What the industrial security rule covers

← All Insights

1. What the rule implements

The National Industrial Security Program Operating Manual (NISPOM) is codified as a federal rule at 32 CFR part 117. It implements policy, assigns responsibilities, establishes requirements and provides procedures for the protection of classified information that is disclosed to, or developed by, contractors of the U.S. Government (32 CFR 117.1(a)). The rule is consistent with Executive Order 12829 on the National Industrial Security Program (NISP), Executive Order 10865 on safeguarding classified information within industry, 32 CFR part 2004 and Department of Defense Instruction (DoDI) 5220.22.

The rule draws on a wider set of authorities as well (32 CFR 117.1(b)). They include Executive Orders 13587, 13691 and 12333, the Atomic Energy Act of 1954, the National Security Act of 1947, the Central Intelligence Agency Act of 1949 and the Intelligence Reform and Terrorism Prevention Act of 2004. Under them, the rule prescribes industrial security procedures and practices to safeguard U.S. Government classified information developed by or disclosed to contractors (32 CFR 117.1(b)(1)). It also prescribes requirements, restrictions and other safeguards to prevent unauthorized disclosure and to protect special classes of classified information (32 CFR 117.1(b)(2)).

2. When contractors had to comply

Contractors were to implement the rule no later than 6 months from February 24, 2021 (32 CFR 117.1(b)(3)). The exception was the requirement to report foreign travel to the Department of Defense (DoD), which comes from Security Executive Agent Directive 3 and is implemented through the rule. Contractors under DoD security cognizance were to begin reporting foreign travel no later than 18 months from February 24, 2021.

3. Who the rule applies to

Inside government, the rule first applies to the Office of the Secretary of Defense, the Military Departments, and the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff (32 CFR 117.2(a)(1)). It also covers the Combatant Commands, the DoD Inspector General, the Defense Agencies, the DoD Field Activities and all other DoD organizational entities (32 CFR 117.2(a)(1)). Together, the rule calls these the DoD Components. It also applies to all executive branch departments and agencies (32 CFR 117.2(a)(2)).

On the private side, the rule reaches all industrial, educational, commercial or other non-government entities granted access to classified information by executive branch departments and agencies or by foreign governments (32 CFR 117.2(a)(3)). That coverage is not limited to defense firms. A university, a commercial company or another non-government body with access is within the program.

4. Every phase of a contract

The rule applies to the release of classified information to contractors, who must safeguard it during all phases of the contracting, agreement, licensing and grant processes (32 CFR 117.2(a)(4)). Those phases are the preparation and submission of bids and proposals, negotiation, award, performance and termination. Agreements include cooperative research and development agreements.

Coverage also extends to work where actual knowledge of classified information is not required, but reasonable physical security measures cannot prevent aural or visual access to it. In that case there is the ability and opportunity to gain knowledge of classified information, and the rule applies. It also applies to any other situation in which classified information or foreign government information furnished to a contractor requires protection in the interest of national security, even when it is not released under a contract, license, certificate or grant.

5. What the rule does not do

The rule does not limit the authority of executive branch departments and agencies to grant access to classified information under their cognizance to any individual they designate (32 CFR 117.2(b)(1)). Such access is outside the scope of the program. It is granted under Executive Orders 12968, 13526 and 13691, the Atomic Energy Act and applicable disclosure policies.

Nor does the rule apply to criminal proceedings in the courts, or authorize contractors or their employees to disclose classified information in connection with them (32 CFR 117.2(b)(2)). Defendants and their representatives in federal criminal proceedings may gain access to classified information under the Classified Information Procedures Act, as amended, at 18 U.S.C. Appendix 3.

6. The policy behind the program

Executive Order 12829 established the program as a single, integrated, cohesive industrial security program to protect classified information and preserve the economic and technological interests of the United States (32 CFR 117.4). Two policy statements follow from that. When contracts, licenses, agreements and grants require access to classified information, national security requires that the information be safeguarded in a manner equivalent to its protection within the executive branch (32 CFR 117.4(a)).

National security also requires that the program promote the economic and technological interests of the United States (32 CFR 117.4(b)). The rule states that redundant, overlapping or unnecessary requirements impede those interests. The same theme appears in the duties of the agencies that oversee contractors, who are told to minimize redundant and duplicative security reviews (32 CFR 117.6(g)(3)).

7. The forms and systems behind the rule

The rule lists its approved information collections (32 CFR 117.5). Standard Form 328, the Certificate Pertaining to Foreign Interest, is used under the reporting and foreign ownership sections (32 CFR 117.5(a)). The Nuclear Regulatory Commission and the Department of Energy each have their own collections for facility clearance and security information (32 CFR 117.5(b) and 32 CFR 117.5(c)).

The DoD collections include the DoD Security Agreement, the National Industrial Security System and the DD Form 254, the Contract Security Classification Specification (32 CFR 117.5(d)). The DD Form 254 is used by DoD and by agencies that have an industrial security agreement with DoD. The Defense Information System for Security records personnel security actions, including adverse information, clearance status checks, investigation requests and continuous evaluation. The Joint Personnel Adjudicative System collects personal data to facilitate the initiation, investigation and adjudication of information relevant to DoD security clearances. How the oversight agencies divide their work is covered in who oversees industrial security.

Key terms

NISPOM	The National Industrial Security Program Operating Manual, codified at 32 CFR part 117.
NISP	The single industrial security program established by Executive Order 12829.
DoD Components	The DoD organizations the rule names collectively.
Aural or visual access	Access that cannot be prevented by reasonable physical measures and brings work within the rule even where knowledge is not required.
DD Form 254	The Contract Security Classification Specification.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Cleared work abroad starts with the security rules at home. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.