued by higher authority.

a. Ensure matters relating to the Navy’s PSP are appropriately coordinated with DUSN (S&I).

b. Ensure personnel security requirements for Navy military and civilian members are properly identified in JPAS or successor system.

c. Ensure personnel security requirements for Navy military members are properly coded in military personnel data systems, which ultimately will update JPAS or successor system.

d. Ensure personnel identifying data and the position designation are accurately reflected and updated in the civilian personnel data systems, which ultimately will update JPAS or successor system.

e. Notify commands of eligibility and/or investigative requirements associated with transfers to new assignments.

2 Enclosure (2)

f. Coordinate with DUSN (S&I) on all matters involving personnel security eligibility determinations on Navy military members.

g. Director, Special Programs Division (CNO N9SP), is the DON SAP Coordinator and is responsible for the management, administration, support, review, and oversight of the DON SAP security program.

h. The Director, Navy International Programs Office is delegated the authority to approve or disapprove requests for access to or transfer of DON technical data or disclosure of DON classified or sensitive unclassified information to foreign governments, international organizations, and their representatives in accordance with national disclosure policy.

i. The DNI is HICE, Navy and administers the SCI program for the Navy, including non-Service DON entities. The Special Security Office, Navy (SSO Navy) is designated as the Cognizant Security Authority (CSA). As the CSA, SSO Navy is responsible for the security management, implementation, and oversight of SCI security programs for the DON’s SCI security program.

j. The HICE, Navy has designated Commander, U.S. Fleet Cyber Command (COMFLTCYBERCOM) Security Directorate the authority responsible for administration of SCI PSPs within the Department’s Cryptologic Community. COMFLTCYBERCOM is assigned as Service Cyber Component to Commander, U.S. Cyber Command for all Navy cyberspace activities and as the Service Cryptologic Component Commander to the National Security Agency/Central Security Service (NSA/CSS).

5. The CMC is responsible for implementing an effective Marine Corps PSP and complying with all directives issued by higher authority.

a. Ensure matters relating to the Marine Corps PSP are appropriately coordinated with DUSN (S&I).

b. Ensure personnel security requirements for Marine Corps military and civilian members are properly identified in JPAS or successor system.

3 Enclosure (2)

c. Ensure personnel security requirements for Marine Corps military members are properly coded in military personnel data systems, which ultimately will update JPAS or successor system.

d. Ensure personnel identifying data and the position designation are accurately reflected and updated in civilian personnel data systems, which ultimately will update JPAS or successor system.

e. Notify commands of eligibility and/or investigative requirements associated with transfer to new assignments, as appropriate.

f. Coordinate with DUSN (S&I) on all matters involving personnel security eligibility determinations on DON military members.

g. The CMC has delegated the DIRINT, Headquarters Marine Corps as HICE, USMC and administers the SCI program for the Marine Corps. SSO Navy (OPNAV N2N6I) is designated as the CSA and is responsible for the security management, implementation, and oversight of SCI security programs for the DIRINT.

6. The DUSN is designated as the DON Security Executive, per reference (d). DUSN is responsible, under the direction and control of the UNSECNAV, for establishing, directing, and overseeing an effective DON PSP, and for implementing and complying with all directives issued by higher authority.

7. The Director, Naval Criminal Investigative Service (DIRNCIS) serves as an advisor to the CNO as Special Assistant for Naval Investigative Matters (CNO N09N).

8. The Office of Chief Information Officer (OCIO) is responsible for providing Information Management and Information Technology (IT) policy and governance oversight for the DON. This includes enterprise architecture, data center optimization, privacy, Freedom of Information Act, civil liberties, information sharing, electromagnetic spectrum, cybersecurity, and IT policy compliance. The OCIO coordinates within the DON Secretariat, as well as with the Navy, Marine Corps, Military Departments, DoD, and other Federal agencies.

4 Enclosure (2)

9. The Deputy Assistant Secretary of the Navy (Civilian Human Resources (DASN (CHR)), under the direction and control of ASN (M&RA), provides oversight to ensure personnel identifying data is accurately reflected and updated, in the Defense Civilian Personnel Data System or successor system, is consistent with information provided in JPAS or successor system, and that matters relating to the DON’s civilian suitability position designation are appropriately coordinated with DUSN (S&I).

10. The DUSN, Senior Director for (S&I), under the authority, direction, and control of DUSN, provides staff support for the functions and responsibilities as described in reference (c).

11. The President, Personnel Security Appeals Board (PSAB) presides over the PSAB, a three-member panel appointed by the Director of Review Boards, to review and decide appeals of unfavorable DoD Consolidated Adjudications Facility (CAF) determinations. The decision of the PSAB is final and concludes the administrative appeal process to sustain or reverse a DoD CAF determination.

12. The Commanding Officer (CO) (used as a generic term for the head of any DON command and includes commander, commanding general, director, and officer in charge) is responsible for the effective management of the PSP within the command. Authority delegated by this instruction to a CO may be further delegated, unless specifically prohibited. "Command" is used as a generic term for the organizational entity and includes a ship, laboratory, facility, activity, unit, squadron, etc.

13. DON military and civilian personnel will:

a. Fully and accurately complete personnel security questionnaires and cooperate with personnel security investigators.

b. Be aware of personnel security eligibility standards and reporting requirements, and consult with local security officials whenever information develops that could affect eligibility, per reference (b).

5 Enclosure (2)

14. The Defense Counterintelligence and Security Agency (DCSA) and the DoD CAF evaluates Personnel Security Investigations (PSI) and other relevant information to determine if granting or continuing national security eligibility is clearly consistent with the interests of national security.

Enclosure (3)

DEPARTMENT OF THE NAVY PERSONNEL SECURITY PROGRAM SUPPLEMENT

1. Basic Policy. This overview applies to Total Force, personnel employed by, detailed to, or assigned to the DON, including Government civilians (both appropriated and NAF);

members of the active and reserve components of the USN and USMC; temporarily assigned forces performing a full-time or training role or function of security, e.g., Auxiliary Security Force and Ship’s Self Defense Force; expert or consultants performing services for the DON through personnel appointments or contractual arrangements; industrial or commercial contractor, licensee, certificate holder, or grantee, including subcontractors.

2. Special Programs

a. The security requirements for access to information classified as Confidential, Secret, or Top Secret (TS) normally provides sufficient protection. Any program requiring additional security protection, handling measures, reporting procedures, or formal access lists is considered a special program.

b. Most special programs requiring additional security measures have been established by authorities outside the DON.

Although the requirements for these programs are included in this regulation, these programs are implemented and governed in the DON by references (g) through (l).

3. SAPs. Programs requiring security measures in addition to those requirements for the protection of TS, Secret, or Confidential classified information, which are established by and within the DoD, are referred to as DoD SAPs. A DoD SAP must be authorized by the SECDEF or by the Deputy Secretary of Defense (DEPSECDEF). CNO (N9SP) is responsible for the coordination of the approval, administration, support, review, oversight, and reporting of all DON SAPs. The UNSECNAV recommends to the DEPSECDEF, the establishment, modification, or disestablishment of DON SAPs.

4. Combat Operations. Security requirements may be modified as necessary to meet local conditions in combat or combat-related operations. In these circumstances, follow the provisions of this regulation as closely as possible. This exception does not

2 Enclosure (3) apply to regularly scheduled training exercises or operations.

Exercises are not combat-related operations.

5. Waivers. When situations arise that require deviation from the standards of this instruction or any of its implementing directives, submit a waiver to the standard or requirement request to the DON Senior Agency Official via CNO or CMC (whichever is appropriate) for consideration and submission to USD (I) for approval.

6. Guidance. Requests for guidance or clarification of this regulation may be addressed formally or informally to, Room 4E572, Washington, DC, 20350-1000. For telephone inquiries, the Security Action Line (with a recorder for after-hours calls) may be reached at DSN 288-5027, commercial (703) 601-5027. Send e-mail requests to donsecurity_pers.fct@navy.mil. DUSN (S&I) homepage at https://portal.secnav.navy.mil/Pages/default.aspx provides policy updates, security awareness items, and other policy materials. Requests for guidance and clarification of this regulation by Navy commands may be addressed by CNO, Director of Navy Staff (DNS), formally or informally, and Marine Corps units may be addressed formally or informally to HQMC Plans, Policy & Oversight/Personnel Security (PP&O/PS).

7. Violations of the Provisions of this Instruction

a. Military personnel are subject to disciplinary action under the Uniform Code of Military Justice (UCMJ), or criminal penalties under applicable Federal Statutes, as well as administrative sanctions, if they knowingly, willfully, or negligently violate the provisions of this policy manual.

b. Civilian employees are subject to criminal penalties under applicable Federal Statutes, as well as administrative sanctions, if they knowingly, willfully, or negligently violate the provisions of this policy manual.

mailto:donsecurity_pers.fct@navy.mil

Enclosure (4)

COMMAND SECURITY PROGRAM

1. Overview. CO’s are responsible for compliance with and implementation of the DON PSP within their command. The effectiveness of the command's security program depends on the importance given to the program by the CO.

2. CO

a. An effective security program relies on a team of professionals working together to fulfill the CO's responsibilities.

b. Command security management responsibilities include:

(1) Designating an Activity Security Manager (ASM) in writing.

(2) Designating a TS Control Officer (TSCO) in writing if the command handles TS information.

(3) Designating an Information System Security Manager (ISSM) in writing if the command processes data in an automated system.

(4) Designating a Security Officer in writing to manage facilities security.

(5) Designating a Special Security Officer in writing to administer the command SCI security program.

(6) Issuing a written command security policy instruction.

(7) Establish an industrial security program when the command engages in classified procurement or when cleared contractors operate within areas under the CO’s control.

(8) Ensuring the ASM attends formal training within 180 days of assignment to the position and other command security professionals are appropriately trained, that all personnel receive required security education, and that the command has a robust security awareness program.

2 Enclosure (4)

(9) Preparing an emergency plan for the protection of classified material.

(10) Ensuring that command security inspections, program reviews, and assist visits are conducted for effectiveness of the PSP in subordinate commands.

(11) Ensuring that the performance rating systems of all DON military and civilian personnel whose duties significantly involve the creation, handling, or management of National Security Information (NSI) include a security element on which to be evaluated.

(12) Ensuring implementation and required use of the JPAS, access to the Defense Information System for Security (DISS) or successor system to communicate with the DoD CAF to receive and respond to notifications of investigations and continuous evaluation alerts.

3. Security Manager

a. Every command in the Navy and Marine Corps eligible to receive sensitive or classified information is required to designate an ASM (also known as Command Security Manager (CSM)) in writing in accordance with reference (b).

(1) CNO, DNS, CMC, and HQMC PP&O/PS will maintain a copy of subordinate ASM designation letters. Navy Echelon I and II ASM will maintain a copy of their subordinate ASM designation letters, per reference (s). Marine Corps CO’s will maintain a copy of subordinate ASM designation letters. The designation letter should include the Unit Identification Code, Security Management Office Code, Electronic Questionnaires for Investigations Processing (e-QIP) four-digit identification number and return e-mail address for program management oversight.

(2) Navy Echelon I and II ASM data will be maintained by CNO, DNS, and CMC. HQMC PP&O/PS will maintain a copy of subordinate Marine Corps commands ASM data to promote program management goals and to allow proper registration for security awareness products, notification of training opportunities, and policy updates. Navy Echelon I and II, HQMC PP&O/PS, and Marine

3 Enclosure (4)

Corps CO’s ASM will ensure all information is forwarded to subordinate commands as required.

b. The ASM will be afforded direct access organizationally to the CO and be organizationally aligned to ensure effective management of the command's security program.

c. The ASM may be assigned full-time, part-time, or as a collateral duty and must be a military officer, senior non-commissioned officer, E-7 or above, a civilian employee, GS-11 or above (or pay band equivalent), with sufficient authority and staff to manage the program for the command. The ASM must be a U.S. citizen and have been the subject of a favorably adjudicated Tier 5 (T5) background investigation (BI) completed within the five years prior to assignment.

d. The ASM must be designated by name and identified to all members of the command on organization charts, telephone listings, rosters, etc.

e. COs are required to obtain formal training for their ASM. The Naval Security Manager Course offered by the Security Education Training and Awareness Team and the Marine Corps Security Management Course satisfy this requirement.

4. Duties of the ASM

a. The ASM is the key in developing and administering the command's PSP. The ASM is the principal advisor on personnel security in the command (except issues specific to SCI, IT, and SAPs unless officially designated for these additional duties and responsibilities) and is responsible to the CO for the security program management.

(1) The duties described here and in reference (d) may be assigned to a number of personnel and may even be assigned to individuals senior to the ASM. However, the ASM remains ultimately responsible to the CO for all program requirements.

(2) The ASM must be cognizant of the command security functions and ensure the security program is coordinated and inclusive of all requirements. Security management may involve direct supervision, oversight, coordination, or a combination thereof, to ensure that those individuals in the command who

4 Enclosure (4) have security duties are kept abreast of changes in policies and procedures, and are provided assistance in solving security problems.

b. The below listed duties and those provided in section 2 of reference (b) apply to every ASM:

(1) Serves as the CO’s advisor and direct representative in matters pertaining to the security of classified information held at the command.

(2) Serves as the CO’s advisor and direct representative in matters regarding the eligibility of personnel to access classified information and to be assigned to sensitive duties.

(3) Develops written command personnel security procedures, including an emergency plan which integrates emergency destruction drills where required.

(4) Formulates and coordinates the command's security awareness and education program.

(5) Ensures security control of visits to and from the command when the visitor requires, and is authorized access to classified information.

(6) Ensures that all PSI are properly prepared and submitted to the DCSA and monitored until completed; and adjudicated by the DoD CAF for all personnel who will handle classified information or will be assigned to sensitive duties.

(7) Ensures that access to classified information is limited to those who are eligible and have the “need-to-know”.

(8) Ensures that PSI, eligibility, and accesses are properly recorded in the Joint Clearance and Access Verification System (JCAVS) or successor system, and that subordinate commands are properly registered in JCAVS or successor system, as necessary.

(9) Coordinates the command program for continuous evaluation of eligibility for access to classified information or assignment to sensitive duties.

5 Enclosure (4)

(10) Maintains liaison with the command SSO concerning information and personnel security policies and procedures.

(11) Coordinates with the ISSM on matters of common concern.

(12) Coordinates with the Human Resources Office on matters concerning civilian personnel to include, development of position descriptions, issues involving access to classified information, or assignment to sensitive positons. Uses the Position Designation Tool to determine position designations and to determine if civilian, contractors, or consultants require national security eligibility.

(13) Ensures that all personnel who have had access to classified information who are separating, retiring, or being terminated from employment have completed a Security Termination Statement in accordance with Section 4-12. The original statement is filed in the individual's Electronic Service Record or Official Personnel Folder (OPF) and a copy is saved in the command’s files.

(14) Ensures all personnel execute a Classified Information Nondisclosure Agreement (SF 312) prior to granting initial access to classified information and records execution of the SF 312 in JPAS or successor system.

5. TSCO. Commands that handle TS material will designate a TSCO, in writing. The TSCO must be an officer, senior non-commissioned officer, E-7 or above, or a civilian employee, GS-7 or above. The TSCO must be a U.S. citizen and have been the subject of a favorably adjudicated T5 investigation completed within five years of initial assignment, with T5 Reinvestigation (T5R) every five years thereafter. The duties of a TSCO are prescribed by reference (d).

6. Other Security Assistants

a. Activity Assistant Security Manager (AASM). Persons designated as AASM must be U.S. citizens, and either officers, enlisted persons E-7 or above, or civilians GS-7, or above. The designation must be in writing and a copy maintained by the ASM for oversight. AASM takes direction from the ASM and provides support, as needed. AASM must have a T5 BI completed and adjudicated by the DoD CAF, if they are designated to issue

6 Enclosure (4) interim security clearances; otherwise, the investigative and clearance eligibility requirements will be determined by the level of access to classified information required.

b. Security Assistant. Civilian and military member employees performing administrative functions under the direction of the ASM may be assigned in writing without regard to rate or grade as long as they have the eligibility needed for the access required to perform their assigned duties and tasking.

c. Top Secret Control Assistant (TSCA). Individuals may be assigned to assist the TSCO as needed. The designation will be in writing and a copy maintained by the TSCO for oversight. A person designated as a TSCA must be a U.S. citizen and either an officer, enlisted person E-5 or above, or civilian employee GS-5 or above. A T5 BI completed, adjudicated and eligibility granted by the DoD CAF is required. TS couriers are not considered to be TSCAs. Duties of a TSCA are listed, per reference (d).

7. Contracting Officer’s Security Representative (COSR).

Commands that award classified contracts to industry will appoint, in writing, one or more qualified security specialists as a COSR. The COSR is responsible to the security manager for coordinating with program managers and technical and procurement officials. The COSR will coordinate with the Contracting Officer’s Representative to ensure that the personnel and information security requirements are properly recorded and the industrial security functions are accomplished when classified information is provided to industry for performance on a classified contract are on the DD Form 254, Contract Security Classification Specification, and that personnel security requirements are met when access to DON IT systems is at issue and the requirements are included in the Statement of Work for unclassified contracts.

8. ISSM

a. Each command involved in processing data in an IT system, including access to local area networks and/or INTRANET/INTERNET, must designate in writing, a U.S. citizen civilian or military member as an ISSM.

7 Enclosure (4)

b. The ISSM is responsible for establishing, implementing and maintaining the DON information system and information assurance program and is responsible to the CO for developing, maintaining, and directing the implementation of the Information Assurance (IA) program within the command. The ISSM advises the CO on all IA matters, including identifying the need for additional IA staff. The IA Manager serves as the command’s point of contact (POC) for all IA matters and implements the command's IA program. The ISSM coordinates information and personnel security matters with the ASM, as appropriate. The ISSM must have a favorable T5 completed within five years of initial assignment, which is updated by T5R every five years.

The duties and functions of the ISSM are prescribed by reference (j).

9. SSO

a. Commands in the DON accredited for and authorized to receive, process, and store SCI will designate a SSO. The SSO is the principal advisor on the SCI security program in the command and is responsible to the CO for the management and administration of the program. SCI security program responsibilities are detailed in reference (k). The SSO will be afforded direct access to the CO to ensure effective management of the command's SCI security program. The SSO will be responsible for the operation of the Sensitive Compartmented Information Facility (SCIF) and the security control and use of the SCIF. All SCI matters shall be referred to the SSO.

b. The SSO and a subordinate SSO will be appointed, in writing, and each will be a U.S. citizen and either a commissioned officer or a civilian employee GS-9 or above, and must meet the requirements of reference (l). The same grade limitations apply to assistant SSOs. The ASM cannot function as the SSO unless authorized by the Director, Office of Naval Intelligence, or Commander, FLTCYBCOM.

c. Although the SSO administers the SCI program independent of the ASM, the ASM must account for all clearance and access determinations made on members of the command. There is great need for cooperation and coordination between the SSO and ASM, especially for personnel security matters. For individuals who are SCI eligible, the ASM and the SSO must keep one another advised of any changes in status regarding clearance and access

8 Enclosure (4) and of information developed that may affect eligibility. The ASM and SSO must also advise each other of changes in SCI and command security program policies and procedures as they may impact on the overall command security posture.

10. Inspections, Assist Visits, and Reviews

a. COs at Navy Echelon I and II levels and Marine Corps COs are responsible for evaluating the security posture of their subordinate commands.

b. Qualified personnel will conduct inspections, assist visits, and reviews to assess the command's overall security posture. Information and personnel security inspections may be conducted in unison unless otherwise required.

11. Security Servicing Agreements

a. Commands may perform specified security functions for other commands via security servicing agreements. Such agreements may be appropriate in situations where security, economy, and efficiency are considerations, including:

(1) A command provides security services for another command, or the command provides services for a tenant activity.

(2) A command is located on the premises of another government entity and the host command negotiates an agreement for the host to perform security functions.

(3) A senior in the chain of command performs or delegates certain security functions of one or more subordinate commands.

(4) A command with particular capability for performing a security function agrees to perform the function for another.

(5) A command is established expressly to provide centralized service (for example, Personnel Support Activity or Human Resources Office).

(6) When either a cleared contractor facility or a long-term visitor group is physically located on a Navy or Marine Corps installation.

9 Enclosure (4)

b. A security servicing agreement will be specific and must clearly define where the security responsibilities of each participant begin and end. The agreement will include requirements for advising COs of any matters that may directly affect the security posture of the command. Append security-servicing agreements to the command security policy instruction.

12. Standard Program Requirements. Each command that handles classified information is required to prepare and keep current a written command security policy manual, specifying how security procedures and requirements will be accomplished in the command.

See reference (d).

13. Planning for Emergencies. Commands will establish a plan for the protection and/or removal of classified NSI under its control during emergencies. Depending upon the location of the command, the plan may direct destruction of classified NSI in an emergency. The plan should be made part of the overall disaster preparedness plan of the command security program policy manual.

Enclosure (5)

COUNTERINTELLIGENCE MATTERS

1. Overview. Certain matters affecting national security must be reported to the DIRNCIS so that appropriate counterintelligence action can be taken. All military and civilian personnel of the DON, whether they have access to classified information or not, will report to their ASMs, COs or to the nearest command, any activities described in this section involving themselves, their dependents, co-workers, or others.

COs will immediately notify the nearest Naval Criminal Investigative Service (NCIS) office.

2. Sabotage, Espionage, Terrorism, Subversion, or Deliberate Compromise

a. Individuals becoming aware of sabotage, international terrorism, espionage, deliberate compromise or gross negligence involving classified information, or other subversive activities will report all available information concerning such activities immediately to the security manager or CO at their command or at the most readily available command. The command receiving the report shall promptly notify the servicing NCIS office. The command will immediately contact the Director, NCIS (DIRNAVCRIMINVSERV WASHINGTON DC) by classified IMMEDIATE message, with DUSN (S&I) and (NAVY JAG WASHINGTON DC//17//) as information addressees if the servicing NCIS office cannot be contacted immediately and the report concerns sabotage, terrorism, espionage, or imminent flight or defection of an individual.

b. The servicing NCIS office will be notified immediately of any requests, through other than official channels, for classified or national defense information from anyone without an official need to know, regardless of nationality. The NCIS office will also be notified of any requests for unclassified information from any individual believed to be in contact with a foreign intelligence entity. Examples of requests to be reported include attempts to obtain: names, duties, personal data or characterizations of DON personnel; technical orders, manuals, regulations, base directories, personnel rosters or unit manning tables; and information about the designation, strength, mission, combat posture, and development of ships, aircraft, and weapons systems.

2 Enclosure (5)

c. NCIS will then advise what additional action is to be taken, and will effect liaison and coordination with appropriate members of the U.S. intelligence community.

3. Contact Reporting

a. All personnel who possess a security clearance are to report to their CO, activity head, or designee, contacts with any individual, regardless of nationality, whether within or outside the scope of the individual's official activities, in which illegal or unauthorized access is sought to classified or otherwise sensitive information.

b. Personnel must report to the command if they are concerned that they may be the target of exploitation. The CO will review and evaluate the information and promptly report it to the local NCIS office.

4. Suicide or Attempted Suicide

a. When personnel who have access to classified information commit or attempt to commit suicide, the individual's CO will immediately forward all available information to the nearest NCIS office for action, with an information copy to the DoD CAF.

The report will, as a minimum, describe the nature and extent of the classified information to which the individual had access, and the circumstances surrounding the suicide or attempted suicide.

b. The NCIS office receiving the report will coordinate investigative action with the CO. If NCIS assumes immediate investigative cognizance, command investigative efforts will be subordinate to those of NCIS. No independent questioning of witnesses should be conducted without prior approval of NCIS.

5. Unauthorized Absentees

a. When personnel who have access to classified information are determined to be in an unauthorized absentee status, the individual's CO will conduct an inquiry to determine if there are any indications from the individual's activities, behavior, or associations that the absence may be contrary to the interests of national security. If the inquiry develops such concerns, the command will report the pertinent information to

3 Enclosure (5) the nearest NCIS office by quickest means available.

b. NCIS will promptly advise whether or not they will conduct an investigation.

6. Death or Desertion. When an employee of the DON who has access to classified information dies or deserts, the employee’s CO must determine if any unusual indicators or circumstances may have existed that may cause security concern. If such concerns exist, the command will report these concerns by the most expedient means available and provide all pertinent information to the nearest NCIS office.

7. Foreign Travel

a. Commands will advise personnel of the particular vulnerabilities associated with foreign travel during orientation and annual refresher briefs. See Section 4, Special Briefings, for additional information regarding the foreign travel briefing.

b. All personnel possessing security clearance eligibility are required to list all personal foreign travel as part of the required Periodic Reinvestigation (PR) in accordance with references (a) and (b) or other reporting guidance issued by the USD (I). The Investigative Service Provider (ISP) will explore the foreign travel issue during the PR and may refer the investigation to NCIS if the travel patterns or failure to list travel create concerns that would make referral appropriate.

8. Foreign Connections

a. A security risk may exist when an individual's immediate family, including cohabitants and other persons to whom the individual is bound by affection or obligation, are not citizens of the U.S. Having a financial interest in a foreign country may also present a security risk.

b. The personnel security adjudicative process requires an examination of a sufficient amount of information regarding an individual to determine whether the individual is an acceptable security risk. The assessment of risk due to the individual's relationship with foreign nationals and foreign entities is a part of the personnel security adjudicative process.

4 Enclosure (5)

c. All personnel with established security clearance eligibility are required to report foreign connections to their ASM in accordance with the references (b) and (r). ASMs must report these issues and coordinate resolution with the DoD CAF as appropriate.

Enclosure (6)

SECURITY EDUCATION

1. Overview

a. Each command handling classified or sensitive information will establish and maintain an active security education program to instruct all personnel, regardless of their position, rank or grade, in security policies and procedures.

b. The purpose of the security education program is to ensure that all personnel understand the need and procedures for protecting classified or sensitive information. The goal is to develop fundamental security habits as a natural element of each task.

2. Responsibility

a. DUSN (S&I) is responsible for policy guidance, education requirements, and support for the DON security education program. Development of security education materials for use throughout the DON must be coordinated with DUSN (S&I) for consistency with current policies and procedures. This requirement does not apply to materials that are prepared for use in command programs.

b. Recruit Training Commands are responsible for indoctrinating military personnel entering the Navy and Marine Corps, with a basic understanding of what it means to be serving in a national security sensitive position and explaining what "classified information" is and why the information must be protected. Civilians being employed by the DON for the first time, who will handle classified material or work in a sensitive position, must also be given basic security indoctrination by the employing activity.

c. COs are responsible for security education in their commands, ensuring time is dedicated for training and awareness. Supervisors, in coordination with the ASM, are responsible for determining security requirements for their functions and ensuring personnel under their supervision understands the security requirements for their particular assignment. On-the-job training is an essential part of command security education and supervisors must ensure that such training is provided.

2 Enclosure (6)

3. Scope

a. Security education must be provided to all personnel in accordance with references (b) and (d).

b. In formulating a command security education program, the ASM must provide the minimum briefing requirements of this regulation. ASMs must guard against allowing the program to become stagnant or simply comply with requirements without achieving the real goals of this instruction.

c. The security education program should be developed based on the command mission and function, and should:

(1) Advise personnel of the adverse effects that unauthorized disclosure of classified information may have on national security. Further, advise of their personal, moral, and legal responsibility to protect classified information within their knowledge, possession, or control.

(2) Advise personnel of their responsibility to adhere to the standards of conduct required of persons holding positions of trust and to avoid personal behavior that could render them ineligible for access to classified information or assignment to sensitive duties.

(3) Advise personnel of their obligation to notify their supervisor or ASM when they become aware of information with potentially serious security significance regarding someone with access to classified information or assigned to sensitive duties.

(4) Advise supervisors of the requirement for continuous evaluation of personnel for eligibility for access to classified information or assignment to sensitive duties.

(5) Familiarize personnel with the principles, criteria, and procedures for the classification, downgrading, declassification, marking, control and accountability, storage, destruction, and transmission of classified information and material and alert them to the strict prohibitions against improper use and abuse of the classification system.

3 Enclosure (6)

(6) Familiarize personnel with procedures for challenging classification decisions believed to be improper.

(7) Familiarize personnel with the security requirements for their particular assignments and identify restrictions.

(8) Instruct personnel having knowledge, possession, or control of classified information on how to determine, before disseminating the information, that the prospective recipient has been authorized access, needs the information to perform his/her official duties, and can properly protect (store) the information.

(9) Advise personnel of the strict prohibition against discussing, transmitting, or electronic processing of classified information over a non-secure telephone, non-secure fax, unclassified IT systems, or in any other manner that may permit interception by an unauthorized person.

(10) Inform personnel of the techniques employed by foreign intelligence activities in attempting to obtain classified information.

(11) Inform personnel of their particular vulnerability to compromise during foreign travel.

(12) Advise personnel that they are to report to their CO, activity head or designee, contacts with any individual regardless of nationality, whether within or outside the scope of the individual’s official activities, in which:

(a) Illegal or unauthorized access is sought to classified or otherwise sensitive information.

(b) The employee is concerned that he or she may be the target of exploitation by a foreign entity.

(13) Advise personnel of the penalties for engaging in espionage activities and for mishandling classified information or material.

4 Enclosure (6)

4. Minimum Requirements

a. The following are the minimum requirements for security education:

b. Initial Orientation of all DON personnel shall be provided not later than six months upon employment by the DON in the basic principles of security in accordance with reference (d).

c. Initial briefing of personnel with national security eligibility or assignment to sensitive duties at the time of assignment, regarding command security requirements in accordance with reference (b).

d. On-the-job training in specific security requirements for the duties assigned.

e. Annual refresher briefings for personnel with national security eligibility will receive annual refresher security training in accordance with references (b) and (d). Security education should be on a continuing basis, taking into account each person’s duties, experience, and past conduct involving the protection of classified or sensitive information. DoD Components will maintain records of all refresher training conducted.

f. An annual counterintelligence brief will be given to all personnel.

g. Special briefings as circumstances dictate.

h. Debriefing upon termination of access.

5. Initial Orientation

a. All personnel entering employment with DON need to have a basic understanding of what classified information is, and the reasons(s) for its protection, as well as how to protect it.

b. A basic indoctrination for military members is done during training at the time of induction. Civilians will be indoctrinated by the employing command.

5 Enclosure (6)

c. See reference (d) for guidance on initial orientation intent.

6. Initial Briefing

a. All personnel with national security eligibility will be given an initial security briefing per reference (b) before gaining access to classified information. All individuals will execute the appropriate nondisclosure forms in accordance with reference (b). If individuals decline to execute the nondisclosure forms, the DoD Component will withhold classified access and report the refusal to the DoD CAF. CNO and CMC will ensure maintenance of records of all initial briefings.

b. A review of written command security manuals or material is not normally considered adequate for an orientation briefing.

c. The timing and format for orientation will vary, depending on the size of the command. At large commands with a high turnover rate, briefings may be scheduled on a regular basis.