Introduction and Reporting Requirements

Maintaining a compliant security program is vital to the University. No one plays a greater role in security than each of you. The success of our program today is based on the everyday security actions taken by all employees.

The purpose of this site is to put some “essential” security rules and regulations at your fingertips. A brief description of subjects such as Need-to-Know, Inspections, Defensive Security, Suspicious Contact Reporting, Terrorism, Visit Authorization Letters, and Travel have been provided for you on this web site's

Reporting Requirements

The information below is provided to assist UAH cleared employees in their responsibility to report certain occurrences. Contact us immediately if you need to report any of these occurrences.

Denise Spiller	Contact by Email
Delores Newton	Contact by Email

Changes in Status

As a cleared employee at UAH you are required to inform the Office of Research Security Administration of any change in your status including a change in name, marital status, or citizenship or termination of employment. Also if the need for access to classified information in the future has been reasonably foreclosed, this must be reported to our office.

Representative of a Foreign Interest

In addition, should you become a representative of a foreign interest or should your status as an RFI materially change, this must be reported to our office.

Foreign Travel

Whenever you travel outside the United States for either business or pleasure you must report this travel to our office in advance of making the trip. We will provide a foreign travel briefing as necessary. Upon your return, you should report to the Facility Security Officer any suspicious contacts that may have occurred during your travel. See below for additional information regarding suspicious contacts.

Adverse Information

A cleared employee is required to report any adverse information that comes to his or her attention regarding another cleared person. These reports must be based on fact. Reports based on rumor or innuendo should not be made. We also suggest that, if any potentially adverse information should arise concerning you, you should contact us to report the circumstances. Self-reporting can go a long way toward mitigating the negative impact of adverse information. All reports of this nature are kept in strictest confidence and are reported only as required in accordance with the attached NISPOM (found here). Reports of this nature may also be submitted via the Defense Hotline.

Suspicious Contacts

Cleared employees are also required to report efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to classified information or to compromise a cleared employee. All contacts by cleared employees with known or suspected intelligence officers from any country or any contact which suggests the employee concerned may be the target of an attempted exploitation by the intelligence services of another country must be reported to our office.

Loss, Compromise, or Suspected Comprise

Any loss, compromise, or suspected compromise of classified information must be reported immediately to this office. If you are unable to locate a classified document that is supposed to be in your custody, do not delay in reporting this matter. Do not assume it will "turn up in a few hours." Report the problem as soon as you become aware of it.

Defense Hotline

While contractor personnel are encouraged to furnish information through established company channels, the Defense Hotline is provided as an unconstrained avenue to report, without fear of reprisal, known or suspected instances of serious security irregularities and infractions concerning contracts, programs, or projects. This alternate means of reporting is provided for your use when you consider it prudent or necessary.

Defense Hotline
The Pentagon
Washington, DC 20301-1900
(800) 424-9098


Reports Submitted to the FBI

A cleared employee must promptly report any information coming to his or her attention concerning actual, probable or possible espionage, sabotage, or subversive activities. Reports of this nature will be immediately forwarded to the Federal Bureau of Investigation (FBI). You may report this information directly to the FBI if you so choose.

Consult your Facility Standard Practice Procedure (SPP) for additional details about your reporting requirements.

Research Security Administration Contact Information

If you have questions regarding Research Security Administration that have not been addressed by this site, please do not hesitate to contact us. We will make every effort to assist you. We hope this contact information will assist you in directing your questions to the appropriate staff member.

Denise K. Spiller - Facility Security Officer
     denise.spiller@email.uah.edu, Phone: (256) 824-6444 Office Location: VBRH E-20

Jerry H. Brown- Information Systems Security Officer
      brownjh@uah.edu, Phone: (256) 824-2627 Office Location: VBRH Annex B-3

Delores Newton - Security Assistant
      dn0003@uah.edu, Phone: (256) 824-6048 Office Location: VBRH E-19

John S. Rogers - Information Systems Security Manager
     rogersjs@uah.edu, Phone: (256) 824-2648 Office Location:VBRH E-23

Need-to-Know

"Need-to-Know" means you need the information to do your job!

Need-to-Know Principle	A Frequent Dilemma!
Need-to-know is one of the most difficult security principles to apply. It violates our inherent social nature and promotes a level of personal responsibility that most of us find difficult to accept. However, failure to accept the responsibility has resulted in some of the most damaging espionage cases in the last decade. 80% of espionage is committed by "insiders". Most of these insiders who committed espionage were fully cleared individuals. In almost every case, insiders gain access to information not pertinent to their job by circumventing the Need-to-Know principle.	In the conduct of your daily duties, you may run into situations which make you question whether and individual has the Need-to-Know certain information you have in your possession. For example, an employee in a higher position than yourself requests access to information you are in possession of but you cannot immediately determine his or her Need-to-Know. Do you grant him or her access based on his or her status? What you should do is ask the individual for the reasons for his or her request for the access. If he or she cannot convince you of his or her Need-to-Know for the information, you should deny the individual access and seek guidance.

Travel Safety

When planning a trip abroad you will need to read the Foreign Travel Related Vulnerability Pamphlet. After you have read the pamphlet, please complete the Notification of Foreign Travel form. This form, along with your itinerary, needs to be forwarded tour office.

The Notification of Foreign Travel form as well as the itinerary can be submitted by campus mail, e-mail, or in person with a scheduled appointment.

When you return to the United States you are required to complete the Notification of Foreign Travel Debriefing form, which needs to be submitted to our office.

This process is required for each trip.

For current travel information you can click on the States Departments Travel Safety Tips Link or the other two links below "Transportation Security Administration (TSA)" and the "Risk During Travel."

Travel Safety Tips

Airport Safety	Terrorism and Travel Abroad
Losing a bag or personal property is easy amid the hubbub of airport activity. The American Society of Travel Agents (ASTA) suggests the following tips: Never leave baggage unattended. Band your luggage together and/or lock zippers. Keep luggage tags turned or folded so your name and address are not visible. Secure buses, limos, and taxis at authorized pick-up points only. Beware of attempts to divert your attention from your belongings. Hand carry portable computers through security check points.	When it comes to terrorism you can not rule anything out and you can not prepare for a random terrorist attack. So what can you do? When traveling abroad check with the State Department for: Public Announcements - temporary conditions overseas. Travel Warnings - what to avoid. Consular Information Sheets. Watch the news for current world events. Check with the security department for info. Get travel advisories from security or travel agents. Seek assistance from U.S. Embassies.
Transportation Security Administration: TSA - Travelers Guide	Risks During Foreign Travel Information: Risks During During Foreign Travel

Visit Authorization Letters

Authorization Request (VAR) Worksheet as far in advance of the planned visit as possible. You may send this worksheet to the Assistant Security Officer or bring it by our office in person. The information in bold print onthe worksheet is mandatory.

Keep in mind that the process may require coordination with a federal agency to obtain Need-to-Know certification before we can send this Visit Authorization Request. This, of course, may slow the process somewhat so please allow us as much time as possible by notifying us as soon as you know the visit is necessary.

Passing A Clearance

Required Information

Clearance are passed in three ways... VALs are used to pass secret and top secret clearances. 10 days advance notice is required to ensure proper processing of the request. PERM CERTS are used to pass requests for SCI access. 3-4 weeks advance notice is required, allowing sufficient time for the government to respond. International Visit Requests - secret and top secret clearances to locations other than a US Government location. 30 days notice is required. None of the above can be hand carried; they must be transmitted security office to security office. This allows the receiving facility the opportunity to approve or disapprove the visit.

10 days prior to the planned trip or meeting, you must complete a VAL for to include... Name of place being visited Name of security officer Security phone and fax number Purpose of visit Contract number or contract name Non security point of contact Dates of visit Your full name and SSN Employees Responsibility It is the employee's responsibility to complete the form and get the information to their local FSO or security assistant for processing.

 

Inspections

The Defensive Security Service (DSS) conducts security assistance visits as cleared facilities and overseas remote facilities - not inspections. The intent of these visits is to help us, the cleared contractor, to maintain a compliant security program which ensures the protection of classified materials.

Preparation

Awareness Questions

Conducts annual security briefings; Mandatory per NISPOM highly recommended to be in person. Conducts travel, courier, overseas, and other briefings as required. Provides all sites with security education posters. Provides all sites with security brochures. Conduct self inspections. Ensures compliance with Government and UAH security policies and procedures. UAH realizes that education and self policing are essential elements of a successful security program. With that in mind, we have prepared this brochure to inform you, the employee - the center of our security program - what a DSS assistance visit is and what you need to know to help us receive a satisfactory rating when the DSS representative visits your facility. We must maintain a compliant security program if we are to maintain out facility clearance. Without a facility clearance we cannot work on classified contracts. Security Inspectables NISPOM UAH SPP Mandatory Annual Briefing Records - Preferably in person. Security info rosters

What contracts are you working on? Which contracts requires a clearance? What percentage of your time is spent on classified work? What is the level of your security clearance? When was your last access to classified information and at what level? Have you ever had access to classified information outside this facility? What procedures did you follow prior to your classified visit at the other facility? Have you ever provided classified materials to another person? If so, did you determine their Need-to-Know and security clearance level? Have you ever been a courier for classified information? What procedures did you follow? Do you generate classified materials? If so how do you protect that information? Is a marking guide available to you? When was the last time you had a security briefing? When was the last time you received security education? What is meant by adverse information? Name three types of adverse information? How would you go about reporting adverse information? Can you describe a security violation? Have you been cited for a security violation? Do you know the combination to any secure safe? If so, where do you keep the combination? Have you ever been approached by anyone asking for classified information? What would you do if someone asked you for classified information? Who is your security officer? What are the NISPOM and SPP? Where are they kept? Do you know where the DD254 for the contracts you work on are kept? If you have questions, please contact your local security office. Denise Spiller: (256) 824-6444 Delores Newton: (256) 824-6048

Personnel Security Clearances

The Office of Research Security Administration assists with all aspects of obtaining, maintaining, and terminating personnel security clearances.  Contact us regarding any questions this web site does not answer in this regard.

Obtaining Your Personnel Security Clearance

If you will be working on a contract issued by a branch of the U.S. government, and it is determined that access to classified information is essential in the performance of your work on that contract, you may be required to obtain a personnel security clearance.  If you have questions about Personnel Security Clearances or questions concerning the process of obtaining Personnel Security Clearance please see Frequently Asked Questions

Initial Security Clearance

If you have never held a personnel security clearance before, or if your previous clearance was terminated more than 24 months ago, we must receive from you the following properly completed items in order to process your request for a personnel security clearance:

• A Personal Data Sheet Front (Fillable PDFs)
• Justification for Personnel Security Clearance (Fillable PDF)
• Proof of U.S. Citizenship: Original Birth Certificate, Certified Copy of a Birth Certificate, or a U.S. Passport
• Electronic Questionnaire for INvestigations Processing (E-QIP), which is the electronic version of the Standard Form 86 (SF 86).
• Authorization for Local Records Check

Electronic Questionnaire for Investigations Processing (e-QIP)

The Electronic Questionnaire for Investigations Processing (e-QIP) is essentially an electronic online version of the Standard Form 86. Once we have received all the items listed above you will be given a copy of the Standard Form 86 and instructions on how to use the e-QIP system. Additional information on the e-QIP system are available on the Office of Personnel Management web site.

What Happens Next

When your clearance is granted, we will contact you to set up an appointment for your initial security briefing.  This briefing is required before any access to classified material may be granted. 

If you have been granted an interim clearance, you will be informed of the restrictions regarding this interim clearance at the time of your briefing appointment.  When your final clearance is later granted, you will be notified.

If the contract under which you are working requires access to special access information such as NATO or CNWDI and your final clearance has been granted, you will be provided the appropriate briefings for access to this additional information during your briefing appointment.

The Standard Form 312

Upon completion of the briefing, you will execute the Classified Information Non-Disclosure Agreement, Standard Form 312 (SF 312).  This will be witnessed by the Facility Security Officer.  A copy of this SF 312 will be retained in our office, and the original will be sent to the Cognizant Security Agency (CSA) for retention.  This form is retained for fifty (50) years beyond the date of your signature.  This should indicate to you the life-long commitment you will be making to protect the classified information to which you have access.

Maintaining Your Personnel Security Clearance

Once you are briefed as a cleared employee, you have certain responsibilities.  These are spelled out for you in detail in the Facility Standard Practice Procedure (SPP), a copy of which was provided to you at your initial security briefing.  These responsibilities include, but are not limited to, certain reporting requirements (under the "Reporting Requirements" tab) , the annual refresher briefing, and a periodic reinvestigation. 

Annual Refresher Briefing

The UAH Office of Research Security is required to provide annual refresher training to all cleared employees.  As a cleared employee, you complete this annual training as one way in which you demonstrate a continuing need for the clearance. This requirement is mandatory. 

Periodic Reinvestigations

As a cleared employee of UAH, you will be asked to complete an updated copy of the Electronic Questionnaire for Investigations Processing (e-QIP) approximately once every five years for a TOP SECRET clearance and once every ten years for a SECRET clearance.  This is a routine periodic reinvestigation.  We will contact you and request that you complete an updated e-QIP within two weeks.  

A copy of your last SF 86 may be of help to you in completing the new e-QIP.  A copy of this form can be provided to you by our office if you do not have a copy already.  

Visit Authorization Requests

For Visit Authorization Requests see "Visit Auth Letters" tab above.

Terminating Employment at UAH and/or Your Personnel Security Clearance

If you terminate employment with UAH or if the classified contract under which your clearance was obtained ends and the likelihood of your obtaining another classified contract in the near future is uncertain, your security clearance must be terminated. Contact us to make an appointment for a debriefing.  If your security clearance is terminated and you are assigned to another contract or obtain different employment for which a clearance is required within 24 months of your original clearance termination date, your clearance can be reinstated quickly.

 

Security Violations

Minor - is an unintentional or negligent failure to comply with security requirements which do not result in compromise, or suspected compromise of classified information.

Major - is a willful disregard of security requirements or a failure to comply with security procedures, regardless of intent, which results in compromise, or suspected compromise of classified information.

Violation of security procedures is a serious matter that can result in irreparable damage to national security and jeopardize UAH's existence as a cleared DOD facility.

Badging for Redstone Arsenal Access

The Office of Research Security Administration will assist you with the process of obtaining an Army contractor badge or a Marshal Space Flight Center contractor badge as necessary if you will require access to Redstone Arsenal/MSFC in the performance of your duties on a contract.  Click the appropriate link above to learn more about the type of badge you may require.  Before your badge card will be signed by your COTR a visit auth letter must be on file for that organization. Please see section: "Visit Auth Letters."

Army Badging Procedures

If, as a requirement of the U.S. Army contract under which you are working, you will require access to Redstone Arsenal facilities on a recurring and continuing basis, you may be eligible to obtain a Personnel Identification Badge.  The Personnel Identification Badge Request Form (SAM Form 1116) may be obtained from our office.  Take proof of ownership and proof of insurance for the vehicle with you when you go to the AMCOM Badging Office to have your badge made.

Common Access Card (CAC)

A common access card is obtained through the new government CVS system. For additional information on CVS please contact your PI for specific contract.

RSIC Forms

RSIC Patron Registration Form (Fillable PDF)

 

 

NASA Badging Procedures

If, as a requirement of the NASA Contract under which you are working,  you will require access to the Marshall Space Flight Center (MSFC) facilities on a recurring and continuing basis (at least three times per week), you may be eligible to obtain a MSFC Contractor Badge.  The Marshall Space Flight Center Contractor Badge/Decal Application form (MSFC Form 1739) may be obtained from our office. Prior to obtaining signature from our office we will need proof of citizenship.

Foreign National Access to MSFC and Redstone Arsenal

Access to Marshall Space Flight Center (MSFC) and Redstone Arsenal by foreign nationals is extremely limited.  Contact us for additional information regarding the circumstances under which such access may be granted.

NASA/MSFC Forms

On 01/01/2008 MSFC implemented an on-line Badge and Remote IT Access Request. This request must be done by contacting our office for an appointment to submit your request. Below are forms that are required to be completed before access or request can be granted.

If your only requirement is access to the NSSTC Building with no MSFC Badge or Remote MSFC IT Access then please complete the form below. Once the form is completed contact our office for signature and approval of the form. For all non-U.S. citizens please see the International Student and Scholar office (ISSO) for signature prior to Research Security Administration office. Our office will be your last stop.

NON U.S. CITIZENS PLEASE COMPLETE THE FOLLOWING: Non U.S. Citizen.

ALL U.S. CITIZENS AND PERMANENT RESIDENTS COMPLETE THE FOLLOWING: U.S. Citizen along with a copy of your birth certificate or passport.

For individuals requiring MSFC Badge, Remote IT Access, or both please complete the following forms and contact our office for an appointment to process this request. Contact Delores Newton (256-824-6048) or Denise Spiller (256-824-6444).

     Complete these 2 forms (along with the appropriate form above):

          - NASA Form 1574 Privacy Act

          - NASA Form 1760 Risk Designation

For individuals who no longer require a NASA badge the following form will need to be completed and taken to Protective Services Department at Building 4312 on Redstone Arsenal along with your NASA badge. A copy of this form once completed should be sent to the UAHuntsville Research Security Administration.

          - MSFC form 383-1 Contractor Employee Clearance Document

 

 

Security DOs and DON'Ts

Maintain a neat and uncluttered work area to prevent classified and proprietary information from being inadvertently disclosed to unauthorized persons.

Report infractions to security.

Get acquainted with UAH security policies and procedures. Know who your security representative is. Never leave classified or proprietary materials unattended. Establish a set routine for securing classified and proprietary materials. USe proper marking for both classified and proprietary materials. Do not discuss classified information on unsecured phones.	Do not discuss proprietary information over phones in open work areas. Ensure the receiver has need to know and, in addition, if the information is classified the receiver must have the appropriate clearance and has been briefed.
The only thing between our adversaries and classified/proprietary information is you and the diligent performance of YOUR SECURITY responsibilities.

For information on our mission. where we failed, and where we have succeeded, read the Security Booklet.

Misc Reporting

The best way for you to help your security program is to participate in your security program. A significant part of the security program is reporting. In addition to reporting adverse information and suspicious activities, you should make reports on the following:

• Non-compliance with published security policies and procedures.
• Blatant disregard for security policies and procedures.
• Unauthorized removal of classified or proprietary information from work.
• Falsification of locations visited during travel.
• Sudden unexplained affluence.
• Falsifying destruction records.
• Careless destruction of proprietary information.
• Frequently working after hours or at unusual times.
• Requests for access to information that is not related to assigned tasks.
• Inquiries to other employees about their work not related to normal tasks.
• Excessive use of photocopying equipment.
• Repeated and continued patterns of performance deterioration.

Remember, protection of classified and proprietary information is in your hands. It is up to you to report violations of security policies and procedures. Contact Denise Spiller or Delores Newton

After all, you are the Center of Security.

Uncleared Personnel

This web site is intended to give personnel who are not cleared an understanding of the responsibilities of safeguarding proprietary and classified information.

We are a contractor cleared by the government to do tasks that may or may not be classified. Everyone who works in this environment should be aware of what a classified document looks like and what precautions to take if there is classified information found unattended.

Need-to-Know

Workplace Awareness

All employees, cleared or unclear, must practice Need-to-Know. "Need-to-Know" is the determination by an authorized holder of information (classified, sensitive, or proprietary) that access to the information is required by another individual to perform official duties. In short, Need-to-know means " the information is required to do the job." Want-to-Know and Need-to-Know are not the same. It is each employee's responsibility to determine Need-to-Know. If in doubt consult with your supervisor or security personnel. Good Need-to-Know procedures limit the amount of information in the work place.

Be aware of visitors in the workplace. If a person seems "Out of Place," challenge them by asking where they are going and who they are visiting. Do not take it for granted that they are "OK" just because they are wearing a badge. All visitors must be escorted while visiting out facility. If you feel something is wrong notify security immediately.

 

 

Sensitive Information

Proprietary Information Proprietary information is that unclassified company information that may be sensitive because of its content and could cause a problem if used by someone for unauthorized purposes. Examples of proprietary information are such things as telephone lists, addresses of personnel, salaries, staffing etc. If in doubt ask yourself, "Could anyone use this information against the company?" If the answer is "yes," protect it! Keep proprietary information locked up when not in use and shred it when it is no longer required.

Spies Yes, even uncleared folks should be alert for spies. Spying is not limited to the collection of classified information. Spies collect all kinds of information: proprietary, sensitive, and classified. Loss of all kinds of information can cause great damage to the company to include, but not limited to: Loss of contracts Loss of revenues Loss of competitive edge Loss of jobs

Security is everyone's responsibility from top management to the receptionist. Any security program can be successful when all employees actively participate.

Security Briefing

A requirement of holding and maintaining your personnel security clearance is to attend an annual "Refresher Training" per the National Industrial Security Program Operating Manual (NISPOM) paragraph 3-107 which states: "We the security office shall provide 'all' cleared employees with some form of security education and training at least annually. Our office will offer several live briefings with a speaker from different organizations such as Federal Bureau of Investigations (FBI) or the Defense Security Service Counter Intelligence Office (DSS)." Please send an acknowledgment, including the title of the video viewed and date viewed, via E-Mail to Denise Spiller or Delores Newton. Thank You, Research Security Office
	Dice 2004 38 Min.			Dice Reloaded 46 Min.
	Careless Keystrokes Can Kill 14 Min.

Export Control

	UAH Export Contol Policy Become Export Control Certified Definition of Terms (EAR) Definition of Terms (ITAR) Department of Commerce/Bureau of Industry and Security Department of Commerce/Commerce Control List (CCL) under Export Administration Regulations (EAR) Department of State/U.S. Munitions List (USML) under International Traffic in Arms Regulations (ITAR) Department of Treasury/Office of Foreign Assets Control (OFAC) list of sanctioned countries Don't Let This Happen To You! Export Administration Regulations (EAR) Database Export Control Laws in the University Setting Letter from Vice President for Research to PIs, Deans, and Center Directors Principal InvestigatorAid in Determining Applicability of Export Control Regulation Questions & Answers Select Agents List US Patriot Act What Researchers Need to Know about Laptops and GPS Equipment (Form)
UAH Home Page | Research Home Page | Organization | Research Funding | Centers & Colleges | Partnerships | Publications News | Office of Intellectual Property | Office of Sponsored Programs | Office of Security Administration Service and Outreach | Mini-Grant Program | Employment | Add to Mailing List | Contact Us
WebMaster Office of Sponsored Programs Von Braun research Hall, Room E-12 University of Alabama in Huntsville Huntsville, AL 35899 (256) 824-6000   (256) 824-6677 (fax) The University of Alabama in Huntsville ©2004 Disclaimer