Stay ready for DCSA reviews with organised NISPOM evidence

NISPOM, the National Industrial Security Program Operating Manual, is the US federal regulation that sets out how cleared contractors must protect classified information. It was codified as 32 CFR Part 117 by a Department of Defense rule published on 21 December 2020 and effective on 24 February 2021. It covers facility and personnel clearances, foreign ownership, insider threat, training, marking, safeguarding, visits, subcontracting and information system security.

Any contractor that holds an entity eligibility determination, commonly called a facility clearance, must comply with NISPOM while it has access to classified information. That includes prime contractors and cleared subcontractors working on classified US government contracts. Companies that only handle unclassified information, such as Controlled Unclassified Information, are covered by other rules like DFARS 252.204-7012 and NIST SP 800-171 instead.

They are now the same thing. NISPOM used to be published as a DoD manual, DoD 5220.22-M. In 2020 the Department of Defense codified it in the Code of Federal Regulations as 32 CFR Part 117, often called the NISPOM rule. The rule took effect on 24 February 2021 and contractors had to comply by 24 August 2021, with a later date for DoD foreign travel reporting.

The cognizant security agency can invalidate a contractor's entity eligibility determination, during which the contractor may not bid on or be awarded new classified work, or revoke it entirely if the contractor is unable or unwilling to protect classified information. Unauthorised disclosure of classified information can also carry criminal penalties under federal law, and individuals can lose their eligibility for access.

NISPOM requires cleared contractors to appoint an insider threat program senior official and run an insider threat programme in line with guidance from their cognizant security agency. Section 117.12 requires insider threat awareness training for cleared employees before access and periodically afterwards, with training records kept. Section 117.18 also requires the information system security programme to incorporate insider threat minimum standards.

They cover different types of information. NISPOM governs classified information and classified information systems, which DCSA authorises using NIST SP 800-37 and SP 800-53 based guidance. NIST SP 800-171 and CMMC apply to Controlled Unclassified Information on contractor systems. Many defence contractors must meet both, so mapping shared controls such as training, access control and incident reporting avoids duplicated effort.

NISPOM has no certificate. Contractors must review their security programme continuously and carry out a formal self-inspection at least annually, and the senior management official must certify in writing each year that it was done and acted upon. The cognizant security agency, DCSA for most contractors, also conducts periodic security reviews and authorises any information systems that process classified information.

Yes. NISPOM is supported in OneClickComply today. OneClickComply helps with the unclassified parts of a cleared contractor's programme, such as policies, training records, risk management and evidence collection, and our in-house audit team can advise. OneClickComply does not process classified information or issue clearances.