Security training and briefings

← All Insights

1. The general duty

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, builds its training rules around one principle. Contractors provide all cleared employees with security training and briefings commensurate with their involvement with classified information (32 CFR 117.12(a)). Every cleared employee, wherever assigned, is told of a personal responsibility for classification management and safeguarding (32 CFR 117.7(g)).

Contractors may get security, threat awareness and other training material from their cognizant security agency (CSA) or other sources (32 CFR 117.12(b)). The CSA provides the initial security briefing to the facility security officer (FSO), and ensures the FSO receives any other briefings required for special categories of information (32 CFR 117.12(c)).

2. Training for the FSO

Contractors ensure the FSO and others performing security duties complete training the CSA considers appropriate, based on the contractor’s involvement with classified information (32 CFR 117.12(d)). It may include an FSO orientation course and, for locations with a classified information safeguarding capability, an FSO program management course. FSOs complete training within six months of appointment. Where the CSA requires it, the program management course is completed within six months of CSA approval to store classified information at the contractor.

The other appointed officials have training duties too. The senior management official, the FSO and the insider threat program senior official (ITPSO) undergo the same security training required for all other employees, plus position-specific training (32 CFR 117.7(b)(1)(ii)). The ITPSO completes training under the training section (32 CFR 117.7(b)(4)(ii)). The contractor ensures its information system security manager is adequately trained and technically competent for the complexity of its classified systems (32 CFR 117.7(b)(5)). Staff and consultants who carry out program security work receive training shaped to that work (32 CFR 117.7(b)(6)).

3. The initial security briefing

Before granting access, contractors give each employee an initial security briefing (32 CFR 117.12(e)). It covers threat awareness, including insider threat awareness, and counterintelligence awareness (32 CFR 117.12(e)(1) and 32 CFR 117.12(e)(2)). It gives an overview of the information security classification system and explains reporting obligations, including on insider threat (32 CFR 117.12(e)(3) and 32 CFR 117.12(e)(4)). Authorized information system users receive cybersecurity training under CSA guidance (32 CFR 117.12(e)(5)).

The briefing also covers the security procedures and duties of the employee’s position, such as marking and safeguarding classified information (32 CFR 117.12(e)(6)). It explains the criminal, civil or administrative consequences that may follow unauthorized disclosure, even though the individual has not yet signed a nondisclosure agreement. Controlled unclassified information training is outside the rule, but contractors comply when a classified contract requires it (32 CFR 117.12(f)).

4. Insider threat training

The ITPSO ensures that program personnel and all other cleared employees complete training consistent with CSA guidance (32 CFR 117.12(g)). Program personnel, including the ITPSO, are trained in counterintelligence and security fundamentals and in procedures for insider threat response actions (32 CFR 117.12(g)(1)). They also learn the laws on gathering, integrating, retaining, safeguarding and using records and data, including the consequences of misuse, and the legal, civil liberties and privacy policies that apply to insider threat programs.

All cleared employees receive insider threat awareness training annually, unless the CSA conducts it instead (32 CFR 117.12(g)(2)). Newly cleared employees receive it before being granted access. It addresses current and potential threats in the work and personal environment. At a minimum, it covers the importance of detecting and reporting potential insider threats, and how adversaries recruit trusted insiders and collect classified information, in particular within information systems. It also covers indicators of insider threat behavior with the procedures to report them, and counterintelligence and security reporting requirements. Contractors establish procedures to validate that every cleared employee has completed the initial and annual training (32 CFR 117.12(g)(3)).

5. Derivative classification training

Employees authorized to make derivative classification decisions are trained in the proper application of its principles, under CSA direction (32 CFR 117.12(h)(1)). They may not classify derivatively until they receive the training. The classification section repeats that every derivative classifier is trained at least once every two years (32 CFR 117.13(c)(4)). Contractors suspend the authority of any employee who misses that refresher (32 CFR 117.12(h)(2)).

The refresher training emphasizes avoiding over-classification. It addresses classification levels, duration of classification, identification and markings, classification prohibitions and limitations, sanctions and classification challenges, security classification guides and information sharing. Contractors keep records of the date and type of each employee’s most recent initial or refresher training (32 CFR 117.12(h)(3)).

6. Systems users and temporary help

All authorized information system users receive training on the security risks of their activities and their responsibilities under the program (32 CFR 117.12(i)). The contractor decides the content, considering roles and responsibilities, specific security requirements and the systems each person may access. A cleared temporary help supplier, or another contractor that employs cleared individuals solely for dispatch elsewhere, ensures its personnel receive the required initial and refresher briefings (32 CFR 117.12(j)). Either the supplier or the using contractor may conduct them.

7. Refresher training and debriefings

All cleared employees receive security education and training every 12 months (32 CFR 117.12(k)). Refresher training reinforces the initial briefing and keeps employees informed of changes in security regulations. It should also address issues identified during the contractor’s self-reviews. Methods may include group briefings, interactive videos and instructional materials, and contractors keep records of programs offered and participation.

Contractors debrief cleared employees and record the debriefing in four situations (32 CFR 117.12(l)). They are when access is no longer needed, at termination of employment by discharge, resignation or retirement, when the employee’s eligibility is terminated, suspended or revoked, and when the entity eligibility determination ends. Self-inspections that feed refresher training are covered in security reviews and self-inspections.

Key terms

Initial security briefing	The briefing given before any access is granted.
Insider threat awareness training	Annual training for all cleared employees.
Derivative classification training	Required before classifying and at least every two years.
Refresher training	Security education every 12 months.
Debriefing	The recorded briefing when access ends.
Temporary help supplier	A cleared firm that dispatches its cleared staff to work for other contractors.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Training is part of preparing personnel for cleared work. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.