Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security CISSP-Discussion
[Top] [All Lists]

Re: [CISSP-D] Security ClearAnce

Subject: Re: [CISSP-D] Security ClearAnce
Date: Thu, 10 Feb 2005 17:28:46 -0500


kevin,
Good explanation. There is one minor correction however. You actually do 
"keep your clearance" for purposes of stating that you have one for a period 
of five years when actively being used and a period of 2 years when 
inactive. You don't "take it with you", but the issuing body has you in 
their system. When you leave one job and go to the next, a change of 
sponsorship takes place (one employer terminates your access the new 
employer requests your re-instatement) but you actually can say yes I have a 
clearance. The official rule is as follows.

"A PCL (security clearance) can be reinstated provided (a) No more than 24 
months has lapsed since the date of termination of the clearance; (b) There 
is no known adverse information; (c) The most recent investigation must not 
exceed 5 years (TS, Q) or 10 years (SECRET, L); and (d) Must meet or exceed 
the scope of the investigation required for the level of PCL that is to be 
reinstated or granted. A PCL can be reinstated at the same, or lower, level 
by submission of a CSA-designated form to the CSA. The employee may not have 
access to classified information until receipt of the LOC".

So itpro, In a nutshell, the new employer does not have to pay for a new 
investigation. They just request re-instatement. This is primary reason why 
you become even more marketable to a potential employer.

cheers,

joan~


On Wed, 9 Feb 2005, itpro_pa wrote:

I see this forum talk a lot about the well treasured (as they should be)
certifications. Having a decade of experience in the field of IT, but as
a newbie to this sector, I was wondering about the added factor of a
security clearance and the marketability of the credentials. Can ANYONE
in this forum tell of their experience or the path one might take in
getting even the most minimal clearance possible? I am currently
scheduled to sit for the CISSP on March 12th in Baltimore. I am really
interested in gaining security clearance but heard (and read) it is
quite costly unless you have a corporate sponsor. Is this true? Can one
gain a minimal security clearance on his own?

AFAIK there is no such thing as a "personal" clearance.  This comes
straight from the need-to-know/least privilege philosophy.  Generally the
subcontractor company or goverment agency directly, as the data owner,
determines the level of clearance you need to perform your job, and
sponsors your application for it.  The clearance only exists for the time
you require that access -  you don't take it with you when you change
employers or even contracts.

All you can have/demonstrate as an individual is that you are *capable* of
being approved for a certain clearance.  For example, I have a "secret"
level clearance sponsored by my employer for my current work on a DoD
contract.  If I'm applying for a job with a different company, I can
demonstrate that I'm currently capable of being issued a secret clearance,
and that may be an important factor in whether they hire me or not.  But
my current clearance wouldn't go with me; the hiring company would have to
sponsor a new one for me based on my new job requirements.  When you see
in a job ad "must have x clearance", that's really shorthand for the
above.

I'm sure there are exceptions, but I'd imagine they'd fall into the
category where the individual is also the data owner or is
self-incorporated as a subcontracting company, something like that.

Hope this helps!

KeS







 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/CISSP-Discuss/

<*> To unsubscribe from this group, send an email to:
    CISSP-Discuss-unsubscribe@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 



<Prev in Thread] Current Thread [Next in Thread>