UNCLASSIFIED

UNCLASSIFIED

Compliance at NSA

How does the National Security Agency (NSA) define “compliance”?

Compliance is a broadly used term in government and industry and is generally defined as the 

process of meeting the expectations of others. Stated another way, it is verifiable conformance 

with a set of clearly defined rules. At NSA, the term “compliance” refers to activities that assure 

consistency with legal and policy rules that protect privacy during mission activities.

Why does NSA care so much about compliance?

Like other Intelligence Community agencies, NSA has been charged with national security 

missions of the utmost importance. We are expected and required to execute those missions in a 

reasonable and lawful manner. Every NSA employee has sworn an oath to support and defend 

the Constitution of the United States. Failure by NSA to carry out its missions in accordance 

with established law and policy could violate privacy rights and harm U.S. national security and 

other interests. Moreover, NSA puts its current and possible future authorities at risk should it 

appear incapable of successfully executing its current missions responsibly. For these reasons, 

mission compliance has long been a part of the NSA culture.

Who is responsible for compliance at NSA?

While performing the Agency’s missions in a compliant manner is everyone’s duty, the Director 

of NSA is ultimately responsible for compliance at NSA. Key senior executives have been 

appointed to lead and shape the compliance framework on his behalf, and over 300 personnel 

support the compliance program. The Compliance Group manages the overall compliance 

program and works with other organizations to train personnel, develop and implement technical 

safeguards, and set up systems to monitor and guide NSA’s activities.

All NSA personnel (civilians, military members, integrees, and contractors) are required to be 

familiar with and agree to uphold the laws, policies, procedures and regulations that govern NSA 

mission activities and implement privacy protections. NSA employees take regular training 

throughout their careers in order to ensure proper handling of personal information. All 

employees are required to take annual core Intelligence Oversight training, and some employees 

may require specialized training depending upon their assigned missions.

All NSA personnel are obligated to report when they reasonably believe NSA is not, or may not 

be, acting consistently with law, policy, or procedure.

How does NSA carry out its compliance responsibilities?

Developed from industry and government best practices, NSA’s Comprehensive Mission 

Compliance Program (CMCP) provides reasonable assurance that personnel, operational 

activities, and technology remain consistent with numerous, distinct authorizations and the 

Attorney General-approved procedures that govern those authorities. Compliance personnel 

regularly consult with the NSA Office of General Counsel to ensure processes and training 
UNCLASSIFIED

UNCLASSIFIED

accurately reflect current laws and procedures. NSA’s CMCP is comprised of the following 

offices:

• Compliance Controls – Manages compliance rules and data governance functions, maintains an 

internal controls framework, and identifies and prioritizes needs for compliance capabilities and 

services.

• Compliance Awareness – Provides effective compliance training and communicates the 

importance of compliance to the workforce.

• Compliance Monitoring & Verification – Monitors and conducts assessments to verify the 

effectiveness of compliance safeguards.

• Compliance for Cybersecurity and Operations – Serves as principal advisor on all matters 

relating to compliance and mission operations.

• Compliance for Capabilities – Serves as principal advisor on all matters relating to compliance 

and technology.

• Compliance for Research – Serves as principal advisor on all matters relating to compliance 

and research efforts.

For more information visit www.nsa.gov