How can you improve document control of classified information?
If your company holds a Facility Clearance (FCL), good document control is a key part of maintaining your clearance and preserving national security. The standards for how facilities need to manage their document control can be found in 32 CFR part 117, NISPOM. Responsibility for maintaining good document control falls on the facility’s Facility Security Officer (FSO). However, it’s a team effort to maintain this security, and doing so may require extra training and encouragement to make sure nothing is overlooked.
Any information marked as classified needs to be appropriately safeguarded. This includes destruction of physical classified material through shredding, burning or melting, proper storage in a GSA-approved container and completing standard forms (SF) 701 and 702 at the end of each day.
What is good document control?
The SF 701, or Activity Security Checklist, requires you to develop a checklist based on the unique attributes of the room where classified information is stored and make sure that the area is clear and properly secured. For example, you may check off that all the doors are locked, pieces of classified material have been removed from their devices and stored and all desks and trash cans are free of any classified material. The FSO will complete this checklist each night, though if they are unable to complete this duty due to illness, vacation or other absences, they can appoint other cleared employees to complete the checklist in their place. The FSO will appoint these personnel in a formal letter to the Senior Management Official and Industrial Security Representative (IS Rep).
For the SF 702, or Security Container Check Sheet, the FSO will initial this form each night to indicate they have double checked that the container where classified information is stored is locked. This form must also be filled out by cleared personnel any time they open the container to access the materials inside.
If your facility has a guard posted 24/7 in the area where classified material is stored or if the facility is in constant operation, you don’t have to complete these forms. These forms are only necessary if there are times when the facility is unoccupied. You’ll hold onto these logs for one year, and your IS Rep may request them for an investigation, or they may be referenced if any information goes missing.
When getting rid of classified information, it’s important to make sure they’re destroyed properly so that no one would be able to recover it. For physical documents, this can be accomplished through shredding or burning the document to render it unreadable. Some pieces of classified material, like laptops, require incineration. Electronic media can be destroyed through overwriting the data, using a magnetic pulse to permanently erase data in a process known as degaussing, or a physical destruction of the devices the information is held on.
When finishing for the day, make sure any classified information you have out is properly stored. Double check that the GSA-approved container is locked when you leave. If you come in the next day and the container is open, you will have to report that to your IS Rep.
Document Control Pitfalls and Solutions
One common issue facilities run into is FSOs not completing the SF 701 or SF 702 at the end of the day. This can put both your facility security and FCL at risk if it continues, so find a way that works for you or your FSO to ensure it’s completed. There are simple ways to do this, like a well-placed written reminder or calendar updates set to the end of the day. However, if you’re someone who can train your brain to overlook those, consider adding an audio component, like a motion sensor that plays a verbal reminder when you exit a certain room. Ensure there is clear direction for who is responsible to complete these forms in case of your absence.
Another issue facilities run into is not having an Emergency Action Plan (EAP) or Catastrophic Failure Plan (CFP). These documents cover what your facility’s plans are for protecting classified information in case of emergency. The EAP includes plans for more likely emergencies, like a fire, extended power loss or medical emergency. What you include in this document may vary depending on the possible emergencies or natural disasters that are more common in your area. The CFP covers all types of emergencies, including those that may be highly unlikely. For example, facilities in Texas may not have expected to have to plan for an ice storm but including it in their CFP meant there was a plan in place when it did happen. You’ll cover earthquakes, volcanos, terrorist actions and more in this plan.
When an emergency does occur, employees knowing these plans can make a big difference in safeguarding, but they are sometimes overlooked. Make sure your office has a plan ready to go and personnel have access to it. While there isn’t always time to safeguard, like not having time to put away documents during a fire, this plan can potentially save you in emergency scenarios.
On rare occasions, you may discover you’re in possession of classified material that isn’t properly marked. If this happens, you will treat it as you would other classified information, making sure it’s properly stored, and report it to your IS Rep. They will give you further guidance of how to handle it.
Beyond this, make sure your employees know to practice good document control. Consider putting up security posters that can help serve as reminders or taking a more fun approach with your trainings to increase personnel engagement.
If you’re an FSO feeling overwhelmed by the mountain of responsibilities you’re expected to complete, Adamo’s FSO support services can make your day-to-day work easier. Trust us with your Personnel Clearances (PCLs), trainings and more and see the difference Adamo can make in your facility!
