What Is NISPOM: Facility Clearance, FOCI, and Insider Threat

NISPOM requirements are the federal rules a private company must follow to handle classified information under a government contract. They are codified at 32 CFR Part 117 and cover facility clearances, personnel vetting, foreign ownership review, safeguarding of classified material, insider threat programs, training, reporting, and security reviews. Every requirement applies from the moment your company is sponsored for a clearance and continues for as long as you hold one.

Who Enforces NISPOM

The National Industrial Security Program Operating Manual has the force of federal regulation, not just internal policy. The Defense Counterintelligence and Security Agency (DCSA) administers the program on behalf of DoD contracting activities and other executive branch agencies that have agreements with DoD for security services, and DCSA acts as the Cognizant Security Office providing oversight.¹ In practice, DCSA is the agency your company will deal with for clearances, inspections, and enforcement.

Facility Clearance Requirements

Before your company can touch classified information, it needs a facility security clearance (FCL). You cannot apply on your own. A government contracting activity or a cleared prime contractor must sponsor your company by submitting the request to DCSA, and sponsorship generally flows from a classified contract accompanied by a DD Form 254 laying out the classification levels and security requirements you must meet.²³

Once sponsored, the company signs the DD Form 441, the Department of Defense Security Agreement, committing to a security system that complies with 32 CFR Part 117 and to verifying subcontractor clearances before sharing classified information.⁴

Key Management Personnel

Every cleared facility must designate Key Management Personnel (KMP) in writing. At minimum, that means a Facility Security Officer (FSO) who supervises all security measures and serves as the day-to-day government contact; an Insider Threat Program Senior Official (ITPSO) who runs the insider threat program; and a Senior Management Official (SMO) responsible for the company’s overall security posture. If the ITPSO is not also the FSO, the ITPSO must ensure the FSO is an integral member of the insider threat program.

All KMP must hold a personnel clearance at or above the facility’s clearance level. Anyone with a majority interest in the company, or with authority to influence management decisions or classified contract performance, must also appear on the KMP list with DCSA concurrence.⁵

Foreign Ownership, Control, or Influence

Foreign Ownership, Control, or Influence (FOCI) is one of the biggest hurdles for companies pursuing or maintaining a facility clearance. If a foreign person or entity has the power to directly or indirectly influence the company’s management or operations, DCSA must evaluate the risk before granting or continuing the FCL. When a company is effectively owned or controlled by a foreign interest, the existing clearance will be revoked unless adequate mitigation can be put in place.¹

The mitigation instrument DCSA requires depends on how deep the foreign interest runs:

A Board Resolution is used when the foreign interest does not hold enough voting stock to elect board representatives. The board formally acknowledges the foreign shareholder and certifies the owner will not have access to classified information.
A Security Control Agreement (SCA) applies when the foreign interest is entitled to board representation but does not effectively own or control the company. At least one cleared U.S. citizen must serve as an outside director.
A Special Security Agreement (SSA) is used when the foreign interest effectively owns or controls the company. The foreign owner keeps a voice in business management but is denied majority board representation and unauthorized access to classified information. Access to the most sensitive categories may require a separate National Interest Determination.
A Voting Trust Agreement (VTA) or Proxy Agreement (PA) are the strongest measures. Both vest foreign-owned voting rights in cleared U.S. citizens approved by DCSA. Under a VTA the foreign owner transfers legal title to the trustees; under a PA only the voting rights are conveyed.

Companies undergoing acquisition by a foreign entity should expect FOCI review to add months to their clearance timeline.⁶

Personnel Clearances and Continuous Vetting

Individual employees who need access to classified information must hold their own personnel security clearance (PCL). The process begins with Standard Form 86, the Questionnaire for National Security Positions, which gathers employment history, residences, financial records, foreign contacts, and other background used to assess reliability, trustworthiness, and loyalty.⁷ Lying or withholding information on the SF-86 is a federal crime under 18 U.S.C. § 1001, carrying up to five years in prison.⁸

Clearances are granted at three levels: Confidential, Secret, and Top Secret. A clearance alone does not grant access to anything. NISPOM enforces a strict need-to-know principle: the person disclosing classified information is responsible for confirming that the recipient has both the appropriate clearance level and a legitimate, job-related reason to see that specific information.¹

Periodic reinvestigations every five or ten years have been replaced by continuous vetting under Trusted Workforce 2.0. Continuous vetting uses ongoing automated checks of public and government databases, supplemented by time- or event-driven investigative activities, and generates alerts that prompt further investigation when issues surface.⁹ A DUI arrest, a missed mortgage payment, or an unreported foreign trip can now trigger review within days rather than sitting undetected for years.

Safeguarding Classified Information

Physical Storage and Marking

Classified documents must be stored in GSA-approved security containers when not in active use. Only containers carrying a GSA approval or recertification label qualify, and they cannot be purchased from third-party vendors or resellers.¹⁰ Every piece of classified material must be marked with its classification level. When contractors create new documents derived from existing classified sources, they must carry forward the appropriate markings and include a classification authority block identifying the person who made the determination.¹¹ Material no longer needed must be destroyed using approved methods that prevent reconstruction.

Classified Information Systems

Any system that captures, stores, processes, or distributes classified information must go through a formal authorization using the Risk Management Framework, which requires categorizing the system, selecting and implementing controls based on NIST standards, assessing those controls, and obtaining authorization from a government official. Contractors must appoint an Information System Security Manager (ISSM) with training and expertise proportional to the system’s complexity, and self-inspections of classified systems must occur at least once every 12 months.¹²

Insider Threat Program

Every cleared facility must establish and maintain an insider threat program to gather, integrate, and report information indicating a potential or actual insider threat. The program is not optional and is evaluated during every DCSA security review.

The ITPSO runs the program and must self-certify the insider threat plan in writing to DCSA. For companies with multiple cleared facilities under one corporate family, a single ITPSO can manage an enterprise-wide program, but each facility must formally appoint that person and the ITPSO must give DCSA an implementation plan covering the entire entity family.⁵ The program should be scaled to the organization’s size, so a 20-person subcontractor and a 10,000-employee prime will look quite different in practice.

Security Training

Before any employee is granted access to classified information, they must receive an initial security briefing covering threat and insider threat awareness, counterintelligence awareness, an overview of the classification system, reporting obligations, cybersecurity training for users of classified systems, and the criminal, civil, and administrative consequences of unauthorized disclosure. The employee cannot access classified material until this briefing is complete, even if the clearance has already been granted.

After that, all cleared employees must complete an annual security awareness refresher. The DCSA-provided course covers the core NISPOM training requirements and currently includes modules reflecting Trusted Workforce 2.0. Employees must score at least 75% on the assessment to receive a certificate of completion.¹³ The FSO and ITPSO have additional position-specific training on top of the standard curriculum.

Reporting Obligations

Cleared contractors carry an ongoing duty to report certain events to DCSA. These duties do not end when a project wraps up or an employee leaves.

Contractors must report adverse information about any cleared employee, including arrests, legal actions, financial distress such as bankruptcy or wage garnishment, and other behavior that could affect eligibility. Terminating the employee does not remove the reporting requirement, and contractors are legally protected from defamation claims arising from these required reports.¹

Any effort by anyone to obtain unauthorized access to classified information, or to elicit information from a cleared employee, must be reported, including contacts that suggest the employee may be targeted by a foreign intelligence service. Contractors must also report changes in ownership or control (including stock transfers that shift control), changes to company name or address, and any changes to KMP.¹

Clearance holders themselves have a personal duty to self-report life events that could affect their eligibility, including arrests, financial problems, foreign travel, and changes in personal relationships.¹⁴ Under continuous vetting, many events will surface through automated checks anyway, but failing to self-report can itself become grounds for adverse action.

Security Reviews and Consequences of Noncompliance

DCSA conducts recurring security reviews of every cleared facility, evaluating NISPOM effectiveness, management support, security awareness, and security community. Each facility receives a rating on a five-tier scale: superior, commendable, satisfactory, marginal, or unsatisfactory. Participation is mandatory to maintain a facility clearance.¹⁵

When problems are found, consequences escalate with severity. Security infractions are incidents that were not deliberate but could lead to compromise if uncorrected. Security violations involve deliberate disregard, gross negligence, or a pattern of carelessness. Three infractions within 12 months are treated as a first violation, and each additional infraction beyond that counts as another violation.

At the organizational level, the real teeth of enforcement come through the facility clearance itself. DCSA can invalidate an FCL, which freezes the company’s ability to bid on or receive new classified contracts while the invalidation is in place. If the contractor is unable or unwilling to protect classified information or comply with NISPOM, DCSA can revoke the clearance entirely. For individual employees, the government can deny, suspend, or revoke a personnel clearance, and the contractor must immediately cut off that person’s access upon notification.¹⁶ Beyond administrative action, unauthorized disclosure of classified information can carry criminal penalties.

1
eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM)
2
Department of Defense. DD Form 254 Instructions
3
General Services Administration. GSAM 504.471 – Processing Security Requirements Checklist (DD Form 254)
4
Department of Defense. DD Form 441 – Department of Defense Security Agreement
5
eCFR. 32 CFR 117.7 – Facility Security Clearance Requirements
6
Defense Counterintelligence and Security Agency. FOCI Mitigation Agreements
7
U.S. Office of Personnel Management. SF 86 – Questionnaire for National Security Positions
8
Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
9
U.S. Government Accountability Office. Observations on the Implementation of the Trusted Workforce 2.0
10
General Services Administration. Security Containers
11
eCFR. 32 CFR 117.13 – Classification
12
eCFR. 32 CFR 117.18 – Information System Security
13
Defense Counterintelligence and Security Agency. DOD Annual Security Awareness Refresher
14
Defense Counterintelligence and Security Agency. DCSA Self-Reporting Factsheet
15
Defense Counterintelligence and Security Agency. Security Review and Rating Process
16
Federal Register. National Industrial Security Program Operating Manual (NISPOM)