Protect U-NNPI and prepare for NAVSEA 08 system approval

U-NNPI is Unclassified Naval Nuclear Propulsion Information: unclassified information about the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance and repair of the propulsion plants of US naval nuclear-powered ships and prototypes, including their support facilities. Although unclassified, it is controlled because it relates to nuclear propulsion technology and is subject to export controls. Its protection is governed by OPNAVINST N9210.3.

OPNAVINST N9210.3 binds US Navy personnel as a general order and reaches contractors through their contracts. Shipyards, prime contractors, subcontractors and suppliers working for the Navy or the Department of Energy on naval nuclear propulsion work usually have it, or equivalent documents such as NN-801, invoked in their contract or DD Form 254. Prime contractors must flow the requirements down to subcontractors that receive NNPI.

Yes. A contractor information system must be approved by Naval Reactors (NAVSEA 08) before it stores or processes U-NNPI. Prime contractor guidance describes a request package that includes a corporate letter, a system security plan addressing NIST SP 800-171 and OPNAVINST N9210.3, plans of action and milestones and any waiver requests, submitted well before the date approval is needed. Personally owned devices may not process NNPI.

U-NNPI protection on contractor systems builds on NIST SP 800-171, so an organisation that already meets 800-171 or CMMC Level 2 has a strong base. However, U-NNPI adds its own requirements for marking, disposal, foreign national access, facility visits and NAVSEA 08 approval of information systems. CMMC certification does not replace that approval, so both need to be addressed separately.

Mishandling U-NNPI can lead to loss of contracts or access, and the standard NNPI statement warns that unauthorised dissemination may be subject to civil and criminal sanctions under the Atomic Energy Act of 1954. Because NNPI is also export controlled technical data, unauthorised release to foreign nationals can breach export control laws. Spills of U-NNPI onto unapproved systems must be reported and cleaned up following the instruction.

U-NNPI must carry markings that identify it as Naval Nuclear Propulsion Information, together with the required dissemination and export control warning statements. Historically this used the NOFORN marking, but more recent Naval Nuclear Propulsion Program guidance aligns U-NNPI markings with the Controlled Unclassified Information framework. Contractors should follow the marking requirements currently invoked in their contract and check with their NNPI control officer.

It depends on your starting point. An organisation with a mature NIST SP 800-171 programme mainly needs to add U-NNPI specific handling, disposal and visitor controls and prepare its approval package, while one starting from scratch must build the underlying security controls first. Prime contractor guidance asks for approval requests to be submitted at least 90 days before approval is needed, so plan ahead.

U-NNPI is mapped in OneClickComply's control library and is available on request rather than live as a standard framework today. We can map its requirements to the NIST SP 800-171, CMMC or ISO 27001 controls you already run, collect evidence automatically and help prepare documents for a NAVSEA 08 approval request. OneClickComply does not grant approval: that decision rests with Naval Reactors.