Subcontracting classified work

← All Insights

1. The prime contractor’s threshold decision

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, places the subcontracting duties on the prime contractor. A threshold determination comes first (32 CFR 117.17(a)(1)). Before a prime contractor releases classified information to a subcontractor, or has one generate it, someone must determine that access will be required and serves a legitimate government requirement for a classified contract (32 CFR 117.17(a)(1)). Prime contractors communicate the appropriate security requirements to all subcontractors.

A security requirements clause and a contract security classification specification, or equivalent, go into the solicitation and the subcontract (32 CFR 117.17(a)(1)(i)). The subcontractor must hold an appropriate entity eligibility determination, and a classified information safeguarding capability if it will possess classified information (32 CFR 117.17(a)(1)(ii)).

2. Bidding before a clearance

If access is not needed before award, prospective subcontractors need no entity eligibility determination to receive or bid on the solicitation (32 CFR 117.17(a)(1)(ii)(A)). If a prospective subcontractor needs access before award but lacks the determination or safeguarding capability, the prime asks the subcontractor’s cognizant security agency (CSA) to start the necessary action (32 CFR 117.17(a)(1)(ii)(B)).

If no access to classified information will be required, the contract is not a classified contract within the rule (32 CFR 117.17(a)(1)(iii)). Requirements for protected information that is not classified, such as controlled unclassified information, still go into the solicitation and subcontract, but the rule does not cover them.

3. Verifying a prospective subcontractor

The prime verifies whether a prospective subcontractor has the appropriate determination and, if the subcontract requires it, a safeguarding capability (32 CFR 117.17(a)(2)(i)). An existing contractual relationship involving classified information of the same or a higher category can support the determination. The verification itself is made through the CSA-designated database or by contacting the CSA.

If the subcontractor lacks what it needs, the prime asks its CSA to initiate action (32 CFR 117.17(a)(2)(ii)). The request gives the full name, address and contact information of the requester and of a contact at the facility to be processed, the clearance level and safeguarding capability needed, and a full justification (32 CFR 117.17(a)(2)(ii)(A)). A safeguarding request describes the quantity, end-item and classification of the related information (32 CFR 117.17(a)(2)(ii)(B)). Other factors, such as special access requirements, are also identified (32 CFR 117.17(a)(2)(ii)(C)).

4. Lead time for uncleared bidders

Requesting contractors allow enough lead time for an uncleared bidder to be processed (32 CFR 117.17(a)(3)). If the determination cannot be granted in time for the current procurement, the CSA continues processing so the subcontractor qualifies for future work, on three conditions. The delay must not have been caused by the subcontractor’s lack of cooperation, future classified negotiations may occur within 12 months, and there must be a reasonable likelihood of a classified subcontract award.

5. Subcontracts involving foreign government information

A U.S. contractor may award a subcontract involving access to foreign government information to another U.S. contractor after verifying with the CSA that it has the appropriate determination and storage capability (32 CFR 117.17(a)(3)(iv)(A)). It also reviews the prime contract for any limitations on approval. The awarding contractor provides classification guidance and incorporates the pertinent security provisions.

The originating foreign government’s express written consent is needed in two cases (32 CFR 117.17(a)(3)(iv)(B)). One is a subcontract to a contractor in a third country. The other is a subcontract to a U.S. entity with a limited determination based on third-country foreign ownership, control or influence (32 CFR 117.17(a)(3)(iv)(B)). The CSA coordinates with that government.

6. Classification guidance for the subcontract

Prime contractors ensure a contract security classification specification, or equivalent, is in each classified subcontract (32 CFR 117.17(b)(1)). They may draw on the prime contract’s specification, its security classification guides and any guides covering information furnished to or generated by the subcontractor (32 CFR 117.17(b)(1)(i)). A designated official of the prime certifies the specification (32 CFR 117.17(b)(1)(ii)). Absent exceptional circumstances it contains no classified information, and any classified supplements go separately (32 CFR 117.17(b)(1)(iii)).

An original specification goes with each request for quotation, request for proposal, invitation for bid or other solicitation, so bidders can plan, and with the subcontract awarded (32 CFR 117.17(b)(2)). A revised one is issued when security requirements change (32 CFR 117.17(b)(3)). A subcontractor’s requests for public release go through the prime contractor to the government contracting activity (GCA) (32 CFR 117.17(b)(4)).

7. Disclosing to the subcontractor

The safeguarding section sets the disclosure conditions. Release to a subcontractor rests on an appropriate facility clearance, a need-to-know, and access that is necessary for tasks essential to the prime contract or a subcontract (32 CFR 117.15(h)(2)(i)). The subcontractor’s clearance, granted by the CSA, has to match or exceed the classification of what it receives (32 CFR 117.15(h)(2)(ii)). Where documents or hardware actually change hands, the subcontractor also needs CSA-approved storage at its site.

8. Completion and problem conditions

On completion, the subcontractor may keep classified material received or generated under the subcontract for two years (32 CFR 117.17(c)(1)). Longer retention needs written authority requested through the prime to the GCA, with the information the safeguarding section requires (32 CFR 117.17(c)(2)). If the GCA approves, the prime issues a final specification giving the retention period and final disposition instructions (32 CFR 117.17(c)(3)).

The prime is notified if the CSA finds marginal or unsatisfactory conditions at the subcontractor or invalidates its facility clearance (32 CFR 117.17(d)). The prime then follows the instructions it receives on safeguarding the classified material. Primes and subcontractors also report to the CSA information suggesting the other cannot adequately protect classified information (32 CFR 117.8(c)(10)). Subcontractors also notify their prime contractors when they make certain reports to their CSA (32 CFR 117.8(c)(14)). How a company qualifies is covered in how a company qualifies for a facility clearance.

Key terms

Security requirements clause	The clause that carries security requirements into a subcontract.
Contract security classification specification	The document conveying classification guidance, such as the DD Form 254.
Safeguarding capability	CSA-approved ability to store classified material.
Lead time	Time allowed for an uncleared bidder to be processed.
Third-country subcontract	A subcontract that needs the foreign government’s written consent.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Subcontracted support is common on cleared programs. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.