Additional Counterintelligence Awareness Resources

• Countering Foreign Intelligence Threats Implementation and Best Practices Guide 
• DCSA Counterintelligence Methods of Contact/Methods of Operation Countermeasures Matrix
• DCSA Counterintelligence Methods of Contact/Methods of Operation Countermeasures Matrix Video 
• DCSA Counterintelligence Directorate 
  • Reports 
  • Handouts 
• DOD Hotline Posters 
• CI and Security Posters – ONCIX 
• CI and Security Posters – CDSE
• CI Glossary 
• NCSC Supply Chain Threats 
• NCSC Video Series Terminal Risk 
• FBI Economic Espionage Awareness Campaign 
• National Counterintelligence and Security Center 
• Office of the Director of National Intelligence 

DSCA Policy

• NISPOM and ISL 
• NISPOM Adverse Information Reporting Requirements 

DOD Policy

• DOD 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence (CI) Insider Threat 
• DOD Directive 2060.1, Implementation of, and Compliance with, Arms Control Agreements 
• DOD Directive 5105.42, Defense Counterintelligence and Security Agency 
• DOD Instruction 5200.39, Critical Program Information (CPI) Protection Within the Department of Defense 
• DOD Directive 5205.16, DOD Insider Threat Program 
• DOD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR) 
• DOD Publications 

National Policy

• National Counterintelligence Strategy or the United States 2020-2022 
• Intelligence Community Directive 700 'Protection of National Intelligence' 
• Counterintelligence Enhancement Act of 2002 
• Public Law 108-458 (Intelligence Reform and Terrorism Prevention Act) 
• Executive Order 13587: Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information 

Intelligence Oversight, Civil Liberty, and Privacy Act issues

• Executive Order 12333 As Amended 
• Privacy Act of 1974 
• ICD 501: Discovery and Dissemination or Retrieval of Information Within the IC 

Reporting

• eLearning Courses
  • Counterintelligence Awareness & Reporting Course for DOD Employees CI116.16
  • NISP Reporting Requirements IS150.16 
• Shorts
  • Suspicious Emails
• Webinars
  • Security Incidents Involving SCI
  • Counterintelligence Awareness and Reporting (CIAR) DODD 5240.06 
  • DOD Hotline Information 
  • DCSA Counterintelligence Methods of Contact/Methods of Operation Countermeasures Matrix
  • DCSA Counterintelligence Methods of Contact/Methods of Operation Countermeasures Matrix Video 
  • How to Pull Email Headers for SCRs Submitted to FOs 
  • Reporting the Threat brochure 
  • Suspicious Contact Report (SCR) Template 
• Videos
  • Counterintelligence Reporting Requirements for Industry

Insider Threat

• For additional Insider Threat resources visit our Insider Threat Toolkit.
• Information on the OPM Cybersecurity Incident 
• eLearning: Insider Threat Awareness INT101.06
• eLearning: Establishing an Insider Threat Program for your Organization INT122.06
• GAO Report: Insider Threats 
• Webinar: Insider Threat for DOD Professionals

Key Policies

• Executive Order 13587: Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information 
• ISL 2013-05 (July 2, 2013): Applicability of National Industrial Security Program Operating Manual (NISPOM) Paragraph 1-301 Reporting Requirements to Cyber Intrusions 

Training

• eLearning: Cybersecurity Awareness CS130.16
• Short: Suspicious Emails
• Video: Insider Threats to Cybersecurity
• Webinar: Cyber Insider Threat
• Webinar: Information Security Continuous Monitoring

Cyber-CI Resources

• Cyber Threat Case Examples 
• Foreign Intelligence Entity Malware Relationship Triage Tool (MReTT) Guidelines for Cleared Contractors 
• Information on the OPM Cybersecurity Incident 
• NCSC Cyber Training Series 
• Suspicious Indicators of Foreign Collection Efforts via Computer Elicitation 

Foreign Travel & Visits Training and Awareness

• Short: Foreign Travel Brief
• Foreign Travel Debriefing 
• Foreign Contact Questionnaire/Debrief  
• SCI Indoctrinated Employee Foreign Travel Questionnaire 

Foreign Travel & Visits Best Practices

• Sample Technology Control Plan 
• Traveling and Espionage 

Counterterrorism Awareness Training

• eLearning: Antiterrorism Officer (ATO) Level II GS109.16 
• Short: Active Shooter Awareness 

Counterterrorism Policy

• DOD 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence (CI) Insider Threat 
• Public Law 108-458 (Intelligence Reform and Terrorism Prevention Act) 

Counterterrorism Best Practices

• Bomb Threat Standoff Distances – National Counterterrorism Center 
• Intelligence Guide for First Responders – National Counterterrorism Center 
• 902d MI Group - Insider Threat and Terrorism Information Page (Ft. Knox Resident Office) 
• National Counterterrorism Center (NCTC) Homepage 
• SAR Indicators 

Job Aids

• Software Supply Chain Attacks 
• Supply Chain Risk Management Job Aid 
• Supply Chain Resilience Month Poster 8.5x11 / 17x22 
• Deliver Uncompromised Campaign Poster 8.5x11 / 17x22 

eLearning Courses

• DOD Supply Chain Fundamentals DAU-CLL037.16
• Contracting for the Rest of Us DAU-CLC011.16

Webinars

• Supply Chain Past, Present, and Future 2022
• Supply Chain Resiliency 2020; Webinar with NCSC

Supply Chain Risk Management Policy

• DODI-O 5240.24 CI Activities Supporting Research, Development and Acquisition (CAC Required) 
• DODM 4140.02 Volume 1-11 DOD Supply Chain Material Management Procedures 
• National Defense Authorization Act 2014, Page 414 - 415 
• Intelligence Community Directive 731 

Threat Awareness

• Foreign Economic Espionage in Cyberspace 
• Computer Security Resource Center NIST 
• NCSC Supply Chain Threats 

Best Practices

• Defense Acquisition Portal SCRM Blog 
• Exploitation of Global Supply Chain 
• Computer Security Resource Center NIST 
• NIST Interagency Report 7622 Notional SCRM Practices for Federal Information Systems 
• The U.S. Resilience Project 

Policies

• Executive Order 12333 United States Intelligence Activities 
• Executive Order 13462 (as amended in 2009) President's Intelligence Advisory Board and Intelligence Oversight Board 
• Directive Type Memorandum 13-008 DOD Implementation of Presidential Policy Directive 19 
• DOD Directive  5106.04 
• Combatant Commander Inspectors General DOD Directive 5148.13 
• Intelligence Oversight DOD Directive 5240.01 (current thru 2014) 
• DOD Intelligence Activities DOD Manual 5240.01 Procedures Governing the Conduct of DOD Intelligence Activities DOD 5240.1R, Change 2 
• Privacy Act of 1974 
• ICD 501: Discovery and Dissemination or Retrieval of Information Within the IC 
• Intelligence Community Policy Guidance (ICPG) 107.1 

Reporting Questionable Government Activities

The Whistleblower Protection Act (PPD-19) protects employees from direct retaliation for acts of reporting protected disclosures. It does NOT protect employees who unlawfully disclose classified information. Report questionable government activity to your supervisor or your organization's security officer. If you are not comfortable reporting to these sources, other avenues are available including the DOD Senior Intelligence Oversight Official, the DOD Inspector General, the US Attorney General, and the DOD Hotline.

Consider these resources for more information:

• The Whistleblower Protection Act (PPD-19) 
• Whistleblower FAQ 
• No FEAR Act Reporting 
• DODD 5148.13 Intelligence Oversight 
• DOD Hotline Information 
• Senior Intelligence Oversight Official 

• Case Study: Yuksel Senbol 
• Poster: Fraud and CI Concerns