Defense Counterintelligence and Security Agency

We get a ton of questions about self-reporting, both from applicants and from security officers understanding this.

And this is where the government's efforts to DCSA specifically to make individual reporting by applicants into its own system easier is.

Has come up right with the individual engagement platform, right? Candidates get more kind of information about where they're at in the process.

I know the hope is eventually for individuals to be able to self-report through that system.

I often see people who have multiple clearances and the reporting issue comes up.

They get denied by NSA and then they are in the military.

So they have a clearance through DCSA and maybe they work Also, you know, they're in the guard or the reserves for the military clearance, but they also, their full-time job as a contractor for like DIA or something like that.

You need to report, you know, NSA knows that you've been denied.

Hello and welcome back to the Security Clearance Careers Podcast.

I'm coming off of our Connect Resting Conference, which is such a high, and really security clearances are on the brain for me because we had DCSA come speak about their individual engagement platform, amongst other things.

So we had folks from the intelligence community talking about recruiting, security clearance policy.

So that's something that we cover over on our sister podcast, SCI, Security, Clearance, and Security, which is produced by Federal News Network.

He is a security clearance attorney, former active duty, current reservist.

So has seen a lot of these stories kind of pan out.

and guidance from DCSA, Doha.

So we're going to dive into all things security clearances today, and I'm really excited about it.

Every year, DSCA releases an annual report about their specific companies that are being targeted.

The fiscal 2025 report actually just came out in the last month, and DCSA is saying companies reported about 22,000 what they call suspicious contacts.

I'll define suspicious contacts in a second, but I want to go one step further.

Of those 22,000 suspicious contacts, roughly 2,900 incidents involved foreign entities seeking sensitive information or technology from the cleared industry.

In some cases, foreign entities attempted to circumvent sanctions and compromise cleared employees.

Now, okay, what is a suspicious contact? DCA defined that as roughly an even chance or higher likelihood that the suspicious contacts represent attempts by individuals of all nationalities to, again, illegally access cleared facilities, classified information, classified technology, or compromise cleared employees.

The SCRs submitted to DCSA also include foreign attempts to acquire dual-use, sensitive, or other U.S. technologies and information.

Now, 22,000 sounds like a lot, but let me just give you some context.

What does ITAR require if a breach occurs?

You must notify the Department of State, the Defense Counterintelligence and Security Agency, and relevant authorities.

Timing is key.

How quickly must notifications be sent?

Moving on to incident response.

What does an ITAR specific incident response plan look like?

It must include immediate containment of affected data, segregation from non-controlled data, and a notification chain to the Department of State and the Defense Counterintelligence and Security Agency.

That sounds intense.

DIU doesn't have that mission set.

Our partners at DCSA have that mission set.

So spending months, upwards of a year working with DCSA to look at the process they employ for the FCLs and for the, the personnel vetting, where can I inject AI into that and help them? DIU's helped transition prototypes from, you know, our side into DCSA, so they can do more throughput and, and actually scrub entities for FOCI risks much faster than their analysts were able to do without a tool like that.

Um, ANS, INS, like DIA, SCIF accreditation.

DIU does not accredit SCIFs.

They are the people that are on contract with DIU deploying their amazing emerging tech that our AO will certify risk against.

Um, so that example, it's the immediate folks.

Other examples though, some of the work we highlighted this morning on the panel with, um, the COO from DCSA, Blake Moore- The work that they have done, him and Director Tonan over there have been phenomenal partners.

[laughs] David Kadler was the Director of the Defense Counterintelligence and Security Agency, and the United States government's premier provider of integrated security services.

He led the agency's strategic transformation and maturation in a workforce of 12,000 federal and contract support personnel, uh, worldwide.

Before he was at DCSA, David was the Assistant Secretary General for Intelligence and Security at NATO.

David helped form and coordinate national policy as Deputy Assistant to the President for Regional Affairs within the National Security Council.

I can go on and on.

Include that FSO because chances are they have that skill set to help you out, get it done right the first time, come up with some reasonable quotes so that you can develop a way forward on getting the business opportunity that's coming up.

So as we just shared, technical competency is very important, right? Being an FSO is more than just taking that DCSA FSO course and running with it.

There is so much to learn as an FSO and an FSO should be involved in professional development.

So as you're considering whether your FSO or you as an FSO are a lid or a launch pad, consider technical expertise.

As mentioned earlier, can we meet challenges that are coming up? And also community involvement.

Did you know that, you know, you can get satisfactory to commendable to superior on these DCSA ratings? And one of the major differences is whether or not your FSO or your senior management official or your organization is involved in the community.

So what you might look at is whether or not your FSO is a lid or a launch pad is are they involved in the community? Is your FSO continuing to learn their skill set? You know, even though there may not be a security professional, they should still be plugged into the community and able to get relevant information from DCSA or other security professionals to help them interpret requirements that are upcoming or new information and apply it to their organization.

For example, I know many FSOs who are not security professionals, but they're involved in professional organizations.