ESCC Clearance Handbook_Draft 10-27-14

advertisement
Electricity Subsector Handbook on the
Private Sector Clearance Program for
Critical Infrastructure
Description of the Clearance Nomination Process, and Clearance Holder’s Roles
and Responsibilities
Table of Contents
Executive Summary ...................................................................................................................................... 2
Overview ....................................................................................................................................................... 2
Background ................................................................................................................................................... 2
ESCC Liaison and DHS/IP Relationship .......................................................................................................... 3
PSCP Nomination Process ............................................................................................................................ 4
Identification and Application Phase .................................................................................................... 4
Justification ........................................................................................................................................... 5
Nomination Approval Phase ................................................................................................................. 7
Security Clearance Processing (Pre-Investigation Phase, Part 1 of 2) .................................................. 8
Security Clearance Processing (Investigation Phase, Part 2 of 2) ......................................................... 9
Roles and Responsibilities of Industry Members with Clearances ............................................................. 9
Safeguarding Classified Information ..................................................................................................... 9
Initial and Annual Security Training ...................................................................................................... 9
Reporting Significant Life Events......................................................................................................... 10
Security Violations .............................................................................................................................. 10
Termination of Need to Know............................................................................................................. 11
Deactivation of a Clearance ....................................................................................................................... 12
Use of Clearance for Information Sharing ................................................................................................. 12
Establish Contacts and Attend Briefings ............................................................................................. 12
Visit Authorization Request ................................................................................................................ 12
Developing Unclassified Documents and Tearlines ............................................................................ 13
Building the Trust Relationship Model ............................................................................................... 13
Information Sharing with Federal Partners for Further Intelligence Evaluation ................................ 13
Access to Greater Analytical Capabilities ............................................................................................ 13
Development of Strategic Level Policy................................................................................................ 14
Industry as a Resource to the Federal Government for Incident Response ....................................... 14
Appendix A..………………………………………………………………………………………………………………………………………… A1
DHS PSCP External Fact Sheet… ………………………………………………………………………………………………….… A1
1
Executive Summary
Overview
The Department of Homeland Security (DHS) in coordination with the Electricity Subsector Coordinating
Council (ESCC) have identified the need for industry executives and subject matter experts (SMEs) to
obtain Federal security clearances in order to facilitate access to classified materials and threat
information related to the industry. The DHS Private Sector Clearance Program (PSCP) for Critical
Infrastructure ensures that select critical infrastructure private sector owners, operators, and industry
representatives, specifically those in positions with responsibilities for ensuring the protection, security,
and resilience of their assets, are identified and processed for Secret level clearances1. Granting of
security clearances to select industry representatives facilitates access to classified information to better
enable risk-informed decision making; assists in determining the content, structure, and types of
information most useful to critical infrastructure owners, operators, and industry representatives; and
allows greater participation in the protection of critical infrastructure and the security of the homeland.
Based on a January 30, 2014, meeting between the ESCC and Government Executives, DHS and the ESCC
agreed to develop an industry handbook regarding DHS’ PSCP and the roles and responsibilities of
industry personnel who are granted security clearances. This handbook is meant to be any industry
resource, which describes the PSCP nomination process and provides guidance on the clearance holder’s
roles and responsibilities and means to effectively use their clearances for information sharing purposes.
Background
Ensuring critical infrastructure security and resilience requires ongoing cooperation between
government and the private sector. While the vast majority of information that DHS shares with the
private sector is unclassified, instances occur where the information to be shared is classified, requiring
a Federal security clearance for access. In recognition of this need, the President issued Executive Order
(EO) 13549 in August 2010, directing the establishment of a “Classified National Security Information
Program for State, Local, Tribal, and Private Sector Entities.” The DHS Office of the Chief Security Officer
(OCSO) exercises responsibility for the supervision, oversight, and direction of DHS’ security programs
for personnel security, information security, and the implementation of EO 13549.
In support of OCSO, the DHS Office of Infrastructure Protection (IP) established the PSCP for critical
infrastructure to ensure that select critical infrastructure private sector owners, operators, and industry
representatives may be processed for security clearances. These individuals must have a demonstrated
and foreseeable need to access classified information, be in a leadership, managerial, or executive-level
position, and able to capitalize on the value of the classified information shared.
More recently in February 2013, the President signed EO 13636, Improving Critical Infrastructure
Cybersecurity2, which states “It is the policy of the United States Government to increase the volume,
1
The DHS/IP PSCP issues Secret level clearances. Top Secret level clearances may be issued by the Department of Energy via a
separate program with different selection criteria and justification requirements.
2
https://www.federalregister.gov/articles/2013/02/19/2013-03915/improving-critical-infrastructure-cybersecurity
2
timeliness, and quality of cyber threat information shared with U.S. private sector entities so that these
entities may better protect and defend themselves against cyber threats.” EO 13636 also directed DHS
to expedite processing of security clearances:
“(d) The Secretary, as the Executive Agent for the Classified National Security Information Program
created under Executive Order 13549 of August 18, 2010 (Classified National Security Information
Program for State, Local, Tribal, and Private Sector Entities), shall expedite the processing of security
clearances to appropriate personnel employed by critical infrastructure owners and operators, prioritizing
the critical infrastructure identified in section 9 of this order.”
To ensure implementation of EO 13636, IP has been given the role and responsibility of identifying
appropriate private sector stakeholders who are in a position to assist DHS and interagency partners in
determining the content, structure, and types of information most useful to critical infrastructure
owners and operators in reducing and mitigating cyber risks and to further enhance the DHS
infrastructure security and resilience mission. Security clearances enable selected owners, operators,
and representatives to access classified information and more fully participate in the protection of
critical infrastructure and the security of the homeland.
Industry also recognized the need and urgency for industry SMEs to obtain and use security clearances.
The North American Electric Reliability Corporation’s (NERC) Critical Infrastructure Protection
Committee (CIPC) and the ESCC, under NERC leadership, developed a Personnel Security Clearance Task
Force Report (PSCTF)3 in June 2013. This report proposed a model for identifying, prioritizing, and
nominating the top four candidates within bulk power system organizations for U.S. government
security clearances. The report identified the need to engage more senior executives at electric utilities
in discussions in the classified space.
In response to EO 13636 and the identification of the need for classified discussions with the newly
initiated ESCC leadership and the Energy Government Coordinating Council, DHS representatives, with
industry concurrence, directed the development of a handbook to facilitate the processing of security
clearances for the Electricity Subsector and provide guidance on use of classified information.
The following sections will help PSCP nominees from the Electricity Subsector navigate the application
process, understand their responsibilities for maintaining a clearance, and participate in classified
information sharing sponsored by the U.S. Federal Government.
ESCC Liaison and DHS/IP Relationship
An ESCC Liaison position has been established to help facilitate the efficient processing of security
clearances for the Electricity Subsector. The function of the ESCC Liaison is to communicate on a regular
basis with the IP Sector Outreach and Programs Division (SOPD) Electricity Liaison Team and PSCP
Administrator to assist in the pre-vetting of clearance requests, managing the flow and maintaining
awareness of the status of clearances in process, and as necessary, assist in providing more detailed
justification for the requested clearance and priority of the application. This relationship helps to
provide immediate feedback to those processing applications and provides a focal point for industry
applicants.
3http://www.nerc.com/comm/CIPC/Personnel%20Security%20Clearances%20Task%20Force%20PSCTF%20201/Personnel%20S
ecurity%20Clearances%20Task%20Force%20Report.pdf
3
The ESCC Liaison is selected from the staff of the ESCC Steering Committee companies. Add generic
email once ESCC portal is established (e.g. ESCCLiaison@ESCC).
PSCP Nomination Process
Identification and Application Phase
The first step in the clearance application process is to identify nominees for security clearances.
Through the DHS PSCP (PSCP@hq.dhs.gov) , DHS/IP Sector-Specific Agencies (SSAs)4, Protective Security
Advisors (PSAs), and Sector Liaisons, as well as other Federal officials designated as “Nominators” by IP
may identify and nominate private sector officials who may require access to classified information to
act on or otherwise fulfill an authorized DHS-related function associated with national security. The
DHS/IP Electricity Liaison team (electricityliaisons@hq.dhs.gov ) and PSAs (PSCDOPS@hq.dhs.gov) are
the primary nominators for the Electricity Subsector. Private sector individuals, organizations, or
associations may not initiate nominations or self-nominate, but may recommend an individual for
nomination to an approved Nominator. An eligible nominee must be an employee —not a contractor or
consultant—of the reference utility with a valid need to know.
Once a nominee has been identified, the nominee may assist the Nominator in completing a Critical
Infrastructure Private Sector Clearance Program Request, DHS Form 9014. The completed form is then
forwarded to the DHS/IP Electricity Liaison team (electricityliaisons@hq.dhs.gov) for initial review and
pre-vetting with the ESCC Liaison before being forwarded to the PSCP Administrator for formal
processing.
The pre-vetting process is an informal check and balance process, between the DHS/IP Electricity Liaison
team and the ESCC Liaison, outside of the formal PSCP nomination process. The ESCC Liaison verifies a
nominee’s place of employment, position within the utility or organization, and reviews the
nomination’s justification. Preference during the pre-vetting process is given to senior-level positions of
an organization or a designee of the Chief Executive Officer (CEO) or CSO, SMEs, and members of the
critical information sharing forums and associations listed below.
Note: Applications require utility senior management approval; without this approval,
applications will likely be returned to the nominee for further justification after the first review.
Note: A nominee is strongly encouraged to submit an email or letter on official company
letterhead from their Security Coordinator, Company Senior Manager, or Chief Security Officer
(CSO) approving the nominee for a security clearance. This correspondence should include the
name of the utility and the senior manager’s name, contact number, and email address.
DHS-sponsored clearances are nominally granted at the Secret level to industry participants who meet
certain criteria and have successfully completed the DHS clearance process. A nominee who cannot be
4
SSA nominations are only for select individuals connected with a DHS mission related activity. Each Federal agency is
responsible for the issuance of security clearances and access to classified information associated with their respective national
security mission activities. As “Nominators,” SSAs are proposing candidates who are associated with the DHS partnership
framework and are critical infrastructure owners and operators, sector leadership (i.e., Sector Coordinating Council members),
or SMEs identified by DHS to assist in analyzing critical infrastructure and national security-related information to further
enhance the DHS infrastructure protection mission.
4
verified as electric utility employee or does not have a valid need for access to classified information
may be denied by DHS/IP at this step.
Justification
Clearances are not granted to every nominee. The Nominator must identify a compelling need for
access to classified information and the nominee’s ability to access classified materials, as well as
articulate the need for DHS to share classified information with the individual. A Nominator may ask a
nominee to assist in completing the justification portion of the DHS Form 9014. The first line asks for
the nominee’s position within the company. The second line asks for the nominee’s job responsibilities.
The third line asks for any relevant association memberships (Sector Coordinating Council [SCC], ISAC,
etc.) to which the nominee belongs. The fourth line asks the nominee to identify the sector with which
the nominee is affiliated. If a nominee belongs to an entity with multiple sector affiliations such as a
combined electric, gas, and water utility, the sector in which the nominee predominately works should
be designated. Nominees from large utilities with multiple clearance holders should reference the NERC
PSCTF Report5. For cases where the number of clearance holders requested exceeds the number
recommended by the NERC PSCTF model, additional detailed justification and validation from the utility
or the ESCC Liaison may be required in order to process the request.
Below is a list of relevant association memberships that may be entered into the third line of the
application (DHS Form 9014: Subject’s association memberships include):
 SCC members;
 Recognized SME within the SCC;
 Member of a critical infrastructure advisory body including the National Infrastructure Advisory
Council; National Security Telecommunications Advisory Committee; Enduring Security
Framework; Unified Coordination Group; Threat Engagement Working Group; Critical
Infrastructure Cross Sector Council;
 Corporate CEO or CSO, or their equivalent or designated Cyber and Physical representative for
nationally critical assets or systems (as identified under the EO 13636 or National Critical
Infrastructure Prioritization Program);
o Nominee would use the information to influence organizational behavior, make risk
management decisions, or make/influence risk management investments;
 Specific staff who support a nationally critical asset and require classified information to conduct
critical security and resilience functions (e.g., security managers and intelligence/risk analysts);
 Identified SMEs in critical infrastructure security and resilience;
 A SME at a trade association within the Electricity Subsector; or
 National Cybersecurity and Communications Integration Center (NCCIC), National Infrastructure
Coordinating Center Watch, and/or Critical Infrastructure Crisis Action Team designated private
sector representative with responsibilities to access classified information as part of these
organizations’ operations.
To help the ESCC Liaison better communicate the nomination’s priority, nominees should ensure the
functional area and SME skill set they represent are clearly stated in the remarks section of the DHS
Form 9014.
5http://www.nerc.com/comm/CIPC/Personnel%20Security%20Clearances%20Task%20Force%20PSCTF%20201/Personnel%20S
ecurity%20Clearances%20Task%20Force%20Report.pd
5

Membership in Electricity Subsector leadership or technical committees will help justify the
nominee’s need to know and potential candidacy for a clearance.
o NERC CIPC members
o ESCC members
o Regional CIPC members
o SMEs on working groups or task forces needing clearances
o Other Electric utility employees identified by using the NERC PSCTF report matrix

Identification of functional registration type in the application will help to prioritize any
applications in the queue.
o Reliability Coordinator
o Balancing Authority
o Transmission Owner
o Transmission Operator
o Generation Owner
o Generation Operator
o Distribution Provider

Providing as much detail in the application will help justify the nomination. The nominee should
identify areas of expertise.
o Executives – Corporate Officers, Directors, and Senior Managers of an organization who
have comprehensive enterprise security and risk management responsibilities. These
executives should have decision making authority in terms of bulk power system
operations and be in a position to effect change, authorize expenditures, exercise
formal policy approval, accept fiduciary responsibility, and be available for immediate
contact. These qualifications are critical when actionable intelligence must be acted on
throughout an organization, but the details of which cannot be shared outside of
classified spaces.
o Cybersecurity SMEs – Individuals who understand the organization’s cyber systems and
how they interact with various functional areas, both vertically and horizontally, and
have the skills, authority, and focus to include the enterprise system and functional
subsystems, e.g., Corporate Networks, Energy Management System/Supervisory Control
and Data Acquisition system (EMS/SCADA), Generation/Transmission Control, and
Market Management Systems linked to EMS/SCADA.
o Physical Security SMEs – Individuals who understand the organization’s physical
systems, and have the skills, authority, and focus to include the enterprise system and
functional subsystems, e.g., CSO, Directors of Security Operations Centers, and
Managers of physical security guard forces.
o Operational SMEs – Individuals who are able to affect real time operations and make
decisions on operating posture based on emerging threat information.
6
Example DHS Form 9014:
Nomination Approval Phase
The PSCP Administrator will vet the nominee’s information against the criteria for participation in the
PSCP. Incomplete requests or requests requiring further justification will be returned to the Nominator.
After review by the PSCP Administrator, the application is routed to the IP Office of the Assistant
Secretary (OAS) for review and nomination approval. Upon approval, the forms are routed to the IP
Security Office for further processing.
If the application is returned, the Nominator and/or ESCC Liaison will provide further justification for the
clearance nomination and resubmit to the PSCP Administrator. This added step will add time to the
application process; therefore, nominees should ensure they provide as much detail as possible in the
initial application.
7
Security Clearance Processing (Pre-Investigation Phase, Part 1 of 2)
The IP Security Office will contact the nominee directly to collect sensitive Personal Identifying
Information (PII) needed to begin the security clearance process (e.g., Date of birth, Place of birth, and
Social Security Number). PII should not be transmitted in clear text via email over the Internet. The IP
Security Office will provide instructions on how to transmit any required PII.
Note: Nominees should whitelist the DHS.gov domain name so the email notification for the
request to collect PII is delivered in a timely manner. If nominees have not heard from DHS or
the ESCC Liaison after three to four weeks of filing the DHS 9014 form, they should contact the
ESCC Liaison (e.g. ESCCLiaison@ESCC) to help facilitate communicating the PII.
Once the nominee’s PII is obtained, the IP Security Office will enter the information into “eQIP”6, a
secure government portal for investigation processing. Once IP Security has initiated the nominee in
eQIP, the nominee will be able to access the eQIP site and complete the required online security
questionnaire.7 Additionally, the IP Security Office will email a forms package to the nominee with
instructions on how to proceed. The forms package includes a set of security forms and instructions on
how to obtain fingerprints locally if within the National Capital Region (NCR). Individuals that are not
located in the NCR will be sent, via U.S. Postal Service mail, fingerprint cards along with instructions.
Once the nominee completes the eQIP process and submits all required forms, signature pages, and
Electronic Questionnaire for Investigation Process (eQIP) is the name of the U.S. Government system used to collect and
manage clearance applicant information.
7 Nominees may download a copy of the security questionnaire, Standard Form 86 from
(http://www.opm.gov/forms/pdf_fill/SF86.pdf) prior to being granted access to eQIP in order to have the required information
readily available.
6
8
fingerprint cards, the IP Security Office will submit the completed application package to OCSO for
further security clearance processing.
Note: The nominee must complete his or her security questionnaire in eQIP within 45 days of
initiation, or he or she will be inactivated and may be removed from consideration. If this
situation occurs, the nominee should contact the Nominator to request a re-nomination into the
program.
Security Clearance Processing (Investigation Phase, Part 2 of 2)
OCSO will initiate a background investigation8, conduct the adjudication, and make a determination
concerning the nominee’s eligibility for a security clearance and access to classified information9. Upon
initiation of the investigation process, DHS may grant an interim Secret clearance for exceptional
reasons or circumstances to expedite access to classified information when there is a mission
requirement. Interim Secret clearances are typically granted in seven days following a favorable
determination from OCSO. The average timeline to complete the full security clearance process
(investigation, adjudication, and determination) is approximately two-to-three months, but may take
longer depending on each nominee’s circumstances. IP Security will notify the nominee via email of the
decision to grant or deny the security clearance.
Roles and Responsibilities of Industry Members with Clearances
Each individual who has obtained a security clearance through the PSCP is required to perform certain
actions to maintain his or her clearance. These actions include:
Non-Disclosure Agreements
Upon receipt of a favorable personnel clearance determination and before the security clearance is
granted, each individual is responsible for completing the following forms and promptly returning to
OCSO and IP Security:
 Complete a Classified Information Nondisclosure Agreement (SF-312)
 Complete a DHS Non-Disclosure Agreement (DHS Form 11000-6)
 Review Statement of Understanding Relative to the Protection of Classified National Security
Information and sign letter of acknowledgement
Safeguarding Classified Information
A cleared individual is responsible for safeguarding all classified information that he/she has accessed in
accordance with the terms of the SF-312 (Classified Information Non-Disclosure Agreement), the
“Statement of Understanding Relative to the Protection of Classified National Security Information,” and
other applicable Federal standards.
Initial and Annual Security Training
To maintain a clearance, the cleared individual must complete both initial and annual refresher security
training. Upon notification of a favorable clearance determination, the cleared individual will be
provided instructions on how to complete his or her initial security training. The annual refresher
security training is administered by the PSCP Administrator, who will notify clearance holders via email
8
OPM Frequency Asked Questions regarding investigations:
ihttp://www.opm.gov/faqs/topic/investigate/index.aspx?cid=56d6e92e-6e27-4b6a-8969-4a7a1bfba76d
9
For some nominees, issuing a clearance may require a Foreign Ownership, Control or Influence determination first.
9
when the training is due. PSCP participants should notify the DHS/IP PSCP Administrator
(PSCP@hq.dh.gov ) or the Electricity Liaison team (electricityliaisons@hq.dhs.gov) of any change to their
email address so that it can be updated.
Reporting Significant Life Events
A cleared individual must report to IP Security Office (ipsecurity@hq.dhs.gov) any information or
significant life events that may have a bearing on continued eligibility for access to classified
information. A list of reportable events is included in the training briefing given to all individuals cleared
through the PSCP, and includes any change of the following:
 Name
 Marital Status
 Citizenship changes
 Adverse information, such as
o Recent arrests, criminal charges (including charges that are dismissed), citations, tickets,
summons or detentions by Federal, State, or other law enforcement authorities for
violations of law within or outside of the U.S. (Traffic violations for which a fine of up to
$300 was imposed need not be reported, unless the violation was alcohol or drugrelated)
o Alcohol or drug related problems
o Personal or business-related bankruptcy filing
 Loss or compromise of classified information
 Any unofficial contact with foreign nationals
 If a member of the individual’s immediate family is a citizen or resident of a foreign country
 Any potential employment or service with a foreign government, organization, entity or interest
Security Violations
If a cleared individual is aware of any security violation he/she or another cleared individual have
committed, then he/she shall promptly report the violation to IP Security (ipsecurity@hq.dhs.gov).
Report of Foreign Travel
All foreign travel, both business and leisure, should be reported in advance of departure. The clearance
holder should contact IP Security (ipsecurity@hq.dhs.gov) to obtain a Notification of Foreign Travel
Form. Once completed, the form should be forwarded to IP Security for processing. For foreign travel
not reported in advance, the form should still be completed and submitted to IP Security. The DHS
Office of Security may have additional questions since the travel was not reported in advance. IP
Security will advise the traveler if additional information is required.
10
Termination of Need to Know
Upon leaving his/her position of employment and/or no longer retaining a need to know with regards to
classified information, the cleared individual shall contact IP Security (ipsecurity@hq.dhs.gov) and the
PSCP Administrator (PSCP@hq.dhs.gov) to commence the debriefing process and removal from the
program.
11
Deactivation of a Clearance
DHS will deactivate a clearance for any of the following reasons:
 Failure to complete annual security refresher training
 Change in employment (a new DHS Form 9014 must be submitted to reactivate)
 Change in citizenship
 No access to classified information for more than one (1) year
Use of Clearance for Information Sharing
Ensuring our nation’s critical infrastructure remains secure and resilient requires ongoing cooperation
between Government and the private sector. The PSCP enables selected industry representatives to
access classified information and more fully participate with government partners in the protection of
critical infrastructure and the security of the homeland.
However, cleared individuals may not always know how to share the information they receive during a
classified briefing, or how to optimize use of their clearance to the benefit of their organization, the
public-private partnership, or other sector partners. The following guidance will help cleared industry
members effectively use their clearances for information sharing purposes.
Establish Contacts and Attend Briefings
Cleared individuals should reach out to their local PSAs, Fusion Centers (https://nfcausa.org/), Federal
Bureau of Investigation Field Offices, Secret Service Offices, and other Federal partners to introduce
themselves and to extend an offer to provide subject matter expertise as required. In doing so, the
individual strengthens the public-private partnership, becomes aware of points of contact at secured
facilities within his or her local area, and gains knowledge of when a classified meeting or briefing of
interest may be scheduled.
Additionally, cleared individuals should coordinate with their local partners and the IP Security Office to
“perm-cert” their clearances for the briefing facilities in their areas.10 Having one’s clearance already in
place at a local briefing facility, where secure phone and email exchanges can occur, will expedite the
flow of critical information when the need arises.
Visit Authorization Request
Invitation to a classified meeting may require a clearance holder to have his or her security clearance
information passed to the sponsoring organization for validation. An individual’s security clearance
information can only be passed from one security office to another. A clearance holder can request his
or her clearance information be passed by contacting IP Security (ipsecurity@hq.dhs.gov) to obtain a
DHS Personnel Visit Authorization Request Form (DHS Form 11000-7). Once completed, the form should
be forwarded to IP Security for processing.
Permanent Certification, or “perm-cert,” allows a person who is cleared through one U.S. Federal Department or Agency to
have his/her clearance passed to another U.S. Federal Department or Agency for a period of up to one year.
10
12
Example DHS Form 11000-7
Developing Unclassified Documents and Tearlines
A cleared individual can add value to classified discussions when development of an unclassified
document or tearline is required. As an industry representative, his or her subject matter expertise may
be able to assist government partners and intelligence assets in better understanding the implications of
threat information received and how best to express that information to a larger audience or industry
partners. Examples of products that benefit from the public-private partnership are the United States
Computer Emergency Readiness Team bulletins and Electricity Sector Information Sharing and Analysis
Center (ES-ISAC) Alerts that indicate a need for action, but do not reveal specific classified information.
These reports may be based on classified intelligence, but only include details at the unclassified or
Official Use Only level.
Building the Trust Relationship Model
Utility employees granted security clearances are expected to integrate their threat analysis efforts with
the ES-ISAC and other information sharing forums to maximize the usefulness of the classified
information. Producing unclassified industry guidance and alerts helps industry develop situational
awareness based on the trust of the content coming from industry SMEs.
Information Sharing with Federal Partners for Further Intelligence Evaluation
The electricity industry has begun to engage with the Federal Government to share real time data flows
to identify malicious code. The bidirectional sharing of information can help the federal partners
evaluate intelligence data and provide feedback on industry issues of concern. Some of this intelligence
evaluation is done in the classified space.
Access to Greater Analytical Capabilities
Individuals cleared at the appropriate level may also have greater awareness of, and potentially access
to, tools and technologies that will enhance the information sharing process. One example is the
Cybersecurity Risk Information Sharing Program (CRISP)11. The Department of Energy and industry are
11
CRISP is a public-private partnership, co-funded by the U.S. Department of Energy's Office of Electricity Delivery and Energy
Reliability and industry. The purpose of CRISP is to collaborate with energy sector partners to facilitate the timely bi-directional
13
integrating the CRISP technology and analytics capability into the ES-ISAC and strategic utility locations
to help determine threats, vulnerabilities, trends, and impacts to the Electricity Subsector and
interdependent critical infrastructure sectors. This effort includes integration into DHS’ NCCIC. Another
example is the National Cyber Investigative Joint Task Force and its analytic capabilities. Understanding
these programs and capabilities strengthens the public-private partnership through classified
information sharing, as SMEs work together to identify cyber-related threat actors, compromises,
exploited tools, and vulnerabilities relevant to the electric industry.
Development of Strategic Level Policy
Cleared individuals can participate in various national and regional-level working groups that focus on
the security and resilience of critical infrastructure in the classified space. Participating in these working
groups, along with effective use of one’s subject matter expertise, can assist in developing sound
strategic-level policy and inform future initiatives between government and industry. The joint
meetings between the ESCC and Government Executives are a good example of this type of
collaboration.
Industry as a Resource to the Federal Government for Incident Response
Electricity industry representatives have provided valuable assistance during national incident response
operations. Having industry SMEs with clearances allow government partners to grant access to various
operation centers and/or request their assistance during various classified incident-related conference
calls.
sharing of unclassified and classified threat information and develop situational awareness tools to enhance the sector's ability
to identify, prioritize, and coordinate the protection of their critical infrastructure and key resources.
14
Appendix A - DHS PSCP External Fact Sheet
Private Sector Clearance
Program for Critical
Infrastructure
Ensuring critical infrastructure security and resilience requires ongoing cooperation between Government
and the private sector. While the vast majority of information that DHS shares with the private sector is
unclassified, there will be instances where the information to be shared will be classified, requiring a
Federal security clearance for access. In recognition of this need, the President issued Executive Order (EO)
13549, directing the establishment of a “Classified National Security Information Program for State, Local,
Tribal, and Private Sector Entities.” The Office of the Chief Security Officer (OCSO) exercises responsibility
for the supervision, oversight, and direction of the Department’s security programs for personnel security
and information security, among others and the implementation of EO 13549.
In support of OCSO, the Office of Infrastructure Protection (IP) has established the Private Sector
Clearance Program (PSCP) for critical infrastructure to ensure that select critical infrastructure private
sector owners, operators, and industry representatives—specifically those who have a demonstrated and
foreseeable
need
to
access
classified
information—are
in leadership, managerial, or executive level positions and are in a
Eligibility criteria for PSCP are provided in
position to capitalize on the value of the classified information
Executive Order (EO) 13549 Section 5.g:
shared are processed for clearances. Security clearances enable
“[P]ersons outside government who are critically
selected owners, operators, and representatives to access classified
involved in ensuring that public and private
information and more fully participate in the protection of critical
preparedness and response efforts are integrated
infrastructure and the security of the homeland.
as part of the Nation’s Critical Infrastructure or
Sector-specific agencies (SSAs)12, DHS IP Protective Security
Key Resources (CIKR), including:
Advisors (PSAs) and Sector Liaisons, and other Federal officials

Corporate owners and operators determined
designated by IP (“Nominators”) identify and nominate private
by the Secretary of Homeland Security to be
sector officials who require access to classified information to act
part of the CIKR
on or otherwise fulfill an authorized DHS-related function

Subject matter experts selected to assist the
associated with national security. The justification for applicants
Federal or State CIKR
nominated for a security clearance should be clear, concise, and

Personnel serving in specific leadership
positions of CIKR coordination, operations,
meet the criteria identified in the eligibility call-out box on this
and oversight;
page. Private sector individuals, organizations, or associations

Employees of corporate entities relating to
may not initiate nominations.

Subject Criteria
The application review process will be based on factors such as:
•
The private sector official (nominee) is in a position to
appropriately
support
the
protection
of
critical
the protection of CIKR
Other entities involved in public safety or
related activities that support the security
of our communities and the nation, but who
are not otherwise eligible for the granting of
a personnel security clearance pursuant to
E.O. 12829, as amended.”
SSA nominations are only for select individuals connected with a DHS mission related activity. Each Federal agency is responsible for
the issuance of security clearances and access to classified information associated with their respective national security mission
activities. As “Nominators” SSAs are proposing candidates which are associated with the DHS partnership framework and are critical
infrastructure owners and operators, sector leadership (i.e., Sector Coordinating Council members), or subject matter experts (SME)
identified by DHS to assist in analyzing critical infrastructure and national security-related information to further enhance DHS’s
infrastructure protection mission.
12
A-1
infrastructure and the security of the homeland.
•
DHS has a demonstrated need to share classified information with an individual.
•
The sponsored nominee requires access to classified information to appropriately represent a
critical infrastructure or to advise the Department on the relevance of the classified information.
•
The nominee must demonstrate willingness to access classified information, such as by attending DHS
classified briefings, or to participate at State or local fusion centers or other Federal facilities where
classified information is available.
•
The nominee is able and willing to participate in the security clearance process, complete required
training, and diligently respond to requests for information as needed .
•
The nominee meets Executive Order 13549 Section 5.g eligibility criteria.
Frequently Asked Questions
What is required in the justification for an application?
The justification should explain the nominee’s role and responsibility in relation to the critical infrastructure
mission. Justifications should include which EO 13549 criteria the nominee meets and should verify that the
nominee’s access to classified material meets the stated criteria. Nominators with a knowledgeable
understanding of nominees, their organization, and their relationship to the DHS critical infrastructure
mission should write the justifications.
Who sees the nominee’s sensitive Personally Identifiable Information?
The only persons authorized to see the applicant’s nominee’s sensitive Personally Identifiable Information
(PII) are the IP Security personnel and authorized security specialists in the OCSO Personnel Security
Division.
What is the purpose of a background investigation?
The scope of the investigation varies with the level of the sponsored security clearance. It is designed to allow
the Government to assess whether a nominee is trustworthy and reliable to be granted access to classified
information. Nominees must meet certain criteria relating to their honesty, character, integrity, reliability,
judgment,
mental
health,
and
potential
for
foreign
influence.
What can an applicant expect during the investigation process?
DHS will receive and review required documents for completeness and accuracy. Credit and criminal history
checks will be conducted on all nominees. 13 Interviews will be conducted of persons who know the nominee
and of any spouse divorced within the past 10 years. Additional interviews will be conducted, as needed, to
resolve any inconsistencies. Residences will be confirmed, neighbors interviewed, and public records queried
for information about bankruptcies, divorces, and criminal or civil litigation. The background investigation
may be expanded if a nominee has resided abroad or has a history of mental disorders or drug or alcohol
abuse.
The
nominee
will
have
a
personal
interview.
What can a nominee do to keep the time needed to perform the background investigation as short as possible?
 Provide accurate and complete information on the security questionnaire
13 For a Top Secret security clearance, the background investigation includes more detailed record checks which verify birth, education,
employment history, and military history.
A-2
 Be as specific as possible on general entries, listing employer(s), location(s), and dates assigned to
each location and indicating all dates, including breaks in employment within the investigation
scope
 List any Federal security clearances previously held or any currently held clearance, for example,
as a military reservist. If known, list investigation type, investigation date, clearance type granted,
by which agency, and the clearance date.
What is involved in the adjudication process?
The adjudication process involves an evaluation of pertinent data contained in a personnel security
investigation as well as any other relevant information to determine whether an individual is eligible for
access to classified information. Any doubt concerning personnel being considered for access to classified
information will be resolved in favor of the national security. The adjudication process is where a final
determination is made whether to grant an individual access to classified information.
What will happen if the nominee declines to provide some of this information?
The background investigation is a condition for a clearance. Providing the information is voluntary, but
nominees will not be considered for a security clearance if they choose not to provide the required
information.
What is the difference between an interim and a full security clearance?
Interim clearances are issued for exceptional reasons or circumstances to support the NPPD mission and to
expedite access to classified information when there is a mission requirement. Generally, there is no
difference between an interim and a full security clearance as it relates to access to classified information.
However, an interim clearance may preclude the use of certain classified equipment and may prevent access
to classified information that is originated from an intelligence agency until a final is granted. When interim
access is granted, the background investigation must be expedited, and if unfavorable information is
developed at any time, the interim security clearance may be withdrawn. DHS does not issue interim Top
Secret clearances.
How long does the clearance granting process take?
Each application is unique, and factors such as travel, foreign contacts, or multiple residences may influence
the investigation and adjudication timelines. The nominee may be contacted for completion of additional
security paperwork, and the investigation cannot proceed until all applicant information is received. Upon
initiation of the investigation process, interim Secret clearances are typically granted in 7 days. The average
timeline to complete the investigation, adjudication, and receive an approved Secret clearance is estimated to
be 2–3 months.
If a nominee chooses to withdraw from the security clearance process, will they still be informed about
counterterrorism and threat related issues important to their sector?
DHS maintains several robust information sharing programs and strives to make information unclassified as
often as possible. Visit DHS.gov/Critical-Infrastructure to learn about the information-sharing mechanisms
available.
How can less favorable information (i.e. credit history) in a nominee’s background affect the investigation?
Less favorable information will not necessarily disqualify a candidate from receiving a clearance, but
resolution of the issues will take additional time. If the issues are significant, they may prevent a clearance
from being approved.
A-3
The Private Sector Clearance Program Process
Identify Subject
• SSAs, PSAs, DHS IP
Sector Liaisons and other
Federal officials
designated by DHS IP
(“Nominators”) identify
qualified individuals who
require access to
classified information
based on the criteria in
EO 13549 and their daily
work with industry
(“Subjects”). See footnote
1.
Submit Application
Approve & Initiate
Formal Application
• Nominators work with
nominees to complete and
sign the DHS Form 9014,
with complete justification,
and submit to the PSCP
Administrator.
• The PSCP Administrator
reviews the submitted
forms for completeness,
eligibility, and justification.
• The PSCP Administrator
routes the form to the
Office of the Assistant
Secretary (OAS) for
review, approval, and
signature.
• Upon approval and
signature, the forms are
routed to the IP Security
Office.
Security Application
Preparation
Security Clearance
Processing
Annual Clearance
Training
• The IP Security Office
contacts the nominee to
obtain additional
information to initiate the
formal application.
 Once nominee completes
the application and
submits information, IP
Security submits
completed package to
OCSO
• OCSO initiates the
investigation,
adjudication, and
subsequent determination
of eligibility for access to
classified information, in
conformity with the
provisions of E.O. 12968,
as amended.
• Clearance holders must
complete an annual
security refresher course.
• Clearance holders must
notify IP Security and the
PSCP Administrator of
any significant life
changes or events,
including a change in
company.
• DHS has the right to
deactivate a clearance at
any time.
Contact Information
All questions should be directed to the PSCP Administrator at PSCP@hq.dhs.gov.
A-4
Download