NATO information in U.S. industry

← All Insights

1. The source of the NATO rules

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, sets the security requirements for North Atlantic Treaty Organization (NATO) information provided to U.S. industry (32 CFR 117.19(g)(1)). They implement the procedures of the U.S. Security Authority for NATO Affairs Instruction 1-07. NATO has four classification levels (32 CFR 117.19(g)(2)). COSMIC TOP SECRET corresponds to Top Secret, NATO SECRET to Secret and NATO CONFIDENTIAL to Confidential. NATO RESTRICTED has no equivalent U.S. classification.

Under NATO regulations and the instruction, security accreditation of information systems that process only NATO RESTRICTED information may be delegated to contractors. The contractor then carries out the contract’s accreditation provisions and confirms to the contracting authority in writing that the system meets the minimum requirements of the contract security clause or security aspects letter. A separate marking, ATOMAL, applies to certain atomic information released to NATO, at the three higher levels (32 CFR 117.19(g)(3)).

2. NATO contracts and facility clearance certificates

Contracts for NATO-unique systems, programs or operations are awarded by a NATO Production and Logistics Organization, a designated NATO Management Agency, the NATO Research Staff or a NATO Command (32 CFR 117.19(g)(4)). For NATO infrastructure projects such as airfields or communications, the contract is awarded by a contracting agency or prime contractor of the responsible NATO nation.

A NATO facility security clearance certificate (FSCC) is required to negotiate or perform a NATO classified contract (32 CFR 117.19(g)(5)). A U.S. entity qualifies if it has an equivalent U.S. entity eligibility determination and its personnel have been briefed on NATO procedures. The cognizant security agency (CSA) provides the certificate to the requesting activity. An FSCC is not required for government contracting activity (GCA) contracts involving access to NATO classified information.

3. People and briefings

Access to NATO classified information requires a final determination of eligibility at the equivalent level (32 CFR 117.19(g)(6)). Before access, employees receive a NATO security briefing covering the requirements and the consequences of negligent handling (32 CFR 117.19(g)(7)). A CSA representative gives the contractor the initial briefing, and the contractor holds annual refreshers.

When access ends, employees are debriefed and sign a certificate acknowledging their responsibility for safeguarding NATO information (32 CFR 117.19(g)(7)(i)). Certificates are kept for two years for NATO SECRET and CONFIDENTIAL, and three years for COSMIC TOP SECRET and ATOMAL information (32 CFR 117.19(g)(7)(ii)). Briefings and debriefings are recorded in the CSA-designated database.

Nationals of non-NATO nations may have access only with the consent of the NATO Office of Security and the contracting activity, with requests sent to the Central U.S. Registry (CUSR) (32 CFR 117.19(g)(8)). Citizens of NATO members may have access if their government provides a NATO security clearance certificate and they have been briefed. Subcontracts on NATO contracts need prior written approval from the NATO contracting activity, requested through the CSA, and a NATO FSCC before award (32 CFR 117.19(g)(9)).

4. Preparing NATO documents

All classified documents a U.S. contractor creates are portion-marked, and an extract from an unmarked NATO document takes that document’s classification (32 CFR 117.19(g)(10)). U.S.-originated NATO classified documents bear a reference number and date on the first page. The number combines the contractor’s abbreviation, the abbreviated classification with a 4-digit sequence number for the year, and the year. COSMIC TOP SECRET, NATO SECRET and ATOMAL documents carry the reference number on each page and a copy number on the cover or first page, with numbered copies and pages and a list of annexes.

Guidance comes as a NATO security aspects letter and security requirements checklist, or a contract security classification specification (32 CFR 117.19(g)(11)). If it is inadequate, the contractor contacts the CSA. NATO information is not declassified or downgraded without the originating activity’s prior written consent, and recommendations go to the CUSR. It is not released to a third party or outside the facility without the contracting agency’s prior written approval (32 CFR 117.19(g)(12)).

5. Storage, transmission and reproduction

NATO documents are stored like U.S. documents of equivalent level, but not commingled with other documents (32 CFR 117.19(g)(13)). Container combinations change annually, when someone with access leaves or no longer needs it, and on suspected compromise. Recorded combinations are marked and controlled like NATO classified documents.

The CUSR at Fort Belvoir, Virginia, is the U.S. central distribution point in NATO’s registry system, with subregistries at government organizations, which may set up control points at contractor facilities (32 CFR 117.19(g)(14)). COSMIC TOP SECRET, NATO SECRET and ATOMAL documents move through the registry system. NATO SECRET and CONFIDENTIAL documents may be hand carried across borders if the GCA authorizes it, with a NATO Courier Certificate from the CSA (32 CFR 117.19(g)(15)). The registry reproduces COSMIC TOP SECRET material, while NATO SECRET and CONFIDENTIAL reproduction may be authorized unless the contracting entity prohibits it (32 CFR 117.19(g)(16)).

6. Disposition, records and reporting

NATO documents are generally returned to the contracting activity on completion, and bid documents are returned immediately if the bid is not accepted or submitted (32 CFR 117.19(g)(17)). Destruction certificates are required for all NATO classified documents except NATO CONFIDENTIAL. Logs, receipts and destruction certificates are kept separately from non-NATO records, and COSMIC TOP SECRET, NATO SECRET and ATOMAL documents are inventoried annually (32 CFR 117.19(g)(18)).

Losses, compromises and other violations involving NATO information are reported immediately to the CSA (32 CFR 117.19(g)(19)). Permission to extract from a COSMIC TOP SECRET or ATOMAL document comes from the CUSR. A U.S. document for a non-NATO contract that includes NATO extracts carries U.S. markings, a caveat and NATO portion markings (32 CFR 117.19(g)(20)). Releasing U.S. classified or export-controlled information to NATO requires an export authorization or other written disclosure authorization (32 CFR 117.19(g)(21)). NATO visits follow the international visit rules, with a NATO Certificate of Security Clearance, and NATO visit records are kept for three years (32 CFR 117.19(g)(22)). Visit procedures are covered in international visits and foreign visitors.

Key terms

COSMIC TOP SECRET	The NATO level corresponding to Top Secret.
NATO RESTRICTED	A NATO level with no U.S. equivalent.
NATO FSCC	The facility security clearance certificate for NATO contracts.
CUSR	The Central U.S. Registry for NATO documents.
Security aspects letter	A form of NATO classification guidance.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Allied programs often involve NATO information. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.