Our note: Which is the point to read this, if you work for the private sector?
Persons working for the private sector may have authorized access to systems and data that are important for their organization and the critical infrastructure. They must learn from the information security directives and must follow best practices and international standards in information security.
SEAD-5 addresses the collection and use of publicly available social media information. Persons working for the private sector also have "publicly available social media information" (any electronic social media information that has been published or broadcast for public consumption, is available on request to the public, is accessible on-line to the public, is available to the public by subscription or purchase, or is otherwise lawfully accessible to the public).
From the Security Executive Agent Directive 5 (SEAD-5) - Important parts
The purpose of the SEAD-5
This Security Executive Agent Directive addresses the collection and use of publicly available social media information during the conduct of personnel security background investigations and adjudications for determining initial or continued eligibility for access to classified national security information or eligibility to hold a sensitive position and the retention of such information. Nothing in this Directive prohibits agencies from conducting other legally permissible investigations or inquiries.
"Covered individual" is:
a. A person who performs work for or on behalf of the executive branch or who seeks to perform work for or on behalf of the executive branch, but does not include the President or (except to the extent otherwise directed by the President) employees of the President under 3 U .S.C. § I 05 or § I 07, the Vice President or ( except to the extent otherwise directed by the Vice President) employees of the Vice President under 3 U.S.C. §106 or annual legislative branch appropriations acts;
b. A person who performs work for or on behalf of a state, local, tribal or private sector entity, as defined in EO 13549, but does not include duly elected or appointed governors of a state or territory, or an official who has succeeded to that office under applicable law;
c. A person working in or for the legislative or judicial branches and the investigation or determination is conducted by the executive branch, but does not include Members of Congress; Justices of the Supreme Court; and Federal judges appointed by the President.
d. Employees of the U.S. Government; industrial, commercial, or personal services contractors; licensees; certificate holders; grantees; experts or consultants; and all subcontractors or any other category of person who acts for or on behalf of the U.S. Government as determined by an appropriate U.S. Government official.
"Publicly available social media information" is any electronic social media information that has been published or broadcast for public consumption, is available on request to the public, is accessible on-line to the public, is available to the public by subscription or purchase, or is otherwise lawfully accessible to the public.
"Social media" are websites, applications, and web-based tools that allow the creation and exchange of user generated content. Through social media, people or groups can engage in dialogue, interact, and create, organize, edit, comment on, combine, and share content.
Policy
Agencies may choose to collect publicly available social media information in the personnel security background investigation process, which pertains to the covered individual's associations, behavior and conduct, as long as the information pertains to the adjudicative guidelines for making determinations of initial or continued eligibility for access to classified information or eligibility to hold a sensitive position.
Authorized investigative agencies may collect, use, and retain publicly available social media information as part of a covered individual's background investigation and, if collected, shall incorporate the relevant results in the investigative record. The period of coverage for publicly available electronic information will be consistent with the scope of the investigation.
Authorized adjudicative agencies may use and retain publicly available social media information when determining initial or continued eligibility of a covered individual for access to classified information or eligibility to hold a sensitive position.
Collection of publicly available social media information shall only be conducted after obtaining the signed Authorization for Release of Information form of the Standard Form 86, Questionnaire for National Security Positions, which includes notice of the collection of such information.
Only publicly available social media information pertaining to the covered individual under investigation shall intentionally be collected. Absent a national security concern, or criminal reporting requirement, information pertaining to individuals other than the covered individual will not be investigated or pursued. Information inadvertently collected relating to other individuals will not be retained unless that information is relevant to a security determination of the covered individual.
Authorized investigative agencies shall make reasonably exhaustive efforts to verify that any information collected that is discrepant or potentially disqualifying pertains to the covered individual. When publicly available social media information pertaining to the covered individual identifies discrepant information or potentially disqualifying issues relevant to one or more of the adjudicative guidelines, the investigation shall be expanded to fully resolve all issues.