Who oversees industrial security

← All Insights

1. The Defense Department role

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, sets out who oversees cleared contractors. The Under Secretary of Defense for Intelligence and Security acts on behalf of the Secretary of Defense under Executive Order 12829, 32 CFR part 2004 and Department of Defense Instruction 5220.22 (32 CFR 117.6(a)). The Under Secretary carries out the order’s direction that the Secretary of Defense issue and maintain the rule and its changes (32 CFR 117.6(a)(1)).

That work is done in consultation with all affected agencies and with the concurrence of the Secretary of Energy, the Chairman of the Nuclear Regulatory Commission (NRC), the Director of National Intelligence (DNI) and the Secretary of Homeland Security. The Information Security Oversight Office (ISOO) Director is also consulted. The Under Secretary acts as the cognizant security agency (CSA) for the Department of Defense (DoD) (32 CFR 117.6(a)(2)). The Under Secretary also provides policy and management of the program for non-DoD executive branch agencies that enter into inter-agency security agreements with DoD for industrial security services (32 CFR 117.6(a)(3)).

2. The Defense Counterintelligence and Security Agency

The Director of the Defense Counterintelligence and Security Agency (DCSA) works under the authority, direction and control of the Under Secretary (32 CFR 117.6(b)). The agency was renamed from the Defense Security Service on June 20, 2020, and references to the old name in DoD issuances are construed to refer to DCSA. The Director oversees and manages DCSA, which serves as the DoD cognizant security office (CSO) (32 CFR 117.6(b)(1)).

The Director administers the program as a separate program element on behalf of DoD government contracting activities and agencies that have agreements with DoD for security services (32 CFR 117.6(b)(2)). The Director also provides security oversight as the DoD CSO for DoD components and those non-DoD agencies (32 CFR 117.6(b)(3)). That oversight is relieved for DoD special access programs when the Secretary or Deputy Secretary of Defense approves a carve-out provision under DoD Directive 5205.07.

3. Energy and the Nuclear Regulatory Commission

The Secretary of Energy prescribes procedures for the parts of the rule on information classified under the Atomic Energy Act, namely Restricted Data, Formerly Restricted Data and Transclassified Foreign Nuclear Information (32 CFR 117.6(c)(1)). Nothing in the rule supersedes the Secretary’s authority under that Act. The Secretary retains authority over access to such information and inspects and monitors programs and facilities that involve access to it, as necessary (32 CFR 117.6(c)(2) and 32 CFR 117.6(c)(3)).

The Chairman of the NRC has parallel duties for information under NRC programs classified under the Atomic Energy Act, other federal statutes and executive orders (32 CFR 117.6(d)(1)). The Chairman prescribes procedures for that information and retains authority over access to it (32 CFR 117.6(d)(1) and 32 CFR 117.6(d)(2)). The Chairman also inspects and monitors contractor, licensee, certificate holder and grantee programs and facilities that involve access to it, where appropriate (32 CFR 117.6(d)(3)).

4. Intelligence and homeland security

The DNI prescribes procedures for the parts of the rule on intelligence sources, methods and activities, including Sensitive Compartmented Information (SCI) (32 CFR 117.6(e)(1)). The DNI retains authority over access to intelligence sources, methods and activities, and provides guidance on the security requirements for that information (32 CFR 117.6(e)(2) and 32 CFR 117.6(e)(3)).

The Secretary of Homeland Security prescribes procedures for the parts of the rule on the Classified Critical Infrastructure Protection Program (32 CFR 117.6(f)(1)). The Secretary retains authority over access to information under that program (32 CFR 117.6(f)(2)). The Secretary also inspects and monitors programs and facilities that involve access to it (32 CFR 117.6(f)(3)).

5. Duties shared by every CSA

All CSA heads oversee the security of classified contracts and activities under their purview and provide oversight of contractors under their security cognizance (32 CFR 117.6(g)(1) and 32 CFR 117.6(g)(2)). They minimize redundant and duplicative security review and audit activities, including at contractor locations where several CSAs have equities (32 CFR 117.6(g)(3)). They execute intra-agency and inter-agency agreements to avoid redundant and duplicate reviews (32 CFR 117.6(g)(4)).

Each CSA head designates one or more CSOs for security administration (32 CFR 117.6(g)(5)). Each also designates subordinate officials to act as the authorizing official (32 CFR 117.6(g)(6)). Authorizing officials assess and authorize contractors to process classified information on information systems (32 CFR 117.6(g)(6)(i)). They also oversee that processing and provide information system security guidelines under federal security control policies, standards and procedures (32 CFR 117.6(g)(6)(ii)).

6. Component agencies and contracting activities

Under applicable CSA direction, the heads of component agencies oversee compliance with procedures identified by the CSA or designated CSO (32 CFR 117.6(h)(1)). They provide oversight of contractor personnel visiting or working on government installations (32 CFR 117.6(h)(2)).

They also promptly tell the CSO of information that could adversely affect a cleared contractor, licensee or grantee, or its employees, in holding a facility clearance or a personnel clearance (32 CFR 117.6(h)(3)). The same applies to information that otherwise raises substantive doubt about their ability to safeguard classified information. Component heads may propose changes to the rule through the applicable CSA (32 CFR 117.6(h)(4)). Proposals go to the Counterintelligence, Law Enforcement and Security Directorate of the Under Secretary’s office.

7. The Information Security Oversight Office

The ISOO Director oversees the program and agency compliance with it under Executive Order 12829 (32 CFR 117.6(i)(1)). The Director issues and maintains the program’s implementing directive at 32 CFR part 2004, which guides the CSAs and agencies (32 CFR 117.6(i)(2)). The Director also chairs the National Industrial Security Program Policy Advisory Committee and addresses complaints and suggestions from contractors as detailed in that committee’s bylaws (32 CFR 117.6(i)(3)).

Contractors may send program administration complaints and suggestions to the ISOO Director, but are encouraged to send them to their CSA first (32 CFR 117.7(o)). Non-CSA agency heads enter into agreements with the Secretary of Defense as the program’s Executive Agent to obtain industrial security services (32 CFR 117.7(k)). The list of agencies served is on the DCSA website. The CSA informs contractors if oversight has been delegated to a CSO (32 CFR 117.7(l)). The rule as a whole is introduced in what the industrial security rule covers.

Key terms

Cognizant security agency (CSA)	An agency that oversees contractors under its security cognizance.
Cognizant security office (CSO)	An office a CSA designates for security administration.
DCSA	The Defense Counterintelligence and Security Agency, the DoD CSO.
Authorizing official	The official who authorizes contractor classified information systems.
Carve-out	An approved provision relieving DCSA of oversight for a special access program.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Knowing the oversight agency shapes how security questions are raised. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.