Communications security, or COMSEC, is the set of federal rules and requirements that govern how classified telecommunications and cryptographic material are protected, and any organization that handles that material must maintain a formal COMSEC program built around a cleared facility, a designated account manager, an account established through a Central Office of Record, and continuous compliance with National Security Agency and Committee on National Security Systems standards. The rules reach every stage of the material’s life: encryption, transmission, storage, inventory, and destruction. Falling short in any one area can cost an organization its clearance and expose individuals to criminal liability.
What the Rules Actually Protect
The Committee on National Security Systems defines COMSEC as four related disciplines, and the compliance requirements track those disciplines.1Office of the Director of National Intelligence. CNSSI 4009 – National Information Assurance Glossary
Cryptographic security covers the algorithms, keying material, and NSA Type 1 certified hardware that render intercepted traffic unreadable. Key management (generation, distribution, storage, and destruction of keys) sits inside this discipline, and a single compromised key can undo everything else.
Transmission security protects the signal itself. Even encrypted traffic can leak intelligence through timing, frequency, or pattern, so countermeasures such as frequency hopping and burst transmission are part of the standard.
Emission security, known as TEMPEST, addresses the stray electromagnetic signals that monitors, processors, and cables radiate during normal use. Shielding, certified equipment, and controlled zones around processing areas are the countermeasures, subject to periodic inspection.2Department of Energy. DOE 5300.2D – Emission Security (TEMPEST)
Physical security is the tangible layer: reinforced containers, federally specified locks, controlled-access areas, and entry logs that keep someone from simply walking out with a hard drive or a key list.
Who Sets the Rules
National Security Directive 42 designates the NSA as the National Manager for National Security Systems, giving it authority over cryptography, telecommunications security, and information systems security across the federal government.3National Security Agency. Operating Under Legal Authorities – Section: National Security Directive 42 (NSD-42) The Committee on National Security Systems, supported by NSA as secretariat, publishes the operational instructions.
Two CNSS instructions do most of the work you need to know about. CNSSI 1253 sets the risk management and security categorization framework federal organizations use to select controls for their systems.4Committee on National Security Systems. CNSSI No. 1253 – Security Categorization and Control Selection for National Security Systems CNSSI 4003 governs the safeguarding, accounting, and reporting of COMSEC material.
For cleared contractors, the National Industrial Security Program Operating Manual at 32 CFR Part 117 puts the obligations in regulatory language, with Section 117.21 addressing COMSEC specifically: who can hold material, how accounts are established, and who supervises them.5eCFR. 32 CFR 117.21 – COMSEC Losing compliance under any of these authorities can end an organization’s ability to hold classified contracts.
Setting Up a COMSEC Account
Clearances Come First
Before any material arrives, the organization needs a Facility Security Clearance at a level covering the work.6eCFR. 10 CFR Part 95 – Facility Security Clearance and Safeguarding of National Security Information and Restricted Data The Facility Security Officer, the COMSEC account manager, and the alternate account manager must each hold a final personnel clearance appropriate for the material.5eCFR. 32 CFR 117.21 – COMSEC Accounts holding Top Secret keying material marked CRYPTO require final Top Secret clearances based on a current investigation.
Top Secret investigations routinely take several months, and adjudication timelines have been trending longer. Plan accordingly. Every person who will access classified COMSEC information must also sign Standard Form 312, the Classified Information Nondisclosure Agreement, which federal courts have upheld as a binding contract.7Office of the Director of National Intelligence. Classified Information Nondisclosure Agreement (SF 312) Frequently Asked Questions Unauthorized disclosure can lead to reprimand, demotion, clearance revocation, or criminal prosecution. For contractors, the government may also terminate the contract or pursue damages.
The Account Manager
The COMSEC account manager, sometimes called the custodian, takes personal responsibility for every piece of accountable material on the account. NIST defines the role as the person designated to be responsible for receipt, transfer, accountability, safeguarding, and destruction of COMSEC material.8National Institute of Standards and Technology. Computer Security Resource Center Glossary – COMSEC Account Manager An alternate must also be appointed so the account is never without an authorized manager.
Registration
For contractors, the process begins when the contracting officer notifies the company that a COMSEC account is required, typically through the Contract Security Classification Specification (DD Form 254). The contractor submits proposed account personnel to the cognizant security agency, which forwards the package with the contractual justification to the appropriate Central Office of Record.5eCFR. 32 CFR 117.21 – COMSEC The COR establishes the account and issues a unique account number that identifies the organization within the COMSEC Material Control System from that point forward.
The registration package typically includes physical security floor plans, storage container details, and personnel records. Storage must use GSA-approved containers with high-security locks built to General Services Administration specification FF-L-2740B. These locks are restricted-purchase items, sold only to government agencies, authorized contractors, and organizations specifically required by the government to use them. Each lock’s serial number is tracked in a secure database.
Accountability and Inventory
COMSEC accountability runs on paper by design. Standard Form 153 is the primary document for recording transfers, destruction, inventory, and possession of accountable material.9Defense Technical Information Center. COMSEC Supplement to Industrial Security Manual for Safeguarding Classified Information You use an SF-153 when material moves between accounts, when a custodian changes, when material is destroyed, and when you conduct a formal inventory. If material appears without transfer paperwork or previously lost material resurfaces, the SF-153 brings it back onto the books.
Inventory frequency depends on the accountability level code assigned to the material:
- Centrally accountable material with ALC 1, 2, and 6 requires a physical inventory every six months, documented in a Semiannual Inventory Report.
- ALC 4 and ALC 7 material requires an annual inventory, plus one whenever the custodian changes.
- Centrally accountable key requires daily and shift-to-shift inventories for continuous control.
- Hand receipt holders are inspected by the custodian at least once per year. If distance makes a personal inspection impractical, the holder completes a self-inspection and inventory instead.
This is where most programs get into trouble. Missing an inventory deadline or failing to reconcile a discrepancy triggers reporting requirements that escalate quickly, and the custodian bears personal responsibility for every item.
Not every user needs their own account. Hand receipt holders, also called local elements, receive material on a hand receipt from the primary custodian and operate under that custodian’s account. The custodian decides whether a hand receipt holder needs a dedicated COMSEC facility based on volume and mission, but accountability stays with the primary account.
Handling, Storage, and Destruction
Two-Person Integrity
The most sensitive keying material, anything marked CRYPTO, requires Two-Person Integrity. No single individual may access the material alone. Two properly cleared people must remain in constant view of each other whenever the material is out of its container.10National Institute of Standards and Technology. NIST Glossary – Two-Person Integrity The container itself must prevent single-person access, typically a safe with two separate combination locks where each person knows only one combination.11I Marine Expeditionary Force. I MEFO 2281.1A – Communications Security Standing Operating Procedures
Destruction
Superseded or expired keying material must be destroyed promptly using approved methods. Acceptable techniques include burning, shredding through NSA-authorized devices, pulping, chopping, and pulverizing. Magnetic tapes are destroyed by disintegration or incineration, and magnetic cores by incineration or smelting.11I Marine Expeditionary Force. I MEFO 2281.1A – Communications Security Standing Operating Procedures For paper, NSA maintains an Evaluated Products List of approved shredders. As of January 2026, every shredder on the list must reduce documents to particles no larger than 1 millimeter by 5 millimeters, and all listed devices are approved for material up to Top Secret/SCI.12National Security Agency. NSA/CSS Evaluated Products List for Paper Shredders
Every account must also maintain an emergency destruction plan that sets the priority order for destroying material if the facility is threatened. Superseded key and the most sensitive items go first. The plan covers precautionary destruction when a threat is developing, total destruction when the facility is about to be overrun or abandoned, and evacuation when material can be moved to a safer location. A copy goes to the installation’s physical security officer.
Incident Reporting
A COMSEC incident is any event that could jeopardize the security of COMSEC material or the secure transmission of national security information. Cryptographic incidents, a subcategory, involve equipment malfunctions or operator errors affecting a cryptographic system: using a superseded key, transmitting in plaintext due to equipment failure, or extending a key’s authorized use period without approval.
All COMSEC incidents must be reported within 72 hours of discovery, regardless of the type of material or its classification level.13Headquarters Marine Corps. COMSEC Management for Commanding Officers Handbook An ongoing local investigation, or even an inquiry by an external agency, does not pause or extend that clock. If routine reporting channels might compromise an active investigation, the command must contact NSA or the appropriate COMSEC authority through alternative secure means. Missing the 72-hour window creates a second reportable problem stacked on top of the first.
Criminal Penalties
Under 18 U.S.C. 798, anyone who knowingly discloses classified information about cryptographic systems, communication intelligence activities, or the design and construction of cryptographic devices to an unauthorized person faces up to ten years in federal prison, a fine, or both.14Office of the Law Revision Counsel. 18 USC 798 – Disclosure of Classified Information The statute is not limited to traditional espionage. Careless handling that results in disclosure to someone without the right clearance and need-to-know can trigger criminal liability. Separate defense information statutes carry similarly steep penalties.
Key Management Infrastructure Transition
The federal government has been replacing the legacy Electronic Key Management System with the Key Management Infrastructure, a modernized platform for producing, distributing, and managing cryptographic keys. NSA originally mandated that all military services and civil agencies transition to KMI by December 2017. Hardware refresh issues, supply chain problems, system configuration challenges, and expanded requirements pushed that timeline well past its original projection.15Director, Operational Test and Evaluation. FY2023 Annual Report – Key Management Infrastructure (KMI) KMI Capability Increment 3 was re-baselined in late 2023, with a Full Deployment Decision targeted for fiscal year 2027.
For active accounts, the practical consequence is dual-track proficiency. Legacy EKMS and KMI will coexist during the transition, so custodians trained only on legacy systems need additional coursework before their accounts migrate. Training is not a one-time event, and a custodian who falls behind puts the whole account at risk, because a procedural error during a routine inventory or key changeover can generate a reportable incident on its own.