What is the NISPOM?

The NISPOM is the National Industrial Security Program Operating Manual, the set of rules a company follows once the government has cleared it to hold classified information. Since February 24, 2021 it has been a federal regulation, 32 CFR Part 117, rather than a Department of Defense (DoD) manual. The rule covers how a company gets and keeps a facility clearance, who inside the company is responsible for security, what must be reported and to whom, how classified material is stored, and how visits, subcontracts, and information systems are handled. Anyone who sells software or services into a cleared facility works inside this rule, because the facility's security officer does.

Where the NISPOM comes from

The program behind the manual is the National Industrial Security Program (NISP). Executive Order 12829, signed January 6, 1993, established it to safeguard classified information released to contractors, licensees, and grantees of United States agencies. The order's preamble states the standard the whole program is built on: information released to industry must be "safeguarded in a manner equivalent to its protection within the executive branch" of government. Section 201 directs the Secretary of Defense, with the concurrence of the Secretary of Energy, the Nuclear Regulatory Commission, and the Director of Central Intelligence, to issue and maintain an operating manual, with those agencies writing the portions on Atomic Energy Act information and on intelligence sources and methods, including sensitive compartmented information (SCI).

Above the manual sits an implementing directive from the Information Security Oversight Office (ISOO), 32 CFR Part 2004, dated May 7, 2018. Section 2004.20 names the Secretary of Defense as the NISP executive agent, who provides industrial security services to agencies that are not cognizant security agencies, by agreement, and who "issues and maintains the National Industrial Security Program Operating Manual" with the concurrence of the other cognizant security agencies. Section 2004.20(b) explains how the manual reaches a company: NISPOM requirements apply through Federal Acquisition Regulation clauses or other contract clauses that refer the company to the NISPOM, or through equivalent contract language.

So the stack has three layers. The executive order creates the program and assigns roles. 32 CFR Part 2004 sets uniform standards for the agencies. 32 CFR Part 117, the NISPOM, tells the contractor what to do.

The NISPOM rule, 32 CFR Part 117

DoD published the NISPOM as a final rule in the Federal Register on December 21, 2020, at 85 FR 83300, under docket DoD-2020-OS-0045. The rule took effect on February 24, 2021, and comments were accepted until February 19, 2021. Industry and DCSA call it the NISPOM rule.

The rule did three things beyond moving the text into the Code of Federal Regulations. The preamble says it incorporated Security Executive Agent Directive (SEAD) 3 so that the NISP would have a "single nation-wide implementation plan" for reporting by cleared contractor personnel. It implemented Section 842 of Public Law 115-232, which removed the requirement for a covered National Technology and Industrial Base entity operating under a special security agreement to obtain a national interest determination before accessing proscribed information. And it removed the old 32 CFR Part 117 subparts B and C, which DoD found duplicative of 32 CFR Part 2004.

Section 117.1(b)(3) gave contractors 6 months from February 24, 2021 to implement the rule. One requirement got more time. An amendment published August 19, 2021, at 86 FR 46597, extended the date for contractors under DoD security cognizance to begin reporting and obtaining pre-approval of unofficial foreign travel to DoD. Commenters had said individual travel reports would be impractical without a batch upload capability, DoD agreed to modify its system, and that one date moved to August 24, 2022.

The preamble estimated that 12,400 cleared entities, 8,036 of them small businesses, would need to learn the rule. DCSA's program page puts the current figure at "approximately 12,500 contractor facilities" under its oversight, and states that the rule replaced the NISPOM previously issued as DoD 5220.22-M on February 24, 2021.

NISPOM change history

People still search for "NISPOM Change 2" because that was the edition in force for almost 5 years. The Federal Register preamble lays out the lineage:

The preamble states that the then-current NISPOM, Change 2, was posted on the DoD issuances site, and that DoD would no longer publish the manual as a policy issuance once the rule took effect. A citation to a NISPOM paragraph in the old "5-306" style refers to the cancelled manual; the current equivalent is a section of 32 CFR Part 117.

How 32 CFR Part 117 is organized

The codified rule has no subparts. It runs as 24 numbered sections, 117.1 through 117.24, and the sections group naturally into the subjects the old manual's chapters covered.

Section 117.2 applies the rule to DoD components, to all executive branch agencies, and to every non-government entity granted access to classified information, through every phase of a contract from bids and proposals to termination.

Who runs the program: CSA, CSO, DCSA, and GCA

The rule's definitions in 117.3 name the players. A cognizant security agency (CSA) is an agency with NISP implementation and security responsibilities for its own components and for the entities under its cognizance. The rule lists five: DoD, the Department of Energy (DOE), the Nuclear Regulatory Commission (NRC), the Office of the Director of National Intelligence (ODNI), and the Department of Homeland Security (DHS). A cognizant security office (CSO) is the unit to which a CSA head delegates the administration of industrial security services. A government contracting activity (GCA) is the element of an agency with delegated acquisition authority; a foreign government can also be a GCA.

Section 117.6 assigns the DoD roles. The Under Secretary of Defense for Intelligence and Security acts as the CSA for DoD and issues the rule itself. The Director of the Defense Counterintelligence and Security Agency (DCSA) runs DCSA as the DoD CSO, administers the NISP on behalf of DoD contracting activities and the non-DoD agencies that have agreements with DoD, and provides security oversight of cleared contractors. DOE, NRC, DNI, and DHS keep authority over their own categories of information: Atomic Energy Act information, intelligence sources and methods including SCI, and the critical infrastructure program.

Section 117.7(k) explains why DCSA appears for so many agencies: non-CSA agency heads enter agreements with the Secretary of Defense as executive agent, and DCSA posts the list of signatory agencies on its website.

The FSO and the other key management personnel

Section 117.7(b) requires a contractor to appoint security officials who are U.S. citizens. Three positions are mandatory, and one person may hold more than one of them depending on the size and complexity of the security operation:

• Senior management official (SMO). Ensures the contractor maintains a system of security controls, appoints the FSO and insider threat program senior official in writing, stays informed of the facility's classified operations, and retains accountability for the management and operations of the facility without delegating it.
• Facility security officer (FSO). Under 117.7(b)(3), the FSO will "supervise and direct security measures" needed to implement the rule and the related government security requirements, and completes the training the CSA deems appropriate. Section 117.9(d)(1)(iii) requires the FSO to be a U.S. citizen employee, and 117.12(d) requires FSO training within 6 months of appointment, plus an FSO program management course where the CSA requires it for facilities approved to store classified material.
• Insider threat program senior official (ITPSO). Establishes and executes the insider threat program required by 117.7(d), consistent with Executive Order 13587. If the ITPSO is not the FSO, the FSO must be an integral member of the program.

Each is designated in writing, cleared at the facility clearance level, and listed as key management personnel (KMP). Section 117.3 defines KMP as the SMO, FSO, ITPSO, and every other official who holds a majority interest or stock in the entity or has direct or indirect authority over its management, operations, or classified contract performance. Under 117.7(c), the CSA may require other KMP to be cleared or may allow the governing board to formally exclude them from access, using the resolution language printed in the rule.

A contractor that processes classified information on its own systems also appoints an information system security manager (ISSM) under 117.7(b)(5), cleared to the highest level processed, whose duties appear in 117.18.

Reporting under 117.8 and SEAD 3

Reporting is where the rule reaches every cleared employee, not just the security office. Section 117.8(a) requires contractors and their cleared employees to report under the rule, under SEAD 3, and under CSA guidance, and to establish internal procedures so cleared employees know to report to the FSO.

The reports fall into groups:

• To the FBI. Under 117.8(b), information about actual, probable, or possible espionage, sabotage, terrorism, or subversive activity at any of the contractor's locations. A phone report must be followed in writing, and the CSA gets a copy.
• To the CSA about people. Adverse information about cleared employees, with a prohibition on reports based on rumor or innuendo. Suspicious contacts, including any effort to elicit information from a cleared employee or any contact suggesting targeting by a foreign intelligence service. Changes in status such as death, name change, termination, or change in citizenship. Refusal to sign the SF 312 nondisclosure agreement.
• To the CSA about the company. Changed conditions under 117.8(c)(7): a change of ownership or control, operating name or address, any change to KMP, bankruptcy or an action to terminate operations, and any material change in FOCI, reported on an updated SF 328, Certificate Pertaining to Foreign Interests. Changes in storage capability, emergencies that prevent safeguarding, problems at a prime or subcontractor, and classified dealings with foreign interests outside government channels.
• Loss or compromise. Under 117.8(d), a preliminary inquiry begins immediately, an initial report follows promptly if the inquiry confirms a loss, and a final report closes the case with corrective and disciplinary action.
• Cyber incidents. Under 117.8(f), cleared defense contractors report cyber incidents on classified covered information systems to the DoD CSO.

SEAD 3 is the Security Executive Agent's directive on reporting by everyone with access to classified information. Dated December 2016 and effective June 12, 2017, it says covered individuals, expressly including contractors, subcontractors, licensees, grantees, and consultants, incur a "special and continuing security obligation" to be aware of the risks of foreign intelligence operations, and a responsibility to recognize and avoid personal behavior that could affect their eligibility. Section F applies to everyone: unofficial foreign travel is reported in advance and approved, with deviations reported within 5 business days of return; unofficial contact with a known or suspected foreign intelligence entity and continuing association with foreign nationals involving bonds of affection, obligation, or intimate contact are reported; and certain conduct by other covered individuals is reported. Sections G and H add items by level, such as foreign passports and arrests for Secret holders, and foreign bank accounts, foreign property, and voting in a foreign election for Top Secret holders. The 2020 rule made all of that a NISPOM requirement.

Facility clearances, personnel clearances, and FOCI

Three sections cover eligibility. Section 117.9 governs the entity eligibility determination, which most CSAs call a facility clearance (FCL). A contractor cannot apply for its own; a GCA or a cleared contractor sponsors it, and this can happen during the solicitation phase. The entity must be organized under U.S., state, territorial, or qualifying tribal law, be located in the United States or its territories, have a record of integrity and lawful conduct, have a cleared SMO, FSO, and ITPSO, and not be under FOCI to a degree inconsistent with the national interest. An FCL stays in effect until terminated or revoked. The separate post on how a company gets a facility clearance walks through the process.

Section 117.10 governs personnel clearances (PCLs): the CSA determines eligibility under SEAD 4, and access requires need-to-know, eligibility at the right level, and a signed nondisclosure agreement.

Section 117.11 governs foreign ownership, control, or influence. An entity is under FOCI when a foreign interest has the power to direct or decide issues affecting its management or operations in a way that could result in unauthorized access to classified information or adversely affect classified contract performance. The entity completes the SF 328 during the clearance process and when its answers change. Where FOCI arises from ownership, 117.11(d)(2) lists the mitigation methods: a board resolution, a security control agreement, a special security agreement, a voting trust, or a proxy agreement, in rising order of how much the foreign owner gives up.

Safeguarding, visits, and information systems

Section 117.15 is the storage chapter. Contractors store classified material in General Services Administration (GSA)-approved security containers, in vaults built to Federal Standard 832, or in open storage areas built to 32 CFR 2001.53, and follow 32 CFR 2001.43 for the controls each level requires. Intrusion detection systems used as supplemental protection for Top Secret and Secret material need CSA approval before installation and must be activated at the close of business whenever cleared personnel are not present. The section also sets end-of-day security checks, perimeter controls, Top Secret accountability, working-paper rules, transmission, destruction, retention limits, and the rules for disclosing classified information to employees, subcontractors, and the public. The companion post on SCIFs, closed areas, and restricted areas covers the storage spaces in detail.

Section 117.16 keeps classified visits to a minimum and requires the host to verify a visitor's clearance through a CSA-designated database or a visit authorization letter. Section 117.18 requires the CSA to authorize any information system before it processes classified information, with the ISSM certifying in writing that the system security plan is implemented.

Self-inspections and security reviews

Oversight runs in two directions. Under 117.7(h)(1), the CSA conducts recurring security reviews, normally announced but sometimes not, and participation is a condition of keeping the facility clearance. Under 117.7(h)(2), the contractor conducts a formal self-inspection at least annually, covering classified activity, classified information, classified information systems, the overall program, and the insider threat program. The contractor writes a formal report and retains it until the next CSA review, and the SMO certifies annually in writing that the inspection was done, other KMP were briefed, and corrective actions were taken.

Section 117.12 supplies the training that supports both: an initial briefing before access, annual insider threat awareness training, refresher training every 12 months, derivative classification training at least every 2 years, and debriefings when access ends.

SCI, special access programs, and international work

Section 117.23 is the supplement for information whose requirements exceed the baseline: alternative compensatory control measures, special access programs (SAPs), SCI, Restricted Data, Formerly Restricted Data, Transclassified Foreign Nuclear Information, and Naval Nuclear Propulsion Information. These requirements apply through specific contract terms, and accepting them is a prerequisite to program participation and to an area accreditation such as an SCI facility or SAP facility accreditation. For SCI, 117.23(b) says contractors follow Intelligence Community directives, standards, and specifications, which is why a contractor's SCIF is accredited under ICD 705 rather than under the NISPOM alone.

Section 117.19 carries the international rules: foreign government information, NATO information handled through the Central U.S. Registry, and the exemptions under the U.S. defense trade treaties with the United Kingdom and Australia.

What to check

• Which CSA has cognizance over the facility, and whether the contract clause points to 32 CFR Part 117 or still cites DoD 5220.22-M.
• Who the FSO and ITPSO are, whether they are the same person, and whether the KMP list on file matches the company's current officers and owners.
• Whether the facility has an approved classified information safeguarding capability under 117.15, or an FCL only. Software that needs to run on classified material needs a place that may hold it.
• Whether any information system that would host new software has a CSA authorization under 117.18 and an ISSM who will own the change.
• Whether the work touches 117.23 categories, such as SCI or a SAP, which bring their own accreditation and contract terms.
• When the last self-inspection report and SMO certification were completed, and what the open corrective actions are.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What does NISPOM stand for?

NISPOM stands for National Industrial Security Program Operating Manual. The National Industrial Security Program (NISP) was created by Executive Order 12829 on January 6, 1993 to safeguard classified information released to contractors, licensees, and grantees. Section 201 of that order told the Secretary of Defense to issue and maintain an operating manual for the program. Since February 24, 2021 the manual has been a regulation, 32 CFR Part 117, rather than a Department of Defense publication.

What is the NISPOM rule?

The NISPOM rule is the name DCSA and industry use for 32 CFR Part 117. The Department of Defense published it as a final rule in the Federal Register on December 21, 2020, and it took effect on February 24, 2021. The rule codified the NISPOM in the Code of Federal Regulations, added the reporting requirements of Security Executive Agent Directive 3, and dropped the national interest determination requirement for certain National Technology and Industrial Base entities under a special security agreement.

Is 32 CFR 117 the same thing as the NISPOM?

Yes. 32 CFR Part 117 is titled National Industrial Security Program Operating Manual (NISPOM), and the NISPOM name appears in its title and acronym list, while the text itself mostly calls it this rule. The earlier NISPOM was DoD 5220.22-M, a manual issued by the Department of Defense. The 2020 final rule says that upon the rule's effective date, February 24, 2021, DoD would no longer publish the manual as a DoD policy issuance, so the regulation is now the only current NISPOM.

What was NISPOM Change 2?

The Federal Register final rule gives the history: the NISPOM was first published in 1995, Conforming Change 1 was issued on March 28, 2013, and NISPOM Change 2 followed in May 2016. Change 2 was the last edition of DoD 5220.22-M and the version in force when 32 CFR Part 117 replaced it on February 24, 2021.

What are the FSO responsibilities under the NISPOM?

Under 32 CFR 117.7(b)(3), the facility security officer supervises and directs the security measures needed to implement the rule and related government security requirements, and completes the training the cognizant security agency requires. The FSO must be a U.S. citizen employee, must be designated in writing by the senior management official, must hold eligibility at the facility clearance level, and is on the key management personnel list. 32 CFR 117.12(d) requires FSO training within 6 months of appointment.

Who enforces the NISPOM?

The cognizant security agencies do. 32 CFR 117.3 names five: the Department of Defense, the Department of Energy, the Nuclear Regulatory Commission, the Office of the Director of National Intelligence, and the Department of Homeland Security. Each may delegate day-to-day work to a cognizant security office. For DoD, 32 CFR 117.6(b) names the Defense Counterintelligence and Security Agency as the cognizant security office, and DCSA also serves the agencies that have signed industrial security agreements with DoD.

What does DCSA do under the NISPOM?

32 CFR 117.6(b) says the Director of DCSA oversees DCSA as the DoD cognizant security office, administers the NISP on behalf of DoD contracting activities and the agencies with DoD agreements, and provides security oversight of cleared contractors. DCSA's own page says it administers the program for DoD and 35 other federal agencies and oversees approximately 12,500 cleared contractor facilities. DCSA conducts the recurring security reviews described in 32 CFR 117.7(h).

What must a contractor report under 32 CFR 117.8?

32 CFR 117.8 requires reports to the FBI of actual, probable, or possible espionage, sabotage, terrorism, or subversive activity, with a copy to the cognizant security agency. Reports to the CSA cover adverse information about cleared employees, suspicious contacts, changes in employee status, changed conditions such as a change in ownership or key management personnel, changes in storage capability, and any loss, compromise, or suspected compromise. Section 117.8(a) also incorporates the reportable activities in SEAD 3.

How does SEAD 3 fit into the NISPOM?

Security Executive Agent Directive 3, issued in December 2016 and effective June 12, 2017, sets reporting requirements for everyone with access to classified information, including contractors. The 2020 final rule says it incorporated SEAD 3 so that cleared contractor employees report activities such as unofficial foreign travel and foreign contacts. 32 CFR 117.8(a) cites SEAD 3 directly. An August 19, 2021 amendment gave DoD-cognizant contractors until August 24, 2022 to begin foreign travel reporting to DoD.

How often does a cleared contractor have to do a self-inspection?

32 CFR 117.7(h)(2) requires a formal self-inspection at least annually, and more often where risk warrants it. The self-inspection covers classified activity, classified information, classified information systems, the overall security program, and the insider threat program, and it samples the contractor's derivative classification actions. The contractor writes a formal report and keeps it until the next government security review. The senior management official certifies annually, in writing, that the self-inspection was done and corrective actions were taken.

Sources

1. 132 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) · U.S. Government Publishing Office, GovInfo
2. 2National Industrial Security Program Operating Manual (NISPOM), Final Rule, 85 FR 83300 · Federal Register, via GovInfo
3. 3National Industrial Security Program Operating Manual (NISPOM); Amendment, 86 FR 46597 · Federal Register, via GovInfo
4. 432 CFR Part 2004, National Industrial Security Program · U.S. Government Publishing Office, GovInfo
5. 5Executive Order 12829, National Industrial Security Program · National Archives and Records Administration, Information Security Oversight Office
6. 6Security Executive Agent Directive 3, Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position · Office of the Director of National Intelligence
7. 7National Industrial Security Program Oversight · Defense Counterintelligence and Security Agency

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.