NATIONAL SECURITY AGENCY 

WASHINGTON 215, D. C. 

MEMORANDUM FOR THE.MEMBERS, USCSB 

25 Feb 55 

SUBJECT: Policy for Safeguarding Cryptologic Information Provided 

to Commercial Organizations 

1. In order to meet the responsibilities which have been assigned 

to me for conducting integrated research and development programs and 

tor formula.ting integrated procurement programs to meet the 

cryptographic requirements of the Military Departments, it is neceSSal'J 

tha.t I execute :maey contracts with commercial organizations. It is 

o:rten essential that these contractors be provided w1th mod.eLs of 

classified cryptographic equipments, documents, techniques and other 

classified cryptographic matter and information. It is also occasionalJ.¥ 

necessary to provide contractors engaged in work on equipments used for 

communications intelligence purposes with limited information related to 

other cryptologic matters. 

2. It is imperative tha."b commercial organizations give all 

cryptographic and cryptologic matter the sa.me degree of protection and 

control as is given by the Departments and Agencies of the Govermnent. 

3. The Military Departments, as well as the other Governmental 

Departments and Agencies concerned, have recognized the need and have 

established precise and detailed regulations for the handling and safeguarding of cryptologic matter and information w!thin ' the Executive 

Branch of the Government. These regulations are substantially the same 

in each Department ar.d Agency. However 1 the control of the security of 

cryptologic informa.tlon within commercial organizations under contract 

to t.he Government has not been as well regulated as it bas been within 

the Governmental .AgenciesA Minimum standards and ,.precise requirements 

have not been clearly defined and have not been stated in industrial 

security regul.a.tions, or other form, which are entirely applicable or 

suitable for use by commercial organizations or by those units of the 

Government ~"hich are responsible for the administration and security of 

Govermnent contracts. 

4. ImJof'ar a.a possible, commercial firms working on National 

Security Agency projects ha.ve been required to adhere to certain minimum 

standards for the protection of cryptologic matter and information, but 

accomplishment of this protection has been difficult because of the lack 

of clearly defined standards in existing industrial security regulations. 

Although the problem is of primary concern to the National Security 

Agency, under the terms of NSC 168, cryptologic contracts may be let by 

Declassified and approved for release by NSA on 02-12-2014 pursuant to E. 0. 1352B 

CONFIDENTIAL 
I 

the Military Departments and the other Feneral Agencies concerned. In 

order to insure that uniform security•standards are applied by all 

Agencies to their particular contracts, it is proposed that a policy 

which establishes minimum standards for the safeguarding of cryptologic 

information provided to commercial organizations be established by the 

USCSB. 

5. A proposed policy for safeguarding cryptologic information 

provided to cormnercial organizations is inclosed. I recommend its 

approval. Copies of the policy have been forWa.rded to the members of 

the USCIB for their information. 

6. Foll.oving USCSB approval of the inclos.ed policy statement, based 

on the general minimum stand.a.rd$ set forth therein, I shall prepare a.n 

"Industrial Security Manual i'or Sa.i'eguarding Cryptologic Information" for 

use within the Department of Defense. In order that other Departments and 

Agencies also may make use of this manual, it will be designed to have fair~ universal application to the security of cryptologic information and 

materials in the custody of connnercia.1 organizations, and copies will be 

made available to the Executive Secretary, USCIB/USCSB, for distribution 

to the members of both Boards. 

Incl: 

a/s 

2 

CONFIDENTIAL 
REF ID: A65~4 

• 

POLICY FOR SAFEGUl\.RDING CHYPrOLOGIC JNFOHMA.TION 

PROVIDED 'ro COUf-tl!:RCIAL OR~ANIZATION3 

1. Cryptologic information which is made availa.ble to commercial 

orr.anizutions by tbc varioua departments and a.scncies of the Goverll¥1ent 

will be aa.f~~uaTded in accordance with the minimum stundn.rds set forth 

herein. 

DEFINITIONG 

2. The follow.l.113 definitions are established for the purpose of 

this policy: 

a. Cryptologic Information. - Any classified equipment, 

material, or information which is desianated by the cogniz~nt depart- mcn~ or agency of the Government as being cryptogra.phic or cryptologic 

because or its relationship to codes, ciphers, or cryptosystems or the 

United States or forei~n nations, or because of its relationship to 

the communications intellieence activities'of the United States. 

b. Commercial Org13.nization. - Any industrial plant, 

educational institution, or commercial company or organization which 

is not under the direct control of the Government but is engaged in 

performing serv:lces of o. cryptoloc;ic nature for the Government, 

usua.lly under contract to the Government or under subcontract to a 

prime contractor of the Government. 

c. Cogniza.nt Agency. - A depa.rtment o~ agency of' the 

Government which has a requirement for providinS cryptologic inf~rmation (either directly or indirectly througb a Government procurcm~nt 

or contractual facility) to a. commercial organiza.tion in ordr~r t.ha.t. 

the commercial organization can satisfactorily perform servicen for 

that department or agency. 

ACCESS 

3. Prior to providing any cryptologic in:form.'3.tion to a. c01nmprcia.J. 

organization, the cognizant agency will ascertain th:.'\.t. the officers, 

directors, and key employees of .the commercial orgPniztJ.tion c.re 

appropriately cleared in accordance with the standordr. or the coc;niznnt 

agency for access to the particular cryptoloe;ic inforniat.lon concf>rncd. 

4. Within a commercial organization, acceos to cryptologic 

information shall be limited to those employeeR who need to know a.nd 

who ho.ve been cleared in accord.a.nee with the standnrds of th~ cognir.o.nt. 

agency. 

-

Incl 
... REF ID : A65 9..i.4 

• 

5. 'rhe cognizant agency wi~l insure that authorities or the 

commercial organization will take steps to make certain that all 

employees concerned are fully indoctrinated in all security requirements or this policy a.nd are continuou'sly a.ware of the necessity 

for safeguarding cryptologic information at all times and or the 

applicable Federal Statutes and Executive Orders, particularly the 

Espionage Lo.ws, Title 18, U.S.C. Sections 793, 794 and 798. 

6. Visitors to a commercial organization shall be permitted 

to have access to cryptologic information iri the custody or that 

organization only when specifically authorize~ by the coGnizant 

agenc1 or other appropriate Government authority. 

PHYSICAL SECURITY 

7. Prior to providing any cryptoloeic information to a 

commercial organization the cognizant agency will ascertain that 

the oraanization is capable of and fully prepared to physically 

sa.fcgua.rq.f1the inform.-'J.tion in accordance with the minimum standards 

set forth herein and such further standards as may be required by 

tbe cognizant agency. The coanizo.nt agency will also ascertain 

that adequate means exist for over-all supervision and constant 

surveillance of those security practices a.nd procedures established. 

8. All cryptologic mo.tter provided to or handled by a commercial 

orP,a.nization will, if practicable, be marked with the appropriate 

classification and, if deemed nccesao.ry by the cognizant agency to 

insure adequate control and handling, will be further marked as being 

cryptologic. If this is not practical, the comn\ercial organization 

will be advised in writing of those specific items which are cryptologic and the classification of each. 

9. Commercial organizations wiJl receipt for and maintain a 

record of all cryptologic matter received. Within the commercial 

organization, the dissemination of cryptologic intormation will be 

carefully controlled and will be limited to those employees who ~re 

authorized to receive it and who have a need for the information. 

Transmission means employed within a commercial organization will 

be such as to insure that only authorized employees will have access 

to cryptoloBic information. 

10. CrYJ>tologic informntion which is classified TOP SECRET or 

which is specified by the cognizant a~ency as requiring registered 

accounto.bility will be strictly accounted for at all times within 

the commercial orc;a.nization in accordance with the stauclardG specified 

by the cognizant o.c;ency. As a minimum, transmittal and custody of all 

such matter will be covered by a hand receipt system and a record will 

be maintained of the' exact location of each item. 

11. Copies or reproductions of cryptologic matter and extracts 

from cryptoJoc;ic documents will be made by commercial organiz~tions 

only as authorized by the cognizant agency. The so.me accountability 

as accorded the orie;irui.l documcnto or materials will be provided for 

a.ll such copies, reproductions or extracts. 

2 
.. ... REF ID: A65~4 

• 

12, Cryptologic matter in the custody of a commercial organization will be transmitted outsfde that or~anization only when 

authorized by the cognizant agency and in ~ccordance with the 

following minimum standards: 

a. Printed matter and documents will be double wrapped 

and sealed. The outer vrapper will contain no indication of the 

fact that the package contains cryptologic or classified matter. 

Equipments and bulky items will be similarly securely packaged 

or crated as specified by the cognizant agency. 

b. The means of transmission used will be one of the 

following: messenger approved by the cognizant agency; United 

States registered mail; or protected connnercial express. The 

exact means will be specified in accordance with the standards 

of the cognizant agency for the particular cryptologic matter 

concerned. Under no circumstances will cryptologic information 

be transmitted by non-registered mail. TOP SECRET cryptologic . 

matter will be transmitted only by direct contact whenever possible. 

13. Within a commercial organization, cryptologic information 

will, when in use, be maintained in a physically segregated area 

which is so designed and constructed as to prevent observation or 

entrance by other than authorized personnel. All entrances to 

the area will be kept under· continuous guard. 

14. During non-working hours and when cryptologic information 

is not in use, it will be stored in three-position dial-type 

combination lock safes or vaults, the size, weight and construction 

of which is such as to minimize the possibility'of physical removal. 

Only a minimum number of authorized personnel will have keys or 

combinations to storage facilities. Combinations to storage 

facilities will always be changed upon transfer of personnel having 

knowledge or same. When because of its size or nature it is not 

possible to store cryptologic matter in a safe or vault, the 

cryptologic matter will be kept under armed guard. Full-time 

guards or roving patrols will be employed as deemed necessary by 

the cognizant agency in order to adequately protect the cryptologic matter involved. Guards will be United States citizens of 

undoubted loyalty. 

15. Commercial organizations will not destroy any cryptologic matter in their custody unless such destruction is authorized 

by the cognizant agency. When authorized, destruction will be 

carried out in accordance with the following minimum standards: 

a. Documents and printed matter wil1 be destroyed by 

burning or by pulping methods if approved by the cognizant agency. 

Cryptologic equipments shall be melted or otherwise destroyed 

beyond recognition ss specified by the cognizant agency. 

3 
... .. ... ' "' e REF ID:A65i4 

b. Destruction will be performed by an appropriately 

cleared and authorized employee pf the commercial organization and 

will be witnessed by at least one other such person. Destruction 

ot: o.11 TOP SJl:CRET and registered cryptologic matter, a.9 well as 

such other cryptologic matter as may be specified by the cognizant 

agency, will be recorded and certified. 

c. Cryptologic waste materials will be carefully and 

securely disposed of as specified by the cognizant ~gency. The 

cognizant agency will insure that commercial organizations are 

provided complete guidance concerning the secure disposition of 

all cryptologic waste materials. 

16. The cognizant agency will a.scertain that commercial 

organizations are prepared, in the event of fire or other emergency, 

to provide adequate protection to cryptologic fn:forrnation in their 

custody' in order to insure that· such information will not be 

accessible to unauthorized persons. 

APPLICABILI'l'Y 

17• The minimum standards set forth herein will apply to all 

sub-contractors as well as to prime contractors of the Government 

who have access to cryptologic information. The cognizant agency 

and the prime contractor are responsible for insuring that cryptologic information provided to sub-contractors is protected in 

accord.a.nee with the foregoing minimum standards, and that subcontractors establish such procedures as may be required to 

accomplish this. 

18. It is not intended that the minimum standards set forth 

herein will apply without exception to those· parts and components 

of' cryptologic equipments or extracts from cryptologic documents 

which, when considered individually, could provide no cryptologic information. It is the responsibility of the cognizant 

agency to furnish guidance to connnercial organizations as required 

concerning the safeguarding standards to be applied to individual 

parts or components of cryptologic items. 

4