Security reviews and self-inspections

← All Insights

1. Government security reviews

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, relies on two kinds of review. The cognizant security agency (CSA) conducts recurring oversight reviews of each contractor’s security program (32 CFR 117.7(h)(1)). Their purpose is to verify that the contractor is protecting classified information and implementing the rule. Participation is required for the entity to keep its eligibility for access to classified information.

The CSA determines the scope and frequency of reviews, and may increase or decrease them consistent with risk management principles (32 CFR 117.7(h)(1)(i)). It generally gives notice of a forthcoming review, but it may also conduct unannounced reviews at its discretion (32 CFR 117.7(h)(1)(ii)(A)). A review may subject contractor employees and all areas and receptacles under the contractor’s control to examination. Contractors report redundant or duplicative security review and audit activity by CSAs to the Director of the Information Security Oversight Office for resolution (32 CFR 117.8(g)(1)).

2. Limits on the examination

The CSA makes every effort to avoid unnecessary intrusion into the personal effects of contractor personnel (32 CFR 117.7(h)(1)(ii)(B)). It may physically examine the interior of containers that are not authorized to secure classified material (32 CFR 117.7(h)(1)(ii)(C)). Those examinations always take place in the presence of a contractor representative.

3. Where controlled unclassified information fits

Agencies implement controlled unclassified information (CUI) requirements under 32 CFR part 2002, but compliance with them is outside the scope of the industrial security program and this rule (32 CFR 117.7(h)(1)(iii)). A CSA may still assess CUI during its review when three conditions are met. The contractor must participate in the program because it needs access to classified information (32 CFR 117.7(h)(1)(iii)(A)).

A classified contract under the CSA’s cognizance must include provisions for access to, or protection or handling of, CUI (32 CFR 117.7(h)(1)(iii)(B)). And the CSA must have given the contractor specific guidance on the assessment criteria and methodology it will use for that CUI (32 CFR 117.7(h)(1)(iii)(C)). That guidance covers CUI being accessed, stored or transmitted by the contractor as part of the classified contract.

4. Annual self-inspections

Contractors review their security programs on a continuing basis (32 CFR 117.7(h)(2)). They conduct a formal self-inspection at least annually, and at intervals consistent with risk management principles. A self-inspection reviews the classified activity, classified information, classified information systems, the overall security program and the insider threat program (32 CFR 117.7(h)(2)(i)).

Self-inspections must have sufficient scope, depth and frequency. Management supports them during the inspection and during the remedial actions that follow. Where applicable, they include a review of samples of the contractor’s derivative classification actions.

The contractor prepares a formal report describing the self-inspection, its findings and how it resolved the issues found (32 CFR 117.7(h)(2)(ii)). It keeps the report for CSA review until after the next CSA security review is completed.

Derivative classification means incorporating, paraphrasing, restating or generating in new form information that is already classified, and marking the new material to match the source markings (32 CFR 117.3). It includes classifying information based on classification guidance. Duplicating or reproducing existing classified information is not derivative classification. A security violation, by contrast, is a failure to comply with the rule’s policy and procedures that reasonably could result in the loss or compromise of classified information.

5. The senior management certification

Each year, the senior management official (SMO) at the cleared facility certifies to the CSA in writing on four points (32 CFR 117.7(h)(2)(iii)). The SMO certifies that a self-inspection was conducted and that other key management personnel were briefed on its results. The SMO also certifies that appropriate corrective actions were taken and that management fully supports the security program as described in the certification.

6. Cooperating with investigators

Contractors cooperate with federal agencies and their officially credentialed government or contractor representatives (32 CFR 117.7(f)). The duty covers official reviews, investigations about the protection of classified information, and personnel security investigations of present or former employees and others, such as consultants or visitors. At a minimum, it includes four things.

The contractor provides suitable arrangements within the facility for private interviews with employees during normal working hours (32 CFR 117.7(f)(1)). When requested, it provides relevant records on an individual under investigation (32 CFR 117.7(f)(2)). They include employment or personnel files, security records, supervisory files and records pertinent to insider threat, such as security, cybersecurity and human resources records. The contractor also provides access to employment and security records kept at offsite locations, and renders other necessary assistance (32 CFR 117.7(f)(3) and 32 CFR 117.7(f)(4)).

7. Training, hotlines and interpretations

Contractors advise all cleared employees, including those at government locations or on operations outside the United States, of their individual responsibility for classification management and for safeguarding classified information (32 CFR 117.7(g)). Training consists of initial briefings, refresher briefings and debriefings under the training section.

Federal agencies maintain hotlines that give government and contractor employees an unconstrained avenue to report known or suspected security irregularities and infractions without fear of reprisal (32 CFR 117.7(j)). The hotlines do not replace the contractor’s own duty to facilitate reporting and timely investigation, and personnel are encouraged to report through contractor channels first. Contractors tell all personnel that hotlines may be used for issues of national security significance. Each CSA posts hotline details on its website. Requests for interpretations of the rule go to the CSA under its guidance (32 CFR 117.7(m)).

8. Waivers

Contractors submit requests to waive provisions of the rule under CSA procedures, which may include periodic review of approved waivers (32 CFR 117.7(n)). The request explains in writing why compliance is impractical or unreasonable, identifies alternative measures and proposes a duration. A waiver cannot be implemented until the CSA approves it. The officials who run the program are covered in contractor security officials and key management.

Key terms

Security review	The CSA’s recurring oversight review of a contractor’s program.
Unannounced review	A review the CSA may conduct without notice.
Self-inspection	The contractor’s formal internal review, at least annually.
SMO certification	The annual written statement to the CSA on the self-inspection.
Waiver	CSA approval to depart from a provision, using alternative measures.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Inspection readiness matters at every site. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.