Hearing of the House Armed Services Committee - National Industrial Security Program; Globalization and Foreign Ownership of the Defense Industrial Base

Statement

BREAK IN TRANSCRIPT

Thank you, Mr. Chairman.

Thank you to all of you for being here.

I wonder if you could clarify for me the role of the National Security Council. Mr. Thornberry mentioned a number of agencies that are involved, and I'm trying to get a handle on whether that's policy alone, and if in fact you believe that perhaps there should even be a greater role. Could you describe that for me? Is that Mr. Torres? Is that --

MR. TORRES: The role in the National Security Council, as it is with most security policy, is that from an oversight perspective.

So most of the policy is not written there unless there is some reason for that level to decide that things are not working the way they should and take affirmative action. So it is an oversight role, but most of the policy is developed at a lower level with the National Industrial Security Program, with us as the lead, the executive agency, with ISOO and of course that would be coordinated up through the National Security Council to make sure that they're in agreement with what the policy will be.

REP. S. DAVIS: But there have been a number of comments made, basically, that, you know, the agency was broken across the board, and you said that they might be dealing at the lower level with policy, but it should be going up the board. If anything, it's going poorly. So were they playing a role?

MR. TORRES: I can't comment as to whether they were involved previously, but I can tell you at this point, there really is not a need for their involvement, because as we stated previously, Defense Security Service now, in our opinion, has the leadership that is needed to get this right, and the working relationship between Defense Security Service, the security directorate, counterintelligence security, the GAO, I think is going very, very well. So I don't think there's any need to push anything further because we really need to do -- the folks with boots on the ground, the Defense Security Service need to tell us what is really needed, and they are actually doing that.

REP. S. DAVIS: Could I ask you, Ms. Watson, would it be helpful to have them feel like a stronger partner in this at all, or is it basically -- things are -- you don't need that kind of oversight or coordination?

MS. WATSON: Well, I think there is a partnership here and there's a role for everyone to play. The NSC is involved at a very top level. More importantly is the role of the ISOO in developing policy here. The ISOO -- Information Security Oversight Office --

REP. S. DAVIS: Thank you.

MS. WATSON: Sorry.

From National Archives Records Administration plays a role here, as does a group called the NISPAC, and it's another acronym, but that's the industry group that participates as well in the oversight and policy making element here. The group, the NISPAC, has a meeting semi-annually. It's sponsored by ISOO, has participation from all 23 government agencies that participate in the National Industrial Security Program and from DSS as well.

REP. S. DAVIS: It's the final accountability, and I think you covered this earlier, but -- the final accountability, though, is where?

MS. WATSON: The accountability in terms of policy?

REP. S. DAVIS: Overall, yeah.

MR. SULLIVAN: Ma'am, according to the executive order that established the National Industrial Security Program, the NSC has overall responsibility for policy. The Information Security Oversight Office implements this program on behalf of the NSC, and establishes the committee that Kathy mentions, and -- which is an entity established to address major policy issues, the coordination of the information that goes into the operating manual. So I think the answer to your question by the executive order is the NSC, for policy matters.

REP. S. DAVIS: NSC. And to the GAO, in your report, is -- did you locate that as the center of accountability or responsibility?

MS. CALVARESI-BARR: We really just focused on DSS and national industrial security, and what was happening on the ground to even first identify that a risk occurred and then the timing of putting protective measures -- so we didn't really do the review of looking at is the right accountability chain set up. We just wanted to know whether they were doing their jobs as their mission called in the first place, and our recommendations were directed in line with that.

REP. S. DAVIS: Thank you. I know that you mentioned earlier the importance of the accountability piece, and I just wanted to be sure I understood that.

MS. CALVARESI-BARR: Yeah. It is important. It's important in any program, and particularly programs that are protecting critical technologies.

REP. S. DAVIS: Thank you.

Thank you, Mr. Chairman.

BREAK IN TRANSCRIPT

Source