DSS administers the NISP on behalf of DOD and 24 other agencies through  its Industrial Security Program. DSS’s Industrial Security Program, which  is one of DSS’s three core mission areas, oversees more than 11,000  contractor facilities to assure U.S. government customers that their  classified information is protected. Further, while  industrial security representatives maintain paper files on the quality of  contractor security programs and the types of security violations that  result in compromises of classified information, DSS does not analyze this  information, and the manner in which it is maintained does not lend itself  to such analysis. Nor  does DSS evaluate its performance in terms of the frequency of security  violations and information compromises occurring at contractor facilities. Further, the manner in which DSS maintains records on  facilities’ security programs—geographically dispersed paper-based files— does not lend itself to analysis. DSS Does Not Always Comply with NISP Requirements after a Possible Compromise of Information

Industrial security representatives often failed to determine whether  security violations by facilities resulted in the loss, compromise, or  suspected compromise of classified information or made determinations  that were not in accordance with approved criteria. DSS made no determinations in any of the eight  cases. In one case,  5 months passed before an industrial security representative was able to  notify a government customer that its information was suspected of being  compromised. In such instances, the subcontractor may have to  work with the prime contractor to identify the government customer to  provide the industrial security representative with this information. In one  case we reviewed, a subcontractor made repeated attempts over a 5- month period to obtain the affected government customer’s identity from  the prime contractor. Such delays limit the government customer’s  opportunity to assess the extent of potential damage to national security. Although  DSS’s inability to assess its performance as well as evaluate and make  changes to its oversight does not necessarily mean that contractors are not  fulfilling their responsibilities under the NISP, the effectiveness of DSS’s  oversight is diminished and the assurances it provides to government  customers regarding the protection of their information cannot be relied  on. Recommendations for Executive Action

To enable DSS to evaluate whether its oversight reduces the risk of  information compromise, we recommend that the Secretary of Defense  direct the Director, Defense Security Service, to take the following three  actions:    establish results-oriented performance goals and measures that would  enable DSS to assess the extent to which it is achieving its industrial  security mission,  identify the information that needs to be analyzed to detect systemic  vulnerabilities and identify trends regarding how contractor facilities  protect classified information, and  regularly analyze that information to make informed management  decisions about the use of resources for its oversight activities and  make any needed changes to those activities or procedures to reduce  the risk of information compromise. We also recommend that the Secretary of Defense direct the Director of  DSS to take the following four actions to ensure that appropriate  determinations are made regarding possible information compromises and  that government customers are notified of such situations in a timely  manner:    evaluate industrial security representatives and field office chiefs’  understanding of the criteria for making determinations regarding the  compromise of classified information and revise training and guidance  for representatives and chiefs based on the results of that evaluation,  revise Industrial Security Operating Manual requirements to emphasize  the need to apply the established determinations regarding the  compromise or loss of classified information,    explore the effects of establishing specific time-based criteria in the  Industrial Security Operating Manual for representatives to make  determinations and notify government customers, and    establish mechanisms that create accountability for knowing the  identity of government customers so that industrial security  representatives can readily notify those customers of any loss or  compromise. Therefore, DSS cannot  provide adequate assurances that its oversight ensures the protection of  classified information. To assess adherence to required procedures by DSS after a security  violation and possible compromise of classified information, we used a  case study approach.
Why GAO Did This Study

Department of Defense (DOD) contractors perform numerous services that require access to classified information. With access comes the possibility of compromise, particularly as foreign entities increasingly seek U.S. military technologies. To ensure the protection of classified information, the National Industrial Security Program (NISP) establishes requirements that contractors must meet. In administering the NISP for DOD and 24 other government agencies, DOD's Defense Security Service (DSS) monitors whether 11,000- plus contractor facilities' security programs meet NISP requirements. In response to a Senate report accompanying the National Defense Authorization Act for Fiscal Year 2004, GAO assessed DSS's oversight and examined DSS's actions after possible compromises of classified information.

What GAO Found

DSS cannot provide adequate assurances to government agencies that its oversight of contractor facilities reduces the risk of information compromise. DSS is unable to provide this assurance because its performance goals and measures do not relate directly to the protection of classified information. While DSS maintains files on contractor facilities' security programs and their security violations, it does not analyze this information. Further, the manner in which this information is maintained--geographically dispersed paper-based files--does not lend itself to analysis. By not analyzing information on security violations and how well classified information is being protected across all facilities, DSS cannot identify systemic vulnerabilities and make corrective changes to reduce the risk of information compromise. When a contractor facility reports a violation and the possible compromise of classified information, DSS does not always follow established procedures. After receiving a report of a possible information compromise, DSS is required to determine whether compromise occurred and to notify the affected government agency so it can assess any damage and take actions to mitigate the effects of the suspected compromise, compromise, or loss. However, DSS failed to make determinations in many of the 93 violations GAO reviewed and made inappropriate determinations in others. In 39 of the 93 violations, DSS made no determinations regarding compromise. For 30 of the remaining 54 violations, DSS's determinations were not consistent with established criteria. As a result, government agencies are not being kept informed of possible compromises of their information. In addition, weeks or months can pass before government agencies are notified by DSS of possible information compromises because of difficulties in identifying the affected agencies. In 11 out of 16 instances GAO reviewed, it took DSS more than 30 days to notify the affected agency that its information had been lost or compromised. DSS relies on contractor facilities to identify the affected government agencies, but some facilities cannot readily provide DSS with this information because they are subcontractors that have to obtain the identity of the government agency from the prime contractors. In one case, 5 months passed before a subcontractor facility could provide DSS with the identity of the government agency whose information was suspected of being compromised. Such delays limit the government agencies' opportunity to assess and mitigate any damage from loss or compromise.