Security for classified information systems

← All Insights

1. The basic requirement

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, covers contractor information systems used to capture, create, store, process or distribute classified information. They must be properly managed to protect against unauthorized disclosure (32 CFR 117.18(a)(1)). The contractor implements protective measures using a risk-based approach that includes minimum standards for its insider threat program, following guidance from the cognizant security agency (CSA).

The CSA’s guidance is based on the requirements for federal systems under the Federal Information Security Modernization Act (32 CFR 117.18(a)(2)). It also draws on National Institute of Standards and Technology (NIST) Special Publication 800-37, Committee on National Security Systems Instruction 1253 and other publications such as NIST Special Publication 800-53.

2. What the security program includes

The contractor maintains an information system security program with a risk-based set of management, operational and technical controls (32 CFR 117.18(b)). It includes policies and procedures that reduce risk to an acceptable level across the system life cycle (32 CFR 117.18(b)(1)). It includes plans to assess, report, isolate and contain data spills and compromises, including sanitization and recovery (32 CFR 117.18(b)(2)). It also includes security training for authorized users (32 CFR 117.18(b)(3)).

The program addresses key parts of the insider threat program (32 CFR 117.18(b)(4)). They include automated or manual user activity monitoring of network activity, information sharing procedures, continuous monitoring, and protecting user activity monitoring logs with access limited to privileged users. The program continually evaluates threats and vulnerabilities to see whether more safeguards are needed (32 CFR 117.18(b)(5)). Change control supports configuration management and flags security-relevant changes that may require re-authorization (32 CFR 117.18(b)(6)). Banners and user agreements make users aware of their rights and responsibilities (32 CFR 117.18(b)(7)).

3. Certification and resources

The contractor certifies to the CSA that its program for classified systems addresses management, operational and technical controls under CSA guidelines (32 CFR 117.18(c)(1)(i)). It provides adequate resources and aligns the organization so the program gets prompt support and succeeds (32 CFR 117.18(c)(1)(ii)).

4. The information system security manager

A contractor that processes, or will process, classified information on an information system appoints an employee as information system security manager (ISSM) (32 CFR 117.18(c)(2)). The contractor confirms the ISSM is adequately trained, experienced and technically competent for the system’s complexity. The ISSM oversees the development, implementation and evaluation of the program and coordinates with the insider threat program senior official on insider threat awareness (32 CFR 117.18(c)(2)(i) and 32 CFR 117.18(c)(2)(ii)). The ISSM also develops, documents and monitors compliance with the program (32 CFR 117.18(c)(2)(iii)).

The ISSM verifies that self-inspections of classified systems happen at least every 12 months and that findings are corrected (32 CFR 117.18(c)(2)(iv)). The ISSM also gives the CSA a written certification for each authorized system (32 CFR 117.18(c)(2)(v)). It states that the system security plan is implemented, that the specified controls are in place and properly tested, and that the system still functions as described (32 CFR 117.18(c)(2)(v)). Users are briefed, and personnel are trained on the system’s restrictions and safeguards before access (32 CFR 117.18(c)(2)(vi)).

The ISSM keeps the documentation for the authorization request to the CSA (32 CFR 117.18(c)(2)(vii)). It may include system security plans, security assessment reports, plans of action and milestones, risk assessments, authorization decision letters, contingency plans, configuration management plans, security configuration checklists and system interconnection agreements.

5. The ISSO and users

The ISSM may assign an information systems security officer (ISSO) (32 CFR 117.18(c)(3)). If assigned, the ISSO verifies implementation of the program as the ISSM delegates, ensures continuous monitoring strategies and conducts self-inspections, verifying corrective actions to the ISSM.

All users comply with the program and are accountable for their actions on an authorized system (32 CFR 117.18(c)(4)). They do not share authentication mechanisms such as passwords, and they protect them at the highest classification level and most restrictive category the mechanisms open. Users are subject to monitoring on any classified network, and the results can be used against them in criminal, security or administrative proceedings. They notify the ISSM or ISSO when they no longer need access. Under the training section, every authorized user is trained on the security risks of their activities, with content the contractor sets according to roles, security requirements and the systems accessed (32 CFR 117.12(i)). A password to a classified system takes the protection of the top classification that system may hold (32 CFR 117.15(e)(5)).

6. The life cycle and the risk management framework

CSA guidance on the system life cycle rests on the NIST 800-37 risk management framework (32 CFR 117.18(d)). It emphasizes building security in during development, continuous awareness of security status, keeping management informed for risk decisions, and supporting reciprocity of authorizations. The framework has seven steps, used to ensure controls are implemented, tested, validated and approved by the government authorizing official (32 CFR 117.18(e)).

The contractor prepares the organization to manage security and privacy risks (32 CFR 117.18(e)(1)). It categorizes the system by impact analysis (32 CFR 117.18(e)(2)). Unless the contract imposes otherwise, the baseline is moderate confidentiality, low integrity and low availability. It selects and tailors baseline controls, implements and documents them, and assesses whether they work as intended, certifying protection to the CSA (32 CFR 117.18(e)(3) to 32 CFR 117.18(e)(5)).

The CSA then makes a timely, credible, risk-based decision to authorize the system, and the system may not process classified information until it does (32 CFR 117.18(e)(6)). The contractor monitors controls on an ongoing basis, documenting and analyzing changes and reporting to the CSA (32 CFR 117.18(e)(7)). Systems handling controlled unclassified information are outside the rule but follow contract requirements (32 CFR 117.18(f)). Cyber incident reporting is covered in changed conditions and loss or compromise reports.

Key terms

ISSM	The information system security manager.
ISSO	An information systems security officer the ISSM may assign.
System security plan	The plan the ISSM certifies is implemented.
Risk management framework	The seven-step NIST process for managing system risk.
Authorization	The CSA decision allowing a system to process classified information.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Systems discipline matters wherever classified work is done. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.