Our note: Which is the point to read this, if you work for the private sector?
Persons working for the private sector may have authorized access to systems and data that are important for their organization and the critical infrastructure. They must learn from the information security directives and must follow best practices and international standards in information security.
SEAD-3 covers the continuing security obligation of persons to be aware of the risks associated with foreign intelligence operations and/or possible terrorist activities directed against them in their country and abroad. These individuals also have a responsibility to recognize and avoid personal behaviors and activities that may adversely impact their continued national security eligibility.
According to SEAD-3, even in unofficial foreign travel, covered individuals must submit an itinerary and must receive approval prior to the foreign travel. Unanticipated border crossings into any foreign country not included in the travelers' approved itinerary, regardless of duration, are discouraged. All deviations from approved travel itineraries must be reported
From the Security Executive Agent Directive 3 (SEAD-3) - Important parts
REPORTING REQUIREMENTS FOR PERSONNEL WITH ACCESS TO CLASSIFIED INFORMATION OR WHO HOLD A SENSITIVE POSITION.
1. All covered individuals incur a special and continuing security obligation to be aware of the risks associated with foreign intelligence operations and/or possible terrorist activities directed against them in the United States and abroad. These individuals also have a responsibility to recognize and avoid personal behaviors and activities that may adversely impact their continued national security eligibility.
2. Covered individuals shall report to their agency head or designee any planned or actual involvement in any of the activities below prior to participation in such activities or otherwise as soon as possible following the start of their involvement. Heads of agencies or designees shall conduct an analysis of such reported activities to determine whether they pose a potential threat to national security and take appropriate action.
3. Failure to comply with reporting requirements and resultant determinations made by the agency may result in administrative action that includes, but is not limited to, revocation of national security eligibility.
4. Heads of agencies or designees may determine that operational and mission needs preclude strict adherence to these reporting requirements. In these instances, equivalent notification, briefing, and reporting shall be accomplished in accordance with agency requirements.
5. Reporting shall be automated to the extent practicable and provide required data elements as identified in Appendix A.
6. Heads of agencies or designees should use available classified and unclassified resources to help determine travel risk, which may include the following:
a. National Counterintelligence and Security Center, National Threat Identification and Prioritization Assessment;
b. Department of State, Security Environment Threat List;
c. Department of State, Travel Alerts and Warnings; and
d. Defense Intelligence Agency Threat List.
7. Heads of agencies may require additional or more detailed reporting and approval procedures for covered individuals under their purview.
8. Covered individuals shall only be required to report to the agency that sponsors their clearance or determined the position they occupy to be sensitive. This does not preclude agency agreements for covered individuals to report to or through a different agency.
REPORTABLE ACTIVITIES FOR ALL COVERED INDIVIDUALS:
1. Foreign Travel:
a. Heads of agencies or designees shall determine requirements for reporting foreign travel as part of a covered individual's official duties.
b. Unofficial Foreign Travel:
1) Covered individuals shall submit an itinerary for unofficial foreign travel to their agency head or designee and, except as noted in the subparagraphs below, must receive approval prior to the foreign travel. Unanticipated border crossings into any foreign country not included in the travelers' approved itinerary, regardless of duration, are discouraged. All deviations from approved travel itineraries shall be reported within five business days of return.
a) Travel to Puerto Rico, Guam, or other U.S. possessions and territories is not considered foreign travel and need not be reported.
b) Unplanned day trips to Canada or Mexico shall be reported upon return. Reporting shall be within five business days.
c) When required by the agency head or designee, covered individuals shall, prior to travel, receive a defensive security and counterintelligence briefing.
d) While emergency circumstances may preclude full compliance with pre-travel reporting requirements, the covered individual, at a minimum, shall verbally advise their supervisor/management chain of the emergency foreign travel with all pertinent specifics and, preferably, a security representative, prior to departure. In any event, full reporting shall be accomplished within five business days of return.
e) Consistent with national security, heads of agencies or designees may identify, for covered individuals under their purview, conditions under which prior reporting and approval of unofficial travel is not required, such as, agencies with an overseas presence that may require less specific reporting as opposed to every instance, e.g. travelled to x country y times last month, travel weekly/monthly to x country, travel to x country y times per year, etc.
2) Heads of agencies or designees may disapprove an unofficial foreign travel request when it is determined that such travel presents an unacceptable risk and the physical safety and security of covered individuals or classified information cannot be reasonably ensured. Failure to comply with such disapproval may result in administrative action that includes, but is not limited to, revocation of national security eligibility.
2. Foreign Contacts:
a. Heads of agencies or designees shall determine requirements for reporting contact with a foreign national as part of a covered individual's official duties.
b. Unofficial Contacts:
1) Unofficial contact with a known or suspected foreign intelligence entity.
2) Continuing association with known foreign nationals that involve bonds of affection, personal obligation, or intimate contact; or any contact with a foreign national that involves the exchange of personal information. This reporting requirement is based on the nature of the relationship regardless of how or where the foreign national contact was made or how the relationship is maintained (i.e. via personal contact, telephonic, postal system, Internet, etc.). The reporting of limited or casual public contact with foreign nationals is not required absent any other reporting requirement in this directive. Following initial reporting, updates regarding continuing unofficial association with known foreign nationals shall occur only if and when there is a significant change in the nature of the contact. Heads of agencies or designees may provide specific guidance and examples of updated reporting situations.
3. Reportable Actions by Others: To ensure the protection of classified information or other information specifically prohibited by law from disclosure, covered individuals shall alert agency heads or designees to the following reportable activities of other covered individuals that may be of potential security or counterintelligence (CI) concern:
a. An unwillingness to comply with rules and regulations or to cooperate with security requirements.
b. Unexplained affluence or excessive indebtedness.
c. Alcohol abuse.
d. Illegal use or misuse of drugs or drug activity.
e. Apparent or suspected mental health issues where there is reason to believe it may impact the covered individual's ability to protect classified information or other information specifically prohibited by law from disclosure.
f. Criminal conduct.
g. Any activity that raises doubts as to whether another covered individual's continued national security eligibility is clearly consistent with the interests of national security.
h. Misuse of U.S. Government property or information systems.
4. Covered individuals who have been identified by their respective agency head in accordance with EO 12968, as amended, Section 1.3. (a) shall file a financial disclosure report, as appropriate.
REPORTABLE ACTIVITIES FOR INDIVIDUALS WITH ACCESS TO SECRET AND CONFIDENTIAL INFORMATION, "L" ACCESS, OR HOLDING A NON-CRITICAL SENSITIVE POSITION:
In addition to the reporting requirements in Section F, individuals with access to Secret and Confidential information, "L" access, or holding a Non-Critical sensitive position shall also report:
1. Foreign Activities:
a. Application for and receipt of foreign citizenship.
b. Application for, possession, or use of a foreign passport or identity card for travel.
2. Other Reportable Activities:
a. Attempted elicitation, exploitation, blackmail, coercion, or enticement to obtain classified information or other information specifically prohibited by law from disclosure regardless of means.
b. Media contacts, other than for official purposes, where the media seeks access to classified information or other information specifically prohibited by law from disclosure, whether or not the contact results in an unauthorized disclosure. Media contacts related to the fulfillment of official duties of the position held by the covered individual need not be reported.
c. Arrests.
d. Bankruptcy or over120 days delinquent on any debt.
e. Alcohol-and drug-related treatment.
APPENDIX A - REQUIRED DATA ELEMENTS FOR REPORTING
When self-reporting or reporting about others is necessary, the following information must be provided in the report, as available and applicable.
1. Foreign travel:
a. Complete itinerary.
b. Dates of travel.
c. Mode of transportation and identity of carriers.
d. Passport data.
e. Names and association (business, friend, relative, etc.) of foreign national traveling companions.
f. Planned contacts with foreign governments, companies, or citizens during foreign travel and reason for contact (business, friend, relative, etc.).
g. Unplanned contacts with foreign governments, companies, or citizens during foreign travel and reason for contact (post-travel reporting).
h. Name, address, telephone number, and relationship of emergency point of contact.
i. Unusual or suspicious occurrences during travel, including those of possible security or counterintelligence significance (post-travel reporting).
j. Any foreign legal or customs incidents encountered (post-travel reporting).
2. Unofficial contact with a known or suspected foreign intelligence entity:
a. Service(s) involved.
b. Name of individual(s) contacted.
c. Date(s) of contact.
d. Nature of contact to include any unusual or suspicious activity.
e. Likelihood of future contacts.
3. Continuing association with a known foreign national(s) or foreign national roommate(s):
a. Name of foreign national(s).
b. Citizenship(s).
c. Occupation.
d. Nature of relationship, i.e., business or personal.
e. Duration and frequency of contact(s).
f. Current status of the relationship(s).
4. Involvement in foreign business:
a. Nature of involvement.
b. Countries involved.
c. Name of business.
5. Foreign Bank Account:
a. Financial institution.
b. Country.
6. Ownership of foreign property:
a. Location.
b. Estimated value.
c. Balance due.
d. Purpose and use of property.
e. How acquired.
7. Foreign citizenship:
a. Country.
b. Basis for citizenship.
c. Date of application or receipt.
8. Application for a foreign passport or identity card for travel:
a. Country.
b. Date of application.
c. Reason for application.
9. Possession of a foreign passport or identity card for travel:
a. Issuing country.
b. Number.
c. Date of issuance.
d. Expiration date.
e. Reason for possession.
10. Use of a foreign passport or identity card for travel:
a. Issuing country.
b. Reason for use.
c. Date(s) and country(ies) of use.
11. Voting in a foreign election:
a. Date.
b. Country.
c. Election.
12. Adoption of non-U.S. citizen children:
a. Country involved.
b. Foreign government organization involved.
c. Foreign travel required.
d. Adoption agency or other intermediary.
e. Adoptive parents' current linkage to foreign country.
13. Attempted elicitation, exploitation, blackmail, coercion, or enticement to obtain classified information or other information specifically prohibited by law from disclosure:
a. Date(s) of incident.
b. Name of individual(s) involved.
c. Nature of incident.
d. Method of contact.
e. Electronic address.
f. Type of information being sought.
g. Background, circumstances, and current state of the matter.
14. Media contacts:
a. Date(s) of contact.
b. Name of media outlet.
c. Name of media representative.
d. Nature and purpose of contact.
e. Whether classified information or other information specifically prohibited by law from disclosure was involved in the contact.
f. Current status of the contact.
15. Arrests:
a. Date(s) of the incident(s).
b. Location(s) of the incident(s).
c. Charges and/or circumstances.
d. Disposition.
16. Financial Issues and Anomalies:
a. Type of issue or anomaly (bankruptcy, inheritance, etc.).
b. Dollar value.
c. Reason.
17. Cohabitant(s):
a. Name(s).
b. Citizenship(s).
c. Date of Birth.
d. Place of Birth.
e. Duration of contact(s).
18. Marriage:
a. Name of spouse.
b. Citizenship of spouse.
c. Date of Birth.
d. Place of Birth.
e. Date of marriage.
19. Alcohol- and drug-related treatment:
a. Reason.
b. Treatment provider, to include contact information.
c. Date(s) treatment provided.