FSO Console · NISPOM / 32 CFR Part 117
How It Works
The industrial-security platform that runs inside your environment — not ours. Here is exactly what that means, and what it does for you every single week.
The part most vendors won't show you
It lives in your house, not ours.
Almost every compliance tool is multi-tenant SaaS: your personnel files, facility records, and reporting history sit in the vendor's cloud. You're trusting their security team, their uptime, and their goodwill not to lose it, leak it, or hold it hostage at renewal. FSO Console is built the other way around. Each customer deploys a single, isolated instance into their own Google Cloud / Workspace environment. The application and its database sit entirely behind your boundary. INTS2 has no standing access, your records never leave unless you send them, and the app's only call out is a license renewal check that carries nothing but its current code.
The vendor sits outside the wall. Your data never crosses it unless you're the one sending it.
Why that matters to a skeptic
You license the software. Your data stays yours.
Your environment, your control
It runs in your own Google tenant, and we can't reach in. Your license is verified offline, so no INTS2 server has to be up for your instance to do its job.
Your data, always portable
One-click export, any time, no permission needed. There's no lock-in and no hostage situation — if you ever walk, you walk out with everything.
Replaces the spreadsheet sprawl
The email threads, the drive full of briefing docs, the calendar reminders you set by hand — consolidated into one tracked, auditable system you can actually prove.
What it does for you every week
Six jobs it takes off your desk.
Foreign-travel briefings that send themselves
Connect your work email once. When a trip is logged, FSO Console generates the required foreign-travel briefing and sends it straight from your mailbox — your address, your signature — pre-travel and post-travel, without you drafting a word. The reminder you used to set, the doc you used to copy-paste, the "did I send that?" — gone.
The briefing that used to eat an afternoon now goes out the moment the trip hits the calendar.
Every briefing tailored to the traveler
It's not a form letter. Each briefing is customized to the individual traveler and their trip — the destination country and its specific threat picture, the itinerary, and the traveler's clearance level and role. What lands in their inbox is the briefing that actually applies to them, not a generic PDF everyone skims and forgets.
One traveler to a low-risk ally and another to a high-threat post get genuinely different briefings — automatically.
A reporting link your employees actually use
The standard requires employees to self-report — foreign contacts, foreign travel, adverse information, and more. Chasing that by email doesn't scale. Push out a single secure link; employees report directly to you through it; every submission lands in the console, time-stamped and tracked, so nothing slips through the cracks and you can prove it was captured.
Instead of hoping people remember to email you, you hand them one link — and the reports come to you, organized.
Security training that practically runs itself
Security-awareness and refresher training is a standing requirement — and a standing chore. The console drafts the training quizzes for you; you review and approve exactly what goes out — nothing reaches an employee unseen — and it sends them automatically and tracks who's completed and who hasn't. You keep full control of the content without building it from scratch or chasing completions by hand.
You approve the questions in a minute; the console handles the drafting, the sending, and the follow-up.
Ask the ISR — the function library
The 32 CFR Part 117 / NISPOM rulebook is dense, and "what does my ISR actually expect here?" is a daily question. Ask the ISR is a built-in function library that answers it — plain-language guidance on requirements, timelines, and procedures, grounded in the standards you're held to — without digging through hundreds of pages or waiting days for an email back from your rep.
The answer you'd normally wait on from your rep, in seconds — tied to the actual requirement.ISR = Industrial Security Representative, your government counterpart. Ask the ISR offers guidance only; it is not legal advice or an official DCSA position.
Know your DCSA rating before the Security Review does
Your DCSA Security Review is the moment everything you do gets graded — and most FSOs walk in guessing. The DCSA Rating tool walks you through the review against the rating criteria: the system auto-answers the handful of questions it can pull straight from your data, you complete the rest, and it places you on the DCSA scale — showing your projected tier and exactly what stands between you and the next one. You see the scorecard before review day, not after.
Example: you'd project at Satisfactory today — the tool surfaces the specific gaps between you and Commendable, with time to close them before the SR.
Instead of walking into the Security Review hoping, you walk in having already seen the grade — and already closed the gaps that would have cost you.The projected tier is an unofficial estimate. Only DCSA assigns your official security rating.
The paperwork, guided
And the wizards that walk you through the hard parts.
The filings that used to mean a binder, a checklist, and a call to your rep — turned into step-by-step tools that already know the order, the forms, and what DCSA is looking for.
FCL Wizard
Facility Clearance, step by step — establishing and maintaining your FCL: the required documents, submissions, and key-management-personnel actions, in the right order.
FOCI Wizard
Foreign Ownership, Control, or Influence, demystified — walk the disclosure, flag where FOCI factors apply, and see the mitigation and reporting each one calls for.
PCL tool
Personnel Clearances in one place — eligibility and level per person, what's due, and what's expiring, so no one's clearance lapses on your watch.
And the rest of the workspace: Deadlines, People, Training, Reporting, Facility, FOCI, Compliance and Tools. See every tab →
Sign-on & access
Everyone signs in as themselves.
Every user has their own sign-in and their own Authorization Code, and every user signs the agreement before their code is released.
Your company account
The billing owner — usually the FSO — creates the company account at app.fsoconsole.com and adds each user by name, work email and CAGE. One person per CAGE is the Owner of the company instance.
Each person signs
Every user receives a personal link to review and sign the agreement. Signing is quick: three acceptance boxes, your typed name and title.
Each person gets a personal Authorization Code
Each user signs once and sees their own Authorization Code on screen; codes are never sent by email. Each code is bound to their email and CAGE, has a fixed term, and is verified inside your instance, offline. Paid subscriptions renew automatically until you cancel; beta codes run 30 days.
Signing in day to day
Users sign in to your company instance with their own FSO Console account. The Owner and Alternate control who can join and see your company data. INTS2 cannot create, reset or recover accounts inside your instance.
Setting it up in your environment
One guided install, in your own Google Cloud.
The Owner sets FSO Console up once for the company with a guided installer — no cloud engineering required.
Prepare a Google Cloud project
Create a project in your company's Google Cloud account and turn on billing. Google bills you directly; the default setup is sized small.
Run the installer
The Owner opens the deployment kit link from their email, opens Google Cloud Shell, and pastes one command. It asks for your project ID, region and Owner email, shows exactly what it will create, and waits for your OK.
What it creates for you
The FSO Console app, a private database, private document storage with public access blocked, and a one-time Owner setup code — all inside your project, under your account. No servers or databases to wire up by hand.
Finish setup
Open the address the installer prints, complete first-time setup as Owner with the setup code, then paste your Authorization Code under Settings. Your team signs in at the same address and enters their own codes.
Updates and your data
When INTS2 publishes a release or security advisory, the Owner is emailed and runs one update command when convenient. Full data export is always available in the app, even after a license ends.
Straight answers
The objections, answered.
So INTS2 can see my data?
What happens if I stop paying, or you go under?
How are we billed?
My email and spreadsheets already work. Why change?
Is this just a nice wrapper over the regulations?
How hard is it to stand up?
The short version
You run the instance. You hold the data. The automation does the busywork. The vendor stays outside the wall.
That's the whole idea — the control a security professional expects, with the week-to-week workload of an FSO quietly taken off your plate.