There are a lot of legal concerns in industrial security. When it comes to incident reports, it’s important to understand how to protect yourself and your organization from future legal ramifications. Tod Stephens, attorney with the law firm Armstrong Teasdale, walked through key ways to avoid legal issues after incident reports are submitted to DCSA during a session at this week’s NCMS Seminar, an annual gathering of security professionals. Stephens encouraged security officers to pay attention to more than the DD-254, and know what is in their organization’s contracts.
INCIDENT REPORTS AND AVOIDING LAWSUITS
Write the actual facts in incident reports, Stephens emphasizes. Start your sentence with the source of the information. That insulates you from murky language. Don’t write down things as if they happened if you weren’t there. Stephens said, “Proper sentence structure corrects 90% of the problems with incident reports.”
Fraud, trade secrets, intellectual property – all of those words also have legal definitions, so be careful of them in your incident reports – despite use of those terms in your security documentation. An incident report can become a legal document and should be considered as one. If you add extra names into the report, they can be called in court. If VROC needs more information, they can send you a request later.
Write the incident reports without thinking through all the different rules – get the information out on paper, but you have to edit them and remove what doesn’t need to be there, says Stephens. Consider all the questions on the incident report that could come back to you in a court setting, and decide if it’s violating any rules or has a legal connotation, he notes. Make sure you review rules on minimizing litigation risk so you can catch any mistakes.
Then, send your best draft to DCSA.
SENIOR MANAGEMENT OFFICIALS AND SEAD 3 UPDATES
Senior management officials are now officially on the hook for NISP compliance. Make sure all teams across an office are setting up leaders for success. The new NISPOM has a robust section on what it means to be a Senior Management Official, adding specific duties. ISSMs, FSOs, AND higher level leaders have responsibility on what happens in the security programs. Make sure SMOs are aware of the added duties and responsibilities under the new NISPOM, Stephens noted.
READ THE CONTRACT – NOT JUST THE DD-254
Security departments and Facility Security Officers (FSOs) need to read their organization’s government contracts – not just the DD-254. It takes a lot of time, but not doing so creates avoidable risks. “It’s boring and tedious. But it’s essential,” said Stephens.
Just this year, clients have come in with issues on DCSA ISR questions and RFIs, employee clearance statuses, Huawei/ZTE bans, and prohibition on foreign persons. All of these clauses are relevant to security but might not be found in the DD-254. Some of these items are only in the contract, so it’s important to take the time to read the full contract, Stephens notes. As DCSA increases its emphasis on the supply chain and full spectrum security, it is asking many more questions about contract details security officers need to be able to answer.
For more information on NCMS,inc. and their training programs, visit classmgmt.com.
