Reporting duties for cleared contractors

← All Insights

1. Why contractors report

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, makes reporting a core duty. Under the rule, Security Executive Agent Directive 3 and cognizant security agency (CSA) guidance, contractors and their cleared employees report four kinds of events (32 CFR 117.8(a)(1)). They are events that may affect the entity’s or an employee’s eligibility for access to classified information, and events that indicate an insider threat. They also include events that affect the proper safeguarding of classified information, and events that indicate it has been, or is suspected to be, lost or compromised.

Contractors establish internal procedures so that eligible employees know their responsibility to report pertinent information to the facility security officer (FSO) (32 CFR 117.8(a)(2)). The contractor provides reports to the Federal Bureau of Investigation (FBI) or other federal authorities as the rule, the contract or U.S. law requires (32 CFR 117.8(a)(2)(i)). Reports go to the FBI, the CSA or the Information Security Oversight Office (ISOO), as the section specifies (32 CFR 117.8(a)(2)(iii)). The contractor also gives the CSA complete information so the CSA can judge whether classified information is adequately protected (32 CFR 117.8(a)(2)(ii)).

2. Marking reports and protecting sources

Reports that contain classified information are marked under the marking section (32 CFR 117.8(a)(3)). A report containing information submitted in confidence is clearly marked as such (32 CFR 117.8(a)(4)). Where a report concerns an individual, the Privacy Act of 1974 permits certain information to be withheld from that individual under specific exemptions. They include withholding information that would reveal the identity of a source who gave it to the government under an express promise of confidentiality.

3. Reports to the FBI

The contractor promptly submits a written report to the nearest FBI field office about information concerning actual, probable or possible espionage, sabotage, terrorism or subversive activities at any of its locations (32 CFR 117.8(b)). An initial report may be made by phone, but it must be followed up in writing, for example by email or formal correspondence, whatever the FBI does with it (32 CFR 117.8(b)(1)). The contractor promptly notifies the CSA when it makes a report to the FBI and gives the CSA a copy of the written report (32 CFR 117.8(b)(2)).

4. Adverse information

Contractors report adverse information that comes to their attention about any employee determined eligible for access to classified information (32 CFR 117.8(c)(1)). Reports are not based on rumor or innuendo. The duty survives the employee’s termination of employment (32 CFR 117.8(c)(1)(i)). If the employee is assigned to a government location, the contractor gives a copy of the report and its final disposition to that location’s security point of contact.

The rule also addresses liability. Citing a 1967 federal appeals court decision and later cases, it addresses defamation claims by employees (32 CFR 117.8(c)(1)(ii)). It states that a contractor may not be liable for communications the rule or the contract requires it to make to a U.S. agency (32 CFR 117.8(c)(1)(ii)).

5. Suspicious contacts

Contractors report suspicious contacts with eligible employees, and efforts by any means to obtain illegal or unauthorized access to the cleared facility (32 CFR 117.8(c)(2)). The duty covers efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to classified information (32 CFR 117.8(c)(2)(i)). It also covers efforts to elicit information from an eligible employee, and any contact suggesting the employee may be the target of attempted exploitation by a foreign intelligence service (32 CFR 117.8(c)(2)(ii)). Security Executive Agent Directive 3 sets out the specific information to be reported. Reporting foreign travel to the Department of Defense also comes from that directive, and contractors under Defense security cognizance were to begin it no later than 18 months from February 24, 2021 (32 CFR 117.1(b)(3)).

6. Changes in an employee’s status

Through the CSA-designated reporting mechanism, contractors report changes in the status of eligible employees (32 CFR 117.8(c)(3)). The examples given are death, a change in name, termination of employment and a change in citizenship. If a non-U.S. citizen employee who holds a limited access authorization becomes a citizen through naturalization, the contractor reports it (32 CFR 117.8(c)(4)). The report gives the city, county and state of naturalization, the date, the court and the certificate number.

Contractors report when an employee no longer wishes to be processed for an eligibility determination, or no longer wishes to keep access to classified information, along with the reason (32 CFR 117.8(c)(5)). They also report an employee’s refusal to sign the SF 312, the Classified Information Nondisclosure Agreement, or another approved nondisclosure agreement (32 CFR 117.8(c)(6)).

7. Tracking violations by individuals

Contractors establish and enforce policies providing for administrative or disciplinary action against employees who violate the rule (32 CFR 117.8(e)). They keep a system to manage and track information about eligible employees who violate it (32 CFR 117.8(e)(1)). The purpose is to identify patterns of negligence or carelessness, or a potential insider threat.

Contractors apply a graduated scale of administrative and disciplinary actions for security violations or negligence in handling classified information (32 CFR 117.8(e)(2)). CSAs may give examples of actions to consider. A final report to the CSA sets out the findings on culpability and the corrective actions taken.

When the responsible individual can be determined, the final report includes a statement of the actions taken against that employee (32 CFR 117.8(e)(3)). It also states whether the incident involved deliberate disregard of security requirements or negligence in handling classified material (32 CFR 117.8(e)(3)(i) and 32 CFR 117.8(e)(3)(ii)). A third factor is an incident that was not deliberate but reflects a recent or recurring pattern of questionable judgment, irresponsibility, negligence or carelessness (32 CFR 117.8(e)(3)(iii)). Reports about the entity itself are covered in changed conditions and loss or compromise reports.

Key terms

Adverse information	Information about an eligible employee that must be reported, but not rumor or innuendo.
Suspicious contact	A contact suggesting an attempt to gain access or exploit an employee.
SF 312	The Classified Information Nondisclosure Agreement.
Limited access authorization	CONFIDENTIAL or SECRET access granted to a non-U.S. citizen who needs only limited access.
Graduated scale	The contractor’s range of actions for security violations.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Reporting discipline protects programs and people. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.