Contractor security officials and key management

← All Insights

1. The basic duty

Under the National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, contractors protect all classified information they are given access to or possess (32 CFR 117.7(a)). The responsibility applies at both contractor and U.S. Government locations. In the rule, a contractor is an industrial, educational, commercial or other entity that a cognizant security agency (CSA) has granted an entity eligibility determination (32 CFR 117.3). The term does not refer to contractor employees.

Contractors appoint security officials who are U.S. citizens, except in exceptional circumstances (32 CFR 117.7(b)). The rule names a senior management official (SMO), a facility security officer (FSO) and an insider threat program senior official (ITPSO). Contractors that process classified information on an information system located at the contractor facility also appoint an information system security manager (ISSM).

2. What every appointed official must do

The SMO, the FSO and the ITPSO each oversee the implementation of the rule’s requirements (32 CFR 117.7(b)(1)(i)). Depending on the size and complexity of the contractor’s security operations, one employee may serve in more than one position. Each undergoes the same security training as all other contractor employees, in addition to position-specific training (32 CFR 117.7(b)(1)(ii)).

Each is designated in writing, with the designation documented under CSA guidance (32 CFR 117.7(b)(1)(iii)). Each also undergoes a personnel security investigation and an eligibility determination at the level of the entity’s own eligibility, such as its facility clearance (FCL) level (32 CFR 117.7(b)(1)(iv)). Each must be on the key management personnel (KMP) list for the cleared entity.

3. The senior management official

The SMO is the contractor’s official responsible for entity policy and strategy (32 CFR 117.3). The SMO holds ultimate authority over the facility’s operations and can direct the actions needed to safeguard classified information. That authority includes cases where employees access classified information only at other contractor facilities or government locations.

The SMO ensures the contractor maintains a system of security controls that meets the rule (32 CFR 117.7(b)(2)(i)). The SMO appoints one or more employees in writing as the FSO and the ITPSO, and may use one person for both roles or two different people (32 CFR 117.7(b)(2)(ii)). The SMO remains fully informed of the facility’s classified operations (32 CFR 117.7(b)(2)(iii)).

Decisions are based on classified threat reporting and a thorough understanding of the threat and the potential impact of a loss of classified information (32 CFR 117.7(b)(2)(iv)). The SMO retains accountability for the management and operations of the facility and does not delegate it to a subordinate manager (32 CFR 117.7(b)(2)(v)).

4. The FSO, the ITPSO and the ISSM

The FSO supervises and directs the security measures needed to implement the rule and related government security requirements (32 CFR 117.7(b)(3)(i)). The FSO completes security training under the training section and as the CSA considers appropriate (32 CFR 117.7(b)(3)(ii)).

The ITPSO establishes and executes an insider threat program (32 CFR 117.7(b)(4)). If the ITPSO is not also the FSO, the ITPSO ensures the FSO is an integral member of the program (32 CFR 117.7(b)(4)(i)). An entity family may set up a family-wide program with one senior official as ITPSO (32 CFR 117.7(b)(4)(iii)). Each cleared entity using that official must separately appoint the person for its facility, and the ITPSO gives the CSA an implementation plan for the whole family.

The ISSM must be eligible for access at the highest level of information processed on the systems under the ISSM’s responsibility (32 CFR 117.7(b)(5)). The contractor ensures the ISSM is adequately trained and technically competent for the complexity of its classified system, and notifies the CSA of any change in the ISSM. Other employees and consultants who perform security functions complete training tailored to those functions (32 CFR 117.7(b)(6)).

5. Other key management personnel

KMP means the SMO, the FSO, the ITPSO and certain other entity officials (32 CFR 117.3). They are officials who hold majority interest or stock in the entity, or who have direct or indirect authority to influence or decide issues affecting its management, operations or classified contract performance (32 CFR 117.3). Subject to CSA concurrence, the contractor puts those other officials on the KMP list (32 CFR 117.7(c)).

The CSA may then take one of two approaches. It may require those officials to be found eligible for access as a condition of the entity’s own eligibility (32 CFR 117.7(c)(1)). Or it may allow the entity to formally exclude them from access to classified information (32 CFR 117.7(c)(2)). The governing board affirms the exclusion by a formal action, documents it and gives a copy to the CSA.

The rule provides model language for two kinds of exclusion. One excludes the named official from all classified information disclosed to the entity. The other excludes the official only from SECRET or TOP SECRET information. In both, the board affirms that the official will not require or have the access and does not occupy a position that would allow them to adversely affect the organization’s policies or practices on classified contracts.

6. Insider threat programs and written procedures

The contractor establishes and maintains an insider threat program to gather, integrate and report information indicating a potential or actual insider threat (32 CFR 117.7(d)). The program is consistent with Executive Order 13587 and the presidential memorandum on national insider threat policy and minimum standards. An insider is cleared contractor personnel with authorized access to any government or contractor resource (32 CFR 117.3). An insider threat is the risk that an insider will use that access, wittingly or unwittingly, to harm U.S. national security.

The contractor implements all applicable provisions of the rule at each cleared facility location (32 CFR 117.7(e)). Written procedures are prepared when the CSA finds them necessary to reasonably exclude the possibility of loss or compromise of classified information. Contractor employees working inside a government facility follow the host installation’s or agency’s procedures (32 CFR 117.7(i)). Government reviews and self-inspections are covered in security reviews and self-inspections.

Key terms

SMO	The official with ultimate authority over the facility’s operations.
FSO	The official who supervises and directs security measures.
ITPSO	The official who runs the insider threat program.
KMP	Key management personnel, including majority owners and officials with authority over operations.
Exclusion resolution	A board action that formally excludes an official from classified access.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Clear security roles make cleared operations workable. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.