Who determines security-in-depth?

Who determines security-in-depth?

• A. The facility manager
• B. Cognizant Security Agency (CSA)
• C. DoD Inspector General
• D. Local law enforcement

Answer: (B)

Security-in-depth is determined by the Cognizant Security Agency. This agency is responsible for establishing the security requirements, approving the security program, and guiding how layered protections—across personnel, physical security, information handling, and procedures—should be implemented at a facility or contractor. They set the standards and review compliance, ensuring the safeguards work together as a system of layers. A facility manager implements and operates under those standards, but it’s the CSA that defines and authorizes the overall security-in-depth approach. The DoD Inspector General audits and assesses compliance, rather than creating the protective framework, and local law enforcement handles external or criminal matters rather than the internal security architecture.

Security-in-depth is determined by the Cognizant Security Agency. This agency is responsible for establishing the security requirements, approving the security program, and guiding how layered protections—across personnel, physical security, information handling, and procedures—should be implemented at a facility or contractor. They set the standards and review compliance, ensuring the safeguards work together as a system of layers.

A facility manager implements and operates under those standards, but it’s the CSA that defines and authorizes the overall security-in-depth approach. The DoD Inspector General audits and assesses compliance, rather than creating the protective framework, and local law enforcement handles external or criminal matters rather than the internal security architecture.