Audit of NARA’s Security Management Program

Update the Facility Security Risk Management Program Internal Operating Procedure (IOP) to include.
• Additional guidance on how to implement the Interagency Security Committee’s (ISC) Standard’s Facility Security Level (FSL) criteria.
• A process for documenting the Chief, Physical Security’s approval of the FSL.
• A requirement for supporting documentation and justification for each assigned score, including source references or observed conditions that could impact certain criteria.
• A requirement for documented justifications for any deviations from the Design Basis Threat (DBT) baseline scores identified by ISC.
• A requirement that security incident data be reviewed, analyzed, and attached as part of the Facility Security Assessment (FSA) process.

Develop and implement standard operating procedures (SOPs) that instruct CORs on the invoice approval process, to include a requirement that CORs document their reconciliation of invoices with detailed timesheets before security guard contract invoices are paid.

Provide training on the new documentation requirements to any COR responsible for security guard contracts.

Provide specific guidance to CORs responsible for security guard contracts or, as appropriate, issue a contract modification which further clarifies the allowable uses for the “Additional Services” Contract Line Item Numbers (CLINs), and processes required to use available funds for other purposes.