FSO ITPM Assistant · Self-inspection
Insider threat program self-inspection
The insider threat part of the annual self-inspection (§117.7(h)). Answer each item, note the evidence you looked at, and record a corrective action for every “No”. Export the results to the Self-Inspection sheet of your workbook.
Not the DCSA handbook. These items are written for this site from the rule and DCSA guidance; they are not DCSA’s Self-Inspection Handbook questions. Use them alongside the handbook, not instead of it. Items marked “Good practice” are not required by the rule.
Sources: 32 CFR §117.7(b), (d) and (h); §117.8; §117.9; §117.12(g); §117.18(b)(4); SEAD 4; DCSA ISL 2021-02; DCSA Assessment and Authorization Process Manual (DAAPM). Not legal advice.
October 2026 administrative-finding follow-up
For administrative findings, DCSA no longer immediately validates mitigation or requests formal written mitigation packages. Continue correcting the issue and keep dated local evidence. Aim for the 30-day Gold Standard; use an internal plan of action and milestones when complexity prevents timely closure. Unresolved findings can affect NE-1/NE-4 at the next review.
This is separate from vulnerability corrective-action responses and DCSA validation, and does not delay incident or other mandatory reports. The benchmark is not a universal statutory deadline. Record the finding and date in the evidence field, the mitigation in Corrective action, and the completion date in Date closed.
Sources: September 2026 VOI, pp. 3–4; October 6, 2026 ISE, slides 27–28. Current review guide and official rating tools.