Controlling and transmitting classified information

← All Insights

1. Information management

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, requires two basic controls over classified holdings. Contractors set up a system to verify that classified information in their custody is used or retained only for a lawful and authorized U.S. Government purpose (32 CFR 117.15(e)(1)(i)). They also set up an information management system to protect and control classified information in their possession in any medium, including information on authorized information systems (32 CFR 117.15(e)(1)(ii)).

2. Extra controls for TOP SECRET

TOP SECRET information and material receive additional controls on accountability, need-to-know and retention, in any medium, unless the cognizant security agency (CSA) directs otherwise (32 CFR 117.15(e)(2)). These controls apply in addition to the information management system. The rule gives one example of a validated procedure: showing that TOP SECRET material stored electronically on an authorized classified system need not be individually numbered in series.

Unless the CSA directs otherwise, contractors designate TOP SECRET control officials to receive, transmit and maintain access and accountability records (32 CFR 117.15(e)(2)(i)). They conduct an annual inventory and use a continuous receipt system for transmittals within and outside the contractor location (32 CFR 117.15(e)(2)(ii) and 32 CFR 117.15(e)(2)(iii)). Each item is numbered in a series, with the copy number on the document and on associated transaction documents (32 CFR 117.15(e)(2)(iv)).

A record is made when TOP SECRET material is completed as a finished document, retained more than 180 days after creation, or transmitted outside the contractor location (32 CFR 117.15(e)(2)(v)). Destruction is carried out by two authorized persons (32 CFR 117.15(e)(2)(vi)). Destruction records are kept for two years, or as the government contracting activity (GCA) requires (32 CFR 117.15(e)(2)(vii)).

3. Working papers, combinations and passwords

Contractors control classified working papers generated in preparing a finished document (32 CFR 117.15(e)(3)). Working papers are dated when created and marked on each page with the highest classification of their contents and the annotation “WORKING PAPERS.” They are destroyed when no longer needed. If released outside the contractor location or kept more than 180 days, they are marked like a finished document at the same level.

Lock combinations follow 32 CFR 2001.45(a)(1) and 2001.43(c) on when combinations are changed (32 CFR 117.15(e)(4)). A combination is protected at the level of the highest classified information the vault, open storage area or container protects. Passwords to classified information systems are protected at the highest level the system is authorized for, under 32 CFR 2001.45(a)(2) (32 CFR 117.15(e)(5)). Reproduction follows 32 CFR 2001.45(b) (32 CFR 117.15(e)(6)).

4. Transmission rules

Contractors set procedures for transmitting and receiving classified material under 32 CFR 2001.46 (32 CFR 117.15(f)). Sending TOP SECRET material outside the contractor location needs written GCA authorization (32 CFR 117.15(f)(1)). Classified material may go to a government activity outside the United States or its territorial areas only under a classified contract or with written GCA authorization (32 CFR 117.15(f)(2)).

Commercial delivery is possible for SECRET or CONFIDENTIAL material within the United States and its territorial areas, with CSA approval (32 CFR 117.15(f)(3)). The entity must hold the General Services Administration (GSA) overnight delivery contract and offer nationwide overnight service with computer tracking (32 CFR 117.15(f)(3)). Such entities need no eligibility determination. Before approval, the contractor documents procedures for incoming and outgoing packages, including the street delivery address (32 CFR 117.15(f)(3)(i)). The procedures ensure package integrity and receipt by cleared personnel, and the method is not used for communications security, North Atlantic Treaty Organization or foreign government information (32 CFR 117.15(f)(3)(ii)).

5. Couriers and air travel

Contractors may designate cleared employees as couriers or hand carriers (32 CFR 117.15(f)(4)). They brief them on their responsibility to safeguard classified information and keep it in their possession at all times. Each carrier receives an identification card or badge with the contractor’s name and the employee’s name and photograph. The contractor also arranges overnight storage at a government installation or cleared facility if needed. They inventory the material before departure and on return, and the employee carries a copy of the inventory.

Cleared employees may be authorized to hand carry classified material aboard commercial passenger aircraft (32 CFR 117.15(f)(5)). They are subject to routine screening, and packages are normally screened by x-ray (32 CFR 117.15(f)(5)(i)). If asked to open a package, the traveler explains that it contains U.S. Government classified information and cannot be opened. The material may not be opened unless customs or other government officials require it. The contractor contacts the airline in advance for special screening where routine processing could compromise the material, visual examination may be needed, or specialized containers are used (32 CFR 117.15(f)(5)(ii)).

The traveler carries a written authorization (32 CFR 117.15(f)(5)(iii)). It gives the traveler’s full name, date of birth, height, weight and signature, with a statement that the traveler is authorized to transmit classified material. It describes the identification the traveler will present and the material carried, with a request that it be exempt from opening. It also identifies the departure, destination and known transfer points, and gives the name, telephone number and signature of the facility security officer and the CSA’s location and telephone number.

6. Escorts and destruction

If an escort is needed, the contractor assigns enough escorts for continuous surveillance and control in transit (32 CFR 117.15(f)(6)). Written instructions cover the recipients and alternates, receipting, transport means and route, each escort’s duties during movement, stops and loading, and emergency and communication procedures.

Classified material is destroyed under the disposition instructions in the contract security classification specification or equivalent (32 CFR 117.15(g)(1)). Destruction follows 32 CFR 2001.47, with equipment meeting 32 CFR 2001.42(b) (32 CFR 117.15(g)(2)). For more detail, the rule points to National Security Agency media destruction guidance and any guidance the CSA provides. Storage and alarm standards are covered in storing classified material and alarm systems.

Key terms

Information management system	The contractor’s system to protect and control classified holdings.
TOP SECRET control official	The person who keeps TOP SECRET accountability records.
Working papers	Material generated while preparing a finished document.
Hand carrier	A cleared employee who personally carries classified material.
Escort	A person assigned to keep continuous control of a shipment.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Moving sensitive material safely is part of secure movement work. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.