What does the Defense Counterintelligence and Security Agency do in Foreign Military Sales?

A role of the Defense Counterintelligence and Security Agency (DCSA) is to provide government contracting agencies with an assurance that U.S. defense contractors are both eligible to access and properly safeguard any classified information. In fulfilling this obligation, DCSA administers the National Industrial Security Program (NISP) operating on behalf of USD(I&S). DCSA does not develop industrial security policy. DCSA implements industrial security policy established by USD (I&S) for SA and SC programs executed by USD (P).

Prior to a defense contractor being granted access to classified information, the contractor must be sponsored for a facility security clearance (FSC). This sponsorship is based upon a bona fide procurement need, and is submitted to DCSA by a U.S. or foreign government contracting activity or by another contractor already cleared under the NISP. DCSA will conduct a facility clearance survey to determine the contractor’s eligibility for access to classified information, and will review the contractor’s organizational structure and key management personnel, and adjudicate any existing foreign ownership, control, or influence (FOCI). Once a favorable determination is made and a facility clearance is granted, the contractor will execute a security agreement with the USG. The security agreement is a legal contract to abide by the 32 CFR, Part 117, National Industrial Security Program Operating Manual (NISPOM). The NISPOM is a contractually binding document and mandates industrial security practices for contractors.

The DCSA verifies the export of classified articles and technical data against the license or the U.S. company’s empowered official’s certification, assures that secure means of transfer have been arranged, and endorses the license back to the DOS. DCSA oversees plant visits by foreign nationals and ensures that companies have adequate technology control plans in place for long-term foreign national visitors, foreign national employees, and FOCI situations. DCSA ensures appropriate transportation plans are in place for commercial overseas shipments of classified material and approves contractor international hand carriage arrangements. Additionally, DCSA provides security assurances to other governments for U.S. contractor facilities and personnel, and obtains assurances on foreign facilities and personnel. It advises cleared contractors concerning program protection plans, ensures compliance, and trains DoW and contractor personnel on program protection planning. The DCSA provides support to cleared contractors operating overseas, and monitors their compliance with the NISPOM. Finally, DCSA provides counterintelligence (CI) support to cleared contractors, including CI awareness briefings.

The technology control plan (TCP) provides guidance for controlling access to classified and unclassified export controlled information by foreign employees and long-term foreign national visitors of a cleared U.S. contractor’s facility. The TCP explains how the requirements of the ITAR, the EAR, and the NISPOM will be carried out. The TCP is developed by the U.S. contractor, based on the requirements of the ITAR, Section 126.13c, and the NISPOM. The content regarding information access and restrictions may be derived from other documents provided by the USG (for example, the license provisos and the program security instructions or the form DD 254, Contract Security Classification Specification). The DCSA will assist the contractor in developing the TCP and will approve it. A specific TCP may not be required if the company’s internal security operating procedures, e.g., standard practice procedures (SPP) contain the necessary details. If security requirements are partially contained in a document such as an SPP and additional export control procedures are in a TCP, the latter must refer to the applicable portions of the other document.