Changed conditions and loss or compromise reports

← All Insights

1. Changed conditions

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, requires contractors to report events about the entity itself, not only about its people. Contractors report events that affect the status of the entity eligibility determination, such as a facility clearance, or an employee’s personnel clearance (32 CFR 117.8(c)(7)). The same applies to events that may indicate an insider threat, affect proper safeguarding, or indicate that classified information has been lost or compromised.

The listed events include a change of ownership or control, including stock transfers that affect control of the entity (32 CFR 117.8(c)(7)(i)). They include a change of operating name or address of the entity or any of its cleared locations (32 CFR 117.8(c)(7)(ii)). They also include any action to terminate business or operations, an imminent adjudication or reorganization in bankruptcy, or any change that might affect the validity of the entity’s eligibility (32 CFR 117.8(c)(7)(iv)).

2. Key management changes

Any change to the information previously submitted on key management personnel (KMP) is reported, including, as appropriate, the names of the individuals being replaced (32 CFR 117.8(c)(7)(iii)). A new complete KMP listing is needed only at the contractor’s discretion or when the cognizant security agency (CSA) requests it. The contractor states whether each new official is cleared and, if so, to what level and when (32 CFR 117.8(c)(7)(iii)(A)). It also gives dates and places of birth, social security numbers and citizenship.

The statement also says whether the new officials have been excluded from access to classified information (32 CFR 117.8(c)(7)(iii)(B)). It says whether they have been temporarily excluded pending their own eligibility determination (32 CFR 117.8(c)(7)(iii)(C)).

3. Foreign ownership, control or influence

Any material change in information previously reported about foreign ownership, control or influence (FOCI) is reported by submitting an updated SF 328, the Certificate Pertaining to Foreign Interests (32 CFR 117.8(c)(7)(v)). Answers that have not changed need not be repeated. When the contractor enters into discussions, consultations or agreements that may reasonably lead to effective ownership or control by a foreign interest, it reports the details to the CSA in writing. If it has received a Schedule 13D from the investor, it forwards a copy with the report.

4. Storage, subcontractors and foreign material

The contractor reports any change in its storage requirement or its capability to safeguard classified material (32 CFR 117.8(c)(8)). It reports as soon as possible any emergency that leaves a location unable to safeguard classified material (32 CFR 117.8(c)(9)). Prime contractors report information suggesting that a subcontractor cannot adequately protect classified information, or that may affect the subcontractor’s eligibility (32 CFR 117.8(c)(10)(i)). Subcontractors report the same kind of information about their prime contractor (32 CFR 117.8(c)(10)(ii)).

A report is made when material previously terminated from accountability is later found and brought back into accountability (32 CFR 117.8(c)(11)). Contractors report any pre-contract negotiation or award not placed through a CSA or a U.S. government contracting activity that may involve release of U.S. classified information to a foreign interest (32 CFR 117.8(c)(12)). The same applies where it may involve access to classified information furnished by a foreign interest. Receipt of classified material from foreign interests outside government channels is reported to the CSA (32 CFR 117.8(c)(13)). Subcontractors notify their prime contractors when they make reports on changed conditions, storage, emergencies or unsatisfactory conditions (32 CFR 117.8(c)(14)).

5. Loss, compromise or suspected compromise

The contractor reports any loss, compromise or suspected compromise of classified information, U.S. or foreign, to the CSA (32 CFR 117.8(d)). Each CSA may give additional guidance on the reporting period. A contractor located on a government facility reports to the CSA and to the head of the facility.

Immediately on receiving a security violation report, the contractor starts a preliminary inquiry into all the circumstances, including validation of the classification of the information (32 CFR 117.8(d)(1)). If the inquiry confirms a loss, compromise or suspected compromise, the contractor promptly submits an initial report unless the CSA says otherwise (32 CFR 117.8(d)(2)).

When the investigation is complete, a final report goes to the CSA, which follows its procedures to notify the government contracting activity (32 CFR 117.8(d)(3)). The final report covers material information not in the initial report, and the full name and social security number of each individual primarily responsible, with any prior record of responsibility for such incidents. It also states the corrective action taken to prevent a recurrence, any disciplinary action, and the specific reasons for concluding that a loss or compromise did or did not occur. When the CSA requests it, the contractor reports information about a responsible employee needed for the case (32 CFR 117.8(d)(4)).

6. Cyber incident reports by cleared defense contractors

A cleared defense contractor is a contractor cleared under the program that has classified contracts with the Department of Defense (DoD) (32 CFR 117.3). For these contractors, the rule adds cyber incident reporting under 10 U.S.C. 391 and 393 and Defense Federal Acquisition Regulation Supplement clause 252.204-7012 (32 CFR 117.8(f)). The contractor immediately reports to the DoD cognizant security office any cyber incident on a classified covered information system that the office approved to process classified information (32 CFR 117.8(f)(1)).

The report includes, at a minimum, the technique or method used, a sample of any malicious software discovered and isolated, and a summary of DoD program information potentially compromised (32 CFR 117.8(f)(1)(i)). Incidents involving classified foreign government information go to the Director of the Defense Technology Security Administration (32 CFR 117.8(f)(1)(iii)). Incidents on unclassified, non-federal systems are reported as the contract requires (32 CFR 117.8(f)(2)).

On request, the contractor gives DoD personnel access to equipment or information needed for forensic analysis (32 CFR 117.8(f)(3)(i)). That access is required only to determine whether information created by or for DoD was exfiltrated, and what was taken (32 CFR 117.8(f)(3)(ii)). Reports about individual employees are covered in reporting duties for cleared contractors.

Key terms

Changed condition	An event that may affect the entity’s eligibility for access.
SF 328	The Certificate Pertaining to Foreign Interests.
Preliminary inquiry	The first step after a security violation report.
Final report	The report to the CSA once the investigation is complete.
Cleared defense contractor	A cleared contractor with classified DoD contracts.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Changes in a company's situation must reach the security office quickly. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.