Disclosure, disposition and retention of classified material

← All Insights

1. Disclosure only to authorized persons

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, requires contractors to set up processes so that classified information is disclosed only to authorized persons (32 CFR 117.15(h)). Contractors may disclose it to their cleared employees who have the right eligibility and a need-to-know, including cleared employees across a multiple facility organization (32 CFR 117.15(h)(1)). The disclosure must be necessary to perform tasks or services essential to a classified contract or subcontract.

2. Subcontractors, parents and subsidiaries

Contractors may disclose classified information to a cleared subcontractor with the appropriate entity eligibility determination, also known as a facility security clearance, and a need-to-know (32 CFR 117.15(h)(2)(i)). Access must be necessary for tasks essential to the prime contract or subcontract, and the contractor conveys classification guidance with the subcontract. The cognizant security agency (CSA) must have found the subcontractor eligible at the same or a higher level than the information disclosed (32 CFR 117.15(h)(2)(ii)). If material is physically transferred, the CSA must also have approved storage at the subcontractor location.

The same structure applies between parent and subsidiary entities (32 CFR 117.15(h)(3)). Both must hold appropriate determinations at the same or a higher level than the information, with a need-to-know, and classification guidance goes with the agreement or procurement action. Approved storage is needed at both if material is physically transferred.

3. Agencies, foreign persons and other contractors

Contractors do not disclose classified information received or generated under one agency’s contract to another federal agency unless the agency with classification jurisdiction specifically authorizes it (32 CFR 117.15(h)(4)). They do not disclose it to foreign persons unless the contract specifies it and the agency with jurisdiction authorizes the release in writing (32 CFR 117.15(h)(5)). For Restricted Data and Formerly Restricted Data that is the Department of Energy. For communications security information it is the National Security Agency, and for Sensitive Compartmented Information the Director of National Intelligence.

Disclosure to another contractor is limited to furthering a contract, subcontract or other government contracting activity (GCA) purpose (32 CFR 117.15(h)(6)). Otherwise it needs GCA authorization where the contract requires it.

4. Litigation

Contractors do not disclose classified information to attorneys hired solely to represent them in civil or criminal cases in federal or state courts, unless the agency with jurisdiction specifically authorizes it (32 CFR 117.15(h)(7)(i)). Nor do they disclose it to any federal or state court except on specific instructions from that agency or from the attorney representing the United States in the case (32 CFR 117.15(h)(7)(ii)).

5. Public release

Classified information is never disclosed to the public (32 CFR 117.15(h)(8)). Unclassified information about a classified contract is not released to the public without prior review and clearance as the contract security classification specification or the GCA specifies. That includes material intended for unclassified brochures, promotional sales literature, reports to stockholders and similar documents.

Requests go through the activity named in the contract’s classification guidance (32 CFR 117.15(h)(8)(i)). Each request gives the approximate release date and identifies the media for the initial release. The contractor keeps each approved request for one inspection cycle for CSA review, and clears information developed later before releasing it.

Unless the GCA prohibits it, no approval is needed for certain facts (32 CFR 117.15(h)(8)(ii)). They include the fact that a contract has been received, with its subject in general terms if the subject is not classified, and the method or type of contract. They also include the total dollar amount, unless it reveals a level of effort in a sensitive research area or classified quantities of weapons and equipment. Whether the contract requires hiring or terminating employees, information approved case by case, and information already officially approved for release are also included.

Declassified information is not thereby authorized for public release (32 CFR 117.15(h)(8)(iii)). If it is commingled with, or qualifies as, controlled unclassified information (CUI), it is protected as CUI until decontrolled and reviewed for release. Otherwise it is protected under the basic safeguarding requirements of 48 CFR 52.204-21 and the agency’s release procedures.

6. Disposition of holdings

Contractors review their classified holdings on a recurring basis to confirm they support a current contract or an authorization to retain (32 CFR 117.15(i)(1)). Duplicate copies are destroyed as soon as practical (32 CFR 117.15(i)(2)). Two 180-day limits apply to classified material received with a bid, proposal or quote (32 CFR 117.15(i)(3)(i)). The rule ties return or destruction to a bid that is not submitted or is withdrawn, measured from the opening date, and to a bid that is not accepted, measured from the notice of non-acceptance (32 CFR 117.15(i)(3)(i)). Material not received under a specific contract, such as from classified meetings, is returned or destroyed within one year after receipt (32 CFR 117.15(i)(3)(ii)).

7. Retention beyond two years

To keep copies beyond 2 years after a contract, the contractor identifies the material (32 CFR 117.15(j)(1)). TOP SECRET material is listed document by document unless the GCA allows identification by subject and approximate number. SECRET and CONFIDENTIAL material may be identified by general subject and approximate number. A justification shows that the material is needed for essential records, is patentable or proprietary data the contractor owns, will help independent research and development, or will benefit the government on other contracts.

If the GCA does not authorize retention, the contractor destroys the material unless it has been declassified or the GCA asks for its return (32 CFR 117.15(j)(2)). If the CSA terminates the contractor’s eligibility, all classified material is returned to the GCA or disposed of as the CSA instructs (32 CFR 117.15(k)). Where a classified contract also includes CUI protection provisions, contractors comply with them even though they are outside the rule (32 CFR 117.15(l)). Destruction methods are covered in controlling and transmitting classified information.

Key terms

Need-to-know	A requirement for each disclosure, in addition to eligibility.
Classification jurisdiction	The agency whose authorization controls further disclosure.
Public release review	The clearance needed before releasing unclassified contract information.
Disposition	Returning or destroying classified holdings no longer needed.
Retention request	A justified request to keep material beyond two years.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Careful release of contract information protects clients and programs. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.