NISPOM (32 CFR Part 117)

Why does it matter?

Entity eligibility for access to classified information, the facility clearance in everyday language, is a condition of holding classified contracts, and 117.9 ties it to the rule: an entity must have an SMO, FSO and ITPSO who hold and maintain eligibility, must not be under FOCI to a degree inconsistent with the national interest, and must keep enough cleared employees to implement the rule. Section 117.7(h) makes participation in the CSA's recurring security reviews a condition of keeping that eligibility, and 117.7 requires a formal self-inspection at least annually with the SMO certifying in writing to the CSA that it was done, that key management personnel were briefed and that corrective actions were taken.

Key benefits include:

• One rule for all five CSAs

Section 117.3 defines the CSAs as DoD, DOE, NRC, ODNI and DHS, so a contractor cleared under more than one agency works from the same codified text, supplemented by CSA guidance.

• Named accountable officials

Section 117.7(b) requires the SMO to appoint, in writing, a U.S. citizen employee as FSO and as ITPSO, and 117.7(b)(5) an ISSM wherever classified information is processed on an information system at the facility.

• A reporting regime with fixed triggers

Section 117.8 lists what goes to the FBI and what goes to the CSA: adverse information, suspicious contacts, changes in cleared employee status, FOCI changes on an updated SF 328, loss or compromise, and cyber incidents on classified systems.

• FOCI handled in the rule itself

Section 117.11 requires the SF 328 Certificate Pertaining to Foreign Interests and sets the mitigation instruments, from board resolutions to security control agreements, special security agreements, voting trusts and proxy agreements.

• Insider threat program as a requirement

Section 117.7(d) requires every cleared contractor to establish and maintain an insider threat program consistent with E.O. 13587 and the National Insider Threat Policy minimum standards.

How does it work?

Section 117.2 applies the rule to DoD components, all executive branch departments and agencies, and every industrial, educational, commercial or other non-government entity granted access to classified information, across every phase of contracting from bids and proposals to termination. Section 117.9 sets the entity eligibility criteria: a legal entity organized and located in the United States with a record of integrity and lawful conduct, cleared SMO, FSO and ITPSO, no disqualifying FOCI and no unacceptable national security risk, in the CSA's judgment. The CSA processes the determination on documentation the entity supplies and investigations for its key management personnel; 117.7(c) lets the governing board formally exclude other officials from access by a resolution in the rule's own words.

Section 117.7 is the operating core. The SMO is accountable for the program; the FSO supervises and directs security measures; the ITPSO runs the insider threat program; employees with security duties complete tailored training; the contractor prepares standard practice procedures when the CSA requires them and cooperates with federal reviews and investigations. Training under 117.12 includes initial, refresher and debriefings for cleared employees and an FSO orientation and, where classified information is stored, an FSO program management course within six months. Security reviews by the CSA recur, and the contractor's self-inspection report is retained for CSA review until the next security review is complete.

Section 117.8 requires prompt reports: to the FBI, actual or suspected espionage, sabotage, terrorism or subversive activities; to the CSA, adverse information about cleared employees, suspicious contacts, changes in cleared employee status, material changes in FOCI on an updated SF 328, loss, compromise or suspected compromise of classified information, and, for cleared defense contractors, immediate reports to the DoD cognizant security office of any cyber incident on a classified covered information system. Section 117.1(b)(3), as amended in 2021, adds that contractors under DoD cognizance report foreign travel under SEAD 3, with that requirement beginning no later than 18 months after February 24, 2021. Sections 117.13 to 117.18 then cover classification, marking, safeguarding, visits, subcontracting and information system security.

Key Elements

• Entity eligibility and KMP (117.7, 117.9)

Eligibility for access to classified information rests on cleared key management personnel, a U.S. location, integrity, manageable FOCI and enough cleared staff; the SMO, FSO and ITPSO can never be excluded from clearance.

• Insider threat program (117.7(d))

A program to gather, integrate and report information indicative of a potential or actual insider threat, run by the ITPSO under E.O. 13587 and the national minimum standards.

• Self-inspection and security reviews (117.7(h))

A formal self-inspection at least annually covering classified activity, systems, the overall program and the insider threat program, with a written report and annual SMO certification to the CSA.

• Reporting requirements (117.8)

Reports to the FBI on hostile acts and to the CSA on adverse information, suspicious contacts, employee status changes, FOCI changes, loss or compromise and classified-system cyber incidents.

• FOCI and the SF 328 (117.11)

Disclosure of foreign ownership, control or influence on the Certificate Pertaining to Foreign Interests and mitigation through board resolutions, security control agreements, special security agreements, voting trusts or proxy agreements.

• Supplement for special categories (117.23)

Requirements that exceed the baseline for ACCM, special access programs, SCI, Restricted Data, Formerly Restricted Data, Transclassified Foreign Nuclear Information and Naval Nuclear Propulsion Information.

What does it cover?

Part 117 governs classified information, not controlled unclassified information. It reaches every non-government entity granted access to classified information by an executive branch agency or a foreign government, their employees, consultants and subcontractors, and it binds the agencies themselves as CSAs and government contracting activities. Section 117.2(b) excludes two things: an agency's own authority to grant access to individuals outside the NISP, and criminal proceedings, where the Classified Information Procedures Act applies. The rule's six-month implementation window ran from February 24, 2021, so every cleared entity has been under Part 117 since August 24, 2021. Unclassified technical data and covered defense information fall instead under DFARS 252.204-7012, NIST SP 800-171 and CMMC 2.0.

What are its objectives?

Section 117.1 states that the rule implements policy, assigns responsibilities, establishes requirements and provides procedures for the protection of classified information disclosed to or developed by contractors of the U.S. Government.

Prescribe industrial security procedures and practices under E.O. 12829 to safeguard classified information developed by or disclosed to contractors (117.1(b)(1)).

Prescribe requirements, restrictions and other safeguards to prevent unauthorized disclosure and to protect special classes of classified information (117.1(b)(2)).

Fix the conditions of entity and personnel eligibility for access to classified information and the handling of foreign ownership, control or influence (117.9 to 117.11).

Require named officials, an insider threat program, training, reporting and self-inspection in every cleared facility (117.7, 117.8, 117.12).

Set the safeguarding, marking, visit, subcontracting and information system requirements for classified material in industry (117.13 to 117.18).

Framework in Context

The NISPOM is the industry half of a system whose government half is the Information Security Oversight Office directive at 32 CFR part 2004 and the classification order E.O. 13526; personnel security comes from E.O. 12968 and the Security Executive Agent Directives, with SEAD 3 reporting written into 117.1. The rule covers classified information only: the same contractors protect controlled unclassified information under 32 CFR part 2002, DFARS 252.204-7012 and NIST SP 800-171, assessed through CMMC 2.0. For Navy work the NNPI page covers OPNAVINST N9210.3, and 117.23 treats NNPI as a special category. ISO/IEC 27001, NIST SP 800-53 and the CIS Controls supply general practice an ISSM reuses, but classified systems are authorized under CSA guidance per 117.18.

Common Framework Mappings

The NISPOM is mapped to the information security frameworks cleared contractors already run, so that one control set serves DCSA security reviews and the assessments their unclassified work requires.

Mapped frameworks include:

CIS Controls v8.1

CMMC 2.0

CSA CCM v4

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2