Title 32—National Defense--Volume 1
PART 117—NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL (NISPOM)
§ 117.1   Purpose.
(a) This rule implements policy, assigns responsibilities, establishes requirements, and provides procedures, consistent with E.O. 12829, “National Industrial Security Program”; E.O. 10865, “Safeguarding Classified Information within Industry”; 32 CFR part 2004; and DoD Instruction (DoDI) 5220.22, “National Industrial Security Program (NISP)” (available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/522022p.pdf?ver=2018-05-01-073158-710 ) for the protection of classified information that is disclosed to, or developed by contractors of the U.S. Government (USG) (hereinafter referred to in this rule as contractors).
(b) This rule, also in accordance with E.O. 12829, E.O. 13587,”Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information”; E.O. 13691, “Promoting Private Sector Cybersecurity Information Sharing”; E.O. 12333, “United States Intelligence Activities”; 42 U.S.C. 2011 et seq. (also known as and referred to in this rule as the “AEA of 1954,” as amended); ” 50 U.S.C. Ch. 44 (also known as the “National Security Act of 1947,” as amended); 50 U.S.C. 3501 et seq. (also known as the “Central Intelligence Agency Act of 1949,” as amended); Public Law 108-458 (also known as the “Intelligence Reform and Terrorism Prevention Act of 2004”); and 32 CFR part 2004:
(1) Prescribes industrial security procedures and practices, under E.O. 12829 or successor orders, to safeguard USG classified information that is developed by or disclosed to contractors of the USG.
(2) Prescribes requirements, restrictions, and other safeguards to prevent unauthorized disclosure of classified information and protect special classes of classified information.
(3) Prescribes that contractors will implement the provisions of this part no later than 6 months from February 24, 2021, with the exception of requirements for reporting foreign travel to the Department of Defense prescribed in SEAD 3 and implemented through this rule. Contractors under the security cognizance of the Department of Defense will begin reporting foreign travel to the Department of Defense no later than 18 months from February 24, 2021.
§ 117.2   Applicability.
(a) This rule applies to:
(1) The Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this rule as the “DoD Components”).
(2) All executive branch departments and agencies.
(3) All industrial, educational, commercial, or other non-USG entities granted access to classified information by the USG executive branch departments and agencies or by foreign governments.
(4) The release of classified information by the USG to contractors, who are required to safeguard classified information released during all phases of the contracting, agreement (including cooperative research and development agreements), licensing, and grant processes, i.e., the preparation and submission of bids and proposals, negotiation, award, performance, and termination. Also, it applies in situations involving a contract, agreement, license, or grant when actual knowledge of classified information is not required, but reasonable physical security measures cannot be employed to prevent aural or visual access to classified information, because there is the ability and opportunity to gain knowledge of classified information. It also applies to any other situation in which classified information or FGI that is furnished to a contractor requires protection in the interest of national security, but which is not released under a contract, license, certificate or grant.
(b) This rule does not:
(1) Limit in any manner the authority of USG executive branch departments and agencies to grant access to classified information under the cognizance of their department or agency to any individual designated by them. The granting of such access is outside the scope of the NISP and is accomplished pursuant to E.O. 12968, E.O. 13526, E.O. 13691, the AEA, and applicable disclosure policies.
(2) Apply to criminal proceedings in the courts or authorize contractors or their employees to disclose classified information in connection with any criminal proceedings. Defendants and their representative in criminal proceedings in U.S. District Courts, Courts of Appeal, and the U.S. Supreme Court may gain access to classified information in accordance with 18 U.S.C. Appendix 3, Section 1, also known as and referred to in this rule as the “Classified Information Procedures Act,” as amended.
§ 117.3   Acronyms and Definitions.
(a) Acronyms. Unless otherwise noted, these acronyms and their terms are for the purposes of this rule.
(b) Definitions. Unless otherwise noted, these terms and their definitions are for the purposes of this rule.
Access means the ability and opportunity to gain knowledge of classified information.
Access Permittee means the holder of an Access Permit issued pursuant to the regulations set forth in 10 CFR part 725, “Permits For Access to Restricted Data.”
ACCM are security measures used by USG agencies to safeguard classified intelligence or operations when normal measures are insufficient to achieve strict need-to-know controls and where SAP controls are not required.
Adverse information means any information that adversely reflects on the integrity or character of a cleared employee, that suggests that his or her ability to safeguard classified information may be impaired, that his or her access to classified information clearly may not be in the interest of national security, or that the individual constitutes an insider threat.
Affiliate means each entity that directly or indirectly controls, is directly or indirectly controlled by, or is under common control with, the ultimate parent entity.
Agency(ies) means any “Executive agency” as defined in 5 U.S.C. 105; any “Military department” as defined in 5 U.S.C. 102; and any other entity within the executive branch that releases classified information to private sector entities. This includes component agencies under another agency or under a cross-agency oversight office (such as ODNI with CIA), which are also agencies for purposes of this rule.
Alarm service company means an entity or branch office from which all of the installation, service, and maintenance of alarm systems are provided, and the monitoring and investigation of such systems are either provided by its own personnel or with personnel assigned by this location.
Alarm system description form means a form describing an alarm system and monitoring information.
Approved security container means a GSA approved security container originally procured through the Federal Supply system. The security containers bear the GSA Approval label on the front face of the container, which identifies them as meeting the testing requirements of the assigned federal specification and having been maintained according to Federal Standard 809.
Approved vault means a vault built to Federal Standard 832 and approved by the CSA.
AUS community consists of the Government of Australia entities and Australian non-governmental facilities identified on the DDTC website ( https://pmddtc.state.gov/ ) at the time of export or transfer.
Authorized person means a person who has a favorable determination of eligibility for access to classified information, has signed an approved nondisclosure agreement, and has a need-to-know.
Branch office means an office of an entity which is located somewhere other than the entity's main office location. A branch office is simply another location of the same legal business entity, and is still involved in the business activities of the entity.
CCIPP means security sharing of classified information under a designated critical infrastructure protection program with such authorized individuals and organizations as determined by the Secretary of Homeland Security.
CDC means a subset of contractors cleared under the NISP who have classified contracts with the DoD.
Certification means comprehensive evaluation of an information system component that establishes the extent to which a particular design and implementation meets a set of specified security requirements.
Classification guide means a document issued by an authorized original classifier that identifies the elements of information regarding a specific subject that must be classified and prescribes the level and duration of classification and appropriate declassification instructions.
Classified contract means any contract, license, agreement, or grant requiring access to classified information by a contractor and its employees for performance. A contract is referred to in this rule as a “classified contract” even when the contract document and the contract provisions are not classified. The requirements prescribed for a “classified contract” also are applicable to all phases of precontract, license or grant activity, including solicitations (bids, quotations, and proposals), precontract negotiations, post-contract activity, or other government contracting activity (GCA) programs or projects which require access to classified information by a contractor.
Classified covered information system means an information system that is owned or operated by or for a cleared defense contractor and that processes, stores, or transmits information created by or for the DoD with respect to which such contractor is required to apply enhanced protection ( e.g., classified information). A classified covered information system is a type of covered network consistent with the requirements of Section 941 of Public Law 112-239 and 10 U.S.C. 391.
Classified information means information that has been determined, pursuant to E.O. 13526, or any predecessor or successor order, and the AEA of 1954, as amended, to require protection against unauthorized disclosure in the interest of national security and which has been so designated. The term includes NSI, RD, and FRD.
Classified meetings means a conference, seminar, symposium, exhibit, convention, training course, or other such gathering during which classified information is disclosed.
Classified visit means a visit during which a visitor will require, or is expected to require, access to classified information.
Classifier means any person who makes a classification determination and applies a classification category to information or material. The determination may be an original classification action or it may be a derivative classification action. Contractors make derivative classification determinations based on classified source material, a security classification guide, or a contract security classification specification, or equivalent.
Cleared commercial carrier means a carrier that is authorized by law, regulatory body, or regulation to transport SECRET and CONFIDENTIAL material and has been granted a SECRET facility clearance in accordance with the NISP.
Cleared employees means all employees of industrial or commercial contractors, licensees, certificate holders, or grantees of an agency, as well as all employees of subcontractors and personal services contractor personnel, and who are granted favorable eligibility determinations for access to classified information by a CSA or are being processed for eligibility determinations for access to classified information by a CSA. A contractor may give an employee access to classified information in accordance with the provisions of § 117.10(a)(1)(iii).
Closed area means an area that meets the requirements of this rule for safeguarding classified material that, because of its size, nature, or operational necessity, cannot be adequately protected by the normal safeguards or stored during nonworking hours in approved containers.
CNWDI means a DoD category of TOP SECRET RD or SECRET RD information that reveals the theory of operation or design of the components of a thermonuclear or fission bomb, warhead, demolition munition, or test device. Specifically excluded is information concerning arming, fusing, and firing systems; limited life components; and total contained quantities of fissionable, fusionable, and high explosive materials by type. Among these excluded items are the components that DoD personnel set, maintain, operate, test or replace.
Compromise means an unauthorized disclosure of classified information.
COMSEC means the protective measures taken to deny unauthorized persons information derived from USG telecommunications relating to national security and to ensure the authenticity of such communications.
CONFIDENTIAL means the classification level applied to information, the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority (OCA) is able to identify or describe.
Consignee means a person, firm, or Government ( i.e., USG or foreign government) activity named as the receiver of a shipment; one to whom a shipment is consigned.
Consignor means a person, firm, or Government ( i.e., USG or foreign government) activity by which articles are shipped. The consignor is usually the shipper.
Constant surveillance service means a transportation protective service provided by a commercial carrier qualified by the Surface Deployment and Distribution Command to transport CONFIDENTIAL shipments. The service requires constant surveillance of the shipment at all times by a qualified carrier representative; however, an FCL is not required for the carrier. The carrier providing the service must maintain a signature and tally record for the shipment.
Consultant means an individual under contract, and compensated directly, to provide professional or technical assistance to a contractor in a capacity requiring access to classified information.
Continuous evaluation as defined in SEAD 6 is a personnel security investigative process to review the background of a covered individual who has been determined to be eligible for access to classified information or to hold a sensitive position at any time during the period of eligibility. Continuous evaluation leverages a set of automated records checks and business rules, to assist in the ongoing assessment of an individual's continued eligibility. It supplements, but does not replace, the established personnel security program for scheduled periodic reinvestigations of individuals for continuing eligibility.
Continuous monitoring program means a system that facilitates ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions.
Contracting officer means a USG official who, in accordance with departmental or agency procedures, has the authority to enter into and administer contracts, licenses or grants and make determinations and findings with respect thereto, or any part of such authority. The term also includes the designated representative of the contracting officer acting within the limits of his or her authority.
Contractor means any industrial, educational, commercial, or other entity that has been granted an entity eligibility determination by a CSA. This term also includes licensees, grantees, or certificate holders of the USG with an entity eligibility determination granted by a CSA. As used in this rule, “contractor” does not refer to contractor employees or other personnel.
Cooperative agreement means a legal instrument which, consistent with 31 U.S.C. 6305, is used to enter into the same kind of relationship as a grant (see definition of “grant” in this subpart), except that substantial involvement is expected between USG and the recipient when carrying out the activity contemplated by the cooperative agreement. The term does not include “cooperative research and development agreements” as defined in 15 U.S.C. 3710a.
Cooperative research and development agreement means any agreement between one or more Federal laboratories and one or more non-Federal parties under which the Government, through its laboratories, provides personnel, services, facilities, equipment, intellectual property, or other resources with or without reimbursement (but not funds to non-Federal parties) and the non-Federal parties provide funds, personnel, services, facilities, equipment, intellectual property, or other resources toward the conduct of specified research or development efforts which are consistent with the missions of the laboratory; except that such term does not include a procurement contract or cooperative agreement as those terms are used in sections 6303, 6304, and 6305 of title 31.
Corporate family means an entity, its parents, subsidiaries, divisions, and branch offices.
Counterintelligence means information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted for or on behalf of foreign powers, organizations or persons, or international terrorist activities, but not including personnel, physical, document or communications security programs.
Courier means a cleared employee, designated by the contractor, whose principal duty is to transmit classified material to its destination, ensuring that the classified material remains under their constant and continuous protection and that they make direct point-to-point delivery.
CRYPTO means the marking or designator that identifies unencrypted COMSEC keying material used to secure or authenticate telecommunications carrying classified or sensitive USG or USG-derived information. This includes non-split keying material used to encrypt or decrypt COMSEC critical software and software based algorithms.
CSA means an agency designated as having NISP implementation and security responsibilities for its own agencies (including component agencies) and any entities and non-CSA agencies under its cognizance. The CSAs are: DoD; DOE; NRC; ODNI; and DHS.
CSO means an organizational unit to which the head of a CSA delegates authority to administer industrial security services on behalf of the CSA.
CUI means information the USG creates or possesses, or that an entity creates or possesses for or on behalf of the USG, that a law, regulation, or USG-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.
Custodian means an individual who has possession of, or is otherwise charged with, the responsibility for safeguarding classified information.
Cybersecurity means prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.
Cyber incident means actions taken through the use of computer networks that result in an actual or potentially adverse effect on an information system or the information residing therein.
Declassification means a date or event which coincides with the lapse of the information's national security sensitivity, as determined by the OCA. Declassification occurs when the OCA has determined that the classified information no longer requires, in the interest of national security, any degree of protection against unauthorized disclosure, and the information has had its classification designation removed or cancelled.
Defense articles means those articles, services, and related technical data, including software, in tangible or intangible form, which are listed on the United States Munitions List (USML) of the International Traffic in Arms Regulations (ITAR), as modified or amended. Defense articles exempt from the scope of ITAR section 126.17 are identified in Supplement No. 1 to Part 126 of the ITAR.
Defense services means:
(1) Furnishing assistance (including training) to foreign persons, whether in the United States or abroad, in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles;
(2) Furnishing to foreign persons any controlled technical data, whether in the United States or abroad; or
(3) Providing military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons in the United States or abroad or by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercise, and military advice.
Derivative classification means the incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. Derivative classification includes classifying information based on classification guidance. Duplicating or reproducing existing classified information is not derivative classification.
Document means any recorded information, regardless of the nature of the medium, or the method or circumstances of recording.
Downgrade means a determination by a declassification authority that information classified and safeguarded at a specified level will be classified and safeguarded at a lower level.
Embedded system means an information system that performs or controls a function, either in whole or in part, as an integral element of a larger system or subsystem, such as, ground support equipment, flight simulators, engine test stands, or fire control systems.
Empowered official is defined in 22 CFR part 120.
Entity is a generic and comprehensive term which may include sole proprietorships, partnerships, corporations, limited liability companies, societies, associations, institutions, contractors, licensees, grantees, certificate holders, and other organizations usually established and operating to carry out a commercial, industrial, educational, or other legitimate business, enterprise, or undertaking, or parts of these organizations. It may reference an entire organization, a prime contractor, parent organization, a branch or division, another type of sub-element, a sub-contractor, subsidiary, or other subordinate or connected entity (referred to as “sub-entities” when necessary to distinguish such entities from prime or parent entities). It may also reference a specific location or facility, or the headquarters or official business location of the organization, depending upon the organization's business structure, the access needs involved, and the responsible CSA's procedures. The term “entity” as used in this rule refers to the particular entity to which an agency might release, or is releasing, classified information, whether that entity is a parent or subordinate organization. The term “entity” in this rule includes contractors.
Entity eligibility determination means an assessment by the CSA as to whether an entity is eligible for access to classified information of a certain level (and all lower levels). Entity eligibility determinations may be broad or limited to specific contracts, sponsoring agencies, or circumstances. A favorable entity eligibility determination results in eligibility to access classified information under the cognizance of the responsible CSA to the level approved. When the entity would be accessing categories of information such as RD or SCI for which the CSA for that information has set additional requirements, CSAs must also assess whether the entity is eligible for access to that category of information. Some CSAs refer to their favorable entity eligibility determinations as FCLs. However, a favorable entity eligibility determination for the DHS CCIPP is not equivalent to an FCL and does not meet the requirements for FCL reciprocity. A favorable entity eligibility determination does not convey authority to store classified information.
Escort means a cleared person, designated by the contractor, who accompanies a shipment of classified material to its destination. The classified material does not remain in the personal possession of the escort but the conveyance in which the material is transported remains under the constant observation and control of the escort.
Extent of protection means the designation (such as “Complete”) used to describe the degree of alarm protection installed in an alarmed area.
Facility means a plant, laboratory, office, college, university, or commercial structure with associated warehouses, storage areas, utilities, and components, that, when related by function and location, form an operating entity.
FCL means an administrative determination that, from a security viewpoint, an entity is eligible for access to classified information of a certain level (and all lower levels) ( e.g., a type of favorable entity eligibility determination used by some CSAs). An entity eligibility determination for the DHS CCIPP is not the equivalent of an FCL and does not meet the requirements for FCL reciprocity.
FGI means information that is:
(1) Provided to the United States by a foreign government or governments, an international organization of governments, or any element thereof with the expectation, expressed or implied, that the information, the source of the information, or both, are to be held in confidence; or
(2) Produced by the United States pursuant to, or as a result of, a joint arrangement with a foreign government or governments, an international organization of governments, or any element thereof, requiring that the information, the arrangement, or both are to be held in confidence.
Foreign interest means any foreign government, agency of a foreign government, or representative of a foreign government; any form of business enterprise or legal entity organized, chartered or incorporated under the laws of any country other than the United States or its territories, and any person who is not a citizen or national of the United States.
Foreign national means any person who is not a citizen or national of the United States.
Foreign person is defined in 31 CFR 800.224 for CFIUS purposes.
FRD means classified information removed from the Restricted Data category upon a joint determination by the DOE and DoD that such information relates primarily to the military utilization of atomic weapons and that such information can be adequately safeguarded as classified defense information.
Freight forwarder (transportation agent) means any agent or facility designated to receive, process, and transship U.S. material to foreign recipients. In the context of this rule, it means an agent or facility cleared specifically to perform these functions for the transfer of U.S. classified material to foreign recipients.
GCA means an element of an agency that the agency head has designated and delegated broad authority regarding acquisition functions. A foreign government may also be a GCA.
Governing board means an entity's board of directors, board of managers, board of trustees, or equivalent governing body.
Grant means a legal instrument which, consistent with 31 U.S.C. 6304, is used to enter into a relationship: (a) Of which the principal purpose is to transfer a thing of value to the recipient to carry out a public purpose of support or stimulation authorized by a law of the United States, rather than to acquire property or services for the USG's direct benefit or use; or, (b) In which substantial involvement is not expected between DoD and the recipient when carrying out the activity contemplated by the award. Throughout this rule, the term grant will include both the grant and cooperative agreement.
Grantee means the entity that receives a grant or cooperative agreement.
Hand carrier means a cleared employee, designated by the contractor, who occasionally hand carries classified material to its destination in connection with a classified visit or meeting. The classified material remains in the personal possession of the hand carrier except for authorized overnight storage.
Home office means the headquarters of a multiple facility entity.
Industrial security means that portion of information security concerned with the protection of classified information in the custody of U.S. industry.
Information means any knowledge that can be communicated or documentary material, regardless of its physical form or characteristics.
Information security means the system of policies, procedures, and requirements established pursuant to executive order, statute, or regulation to protect information that, if subjected to unauthorized disclosure, could reasonably be expected to cause damage to national security. The term also applies to policies, procedures, and requirements established to protect unclassified information that may be withheld from release to the public.
Information system means an assembly of computer hardware, software, and firmware configured for the purpose of automating the functions of calculating, computing, sequencing, storing, retrieving, displaying, communicating, or otherwise manipulating data, information and textual material.
Insider means cleared contractor personnel with authorized access to any USG or contractor resource, including personnel, facilities, information, equipment, networks, and systems.
Insider threat means the likelihood, risk, or potential that an insider will use his or her authorized access, wittingly or unwittingly, to do harm to the national security of the United States. Insider threats may include harm to contractor or program information, to the extent that the information impacts the contractor or agency's obligations to protect classified NSI.
Joint venture means an association of two or more persons or entities engaged in a single defined project with all parties contributing assets and efforts, and sharing in the management, profits and losses, in accordance with the terms of an agreement among the parties.
KMP means an entity's senior management official (SMO), facility security officer (FSO), insider threat program senior official (ITPSO), and all other entity officials who either hold majority interest or stock in, or have direct or indirect authority to influence or decide issues affecting the management or operations of, the entity or classified contract performance.
L access authorization means an access determination that is granted by DOE or NRC based on a Tier 3 or successor background investigation as set forth in applicable national-level requirements and DOE directives. Within DOE and NRC, an “L” access authorization permits an individual who has an official “need to know” to access Confidential Restricted Data, Secret and Confidential Formerly Restricted Data, Secret and Confidential Transclassified Foreign Nuclear Information, or Secret and Confidential National Security Information, required in the performance of official duties. An “L” access authorization determination is required for individuals with a need to know outside of DOE, NRC, DoD, and in limited cases NASA, to access Confidential Restricted Data.
LAA means security access authorization to CONFIDENTIAL or SECRET information granted to non-U.S. citizens requiring only limited access in the course of their regular duties.
Material means any product or substance on or in which information is embodied.
Matter means anything in physical form that contains or reveals classified information.
Media means physical devices or writing surfaces including but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts (but not including display media) onto which information is recorded, stored, or printed within an information system.
MFO means a legal entity (single proprietorship, partnership, association, trust, or corporation) composed of two or more entities (facilities).
National of the United States means a person who owes permanent allegiance to the United States. All U.S. citizens are U.S. nationals; however, not all U.S. nationals are U.S. citizens (for example, persons born in American Samoa or Swains Island).
NATO information means information bearing NATO markings, indicating the information is the property of NATO, access to which is limited to representatives of NATO and its member nations unless NATO authority has been obtained to release outside of NATO.
NATO visits means visits by personnel representing a NATO entity and relating to NATO contracts and programs.
Need-to-know means a determination made by an authorized holder of classified information that a prospective recipient has a requirement for access to, knowledge of, or possession of the classified information to perform tasks or services essential to the fulfillment of a classified contract or program.
Network means a system of two or more information systems that can exchange data or information.
NNPI is classified or unclassified information concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and repair of the propulsion plants of naval nuclear-powered ships and prototypes, including the associated shipboard and shore-based nuclear support facilities.
Non-DoD executive branch agencies means the non-DoD agencies that have entered into agreements with DoD to receive NISP industrial security services from DoD. A list of these agencies is on the Defense Counterintelligence and Security Agency website at https://www.dcsa.mil.
Non-Federal information system is defined in 32 CFR part 2002.
NRTL means a private sector organizations recognized by the Occupational Safety and Health Administration to perform certification for certain products to ensure that they meet the requirements of both the construction and general industry Occupational Safety and Health Administration electrical standards. Each NRTL is recognized for a specific scope of test standards.
NSI means information that has been determined pursuant to E.O. 13526 or predecessor order to require protection against unauthorized disclosure and marked to indicate its classified status.
NTIB means the industrial bases of the United States and Australia, Canada, and the United Kingdom.
NTIB entity means a person that is a subsidiary located in the United States for which the ultimate parent entity and any intermediate parent entities of such subsidiary are located in a country that is part of the national technology and industrial base (as defined in section 2500 of title 10, United States Code); and that is subject to the foreign ownership, control, or influence requirements of the National Industrial Security Program.
Nuclear weapon data means Restricted Data or Formerly Restricted Data concerning the design, manufacture, or utilization (including theory, development, storage, characteristics, performance and effects) of nuclear explosives, nuclear weapons or nuclear weapon components, including information incorporated in or related to nuclear explosive devices. Nuclear weapon data is matter in any combination of documents or material, regardless of physical form or characteristics.
OCA means an individual authorized in writing, either by the President, the Vice President, or by agency heads or other officials designated by the President, to classify information in the first instance.
Original classification means an initial determination that information requires, in the interest of national security, protection against unauthorized disclosure. Only USG officials who have been designated in writing may apply an original classification to information.
Parent means an entity that owns at least a majority of another entity's voting securities.
PCL means an administrative determination that an individual is eligible, from a security point of view, for access to classified information of the same or lower category as the level of the personnel clearance being granted.
Prime contract means a contract awarded by a GCA to a contractor for a legitimate USG purpose.
Prime contractor means the contractor who receives a prime contract from a GCA.
Privileged user means a user that is authorized (and, therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform.
Proscribed information means:
(1) TOP SECRET information;
(2) COMSEC information or material, excluding controlled cryptographic items when unkeyed or utilized with unclassified keys.
(3) RD;
(4) SAP information; or.
(5) SCI.
Protective security service means a transportation protective service provided by a cleared commercial carrier qualified by DoD's Surface Deployment and Distribution Command to transport SECRET shipments.
Q access authorization means an access determination that is granted by DOE or NRC based on a Tier 5 or successor background investigation as set forth in applicable national-level requirements and DOE directives. Within DOE and the NRC, a “Q” access authorization permits an individual with an official “need to know” to access Top Secret, Secret and Confidential Restricted Data, Formerly Restricted Data, Transclassified Foreign Nuclear Information, National Security Information, or special nuclear material in Category I or II quantities, as required in the performance of official duties. A “Q” access authorization is required for individuals with a need to know outside of DOE, NRC, DoD, and in a limited case NASA, to access Top Secret and Secret Restricted Data.
Remote terminal means a device communicating with an automated information system from a location that is not within the central computer facility.
Restricted area means a controlled access area established to safeguard classified material that, because of its size or nature, cannot be adequately protected during working hours by the usual safeguards, but is capable of being stored during non-working hours in an approved repository or secured by other methods approved by the CSA.
RD means all data concerning (1) design, manufacture, or utilization of atomic weapons; (2) the production of special nuclear material; or (3) the use of special nuclear material in the production of energy, but does not include data declassified or removed from the RD category pursuant to section 142 of the AEA.
SAP means any program that is established to control access and distribution and to provide protection for particularly sensitive classified information beyond that normally required for TOP SECRET, SECRET, or CONFIDENTIAL information. A SAP can be created or continued only as authorized by a senior agency official delegated such authority pursuant to E.O. 13526.
Schedule 13D means a form required by the Securities and Exchange Commission when a person or group of persons acquires beneficial ownership of more than 5% of a voting class of a company's equity securities registered under Section 12 of the “Securities Exchange Act of 1934” (available at: https://www.sec.gov/fast-answers/answerssched13htm.html ).
SCI means a subset of classified national intelligence concerning or derived from intelligence sources, methods or analytical processes that is required to be protected within formal access control systems established by the DNI.
SECRET means the classification level applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the OCA is able to identify or describe.
Security in depth means a determination made by the CSA that a contractor's security program consists of layered and complementary security controls sufficient to deter and detect unauthorized entry and movement within the facility. Examples include, but are not limited to, use of perimeter fences, employee and visitor access controls, use of an Intrusion Detection System (IDS), random guard patrols throughout the facility during nonworking hours, closed circuit video monitoring, or other safeguards that mitigate the vulnerability of open storage areas without alarms and security storage cabinets during nonworking hours.
Security violation means failure to comply with the policy and procedures established by this part that reasonably could result in the loss or compromise of classified information.
Shipper means one who releases custody of material to a carrier for transportation to a consignee. (See also “Consignor.”)
SMO is the contractor's official responsible for the entity policy and strategy. The SMO is an entity employee occupying a position in the entity with ultimate authority over the facility's operations and the authority to direct actions necessary for the safeguarding of classified information in the facility. This includes the authority to direct actions necessary to safeguard classified information when the access to classified information by the facility's employees is solely at other contractor facilities or USG locations.
Source document means an existing document that contains classified information that is incorporated, paraphrased, restated, or generated in new form into a new document.
Standard practice procedures means a document prepared by a contractor that implements the applicable requirements of this rule for the contractor's operations and involvement with classified information at the contractor's facility.
Subcontract means any contract entered into by a contractor to furnish supplies or services for performance of a prime contract or a subcontract. It includes a contract, subcontract, purchase order, lease agreement, service agreement, request for quotation (RFQ), request for proposal (RFP), invitation for bid (IFB), or other agreement or procurement action between contractors that requires or will require access to classified information to fulfill the performance requirements of a prime contract.
Subcontractor means a supplier, distributor, vendor, or firm that enters into a contract with a prime contractor to furnish supplies or services to or for the prime contractor or another subcontractor. For the purposes of this rule, each subcontractor will be considered as a prime contractor in relation to its subcontractors.
Subsidiary means an entity in which another entity owns at least a majority of its voting securities.
System software means computer programs that control, monitor, or facilitate use of the information system; for example, operating systems, programming languages, communication, input-output controls, sorts, security packages, and other utility-type programs. Also includes off-the-shelf application packages obtained from manufacturers and commercial vendors, such as for word processing, spreadsheets, data base management, graphics, and computer-aided design.
Technical data means:
(1) Information, other than software, which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions or documentation.
(2) Classified information relating to defense articles and defense services on the U.S. Munitions List and 600-series items controlled by the Commerce Control List.
(3) Information covered by an invention secrecy order.
(4) Software directly related to defense articles.
TFNI means classified information concerning the nuclear energy programs of other nations (including subnational entities) removed from the RD category under section 142(e) of the AEA after the DOE and the Director of National Intelligence jointly determine that it is necessary to carry out intelligence-related activities under the provisions of the National Security Act of 1947, as amended, and that it can be adequately safeguarded as NSI instead. This includes information removed from the RD category by past joint determinations between DOE and the CIA. TFNI does not include information transferred to the United States under an Agreement for Cooperation under the Atomic Energy Act or any other agreement or treaty in which the United States agrees to protect classified information.
TOP SECRET means the classification level applied to information, the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the OCA is able to identify or describe.
Transmission means sending information from one place to another by radio, microwave, laser, or other non-connective methods, as well as by cable, wire, or other connective medium. Transmission also includes movement involving the actual transfer of custody and responsibility for a document or other classified material from one authorized addressee to another.
Transshipping activity means a government activity to which a carrier transfers custody of freight for reshipment by another carrier to the consignee.
UK community consists of the UK Government entities with facilities and UK non-governmental facilities identified on the DDTC website ( https://www.pmddtc.state.gov/ ) at the time of export.
Unauthorized person means a person not authorized to have access to specific classified information in accordance with the requirements of this rule.
United States means the 50 states and the District of Columbia.
United States and its territorial areas means the 50 states, the District of Columbia, Puerto Rico, Guam, American Samoa, the Virgin Islands, Wake Island, Johnston Atoll, Kingman Reef, Palmyra Atoll, Baker Island, Howland Island, Jarvis Island, Midway Islands, Navassa Island, and Northern Mariana Islands.
Upgrade means a determination that certain classified information, in the interest of national security, requires a higher degree of protection against unauthorized disclosure than currently provided, coupled with a change to the classification designation to reflect the higher degree.
U.S. classified cryptographic information means a cryptographic key and authenticators that are classified and are designated as TOP SECRET CRYPTO or SECRET CRYPTO. This means all cryptographic media that embody, describe, or implement classified cryptographic logic, to include, but not limited to, full maintenance manuals, cryptographic descriptions, drawings of cryptographic logic, specifications describing a cryptographic logic, and cryptographic software, firmware, or repositories of such software such as magnetic media or optical disks.
U.S. person means a United States citizen, an alien known by the intelligence agency concerned to be a permanent resident alien, an unincorporated association substantially composed of United States citizens or permanent resident aliens, or a corporation incorporated in the United States, except for a corporation directed and controlled by a foreign government or governments.
Voting securities means any securities that presently entitle the owner or holder thereof to vote for the election of directors of the issuer or, with respect to unincorporated entities, individuals exercising similar functions.
Working hours means the period of time when:
(1) There is present in the specific area where classified material is located, a work force on a regularly scheduled shift, as contrasted with employees working within an area on an overtime basis outside of the scheduled work shift; and
(2) The number of employees in the scheduled work force is sufficient in number and so positioned to be able to detect and challenge the presence of unauthorized personnel. This would, therefore, exclude janitors, maintenance personnel, and other individuals whose duties require movement throughout the facility.
Working papers means documents or materials, regardless of the media, which are expected to be revised prior to the preparation of a finished product for dissemination or retention.
§ 117.4   Policy.
E.O. 12829 established the NISP to serve as a single, integrated, cohesive industrial security program to protect classified information and preserve our Nation's economic and technological interests.
(a) When contracts, licenses, agreements, and grants to contractors require access to classified information, national security requires that this information be safeguarded in a manner equivalent to its protection within the executive branch of the USG.
(b) National security requires that the industrial security program promote the economic and technological interests of the United States. Redundant, overlapping, or unnecessary requirements impede those interests.
§ 117.5   Information collections.
The information collection requirements are:
(a) Standard Form (SF) 328 “Certificate Pertaining to Foreign Interest” (available at: https://www.gsa.gov/forms-library/certificate-pertaining-foreign-interests ) in § 117.8 and § 117.11, is assigned Office of Management and Budget (OMB) Control Number 0704-0579. The expiration date of this information collection is listed in the DoD Information Collections System at https://apps.sp.pentagon.mil/sites/dodiic/Pages/default.aspx.
(b) NRC collection. “Facility Security Clearance and Safeguarding of National Security Information and Restricted Data,” is assigned OMB Control Number: 3150-0047. Under this collection, NRC-regulated facilities and other organizations are required to provide information and maintain records to ensure that an adequate level of protection is provided to NRC-classified information and material.
(c) DOE collection. “Security,” a NISP CSA information collection, is assigned OMB Control Number: 1910-1800. This information collection, which includes facility security clearance information, is used by the DOE to exercise management, oversight, and control over its contractors' management and operation of DOE's Government-owned contractor-operated facilities, and over its offsite contractors. The contractor management, oversight, and control functions relate to the ways in which DOE contractors provide goods and services for DOE organizations and activities in accordance with the terms of their contracts and the applicable statutory, regulatory, and mission support requirements of the Department. Information collected from private industry and private individuals is used to protect national security and critical assets entrusted to the Department.
(d) DoD collection. “DoD Security Agreement,” is assigned OMB Control Number: 0704-0194. “National Industrial Security System,” a CSA information collection, is assigned OMB Control Number: 0704-0571, and is a DoD information collection used to conduct its monitoring and oversight of contractors. Department of Defense “Contract Security Classification Specification,” (available at: https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf and available at: https://www.dcsa.mil/is/nccs/ ), is assigned OMB Control Number 0704-0567 and used by both DoD and agencies which have an industrial security agreement with DoD. “Defense Information System for Security,” is assigned OMB Control Number: 0704-0573. Defense Information System for Security is a DoD automated system for personnel security, providing a common, comprehensive medium to record, document, and identify personal security actions within DoD including submitting adverse information, verification of security clearance status, requesting investigations, and supporting continuous evaluation activities. It requires personal data collection to facilitate the initiation, investigation and adjudication of information relevant to DoD security clearances and employment suitability determinations for active duty military, civilian employees and contractors seeking such credentials. Joint Personnel Adjudicative System is assigned OMB Control Number: 0704-0496. Joint Personnel Adjudicative System is an information system which requires personal data collection to facilitate the initiation, investigation and adjudication of information relevant to DoD security clearances and employment suitability determinations for active duty military, civilian employees and contractors seeking such credentials.
§ 117.6   Responsibilities.
(a) Under Secretary of Defense for Intelligence & Security (USD(I&S)). The USD(I&S), on behalf of the Secretary of Defense, and in accordance with E.O. 12829, 32 CFR part 2004, and DoDI 5220.22:
(1) Carries out the direction in section 201 of E.O. 12829 that the Secretary of Defense issue and maintain this rule and changes to it. The USD(I&S) does so in consultation with all affected agencies (E.O. 12829 section 201), with the concurrence of the Secretary of Energy, the Chairman of the NRC, the DNI, and the Secretary of Homeland Security (E.O.12829 section 201), and in consultation with the ISOO Director (E.O. 12829 section 102).
(2) Acts as the CSA for DoD.
(3) Provides policy and management of the NISP for non-DoD executive branch agencies who enter into inter-agency security agreements with DoD to provide industrial security services required when classified information is disclosed to contractors in accordance with E.O. 12829, as amended.
(b) Director, DCSA. Under the authority, direction, and control of the USD(I&S), and in accordance with DoDI 5220.22 and DoD Directive (DoDD) 5105.42, “Defense Security Service (DSS)” 1 (available at: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/510542p.pdf?ver=2019-01-14-090012-283 ) the Director, DCSA:
1 On June 20, 2020, the Secretary of Defense re-named the Defense Security Service (DSS) as the Defense Counterintelligence and Security Agency (DCSA), as required by Executive Oder 13467, section 2.6(b)(i) (as amended by Executive Order 13968, Apr. 24, 2019, 84 FR 18125). Pursuant to Section 4 of E.O. 13968, references to DSS in DoD issuances should be deemed or construed to refer to DCSA.
(1) Oversees and manages DCSA, which serves as the DoD CSO.
(2) Administers the NISP as a separate program element on behalf of DoD GCAs and those agencies with agreements with DoD for security services.
(3) Provides security oversight of the NISP as the DoD CSO on behalf of DoD components and those non-DoD executive branch agencies who enter into agreements with DoD as noted in paragraph (a)(3) of this section. The Director, DCSA, will be relieved of this oversight function for DoD special access programs (SAPs) when the Secretary of Defense or the Deputy Secretary of Defense approves a carve-out provision in accordance with DoDD 5205.07, “DoD SAP Policy” (available at: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/520507p.pdf?ver=2020-02-04-142942-827 ).
(c) Secretary of Energy. In addition to the responsibilities in paragraph (h) of this section, the Secretary of Energy:
(1) Prescribes procedures for the portions of this rule pertaining to information classified under the AEA ( i.e., RD, FRD, and TFNI), as nothing in the rule shall be construed to supersede the authority of the Secretary of Energy under the AEA.
(2) Retains authority over access to information classified under the AEA.
(3) Inspects and monitors contractor, licensee, certificate holder, and grantee programs and facilities that involve access to information classified under the AEA, as necessary.
(d) Chairman of the NRC. In addition to the responsibilities in paragraph (h) of this section, the Chairman of the NRC:
(1) Prescribes procedures for the portions of this rule that pertain to information under NRC programs classified under the AEA, other federal statutes, and executive orders.
(2) Retains authority over access to information under NRC programs classified under the AEA, other federal statutes, and executive orders.
(3) Inspects and monitors contractor, licensee, certificate holder, and grantee programs and facilities that involve access to information under NRC programs classified pursuant to the AEA, other federal statutes, and executive orders where appropriate.
(e) DNI. In addition to the responsibilities in paragraph (h) of this section, the DNI:
(1) Prescribes procedures for the portions of this rule pertaining to intelligence sources, methods, and activities, including, but not limited to, SCI.
(2) Retains authority over access to intelligence sources, methods, and activities, including SCI.
(3) Provides guidance on the security requirements for intelligence sources and methods of information, including, but not limited to, SCI.
(f) Secretary of Homeland Security. In accordance with E.O. 12829, E.O. 13691, and in addition to the responsibilities in paragraph (h) of this section, the Secretary of Homeland Security:
(1) Prescribes procedures for the portions of this rule that pertain to the CCIPP.
(2) Retains authority over access to information under the CCIPP.
(3) Inspects and monitors contractor, licensee, certificate holder, and grantee programs and facilities that involve access to CCIPP.
(g) All the CSA heads. The CSA heads:
(1) Oversee the security of classified contracts and activities under their purview.
(2) Provide oversight of contractors under their security cognizance.
(3) Minimize redundant and duplicative security review and audit activities of contractors, including such activities conducted at contractor locations where multiple CSAs have equities.
(4) Execute appropriate intra-agency and inter-agency agreements to avoid redundant and duplicate reviews.
(5) Designate one or more CSOs for security administration.
(6) Designate subordinate officials, in accordance with governing policies, to act as the authorizing official. Authorizing officials will:
(i) Assess and authorize contractors to process classified information on information systems.
(ii) Conduct oversight of such information system processing and provide information system security guidelines in accordance with Federal information system security control policies, standards, and procedures. Minimize redundant and duplicative security review and audit activity of contractors, including such activity conducted at contractor locations where multiple CSAs have equities.
(h) Heads of component agencies. In accordance with applicable CSA direction, the component agency heads:
(1) Oversee compliance with procedures identified by the applicable CSA or designated CSO.
(2) Provide oversight of contractor personnel visiting or working on USG installations.
(3) Promptly apprise the CSO of information received or developed that could adversely affect a cleared contractor, licensee, or grantee, and their employees, to hold an FCL or PCL, or that otherwise raises substantive doubt about their ability to safeguard classified information entrusted to them.
(4) Propose changes to this rule as deemed appropriate and provide them to the applicable CSA for submission to the OUSD(I&S) Counterintelligence, Law Enforcement and Security Directorate.
(i) Director, ISOO. The Director, ISOO:
(1) Oversees the NSIP and agency compliance with it, in accordance with E.O. 12829.
(2) Issues and maintains the NISP implementing directive (32 CFR part 2004), in accordance with E.O. 12829, to provide guidance to the CSAs and USG agencies under the NISP.
(3) Chairs the NISP Policy Advisory Committee. Addresses complaints and suggestions from contractors, as detailed in the NISP Policy Advisory Committee bylaws.
§ 117.7   Procedures.
(a) General. Contractors will protect all classified information that they are provided access to or that they possess. This responsibility applies at both contractor and USG locations.
(b) Contractor Security Officials. Contractors will appoint security officials who are U.S. citizens, except in exceptional circumstances (see § 117.9(m) and § 117.11(e)).
(1) Appointed security officials listed in paragraphs (b)(2), (b)(3), and (b)(4) of this section must:
(i) Oversee the implementation of the requirements of this rule. Depending upon the size and complexity of the contractor's security operations, a single contractor employee may serve in more than one position.
(ii) Undergo the same security training that is required for all other contractor employees pursuant to § 117.12, in addition to their position specific training.
(iii) Be designated in writing with their designation documented in accordance with CSA guidance.
(iv) Undergo a personnel security investigation and national security eligibility determination for access to classified information at the level of the entity's eligibility determination for access to classified information ( e.g., FCL level) and be on the KMP list for the cleared entity.
(2) SMO. The SMO will:
(i) Ensure the contractor maintains a system of security controls in accordance with the requirements of this rule.
(ii) Appoint a contractor employee or employees, in writing, as the FSO and appoint the same employee or a different employee as the ITPSO. The SMO may appoint a single employee for both roles or may appoint one employee as the FSO and a different employee as the ITPSO.
(iii) Remain fully informed of the facility's classified operations.
(iv) Make decisions based on classified threat reporting and their thorough knowledge, understanding, and appreciation of the threat information and the potential impacts caused by a loss of classified information.
(v) Retain accountability for the management and operations of the facility without delegating that accountability to a subordinate manager.
(3) FSO. The FSO will:
(i) Supervise and direct security measures necessary for implementing the applicable requirements of this rule and the related USG security requirements to ensure the protection of classified information.
(ii) Complete security training pursuant to § 117.12 and as deemed appropriate by the CSA.
(4) ITPSO. The ITPSO will establish and execute an insider threat program.
(i) If the appointed ITPSO is not also the FSO, the ITPSO will ensure that the FSO is an integral member of the contractor's insider threat program.
(ii) The ITPSO will complete training pursuant to § 117.12.
(iii) An entity family may choose to establish an entity family-wide insider threat program with one senior official appointed, in writing, to establish, and execute the program as the ITPSO. Each cleared entity using the entity-wide ITPSO must separately appoint that person as its ITPSO for that facility. The ITPSO will provide an implementation plan to the CSA for executing the insider threat program across the entity family.
(5) ISSM. Contractors who are, or will be, processing classified information on an information system located at the contractor facility will appoint an employee to serve as the ISSM. The ISSM must be eligible for access to classified information to the highest level of the information processed on the system(s) under their responsibility. The contractor will ensure that the ISSM is adequately trained and possesses technical competence commensurate with the complexity of the contractor's classified information system. The contractor will notify the applicable CSA if there is a change in the ISSM. The ISSM will oversee development, implementation, and evaluation of the contractor's classified information system program. ISSM responsibilities are in § 117.18.
(6) Employees performing security duties. Those employees whose official duties include performance of NISP-related security functions will complete security training tailored to the security functions performed. This training requirement also applies to consultants whose official duties include security functions.
(c) Other KMP. In addition to the SMO, the FSO, and the ITPSO, the contractor will include on the KMP list, subject to CSA concurrence, any other officials who either hold majority interest or stock in the entity, or who have direct or indirect authority to influence or decide issues affecting the management or operations of the contractor or issues affecting classified contract performance. The CSA may either:
(1) Require these KMP to be determined to be eligible for access to classified information as a requirement for the entity's eligibility determination or;
(2) Allow the entity to formally exclude these KMP from access to classified information. The entity's governing board will affirm the exclusion by issuing a formal action (see table), and provide a copy of the exclusion action to the CSA. The entity's governing board will document this exclusion action.
Table 1 to Paragraph ( c )(2)—Exclusion Resolutions
(d) Insider Threat Program. Pursuant to this rule and CSA provided guidance to supplement unique CSA mission requirements, the contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.”
(e) Standard practice procedures. The contractor will implement all applicable provisions of this rule at each of its cleared facility locations. The contractor will prepare written procedures when the CSA determines them to be necessary to reasonably exclude the possibility of loss or compromise of classified information, and in accordance with additional CSA-provided guidance, as applicable.
(f) Cooperation with Federal agencies. Contractors will cooperate with Federal agencies and their officially credentialed USG or contractor representatives during official reviews, investigations concerning the protection of classified information, or personnel security investigations of present or former employees and others ( e.g., consultants or visitors). At a minimum, cooperation includes:
(1) Providing suitable arrangements within the facility for conducting private interviews with employees during normal working hours;
(2) Providing, when requested, relevant employment or personnel files, security records, supervisory files, records pertinent to insider threat ( e.g., security, cybersecurity, and human resources) and any other records pertaining to an individual under investigation that are, in the possession or control of the contractor or the contractor's representatives or located in the contractor's offices;
(3) Providing access to employment and security records that are located at an offsite location; and
(4) Rendering other necessary assistance.
(g) Security training and briefings. Contractors will advise all cleared employees, including those assigned to USG locations or operations outside the United States, of their individual responsibility for classification management and for safeguarding classified information. Contractors will provide security training to cleared employees consisting of initial briefings, refresher briefings, and debriefings in accordance with § 117.12.
(h) Security reviews —(1) USG reviews. The applicable CSA will conduct recurring oversight reviews of contractors' NISP security programs to verify that the contractor is protecting classified information and implementing the provisions of this rule. The contractor's participation in the security review is required for maintaining the entity's eligibility for access to classified information.
(i) Review cycle. The CSA will determine the scope and frequency of security reviews, which may be increased or decreased consistent with risk management principles.
(ii) Procedures. (A) The CSA will generally provide notice to the contractor of a forthcoming review, but may also conduct unannounced reviews at its discretion. The CSA security review may subject contractor employees and all areas and receptacles under the control of the contractor to examination.
(B) The CSA will make every effort to avoid unnecessary intrusion into the personal effects of contractor personnel.
(C) The CSA may conduct physical examinations of the interior space of containers not authorized to secure classified material. Such examinations will always be accomplished in the presence of a representative of the contractor.
(iii) Controlled unclassified information (CUI). 32 CFR part 2002 requires agencies to implement CUI requirements, but compliance with CUI requirements is outside the scope of the NISP and this rule. However, CSAs may conduct CUI assessments in conjunction with NISP USG reviews when:
(A) The contractor is a participant in the NISP based on a requirement to access classified information;
(B) A classified contract under the CSA's cognizance includes provisions for access to, or protection or handling of, CUI; and
(C) The CSA has provided the contractor with specific guidance regarding the assessment criteria and methodology it will use for overseeing protection of the CUI being accessed, stored or transmitted by the contractor as part of the classified contract.
(2) Contractor reviews. Contractors will review their security programs on a continuing basis and conduct a formal self-inspection at least annually and at intervals consistent with risk management principles.
(i) Self-inspections will include the review of the classified activity, classified information, classified information systems, conditions of the overall security program, and the insider threat program. They will have sufficient scope, depth, and frequency, and will have management support during the self-inspection and during remedial actions taken as a result of the self-inspection. Self-inspections will include the review of samples representing the contractor's derivative classification actions, as applicable.
(ii) The contractor will prepare a formal report describing the self-inspection, its findings, and its resolution of issues discovered during the self-inspection. The contractor will retain the formal report for CSA review until after the next CSA security review is completed.
(iii) The SMO at the cleared facility will annually certify to the CSA, in writing, that a self-inspection has been conducted, that other KMP have been briefed on the results of the self-inspection, that appropriate corrective actions have been taken, and that management fully supports the security program at the cleared facility in the manner as described in the certification.
(i) Contractors working at USG locations. Contractor employees performing work within the confines of a USG facility will safeguard classified information according to the procedures of the host installation or agency.
(j) Hotlines. Federal agencies maintain hotlines to provide an unconstrained avenue for USG and contractor employees to report, without fear of reprisal, known or suspected instances of security irregularities and infractions concerning contracts, programs, or projects. These hotlines do not supplant the contractor's responsibility to facilitate reporting and timely investigations of security issues concerning its operations or personnel. Contractor personnel are encouraged to report information through established contractor channels. The hotline may be used as an alternate means to report this type of information. Contractors will inform all personnel that hotlines may be used for reporting issues of national security significance. Each CSA will post hotline information and telephone numbers on their websites for contractor access.
(k) Agency agreements. 32 CFR part 2004 and E.O. 12829 require non-CSA agency heads to enter into agreements with the Secretary of Defense as the Executive Agent for the NISP to provide industrial security services. The Secretary of Defense may also enter into agreements to provide services for other CSA's in accordance with 32 CFR part 2004 and E.O. 12829. Agency agreements establish the terms of the Secretary of Defense's (or the Secretary of Defense's designee's) responsibilities when acting as the CSA on behalf of these agency heads. The list of agencies for which the Secretary of Defense has agreed to render industrial security services is on the DCSA website at https://www.dcsa.mil.
(l) Security cognizance. The CSA will inform contractors if oversight has been delegated to a CSO.
(m) Rule interpretations. Contractors will forward requests for interpretations of this rule to their CSA in accordance with their CSA-provided guidance to supplement unique CSA mission requirements.
(n) Waivers to this rule. Contractors will submit any requests to waive provisions of this rule in accordance with CSA procedures, which may include periodic review of approved waivers. When submitting a request for a waiver, the contractor will, in writing, explain why it is impractical or unreasonable for the contractor to comply with the requirement it is asking to waive, identify alternative measures as prescribed by this rule, and include a proposed duration for the waiver. The contractor cannot implement a waiver unless the waiver is approved by the applicable CSA.
(o) Complaints and suggestions. Contractors may forward NISP administration complaints and suggestions to the Director of ISOO. However, contractors are encouraged to forward NISP administration complaints and suggestions to their respective CSA prior to forwarding to the ISOO.
Table 2 to Paragraph ( o ) NISP Administration Complaints and Suggestions
§ 117.8   Reporting requirements.
(a) General. Pursuant to this rule, Security Executive Agent Directive (SEAD) 3, (available at: https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-3-Reporting-U.pdf ) and CSA-provided guidance to supplement unique CSA mission requirements, contractors and their cleared employees are required to:
(1) Report certain events that may have an effect on the status of the entity's or an employee's eligibility for access to classified information; report events that indicate an insider threat to classified information or to employees with access to classified information; report events that affect proper safeguarding of classified information; and report events that indicate classified information has been, or is suspected to be, lost or compromised.
(2) Establish internal procedures to ensure employees with eligibility for access to classified information are aware of their responsibilities for reporting pertinent information to the FSO. The contractor will:
(i) Provide reports to the FBI, or other Federal authorities as required by this rule, the terms of a classified contract or other agreement, and by U.S. law.
(ii) Provide complete information to enable the CSA to ascertain whether classified information is adequately protected.
(iii) Submit reports to the FBI, the CSA, or the ISOO as specified in paragraphs (b), (c), and (g) of this section.
(3) Appropriately mark reports containing classified information in accordance with § 117.14.
(4) Clearly mark a report containing information submitted in confidence as containing that information. When reports contain information pertaining to an individual, 5 U.S.C. 552a (also known as and referred to in this rule as “The Privacy Act of 1974, as amended,”) permits the withholding of certain information from the individual in accordance with specific exemptions, which include authority to withhold release of information to the extent that the disclosure of the information would reveal the identity of a source who furnished the information to the USG under an express promise that the identity of the source would be held in confidence.
(b) Reports to be submitted to the FBI. The contractor will promptly submit a written report to the nearest field office of the FBI regarding information coming to the contractor's attention concerning actual, probable, or possible espionage, sabotage, terrorism, or subversive activities at any of its locations.
(1) An initial report may be made by phone, but it must be followed up in writing ( e.g., email or formal correspondence), regardless of the FBI's disposition of the report.
(2) The contractor will promptly notify the CSA when they make a report to the FBI and provide the CSA a copy of the written report.
(c) Reports to be submitted to the CSA —(1) Adverse information. Contractors are required to report adverse information coming to their attention concerning any of their employees determined to be eligible for access to classified information, in accordance with this rule, SEAD 3, and CSA-provided guidance. Contractors will not make reports based on rumor or innuendo.
(i) The termination of employment of an employee does not negate the requirement to submit this report. If a contractor employee is assigned to a USG location, the contractor will furnish a copy of the report and its final disposition to the USG security point of contact for that location.
(ii) Pursuant to Becker v. Philco, 372 F.2d 771 (4th Cir. 1967), cert. denied 389 U.S. 979 (1967), and subsequent cases, a contractor may not be liable for defamation of an employee because of communications that are required of and made by a contractor to an agency of the United States under the requirements of this rule or under the terms of applicable contracts.
(2) Suspicious contacts. Contractors will report information pertaining to suspicious contacts with employees determined to be eligible for access to classified information, and pertaining to efforts to obtain illegal or unauthorized access to the contractor's cleared facility by any means, including:
(i) Efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to classified information.
(ii) Efforts by any individual, regardless of nationality, to elicit information from an employee determined eligible for access to classified information, and any contact which suggests the employee may be the target of an attempted exploitation by an intelligence service of another country. See SEAD 3 for specific information to be reported.
(3) Change in status of employees determined eligible for access to classified information. Contractors will report by means of the CSA-designated reporting mechanism information pertaining to changes in status of employees determined eligible for access to classified information such as:
(i) Death.
(ii) Change in name.
(iii) Termination of employment.
(iv) Change in citizenship.
(4) Citizenship by naturalization. Contractors will report if a non-U.S. citizen employee granted an LAA becomes a citizen through naturalization. The report will include:
(i) City, county, and state where naturalized.
(ii) Date naturalized.
(iii) Court.
(iv) Certificate number.
(5) Employees desiring not to be processed for a national security eligibility determination or not to perform classified work. Contractors will report instances when an employee no longer wishes to be processed for a determination of eligibility for access to classified information or to continue having access to classified information, and the reason for that request.
(6) Classified information nondisclosure agreement (NDA). Contractors will report the refusal by an employee to sign the SF 312, “Classified Information Nondisclosure Agreement,” (available at: https://www.gsa.gov/cdnstatic/SF312-13.pdf?forceDownload=1 ) or other approved NDA.
(7) Changed conditions affecting the contractor's eligibility for access to classified information. Contractors are required to report certain events that affect the status of the entity eligibility determination ( e.g., FCL), affect the status of an employee's PCL, may indicate an employee poses an insider threat, affect the proper safeguarding of classified information, or indicate classified information has been lost or compromised, including:
(i) Change of ownership or control of the contractor, including stock transfers that affect control of the entity.
(ii) Change of operating name or address of the entity or any of its locations determined eligible for access to classified information.
(iii) Any change to the information previously submitted for KMP including, as appropriate, the names of the individuals the contractor is replacing. A new complete KMP listing need be submitted only at the discretion of the contractor or when requested by the CSA. The contractor will provide a statement indicating:
(A) Whether the new KMP are cleared for access to classified information, and if cleared, to what level they are cleared and when they were cleared, their dates and places of birth, social security numbers, and citizenship.
(B) Whether they have been excluded from access to classified information in accordance with § 117.7(b)(5)(ii).
(C) Whether they have been temporarily excluded from access to classified information pending the determination of eligibility for access to classified information in accordance with § 117.9(g).
(iv) Any action to terminate business or operations for any reason, imminent adjudication or reorganization in bankruptcy, or any change that might affect the validity of the contractor's eligibility for access to classified information.
(v) Any material change concerning the information previously reported concerning foreign ownership, control, or influence (FOCI). This report will be made by the submission of an updated SF 328, “Certificate Pertaining to Foreign Interests,” in accordance with CSA-provided guidance. When submitting this information, it is not necessary to repeat answers that have not changed. When entering into discussion, consultations, or agreements that may reasonably lead to effective ownership or control by a foreign interest, the contractor will report the details to the CSA in writing. If the contractor has received a Schedule 13D from the investor, the contractor will forward a copy with the report.
(8) Changes in storage capability. The contractor will report any changes in their storage requirement or capability to safeguard classified material.
(9) Inability to safeguard classified material. The contractor will report any emergency situation that renders their location incapable of safeguarding classified material as soon as possible.
(10) Unsatisfactory conditions of a prime or subcontractors. (i) Prime contractors, including subcontractors who have in turn subcontracted work, will report any information coming to their attention that may indicate that classified information cannot be adequately protected by a subcontractor, or other circumstances that may impact the validity of the eligibility for access to classified information of any subcontractors.
(ii) Subcontractors will report any information coming to their attention that may indicate that classified information cannot be adequately protected or other circumstances that may impact the validity of the eligibility for access to classified information of their prime contractor.
(11) Dispositioned material previously terminated. The contractor will make a report when the location or disposition of material previously terminated from accountability is subsequently discovered and brought back into accountability.
(12) Foreign classified contracts. Contractors will report any pre-contract negotiation or award not placed through a CSA or U.S. GCA that involves, or may involve:
(i) The release or disclosure of U.S. classified information to a foreign interest.
(ii) Access to classified information furnished by a foreign interest.
(13) Reporting of improper receipt of foreign government material. The contractor will report to the CSA the receipt of classified material from foreign interests that is not received through USG channels.
(14) Reporting by subcontractor. Subcontractors will also notify their prime contractors if they make any reports to their CSA in accordance with the provisions of paragraphs (c)(7) through (c)(10) of this section.
(d) Reports of loss, compromise, or suspected compromise. The contractor will report any loss, compromise, or suspected compromise of classified information, U.S. or foreign, to the CSA in accordance with paragraph (d)(1) through (d)(3) of this section. Each CSA may provide additional guidance concerning the reporting time period. If the contractor is located on a USG facility, the contractor will submit the report to the CSA and to the head of the USG facility.
(1) Preliminary inquiry. Immediately upon receipt of a security violation report involving classified information, the contractor will initiate a preliminary inquiry to ascertain all of the circumstances surrounding the presumed loss, compromise, or suspected compromise, including validation of the classification of the information.
(2) Initial report. If the contractor's preliminary inquiry confirms that a loss, compromise, or suspected compromise of any classified information occurred, the contractor will promptly submit an initial report of the incident unless otherwise notified by the CSA.
(3) Final report. When the investigation has been completed, the contractor will submit a final report to the CSA which, in turn, will follow CSA procedures to notify the applicable GCA. The report will include:
(i) Material and relevant information that was not included in the initial report.
(ii) The full name and social security number of the individual or individuals primarily responsible for the incident, including a record of prior loss, compromise, or suspected compromise for which the individual had been determined responsible.
(iii) A statement of the corrective action taken to preclude a recurrence.
(iv) Disciplinary action taken against the responsible individual or individuals, if any.
(v) Specific reasons for reaching the conclusion that loss, compromise, or suspected compromise occurred or did not occur.
(4) Employee information in compromise cases. When requested by the CSA, the contractor will report information concerning an employee or other individual, determined to be responsible for the incident, when the information is needed by the CSA for the loss, compromise, or suspected compromise of classified information.
(e) Individual culpability reports. Contractors will establish and enforce policies that provide for appropriate administrative or disciplinary actions taken against employees who violate the requirements of this rule.
(1) Contractors will establish a system to manage and track information regarding employees with eligibility for access to classified information who violate the requirements of this rule in order to be able to identify patterns of negligence or carelessness, or to identify a potential insider threat.
(2) Contractors will establish and apply a graduated scale of administrative and disciplinary actions in the event of employee security violations or negligence in the handling of classified information. CSAs may provide guidance to contractors with examples of administrative or disciplinary actions that the contractor may consider implementing in the event of employee violations or negligence. Contractors are required to submit a final report to the CSA with the findings of an employee's culpability and what corrective actions were taken.
(3) Contractors will include a statement of the administrative or disciplinary actions taken against an employee in a final report to the CSA. A statement must be included when the individual responsible for a security violation can be determined. Contractors' final reports will indicate whether one or more of the following factors are evident:
(i) Involved a deliberate disregard of security requirements.
(ii) Involved negligence in the handling of classified material.
(iii) Was not deliberate in nature but reflects a recent or recurring pattern of questionable judgment, irresponsibility, negligence, or carelessness.
(f) CDC cyber incident reports. This paragraph applies only to CDCs and sets forth reporting requirements pursuant to 10 U.S.C. 391 and 393 and Defense Federal Acquisition Regulation Supplement Clause 252.204-7012. The reporting requirements of paragraph (f) of this section are in addition to the requirements in paragraphs (b) and (d) of this section, which can include certain activities occurring on unclassified information systems. DoD will provide detailed reporting instructions for contractors affected by these references via industrial security letter in accordance with DoDI 5220.22.
(1) Reports to be submitted to the designated DoD CSO. CDCs will immediately report to the DoD CSO, any cyber incident on a classified covered information system that has been approved by that CSO to process classified information.
(i) At a minimum, the report will include:
(A) A description of the technique or method used in the cyber incident.
(B) A sample of the malicious software involved in the cyber incident, if discovered and isolated by the CDC,
(C) A summary of information in connection with any DoD program that has been potentially compromised due to the cyber incident.
(ii) Information that is reported by the CDC (or derived from information reported by the CDC) will be safeguarded, used, and disseminated in a manner consistent with DoD procedures governing the handling of such information pursuant to Public Law 112-239 and 10 U.S.C. 391.
(iii) Reports involving classified foreign government information will be reported to the Director, Defense Technology Security Administration (DoD).
(2) Reports on non-Federal information systems not authorized to process classified information. CDCs will report cyber incidents on non-Federal, unclassified information systems in accordance with contract requirements.
(3) Access to equipment and information by DoD personnel. (i) The CDC will allow, upon request by DoD personnel, access by DoD personnel to additional equipment or information of the CDC that is necessary to conduct forensic analysis of reportable cyber incidents in addition to any analysis conducted by the CDC.
(ii) The CDC is only required to provide DoD access to equipment or information to determine whether information created by or for DoD in connection with any DoD program was successfully exfiltrated from a CDC's network or information system, and what information was exfiltrated from the CDC's network or information system.
(g) Reports to ISOO. (1) Contractors will report instances of redundant or duplicative security review and audit activity by the CSAs to the Director, ISOO, for resolution.
(2) Contractors will report instances of CSAs duplicating processing to determine an entity's eligibility for access to classified information when there is an existing determination of an entity's eligibility for access to classified information by another CSA.
§ 117.9   Entity eligibility determination for access to classified information.
(a) General. This section applies to all contractors with entity eligibility determinations, except as provided in § 117.22 for entity eligibility determinations for participation in the CCIPP under the cognizance of DHS.
(1) Prior to the entity being granted an entity eligibility determination for access to classified information, the responsible CSA must have determined that:
(i) The entity is eligible for access to classified information to meet a legitimate USG or foreign government need.
(ii) Access is consistent with national security interests.
(2) The CSA will provide guidance on processing entity eligibility determinations for entity access to classified information.
(3) The determination of entity eligibility for access is separate from the determination of a classified information safeguarding capability (see § 117.15).
(4) Neither the contractor nor its employees will be permitted access to classified information until the CSA has made an entity eligibility determination ( e.g., issued an FCL).
(5) The requirement for a favorable entity eligibility determination (also referred to in some instances as an FCL) for a prime contractor includes instances where all access to classified information will be limited to subcontractors. A prime contractor must have a favorable entity eligibility determination at the same or higher classification level as its subcontractors.
(6) Contractors are eligible for storage of classified material in connection with a legitimate USG or foreign government requirement if they have a favorable entity eligibility determination and a classified information safeguarding capability approved by the CSA.
(7) An entity eligibility determination is valid for access to classified information at the same or lower classification level.
(8) Each CSA will maintain a record of entity eligibility determinations made by that CSA.
(9) A contractor will not use its favorable entity eligibility determination for advertising or promotional purposes. This does not prohibit the contractor from advertising employee positions that require a PCL in connection with the position.
(10) A contractor or prospective contractor cannot apply for its own entity eligibility determination. A GCA or a currently cleared contractor may sponsor an entity for an entity eligibility determination at any point during the contracting or agreement life cycle at which the entity must have access to classified information to participate (including the solicitation or competition phase).
(b) Reciprocity. If an entity has an appropriate, final entity eligibility determination, a CSA will not duplicate the entity eligibility determination processes performed by another CSA. If a CSA cannot acknowledge an entity eligibility determination to another CSA, the involved entity may be subject to duplicate processing in accordance with 32 CFR part 2004.
(c) Eligibility requirements. To be eligible for an initial entity eligibility determination or to maintain an existing entity eligibility determination, the entity must:
(1) Need access to classified information in connection with a legitimate USG or foreign government requirement, and access must be consistent with U.S. national security interests as determined by the CSA.
(2) Be organized and existing:
(i) Under the laws of the United States, one of the fifty States, the District of Columbia, or an organized U.S. territory (Guam, Commonwealth of the Northern Marianas Islands, Commonwealth of Puerto Rico, and the U.S. Virgin Islands); or
(ii) Under the laws of an American Indian/Alaska Native tribal entity if:
(A) The American Indian or Alaska Native tribe under whose laws the entity is chartered has been formally acknowledged by the Assistant Secretary—Indian Affairs, of the U.S. Department of the Interior.
(B) The contractor is organized and continues to exist, during the period of the eligibility under a tribal statue or code, or pursuant to a resolution of an authorized tribal legislative body.
(C) The contractor has submitted or will submit records such as a charter, certificate of organization, or other applicable tribal documents and statute or code provisions governing the formation and continuation of the entity, for CSA determination that the entity is tribally chartered.
(3) Be located in the United States or its territorial areas.
(4) Have a record of integrity and lawful conduct in its business dealings.
(5) Have a SMO, FSO, and ITPSO who have and who maintain eligibility for access to classified information and are not excluded from participating in USG contracts or agreements in accordance with § 117.7(b)(1) through § 117.7(b)(3).
(6) Not be under FOCI to such a degree that a favorable entity eligibility determination for access to classified information would be inconsistent with the national interest, in the judgment of the CSA.
(7) Maintain sufficient authorized and cleared employees to manage and implement the requirements of this rule in accordance with CSA guidance.
(8) Not pose an unacceptable risk to national security interests, in the judgment of the CSA.
(9) Meet all requirements governing access to classified information established by the CSA or the relevant authorizing law, regulation, or government-wide policy.
(d) Processing the entity eligibility determination. The CSA will assess the entity's eligibility for access to classified information based on its business structure.
(1) At a minimum, the entity will:
(i) Provide CSA-requested documentation within timelines established by the CSA.
(ii) Have and identify the SMO.
(iii) Appoint a U.S. citizen employee as the FSO.
(iv) Appoint a U.S. citizen employee as the ITPSO.
(v) Submit requests for personnel security investigations for the SMO, FSO, ITPSO, and those other KMP identified by the CSA as requiring eligibility for access to classified information in connection with the entity eligibility.
(2) If the entity is under FOCI with a special security agreement (SSA) as the proposed method of FOCI mitigation, and the GCA requires the entity to have access to proscribed information, the CSA must consider the measures listed in § 117.11(d) as part of the entity eligibility determination.
(e) Other personnel eligibility determinations concurrent with the entity eligibility determination. (1) Contractors may designate employees who require access to classified information during the negotiation of a contract or the preparation of a bid or quotation pertaining to a prime contract or a subcontract. These designated employees will be processed for a determination of eligibility for access to classified information ( i.e., PCL eligibility) concurrent with entity's entity eligibility determination.
(2) The entity eligibility determination is not dependent on the PCL eligibility for access to classified information by such employees, provided none of these employees are among those listed in paragraph (c)(5) of this section. Even so, the employees will not be granted access to classified information until both a favorable entity eligibility determination and PCL eligibility has been granted.
(f) Exclusion procedures. If a CSA determines that certain KMP can be excluded from access to classified information, the contractor will follow the procedures in accordance with § 117.7(b)(5)(ii).
(g) Temporary exclusions. As a result of a changed condition, the SMO or other KMP who require eligibility for access to classified information in connection with the facility entity eligibility determination may be temporarily excluded from access to classified information while in the process of a PCL eligibility determination provided:
(1) The SMO or other KMP are not appointed as the FSO or ITPSO. FSOs and ITPSOs may not be temporarily excluded. A cleared employee must always be appointed to fulfill the requirements of these positions in accordance with this rule.
(2) An employee, cleared to the level of the entity eligibility determination, must be able to fulfill the NISP responsibilities of the temporarily excluded KMP in accordance with this rule while the temporary exclusion is in effect.
(3) The applicable CSA may provide additional guidance on the duration of a temporary exclusion from access to classified information based on circumstances, business structure, and other relevant security information.
(4) The contractor's governing board affirms the exclusion action, and provides a copy of the exclusion action to the CSA. The organization's governing body will document this action.
Table 1 to Paragraph (g)(4) Temporary Exclusion Resolutions
(h) Interim entity eligibility determinations. The CSA may make an interim entity eligibility determination for access to classified information, in the sole discretion of the CSA. See § 117.10(l) for access limitations that also apply to interim entity eligibility determinations.
(i) An interim entity eligibility determination is made on a temporary basis pending completion of the full investigative requirements.
(ii) If the contractor with an interim entity eligibility determination is unable or unwilling to comply with the requirements of this rule and CSA-provided guidance regarding the process to obtain a final entity eligibility determination, the CSA will withdraw the interim entity eligibility.
(i) Multiple facility organizations. The home office must have an entity eligibility determination at the same level as the highest entity eligibility determination of an entity within the MFO. The CSA will determine whether branch offices are eligible for access to classified information if the branch offices need access and meet all other requirements.
(j) Parent-subsidiary relationships. When a parent-subsidiary relationship exists, the CSA will process the parent and the subsidiary separately for entity eligibility determinations.
(1) If the CSA determines the parent must be processed for an entity eligibility determination, then the parent must have an entity eligibility determination at the same or higher level as the subsidiary.
(2) When a parent and subsidiary or multiple cleared subsidiaries are collocated, a formal written agreement to use common security services may be executed by the entities, subject to the approval of the CSA.
(k) Joint ventures. A joint venture may be granted eligibility for access to classified information if it meets the eligibility requirements in paragraph (c) of this section, including:
(1) The joint venture must be established as a legal business entity ( e.g. limited liability company, corporation, or partnership). A joint venture established by contract that is not also established as a legal business entity is not eligible for an entity eligibility determination.
(2) The business entity operating as a joint venture must have been awarded a classified contract or sponsored by a GCA or prime contractor for an entity eligibility determination in advance of a potential award for which the business entity has bid pursuant to paragraph (c) of this section.
(3) The business entity operating as a joint venture must have an employee or employees appointed as security officials or KMP pursuant to § 117.7(b).
(l) Consultants. The responsible CSA will determine when there is a need for self-employed consultants requiring access to classified information to be considered for an entity eligibility determination.
(m) Limited entity eligibility determination (Non-FOCI). (1) The applicable CSA may choose to allow a GCA to request limited entity eligibility determinations for a single, narrowly defined contract, agreement, or circumstance and specific to the requesting GCA's classified information. This is not the same as a limited entity eligibility determination in situations involving FOCI, when the FOCI is not mitigated or negated.
(i) Limited entity eligibility determinations (or FCLs) involving FOCI will be processed in accordance with § 117.11(e).
(ii) This paragraph (paragraph (m) of this section) applies to limited entity eligibility determinations for purposes other than FOCI mitigation in accordance with 32 CFR part 2004. Additional guidance may be provided by the responsible CSA.
(2) An entity must be sponsored for a limited entity eligibility determination by a GCA in accordance with the sponsorship requirements contained in paragraph (c) of this section. The contractor should be aware that the sponsorship request from the GCA to the CSA must also include:
(i) Description of the compelling need for the limited entity eligibility determination that is in accordance with U.S. national security interests.
(ii) Specific reason(s) or rationale for limiting the entity eligibility determination.
(iii) The GCA's formal acknowledgement and acceptance of the risk associated with this rationale.
(3) The entity must otherwise meet the entity eligibility determination requirements set out in this rule.
(4) Access limitations are inherent with the limited entity eligibility determination and are imposed upon all of the entity's employees regardless of citizenship.
(5) Contractors should be aware that the CSA will document the requirements of each limited entity eligibility determination it makes, including the scope of, and any limitations on, access to classified information.
(6) Contractors should be aware that the CSA will verify limited entity eligibility determinations only to the requesting GCA. In the case of multiple limited entity eligibility determinations for a single entity, the CSA verifies each one separately only to its requestor.
(7) The applicable CSA administratively terminates the limited entity eligibility determination when there is no longer a need for access to the classified information for which the CSA approved the limited entity eligibility determination.
(n) Termination of the entity eligibility determination. Once granted, a favorable entity eligibility determination remains in effect until terminated or revoked. If the entity eligibility determination is terminated or revoked, the contractor will return all classified material in its possession to the appropriate GCA or dispose of the material as instructed by the CSA. The contractor should be aware that it may request an administrative termination or the CSA may:
(1) After coordination with applicable GCAs, administratively terminate the entity eligibility determination because the contractor no longer has a need for access to classified information.
(2) Revoke an entity eligibility determination if the contractor is unable or unwilling to protect classified information or is unable to comply with the security requirements of this rule.
(o) Invalidation of the entity eligibility determination. The CSA may invalidate an existing entity eligibility determination. While the entity eligibility determination is in an invalidated status, the contractor may not bid on or be awarded new classified contracts or solicitations. The contractor may continue to work on existing classified contracts if the GCA agrees.
(p) Records maintenance. Contractors will maintain the original CSA designated forms for the duration of the entity eligibility determination in accordance with CSA-provided guidance.
§ 117.10   Determination of eligibility for access to classified information for contractor employees.
(a) General. (1) The CSA is responsible for determining an employee's eligibility for access to classified information.
(i) The contractor must determine that access to classified information is essential in the performance of tasks or services related to the fulfillment of a classified contract.
(ii) Access must be clearly consistent with U.S. national security interests as determined by the CSA.
(iii) A contractor may give an employee access to classified information at the same or lower level of classification as the level of the contractor's entity eligibility determination if the employee has:
(A) A valid need-to-know for the classified information.
(B) A USG favorable eligibility determination for access to classified information at the appropriate level; and
(C) Signed a non-disclosure agreement.
(2) The CSA will determine eligibility for access to classified information in accordance with SEAD 4 (available at: https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf ) and notify the contractor when eligibility has been granted.
(i) The CSA will notify the contractor when an employee's eligibility has been denied, suspended, or revoked.
(ii) The contractor will immediately deny access to classified information to any employee when notified of a denial, revocation, or suspension of eligibility regardless of the contractor employee's location.
(iii) If the employee's performance is at a USG facility, the contractor will provide notification to the appropriate GCA of any denial, revocation, or suspension of eligibility for access to classified information.
(3) Contractors will annotate and maintain the accuracy of their employees' records in the system of record for contractor eligibility and access to classified information, when one has been designated by the CSA.
(4) Within an MFO or within the same business organization, contractors may centrally manage eligibility for access to classified information and access to classified information records.
(5) The contractor will limit requests for determinations of eligibility for access to classified information to the minimum number of employees and consultants necessary for operational efficiency in accordance with contractual obligations and other requirements of this rule. Requests for determinations of eligibility for access to classified information will not be used to establish a cache of cleared employees.
(6) The contractor will not submit a request for an eligibility determination to one CSA if the employee applicant is known to be cleared or in process for eligibility for access to classified information by another CSA. In such cases, reciprocity of eligibility determination in accordance with SEAD 7 (available at: https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-7_BI_ReciprocityU.pdf ) shall be used. The contractor will provide the new CSA with the full name, date, and place of birth, social security number, clearing agency, and type of investigation for verification.
(7) Contractors will not submit requests for determination of eligibility for access to classified information for individuals who are not their employees or consultants; nor will they submit requests for employees of subcontractors.
(8) Access to SCI, SAP, FRD, and RD information is a determination made by the granting authority by the applicable USG granting authority for each category of information.
(b) Investigative requirements. E.O. 13467, as amended, “Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information,” designates the Security and Suitability Executive Agents responsible for establishing the standards for investigative requirements that apply to contractors.
(1) Investigative tiers. The standards established in accordance with E.O. 13467, as amended, designate specific investigative tiers that are acceptable for access to classified information. An investigative tier is for positions designated as moderate risk, non-critical sensitive, and allow access to information classified at the L, CONFIDENTIAL, and SECRET levels. Another investigative tier is for positions designated as high risk, critical sensitive, special sensitive, and allow access to information classified at the Q, TOP SECRET, and SCI levels.
(2) Investigative coverage. (i) Automated sources. Investigative providers will use automation whenever possible to collect, verify, corroborate, or discover information about an individual, as documented on the request for investigation or developed from other sources, i.e., automated record checks and inquiries.
(ii) Interviews. Interviews, if required, will cover areas of adjudicative concern.
(iii) Information Covered in Previous Investigations. Information validated in a prior investigation, the results of which are not expected to change ( e.g., verification of education degree), will not be repeated as part of subsequent investigations.
(3) Polygraph. Agencies with policies authorizing the use of the polygraph for purposes of determining eligibility for access to classified information may require polygraph examinations when necessary. If adjudicatively relevant information arises during the investigation or the polygraph examination, the investigation may be expanded to resolve the adjudicative concerns.
(4) Financial disclosure. When a GCA requires that a contractor employee complete a financial disclosure form, the contractor will ensure that the employee has the opportunity to complete and submit the form in accordance with the Privacy Act of 1974, as amended, and other applicable provisions of law.
(5) Reinvestigation and Continuous Evaluation. Contractor employees determined eligible for access to classified information will follow CSA guidance to complete reinvestigation and continuous evaluation or continuous vetting requirements. The contractor will validate that the employee requires continued eligibility for access to classified information before initiating the reinvestigation.
(c) Verification of U.S. citizenship. A contractor will require each applicant for determination of eligibility for access to classified information who claims U.S. citizenship to provide evidence of citizenship to the FSO or other authorized representative of the contractor. All documentation must be the original or certified copies of the original documents.
(1) Any document, or its successor, listed in this paragraph is an acceptable document to corroborate U.S. citizenship by birth, including by birth abroad to a U.S. citizen.
(i) A birth certificate certified with the registrar's signature, which bears the raised, embossed, impressed, or multicolored seal of the registrar's office.
(ii) A current or expired U.S. passport or passport card that is unaltered and undamaged and was originally issued to the individual.
(iii) A Department of State Form FS-240, “Consular Report of Birth Abroad of a Citizen of the United States of America.”
(iv) A Department of State Form FS-545 or DS-1350, “Certification of Report of Birth.”
(2) Any document, or its successor, listed in this paragraph is an acceptable document to corroborate U.S. citizenship by certification, naturalization, or birth abroad to a U.S. citizen.
(i) A U.S. Citizenship and Immigration Services Form N-560 or N-561, “Certification of U.S. Citizenship.”
(ii) A U.S. Citizenship and Immigration Services Form 550, 551, or 570, “Naturalization Certificate.”
(iii) A valid or expired U.S. passport or passport card that is unaltered and undamaged and was originally issued to the individual.
(d) Procedures for completing the electronic version of the SF 86, “Questionnaire for National Security Positions.” The electronic version of the SF 86 (available at: https://www.opm.gov/forms/pdf_fill/sf86.pdf ) must be completed in e-QIP or its successor system by the contractor employee and reviewed by the FSO or other contractor employee(s) who has (have) been specifically designated by the contractor to review an employee's SF 86. The FSO or designee will:
(1) Provide the employee with written notification that review of the SF 86 by the FSO or other contractor employee is for adequacy and completeness and information will be used for no other purpose within the entity. The use and disclosure by the U.S. Government, and by U.S. Government contractors operating systems of records on behalf of a U.S. Government agency to accomplish an agency function, of the information provided by the employee on the SF-86 is governed by the Privacy Act of 1974, as amended, and by the routine uses published by the USG in the applicable System of Records Notice.
(2) Not share information from the employee's SF 86 within the entity and will not use the information for any purpose other than determining the adequacy and completeness of the SF 86.
(e) Fingerprint collection. The contractor will submit fingerprints in accordance with CSA guidance. Contractors will use digital fingerprints whenever possible.
(f) Pre-employment eligibility determination action. (1) If a potential employee requires access to classified information immediately upon commencement of employment, the contractor may submit a request for investigation prior to the date of employment, provided:
(i) A written commitment for employment has been made by the contractor.
(ii) The candidate has accepted the offer in writing.
(2) The commitment for employment must indicate employment will commence within 45 days of the employee being granted eligibility for access to classified information at a level that allows them to perform the tasks or services associated with the contract or USG requirement for which they were hired.
(3) Contractors will comply with the requirements pursuant to paragraph (a) (5) of this section.
(g) Classified information NDA. The NDA designated by the CSA ( e.g., SF 312), is an agreement between the USG and an individual who is determined eligible for access to classified information.
(1) An employee determined eligible for access to classified information must execute an NDA prior to being granted access to classified information.
(2) The employee must sign and date the NDA in the presence of a witness. The employee's and witness' signatures must bear the same date.
(3) The contractor will forward the executed NDA to the CSA for retention. The CSA may authorize the contractor to retain a copy of the form for administrative purposes, if appropriate.
(4) If the employee refuses to execute the NDA, the contractor will deny the employee access to classified information and submit a report to the CSA in accordance with § 117.8(c)(6).
(h) Reciprocity. The applicable CSA is responsible for determining whether contractor employees have been previously determined eligible for access to classified information or investigated by an authorized investigative activity in accordance with SEAD 7 (available at: https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-7_BI_ReciprocityU.pdf ).
(1) Any current eligibility determination for access to classified information that is based on an investigation of a scope that meets or exceeds that necessary for the required level of access will provide the basis for a new eligibility determination.
(2) The prior investigation will be used without further investigation or adjudication unless the CSA becomes aware of significant derogatory information that was not previously adjudicated.
(i) Break in access. There are circumstances when a contractor administratively terminates an employee's access to classified information solely because of no current requirement for such access. If the employee again requires access to classified information and has been in the contractor's continuous employment, and the employee again requires access to classified information, the contractor may provide access to classified information without further investigation, based on CSA guidance, so long as the employee remains eligible for access to classified information and has a current investigation of a scope that meets or exceeds that necessary for the access required and no new derogatory information is known. Any adverse information from or about the employee must continue to be reported while the employee maintains eligibility for access to classified information, even when access to classified information has been administratively terminated.
(j) Break in employment. (1) When an employee had a break in employment and now requires access to classified information, the contractor may provide access to classified information based on CSA guidance provided the employee remains eligible for access to classified information and has a current investigation of a scope that meets or exceeds that necessary for the access required.
(2) The contractor may not provide access to classified information to an employee who previously was eligible for access to classified information, but has had a break in employment that resulted in a loss of eligibility without a new eligibility determination by the CSA.
(k) Non-U.S. citizens. (1) Contractors must make every effort to ensure that non-U.S. citizens are not employed in duties that may require access to classified information. However, compelling reasons may exist to grant access to classified information to a non-U.S. citizen. The CSA may grant such individuals a LAA in those rare circumstances where a non-U.S. citizen possesses unique or unusual skills or expertise that is urgently needed to support a specific USG contract involving access to specified classified information, and a cleared or clearable U.S. citizen is not readily available. The CSA will provide specific procedures for requesting an LAA, to include the need for approval by a GCA senior official.
(2) An LAA granted under the provisions of this rule is not valid for access to:
(i) TOP SECRET information.
(ii) RD or FRD.
(iii) Information that has not been determined releasable by a USG designated disclosure authority to the country of which the individual is a citizen.
(iv) Communications security (COMSEC) information.
(v) Intelligence information.
(vi) NATO information. Foreign nationals of a NATO member nation may be authorized access to NATO information provided:
(A) The CSA obtains a NATO security clearance certificate from the individual's country of citizenship.
(B) NATO access is limited to performance on a specific NATO contract.
(vii) Information for which foreign disclosure has been prohibited in whole or in part.
(viii) Information provided to the USG in confidence by a third-party government.
(ix) Classified information furnished by a third-party government.
(l) Temporary eligibility for access to classified information. In accordance with SEAD 8 (available at: https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-8_Temporary_Eligibility_U.pdf ), the CSA may grant temporary (previously called interim) eligibility for access to classified information, as appropriate, to applicants for access to TOP SECRET, SECRET, and CONFIDENTIAL information. This eligibility may only be granted if there is no evidence of adverse information that calls into question an individual's eligibility for access to classified information. If results are favorable following completion of full investigative requirements, the CSA will update the temporary eligibility determination for access to classified information to be final. In any case, a temporary eligibility determination shall not exceed one year unless approved by the applicable CSA in the system of record. Non-U.S. citizens are not eligible for access to classified information on a temporary basis.
(1) A temporary SECRET or CONFIDENTIAL eligibility determination is valid for access to classified information at the level of the eligibility granted. Access to RD, COMSEC information, and NATO information requires a final SECRET eligibility determination.
(2) A temporary TOP SECRET eligibility determination is valid for access to TOP SECRET information. If an individual has a temporary TOP SECRET eligibility determination and has a final SECRET eligibility determination based on a previously completed investigation, the temporary TOP SECRET eligibility determination is valid for access to RD, NATO, and COMSEC information at the SECRET or CONFIDENTIAL level.
(3) Access to SCI and SAP information based on a temporary eligibility determination is a determination made by the granting authority.
(4) When a temporary eligibility determination has been made and derogatory information is subsequently developed, the CSA may withdraw the temporary eligibility pending completion of the processing that is a prerequisite to the final eligibility determination.
(5) When a temporary eligibility determination is withdrawn for an individual who is required to be eligible for access to classified information in connection with the entity eligibility determination for access to classified information, the contractor must remove the individual from access to classified information and any KMP position requiring PCL eligibility or the temporary entity eligibility determination will also be withdrawn.
(6) Withdrawal of a temporary eligibility determination is not a denial, termination, or revocation of eligibility under this rule and may not be appealed.
(m) Consultants. (1) A consultant will not access classified information off the premises of the using (hiring) contractor except in connection with authorized classified visits.
(2) A contractor may only assign a consultant outside the United States with responsibilities requiring access to classified information when:
(i) The consultant agreement between the contractor and consultant includes:
(A) Identification of the contract, license, or agreement that requires access to classified information, the level of classified information that is required, and access to FGI by the consultant while assigned outside the United States.
(B) A formal agreement that prohibits the consultant from disclosing any classified information related to the contract, license, or agreement as required in paragraph (m)(i)(A) of this section to any party other than the USG or foreign government with which the consultant is meeting, and who possesses the requisite clearance and need to know.
(ii) The consultant and the using contractor will jointly execute the consultant agreement setting forth respective security responsibilities. The contractor will retain an original signed copy of the agreement and will ensure its availability if requested by the CSA.
(iii) The contractor, in consultation with the applicable CSA as appropriate, will determine what threat briefing(s) the consultant should receive before the assignment, and conduct those briefings as part of the consultant's pre-assignment and recurring security training.
(iv) The contractor provides notice of any changes to the consultant agreement to the applicable CSA during assessments or upon CSA request.
(3) The using contractor will be the consumer of the consultant services as set forth in the consultant agreement.
(4) For security administration purposes, a consultant will be considered an employee of the using contractor for compliance with this rule.
(5) Consultants to GCAs are not under the purview of the NISP and will be processed for determination of eligibility by the GCA in accordance with GCA procedures.
§ 117.11   Foreign Ownership, Control, or Influence (FOCI).
(a) General. Foreign investment can play an important role in maintaining the vitality of the U.S. industrial base. Therefore, it is the intent of the USG to allow foreign investment consistent with the national security interests of the United States. The following FOCI procedures for cleared U.S. entities are intended to mitigate the risks associated with FOCI by ensuring that foreign firms cannot undermine U.S. security to gain unauthorized access to classified information.
(1) The CSA will consider a U.S. entity to be under FOCI when:
(i) A foreign interest has the power to direct or decide issues affecting the entity's management or operations in a manner that could either:
(A) Result in unauthorized access to classified information; or
(B) Adversely affect performance of a classified contract or agreement.
(ii) The foreign government is currently exercising, or could prospectively exercise, that power, whether directly or indirectly, such as:
(A) Through ownership of the U.S. entity's securities, by contractual arrangements, or other means, or;
(B) By the ability to control or influence the election or appointment of one or more members to the entity's governing board.
(2) When the CSA has determined that an entity is under FOCI, the primary consideration will be the protection of classified information. The CSA will take whatever action is necessary to protect classified information, in coordination with other affected agencies as appropriate.
(3) A U.S. entity that is in process for an entity eligibility determination for access to classified information and subsequently determined to be under FOCI is ineligible for access to classified information unless and until effective security measures have been put in place to negate or mitigate FOCI to the satisfaction of the CSA.
(4) When a contractor determined to be under FOCI is negotiating an acceptable FOCI mitigation or negation measure in good faith, an existing entity eligibility determination may continue in effect so long as there is no indication that classified information is at risk of compromise in consultation with the applicable GCA. The applicable CSA may decide that circumstances involving the FOCI are such that the entity eligibility determination will be invalidated until implementation of an acceptable FOCI mitigation plan.
(5) An existing entity eligibility determination will be invalidated if the contractor is unable or unwilling to negotiate and implement an acceptable FOCI mitigation or negation measure. An existing entity eligibility determination will be revoked if security measures cannot be taken to remove the possibility of unauthorized access to classified information or adverse effect on performance of classified contracts.
(6) Changed conditions, such as a change in ownership, indebtedness, or a foreign intelligence threat, may justify certain adjustments to the security terms under which an entity is operating or, alternatively, that a different FOCI mitigation or negation method be employed. If a changed condition is of sufficient significance, it might also result in a determination that a contractor is no longer considered to be under FOCI, or, conversely, that a contractor is no longer eligible for access to classified information.
(7) The USG reserves the right, and has the obligation, to impose any security method, safeguard, or restriction (including denial, termination or revocation of an entity eligibility determination) it believes necessary to ensure that unauthorized access to classified information is effectively precluded and performance of classified contracts is not adversely affected.
(8) Nothing contained in this section affects the authority of a Federal agency head to limit, deny, or revoke access to classified information under its statutory, regulatory, or contract jurisdiction.
(b) Factors. Factors relating to the entity, relevant foreign interests, and the government of such foreign interests, as appropriate, will be considered in the aggregate to determine whether an applicant entity is under FOCI, its eligibility for access to classified information, and the protective measures required. These factors include:
(1) Record of espionage against U.S. targets, either economic or government.
(2) Record of enforcement actions against the entity for transferring technology without authorization.
(3) Record of compliance with pertinent U.S. laws, regulations, and contracts or agreements.
(4) Type and sensitivity of the information the entity would access.
(5) Source, nature, and extent of FOCI, including whether foreign interests hold a majority or minority position in the entity, taking into consideration the immediate, intermediate, and ultimate parent entities.
(6) Nature of any relevant bilateral and multilateral security and information exchange agreements.
(7) Ownership or control, directly or indirectly, in whole or in part, by a foreign government.
(8) Any other factor that indicates or demonstrates capability of foreign interests to control or influence the entity's operations or management.
(c) Procedures. An entity is required to complete an SF 328 during the process for an entity eligibility determination or when significant changes occur to information previously submitted. In the case of a corporate family, the form may be a consolidated response rather than separate submissions from individual members of the corporate family based on CSA guidance.
(1) If an entity provides any affirmative answers on the SF 328, or the CSA receives other information which indicates that the applicant entity may be under FOCI, the CSA will make a risk-based determination regarding the relative significance of the information in regard to:
(i) Whether the applicant is under FOCI.
(ii) The extent and manner to which the FOCI represents a risk to the national security or may adversely impact classified contract performance.
(iii) The type of actions, if any, that would be necessary to mitigate or negate the effects of FOCI to a level deemed acceptable to the USG. The CSA will advise entities on the CSA's appeal channels for disputing CSA FOCI determinations.
(2) When an entity with a favorable eligibility determination enters into negotiations for the proposed merger, acquisition, or takeover by a foreign interest, the entity will submit notification to the CSA of the commencement of such negotiations.
(i) The submission will include the type of transaction under negotiation ( e.g., stock purchase, asset purchase), the identity of the potential foreign interest investor, and a plan to negate or mitigate the FOCI by a method outlined in paragraph (d) of this section.
(ii) The entity will submit copies of loan, purchase, and shareholder agreements, annual reports, bylaws, articles of incorporation, partnership agreements, other organizational documents, and reports filed with other Federal agencies to the CSA.
(d) FOCI action plans. (1) When FOCI factors not related to ownership are present, the CSA will determine if positive measures will assure the CSA that the foreign interest can be effectively mitigated and cannot otherwise adversely affect performance on classified contracts. Examples of such measures include:
(i) Modification or termination of loan agreements, contracts, and other understandings with foreign interests.
(ii) Diversification or reduction of foreign-source income.
(iii) Demonstration of financial viability independent of foreign interests.
(iv) Elimination or resolution of problem debt.
(v) Assignment of specific oversight duties and responsibilities to board members.
(vi) Formulation of special executive-level security committees to consider and oversee issues that affect the performance of classified contracts.
(vii) Physical or organizational separation of the contractor component performing on classified contracts.
(viii) Adoption of special board resolutions.
(ix) Other actions that negate or mitigate foreign control or influence.
(x) A combination of these methods, as determined by the CSA.
(2) When FOCI factors related to ownership are present, methods the CSA may apply to negate or mitigate the risk of foreign ownership include, but are not limited to:
(i) Board resolution. (A) When a foreign interest does not possess voting interests sufficient to elect, or otherwise is not entitled to representation on the entity's governing board, a resolution(s) by the governing board may be adequate. In the resolution, the governing board will:
( 1 ) Identify the foreign shareholder.
( 2 ) Describe the type and number of foreign-owned shares.
( 3 ) Acknowledge the entity's obligation to comply with all industrial security program requirements.
( 4 ) Certify that the foreign owner does not require, will not have, and can be effectively precluded from unauthorized access to all classified information entrusted to or held by the entity.
(B) The governing board will provide for annual certifications to the CSA acknowledging the continued effectiveness of the resolution.
(C) The entity will distribute to members of its governing board and to its KMP copies of such resolutions, and report in the entity's corporate records the completion of such distribution.
(ii) Security control agreement (SCA). When a foreign interest does not effectively own or control an entity ( i.e., the entity is under U.S. control), but the foreign interest is entitled to representation on the entity's governing board, an SCA may be adequate. At least one cleared U.S. citizen must serve as an outside director on the entity's governing board. There are no access limitations under an SCA.
(iii) SSA. When a foreign interest effectively owns or controls an entity, an SSA may be adequate. An SSA is an arrangement that, based upon an assessment of the source and nature of FOCI and FOCI factors, imposes various industrial security measures within an institutionalized set of entity practices and procedures. The SSA preserves the foreign owner's right to be represented on the entity's board or governing body with a direct voice in the entity's business management, while denying the foreign owner majority representation and unauthorized access to classified information.
(A) Requirement for a National Interest Determination (NID). Unless otherwise prohibited by law or regulation ( e.g., Section 842 of Pub. L. 115-232), the applicable CSA must determine whether allowing an entity access to proscribed information under an SSA is consistent with national security interests of the U.S. with concurrence from controlling agencies, as applicable. Such NIDs will be made as part of an entity eligibility determination or because of a changed condition when a GCA requires an entity to have access to proscribed information and the CSA proposes an SSA as the mitigation measure. The NID can be program, project, or contract specific.
(B) NID process: ( 1 ) The CSA makes a NID for TOP SECRET or SAP information to which the entity requires access. Contractors should be aware that DOE Order 470.4B provides additional information and requirements for processing NID requests for access to RD.
( 2 ) In cases in which any category of the proscribed information is controlled by another agency (ODNI for SCI, DOE for RD, the National Security Agency (NSA) for COMSEC), the CSA asks that controlling agency to concur or non-concur on the NID for that category of information.
( 3 ) The CSA informs the GCA and the entity when the NID is complete. In cases involving SCI, RD, or COMSEC, the CSA also informs the GCA and the entity when a controlling agency concurs or non-concurs on that agency's category of proscribed information. The entity may begin accessing a category of proscribed information once the CSA informs the GCA and the entity that the controlling agency concurs, even if other categories of proscribed information are pending concurrence.
( 4 ) An entity's access to SCI, RD, or COMSEC remains in effect so long as the entity remains eligible for access to classified information and the contract or agreement (or program or project) which imposes the requirement for access to those categories of proscribed information remains in effect, except under any of the following circumstances:
( i ) The CSA, GCA, or controlling agency becomes aware of adverse information that impacts the entity eligibility determination.
( ii ) The CSA's threat assessment pertaining to the entity indicates a risk to one of the categories of proscribed information.
( iii ) The CSA becomes aware of any material change regarding the source, nature, and extent of FOCI.
( iv ) The entity's record of NISP compliance, based on CSA reviews, becomes less than satisfactory. Consult DOE Order 470.4B for additional information and requirements for processing NID requests for access to RD.
( 5 ) Under any of the circumstances in paragraphs (d)(2)(iii)(B)( 4 )( i ) through (d)(2)(iii)(B)( 4 )( iv ) in this section, the CSA determines whether the entity remains eligible for access to classified information, it must change the FOCI mitigation measure in order to remain eligible for access to classified information, or the CSA must terminate or revoke the access to classified information.
( 6 ) When an entity is eligible for access to classified information that includes a favorable NID for SCI, RD, or COMSEC, the CSA does not have to request a new NID concurrence for the same entity if the access to classified information requirements for the relevant category of proscribed information and terms remain unchanged for:
( i ) Renewing the contract or agreement.
( ii ) New task orders issued under the contract or agreement.
( iii ) A new contract or agreement that contains the same provisions as the previous one (this usually applies when the contract or agreement is for a program or project.)
( iv ) Renewing the SSA.
( 7 ) Under certain conditions, entities under an SSA may not require a NID for one or more categories of proscribed information in accordance with CSA-provided guidance. Categories of proscribed information for entities under SSAs not requiring a NID will be recorded in the CSA's system of record for entity eligibility determinations.
(iv) Voting Trust (VT) or Proxy Agreement (PA). The VT and the PA are arrangements that vest the voting rights of the foreign-owned stock in cleared U.S. citizens approved by the USG. Under a VT, the foreign owner transfers legal title its ownership interests in the entity to the trustees. Under a PA, the foreign owner's voting rights are conveyed to the proxy holders. Neither arrangement imposes any restrictions on the entity's eligibility to have access to classified information or to compete for classified contracts.
(A) Establishment of a VT or PA involves the selection of trustees or proxy holders, all of whom must become members of the entity's governing board. Both arrangements must provide for the exercise of all prerogatives of ownership by the trustees or proxy holders with complete freedom to act independently from the foreign owners, except as provided in the VT or PA. The arrangements may limit the authority of the trustees or proxy holders by requiring approval be obtained from the foreign owner with respect to issues such as:
( 1 ) The sale or disposal of the entity's assets or a substantial part thereof.
( 2 ) Pledges, mortgages, or other encumbrances on the entity's assets, capital stock, or ownership interests.
( 3 ) Mergers, consolidations, or reorganizations.
( 4 ) Dissolution.
( 5 ) Filing of a bankruptcy petition.
(B) The trustees or proxy holders may consult with the foreign owner, or vice versa, where otherwise consistent with U.S. laws, regulations, and the terms of the VT or PA.
(C) The trustees or proxy holders assume full responsibility for the foreign owner's voting interests and for exercising all governance and management prerogatives relating thereto to ensure the foreign owner will be insulated from the entity, thereby solely retaining the status of a beneficiary. The entity must be organized, structured, and financed to be capable of operating as a viable business entity and independent from the foreign owners' interests that required FOCI mitigation or negation.
(v) Combination measures. The CSA may apply combinations of the measures in paragraphs (d)(2)(i) through (d)(2)(iv) in this section or other similar measures that effectively mitigate or negate the risks involved with foreign ownership.
(e) Limited entity eligibility determination due to FOCI. In accordance with the provisions of this section and CSA-provided guidance, a limited entity eligibility determination may be an option for a single, narrowly defined contract, agreement, or circumstance for entities under FOCI without mitigation or negation. Limitations on access to classified information are inherent with the granting of limited entity eligibility determinations and are imposed upon all of the entity's employees regardless of citizenship.
(1) In exceptional circumstances, when an entity is under FOCI, the CSA may decide that a limited entity eligibility determination is appropriate when the entity is unable or unwilling to implement FOCI mitigation or negation measures, and the conditions in paragraphs (e)(1)(i) through (iii) of this section are met. This is not the same as a limited entity eligibility determination for purposes not related to FOCI. Information on limited entity eligibility determinations for purposes other than FOCI can be found in § 117.9(m). A CSA may decide that a limited entity eligibility is appropriate for an entity under FOCI if:
(i) The limited entity eligibility determination is in accordance with national security interests and a GCA has informed the CSA that access to classified information by the contractor is essential to contract or agreement performance.
(ii) There is an industrial security agreement with the foreign government of the country from which the FOCI is derived.
(iii) The contractor meets all other entity eligibility requirements outlined in § 117.9(c) except that KMP, other than the FSO, may be citizens of the country from which the FOCI derives and the United States has obtained security assurances at the appropriate level from that country.
(2) A U.S. subsidiary of a foreign entity may be sponsored for a limited entity eligibility determination by a foreign government when the foreign government desires to award a contract or agreement to the U.S. subsidiary that involves access to only that classified information for which the foreign government is the OCA.
(3) Limited entity eligibility determinations are specific to the classified information for the requesting GCA or foreign government and the single narrowly defined contract, agreement, or circumstance the request was based on. The limited entity eligibility determination will only be verified to that GCA or foreign government for the authorized level of access to classified information and any limitations to that access to classified information.
(4) A limited entity eligibility determination is not an option for contractors that require access to proscribed information when a foreign government has ownership or control over the entity.
(5) Release of classified information must be in conformity with the U.S. National Disclosure Policy-1 (provided to designated disclosure authorities on a need-to-know basis from the Office of the Under Secretary of Defense for Policy, Defense Technology Security Administration).
(6) A limited entity eligibility determination will be administratively terminated when there is no longer a need for the contractor to access the classified information for which it was sponsored. Administrative termination of one limited entity eligibility determination does not impact a contractor's other limited entity eligibility determinations.
(7) If there is no industrial security agreement with the foreign government of the country from which the FOCI is derived, in extraordinary circumstances, a limited entity eligibility determination may also be granted if there is a compelling need to do so consistent with U.S. national security interests and the GCA has informed the applicable CSA that access to classified information by the contractor is essential to contract or agreement performance. Under this circumstance, the entity must follow all provisions of this rule.
(f) Qualifications of trustees, proxy holders, and outside directors. Individuals who serve as trustees, proxy holders, or outside directors must meet the following criteria:
(1) Trustees and proxy holders must be resident U.S. citizens who can exercise governance and management prerogatives relating to their position in a way that ensures that the foreign owner can be effectively insulated from the entity.
(2) Outside directors must be resident U.S. citizens who can exercise governance and management prerogatives relating to their position in a way that ensures that the foreign owner can be effectively separated from the entity's classified work.
(3) New trustees, proxy holders, and outside directors must be completely disinterested individuals with no prior involvement with the entity, the entities with which it is affiliated, or the foreign owner.
(4) The CSA may consider other circumstances that may affect an individual's eligibility to serve effectively including the number of boards on which the individual serves, the length of time serving on any other governance boards, and other factors in accordance with CSA-provided guidance.
(5) Trustees, proxy holders, and outside directors must be determined eligible for access to classified information at the level of the entity eligibility determination for access to classified information. Individuals who are serving as trustees, proxy holders, or outside directors as part of a mitigation measure for the entity are not considered to have prior involvement solely by performing that role for purposes of paragraph (f)(3) of this section.
(g) Government security committee (GSC). Under a VT, PA, SSA, or SCA, the contractor is required to establish a permanent committee of its board of directors, known as the GSC.
(1) Unless otherwise approved by the CSA, the GSC consists of trustees, proxy holders, or outside directors and those officer directors who have been determined to be eligible for access to classified information.
(2) The members of the GSC are required to ensure that the contractor adheres to laws and regulations and maintains internal entity policies and procedures to safeguard classified information entrusted to it. The GSC ensures that violations of those policies and procedures are promptly investigated and reported to the appropriate authority when it has been determined that a violation has occurred.
(3) The contractor's FSO will be the principal advisor to the GSC and attend GSC meetings. The chairman of the GSC must concur with the appointment and replacement of FSOs selected by management. The FSO functions will be carried out under the authority of the GSC.
(h) Additional procedures for FOCI mitigation or negation measures. In addition to the basic requirements of the FOCI mitigation or negation agreement, the entity may be required to document and implement additional procedures based upon the circumstances of an entity's operations. Those additional procedures will be established in supplements to the FOCI mitigation agreement to allow for flexibility as circumstances change without having to renegotiate the entire agreement. When making use of supplements, the CSA does not consider the FOCI mitigation measure final until the CSA has approved the required supplements. These supplements may include:
(1) Technology control plan (TCP). A TCP approved by the CSA will be developed and implemented by those entities cleared under a VT, PA, SSA and SCA and when otherwise deemed appropriate by the CSA. The TCP will prescribe all security measures determined necessary to reasonably prevent the possibility of access by non-U.S. citizen employees and visitors to information for which they are not authorized. The TCP will also prescribe measures designed to assure that access by non-U.S. citizens is strictly limited to only that specific information for which appropriate USG disclosure authorization has been obtained, e.g., an approved export license or technical assistance agreement. Unique badging, escort, segregated work area, security indoctrination schemes, and other measures will be included, as appropriate.
(2) Electronic communications plan (ECP). The contractor will develop and implement an ECP, subject to CSA approval, tailored to the contractor's operations to verify that electronic controls are in place for clear technical and logical separation of electronic communications and networks between the contractor, the foreign interest, and its affiliates. The purpose is to prevent the unauthorized disclosure of classified information to the foreign parent or its affiliates. The contractor will include in the ECP a detailed network description and configuration diagram that clearly delineates which networks will be shared and which will be protected from access by the foreign parent or its affiliates. The network description will address firewalls, remote administration, monitoring, maintenance, and separate email servers, as appropriate.
(3) Affiliated operations plan. There may be circumstances when the parties to a transaction propose in the FOCI action plan that the U.S. contractor provides certain services for the foreign interest or enters into arrangements with the foreign interest, or the foreign interest provides services for or enters into arrangements with the U.S. contractor. In such circumstances, the contractor will document a plan, subject to CSA approval, outlining the entity's consolidated policies and procedures regarding the control of affiliated operations, regardless of whether such endeavors are administrative, operational, or commercial, performed directly or through third-party service providers, within the entity, or among any of the entity's controlled entities, or the foreign interest and its affiliates.
(4) Facilities location plan. When a contractor is potentially collocated with or in close proximity to its foreign parent or an affiliate, the contractor will prepare a facilities location plan to assist the CSA in determining if the contractor is collocated or if the close proximity can be allowed under the FOCI mitigation plan. A U.S. entity generally cannot be collocated with the foreign parent or affiliate, i.e., at the same address or in the same location.
(i) Annual review and certification —(1) Annual review. The CSA will meet at least annually, and otherwise as required by circumstances, with the GSCs of contractors operating under a VT, PA, SSA, or SCA to review the purpose and effectiveness of the clearance arrangement and to establish a common understanding of the operating requirements and their implementation. These reviews will include an examination of:
(i) Acts of compliance or noncompliance with the approved security arrangement, standard rules, and applicable laws and regulations.
(ii) Problems or impediments associated with the practical application or utility of the security arrangement.
(iii) Whether security controls, practices, or procedures warrant adjustment.
(2) Annual certification. For contractors operating under a VT, PA, SSA, or SCA, the chairman of the GSC will submit to the CSA one year from the effective date of the agreement and annually thereafter, an implementation and compliance report. Such reports will include:
(i) A detailed description of the manner in which the contractor is carrying out its obligations under the agreement.
(ii) Changes to security procedures, implemented or proposed, and the reasons for those changes.
(iii) A detailed description of any acts of noncompliance, whether inadvertent or intentional, with a discussion of remedial measures, including steps taken to prevent such acts from recurring.
(iv) Any changes, or impending changes, of KMP or key board members, including the reasons therefore.
(v) Any changes or impending changes in the organizational structure or ownership, including any reorganizations, acquisitions, mergers, or divestitures.
(vi) Any other issues that could have a bearing on the effectiveness of the applicable agreement.
(j) Transactions involving foreign persons, and the Committee on Foreign Investment in the United States (CFIUS).
(1) The CFIUS is a USG interagency committee chaired by the Treasury Department that conducts assessments, reviews and investigations of transactions that could result in foreign control of a U.S. business, and certain non-controlling investments and certain real estate transactions involving foreign persons under 50 U.S.C. 4565.
(2) In CFIUS cases where the acquired U.S. business requires access to classified information, the CFIUS assessment, review or investigation, as applicable, and the CSA industrial security FOCI review are carried out in parallel, but are separate processes with different time constraints and considerations.
(3) The CSA will promptly advise the parties in a transaction under CFIUS review that would require FOCI negation or mitigation measures if consummated, to submit to the CSA a plan to negate or mitigate FOCI. If it appears that an agreement cannot be reached on material terms of a FOCI action plan, or if the U.S. person that is a party, or in applicable cases, a subject of the proposed transaction fails to comply with the FOCI reporting requirements of this rule, the CSA may recommend a full investigation of the transaction by the CFIUS to determine the effects on national security.
§ 117.12   Security training and briefings.
(a) General. Contractors will provide all cleared employees with security training and briefings commensurate with their involvement with classified information.
(b) Training materials. Contractors may obtain security, threat awareness, and other education and training information and material from their CSA or other sources.
(c) Government provided briefings. The CSA is responsible for providing initial security briefings to the FSO and for ensuring other briefings required for special categories of information are provided to the FSO.
(d) FSO training. Contractors will ensure the FSO and others performing security duties complete training considered appropriate by the CSA. Training requirements will be based on the contractor's involvement with classified information. Training may include an FSO orientation course, and for FSOs at contractor locations with a classified information safeguarding capability, an FSO program management course. Contractor FSOs will complete training within six months of appointment to the position of FSO. When determined by the applicable CSA, contractor FSOs must complete an FSO program management course within six months of the CSA approval to store classified information at the contractor.
(e) Initial security briefings. Prior to being granted access to classified information, contractors will provide employees with an initial security briefing that includes:
(1) Threat awareness, including insider threat awareness in accordance with paragraph (g) in this section.
(2) Counterintelligence (CI) awareness.
(3) Overview of the information security classification system.
(4) Reporting obligations and requirements, including insider threat.
(5) Cybersecurity training for all authorized information system users in accordance with CSA-provided guidance pursuant to § 117.18(a)(1) and (a)(2).
(6) Security procedures and duties applicable to the employee's position requirements ( e.g. marking and safeguarding of classified information) and criminal, civil, or administrative consequences that may result from the unauthorized disclosure of classified information, even though the individual has not yet signed an NDA.
(f) CUI training. While outside the requirements of the NISPOM, when a classified contract includes provisions for CUI training, contractors will comply with those contract requirements.
(g) Insider threat training. The designated ITPSO will ensure that contractor program personnel assigned insider threat program responsibilities and all other cleared employees complete training consistent with applicable CSA provided guidance.
(1) The contractor will provide training to insider threat program personnel, including the contractor's designated ITPSO, on:
(i) CI and security fundamentals.
(ii) Procedures for conducting insider threat response actions.
(iii) Applicable laws and regulations regarding the gathering, integration, retention, safeguarding, and use of records and data, including the consequences of misuse of such information.
(iv) Applicable legal, civil liberties, and privacy policies and requirements applicable to insider threat programs.
(2) The contractor will provide insider threat awareness training to all cleared employees on an annual basis. Depending upon CSA specific guidance, a CSA may instead conduct such training. The contractor must provide all newly cleared employees with insider threat awareness training before granting access to classified information. Training will address current and potential threats in the work and personal environment and will include at a minimum:
(i) The importance of detecting potential insider threats by cleared employees and reporting suspected activity to the insider threat program designee.
(ii) Methodologies of adversaries to recruit trusted insiders and collect classified information, in particular within information systems.
(iii) Indicators of insider threat behavior and procedures to report such behavior.
(iv) CI and security reporting requirements, as applicable.
(3) The contractor will establish procedures to validate all cleared employees who have completed the initial and annual insider threat training.
(h) Derivative classification —(1) Initial training. The contractor will ensure all employees authorized to make derivative classification decisions are trained in the proper application of the derivative classification principles, in accordance with CSA direction. Employees are not authorized to conduct derivative classification until they receive such training.
(2) Refresher training. In addition to the initial training, contractors will ensure all employees who conduct derivative classification receive training at least once every two years. Contractors will suspend an employee's derivative classification authority for any employee who does not receive such training at least once every two years. Training will emphasize the avoidance of over-classification and address:
(i) Classification levels.
(ii) Duration of classification.
(iii) Identification and markings.
(iv) Classification prohibitions and limitations.
(v) Sanctions and classification challenges.
(vi) Security classification guides.
(vii) Information sharing.
(3) Record of training. Contractors will retain records of the date of the most recent training (initial or refresher) and type of training provided to employees.
(i) Information systems security. All information system authorized users will receive training on the security risks associated with their user activities and responsibilities under the NISP. The contractor will determine the appropriate content of the training, taking into consideration assigned roles and responsibilities, specific security requirements, and the information system to which personnel are authorized access.
(j) Temporary help suppliers. A cleared temporary help supplier, or other contractor who employs cleared individuals solely for dispatch elsewhere, will be responsible for ensuring that required briefings (both initial and refresher training) are provided to their cleared personnel. The temporary help supplier or the using contractor may conduct these briefings.
(k) Refresher training. The contractor will provide all cleared employees with security education and training every 12 months. Refresher training will reinforce the information provided during the initial security briefing and will keep cleared employees informed of changes in security regulations and should also address issues or concerns identified during contractor self-reviews. Training methods may include group briefings, interactive videos, dissemination of instructional materials, or other media and methods. Contractors will maintain records about the programs offered and employee participation in them.
(l) Debriefings. Contractors will debrief cleared employees and annotate the debriefing in the appropriate contractor records when access to classified information is no longer needed; at the time of termination of employment (discharge, resignation, or retirement); when an employee's eligibility for access to classified information is terminated, suspended, or revoked; and upon termination of the entity eligibility determination.
§ 117.13   Classification.
(a) Original classification. Only a USG official designated or delegated the authority in writing can make an original classification decision.
(1) An OCA classifies information pursuant to E.O. 13526 and 32 CFR part 2001, designates and marks it as TOP SECRET, SECRET, or CONFIDENTIAL, and, except as provided by statute, may use no other terms to identify classified information.
(2) The designation UNCLASSIFIED is used to identify information that does not meet the criteria for classification in accordance with E.O. 13526. In accordance with 32 CFR 2002, CUI implementing guidance (including the Marking Handbook) and any GCA-provided guidance, CUI commingled with classified information must be marked as CUI to alert users to its presence and sensitivity. The CUI regulation, guidance, and handbook are available at: https://www.archives.gov/cui.
(b) Derivative classification. (1) Contractor personnel make derivative classification decisions when they incorporate, paraphrase, restate, or generate in new form, information that is already classified. They must mark the newly developed material consistently with the classification markings that apply to the source information.
(2) Derivative classification is the classification of information based on guidance from an OCA, which may be either a properly marked source document or a current security classification guide provided by a GCA in accordance with E.O. 13526. The duplication or reproduction of existing classified information is not derivative classification.
(3) A source document that does not contain portion markings, due to an ISOO-approved waiver, must contain a warning statement that it may not be used as a source for derivative classification in accordance with 32 CFR 2001.24(k)(4).
(4) Classified information in email messages is marked pursuant to E.O. 13526 and 32 CFR part 2001. If an email is transmitted on a classified system, includes a classified attachment, and contains no classified information within the body of the email itself, the email serves as a transmittal document and is not a derivatively classified document. The email's overall classification must reflect the highest classification level present in the attachment.
(c) Derivative classification responsibilities. Contractors will provide employees with pertinent classification guidance to fulfill their derivative classification responsibilities. All contractor employees authorized to make derivative classification decisions will:
(1) Mark the face of each derivatively classified document with a classification authority block that includes the employee's name and position or personal identifier, the entity name, and when applicable, the division or the branch.
Figure 1 to Paragraph ( c )(1) Example of Industry Classification Authority Block
UNCLASSIFIED: CLASSIFICATION MARKINGS FOR ILLUSTRATION PURPOSES ONLY
(2) Observe and respect original classification decisions.
(3) Carry forward the pertinent classification markings to any newly created documents. For information derivatively classified based on multiple sources, the derivative classifier will carry forward:
(i) The date or event for declassification that corresponds to the longest period of classification among the sources.
(ii) A listing of the source materials.
(4) Be trained, in accordance with § 117.12(h), in the proper application of the derivative classification principles at least once every two years.
(5) Whenever possible, use a classified addendum if classified information constitutes a small portion of an otherwise unclassified document.
(d) Security classification guidance. (1) Contractors should be aware the GCA will:
(i) Incorporate appropriate security requirement clauses in a classified contract, IFB, RFP, RFQ, or all solicitations leading to a classified contract.
(ii) Provide the contractor with the security classification guidance needed during performance of the contract.
(iii) Provide this guidance to the contractor in the contract security classification specification, or equivalent.
(2) The contract security classification specification, or equivalent, must identify the specific elements of classified information involved in the contract that require security protection.
(3) At the discretion of the CSA, contractors may, to the extent possible, advise and assist in the development and any updates to or any revisions to the contract security classification specification, or equivalent.
(4) The contractor will comply with all aspects of the classification guidance.
(i) Users of classification guides are encouraged to notify the originator of the guide when they acquire information that suggests the need for change in the instructions contained in the guide.
(ii) Classification guidance is the exclusive responsibility of the GCA, and the final determination of the appropriate classification for the information rests with that activity. The contract security classification specification, or equivalent, is a contractual specification necessary for the performance of a classified contract. Challenges to classification status are in paragraph (e) in this section.
(iii) If the contractor receives a classified contract without a contract security classification specification, or equivalent, the contractor will notify the GCA. If the GCA does not respond with the appropriate contract security classification specification, or equivalent, the contractor will notify the CSA.
(5) Upon completion of a classified contract, the contractor must return all USG provided or deliverable information to the custody of the USG.
(i) If the GCA does not advise to the contrary, the contractor may retain copies of the USG material for a period of two years following the completion of the contract. The contract security classification specification, or equivalent, will continue in effect for this two-year period.
(ii) If the GCA determines the contractor has a continuing need for the copies of the USG material beyond the two-year period, the GCA will issue a final contract security classification specification, or equivalent, for the classified contract and will include disposition instructions for the copies.
(e) Challenges to classification status. (1) The contractor will address challenges to classification status with the GCA and request remedy when:
(i) Information is classified improperly or unnecessarily.
(ii) Current security considerations justify downgrading to a lower classification level or upgrading to a higher classification level.
(iii) Security classification guidance is not provided, improper or inadequate.
(2) If the GCA does not provide a remedy, and the contractor still believes that corrective action is required, the contractor will make a formal written challenge to the GCA. The challenge will include:
(i) A description sufficient to identify the issue.
(ii) The reasons why the contractor thinks that corrective action is required.
(iii) Recommendations for appropriate corrective action.
(3) The contractor will safeguard the information as required for its assigned or proposed level of classification, whichever is higher, until action is completed.
(4) If the contractor does not receive a written answer from the GCA within 60 days, the contractor will request assistance from the CSA. If the contractor does not receive a response from the GCA within 120 days, the contractor may appeal the challenge to the Interagency Security Classification Appeals Panel through ISOO.
(5) The fact that a contractor has initiated such a challenge will not, in any way, serve as a basis for adverse action against the contractor by the USG. If a contractor believes that adverse action did result from a classification challenge, the contractor will promptly furnish full details to ISOO for resolution.
(f) Contractor developed information. Whenever a contractor develops an unsolicited proposal or originates information not in the performance of a classified contract, the provisions of this paragraph apply.
(1) If the information was previously identified as classified, it will be classified according to an appropriate classification guide, or source document, and appropriately marked.
(2) If the information was not previously classified, but the contractor believes the information may or should be classified, the contractor will:
(i) Protect the information as though classified at the appropriate level.
(ii) Submit the information to the agency that has an interest for a classification determination. In such cases, clearly mark the material “CLASSIFICATION DETERMINATION PENDING; Protect as either TOP SECRET, SECRET, or CONFIDENTIAL.” This marking will appear conspicuously at least once on the material but no further markings are necessary until a classification determination is received.
(iii) Not be precluded from marking such material as entity-private or entity-proprietary information, unless the material was based upon information obtained from prior deliverables to the USG or was developed from USG material.
(iv) Protect the information pending a final classification determination. The information may be CUI, if it is not classified. Only information that is owned by, produced by, produced for, or is under the control of the USG can be classified in accordance with E.O. 13526.
(3) To be eligible for classification:
(i) The information must incorporate classified information to which the contractor was given prior access.
(ii) The information must be partially or wholly owned by, produced by or for, or under the control of the USG.
(4) 10 CFR 1045.21 includes provisions for the DOE with regard to privately generated RD, whereby the DOE may classify such information in accordance with the AEA.
(g) Improperly released classified information appearing in public media. Improperly released classified information is not automatically declassified. When classified information has been improperly released, and even when that classified information has become publicly available, contractors will:
(1) Continue to protect the information at the appropriate classification level until formally advised to the contrary by the GCA.
(2) Bring any questions about the propriety of continued classification in these cases to the immediate attention of the GCA.
(3) Notify the applicable CSA if an employee downloads the improperly released classified information to determine how to resolve a data spill.
(h) Downgrading or declassifying classified information. Information is downgraded or declassified based on the loss of sensitivity of the information due to the passage of time or on occurrence of a specific event. Downgrading or declassifying actions constitute implementation of a directed action based on a review by either the OCA or the USG-designated classification authority. Declassification is not an approval for public disclosure.
(1) Downgrading. Contractors will refer information for classification or downgrade to the GCA based on the guidance provided in a contract security classification specification, or equivalent, or upon formal notification.
(2) Declassification. Contractors are not authorized to implement downgrading or declassification instructions even when the material is marked for automatic downgrading or declassification. If the material is marked for automatic declassification and the contractor notes that the date or event for the automatic declassification has occurred, the contractor will seek guidance from the GCA.
(i) RD, FRD, and TFNI. Protection requirements for RD, FRD, and TFNI are pursuant to § 117.23(e). Information about classification and declassification of RD, FRD, or TFNI documents is in § 117.23(e)(5).
§ 117.14   Marking requirements.
(a) Purpose for marking. (1) Physically marking classified information with appropriate classification markings serves to warn and inform holders of the information of the degree of protection required. Other notations facilitate downgrading and declassification, and aid in derivative classification actions.
(2) Contractors will clearly mark all classified information and material to convey to the holder the level of classification assigned, the portions that contain or reveal classified information, the period of time protection is required, the identity (by name and position or personal identifier) of the classifier, the source(s) for derivative classification, and any other notations required for protection of the information.
(b) Marking guidance for classified information and material. Contractors will use the marking guidance conveyed in 32 CFR 2001.22 through 2001.26, and its companion document, ISOO booklet “Marking Classified National Security Information,” (available at: https://www.archives.gov/isoo/training/training-aids ) or CSA specific provided guidance for marking derivatively classified information and material and as required by applicable security classification guide. The special requirements for marking documents containing RD, FRD, and TFNI are addressed in § 117.23.
(c) Marking guidance for CUI. Contractors will use marking guidance conveyed in 32 CFR 2002.20, the CUI Marking Handbook (available at: https://www.archives.gov/files/cui/documents/20161206-cui-marking-handbook-v1-1-20190524.pdf ), and agency policy to mark CUI in accordance with contract requirements.
(d) Working papers. Working papers will be marked, destroyed, and retained in accordance with § 117.15(e)(3).
(e) Translations. The contractor will mark translations of U.S. classified information into a language other than English with the appropriate U.S. markings and the foreign language equivalent to show the United States as the country of origin.
(f) Marking wholly unclassified material. The contractor will not mark or stamp wholly UNCLASSIFIED material as UNCLASSIFIED unless it is essential to convey to a recipient of such material that:
(1) The material has been examined specifically with a view to impose a security classification and has been determined not to require classification by the GCA.
(2) The material has been reviewed and has been determined to no longer require classification and it has been declassified by the applicable GCA.
(g) Marking miscellaneous material. The contractor will:
(1) Handle miscellaneous material developed in connection with the handling, processing, production, storage, and utilization of classified information in a manner that ensures adequate protection of the classified information involved.
(2) Destroy the miscellaneous material at the earliest practical time, unless a requirement exists to retain such material. Notwithstanding the provisions of paragraph (a) of this section, there is no requirement for the contractor to mark such material, but disposition and retention requirements in § 117.15(i) and (j) apply.
(h) Marking training material. The contractor will clearly mark unclassified documents or materials that are created to simulate or demonstrate classified documents or material to indicate the actual UNCLASSIFIED status of the information. For example, the contractor may use: MARKINGS ARE FOR TRAINING PURPOSES ONLY, OTHERWISE UNCLASSIFIED or UNCLASSIFIED SAMPLE, or other similar marking.
(i) Downgrading or declassification actions. When a contractor removes documents or material that have been downgraded or declassified from storage for use or for transmittal outside the contractor location:
(1) The documents or material must be re-marked pursuant to paragraph (i)(1)(i) or (i)(1)(ii) in this section.
(i) Prior to taking any action to downgrade or declassify information, the contractor will seek guidance from the GCA. If the GCA approves such action, the contractor will cancel all old classification markings with the new markings substituted, whenever practical. For documents, at a minimum the outside of the front cover, the title page, the first page, and the outside of the back will reflect the new classification markings, or include the designation UNCLASSIFIED. The contractor will re-mark other material by the most practical method for the type of material involved to ensure that it is clear to the holder what level of classification is assigned to the material.
(ii) When the GCA notifies contractors of downgrading or declassification actions that are contrary to the markings shown on the material, the contractor will re-mark material to indicate the change and notify other holders if further dissemination was made. The contractor will mark the material to indicate the:
(A) Authority for the action.
(B) Date of the action.
(C) Identity and position of the individual taking the action.
(2) If the volume of material is such that prompt re-marking of each classified item cannot be accomplished without unduly interfering with operations, the contractor may attach a downgrading and declassification notice to the inside of the file drawers or other storage container instead of the re-marking otherwise required.
(3) When such documents or materials are withdrawn from the container solely for transfer to another container, or when the container is transferred from one place to another, the transfer may be made without re-marking if the notice is attached to the new container or remains with each shipment.
(4) For the purpose of paragraphs (i)(2) and (i)(3) in this section, the contractor must include in the downgrading and declassification notice:
(i) The authority for the downgrading or declassification action.
(ii) The date of the action.
(iii) The storage container to which it applies.
(j) Upgrading action. (1) When the contractor receives notice from the GCA to upgrade material to a higher level; for example, from CONFIDENTIAL to SECRET, the contractor will:
(i) Immediately enter the new markings on the material according to the notice to upgrade, and strike through all the superseded markings.
(ii) Enter the authority for and the date of the upgrading action on the material.
(iii) Ensure all records affected are stored at the appropriate level of security, including digital networks and systems. Upgrades requiring network or system adjustment will be coordinated with the GCA to mitigate or account for impact on the execution of the contract.
(2) The contractor will notify all holders to whom they disseminated the material. The contractor will not mark the notice as classified unless it contains additional information warranting classification.
(3) In the case of material which was inadvertently released as UNCLASSIFIED, the contractor will mark and protect the notice as classified at the CONFIDENTIAL level, unless it contains additional information warranting a higher classification. The contractor will cite the applicable Contract Security Classification Specification, or equivalent, or other classification guide on the “Derived From” line and mark the notice with an appropriate declassification instruction.
(k) Dissemination of improperly marked information. If the contractor inadvertently distributes classified material without the proper classification assigned to it, or without any markings to identify the material as classified, as appropriate, the contractor will:
(1) Determine whether all holders of the material are cleared and authorized access to it.
(2) If recipients are authorized persons, and the contractor disseminated the information through authorized channels, promptly provide written notice to all holders of the proper classification to be assigned. The contractor will also include the classification source as well as declassification instructions in the notification.
(3) Report compromises to the CSA in accordance with the provisions of § 117.8(d), if:
(i) Any of the recipients of the material are not authorized persons.
(ii) Any material cannot be accounted for.
(iii) The material was transmitted through unauthorized channels.
(l) Marking foreign government classified material. Foreign government classified information will retain its original classification markings or will be assigned a U.S. classification that provides a degree of protection at least equivalent to that required by the foreign government entity that furnished the information in accordance with 32 CFR 2001.54. The equivalent U.S. classification and the country of origin will be marked on the front and back in English.
(m) Foreign government restricted information and “in confidence” information.
(1) Some foreign governments have a fourth level of classification that does not correspond to an equivalent U.S. classification that is identified as RESTRICTED information. In many cases, security agreements require RESTRICTED information to be protected as U.S. CONFIDENTIAL information.
(2) Some foreign governments may have a category of unclassified information that is protected by law. This latter category is normally provided to other governments with the expectation that the information will be treated “In Confidence.” The foreign government or international organization must state that the information is provided in confidence and that it must be protected from release.
(i) 10 U.S.C. 130c protects information provided “In Confidence” by foreign governments which is not classified but meets special requirements.
(ii) This provision also applies to RESTRICTED information which is not required by an agreement to be protected as classified information.
(iii) The contractor will not disclose information protected by this statutory provision to anyone except personnel who require access to the information in connection with the contract.
(3) It is the responsibility of the foreign entity that awards the contract to incorporate requirements for the protection and marking of RESTRICTED or “In Confidence” information in the contract. The contractor will advise the CSA if requirements were not provided by the foreign entity.
(n) Marking U.S. documents containing FGI. (1) U.S. documents containing FGI must be marked on the front, “THIS DOCUMENT CONTAINS (indicate country of origin) INFORMATION.” In addition, the portions must be marked to identify both the country and classification level, ( e.g., (UK-C), (GE-C)). The “Derived From” line will identify U.S. as well as foreign classification sources.
(2) If the identity of the foreign government must be concealed, the front of the document will be marked “THIS DOCUMENT CONTAINS FOREIGN GOVERNMENT INFORMATION;” paragraphs will be marked FGI, together with the classification level ( e.g., (FGI-C)); and the “Derived From” line will indicate FGI in addition to any U.S. source. The identity of the foreign government will be maintained with the record copy of the document.
(3) A U.S. document that contains FGI will not be downgraded below the highest level of FGI contained in the document or be declassified without the written approval of the foreign government that originated the information. Recommendations concerning downgrading or declassification will be submitted to the GCA or foreign government contracting authority, as applicable.
(o) Marking documents prepared for foreign governments. Documents prepared for foreign governments that contain U.S. classified information and FGI will be marked as prescribed by the foreign government. In addition, they will be marked on the front, “THIS DOCUMENT CONTAINS UNITED STATES CLASSIFIED INFORMATION.” Portions will be marked to identify the U.S. classified information.
(p) Marking requirements for transfers of defense articles to Australia (AUS) or the United Kingdom (UK). Marking requirements for transfers of defense articles to AUS or the UK without a license or other written authorization are pursuant to § 117.19(i).
(q) Commingling of RD and FRD. Commingling of RD, FRD, and TFNI with national security information (NSI) in the same document should be avoided to the greatest degree possible. When mixing this information cannot be avoided, the marking requirements in 10 CFR part 1045, section 140(f) and declassification requirements of 10 CFR part 1045, section 155 apply.