Classified visits and meetings

← All Insights

1. When the visit rules apply

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, has separate rules for visits and meetings. The visit rules apply when classified information is expected to be disclosed, for a lawful and authorized U.S. Government purpose, during a visit to a cleared contractor facility or a government facility (32 CFR 117.16(a)). Classified visits are held to a minimum (32 CFR 117.16(a)(1)).

The contractor must decide that the visit is necessary and that its purpose cannot be achieved without access to or disclosure of classified information (32 CFR 117.16(a)(1)(i)). It sets procedures to ensure positive identification of visitors, the right personnel clearance and need-to-know before any disclosure (32 CFR 117.16(a)(1)(ii)). It also ensures visitors get access only to information consistent with the purpose of the visit (32 CFR 117.16(a)(1)(iii)).

2. Who decides need-to-know

The person who will disclose classified information during the visit is responsible for deciding need-to-know (32 CFR 117.16(a)(2)). It is generally based on a contractual relationship between the contractors. In other cases, it rests on an assessment that the receiving contractor has a bona fide need for the information in furtherance of a government contracting activity (GCA) purpose. Government inspectors, investigators and auditors acting in their official capacity may visit a contractor facility if they present appropriate government credentials on arrival (32 CFR 117.16(a)(3)).

3. Verifying clearances and the visit authorization letter

If the visit requires access to classified information, the host contractor verifies the visitor’s personnel clearance level (32 CFR 117.16(a)(4)(i)). It may do so through a database designated by the cognizant security agency (CSA), or through a visit authorization letter (VAL) from the visitor’s employer.

Where no CSA database is available and a VAL is required, it includes the contractor’s name, address and telephone number, its commercial and government entity code if applicable, and certification of its entity eligibility level (32 CFR 117.16(a)(4)(ii)). It gives the visiting employee’s name, date and place of birth and citizenship, and certifies the visitor’s clearance and any special access authorizations needed. It names the people to be visited, states the purpose with enough justification to judge the visit’s necessity, and gives the dates or period of validity.

4. Long-term visitors

When government employees or another contractor’s employees are temporarily stationed at a contractor facility, the host contractor’s security procedures govern (32 CFR 117.16(a)(5)(i)). Government personnel assigned to or visiting a contractor facility to oversee an acquisition program keep control of their work product (32 CFR 117.16(a)(5)(ii)). Their classified work products are handled under the rule, and contractor procedures may not require them to give up control of their work, classified or not. Contractor employees at government installations follow the host’s security requirements, but the contractor keeps security oversight of them (32 CFR 117.16(a)(5)(iii)).

5. Classified meetings

A meeting is any conference, seminar, symposium, exhibit, convention, training course or similar gathering at which classified information is disclosed (32 CFR 117.16(b)). The rule notes that disclosure to large, diverse audiences increases security risks. Disclosure may occur when it serves a government purpose and adequate security measures are in place in advance.

A meeting conducted by a cleared contractor is authorized by a government agency that agrees to assume security jurisdiction (32 CFR 117.16(b)(1)). The agency must approve the security arrangements, announcements, attendees and location, and may delegate some responsibilities to the contractor under its general supervision.

Requests go to the agency with principal interest in the subject (32 CFR 117.16(b)(2)). They explain the government purpose served and why conventional release channels will not advance it. They give the subject, the scope and level of classified topics, the dates and location, and the general content of the announcement. They identify any other non-government organization involved and its support, list any proposed foreign attendees with nationality and affiliation, and describe the security arrangements.

6. Location, announcements and attendance

Classified sessions are held only at a government installation or a cleared contractor facility with approved physical security and procedural controls, and the authorizing agency approves the location (32 CFR 117.16(b)(3)). Announcements are unclassified, approved by the agency, and limited to a general description of topics, speakers and administrative instructions (32 CFR 117.16(b)(4)(i)). They do not solicit classified presentations. Once the meeting is approved, an announcement may state only that the agency has authorized classified sessions and will provide security assistance. It also says that clearances and justifications for attending go to the authorizing agency or its designee. Invitations to foreign persons are sent by the authorizing agency.

Every attendee at a classified session must have the required clearance and need-to-know (32 CFR 117.16(b)(4)(ii)). The authorizing agency or its designee decides need-to-know from the justification provided. Attendance is authorized only for people whose clearance and justification the security officer of their own organization has verified. Names appear on an access list, and entry follows verification of identity by official photographic identification, such as a passport or a contractor or government identification card.

7. Presentations and disclosure authority

Classified information must be authorized for disclosure in advance by the agency with jurisdiction over it (32 CFR 117.16(b)(4)(iii)). Presenters give enough classification guidance for attendees to identify what is classified and at what level. Presentations are oral or visual, copies of classified materials are not distributed, and classified notes or recordings are safeguarded under the rule. Physical security measures control access and provide secure storage if needed (32 CFR 117.16(b)(4)(iv)).

Each contractor that wants to disclose classified information at a meeting obtains prior written authorization for each disclosure and gives a copy to the sponsoring agency (32 CFR 117.16(b)(5)). Associations are not responsible for checking other organizations’ approvals. Before an employee attends, the contractor gives the authorizing agency a justification, citing the contract or program involved (32 CFR 117.16(b)(6)). Disclosure rules more generally are covered in disclosure, disposition and retention of classified material.

Key terms

Classified visit	A visit at which classified information is expected to be disclosed.
VAL	A visit authorization letter from the visitor’s employer.
Long-term visitor	A person temporarily stationed at another organization’s facility.
Classified meeting	A conference or similar gathering where classified information is disclosed.
Security jurisdiction	The authorizing agency’s responsibility for a contractor-run meeting.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Site visits are routine in program support. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.