Title 32—National Defense--Volume 1
PART 117—NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL (NISPOM)
§ 117.15   Safeguarding classified information.
(a) General safeguarding. Contractors will be responsible for safeguarding classified information in their custody or under their control, with approval for such storage of classified information by the applicable CSA. Individuals are responsible for safeguarding classified information entrusted to them. Contractors will provide the extent of protection to classified information sufficient to reasonably protect it from loss or compromise.
(1) Oral discussions. Contractors will ensure that all cleared personnel are aware of the prohibition against discussing classified information over unsecured telephones, in public conveyances or places, or in any other manner that permits interception by unauthorized persons.
(2) End of day security checks. (i) Contractors that store classified material will establish a system of security checks at the close of each working day to verify that all classified material and security repositories have been appropriately secured.
(ii) Contractors that operate multiple work shifts will perform the security checks at the end of the last working shift in which classified material was removed from storage for use. The checks are not required during continuous 24-hour operations.
(3) Perimeter controls. (i) Contractors authorized to store classified material will establish and maintain a system to deter and detect unauthorized introduction or removal of classified material from their facility without proper authority.
(ii) If the unauthorized introduction or removal of classified material can be reasonably prevented through technical means ( e.g., an intrusion detection system), which are encouraged, no further controls are necessary. The contractor will provide appropriate authorization to personnel who have a legitimate need to remove or transport classified material for passing through designated entry or exit points.
(iii) The contractor will:
(A) Provide appropriate authorization to personnel who have a legitimate need to remove or transport classified material for passing through designated entry or exit points.
(B) Conspicuously post notices at all pertinent entries and exits that persons who enter or depart the facility are subject to an inspection of their personal, except under circumstances where the possibility of access to classified material is remote.
(C) Limit inspections to buildings or areas where classified work is being performed.
(D) Establish the extent, frequency, and location of inspections in a manner consistent with contractual obligations and operational efficiency. The contractor may use any appropriate random sampling technique.
(E) Seek legal advice during the formulation of implementing procedures.
(F) Submit significant problems pertaining to perimeter controls and inspections to the CSA.
(iv) Contractors will develop procedures for safeguarding classified material in emergency situations.
(A) The procedures should be as simple and practical as possible and adaptable to any type of emergency that may reasonably arise.
(B) Contractors will promptly report to the CSA any emergency situation that renders them incapable of safeguarding classified material.
(b) Standards for Security Equipment. Contractors will follow guidelines established in 32 CFR part 2001, when procuring storage and destruction equipment. Authorized repairs for GSA-approved security containers and vaults must be in accordance with Federal Standard 809.
(c) Storage. Contractors will store classified information and material in General Services Administration (GSA)-approved security containers, vaults built to Federal Standard 832, or an open storage area constructed in accordance with 32 CFR 2001.53. In the instance that an open storage area has a false ceiling or raised floor, contractors shall develop and implement procedures to ensure their structural integrity. Nothing in 32 CFR part 2001, should be construed to contradict or inhibit compliance with local laws or building codes, but the contractor will notify the applicable CSA if there are any conflicting issues that would inhibit compliance. Contractors will store classified material in accordance with the specific sections of 32 CFR 2001.43:
(1) CONFIDENTIAL. See 32 CFR 2001.43(b)(3).
(2) SECRET. See 32 CFR 2001.43(b)(2).
(3) TOP SECRET Documents. See 32 CFR 2001.43(b)(1).
(d) Intrusion Detection Systems (IDS). This paragraph specifies the minimum standards for an approved IDS when used for supplemental protection of TOP SECRET and SECRET material. The CSA will provide additional guidance for contingency protection procedures in the event of IDS malfunction, including contractors located in USG owned contractor operated facilities.
(1) CSA approval. (i) CSA approval is required before installing an IDS. The CSA will base approval of a new IDS on the criteria of Intelligence Community Directive 705 (available at: https://www.dni.gov/files/documents/ICD/ICD_705_SCIFs.pdf ) and any applicable intelligence community standard, Underwriters Laboratories (UL) Standard 2050 (Government agencies with a role as a CSA or CSO may obtain this reference without charge; available at: www.ul.com/contact ), or the CSA may base approval on written CSA-specific standards for the information to be protected.
(ii) Installation will be performed by an alarm services company certified by a NRTL that meets the requirements in 29 CFR 1910.7 to perform testing and certification. The NRTL-approved alarm service company is responsible for completing the appropriate alarm system description form approved by the NRTL.
(iii) All the intrusion detection equipment (IDE) used in the IDS installation will be tested and approved (or listed) by a NRTL, ensuring its proper operation and resistance from tampering. Any IDE that has not been tested and approved by a NRTL will require CSA approval.
(2) Central monitoring station. (i) For the purpose of monitoring alarms, an equivalent level of monitoring service is available from multiple types of providers. The central monitoring station may be located at a one of the following:
(A) Government contractor monitoring station (GCMS), formerly called a proprietary central station.
(B) Cleared commercial central station.
(C) Cleared protective signal service station ( e.g., fire alarm monitor).
(D) Cleared residential monitoring station.
(E) National industrial monitoring station.
(ii) SECRET-cleared central station employees at the alarm monitoring station will be in attendance in sufficient number to monitor each alarmed area within the cleared contractor facility.
(iii) The central monitoring station will be supervised continuously by a U.S. citizen who has eligibility for access to SECRET information.
(iv) The IDS must be activated at the close of business whenever the area is not occupied by cleared personnel. Any IDS exit delay function must expire prior to the cleared personnel leaving the immediate area. A record will be maintained to identify the person or persons who are responsible for setting and deactivating the IDS.
(v) Records will be maintained for 12 months indicating time of receipt of alarm, name(s) of security force personnel responding, time dispatched to facility or area, time security force personnel arrived, nature of alarm, and what follow-up actions were accomplished.
(3) Investigative response to alarms. (i) Alarm response teams will ascertain if intrusion has occurred and, if possible, assist in the apprehension of the individuals involved.
(A) If an alarm activation resets in a reasonable amount of time and no damage to the area is visible, then entrance into the area is not required and an initial response team may consist of uncleared personnel.
(B) If the alarm activation does not reset and damage is observed, then a cleared response team must be dispatched. The initial uncleared response team must stay on station until relieved by the cleared response team. If a cleared response team does not arrive within 1 hour, then a report to the CSA must be made by the close of the next business day.
(ii) The following resources may be used to investigate alarms: Proprietary security force personnel, central station guards, local law enforcement personnel, or a subcontracted guard service. The CSA may approve procedures for the use of entity cleared employees who can meet the minimum response requirements outlined in this section.
(A) For a GCMS, trained proprietary or subcontractor security force personnel, cleared to the SECRET level and sufficient in number to be dispatched immediately to investigate each alarm, will be available at all times when the IDS is in operation.
(B) For a commercial central station, protective signaling service station, or residential monitoring station, there will be a sufficient number of trained guards available to respond to alarms. Guards will be cleared only if they have the ability and responsibility to access the area or container(s) housing classified material ( i.e., keys to the facility have been provided or the personnel are authorized to enter the building or check the container or area that contains classified material).
(C) Uncleared guards dispatched by a commercial central station, protective signaling service station, or residential monitoring station in response to an alarm will remain on the premises until a designated, cleared representative of the facility arrives, or for a period of not less than 1 hour, whichever comes first. If a cleared representative of the facility does not arrive within 1 hour following the arrival of the guard, the central control station must provide the CSA with a report of the incident that includes the name of the subscriber facility, the date and time of the alarm, and the name of the subscriber's representative who was contacted to respond. A report will be submitted to the CSA by the end of business on the next business day.
(D) Subcontracted guards must be under a classified contract with either the installing alarm service company or the cleared facility.
(iii) The response time will be in accordance with the provisions in paragraphs (c)(1) through (c)(3) in this section as applicable. When environmental factors ( e.g., traffic, distance) legitimately prevent meeting the requirements for TOP SECRET information, as indicated in paragraph (c)(3) in this section, the CSA may authorize up to a 30-minute response time. The CSA approval will be documented on the alarm system description form and the specified response time will be noted on the alarm certificate. The requirement for response is 80 percent within the time limits.
(4) Installation. The IDS will be installed by an NRTL-approved entity or by an entity approved in writing by the CSA. When connected to a commercial central station, GCMS, national industrial monitoring station, or residential monitoring station, the service provided will include line security ( i.e., the connecting lines are electronically supervised to detect evidence of tampering or malfunction). The level of protection for the alarmed area will include all points of probable entry (perimeter doors and accessible windows) with magnetic contacts and motion detectors positioned in the probable intruder paths from the probable points of entry to the classified information. In accordance with Federal Standard 809, no IDS sensors (magnetic contacts or vibration detectors) will be installed on GSA-approved security containers. CSA authorization on the alarm system description form is required in the following circumstances:
(i) When line security is not available, installation will require two independent means of transmission of the alarm signal from the alarmed area to the monitoring station.
(ii) Alarm installation provides a level of protection, e.g. UL's Extent 5, based on patrolling employees and CSA approval of security-in-depth.
(iii) Where law enforcement personnel are the primary alarm response. Under those circumstances, the contractor must obtain written assurance from the police department regarding the ability to respond to alarms in the required response time.
(iv) Alarm signal transmission is over computer-controlled data-networks ( e.g., internet, intranet). The CSA will provide specific acceptance criteria ( e.g., encryption requirements) for alarms monitored over data networks.
(v) Alarm investigator response time exceeds the parameters outlined in paragraphs (c)(1) through (c)(3) in this section as applicable.
(5) Certification of compliance. Evidence of compliance with the requirements of this section will consist of a valid (current) certification by an approved NRTL for the appropriate category of service. This certificate:
(i) Will have been issued to the protected facility by the NRTL, through the alarm service company.
(ii) Serves as evidence that the alarm service company that did the installation is:
(A) Listed as furnishing security systems of the category indicated.
(B) Authorized to issue the certificate of installation as representation that the equipment is in compliance with requirements established by NRTL for the class of alarm system.
(C) Subject to the NRTL inspection program whereby periodic inspections are made of representative alarm installations by NRTL personnel to verify the correctness of certification practices.
(6) Exceptional cases. (i) If the requirements in paragraphs (d)(1) through (d)(5) in this section cannot be met, the contractor may request CSA approval for an alarm system meeting one of these conditions, which will be documented on the alarm system description form:
(A) Monitored by a central control station but responded to by a local (municipal, county, state) law enforcement organization.
(B) Connected by direct wire to alarm receiving equipment located in a local (municipal, county, State) police station or public emergency service dispatch center. This alarm system is activated and deactivated by employees of the contractor, but the alarm is monitored and responded to by personnel of the monitoring police or emergency service dispatch organization. Personnel monitoring alarm signals at police stations or dispatch centers do not require PCLs. Police department response systems may be requested only when:
( 1 ) The contractor facility is located in an area where central control station services are not available with line security or proprietary security force personnel, or a contractually-dispatched response to an alarm signal cannot be achieved within the time limits required by the CSA.
( 2 ) It is impractical for the contractor to establish a GCMS or proprietary guard force at that location. In this case, installation of these systems must use NRTL-approved equipment and be accomplished by an NRTL-approved entity meeting the applicable testing standard for the category of service.
(ii) An installation proposal, explaining how the system would operate, will be submitted to the CSA. The proposal must include:
(A) Sufficient justification for the granting of an exception and the full name and address of the police department that will monitor the system and provide the required response.
(B) The name and address of the NRTL-approved entity that will install the system, and inspect, maintain, and repair the equipment.
(iii) The response times will be in accordance with the provisions in paragraphs (c)(1) through (c)(3) in this section as applicable. Arrangements will be made with the central monitoring station to immediately notify a contractor representative on receipt of the alarm. The contractor representative is required to go immediately to the facility to investigate the alarm and to take appropriate measures to secure the classified material.
(iv) In exceptional cases where central station monitoring service is available, but no proprietary security force, central station, or subcontracted guard response is available, and where the police department does not agree to respond to alarms, and no other manner of investigative response is available, the CSA may approve cleared employees as the sole means of response.
(e) Information controls —(1) Information management system. Contractors will establish:
(i) A system to verify that classified information in their custody is used or retained only for a lawful and authorized USG purpose.
(ii) An information management system to protect and control the classified information in their possession regardless of media, to include information processed and stored on authorized information systems.
(2) Top secret information. Contractors will establish controls for TOP SECRET information and material to validate procedures are in place to address accountability, need to know, and retention, e.g., demonstrating that TOP SECRET material stored in an electronic format on an authorized classified information system does not need to be individually numbered in series. These controls are in addition to the information management system and must be applied, unless otherwise directed by the applicable CSA, regardless of the media of the TOP SECRET information, to include information processed and stored on authorized information systems. Unless otherwise directed by the applicable CSA, the contractor will establish the following additional controls:
(i) Designate TOP SECRET control officials to receive, transmit, and maintain access and accountability records to TOP SECRET information.
(ii) Conduct an annual inventory of TOP SECRET information and material.
(iii) Establish a continuous receipt system for the transmittal of TOP SECRET information within and outside the contractor location.
(iv) Number each item of TOP SECRET material in a series. Place the copy number on TOP SECRET documents, regardless of media, and on all associated transactions documents.
(v) Establish a record of TOP SECRET material when the material is:
(A) Completed as a finished document.
(B) Retained for more than 180 days after creation, regardless of the stage of development.
(C) Transmitted outside the contractor location.
(vi) Establish procedures for destruction of TOP SECRET material by two authorized persons.
(vii) Establish destruction records for TOP SECRET material and maintain the records for two years in accordance with § 117.13(d)(5) or in accordance with GCA requirements.
(3) Working papers. Contractors will establish procedures for the control of classified working papers generated in the preparation of a finished document. The contractor will:
(i) Date working papers when they are created.
(ii) Mark each page of the working papers with the highest classification level of any information contained in them and with the annotation “WORKING PAPERS.”
(iii) Destroy working papers when no longer needed.
(iv) Mark in the same manner prescribed for a finished document at the same classification level if released outside the contractor location or retained for more than 180 days from the date of origin.
(4) Combinations to locks. Contractors will follow the guidance in 32 CFR 2001.45(a)(1) and 2001.43 (c) to address thresholds when combinations will be changed. Combinations to locks used to secure vaults, open storage areas, and security containers that are approved for the safeguarding of classified information will be protected in the same manner as the highest level of classified information that the vault, open storage area, or security container is used to protect.
(5) Information system passwords. Contractors will follow the guidance established in 32 CFR 2001.45(a)(2) for the protection of passwords to information systems authorized to process and store classified information at the highest level of classification to which the information system is authorized.
(6) Reproduction of classified information. Contractors will follow the guidance established in 32 CFR 2001.45(b) for the reproduction of classified information.
(f) Transmission of classified information. Contractors will establish procedures for transmitting and receiving classified information and material in accordance with 32 CFR 2001.46.
(1) Top secret. The contractor must have written authorization from the GCA to transmit TOP SECRET material outside the contractor location.
(2) Transmission outside the United States and its Territorial Areas. The contractor may transmit classified material to a USG activity outside the United States or a U.S. territorial area only under the provisions of a classified contract or with written authorization from the GCA.
(3) Commercial delivery entities. The CSA may approve contractors to transmit SECRET or CONFIDENTIAL information within the United States and its territorial areas by means of a commercial delivery entity that is a current holder of the GSA contract for overnight delivery, and which provides nation-wide, overnight service with computer tracking and reporting features (a list of current contract holders may be found at: https://www.archives.gov/isoo/faqs#what-is-overnightcarriers ). Such entities do not need to be determined eligible for access to classified information.
(i) Prior to CSA approval, the contractor must establish and document procedures to ensure the proper protection of incoming and outgoing classified packages, including the street delivery address, for each cleared facility intending to use GSA-listed commercial delivery entities for overnight services.
(ii) Contractors will establish procedures for the use of commercial delivery entities in accordance with 32 CFR part 2001. The procedures will:
(A) Confirm that the commercial delivery entity provides nationwide, overnight delivery service with automated in-transit tracking of the classified packages.
(B) Ensure the package integrity during transit and that incoming shipments are received by appropriately cleared personnel.
(C) Not be used for COMSEC, NATO, or FGI.
(4) Couriers and hand carriers. Contractors may designate cleared employees as couriers or hand carriers. Contractors will:
(i) Brief employees providing such services on their responsibility to safeguard classified information and keep classified material in their possession at all times.
(ii) Provide employees with an identification card or badge which contains the contractor's name and the name and a photograph of the employee.
(iii) Make arrangements in advance of departure for overnight storage at a USG installation or at a cleared contractor's facility that has appropriate storage capability, if needed.
(iv) Conduct an inventory of the material prior to departure and upon return. The employee will carry a copy of the inventory with them.
(5) Use of commercial passenger aircraft. The contractor may authorize cleared employees to hand carry classified material aboard commercial passenger aircraft.
(i) Routine processing. Employees hand carrying classified material are subject to routine processing by airline security agents. Hand-held packages will normally be screened by x-ray examination. If security personnel are not satisfied with the results of the inspection and requests the prospective passenger to open a classified package for visual examination, the traveler must inform the screener that the carry-on items contain USG classified information and cannot be opened. Under no circumstances may traveler or security personnel open the classified material unless required by customs or other government officials.
(ii) Special processing. The contractor will contact the appropriate air carrier in advance to explain the particular circumstances and obtain instructions on the special screening procedures to follow when:
(A) Routine processing would subject the classified material to compromise or damage.
(B) Visual examination is or may be required to successfully screen a classified package.
(C) Classified material is in specialized containers, which due to its size, weight, or other physical characteristics cannot be routinely processed.
(iii) Authorization letter. Contractors will provide employees with written authorization to hand carry classified material on commercial aircraft that includes:
(A) Full name, date of birth, height, weight, and signature of the traveler and statement that he or she is authorized to transmit classified material.
(B) Description of the type of identification the traveler will present on request.
(C) Description of the material being hand carried, with a request that it be exempt from opening.
(D) Identification of the points of departure, destination, and known transfer points.
(E) Name, telephone number, and signature of the FSO, and the location and telephone number of the CSA.
(6) Escorts. If an escort is necessary to ensure the protection of the classified information being transported, the contractor will assign a sufficient number to each classified shipment to ensure continuous surveillance and control over the shipment while in transit. The contractor will furnish escorts with specific written instructions and operating procedures prior to shipping that include:
(i) Name and address of persons, including alternates, to whom the classified material is to be delivered.
(ii) Receipting procedures.
(iii) Means of transportation and the route to be used.
(iv) Duties of each escort during movement, during stops end route, and during loading and unloading operations.
(v) Emergency and communication procedures.
(g) Destruction. Contractors will:
(1) Destroy classified material in their possession based on the disposition instructions in the contract security classification specification or equivalent.
(2) Follow the guidance for destruction of classified material in accordance with 32 CFR 2001.47 and the destruction equipment standards in accordance with 32 CFR 2001.42(b). See https://www.nsa.gov/resources/everyone/media-destruction/ and any CSA provided guidance for additional information.
(h) Disclosure. Contractors will establish processes by which classified information is disclosed only to authorized persons.
(1) Disclosure to employees. Contractors are authorized to disclose classified information to their cleared employees with the appropriate eligibility for access to classified information and need to know as necessary, including cleared employees across the MFO, when applicable, for the performance of tasks or services essential to the fulfillment of a classified contract or subcontract.
(2) Disclosure to subcontractors. (i) Contractors:
(A) Are authorized to disclose classified information to a cleared subcontractor with the appropriate entity eligibility determination (also known as a facility security clearance) and need to know when access to classified information is necessary for the performance of tasks or services essential to the fulfillment of a prime contract or a subcontract.
(B) Will convey appropriate classification guidance for the classified information to be disclosed with the subcontract in accordance with § 117.13.
(ii) The CSA must have:
(A) Made a determination of eligibility for access to classified information for the subcontractor, at the same level, or higher, than the classified information to be disclosed, to allow for such disclosures.
(B) Approved storage capability for classified material at the subcontractor location if a physical transfer of classified material occurs.
(3) Disclosure between parent and subsidiaries. (i) Contractors:
(A) Are authorized to disclose classified information between parent and subsidiary entities with the appropriate entity eligibility determination (also known as a facility security clearance) and need to know when access to classified information is necessary for the performance of tasks or services essential to the fulfillment of a prime or subcontract.
(B) Will convey appropriate classification guidance with the agreement or procurement action that necessitates the disclosure.
(ii) The CSA must have:
(A) Made a determination of eligibility for access to classified information for both the parent and subsidiary, at the same level, or higher, than the classified information to be disclosed, to allow for such disclosures.
(B) Approved storage capability for classified material at the parent and the subsidiary if a physical transfer of classified material occurs.
(4) Disclosure to federal agencies. Contractors will not disclose classified information received or generated under a contract from one agency to any other federal agency unless specifically authorized by the agency that has classification jurisdiction over the information.
(5) Disclosure of classified information to foreign persons. Contractors will not disclose classified information to foreign persons unless specified by the contract and release of the information is authorized in writing by the government agency having classification jurisdiction over the information involved, i.e. the DOE for RD and FRD (also see § 117.23), the NSA for COMSEC, the DNI for SCI, and all other executive branch departments and agencies for classified information under their respective jurisdictions.
(6) Disclosure to other contractors. Contractors will not disclose classified information to another contractor except in furtherance of a contract, subcontract, or other GCA purpose without the authorization of the GCA, if such authorization is required by contract.
(7) Disclosure of classified information in connection with litigation. Contractors will not disclose classified information to:
(i) Attorneys hired solely to represent the contractor in any civil or criminal case in federal or State courts unless the disclosure is specifically authorized by the agency that has jurisdiction over the information.
(ii) Any federal or state court except on specific instructions of the agency, which has jurisdiction over the information or the attorney representing the United States in the case.
(8) Disclosure to the public. Contractors will not disclose classified information to the public. Contractors will not disclose unclassified information pertaining to a classified contract to the public without prior review and clearance as specified in the Contract Security Classification Specification, or equivalent, for the contract or as otherwise specified by the GCA. The procedures of this paragraph also apply to information pertaining to classified contracts intended for use in unclassified brochures, promotional sales literature, reports to stockholders, or similar material.
(i) The contractor will:
(A) Submit requests for approval through the activity specified in the GCA-provided classification guidance for the contract involved.
(B) Include in each request the approximate date the contractor intends to release the information for public disclosure and identify the media to be used for the initial release.
(C) Retain a copy of each approved request for release for a period of one inspection cycle for review by the CSA.
(D) Clear all information developed subsequent to the initial approval through the appropriate office prior to public disclosure.
(ii) Unless specifically prohibited by the GCA, the contractor does not need to request approval for disclosure of:
(A) The fact that a contract has been received, including the subject of the contract or type of item in general terms provided the name or description of the subject is not classified.
(B) The method or type of contract.
(C) Total dollar amount of the contract unless that information equates to:
( 1 ) A level of effort in a sensitive research area.
( 2 ) Quantities of stocks of certain weapons and equipment that are classified.
(D) Whether the contract will require the hiring or termination of employees.
(E) Other information that from time-to-time may be authorized on a case-by-case basis in a specific agreement with the contractor.
(F) Information previously officially approved for public disclosure.
(iii) Information that has been declassified is not authorized for public disclosure. If the information is comingled with CUI, or qualifies as CUI once declassified, it will be marked and protected as CUI until it is decontrolled pursuant to 32 CFR part 2002 and reviewed for public release. If the information does not qualify as CUI, it will be protected in accordance with the basic safeguarding requirements in 48 CFR 52.204-21 and subject to the agency's public release procedures. Contractors will request approval for public disclosure of declassified information in accordance with the procedures of this paragraph.
(i) Disposition. Contractors will:
(1) Establish procedures for review of their classified holdings on a recurring basis to ensure the classified holdings are in support of a current contract or authorization to retain beyond the end of the contract period.
(2) Destroy duplicate copies as soon as practical.
(3) For disposition of classified material not received under a specific contract:
(i) Return or destroy classified material received with a bid, proposal, or quote if the bid, proposal, or quote is not:
(A) Submitted or is withdrawn within 180 days after the opening date of bids, proposals, or quotes.
(B) Accepted within 180 days after notification that a bid, proposal, or quote has not been accepted.
(ii) If the classified material was not received under a specific contract, such as material obtained at classified meetings or from a secondary distribution center, return or destroy the classified material within one year after receipt.
(j) Retention. The provisions of § 117.13(d)(5) apply for retention of classified material upon completion of a classified contract.
(1) If contractors propose to retain copies of classified material beyond 2 years, the contractor will identify:
(i) TOP SECRET material identified in a list of specific documents unless the GCA authorizes identification by subject and approximate number of documents.
(ii) SECRET and CONFIDENTIAL material may be identified by general subject and the approximate number of documents.
(iii) Contractors will include a statement of justification for retention beyond two years based on if the material:
(A) Is necessary for the maintenance of the contractor's essential records.
(B) Is patentable or proprietary data to which the contractor has the title.
(C) Will assist the contractor in independent research and development efforts.
(D) Will benefit the USG in the performance of other prospective or existing agency contracts.
(E) Will benefit the USG in the performance of another active contract and will be transferred to that contract (specify contract).
(2) If the GCA does not authorize retention beyond two years, the contractor will destroy all classified material received or generated in the performance of a classified contract unless it has been declassified or the GCA has requested that the material be returned.
(k) Termination of security agreement. Notwithstanding the provisions for retention outlined in paragraph (i) in this section, in the event that the CSA terminates the contractor's eligibility for access to classified information, the contractor will return all classified material in its possession to the GCA concerned, or dispose of such material in accordance with instructions from the CSA.
(l) Safeguarding CUI. While outside the requirements of the NISPOM, when a classified contract also includes provisions for protection of CUI, contractors will comply with those contract requirements.
§ 117.16   Visits and meetings.
(a) Visits. This paragraph applies when, for a lawful and authorized USG purpose, it is anticipated that classified information will be disclosed during a visit to a cleared contractor facility or to a USG facility.
(1) Classified visits. The number of classified visits will be held to a minimum. The contractor:
(i) Must determine that the visit is necessary and the purpose of the visit cannot be achieved without access to, or disclosure of, classified information.
(ii) Will establish procedures to ensure positive identification of visitors, appropriate PCL, and need-to-know prior to the disclosure of any classified information.
(iii) Will establish procedures to ensure that visitors are only afforded access to classified information consistent with the purpose of the visit.
(2) Need-to-know determination. The responsibility for determining need-to-know in connection with a classified visit rests with the individual who will disclose classified information during the visit. Need-to-know is generally based on a contractual relationship between the contractors. In other circumstances, disclosure of the information will be based on an assessment that the receiving contractor has a bona fide need to access the information in furtherance of a GCA purpose.
(3) Visits by USG representatives. Representatives of the USG, when acting in their official capacities as inspectors, investigators, or auditors, may visit a contractor's facility, provided these representatives present appropriate USG credentials upon arrival.
(4) Visit authorization. (i) If a visit requires access to classified information, the host contractor will verify the visitor's PCL level. Verification of a visitor's PCL may be accomplished by a review of a CSA-designated database that contains the information or by a visit authorization letter (VAL) provided by the visitor's employer.
(ii) If a CSA-designated database is not available and a VAL is required, contractors will include in all VALs:
(A) Contractor's name, employee's name, address, and telephone number, assigned commercial and government entity (CAGE) code, if applicable, and certification of the level of the entity eligibility determination.
(B) Name, date and place of birth, and citizenship of the employee intending to visit.
(C) Certification of the proposed visitor's PCL and any special access authorizations required for the visit.
(D) Name of person(s) to be visited.
(E) Purpose and sufficient justification for the visit to allow for a determination of the necessity of the visit.
(F) Date or period during which the VAL is to be valid.
(5) Long term visitors. (i) When USG employees or employees of one contractor are temporarily stationed at another contractor's facility, the security procedures of the host contractor will govern.
(ii) USG personnel assigned to or visiting a contractor facility and engaged in oversight of an acquisition program will retain control of their work product. Classified work products of USG employees will be handled in accordance with this rule. Contractor procedures will not require USG employees to relinquish control of their work products, whether classified or not, to a contractor.
(iii) Contractor employees at USG installations will follow the security requirements of the host. This does not relieve the contractor from security oversight of their employees who are long-term visitors at USG installations.
(b) Classified meetings. This paragraph applies to a conference, seminar, symposium, exhibit, convention, training course, or other such gathering during which classified information is disclosed, hereafter called a “meeting.” Disclosure of classified information to large diverse audiences such as conferences increases security risks. Classified disclosure at such meetings may occur when it serves a government purpose and adequate security measures have been provided in advance.
(1) Meeting conducted by a cleared contractor. If conducted by a cleared contractor, the meeting is authorized by a USG agency that has agreed to assume security jurisdiction. The USG agency:
(i) Must approve security arrangements, announcements, attendees, and the location of the meeting.
(ii) May delegate certain responsibilities to a cleared contractor for the security arrangements and other actions necessary for the meeting under the general supervision of the USG agency.
(2) Request for authorization. Contractors desiring to conduct meetings that require sponsorship will submit their requests to the USG agency that has principal interest in the subject of each meeting. Requests for authorization will include:
(i) An explanation of the USG purpose to be served by disclosing classified information at the meeting and why the use of conventional channels for release of the classified information will not advance those interests.
(ii) The subject of the meeting and scope of classified topics, to include the classification level, to be disclosed at the meeting.
(iii) The expected dates and location of the meeting.
(iv) The general content of the proposed announcement or invitation to be sent to prospective attendees or participants.
(v) The identity of any other non-government organization involved and a full description of the type of support it will provide.
(vi) A list of any foreign representatives (including their nationality, name, organizational affiliation) whose attendance at the meeting is proposed.
(vii) A description of the security arrangements necessary for the meeting to comply with the requirements of this rule.
(3) Locations of meetings. Classified sessions will be held only at a USG installation or a cleared contractor facility where adequate physical security and procedural controls have been approved. The authorizing USG agency is responsible for evaluating and approving the location proposed for the meeting.
(4) Security arrangements for meetings. The contractor will develop the security measures and procedures to be used and obtain the authorizing agency's approval. The security arrangements must provide:
(i) Announcements. Approval of the authorizing agency will be obtained for all announcements of the meeting.
(A) Announcements will be unclassified and will be limited to a general description of topics expected to be presented, names of speakers, and administrative instructions for requesting invitations or participation. Classified presentations will not be solicited in the announcement.
(B) When the meeting has been approved, announcements may only state that the USG agency has authorized the conduct of classified sessions and will provide necessary security assistance.
(C) The announcement will further specify that security clearances and justification to attend classified sessions are to be forwarded to the authorizing agency or its designee.
(D) Invitations to foreign persons will be sent by the authorizing USG agency.
(ii) Clearance and need-to-know. All persons in attendance at classified sessions will possess the requisite clearance and need-to-know for the information to be disclosed.
(A) Need-to-know will be determined by the authorizing agency or its designee based on the justification provided.
(B) Attendance will be authorized only to those persons whose security clearance and justification for attendance have been verified by the security officer of the organization represented.
(C) The names of all authorized attendees or participants must appear on an access list with entry permitted to the classified session only after verification of the attendee's identity based on presentation of official photographic identification such as a passport, contractor or USG identification card.
(iii) Presentations. Classified information must be authorized for disclosure in advance by the USG agency having jurisdiction over the information to be presented.
(A) Individuals making presentations at meetings will provide sufficient classification guidance to enable attendees to identify what information is classified and the level of classification.
(B) Classified presentations will be delivered orally or visually.
(C) Copies of classified presentation materials will not be distributed at the classified meeting, and any classified notes or electronic recordings of classified presentations will be classified, safeguarded, and transmitted as required by this rule.
(iv) Physical security. The physical security measures for the classified sessions will provide for control of, access to, and dissemination of, the classified information to be presented and will provide for secure storage capability, if necessary.
(5) Disclosure authority at meetings. Authority to disclose classified information at meetings, whether disclosure is by officials of industry or USG, must be granted by the USG agency or activity that has classification jurisdiction over the information to be disclosed. Each contractor that desires to disclose classified information at a meeting is responsible for requesting and obtaining disclosure approvals. Associations are not responsible for ensuring that classified presentations and papers of other organizations have been approved for disclosure. A contractor desiring to disclose classified information at a meeting will:
(i) Obtain prior written authorization for each proposed disclosure of classified information from the USG agency having jurisdiction over the information involved.
(ii) Furnish a copy of the disclosure authorization to the USG agency sponsoring the meeting.
(6) Requests to attend classified meetings. Before a contractor employee can attend a classified meeting, the contractor will provide justification for why the employee requires access to the classified information, cite the classified contract or GCA program or project involved, and forward the information to the authorizing USG agency.
§ 117.17   Subcontracting.
(a) Prime contractor responsibilities —(1) Responsibilities. Before a prime contractor may release or disclose classified information to a subcontractor, or cause classified information to be generated by a subcontractor, a determination that access to classified information will be required and such access serves a legitimate USG requirement for the performance of a “classified contract” in accordance with § 117.9(a) must be made. Prime contractors are responsible for communicating the appropriate security requirements to all subcontractors.
(i) A “security requirements clause” and a “Contract Security Classification Specification,” or equivalent, will be incorporated in the solicitation and in the subcontract. (See the “security requirements clause” in the prime contract.)
(ii) The subcontractor must possess an appropriate entity eligibility determination and a classified information safeguarding capability if possession of classified information will be required.
(A) If access to classified information will not be required in the pre-award phase, prospective subcontractors are not required to possess an entity eligibility determination to receive or bid on the solicitation.
(B) If a prospective subcontractor requires access to classified information during the pre-award phase and does not have the appropriate entity eligibility determination or a classified information safeguarding capability, the prime contractor will request the CSA of the subcontractor to initiate the necessary action.
(iii) If access to classified information will not be required, the contract is not a classified contract within the meaning of this rule. If the prime contract contains requirements for release or disclosure of protected information that is not classified, such as CUI, the requirements will be incorporated in the solicitation and the subcontract and are not covered by this rule.
(2) Prospective subcontractors entity eligibility determinations. (i) The prime contractor will verify whether the prospective subcontractors have the appropriate entity eligibility determination and also a classified information safeguarding capability, if a subcontract requirement. This determination can be made if there is an existing contractual relationship between the parties involving classified information of the same or higher category, and must be verified by accessing the CSA-designated database, or by contacting the CSA.
(ii) If a prospective subcontractor does not have the appropriate entity eligibility determination or a classified information safeguarding capability, the prime contractor will request that the CSA of the subcontractor initiate the necessary action.
(A) Requests will include, at a minimum, the full name, address, and contact information for the requester; the full name, address, and contact information for a contact at the facility to be processed for an entity eligibility determination; the level of clearance and the required classified information safeguarding capability; and full justification for the request.
(B) Requests for safeguarding capability will include a description, quantity, end-item, and classification of the information related to the proposed subcontract.
(C) Other factors necessary to help the CSA determine if the prospective subcontractor meets the requirements of this rule will be identified, such as any special access requirements.
(3) Lead time for entity eligibility determination when awarding to an uncleared subcontractor. Requesting contractors will allow sufficient lead time in connection with the award of a classified subcontract to enable an uncleared bidder to be processed for the necessary entity eligibility determination. When the entity eligibility determination cannot be granted in sufficient time to qualify the prospective subcontractor for participation in the current procurement action, the CSA will continue the entity eligibility determination processing action to qualify the prospective subcontractor for future contract consideration provided:
(i) The delay in processing the entity eligibility determination was not caused by a lack of cooperation on the part of the prospective subcontractor.
(ii) Future classified negotiations may occur within 12 months.
(iii) There is reasonable likelihood the subcontractor may be awarded a classified subcontract.
(iv) Subcontracting that involves access to FGI. (A) A U.S. contractor may award a subcontract that involves access to FGI to another U.S. contractor after verifying with the CSA that the prospective subcontractor has the appropriate entity eligibility determination and a classified information storage capability, and review of the prime contract to determine if there are any contractual limitations for approval before awarding a subcontract. The contractor awarding a subcontract will provide appropriate security classification guidance and incorporate the pertinent security provisions in the subcontract.
(B) The contractor cannot award subcontracts involving FGI to a contractor in a third country or to a U.S. entity with a limited entity eligibility determination based on third-country FOCI without the express written consent of the originating foreign government. The CSA will coordinate with the appropriate foreign government authorities.
(b) Security classification guidance. (1) Prime contractors will ensure that a Contract Security Classification Specification, or equivalent, is incorporated in each classified subcontract.
(i) When preparing classification guidance for a subcontract, the prime contractor may extract pertinent information from:
(A) The Contract Security Classification Specification, or equivalent, issued with the prime contract.
(B) Security classification guides issued with the prime contract.
(C) Any security guides that provide guidance for the classified information furnished to, or that will be generated by, the subcontractor.
(ii) The Contract Security Classification Specification, or equivalent, prepared by the prime contractor will be certified by a designated official of the contractor.
(iii) In the absence of exceptional circumstances, the classification specification will not contain any classified information. If classified supplements are required as part of the Contract Security Classification Specification, or equivalent, they will be identified and forwarded to the subcontractor by separate correspondence.
(2) An original Contract Security Classification Specification, or equivalent, will be included with each RFQ, RFP, IFB, or other solicitation to ensure that the prospective subcontractor is aware of the security requirements of the subcontract and can plan accordingly. An original Contract Security Classification Specification, or equivalent, will also be included in the subcontract awarded to the successful bidder.
(3) A revised Contract Security Classification Specification, or equivalent, will be issued as necessary during the lifetime of the subcontract when the security requirements change.
(4) Requests for public release by a subcontractor will be forwarded through the prime contractor to the GCA.
(c) Responsibilities upon completion of the subcontracts. (1) Upon completion of the subcontract, the subcontractor may retain classified material received or generated under the subcontract for a two-year period, in accordance with the provisions in § 117.13(d)(5).
(2) If retention is required beyond the two-year period, the subcontractor must request written retention authority through the prime contractor to the GCA, including the information required by § 117.15(j).
(3) If retention authority is approved by the GCA, the prime contractor will issue a final Contract Security Classification Specification, or equivalent, annotated to provide the retention period and final disposition instructions.
(d) Notification of invalidation, marginal, or unsatisfactory conditions. The prime contractor will be notified if the CSA discovers marginal or unsatisfactory conditions at the subcontractor's facility or if the CSA invalidates the subcontractor's facility clearance. Once notified, the prime contractor will follow the instructions received on what action, if any, should be taken in order to safeguard classified material relating to the subcontract.
§ 117.18   Information system security.
(a) General. (1) Contractor information systems that are used to capture, create, store, process, or distribute classified information must be properly managed to protect against unauthorized disclosure of classified information. The contractor will implement protective measures using a risk-based approach that incorporates minimum standards for their insider threat program in accordance with CSA-provided guidance.
(2) The CSA will issue guidance based on requirements for federal systems, pursuant to 44 U.S.C. Ch. 35 of subchapter II, also known as the “Federal Information Security Modernization Act,” and as set forth in National Institute of Standards and Technology (NIST) Special Publication 800-37 (available at: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final ), Committee on National Security Systems (CNSS) Instruction 1253 (available at: https://www.cnss.gov/CNSS/openDoc.cfm?QwPYrAJ5Ldq+s+jvttTznQ== ), and other applicable CNSS and NIST publications ( e.g., NIST Special Publication 800-53).
(b) Information system security program. The contractor will maintain an information system security program that supports overall information security by incorporating a risk-based set of management, operational, and technical security controls in accordance with CSA-provided guidance. The contractor will incorporate into the program:
(1) Policies and procedures that reduce information security risks to an acceptable level and address information security throughout the information system life cycle.
(2) Plans and procedures to assess, report, isolate, and contain data spills and compromises, to include sanitization and recovery methods.
(3) Information system security training for authorized users, as required in CSA provided guidance.
(4) Policies and procedures that address key components of the contractor's insider threat program, such as:
(i) User activity monitoring network activity, either automated or manual.
(ii) Information sharing procedures.
(iii) A continuous monitoring program.
(iv) Protecting, interpreting, storing, and limiting access to user activity monitoring automated logs to privileged users.
(5) Processes to continually evaluate threats and vulnerabilities to contractor activities, facilities, and information systems to ascertain the need for additional safeguards.
(6) Change control processes to accommodate configuration management and to identify security relevant changes that may require re-authorization of the information system.
(7) Methods to ensure users are aware of rights and responsibilities through the use of banners and user agreements.
(c) Contractor responsibilities —(1) Certification. The contractor will:
(i) Certify to the CSA that the security program for information systems to process classified information addresses management, operation, and technical controls in accordance with CSA-provided guidelines.
(ii) Provide adequate resources to the information system security program and organizationally align to ensure prompt support and successful execution of a compliant information system security program.
(2) ISSM. Contractors that are or will be processing classified information on an information system will appoint an employee ISSM. The contractor will confirm that the ISSM is adequately trained, has sufficient experience, and possesses technical competence commensurate with the complexity of the information system. The ISSM will:
(i) Oversee the development, implementation, and evaluation of the contractor's information system program for contractor management, information system personnel, users, and others as appropriate.
(ii) Coordinate with the contractor's insider threat senior program official so that insider threat awareness is addressed in the contractor's information system security program.
(iii) Develop, document, and monitor compliance of the contractor's information system security program in accordance with CSA-provided guidelines for management, operational, and technical controls.
(iv) Verify self-inspections are conducted at least every 12 months on the contractor's information systems that process classified information, and that corrective actions are taken for all identified findings.
(v) Certify to the CSA in writing that the systems security plan (SSP) is implemented for each authorized information systems, specified in the SSP; the specified security controls are in place and properly tested; and the information system continues to function as described in the SSP.
(vi) Brief users on their responsibilities with regard to information system security and verify that contractor personnel are trained on the security restrictions and safeguards of the information system prior to access to an authorized information system.
(vii) Develop and maintain security documentation of the security authorization request to the CSA. Documentation may include:
(A) SSPs.
(B) Security assessment reports.
(C) Plans of actions and milestones.
(D) Risk assessments.
(E) Authorization decision letters.
(F) Contingency plans.
(G) Configuration management plans.
(H) Security configuration checklists.
(I) System interconnection agreements.
(3) Information systems security officer (ISSO). The ISSM may assign an ISSO. If assigned, the ISSO will:
(i) Verify the implementation of the contractor's information system security program as delegated by the ISSM.
(ii) Ensure continuous monitoring strategies and verify corrective actions to the ISSM.
(iii) Conduct self-inspections and verify corrective actions to the ISSM.
(4) Information system users. All information system users will:
(i) Comply with the information system security program requirements as part of their responsibilities for protecting classified information.
(ii) Be accountable for their actions on an authorized information system.
(iii) Not share any authentication mechanisms (including passwords) issued for the control of their access to an information system.
(iv) Protect authentication mechanisms at the highest classification level and most restrictive classification category of information to which the mechanisms permit access.
(v) Be subject to monitoring of their activity on any classified network, understanding that the results of such monitoring can be used against them in a criminal, security, or administrative proceeding or action.
(vi) Notify the ISSM or ISSO when access to a classified system is no longer required.
(d) Information system security life-cycle. The CSA-provided guidance on the information system security life-cycle is based on the risk management framework outlined in NIST special publication 800-37 that emphasizes:
(1) Building security into information systems during initial development.
(2) Maintaining continuous awareness of the current state of information system security.
(3) Keeping contractor management informed to facilitate risk management decisions.
(4) Supporting reciprocity of information system authorizations.
(e) Risk management framework. The risk management framework is a seven-step process used for managing information system security-related risks. These steps will be used to help ensure security capabilities provided by the selected security controls are implemented, tested, validated, and approved by the USG authorizing official with a degree of assurance appropriate for the information system. This process accommodates an on-going risk mitigation strategy.
(1) Prepare. The contractor will execute essential activities at the organization, mission and business process, and system levels of the organization to help prepare the organization to manage its security and privacy risks using the Risk Management Framework.
(2) Categorize. The contractor will categorize the information system and the information processed, stored, and transmitted by the information system based on an impact analysis. Unless imposed by contract, the information system baseline is moderate-confidentiality, low-integrity, and low-availability.
(3) Select. The contractor will select an initial set of baseline security controls for the information system based on the security categorization; tailoring and supplementing the security control baseline as needed based on an organizational assessment of risk and local conditions.
(4) Implement. The contractor will implement the security controls and document how the controls are deployed within the information system and the operational environment.
(5) Assess. The contractor will assess the security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the information system. The contractor will review and certify to the CSA that all systems have the appropriate protection measures in place.
(6) Authorize. The CSA will use the information provided by the contractor to make a timely, credible, and risk-based decision to authorize the system to process classified information. The CSA must authorize the system before the contractor can use the system to process classified information.
(7) Monitor. The contractor will monitor and assess selected security controls in the information system on an ongoing basis:
(i) Effectiveness of security controls.
(ii) Documentation of changes to the information system and the operational environment.
(iii) Analysis of the security impact of changes to the information system.
(iv) Making appropriate reports to the CSA.
(f) Unclassified information systems that process, store, or transmit CUI. While outside the requirements of the NISPOM, contractors will comply with contract requirements regarding contractor information systems that process, store, or transmit CUI.
§ 117.19   International security requirements.
(a) General. This section provides information and procedures governing the protection of classified information in international programs.
(b) Disclosure of classified U.S. information to foreign interests —(1) Applicable federal law. The transfer of articles, services, and related data to a foreign person, within or outside the United States, or the movement of such material or information to any destination outside of the legal jurisdiction of the United States constitutes an export. Depending on the nature of the articles or data, most exports are pursuant to (1) 22 U.S.C. chapter 39, also known and referred to in this rule as the “Arms Export Control Act,” (2) 50 U.S.C. 4801 et seq., also known as the “Export Control Reform Act of 2018,” or (3) the AEA. This section applies to those exports that involve classified information.
(2) Security agreements —(i) Bilateral security agreements ( e.g., General Security of Information Agreements and General Security of Military Information Agreements) are negotiated with various foreign governments. Confidentiality requested by some foreign governments prevents a listing of the countries that have executed these agreements. The bilateral security agreement, negotiated through diplomatic channels:
(A) Requires that each government provide substantially the same degree of protection to classified information released by the other government.
(B) Contains provisions concerning limits on the use of each government's information, including restrictions on third-party transfers and proprietary rights.
(C) Does not commit governments to share classified information, nor does it constitute authority to release classified material to that government.
(D) Satisfies, in part, the eligibility requirements of the Arms Export Control Act concerning the agreement of the recipient foreign government to protect U.S. classified defense articles and classified information.
(ii) The applicable CSA will provide a mechanism for contractors to access, for official purposes, classified general security agreements.
(iii) Industrial security agreements have been negotiated with certain foreign governments that identify the procedures to be used when foreign government classified information is provided to U.S. industry and UUSG classified information is provided to foreign defense industry.
(3) Authorization for disclosure. The GCA will provide disclosure guidance.
(i) Contractors will only disclose non-public USG information to foreign persons in accordance with specified requirements of the contract. In the absence of any specified requirements the contractor will not disclose non-public USG information to foreign persons.
(ii) Disclosure authorization may be in the form of an export license or other export authorization by a cognizant export authority.
(iii) The contractor may not use disclosure guidance provided by the GCA for a previous contract or program unless so instructed in writing by the GCA or the licensing authority.
(iv) Disclosure and export of classified information, authorized by an appropriate USG disclosure official, by a contractor will ensure the following:
(A) International agreements. Contractors may not disclose classified information until agreements are signed by the participating government and disclosure guidance and security arrangements are established. The export of technical data pursuant to such agreements may be exempt by approval of the Department of State or the Department of Commerce.
(B) Symposia, seminars, exhibitions, and conferences. Contractors must assure that any foreign nationals who will be attending a classified gathering have the appropriate export license, disclosure authority, and security assurance on file.
(C) Visits by foreign nationals to the contractor. The contractor will limit disclosure of classified information to that specific information authorized in connection with an approved visit request and an export authorization, as required.
(D) Temporary exports. Classified articles, including articles that require the use of classified information for operation, exported for demonstration purposes must remain under U.S. control. The contractor must obtain an export authorization from the relevant authority ( i.e., from the Department of State in accordance with 22 CFR parts 120-130, also known as and referred to in this rule as the “International Traffic in Arms Regulations,” or from the Department of Commerce in accordance with 15 CFR parts 730-774, also known as the “Export Administration Regulations”).
(4) Direct commercial arrangements. (i) The disclosure of classified information may be authorized pursuant to a direct commercial sale with the appropriate export authorization. A direct commercial arrangement includes sales, loans, leases, or grants of classified items, including sales under a government agency sales financing program.
(ii) If a proposed disclosure is in support of a foreign government requirement, the contractor should consult with U.S. in-country officials, normally the U.S. Security Assistance/Armaments Cooperation Office or Commercial Counselor.
(A) Before a contractor makes a proposal to a foreign interest that involves the eventual disclosure of U.S. classified information, the contractor must obtain appropriate government disclosure authorization.
(B) Such disclosure authorization does not equate with authorization for export. Export authorization must be obtained from the appropriate regulatory body.
(iii) The contractor will request a FCL assurance for a foreign entity through the CSA from the security authority of the foreign entity's sponsoring government prior to entering into a contractual arrangement with the foreign entity.
(5) Subcontract security provisions. (i) A U.S. contractor may be authorized to enter into an agreement involving classified information with a foreign contractor. The U.S. contractor's empowered official will verify the contractor can release the information to a foreign person. Such agreements may include:
(A) Award of a subcontract.
(B) Department of State authorized manufacturing license agreement, technical assistance agreement, or other direct commercial arrangement.
(ii) The contractor will incorporate security provisions into the subcontract document or agreement, and provide security classification guidance by means of a Contract Security Classification Specification, or equivalent.
(iii) The contractor will provide a copy of the signed contract with the provisions and the classification guidance to the CSA.
(iv) If the export authorization specifies that additional security arrangements are necessary for performance on the contract, the contractor will incorporate those additional arrangements by appropriate provision in the contract or in a separate security document.
(v) The contractor will prepare and maintain a written record that identifies the originator or source of classified information that will be used in providing classified defense articles, material or services to foreign customers. The contractor will maintain this listing with the contractor's record copy of the pertinent export authorization.
(vi) The contractor will include the security provisions in accordance with paragraph (b)(5) in this section in all contracts and subcontracts involving classified information that are awarded to foreign contractors. Contractors must insert the bracketed contract specific information ( e.g., applicable country and disposition of classified material) where noted, when using the following security clauses in the contract.
(A) All classified information and material furnished or generated under the contract will be protected to ensure that:
( 1 ) The recipient will not release the information or material to any third party without disclosure authorization and export authorization, as appropriate.
( 2 ) The recipient will afford the information and material a degree of protection equivalent to that afforded it by the releasing government.
( 3 ) The recipient will not use the information and material for other than the purpose for which it was furnished without the prior written consent of the releasing government.
(B) Classified information and material furnished or generated under this contract will be transferred through government channels or other channels specified in writing by the governments of the United States and [insert applicable country]. It will only be transferred to persons who have an appropriate security clearance and an official need for access to the information in order to perform on the contract.
(C) Classified information and material furnished under the contract will be re-marked by the recipient with its government's equivalent security classification markings.
(D) Classified information and material generated under the contract must be assigned a security classification as specified by the Contract Security Classification Specifications, or equivalent, provided with this contract.
(E) All cases in which it is known or there is reason to believe that classified information or material furnished or generated under the contract has been lost or disclosed to unauthorized persons will be reported promptly and fully by the contractor to its government's security authorities.
(F) Classified information and material furnished or generated pursuant to the contract will not be further provided to another potential contractor or subcontractor unless:
( 1 ) A potential contractor which is located in the United States or [insert applicable country] has been approved for access to classified information and material by the USG or [insert applicable country] security authorities; or
( 2 ) If located in a third country, prior written USG consent is obtained.
(G) Upon completion of the contract, all classified material furnished or generated pursuant to the contract will be [insert whether the material is to be returned or destroyed, or provide other instructions].
(H) The recipient contractor will insert terms that substantially conform to the language of these provisions, including this one, in all subcontracts under this contract that involve access to classified information furnished or generated under this contract.
(c) FGI —(1) General. The contractor will notify the csa when awarded contracts by a foreign interest that will involve access to classified information. The csa will oversee and ensure implementation of the security requirements of the contract on behalf of the foreign government, including the establishment of channels for the transfer of classified material.
(2) Contract security requirements. The foreign entity that awards a classified contract is responsible for providing appropriate security classification guidance and any security requirements clauses. The contractor will report to the CSA when a foreign entity fails to provide classification guidance.
(3) Marking foreign government classified material. Foreign government classified material will be marked in accordance with § 117.14(l).
(4) Foreign Government RESTRICTED Information and “In Confidence” Information. Foreign government RESTRICTED information and “in confidence” information will be marked in accordance with § 117.14(m).
(5) Marking U.S. documents containing FGI. U.S. documents containing FGI will be marked in accordance with § 117.14(n).
(6) Marking documents prepared for foreign governments. Marking documents prepared for foreign governments will be marked in accordance with § 117.14(o).
(7) Storage and control. Contractors will store foreign government material and control access generally in the same manner as U.S. classified material of an equivalent classification. Contractors will store foreign government material in a manner that will separate it from other material. Separation can be accomplished by establishing distinct files in a storage container or on an information system.
(8) Disclosure and use limitations. (i) FGI is provided by the foreign government to the United States. The contractor will:
(A) Not disclose FGI to nationals of a third country, or to any other third party, or use it for any purpose other than that for which it was provided without the prior written consent of the originating foreign government.
(B) Submit requests for other uses or further disclosure to the GCA for U.S. contracts, and through the CSA for direct commercial contracts.
(ii) Approval of the request by the foreign government does not eliminate the requirement for the contractor to obtain an export authorization.
(9) Transfer. The contractor will transfer FGI within the United States and its territories using the same channels as specified for U.S. classified information of an equivalent classification, except that contractors cannot use non-cleared express overnight carriers for FGI.
(10) Reproduction. The reproduction of foreign government TOP SECRET or equivalent information requires the written approval of the originating government.
(11) Disposition. The contractor:
(i) Will destroy FGI on completion of the contract unless the contract specifically authorizes retention or return of the information to the U.S. GCA or foreign government that provided the information.
(ii) Must witness the destruction of TOP SECRET, execute a destruction certificate, and retain the destruction certificate for two years.
(12) Reporting of improper receipt of foreign government material. The contractor will report improper receipt of foreign government material in accordance with § 117.8(c)(13).
(13) Subcontracting. Subcontracting procedures will be in accordance with § 117.17(a)(4).
(d) International transfers of classified material —(1) General. This paragraph (d) contains the procedures for international transfers of classified material through government-to-government channels or other arrangements agreed to by the governments involved, otherwise referred to as government-to-government transfers. The requirements in this paragraph (d) do not apply to the transmission of classified material to usg activities outside the united states.
(i) All international transfers of classified material must take place through channels approved by both governments. U.S. control of classified material must be maintained until the material is officially transferred to the intended recipient government through its designated government representative (DGR).
(ii) To ensure government control, written transmission instructions must be prepared for all international transfers of classified material. The contractor is responsible for the preparation of instructions for direct commercial arrangements, and the GCA will prepare instructions for government arrangements.
(iii) The contractor will contact the CSA at the earliest possible stage in deliberations that will lead to the international transfer of classified material. The CSA will advise the contractor on the transfer arrangements, identify the recipient government's DGR, appoint a U.S. DGR, and ensure that the transportation plan prepared by the contractor or foreign government is adequate.
(iv) The contractor's empowered official is responsible for requests for all export authorizations, including ones that will involve the transfer of classified information.
(2) Transfers of freight —(i) Transportation plan (TP). (A) A requirement to prepare a TP will be included in each arrangement that involves the international transfer of classified material as freight. The TP will:
( 1 ) Describe requirements for the secure shipment of the material from the point of origin to the ultimate destination.
( 2 ) Provide for security requirements in the event the transfer cannot be made promptly.
(B) The U.S. and recipient government DGRs will be identified in the TP as well as any requirement for an escort. When there are to be repetitive shipments, a notice of classified consignment will be used.
(ii) Government agency arrangements. Classified material to be furnished to a foreign government under such transactions normally will be shipped via government agency-arranged transportation and be transferred to the foreign government's DGR within the recipient government's territory.
(A) The government agency that executes the arrangement is responsible, in coordination with the recipient foreign government, for preparing a TP.
(B) When the point of origin is a U.S. contractor facility, the GCA will provide the contractor with a copy of the TP and the applicable letter of offer and acceptance. If a freight forwarder will be involved in processing the shipment, the GCA will provide a copy of the TP to the freight forwarder.
(C) Commercial arrangements. ( 1 ) The contractor will prepare a TP in coordination with the receiving government. This requirement applies whether the material is moved by land, sea, or air, and applies to U.S. and foreign classified contracts.
( 2 ) After the CSA approves the TP, the CSA will forward it to the recipient foreign government security authorities for final coordination and approval. The CSA will notify the contractor upon the concurrence by the respective parties.
(D) International carriers. The international transfer of classified material will be made using only ships, aircraft, or other carriers that:
( 1 ) Are owned or chartered by the USG or under U.S. registry;
( 2 ) Are owned or chartered by or under the registry of the recipient government; or
( 3 ) Are other than those described that are expressly authorized to perform this function in writing by the Designated Security Authority of the GCA and the security authorities of the foreign government involved. This authority cannot be delegated and this exception may be authorized only when a carrier described in paragraph (d)(2)(iv)(A) or (d)(2)(iv)(B) in this section is not available and an urgent operational requirement dictates use of the exception.
(E) Escorts. ( 1 ) The contractor must provide escorts for international shipments of SECRET or CONFIDENTIAL material by air.
( 2 ) Escorts must have an eligibility determination and access to classified information at the classification level of the material being shipped.
( 3 ) Escorts are responsible for ensuring that the classified material being shipped is safeguarded in the event of an emergency stop en route, re-routing of the aircraft, or in the event that the recipient government's representative fails to meet the shipment at its destination.
( 4 ) The contractor does not have to provide escorts if:
( i ) The classified material is shipped by the Defense Transportation System or a U.S. military carrier.
( ii ) The recipient government DGR has signed for the receipt of the classified material within the United States.
( iii ) The classified material is shipped via a military carrier of the recipient government or a carrier owned by or registered to the recipient government.
( iv ) The classified material is shipped via a cleared U.S. commercial freight carrier, so long as the contractor has a written agreement from the U.S. commercial freight carrier to provide an escort who is eligible for access to classified information and has access to classified information at the classification level of the material being shipped.
( v ) There are exceptional circumstances, and procedures have been approved by both the USG and the recipient government.
(3) Secure communications plan. (i) The contractor is required to meet all requirements outlined in this section, as applicable, for the secure communications plan.
(ii) The secure communications plan may be approved within a program security instruction, SSP, or a government to government agreement by the designated security authorities. A separate memorandum of understanding or memorandum of agreement is not required.
(iii) Additionally, an SSP must be authorized in accordance with § 117.18 and the CSA provided guidance.
(4) Return of material for repair, modification, or maintenance. (i) A foreign government or foreign contractor may return classified material to a U.S. contractor for repair, modification, or maintenance.
(ii) The approved methods of return will be specified in either the GCA sales arrangement, the security requirements section of a direct commercial sales arrangement or, in the case of material transferred as freight, in the original TP.
(iii) The contractor, on receipt of notification that classified material is to be received, will notify the applicable CSA.
(5) Use of freight forwarders. (i) A commercial freight forwarder may be used to arrange for the international transfer of classified material as freight.
(A) The freight forwarder must be under contract to a USG agency, U.S. contractor, or the recipient foreign government.
(B) The contract will describe the specific functions to be performed by the freight forwarder.
(C) The responsibility for security and control of the classified material that is processed by freight forwarders remains with the USG until the freight is transferred to a DGR of the recipient government.
(ii) Only freight forwarders that have a valid determination of eligibility for access to classified information and storage capability for classified material at the appropriate level are eligible to take custody or possession of classified material for delivery as freight to foreign recipients. Freight forwarders that only process unclassified paperwork and make arrangements for the delivery of classified material to foreign recipients do not require an eligibility determination for access to classified information.
(iii) A freight forwarder cannot serve as a DGR.
(6) Hand carrying classified material. To meet contractual requirements, the CSA may authorize contractor employees to hand carry classified material outside the United States. SECRET is the highest level of classified material to be carried and it must be of such size and weight that the courier can retain it in his or her possession at all times.
(i) The CSA will ensure that the contractor has made necessary arrangements with U.S. airport security and customs officials and that security authorities of the receiving government approve the plan. If the transfer is under a contract or a bilateral or multinational government program, the GCA will approve the request in writing. The contractor will notify the CSA of a requirement to hand carry at least 5 working days in advance of the transfer.
(ii) The courier must be a full-time employee of the dispatching or receiving contractor who has been determined eligible and has been granted access to classified information.
(iii) The employing contractor will provide the courier with a courier certificate that is consecutively numbered and valid for one journey only. The journey may include more than one stop if approved by the CSA and secure government storage has been arranged at each stop. The courier will return the courier certificate to the dispatching contractor immediately on completion of the journey.
(iv) Before commencement of each journey, the courier will read and initial the notes to the courier attached to the courier certificate and sign the courier declaration. The contractor will maintain the declaration until completion of the next CSA security review.
(v) The dispatching contractor will inventory, wrap, and seal the material in the presence of the U.S. DGR. The contractor will place the address of the receiving security office and the return address of the dispatching contractor security office on the inner envelope or wrapping and mark it with the appropriate classification. The contractor will place the address of the receiving government's DGR on the outer envelope or wrapping along with the return address of the dispatching contractor.
(vi) The dispatching contractor will prepare three copies of a receipt based on the inventory and list the classified material that is being sent. The dispatching contractor will retain one copy of the receipt. The contractor will pack the other two copies with the classified material. The contractor will obtain a receipt for the sealed package from the courier.
(vii) The dispatching contractor will provide the receiving contractor with 24 work hours advance notification of the anticipated date and time of the courier's arrival and the identity of the courier. The receiving contractor must notify the dispatching contractor if the courier does not arrive within 8 hours of the expected time of arrival. The dispatching contractor will notify its DGR of any delay, unless officially notified otherwise of a change in the courier's itinerary.
(viii) The receiving DGR will verify the contents and sign the receipts enclosed in the consignment. The receiving DGR will return one copy to the courier. On return, the courier will provide the executed receipt to the dispatching contractor.
(ix) Throughout the journey, the courier will maintain the classified material under direct personal control. The courier will not leave the material unattended at any time during the journey, in the transport being used, in hotel rooms, in cloakrooms, or other such location, and will not deposit it in hotel safes, luggage lockers, or in luggage offices. In addition, the courier will not open envelopes or packages containing the classified material en route, unless required by customs or other government officials.
(x) When inspection by government officials is unavoidable, the courier will request that the officials provide written verification that they have opened the package. The courier will notify their employing contractor as soon as possible. The contractor will notify the U.S. DGR. If the inspecting officials are not of the same country as the dispatching contractor, the CSA will notify the designated security authority in the country whose officials inspected the consignment. Under no circumstances will the courier hand over the classified material to customs or other officials for their custody.
(xi) When carrying classified material, the courier will not travel by surface routes through third countries, except as authorized by the CSA. The courier will travel only on carriers described in paragraph (d)(2)(iv) in this section, and will travel direct routes between the United States and the destination.
(7) Classified material receipts. (i) The U.S. DGR and the DGR of the ultimate foreign recipient will maintain a continuous chain of receipts to record international transfers of all classified material from the contractor through the dispatching DGR and recipient DGR to the ultimate foreign recipient. The dispatching contractor will retain:
(A) An active suspense record until return of applicable receipts for the material.
(B) A copy of the external receipt that records the passing of custody of the package containing the classified material and each intermediate consignee in a suspense file until the receipt that is enclosed in the package is signed and returned.
(ii) The contractor will initiate follow-up action through the CSA if the signed receipt is not returned within 45 days.
(8) Contractor preparations for international transfers of classified material pursuant to direct commercial and foreign military sales. To prepare for international transfers the contractor will:
(i) Identify each party to be involved in the transfer in the applicable contract or agreement and in the license application or letter request.
(ii) Notify the appropriate U.S. DGR when the material is ready.
(iii) When the classified material is also ITAR-controlled, provide documentation or written certification by an empowered official (as defined in the ITAR) to the U.S. DGR. This documentation must verify that the classified shipment is within the limitation scope of the pertinent export authorization or an authorized exemption to the export authorization requirements, or is within the limitations of the pertinent GCA contract.
(iv) Have the classified shipment ready for visual review and verification by the DGR. As a minimum this will include:
(A) Preparing the packaging materials, address labels, and receipts for review.
(B) Marking the contents with the appropriate U.S. classification or the equivalent foreign government classification, downgrading, and declassification markings, as applicable.
(C) Ensuring that shipping documents (including, as appropriate, the shipper's export declaration) include the name and contact information for the CSA that validates the license or letter authorization, and the FSO or designee for the particular transfer.
(D) Sending advance notification of the shipment to the CSA, the recipient, and to the freight forwarder, if applicable. The notification will require that the recipient confirm receipt of the shipment or provide notice to the contractor if the shipment is not received in accordance with the prescribed shipping schedule.
(9) Transfers pursuant to an ITAR exemption. (i) The contractor will provide to the DGR valid documentation ( i.e., license, export authorization, letter of offer and acceptance, or agreement) to verify the export authorization for classified technical data information or certain defense articles to be transferred under an exemption to the ITAR exemption. The documentation must include a copy of the Department of State Form DSP-83 associated with the original export authorization.
(ii) Classified technical data information or certain defense articles to be exported pursuant to ITAR exemptions will be supported by a written authorization signed by an authorized exemption official or exemption certifying official who has been appointed by the GCA's responsible disclosure authority.
(A) The contractor will provide a copy of the authorization to the CSA.
(B) The CSA will provide a copy of the authorization to the Department of State Directorate of Defense Trade Controls (DDTC).
(e) International visits —(1) General. (i) The contractor will establish procedures to monitor international visits by their employees and visits or assignments of foreign nationals to the contractor location. Doing so will ensure that the disclosure of, and access to, classified export-controlled articles related to classified information are limited to those that are approved by an export authorization.
(ii) Contractors cannot use visit authorizations to employ or otherwise acquire the services of foreign nationals that require access to export-controlled information. An export authorization is required for such situations.
(2) International visits by U.S. contractor employees —(i) Types and purpose of international visits —(A) One-time visits. A visit for a single, short-term occasion (normally 30 days or fewer) for a specified purpose.
(B) Recurring visits. Intermittent, recurring visits over a specified period of time, normally up to one year in duration, in support of a government-approved arrangement, such as an agreement, contract, or license. By agreement of the governments, the term of the authorization may be for the duration of the arrangement, subject to annual review, and validation.
(C) Long-term visits. A single visit for an extended period of time, normally up to one year, in support of an agreement, contract, or license.
(D) Emergency visits. A visit related to a specific government-approved contract, international agreement or announced request for proposal, and failure to make the visit could be reasonably expected to seriously jeopardize performance on the contract or program, or result in the loss of a contract opportunity.
(ii) Requests for visits. Visit requests are necessary to make administrative arrangements and disclosure decisions and obtain security assurances.
(A) Many foreign governments require the submission of a visit request for all visits to a government facility or a cleared contractor facility, even though classified information may not be involved. They may also require that the requests be received a specified number of days in advance of the visit.
(B) The contractor can obtain information pertaining to the visit requirements of other governments and the NATO from the CSA. The contractor must obtain an export authorization if classified export controlled articles or technical data is to be disclosed or if information to be divulged is related to a classified USG program, unless the disclosure of the information is covered by other agreements, authorizations, or exemptions.
(iii) Request format. Contractors will request a visit request template from the CSA. The contractor will forward the visit request to the security official designated by the CSA. The host for the visit should coordinate the visit in advance with appropriate government authorities who are required to approve the visit. It is the visitor's responsibility to ensure that such coordination has occurred.
(iv) Government agency programs. The contractor will submit a visit request when contractor employees are to visit foreign government facilities or foreign contractors on USG orders in support of a government contract or agreement.
(v) Requests for emergency visits. The requester will include in the emergency visit request, and any other requirements in accordance with applicable CSA guidance:
(A) The complete name, position, address, and telephone number of the person to be visited.
(B) A knowledgeable foreign government point of contact.
(C) The identification of the contract, agreement, or program and the justification for submission of the emergency visit request.
(vi) Requests for recurring visits. Contractors will request recurring visit authorizations at the beginning of each program. After approval of the request, the contractor may arrange individual visits directly with the security office of the location to be visited subject to 5 working days advance notice.
(vii) Amendments. (A) Once visit requests have been approved or are being processed, the contractor may amend them only to change, add, or delete names and change dates.
(B) The contractor cannot amend visit requests to specify dates that are earlier than originally specified.
(C) The contractor cannot amend emergency visit authorizations.
(3) Classified visits by foreign nationals to U.S. contractors —(i) Requests for classified visits. Requests for visits by foreign nationals to U.S. contractors that will involve the disclosure of classified information may require authorization by the Department of State. Classified visits by foreign nationals must be processed by government national security authorities on behalf of the contractor through the sponsoring foreign government (normally the visitor's embassy) to the USG for approval.
(ii) USG approval. The USG may approve or deny the request or decline to render a decision.
(A) USG-Approved Visits. ( 1 ) USG approved classified visits cannot be used to avoid the export licensing requirements for commercial initiatives.
( 2 ) When the cognizant USG agency approves a classified visit, the notification of approval will contain instructions on the level and scope of classified and unclassified information authorized for disclosure, as well as any limitations.
( 3 ) Final acceptance for the visit will be subject to the concurrence of the contractor. The contractor will notify the USG agency when a classified visit is not desired.
(B) Visit request denials. ( 1 ) If the USG agency does not approve the disclosure of the information related to the proposed classified visit, it will deny the classified visit request. The USG agency will advise the requesting government and the contractor to be visited of the reason for the denial.
( 2 ) The contractor may accept the visitor(s), but only information that is in the public domain may be disclosed during the classified visit.
(C) Non-sponsorship. The USG agency will decline to render a decision on a classified visit request that is not in support of a USG program. The USG agency will furnish a declination notice indicating that the classified visit is not USG-approved ( i.e., the classified visit is non-sponsored) to the requesting foreign government with an information copy to the U.S. contractor to be visited.
( 1 ) A declination notice does not preclude the classified visit, provided the contractor has, or obtains, an export authorization for the information involved and, has been notified that the requesting foreign government has provided the required security assurance of the proposed visitor to the USG agency in the original classified visit request.
( 2 ) It is the contractor's responsibility to consult applicable export regulations to determine licensing requirements regarding the disclosure of export-controlled information during such classified visits by foreign nationals.
(D) Visits to subsidiaries. A classified visit request authorization for a classified visit to any element of a corporate family may be used for visits to other divisions or subsidiaries within the same corporate family in accordance with § 117.15(h)(3), provided disclosures are for the same purpose and the information to be disclosed does not exceed the parameters of the approved classified visit request.
(E) Long-term classified visits and assignments of foreign nationals. Extended classified visits and assignments of foreign nationals to contractor locations can be authorized only when it is essential pursuant to a contract or government agreement ( e.g., joint venture, liaison representative to a joint or multinational program, and direct commercial sale). The contractor will:
( 1 ) Consult with its empowered official for guidance.
( 2 ) Notify the CSA in advance of all long-term classified visits and assignments of foreign nationals.
( 3 ) Provide the CSA with a copy of the approved classified visit authorization or the USG export authorization.
(4) Control of foreign visitors to U.S. contractors —(i) Contractor. The contractor will:
(A) Establish procedures to ensure that foreign visitors are not afforded access to classified information except as authorized by an export license, approved visit request, or other exemption to the licensing requirements.
(B) Not inform the foreign visitor of the scope of access authorized or of the limitations imposed by the government.
(ii) Foreign visitors. Foreign visitors will not be given custody of classified material except when they are acting as official couriers of the government and the CSA authorizes the transfer.
(iii) Visitor records. The contractor will maintain a record of foreign visitors for one year when the visit involves access to classified information.
(iv) Temporary approval of safeguarding. (A) Classified U.S. and foreign government material at a U.S. contractor location is to remain under U.S. contractor custody and control and is subject to self-inspection and CSA security reviews.
(B) This does not preclude the contractor from furnishing a foreign visitor with a security container for the temporary storage of classified material, consistent with the purpose of the visit or assignment, provided the CSA approves and responsibility for the container and its contents remains with the U.S. contractor.
( 1 ) The CSA may approve exceptions to this policy on a case-by-case basis for the storage of foreign government classified information furnished to the visitor by the visitor's government through government channels.
( 2 ) The CSA must approve such exceptions in advance in writing with agreement from the visitor's government. The agreed procedures will be included in the contractor's TCP, will require the foreign nationals to provide receipts for the material, and will include an arrangement for the CSA to ensure compliance, including provisions for the CSA to inspect and inventory the material.
(v) TCP. A TCP is required to control access by foreign nationals assigned to, or employed by, cleared contractor facilities, and when foreign nationals visit cleared contractor facilities on a long-term or extended basis, unless the CSA determines that procedures already in place at the contractor's facility are adequate. The TCP will contain procedures to control access for all export-controlled information. A sample TCP may be obtained from the CSA.
(f) Contractor operations abroad —(1) Access by contractor employees assigned outside the United States. (i) Contractor employees assigned outside the United States, its possessions, or territories may have access to classified information in connection with performance on a specified U.S., NATO, or foreign government classified contract.
(ii) The assignment of an employee who is a non-U.S. citizen outside the United States on programs that will involve access to classified information is prohibited.
(2) Storage, custody, and control of classified information abroad by contractor employees. (i) The USG is responsible for the storage, custody, and control of classified information required by a U.S. contractor employee abroad. Therefore, the storage of classified information by contractor employees at any location abroad that is not under USG control is prohibited. The storage may be at a U.S. military facility, an American Embassy or consulate, or other location occupied by a USG organization.
(ii) A contractor employee may be furnished a security container to temporarily store classified material at a USG agency overseas location. The decision to permit a contractor to temporarily store classified information must be approved in writing by the senior security official for the USG host organization.
(iii) A contractor employee may be permitted to temporarily remove classified information from an overseas USG-controlled facility when necessary for the performance of a GCA contract or pursuant to an approved export authorization.
(A) The responsible USG security official at the facility will verify that the contractor has an export authorization or other written USG approval to have the material, verify the need for the material to be removed from the facility, and brief the employee on handling procedures.
( 1 ) In such cases, the contractor employee will sign a receipt for the classified material.
( 2 ) Arrangements will also be made with the USG custodian for the return and storage of the classified material during non-duty hours.
(B) The security office at the USG facility will report violations of this policy to the applicable CSA.
(iv) A contractor employee will not store classified information at overseas divisions or subsidiaries of U.S. entities incorporated or located in a foreign country.
(A) The divisions or subsidiaries may possess classified information that has been transferred to the applicable foreign government through government-to-government channels pursuant to an approved export authorization or other written USG authorization.
(B) Access to this classified information at such locations by a U.S. contractor employee assigned abroad by the parent facility on a visit authorization in support of a foreign government contract or subcontract, is governed by the laws and regulations of the country in which the division or subsidiary is registered or incorporated. The division or subsidiary that has obtained the information from the foreign government will provide the access.
(v) U.S. contractor employees assigned to foreign government or foreign contractor locations under a direct commercial sales arrangement will be subject to the host-nation's industrial security policies.
(3) Transmission of classified material to employees abroad. The transmission of classified material to a cleared contractor employee located outside the United States will be through USG channels.
(i) If the material is to be used for other than USG purposes, an export authorization is required and a copy of the authorization, validated by the DGR, will accompany the material. The material will be addressed to a U.S. military organization or other USG organization ( e.g., an embassy).
(ii) USG organization abroad will be responsible for custody and control of the material.
(4) Security briefings. An employee being assigned outside the United States will be briefed on the security requirements of his or her assignment, including the handling, disclosure, and storage of classified information overseas.
(g) NATO information security requirements —(1) General. This section provides the security requirements needed to comply with the procedures established by the U.S. Security Authority for NATO Affairs Instruction 1-07 (available at: http://archives.nato.int/informationobject/browse?topLod=0&query=United+States+Security+Authority+for+NATO+Affairs+Instruction+1-07 ) for safeguarding NATO information provided to U.S. industry.
(2) NATO security classification levels.
Table 1 to Paragraph ( g )(2) NATO Security Classification Levels
1 Pursuant to applicable NATO security regulations and United States Security Authority, NATO Instruction 1-07, security accreditation may be delegated to contractors for information systems processing only NATO RESTRICTED information. The contractor will be responsible for executing specific provisions under contract for the accreditation of such systems, and shall provide the Contracting Authority with a written statement confirming the information system has been accredited in compliance with the minimum requirements established in the contract security clause or contract Security Aspects Letter.
(3) ATOMAL Classification Markings. ATOMAL is a marking applied to U.S. RESTRICTED DATA or FORMERLY RESTRICTED DATA and UK Atomic information that has been released to the NATO.
Table 2 to Paragraph ( g )(3) ATOMAL Classification Markings
(4) NATO contracts. NATO contracts involving NATO-unique systems, programs, or operations are awarded by a NATO Production and Logistics Organization (NPLO), a designated NATO Management Agency, the NATO Research Staff, or a NATO Command. In the case of NATO infrastructure projects ( e.g., airfields, communications), the NATO contract is awarded by a contracting agency or prime contractor of the NATO nation responsible for the infrastructure project.
(5) NATO facility security clearance certificate (FSCC). A NATO FSCC is required for a contractor to negotiate or perform on a NATO classified contract.
(i) A U.S. entity qualifies for a NATO FSCC if it has an equivalent U.S. entity eligibility determination and its personnel have been briefed on NATO procedures.
(ii) The CSA will provide the NATO FSCC to the requesting activity.
(iii) A NATO FSCC is not required for GCA contracts involving access to NATO classified information.
(6) Eligibility for personnel access to classified information. Access to NATO classified information requires a final determination that an individual is eligible for access to classified information at the equivalent level.
(7) NATO briefings. Before having access to NATO classified information, the contractor will give employees a NATO security briefing that covers the requirements of this section and the consequences of negligent handling of NATO classified information. A representative of the CSA will give the initial briefing to the contractor. The contractor must conduct annual refresher briefings.
(i) When access to NATO classified information is no longer required, the contractor will debrief the employees. The employees will sign a certificate stating that they have been briefed or debriefed, as applicable, and acknowledge their responsibility for safeguarding NATO information.
(ii) The contractor will maintain certificates for two years for NATO SECRET and CONFIDENTIAL, and three years for COSMIC TOP SECRET and all ATOMAL information. The contractor will maintain a record of all NATO briefings and debriefings in the CSA-designated database.
(8) Access to NATO classified information by foreign nationals. Foreign nationals of non-NATO nations may have access to NATO classified information only with the consent of the NATO Office of Security and the contracting activity.
(i) Requests will be submitted to the Central U.S. Registry (CUSR).
(ii) Access to NATO classified information may be permitted for citizens of NATO member nations, provided a NATO security clearance certificate is provided by their government and they have been briefed.
(9) Subcontracting for NATO contracts. The contractor will obtain prior written approval from the NATO contracting activity and a NATO FSCC must be issued prior to awarding the subcontract. The contractor will forward the request for approval through the CSA.
(10) Preparing and marking NATO documents. All classified documents created by a U.S. contractor will be portion-marked. Any portion extracted from a NATO document that is not portion marked, must be assigned the classification that is assigned to the NATO document.
(i) All U.S.-originated NATO classified documents will bear an assigned reference number and date on the first page. The reference numbers will be assigned as follows:
(A) The first element will be the abbreviation for the name of the contractor.
(B) The second element will be the abbreviation for the highest classification followed by a hyphen and the 4-digit sequence number for the document within that classification that has been generated for the applicable calendar year.
(C) The third element will be the year; e.g., MM/NS-0013/17.
(ii) COSMIC TOP SECRET, NATO SECRET, and ATOMAL documents will bear the reference number on each page and a copy number on the cover or first page.
(A) Copies of NATO documents will be serially numbered.
(B) Pages will be numbered.
(C) The first page, index, or table of contents will include a list, including page numbers, of all annexes and appendices.
(D) The total number of pages will be stated on the first page.
(E) All annexes or appendices will include the date of the original document and the purpose of the new text (addition or substitution) on the first page.
(iii) One of the following markings will be applied to NATO documents that contain ATOMAL information:
(A) “This document contains U.S. ATOMIC Information (RESTRICTED DATA or FORMERLY RESTRICTED DATA) made available pursuant to the NATO Agreement for Cooperation Regarding ATOMIC Information, dated 18 June 1964, and will be safeguarded accordingly.”
(B) “This document contains UK ATOMIC Information. This information is released to NATO including its military and civilian agencies and member states on condition that it will not be released by the recipient organization to any other organization or government or national of another country or member of any other organization without prior permission from H.M. Government in the United Kingdom.”
(iv) Working papers will be retained only until a final product is produced and in accordance with § 117.15(e)(3).
(11) Classification guidance. Classification guidance will be in the form of a NATO security aspects letter and a security requirements checklist for NATO contracts, or a Contract Security Classification Specification, or equivalent.
(i) If adequate classification guidance is not received, the contractor will contact the CSA for assistance.
(ii) NATO classified documents and NATO information in other documents will not be declassified or downgraded without the prior written consent of the originating activity.
(iii) Recommendations concerning the declassification or downgrading of NATO classified information will be forwarded to the CUSR.
(12) Further distribution. The contractor will not release or disclose NATO classified information to a third party or outside the contractor's facility for any purpose without the prior written approval of the contracting agency.
(13) Storage of NATO documents. NATO classified documents will be stored as prescribed for U.S. documents of an equivalent classification level, except as follows:
(i) NATO classified documents will not be comingled with other documents.
(ii) Combinations for containers used to store NATO classified information will be changed annually. The combination also will be changed when an individual with access to the container departs or no longer requires access to the container, and if the combination is suspected of being compromised.
(iii) When the combination is recorded it will be marked with the highest classification level of documents stored in the container as well as to indicate the level and type of NATO documents in the container. The combination record must be logged and controlled in the same manner as NATO classified documents.
(14) International transmission. The NATO has a registry system for the receipt and distribution of NATO documents within each NATO member nation. The central distribution point for the United States is the CUSR now located at 9301 Chapek Road, Building 1458, Fort Belvoir, Virginia 22060.
(i) The CUSR establishes sub registries at USG organizations for further distribution and control of NATO documents. Sub registries may establish control points at contractor facilities.
(ii) COSMIC TOP SECRET, NATO SECRET, and all ATOMAL documents will be transferred through the registry system. NATO CONFIDENTIAL documents provided as part of NATO infrastructure contracts will be transmitted via government channels in compliance with paragraph (d) in this section.
(15) Hand carrying. NATO SECRET and NATO CONFIDENTIAL documents may be hand carried across international borders if authorized by the GCA. The courier will be issued a NATO Courier Certificate by the CSA. When hand carrying is authorized, the documents will be delivered to a U.S. organization at NATO, which will transfer them to the intended NATO recipient.
(16) Reproduction. Reproductions of COSMIC TOP SECRET and COSMIC TOP SECRET ATOMAL information will be performed by the responsible Registry. The reproduction of NATO SECRET and CONFIDENTIAL documents may be authorized to meet contractual requirements unless reproduction is prohibited by the contracting entity. Copies of COSMIC TOP SECRET, NATO SECRET, and ATOMAL documents will be serially numbered and controlled and accounted for in the same manner as the original.
(17) Disposition. (i) Generally, all NATO classified documents will be returned to the contracting activity that provided them on completion of the contract. Documents provided in connection with an invitation to bid also will be returned immediately if the bid is not accepted or submitted.
(ii) NATO classified documents may also be destroyed when permitted. COSMIC TOP SECRET and COSMIC TOP SECRET ATOMAL documents will be destroyed by the registry that provided the documents.
(A) Destruction certificates are required for all NATO classified documents except NATO CONFIDENTIAL.
(B) The destruction of COSMIC TOP SECRET, NATO SECRET, and all ATOMAL documents must be witnessed.
(18) Accountability records. Logs, receipts, and destruction certificates are required for NATO classified information. Records for NATO documents will be maintained separately from records of non-NATO documents (methods such as separate drawers of a container).
(i) COSMIC TOP SECRET and all ATOMAL documents will be recorded on logs maintained separately from other NATO logs and will be assigned unique serial control numbers.
(ii) Additionally, disclosure records bearing the name and signature of each person who has access are required for all COSMIC TOP SECRET, COSMIC TOP SECRET ATOMAL, and all other ATOMAL or NATO classified documents to which special access limitations have been applied.
(iii) Minimum identifying data on logs, receipts, and destruction certificates will include the NATO reference number, short title, date of the document, classification, and serial copy numbers. Logs will reflect the short title, unclassified subject, and distribution of the documents.
(iv) Receipts are required for all NATO classified documents except NATO CONFIDENTIAL.
(v) Inventories will be conducted annually of all COSMIC TOP SECRET, NATO SECRET, and ATOMAL documents.
(vi) Accountability records for ATOMAL documents will be retained for 10 years after transfer or destruction of the ATOMAL document. Destruction certificates will be retained for 10 years after destruction of the related ATOMAL documents.
(19) Security violations and loss, compromise, or possible compromise. The contractor will immediately report the loss, compromise, or suspected loss or compromise, as well as any other security violations involving NATO classified information to the CSA.
(20) Extracting from NATO documents. Permission to extract from a COSMIC TOP SECRET or ATOMAL document will be obtained from the CUSR.
(i) If extracts of NATO information are included in a U.S. document prepared for a non-NATO contract, the document will be marked with U.S. classification markings. The caveat, “THIS DOCUMENT CONTAINS NATO (level of classification) INFORMATION” also will be marked on the front cover or first page of the document. Additionally, each paragraph or portion containing the NATO information will be marked with the appropriate NATO classification, abbreviated in parentheses ( e.g., “NS” for NATO SECRET) preceding the portion or paragraph. Declassification and downgrading instructions shall indicate that the NATO information is exempt from declassification or downgrading without the prior consent of NATO, in the absence of other originator instructions, citing the reason “Foreign Government Information.”
(ii) The declassification or downgrading of NATO information in a U.S. document requires the approval of the originating NATO activity. Requests will be submitted to the CUSR for NATO contracts, through the GCA for U.S. contracts, and through the CSA for non-NATO contracts awarded by a NATO member nation.
(21) Release of U.S. information to NATO. (i) Release of U.S. classified or export-controlled information to NATO requires an export authorization or other written disclosure authorization. When a document containing U.S. classified information is being prepared for NATO, the appropriate NATO classification markings will be applied to the document.
(A) Documents containing U.S. classified information and U.S. classified documents that are authorized for release to NATO will be marked on the cover or first page “THIS DOCUMENT CONTAINS U.S. CLASSIFIED INFORMATION. THE INFORMATION IN THIS DOCUMENT HAS BEEN AUTHORIZED FOR RELEASE TO (cite the NATO organization) BY (cite the applicable license or other written authority).”
(B) The CSA will provide transmission instructions to the contractor. The material will be addressed to a U.S. organization at NATO, which will then place the material into NATO security channels. The material will be accompanied by a letter to the U.S. organization that provides transfer instructions and assurances that the material has been authorized for release to NATO. The inner wrapper will be addressed to the intended NATO recipient.
(C) Material to be sent to NATO via mail will be routed through the U.S. Postal Service and U.S. military postal channels to the U.S. organization that will make the transfer.
(ii) A record will be maintained that identifies the originator and source of classified information that are used in the preparation of documents for release to NATO. The record will be provided with any request for release authorization.
(22) Visits. NATO visits will be handled in accordance with the requirements in paragraph (e) of this section. A NATO Certificate of Security Clearance will be included with the visit request.
(i) NPLO and NATO industrial advisory group (NIAG) recurring visits. NATO has established special procedures for recurring visits involving contractors, government departments and agencies, and NATO commands and agencies that are participating in a NPLO or NIAG contract or program. The NATO management office or agency responsible for the NPLO program will prepare a list of the government and contractor facilities participating in the program. For NIAG programs, the list will be prepared by the responsible NATO staff element. The list will be forwarded to the appropriate clearance agency of the participating nations, which will forward it to the participating contractor.
(ii) Visitor record. The contractor will maintain a record of NATO visits including those by U.S. personnel assigned to NATO. The records will be maintained for three years.
(h) Security and export control violations involving foreign nationals. Contractors will report any violation of administrative security procedures or export control regulations that would subject classified information to possible compromise by foreign visitors or foreign national employees to the applicable CSA.
(i) Transfers of defense articles to the UK or AUS without a license or other written authorization —(1) Treaties with AUS and UK. Exemptions in ITAR parts 126.16 and 126.17 implement the Defense Trade Cooperation Treaty between the Government of the United States of America and the Government of the UK of Great Britain and Northern Ireland and the Defense Trade Cooperation Treaty between the Government of the United States of America and the Government of AUS, also known as the “U.S.-UK Treaty” and “U.S.-AUS Treaty,” respectively, referred to collectively in this rule as “the Treaties.”
(i) The Treaties provide a comprehensive framework for exports and transfers to the UK or AUS of certain classified and unclassified defense articles without a license or other written authorization.
(ii) The ITAR part 126, supplement no. 1 identifies those defense articles and services that are not eligible for export via treaty exemptions.
(iii) This exemption applies to contractors registered with the DDTC and eligible to export defense articles.
(2) Defense articles. Defense articles fall under the scope of the Treaties when they are in support of:
(i) U.S. and UK or U.S. and AUS combined military or counter-terrorism operations.
(ii) U.S. and UK or U.S. and AUS cooperative security and defense research, development, production, and support programs.
(iii) Mutually agreed specific security and defense projects where the government of the UK or AUS is the end-user.
(iv) USG end-use.
(3) Marking requirements. Contractors are required to mark defense articles that fall under the scope of the treaty prior to transferring from the U.S. to the UK in accordance with the provisions of this paragraph. All other standard classification marking in accordance with § 117.14 also apply. When defense articles are returned from the UK or AUS to the United States, any defense articles marked as RESTRICTED in the manner shown in Table 4 purely for the purposes of the treaties will be considered to be unclassified and such marking will be removed.
Table 3 to Paragraph ( i )(3) Classified U.S. Defense Article Markings
UNCLASSIFIED: CLASSIFICATION MARKINGS FOR ILLUSTRATION PURPOSES ONLY
Table 4 to Paragraph ( i )(3) Unclassified U.S. Defense Article Markings
UNCLASSIFIED: CLASSIFICATION MARKINGS FOR ILLUSTRATION PURPOSES ONLY
(4) Notice. A notice will be included ( e.g., as part of the bill of lading) whenever defense articles are exported in accordance with the provisions of these treaties and the ITAR.
Table 5 to Paragraph ( i )(4) Notice Text for Exported Defense Articles
(5) Labeling. (i) Defense articles (other than technical data) will be individually labeled with the appropriate identification; or, where such labeling is impracticable ( e.g., propellants, chemicals), will be accompanied by documentation (such as contracts or invoices) clearly associating the defense articles with the appropriate markings.
(ii) Technical data (including data packages, technical papers, manuals, presentations, specifications, guides and reports), regardless of media or means of transmission ( i.e., physical, oral, or electronic), will be individually labeled with the appropriate identification detailed. Where such labeling is impracticable, the data will be accompanied by documentation (such as contracts or invoices) or oral notification clearly associating the technical data with the appropriate markings.
(iii) Defense services will be accompanied by documentation ( e.g. contracts, invoices, shipping bills, or bills of lading clearly labeled with the appropriate identification).
(6) Transfers. (i) All defense articles that fall under the scope of the Treaties must be transferred from the U.S. point of embarkation through channels approved by both the United States and the UK or the United States and AUS, as applicable.
(ii) For transfers of defense articles as freight, the contractor will prepare a transportation plan. For transfer of classified U.S. defense articles, a freight forwarder must have a valid entity eligibility determination and a classified information storage capability at the appropriate level. For unclassified U.S. defense articles transferred as freight, a freight forwarder is not required to be cleared.
(7) Records. Contractors will maintain records of exports, transfers, re-exports, or re-transfers of defense articles subject to the Treaties for a minimum of five years. The contractor will make records available to the CSA upon request. In accordance with the ITAR parts 126.16 and 126.17 the records will contain:
(i) Port of entry or exit.
(ii) Date and time of export or import.
(iii) Method of export or import.
(iv) Commodity code and description of the commodity, including technical data.
(v) Value of export.
(vi) Justification for export under the Treaties.
(vii) End-user or end-use.
(viii) Identification of all U.S. and foreign parties to the transaction.
(ix) How export was marked.
(x) Security classification of the export.
(xi) All written correspondence with the USG on the export.
(xii) All information relating to political contributions, fees, or commissions furnished or obtained, offered, solicited, or agreed upon, as outlined in the ITAR parts 126.16(m) or 126.17(m).
(xiii) Purchase order, contract, or letter of intent.
(xiv) Technical data actually exported.
(xv) The internal transaction number for the electronic export information filing in the automated export system.
(xvi) All shipping documentation (including, but not limited to, the airway bill, bill of lading, packing list, delivery verification, and invoice).
(xvii) Statement of registration (Department of State Form DS-2032 (available at: https://www.pmddtc.state.gov/sys_attachment.do?sysparm_referring_url=tear_off&view=true&sys_id=dabc05f6db6be344529d368d7c961984 )).
§ 117.20   Critical Nuclear Weapon Design Information (CNWDI).
(a) General. This section contains the special requirements for protection of CNDWI. The sensitivity of DoD CNWDI is such that access shall be granted to the absolute minimum number of employees who require it for the accomplishment of assigned responsibilities on a classified contract. Because of the importance of such information, special requirements have been established for its control. DoDI 5210.02, “Access to and Dissemination of Restricted Data and Formerly Restricted Data” (available at: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/521002p.pdf?ver=2019-01-14-072742-700 ) establishes these controls in the DoD.
(b) Briefings. Prior to having access to CNWDI, employees will be briefed on its sensitivity by the FSO or his or her alternate. The FSO will be initially briefed by a USG representative.
(1) The briefing will include:
(i) The definition of CNWDI.
(ii) A reminder of the extreme sensitivity of the information.
(iii) An explanation of the individual's continuing responsibility for properly safeguarding CNWDI and for ensuring that dissemination is strictly limited to other personnel who have been authorized for access and have a need-to-know for the particular information.
(2) The briefing will also be tailored to cover any special local requirements. Upon termination of access to CNWDI, the employee will be given an oral debriefing.
(c) Markings. In addition to any other required markings, CNWDI material will be clearly marked in accordance with DoDI 5210.02. At a minimum, CNWDI documents will show such markings on the cover or first page. Portions of documents that contain CNWDI will be marked with an (N) or (CNWDI) following the classification of the portion; for example, TS (RD)(N) or TS(RD)(CNWDI).
(d) Subcontractors. Contractors will not disclose CNWDI to subcontractors without the prior written approval of the GCA. This approval may be included in a contract security classification specification, or equivalent, other contract-related document, or by separate correspondence.
(e) Transmission outside the facility. Transmission of CNWDI outside the contractor's facility is authorized only to the GCA, or to a subcontractor as described in paragraph (d) of this section. Any other transmission must be approved by the GCA.
(1) Prior to transmission to another cleared facility, the contractor will verify from the CSA that the facility has been authorized access to CNWDI. When CNWDI is transmitted to another facility, the inner wrapping will be addressed to the personal attention of the FSO or his or her alternate, and in addition to any other prescribed markings, the inner wrapping will be marked: “Critical Nuclear Weapon Design Information-DoD Instruction 5210.02 Applies.”
(2) The same marking will be used on the inner wrapping of transmissions addressed to the GCA or other USG.
(f) Records. Contractors will annotate CNWDI access in the CSA-designated database for all employees who have been authorized access to CNWDI.
(g) Nuclear weapon data. Some nuclear weapon data is divided into Sigma categories, the protection of which is prescribed by DOE Order 452.8 (available at: https://www.directives.doe.gov/directives-documents/400-series/0452.8-border/@@images/file ). However, certain nuclear weapon data has been re-categorized as CNWDI and is protected as described in this section.
§ 117.21   COMSEC.
(a) General. The procedures in this section pertaining to classified COMSEC information will apply to contractors when the contractor:
(1) Requires the use of COMSEC systems in the performance of a contract.
(2) Is required to install, maintain, or operate COMSEC equipment for the USG.
(3) Is required to accomplish research, development, or production of COMSEC systems, COMSEC equipment, or related COMSEC material.
(b) Instructions. Specific requirements for the management and safeguarding of COMSEC material in industry are established in the COMSEC material control and operating procedures provided to the account manager of each industrial COMSEC account by the agency central office of record (COR) responsible for establishing the account. Such procedures that are above the baseline requirements detailed in the other sections of this rule will be contractually mandated.
(c) Clearance and access requirements. (1) Before a COMSEC account can be established and a contractor may receive or possess COMSEC material accountable to a COR, individuals occupying the positions of FSO, COMSEC account manager, and alternate COMSEC account manager must have a final PCL appropriate for the material to be held in the account.
(i) COMSEC account managers and alternate COMSEC account managers having access to operational TOP SECRET keying material marked as CRYPTO must have a final TOP SECRET security clearance based upon a current investigation of a scope that meets or exceeds that necessary for the access required.
(ii) This requirement does not apply to contractors using only data transfer devices and seed key.
(2) Before disclosure of COMSEC information to a contractor, GCAs must first verify with the CSA that appropriate COMSEC procedures are in place at the contractor facility. If procedures are not in place, the GCA will provide a written request and justification to the CSA to establish COMSEC procedures and a COMSEC account, if appropriate, at the facility and to conduct the initial COMSEC or cryptographic access briefings for the FSO and COMSEC account personnel.
(3) Access to COMSEC information by a contractor requires a final entity eligibility determination and a USG-issued final PCL at the appropriate level; however, an Interim TOP SECRET entity eligibility determination or PCL is valid for access to COMSEC at the SECRET and CONFIDENTIAL levels.
(4) If a COMSEC account will be required, the Contract Security Classification Specification, or equivalent, will contain a statement regarding the establishment of a COMSEC account as appropriate.
(d) Establishing a COMSEC account. (1) When COMSEC material that is accountable to a COR is to be provided, acquired, or produced under a contract, the contracting officer will inform the contractor that a COMSEC account must be established. The contractor will forward the names of U.S. citizen employees who will serve as the COMSEC account manager and alternate COMSEC account manager to the CSA. The CSA will forward the names of the FSO, COMSEC account manager, and alternate COMSEC account manager, along with a contractual requirement for the establishment of a COMSEC account (using DD Form 254 or equivalent) to the appropriate COR, with a copy to the GCA, indicating that the persons have been cleared and COMSEC has been briefed.
(2) The COR will then establish the COMSEC account and notify the CSA that the account has been established.
(3) An individual may be appointed as the COMSEC account manager or alternate COMSEC account manager for more than one account only when approved by each COR concerned.
(e) COMSEC briefing and debriefing. (1) All contractor employees who require access to classified COMSEC information in the performance of their duties will be briefed before access is granted. Depending on the nature of COMSEC access required, either a COMSEC briefing or a cryptographic access briefing will be given. The FSO, the COMSEC account manager, and the alternate COMSEC account manager will be briefed by a USG representative or their designee. Other contractor employees will be briefed by the FSO, the COMSEC account personnel, or other individual designated by the FSO. The purpose of the briefing is to ensure that the contractor understands:
(i) The unique nature of COMSEC information and its unusual sensitivity.
(ii) The special security requirements for the handling and protection of COMSEC information.
(iii) The penalties prescribed in 18 U.S.C. 793, 794, and 798 for disclosure of COMSEC information.
(2) COMSEC debriefings are not required.
(3) The contractor will maintain a record of all COMSEC briefings as specified by the appropriate COR.
(f) U.S. classified cryptographic information access briefing and debriefing requirements. (1) U.S. classified cryptographic information does not include seed key or controlled cryptographic items.
(2) A contractor's employee may be granted access to U.S. classified cryptographic information only if the employee:
(i) Is a U.S. citizen.
(ii) Has a final USG-issued eligibility determination appropriate to the classification of the U.S. cryptographic information to be accessed.
(iii) Has a valid need-to-know to perform duties for, or on behalf of, the USG.
(iv) Receives a security briefing appropriate to the U.S. Classified Cryptographic Information to be accessed.
(v) Acknowledges the granting of access to classified information by executing Section I of Secretary of Defense (SD) Form 572, “Cryptographic Access Certification and Termination” (available at: https://www.esd.whs.mil/Portals/54/Documents/DD/forms/sd/sd0572.pdf ).
(vi) Where so directed by a USG department or agency head, acknowledges the possibility of being subject to a CI scope polygraph examination that will be administered in accordance with department or agency directives and applicable law.
(3) An employee granted access to cryptographic information will be debriefed and execute Section II of the SD 572 not later than 90 days from the date access is no longer required.
(4) The contractor will maintain the SD 572 for a minimum of five years following the debriefing.
(5) Cryptographic access briefings must fully meet the requirements of paragraph (e) of this section.
(g) Destruction and disposition of COMSEC material. The appropriate GCA representative, e.g., the contracting officer representative, will provide directions to the contractor when accountable COMSEC material is to be destroyed. These directions may be provided in superseding editions of publications or by specific instructions.
(h) Subcontracting COMSEC work. Subcontracts requiring the disclosure of classified COMSEC information will be awarded only upon the written approval of the GCA.
(i) Unsolicited proposals. Any unsolicited proposal for a COMSEC system, equipment, development, or study that may be submitted by a contractor to a USG agency will be forwarded to the Deputy National Manager for National Security Systems for review and follow up action at: Deputy National Manager for National Security Systems, NSA, Fort George G. Meade, MD 20755-6000.
§ 117.22   DHS CCIPP.
(a) General. DHS will coordinate with other USG agencies that have an equity with a private sector entity and the CCIPP in accordance with § 117.6(f).
(b) Authority. (1) The Secretary of Homeland Security has the authority to determine the eligibility for personnel security clearances and to administer the sharing of relevant classified NSI with certain private sectors or non-federal partners for the purpose of furthering cybersecurity information sharing among critical infrastructure partners pursuant to E.O. 13691.
(2) DHS provides security oversight and assumes security responsibilities similar to those of an FSO, unless otherwise provided in this section. Participating entities will cooperate with DHS security officials to ensure the entity is in compliance with requirements in this rule.
§ 117.23   Supplement to this rule: Security Requirements for Alternative Compensatory Control Measures (ACCM), Special Access Programs (SAPs), Sensitive Compartmented Information (SCI), Restricted Data (RD), Formerly Restricted Data (FRD), Transclassified Foreign Nuclear Information (TFNI), and Naval Nuclear Propulsion Information (NNPI).
(a) General. Given the sensitive nature of Alternative Compensatory Control Measures (ACCM), SAPs, SCI, RD, FRD, TFNI, and NNPI, the security requirements prescribed in this section exceed baseline standards for this rule and must be applied, as applicable, through specific contract requirements.
(1) Compliance. The contractor will comply with the security measures reflected in this section and other documents specifically referenced, when applied by the GCA or designee as part of a contract. Acceptance of the contract security measures is a prerequisite to any negotiations leading to program participation and an area accreditation ( e.g., an SCI facility or SAP facility accreditation).
(2) CSA-imposed higher standards. In some cases, security or sensitive factors of a CSA-created program may require security measures that exceed the standards of this section. In such cases, the CSA-imposed higher standards specifically detailed in the contract or conveyed through other applicable directives will be binding on USG and contractor participants. In cases of doubt over the specific provisions, the contractor should consult the program security officer and the contracting officer before taking any action or expending program-related funds. In cases of extreme emergencies requiring immediate attention, the action taken should protect the USG's interest and the security of the program from loss or compromise.
(3) Waivers. Every effort will be made to avoid waivers to established standards unless they are in the best interest of the USG. In those cases where waivers are deemed necessary, a request will be submitted in accordance with the procedures established by the CSA.
(b) Intelligence information. National intelligence is under the jurisdiction and control of the DNI, who establishes security policy for the protection of national intelligence and intelligence sources, methods, and activities. In addition to the guidance in this rule, contractors will follow Intelligence Community directives, policy guidance, standards, and specifications for the protection of classified national intelligence and SCI.
(c) ACCM. Contractors may participate in ACCMs, or be directed to participate, only when such access and the associated security plan are identified in DD Form 254 or equivalent. Care must be taken to ensure identification of the security plan does not disclose ACCM-protected data.
(1) ACCM contracts. DoD contractors will implement the security requirements for ACCMs, when established by contract, in accordance with applicable statutes, E.O.s, CSA directives, instructions, manuals, regulations, standards, and memorandums.
(2) Non-DoD with ACCMs. Contractors performing on ACCM contracts issued by other than DoD GCAs will implement ACCM protection requirements imposed in their contracts.
(d) SAPs —(1) DoD SAP contracts. Contractors will implement the security requirements for SAPs codified in SAP-related policy, when established by contract. These documents include, but are not limited to, statutes, E.O.s, CSA directives, instructions, manuals, regulations, standards, memorandums, and other SAP security related policy documents.
(2) Non-DoD SAPs. Contractors performing on SAP contracts issued by non-DoD GCAs will implement SAP protection requirements imposed in their contracts. These requirements may be from, but are not limited to, statutes, E.O.s, CSA directives, instructions, manuals, regulations, standards, memorandums, and other SAP security related policy documents.
(e) RD, FRD, and TFNI —(1) General. This section describes some of the requirements for nuclear-related information designated RD, FRD, or TFNI in accordance with the AEA and 10 CFR part 1045. 10 CFR part 1045 contains the full requirements for classification and declassification of RD, FRD, and TFNI. Information on safeguarding of RD by access permittees is contained in 10 CFR part 1016. For RD that is NNPI, the additional provisions of paragraph (f) of this section apply.
(i) The DOE is the sole authority for establishing requirements for classifying, accessing, handling, securing, and protecting RD. The DOE and the DoD share authority for the requirements for FRD. The DOE and ODNI share authority for establishing requirements for TFNI.
(ii) RD, FRD, and TFNI categories are distinguished from the NSI category, which is governed in accordance with E.O. 13526.
(A) RD, FRD, and TFNI have unique marking requirements and are not subject to automatic declassification. In addition, RD and FRD have special restrictions regarding foreign release.
(B) It is necessary to differentiate between the handling of this information and NSI because of its direct relationship to our nation's nuclear deterrent.
(iii) Some access requirements for RD and FRD exceed the requirements for NSI. Due to the unique national security implications of RD and FRD, and to facilitate maintaining consistency of codified requirement, they are not repeated in the baseline of this rule, but may be applied through specific contract requirements.
(iv) When RD is transclassified as TFNI, it is safeguarded as NSI. Such information will be labeled as TFNI. The label TFNI will be included on documents to indicate it is exempt from automatic declassification as specified in 10 CFR part 1045, the AEA, E.O. 13526, and 32 CFR part 2001.
(2) Unauthorized disclosures. Contractors will report all unauthorized disclosures involving RD, FRD and TFNI information to the CSA.
(3) International requirements. The AEA provides for a program of international cooperation to promote common defense and security and to make available to cooperating nations the benefits of peaceful applications of atomic energy as widely as expanding technology and considerations of the common defense and security will permit.
(i) Information controlled in accordance with the AEA, RD, and FRD may be shared with another nation only under the terms of an agreement for cooperation. The disclosure by a contractor of RD and FRD will not be permitted until an agreement is signed by the United States and participating governments, and disclosure guidance and security arrangements are established.
(ii) RD and FRD will not be transmitted to a foreign national or regional defense organization unless such action is approved and undertaken under an agreement for cooperation between the United States and the cooperating entity and supporting statutory determinations, as prescribed in the AEA.
(4) Personnel security clearance and access. Only the DOE, the NRC, the DoD, and the National Aeronautics and Space Agency can grant access to RD and FRD that is under their cognizance. Access to RD and FRD must be granted in accordance with the AEA. Baseline requirements for access to RD and FRD are codified in specific DoD, DOE, NRC, and the National Aeronautics and Space Agency directives and regulations. In addition, need-to-know and other restrictions on access apply.
(5) Classification and declassification. (i) All persons with access to RD and FRD must receive initial and periodic refresher training as required under § 1045.120 10 CFR. The training must include the following information:
(A) What information is potentially RD and FRD.
(B) Matter that potentially contains RD or FRD must be reviewed by an RD derivative classifier to determine whether it is RD or FRD.
(C) The DOE must review matter that potentially contains RD or TFNI for public release and DOE or DoD must review matter that potentially contains FRD for public release.
(D) RD derivative classification authority is required to classify or upgrade matter containing RD or FRD, or to downgrade the level of matter containing RD or FRD.
(E) Only a person trained in accordance with § 1045.120 10 CFR may classify matter containing TFNI.
(F) Matter containing RD, FRD, and TFNI is not automatically declassified and only DOE-authorized persons may downgrade the category or declassify matter marked as containing RD. Only DOE or DoD authorized persons may downgrade the category or declassify matter marked as containing FRD.
(G) How to submit a challenge if they believe RD, FRD, or TFNI information ( e.g., a guide topic) or matter containing RD, FRD, or TFNI is not properly classified.
(H) Access requirements for matter marked as containing RD or FRD.
(ii) All persons with access to TFNI must receive initial and periodic refresher training as required under § 1045.120 10 CFR. This training may be combined with the training for access to RD and FRD. The training must include the following information:
(A) What information is potentially TFNI.
(B) Only a person with appropriate training may determine if matter contains TFNI.
(C) Marking requirements for matter containing TFNI.
(D) Matter containing TFNI is not automatically declassified and only DOE authorized persons may downgrade the category or declassify matter marked as containing TFNI.
(E) How to submit a challenge if they believe TFNI information ( e.g., a guide topic) or matter containing TFNI is not properly classified.
(iii) Persons with access to RD, FRD, or TFNI must submit matter that potentially contains RD or FRD to an RD derivative classifier for review. If matter potentially contains TFNI, it must be submitted to a person trained to make TFNI determinations. Matter potentially containing RD, FRD, or TFNI must be reviewed, even if the potential RD, FRD, or TFNI is derived from the open literature. Prior to review, the matter must be marked as a working paper under 10 CFR 1045.140(c). If the matter is intended for pubic release and potentially contains RD or TFNI, it must be submitted to the DOE for review. If the matter is intended for public release and contains FRD, it must be submitted to the DOE or the DoD.
(iv) Only RD derivative classifiers may classify matter containing RD or FRD. RD derivative classifiers must receive initial training and refresher training every two years as required under 10 CFR 1045.120. The training must include the content for persons with access to RD and FRD, along with the following:
(A) The use of classification guides, classification bulletins, and portion-marked source documents to classify matter containing RD and FRD.
(B) What to do if applicable classification guidance is not available.
(C) Limitations on an RD derivative classifier's authority to remove RD or FRD portions from matter.
(D) Marking requirements for matter containing RD and FRD.
(v) Only persons with appropriate training may review matter to determine if it contains TFNI. Training must be completed prior to making determinations and every two years after. The training must include the content for persons with access to TFNI and the following:
(A) The markings applied to matter containing TFNI.
(B) Limitations on their authority to remove TFNI portions from matter.
(C) Only DOE authorized persons may determine that classified matter no longer contains TFNI.
(D) Only DOE-authorized persons may declassify matter marked as containing TFNI.
(E) The DOE must review matter that potentially contains TFNI for public release.
(vi) RD derivative classifiers must use approved classification guides, classification bulletins, or portion-marked source documents as the basis for classifying matter containing RD and FRD.
(vii) Persons trained to make TFNI determinations must use approved TFNI guidelines, classification guides, classification bulletins, or portion-marked source documents as the basis for classifying or upgrade matter containing TFNI.
(6) Marking matter containing RD, FRD, and TFNI. The front page of matter containing RD or FRD must have the highest classification level of the information on the top and bottom of the first page, the RD or FRD admonishment, the subject or title marking, and the classification authority block. Matter containing TFNI must include the TFNI identifier on each page unless the matter also contains RD or FRD, in which case the RD or FRD takes precedence.
(i) Documents classified as RD or FRD must also include a Classification Authority Block with the RD derivative classifier's name and position, title, or unique identifier and the classification guide or source document (by title and date) used to classify the document. No declassification date or event may be placed on a document containing RD, FRD, or TFNI. If a document containing RD, FRD, or TFNI also contains NSI, “N/A to RD/FRD/TFNI” (as appropriate) must be placed on the “Declassify On:” line.
(ii) Each interior page of matter containing RD or FRD must be clearly marked at the top and bottom with the overall classification level and category of the matter or the overall classification level and category of the page, whichever is preferred. The abbreviations “RD” or “FRD” may be used in conjunction with the matter classification ( e.g., SECRET//RD, CONFIDENTIAL//FRD).
Table 1 to Paragraph ( e )(6)( ii ) RD and FRD Admonishment Markings
(iii) Documents classified as RD or FRD must also include a Classification Authority Block with the RD derivative classifier's name and position, title, or unique identifier and the classification guide or source document (by title and date) used to classify the document.
(iv) Other than the required subject or title markings, portion marking is permitted, but not required, for matter containing RD or FRD. Each agency that generates matter containing RD or FRD determines the policy for portion-marking matter generated within the agency. If matter containing RD or FRD is portion-marked, each portion containing RD or FRD must be marked with the level and category of the information in the portion ( e.g., SRD, CFRD, S//RD, C//FRD).
(v) Additional information and requirements are in 10 CFR 1045.140. Requests for additional information about the classification and declassification of RD, FRD, and TFNI can be directed to Agency RD Management Officials or the DOE Office of Classification at outreach@hq.doe.gov or at (301) 903-7567.
(7) Declassification. (i) No date or event for automatic declassification ever applies to RD, FRD, or TFNI documents, even if they contain classified NSI. RD, FRD, or TFNI documents remain classified until a positive action by a designated DOE official (for RD, FRD, or TFNI) or an appropriate DoD official (for FRD) is taken to declassify them.
(ii) RD derivative classifiers may remove RD or FRD from portion-marked source matter if the resulting matter is not for public release. RD derivative classifiers cannot declassify matter marked as containing RD, FRD, and TFNI. Matter that potentially contains RD or TFNI must be sent to designated individuals in the DOE and those containing FRD must be sent to designated individuals in the DoD for declassification or removal of the RD, FRD, or TFNI prior to public release.
(iii) Matter containing TFNI is excluded from the automatic declassification provisions of E.O. 13526 until the TFNI designation is properly removed by the DOE. When the DOE determines that a TFNI designation may be removed, any remaining classified information must be referred to the appropriate agency.
(iv) Any matter marked as or that potentially contains RD, FRD, or TFNI within a document intended for public release that contains RD or FRD subject area indicators must be reviewed by the appropriate DOE organization.
(8) Challenges to RD, FRD, and TFNI. A contractor employee who believes RD, FRD, or TFNI is classified improperly or unnecessarily may challenge that classification following the procedures established by the GCA. They may also send challenges directly to the Director, Office of Classification, AU-60/Germantown Building; U.S. Department of Energy; 1000 Independence Avenue SW, Washington, DC 20585, at any time. Under no circumstance is an employee subject to retribution for challenging the classification status of RD, FRD, or TFNI.
(9) Commingling. Commingling of RD, FRD, and TFNI with NSI in the same document should be avoided to the greatest degree possible. When mixing this information cannot be avoided, the marking requirements in 10 CFR part 1045, section 140(f) and declassification requirements of 10 CFR part 1045, section 155 apply.
(10) Protection of RD and FRD. Most of the protection requirements for RD and FRD are similar to NSI and are based on the classification level. However, there are some protection requirements for certain RD information that may be applied through specific contract requirements by the GCA. These range from distribution limitations through the limitation of access to specifically authorized individuals to specific storage requirements, including the requirement for IDSs, and additional accountability records.
(i) Any DOE contractor that violates a classified information security requirement may be subject to a civil penalty under the provisions of 10 CFR part 824.
(ii) Certification is required for individuals authorized access to specific Sigma categories, as appropriate. Address questions regarding these requirements to DOE's National Nuclear Security Administration, Office of Defense Programs.
(iii) Storage and distribution requirements are determined by the classification level, category, and Sigma category. Sigma designation is not a requirement for all RD documents. Storage and distribution requirements will be dependent only on classification level and category.
(11) Accountability. In addition to TOP SECRET information, some SECRET RD information is considered accountable ( e.g., specific Sigma 14 matter). Each nuclear weapon data control point will keep a record of transactions involving Secret nuclear weapon data documents under its jurisdiction including origination, receipt, transmission, current custodian, reproduction, change of classification, declassification, and destruction.
(12) Cybersecurity. Classified databases, systems, and networks containing RD and FRD are protected under the requirements developed and distributed by the DOE Office of the Chief Information Officer.
(f) NNPI. NNPI is information associated with the Naval Nuclear Propulsion Program and is governed by Office of the Chief of Naval Operations Instruction (OPNAVINST) N9210.3, “Safeguarding of Naval Nuclear Propulsion Information” (available at: https://www.secnav.navy.mil/doni/Directives/09000%20General%20Ship%20Design%20and%20Support/09-200%20Propulsion%20Plants%20Support/N9210.3%20(Unclas%20Portion).pdf ). Naval Reactors, a joint DOE/Department of Navy organization established under 50 U.S.C. 2406 and 2511, is responsible for the protection of this information. All contracts which grant access to NNPI must require compliance with the specific safeguarding requirements contained in OPNAVINST N9210.3. All waivers or deviations involving security requirements protecting NNPI require Naval Reactors' concurrence. Classified NNPI may not be processed on any contractor information system unless approved by the cognizant authorizing authority with concurrence from Naval Reactors.
§ 117.24   Cognizant Security Office information.
(a) DoD. Refer to the DCSA website ( https://www.dcsa.mil ) for a listing of office locations and areas of responsibility and for information on verification of facility clearances and safeguarding. In those cases where the cleared facility is located on a DoD installation the applicable DCSA field office can advise if the installation commander is providing security oversight.
Table 1 to Paragraph ( a ) DoD Cognizant Security Office
(b) DOE.
Table 2 to Paragraph ( b ) DOE Cognizant Security Offices
Table 3 to Paragraph ( b ) DOE Cognizant Security Offices Continued
(c) NRC.
Table 4 to Paragraph ( c ) NRC Cognizant Security Offices
(d) DHS.
Table 6 to Paragraph ( d ) DHS Cognizant Security Office