Attachment 3_DOD 5220.22-R.pdf

DoD 5220.22-R, Dec. 4, 1985

2 FOREWORD

TABLE OF CONTENTS

Page

FOREWORD 2

TABLE OF CONTENTS 3

REFERENCES 6

GLOSSARY OF ACRONYMS AND ABBREVIATIONS COMMONLY USED IN THE DoD

INDUSTRIAL SECURITY PROGRAM

CHAPTER 1 - GENERAL PROVISIONS 14

C1.1. INTRODUCTION 14

C1.2. DEFINITIONS OF TERMS 35

C1.3. SECURITY COGNIZANCE 49

C1.4. SPONSORSHIP OF MEETINGS 53

C1.5. PROCEDURES PERTAINING TO COMSEC INFORMATION 61

C1.6. TRANSMISSION OF CLASSIFIED MATERIAL 64

C1.7. PROCEDURES PERTAINING TO COMMERCIAL CARRIERS 67

CHAPTER 2 - CLEARANCE PROCEDURES 72

C2.1. FACILITY SECURITY CLEARANCES AND DENIALS 72

C2.2. U.S. FACILITIES THAT ARE FOREIGN OWNED, CONTROLLED, OR INFLUENCED 116

C2.3. PERSONNEL SECURITY CLEARANCES AND DENIALS FOR CONTRACT

PERSONNEL

C2.4. MAINTENANCE OF FACILITY FILES AND DISCO RECORDS 160

CHAPTER 3 - VISITORS 163

C3.1. VISITS TO USER AGENCY CONTRACTORS 163

C3.2. VISITS TO USER AGENCY ACTIVITIES 171

C3.3. VISITS TO GOVERNMENT ACTIVITIES OTHER THAN USER AGENCIES 175

C3.4. VISITS TO FOREIGN GOVERNMENTS AND ACTIVITIES 176

C3.5. VISITS IN CONNECTION WITH BILATERAL INDUSTRIAL SECURITY

AGREEMENTS AND NATO VISIT PROCEDURES

CHAPTER 4 - SECURITY INSPECTIONS 184

C4.1. INSPECTIONS 184

C4.2. UNSATISFACTORY INSPECTIONS 194

C4.3. "CLOSE-OUT" INSPECTIONS 198

3 TABLE OF CONTENTS

TABLE OF CONTENTS, continued

CHAPTER 5 - ESPIONAGE, SABOTAGE, LOSS, COMPROMISE, AND OTHER VIOLATIONS 199

C5.1. APPLICATION 199

C5.2. ESPIONAGE, SABOTAGE, AND SUBVERSIVE ACTIVITIES 199

C5.3. LOSS, COMPROMISE, AND SUSPECTED COMPROMISE 200

C5.4. INVESTIGATIVE SUPPORT 203

C5.5. ADDITIONAL REPORTING OF ESPIONAGE, CRIMINAL ACTIVITY, AND

DELIBERATE COMPORMISE CASES

C5.6. OTHER SECURITY VIOLATIONS 206

C5.7. OTHER ADMINISTRATIVE VIOLATIONS 206

C5.8. RESPONSIBILITY OF CONTRACTING USER AGENCY TO INVESTIGATE

CERTAIN BREACHES OF SECURITY

C5.9. INQUIRIES INTO DELAYS, TAMPERING, OR IMPROPER SHIPPING METHODS 208

CHAPTER 6 - INDUSTRIAL SECURITY EDUCATION 210

C6.1. APPLICATION 210

C6.2. RESPONSIBILITY 210

C6.3. PREPARATION OF MATERIAL 210

C6.4. FUNDING 211

C6.5. MATERIAL AVAILABLE 211

C6.6. DISTRIBUTION OF MATERIAL 211

C6.7. TRAINING SCHOOLS 212

CHAPTER 7 - SECURITY CLASSIFICATION AND DECLASSIFICATION 213

C7.1. APPLICATION 213

C7.2. SECURITY CLASSIFICATION 214

C7.3. ISSUANCE OF SECURITY CLASSIFICATION GUIDANCE 215

C7.4. REQUIRED DISTRIBUTION 221

C7.5. REVIEW OF CLASSIFICATION AND NEED-TO-KNOW 223

C7.6. CLASSIFICATION INTERPRETATION PROCEDURES 225

C7.7. RESPONSIBILITY FOR AUTHORIZING RETENTION OF CLASSIFIED MATERIAL

AT COMPLETION OF A CONTRACT

C7.8. DOWNGRADING AND DECLASSIFICATION 228

C7.9. PROTECTIVE MARKING -- FOR OFFICIAL USE ONLY 229

4 TABLE OF CONTENTS

TABLE OF CONTENTS,continued

CHAPTER 8 - INTERNATIONAL SECURITY PROGRAMS 230

C8.1. INTERNATIONAL CONTRACTS 23

C8.2. PROCEDURES PERTAINING TO U.S. PATENT AGENTS ENGAGED IN FILING

CLASSIFIED PATENT APPLICATIONS FOR FOREIGN GOVERNMENTS

C8.3. OFFICE OF INDUSTRIAL SECURITY INTERNATIONAL 244

C8.4. OVERSEAS OPERATIONS OF U.S. CONTRACTORS 245

C8.5. ACCESS TO CLASSIFIED INFORMATION OF FOREIGN GOVERNMENTS AND

INTERNATIONAL PACT ORGANIZATIONS UNDER A U.S. SECURITY ASSURANCE

CHAPTER 9 - INDUSTRIAL SECURITY FORMS 251

C9.1. GENERAL 251

C9.2. EXHIBITS OF FORMS 254

CHAPTER 10 - OPERATIONS SECURITY (OPSEC) 275

C10.1. PURPOSE 275

C10.2. GENERAL 275

C10.3. APPLICATION 276

C10.4. RESPONSIBILITIES 278

C10.5. PROCEDURES FOR INSPECTING OPSEC PROGRAMS 279

APPENDIX 1 - RELEASE OF ECONOMIC AND TECHNICAL INFORMATION 280

APPENDIX 2- INFORMATION REGARDING COGNIZANT SECURITY OFFICES, DISCO,

DISI, AND OISI

APPENDIX 3 - INDUSTRIAL SECURITY FUNCTIONAL RESPONSIBILITIES OF A

CONTRACTING OFFICER

APPENDIX 4 - PREPARATION OF CLASSIFICATION GUIDANCE 297

APPENDIX 5 - AREAS SERVICED BY MTMC AND BY MILITARY COMMANDERS IN

ALASKA, HAWAII, PUERTO RICO, AND U.S. POSSESSIONS

AND TRUST TERRITORIES

APPENDIX 6 - FUNCTIONAL RESPONSIBILITIES OF MTMC, TO, AND CSO 304

APPENDIX 7 - FORMATS NECESSARY FOR NATO HAND-CARRIED MATERIALS 306

APPENDIX 8 - INDEX 312

5 TABLE OF CONTENTS

REFERENCES

(a) DoD 5220.22-M, "Industrial Security Manual (ISM) for Safeguarding Classified Information," December 2, 1985

(b) DoD 5220.22-C, "Carrier Supplement to Industrial Security Manual for Safeguarding Classified Information," April 1970, with Change 1, March 15, 1971

(c) DoD Supplement (DAR) to the FAR

(d) DoD Directive 5230.9, "Clearance of DoD Information for Public Release," April 2,

(e) Reserved

(f) Reserved

(g) Public Law 81-11, Section (§) 63 Statute 7, "Export Control Act of 1949"

(h) Public Law 83-665, § 68 Statute 832, "Mutual Security Act of 1949"

(i) Title 22, Code of Federal Regulations, Parts 121-128, the same information is contained in "International Traffic in Arms Regulation (ITAR)," published as a brochure by the Department of State

(j) Reserved

(k) Reserved

(l) DoD 5400.7-R, "DoD Freedom of Information Act Program," March 24, 1980

(m) DoD 5400.11-R, "Department of Defense Privacy Program, June 9, 1982

(n) Section 1101(a)(22) of title 8, United States Code (U.S.C.)

(o) Public Law 83-703, §11, 68 Statutes 919, 924, "Atomic Energy Act of 1954"

(p) Section 1681of title 48, U.S.C.

(q) DoD 5220.22-S-1, "COMSEC Supplement to Industrial Security Manual (CSISM) for Safeguarding Classified Information," August 1983

(r) National Disclosure Policy (NDP-1), September 9, 1981

(s) Public Law 91-184, § 83 Statute 841, "Export Administration Act of 1969"

(t) Public Law 9-629, § 82 Statute 1320 on the Arms Export Control Act (1968)

(u) National Communications Security Committee Publication (NCSC-2), "National

Policy on Release of Communications Security Information to U.S. Contractors and Other Nongovernmental Sources"

(v) Reserved

(w) Executive Order 12356, "National Security Information," April 2, 1982

(x) Reserved

(y) Joint Regulation AR 55-355, NAVSUP Instruction 4500.70 (Revised), AFM-72-2, MCO P4600.14A, DLAR 4.500.3, "Military Traffic Management Regulation," March 15, 1969

(z) Reserved

6 REFERENCES

(aa) Reserved

(bb) Reserved

(cc) Reserved

(dd) Defense Investigative Service (DIS) Form 1149, "Department of Defense

Transportation Security Agreement," May 1983

(ee) Public Law 81-774, § 64 Statute 798, "Defense Production Act of 1950"

(ff) Public Law 85-536, "Small Business Act"

(gg) Federal Acquisition Regulation (FAR)

(hh) DoD Instruction 5200.21, "Dissemination of DoD Technical Information,"

September 27, 1979

(ii) Reserved

(jj) Reserved

(kk) Public Law 82-414, § 66 Statute 163, "Imigration and Nationality Act of 1952"

(ll) DoD Directive 5220.6, "Defense Industrial Personnel Security Clearance Review

Program," August 12, 1985

(mm) DoD Directive 5200.2, "DoD Personnel Security Program," December 20, 1979

(nn) Sections 793, 794, and 798 of title 18, U.S.C.

(oo) Director of Central Intelligence Directive No. 1/7," Control and Dissemination of

Intelligence Information," May 4, 1981

(pp) DoD Directive 5210.41, "Security Criteria and Standards for Protecting Nuclear

Weapons," September 12, 1978

(qq) DoD Directive 5210.42, "Nuclear Weapon Personnel Reliability Program," April

23, 1981

(rr) DoD 5200.2-R, "DoD Personnel Security Program," December 20, 1979

(ss) Defense Logistic Agency Manual (DLAM) 5205.1, "Correspondence," March 30,

(tt) Reserved

(uu) Reserved

(vv) Chapter 37, § 537 of title 18, U.S.C.

(ww) Public Law 81-831, § 64 Statutes 987, 989, 991, and 992, Chapter 1024, "Subversive Activities Control Act of 1950"

(xx) DoD Instruction 5240.4, "Reporting of Counterintelligence and Criminal

Violations," July 28, 1983

(yy) DoD 5200.1-R, "Information Security Program Regulation," July 12, 1982

(zz) DoD Directive 5100.36, "Defense Scientific and Technical Information Program,"

October 2, 1981 (aaa) Defense Investigative Service (DIS) 31-4-R, "Industrial Security Operating

Regulation (ISOR)," September 4, 1984 (bbb) DoD 5000.12-M, "DoD Directive Manual for Standard Data Elements," December

7 REFERENCES

(ccc) Public Law 77-831, § 56 Statute 1078, "Federal Reports Act of 1942" (ddd) Public Law 75-583, § 52 Statute, "Foreign Agent Registration Act of 1938," as amended in Public Law 77-532, § 56 Statute 248 (1942) (eee) Joint Chiefs of Staff (JCS) Pub 1, "Department of Defense Dictionary of Military and Associated Terms," June 1, 1979 (fff) DoD Directive 5220.22, "DoD Industrial Security Program," December 8, 1980 (ggg) DoD Directive 5205.2, "DoD Operations Security Program," July 7, 1983 (hhh) DoD Instruction 5230.22, April 1, 1982

(iii) U.S. Security Authority for NATO (USSAN) 1-69, North Atlantic Treaty

Organization (NATO) Security Program (Enclosure 2 to DoD Directive 5100.55, "U.S. Security Authority for North Atlantic Treaty Organization Affairs," April 21, 1982)

(jjj) DoD Directive 5230.25, "Withholding of Unclassified Technical Data From Public Disclosure," November 6, 1984

8 REFERENCES

AL1. GLOSSARY OF ACRONYMS AND ABBREVIATIONS

COMMONLY USED IN THE DoD INDUSTRIAL SECURITY PROGRAM

AL1.1.1. AA&E Arms, Ammunition, and Explosives AL1.1.2. ACO Administrative Contracting Officer AL1.1.3. ACDA U.S. Arms Control and Disarmament

Agency AL1.1.4. ACSI Assistant Chief of Staff for

Intelligence, Department of Army AL1.1.5. ADP Automatic Data Processing AL1.1.6. APO Army Post Office AL1.1.7. ARFCOS Armed Forces Courier Service AL1.1.8. ASD(C) Assistant Secretary of Defense

(Comptroller) AL1.1.9. BI Background Investigation AL1.1.10. BL Bill of Lading

AL1.1.11. (C) CONFIDENTIAL

AL1.1.12. CAB Civil Aeronautics Board AL1.1.13. CAGE Commercial and Government Entity

Number (formerly FSC) AL1.1.14. CBL Commercial Bill(s) of Lading AL1.1.15. CDSS Canadian Department of Supply and Services AL1.1.16. CENTO Central Treaty Organization AL1.1.17. CM Candidate Material AL1.1.18. CNWDI Critical Nuclear Weapon

Design Information AL1.1.19. Cog Cognizant AL1.1.20. COMINT Communications Intelligence AL1.1.21. COMSEC Communications Security AL1.1.22. CONUS Continental United States AL1.1.23. COR Central Office of Record AL1.1.24. COSMIC-TOP SECRET Property of NATO and Subject to Special Security Controls AL1.1.25. CSISM COMSEC Supplement to the

Industrial Security Manual AL1.1.26. CSO Cognizant Security Office AL1.1.27. CVA Central Verifications Activity AL1.1.28. DCASR Defense Contract Administration

Services Region

9 ABBREVIATIONS AND/OR ACRONYMS

AL1.1.29. DCII Defense Central Index of Investigations

AL1.1.30. DGSC Defense General Supply Center AL1.1.31. DIA Defense Intelligence Agency AL1.1.32. DIPP Defense Industrial Facilities

Protection Program AL1.1.33. DIS Defense Investigative Service AL1.1.34. DISCO Defense Industrial Security

Clearance Office

AL1.1.35. DISCR,OGC,

OSD

Director for Industrial Security Clearance Review, Office of the General Counsel, Office of Secretary of Defense

AL1.1.36. DISP Defense Industrial Security Program

AL1.1.37. DSI Defense Security Institute AL1.1.38. DLA Defense Logistics Agency AL1.1.39. DNACC Defense National Agency Check Center AL1.1.40. DoD Department of Defense AL1.1.41. DoDAAD Department of Defense Activity Address

Directory AL1.1.42. DOE Department of Energy (formerly ERDA) AL1.1.43. DOIS Director, Office of Industrial Security AL1.1.44. DOJ Department of Justice AL1.1.45. DOT Department of Transportation AL1.1.46. DSP&P Director for Security Plans and Programs, Office of the Deputy Under Secretary of Defense for Policy Review

AL1.1.47. DTIC Defense Technical Information Center AL1.1.48. DUSD Deputy Under Secretary of Defense AL1.1.49. DUSD(P) Deputy Under Secretary of Defense for Policy AL1.1.50. EEFI Essential Elements of Friendly Information AL1.1.51. ENAC Expanded National Agency Check AL1.1.52. E.O. Executive Order AL1.1.53. EPA Environmental Protection Agency AL1.1.54. FAA Federal Aviation Agency

(presently Federal Aviation Administration, Department of Transportation)

AL1.1.55. FAR Federal Acquisition Regulation

10 ABBREVIATIONS AND/OR ACRONYMS

AL1.1.56. FBI Federal Bureau of Investigation AL1.1.57. FCL Facility Security Clearance AL1.1.58. FEMA Federal Emergency Management Agency AL1.1.59. FMS Foreign Military Sales AL1.1.60. FOCI Foreign Ownership, Control, or Influence

AL1.1.61. (FRD) FORMERLY RESTRICTED DATA

AL1.1.62. FRS Federal Reserve System AL1.1.63. FSC Federal Supply Code (see CAGE) AL1.1.64. FSO Facility Security Supervisor/Officer AL1.1.65. FSS Federal Supply Schedule AL1.1.66. GAO General Accounting Office AL1.1.67. GBL Government Bill(s) of Lading AL1.1.68. GFE Government-Furnished Equipment AL1.1.69. GFP Government-Furnished Property AL1.1.70. GPO Government Printing Office AL1.1.71. GSA General Services Administration AL1.1.72. GSOIA General Security of Information Agreement AL1.1.73. HOF Home Office Facility AL1.1.74. HOIS Hostile Intelligence Services AL1.1.75. HQ Headquarters AL1.1.76. ICC Interstate Commerce Commission AL1.1.77. IFB Invitation for Bid AL1.1.78. INSCOM Intelligence and Security Command AL1.1.79. IPO International Pact Organization AL1.1.80. ISB Industrial Security Bulletin AL1.1.81. ISL Industrial Security Letter AL1.1.82. ISM "Industrial Security Manual for

Safeguarding Classified Information" (DoD 5220.22-M)

AL1.1.83. ISR "Industrial Security Regulation" (DoD 5220.22-R) AL1.1.84. ITAR "International Traffic in Arms Regulations" AL1.1.85. KGB Committee on State Security (Soviet Union) AL1.1.86. LOC Letter of Consent (DISCO Form 560) AL1.1.87. MAAG Military Assistance Advisory Group AL1.1.88. MAP Mutual Aid Program AL1.1.89. MDAP Mutual Defense Assistance Program AL1.1.90. MFO Multiple Facility Organization AL1.1.91. MIL-STD Military Standard (Book Form) AL1.1.92. MTMC Military Traffic Management Command

(formerly MTKRS)

11 ABBREVIATIONS AND/OR ACRONYMS

AL1.1.93. N/A Not Applicable AL1.1.94. NAC National Agency Check AL1.1.95. NASA National Aeronautics and Space

Administration AL1.1.91. NATO North Atlantic Treaty Organization AL1.1.92. NCSC National Communications Security

Committee AL1.1.93. NIS Naval Investigative Service AL1.1.94. NPLO NATO Production Logistics Organization AL1.1.95. NRC Nuclear Regulatory Comission AL1.1.96. NSA National Security Agency AL1.1.97. NSF National Science Foundation AL1.1.98. OASD(C) Office of the Assistant Secretary of Defense

(Comptroller) AL1.1.99. OASD(PA) Office of the Assistant Secretary of Defense

(Public Affairs) AL1.1.100. OGC Office of General Counsel AL1.1.101. OISI Office of Industrial Security International AL1.1.102. OODEPs Owners, Officers, Directors, Partners, Regents, Trustees, or Executive Personnel AL1.1.103. OPSEC Operations Security AL1.1.104. OSD Office of Secretary of Defense AL1.1.105. OSI Office of Special Investigations, USAF AL1.1.106. PCO Procuring Contracting Officer AL1.1.107. PCL Personnel Security Clearance AL1.1.108. PIC Personnel Investigations Center AL1.1.109. PMF Principal Management Facility AL1.1.110. PRP Personnel Reliability Program AL1.1.111. PSCF Industrial Personnel Security Clearance

Files (formerly CIF) AL1.1.112. PSQ Personnel Security Questionnaire AL1.1.113. PSS Protective Security Service

AL1.1.114. (RD) RESTRICTED DATA

AL1.1.115. RFI Representative of a Foreign Interest AL1.1.116. RFP Request for Proposal AL1.1.117. RFQ Request for Quote

AL1.1.118. (S) SECRET

AL1.1.119. SAP Special Access Program AL1.1.120. SBA Small Business Administration

12 ABBREVIATIONS AND/OR ACRONYMS

AL1.1.121. SCI Sensitive Compartmented Information AL1.1.122. SEATO Southeast Asia Treaty Organization AL1.1.123. SIOP Single Integrated Operational Plan AL1.1.124. SPP Standard Practice Procedure(s) AL1.1.125. SSS Signature Security Service AL1.1.126. TO Transportation Officer

AL1.1.127. (TS) TOP SECRET

AL1.1.128. TSEC U.S. Telecommunications Security AL1.1.129. TWX Teletype Communications

AL1.1.130. (U) UNCLASSIFIED

AL1.1.131. UA User Agency AL1.1.132. U.K. United Kingdom AL1.1.133. UL Underwriters' Laboratories AL1.1.134. U.S. United States AL1.1.135. USAFSS U.S. Air Force Security Service AL1.1.136. USASTRATCOM U.S. Army Strategic Communications

Command AL1.1.137. U.S.C United States Code AL1.1.138. USIA U.S. Information Agency AL1.1.139. USIB U.S. Intelligence Board

13 ABBREVIATIONS AND/OR ACRONYMS

C1. CHAPTER 1

GENERAL PROVISIONS

C1.1. INTRODUCTION

C1.1.1. Objective. The security of the United States depends in part on the proper safeguarding of classified information released to industry. The objective of the DoD Industrial Security Program is to ensure the safeguarding of classified information in the hands of U.S. industrial organizations, educational institutions, and all organizations and facilities used by prime and subcontractors, hereinafter referred to as "industry."

The objective of this Regulation is to set forth policies, practices, and procedures of the DoD Industrial Security Program used internally by the Department of Defense to ensure maximum uniformity and effectiveness in its application throughout industry.

The "Industrial Security Manual for Safeguarding Classified Information (ISM)," DoD 5220.22-M (reference (a)), as a companion document to this Regulation, is a DoD publication that contains detailed security requirements to be followed by U.S.

contractors for safeguarding classified information. The ISM is made applicable to industry by execution of the "DoD Security Agreement" (DD Form 441), and by direct reference in the "Security Requirements Clause" in the contract. Should there develop any conflict in instructions between the ISM and this Regulation, such conflict shall be reported to the Director, Defense Investigative Service (DIS), ATTN: Deputy Director (Industrial Security). Pending resolution, the provisions of this Regulation shall govern.

C1.1.2. Authority and Scope. This Regulation, authorized by the Secretary of Defense under the authority of the National Security Act of 1947, as amended, is established as a DoD Regulation published by Headquarters (HQ) Defense Investigative Service (DIS) under the authority of DoD Directive 5220.22 (reference (a)).

C1.1.2.1. This Regulation is applicable to the OSD (including all of its boards, councils, staffs, and commands), DoD Agencies, and the Departments of the Army, the Navy, and the Air Force (including all of their activities), hereinafter referred to as User Agencies (UAs), in all industrial security relationships with industry.

C1.1.2.2. The Secretary of Defense is authorized to act on behalf of the UAs listed in paragraph C1.2.90.

C1.1.2.3. The DIS shall administer the DoD Industrial Security Program on behalf of all UAs.

14 CHAPTER 1

C1.1.2.3.1. The Regional Directors of DIS have the authority and responsibility for administration of the DoD Industrial Security Program within their respective regions. The offices of the Directors of Industrial Security are designated as the cognizant security offices (CSOs) for all contractor facilities within their jurisdictions and are responsible for the performance of CSO functions prescribed in this Regulation, except for certain security actions noted elsewhere herein that may be performed by the Commander or Head of a UA installation or the Regional Directors of DIS. Facility security clearances (FCLs) shall be granted by the CSO.

C1.1.2.3.2. The Director, Defense Industrial Security Clearance Office (DISCO), DIS, Columbus, Ohio 43216, shall assume responsibility for processing and granting all industrial personnel security clearances (PCLs) (except for contractor-granted CONFIDENTIAL clearances), including those PCLs for contractor personnel located on a UA installation, and for maintaining an industrial personnel security clearance file (PSCF) of PCLs and FCLs.

C1.1.2.3.3. UAs have the authority and exercise the functions of, a contracting activity as prescribed in this Regulation and the ISM, reference (a). Certain of these functions, under the delegation of the Procuring Contracting Officer (PCO), are performed by the Administrative Contracting Officer (ACO) (see Appendix 3).

C1.1.2.4. This Regulation implements the security policies established by the Deputy Under Secretary of Defense for Policy (DUSD(P)) and establishes the procedures, requirements, and practices concerned with the effective protection of classified information in the hands of industry, including foreign classified information that the U.S. Government is obliged to protect, in the interest of national security. UAs are not authorized to require a different standard of industrial security than prescribed herein, except as authorized in paragraph C1.1.16. In addition, this Regulation implements the DoD Operations Security (OPSEC) Program established by DUSD(P) as set forth in DoD Directive 5205.2, "DoD Operations Security Program," (reference (ggg)). Chapter 10 of this Regulation provides amplifying and procedural, guidance for UAs when considering imposition of OPSEC requirements on industry.

C1.1.2.4.1. This Regulation is written in terms of the most common situation where the contractor has access to, or possession of, classified information in connection with the performance of a classified contract. However, it is also applicable to the safeguarding of classified information in connection with all aspects of pre-contract activity, including preparation of bids and proposals and precontract negotiations, and all aspects of post-contract activity. Moreover, the requirements are equally applicable to the safeguarding of classified information not released or

15 CHAPTER 1

disclosed under a procurement contract such as U.S. Government-sponsored independent research and development advance agreements or UA programs participated in by a firm, organization, or individual on a voluntary or grant basis. Examples of the latter programs are long-range scientific and technical planning programs and programs designed to provide planning briefings for industry. Contractors participating in such programs shall be advised of the following: "The recipient shall safeguard all classified material and shall provide and maintain a system of security controls within its organization in accordance with the requirements of: (i) the Department of Defense Security Agreement (DD Form 441), (ii) the ISM (attachment to DD Form 441), and

(iii) any revisions or changes to the ISM required by the demands of national security as determined by the U.S. Government." In such situations, the official of the UA, or designee, who releases or discloses the classified information to the firm, organization, or individual shall fulfill the responsibilities that this Regulation and the ISM (reference (a)) assign to the contracting officer (such as, furnishing necessary classification guidance, authorizing retention of classified material, and certifying contractors need to attend classified meetings).

C1.1.2.4.2. When foreign classified information is made available to a contractor by a UA in connection with a U.S. classified contract, procedures applicable to U.S. classified information shall be used. However, when foreign classified information is made available to U.S. contractors in connection with a foreign classified contract, the responsibility for the actions that this Regulation and the ISM (reference (a)) charge to the contracting officer and the contracting UA shall be as prescribed in subparagraph C8.1.4.4.12. Responsibilities not specifically DoD 5220.22-R-assigned in subparagraph C8.1.4.4.12. are reserved to the foreign government agency or foreign contracting activity concerned.

C1.1.2.4.3. When a report is submitted in accordance with paragraph 6a (18), ISM (reference (a)), the CSO shall contact the originator, or, where appropriate, the authority releasing the classified material to the contractor to:

C1.1.2.4.3.1. Identify the source and contact for obtaining classification guidance relating to the material

C1.1.2.4.3.2. Establish the contractor's need for the material;

C1.1.2.4.3.3. Determine the safeguards that are prescribed for the protection of the material: and

C1.1.2.4.3.4. Determine the disposition instructions that are applicable to the material. Upon receipt of the classification guidance and disposition

16 CHAPTER 1

instructions from the releasing authority, the CSO shall provide such information to the contractor. UAs originating such material, or releasing or authorizing the release of such material to contractors, shall assist CSOs in establishing appropriate guidance and instruction for contractors who receive classified material without proper guidance for its protection and disposition.

C1.1.2.5. Any situation or emergency that indicates a need for clarification, modification, addition, or deletion to this Regulation shall be reported promptly, together with recommendations, through channels to the DIS, ATTN: Deputy Director (Industrial Security). Temporary action is authorized to be taken by a UA to safeguard its classified information in an emergency situation.

C1.1.2.6. This Regulation shall not be construed to limit in any manner the authority of the Secretary of Defense, the Secretaries of the Army, the Navy, and the Air Force, or the Heads of UAs individually, to grant access to classified information under the cognizance of their Department or Agency, to any individual designated by them. The granting of such access is beyond the scope of the DoD Industrial Security Program.

C1.1.2.7. The Deputy Director (Industrial Security), HQ DIS, is responsible for the implementation and administration of security procedures applicable to the transmission of SECRET material by commercial carriers.

C1.1.2.8. The Commander, Military Traffic Management Command (MTMC) is responsible for the implementation and administration of security procedures applicable to the transmission of CONFIDENTIAL materiel by commercial carriers within the continental U.S. (CONUS). Designated Commanders will provide this service in prescribed areas outside the CONUS (also see Appendix 6).

C1.1.2.9. All U.S. Arms Control Disarmament Agency (ACDA) contracts involving contractor access to RESTRICTED DATA are, by separate agreement between ACDA and the Department of Energy (DOE), the responsibility of the DOE.

C1.1.3. Superseded Regulation. This Regulation supersedes the ISR dated February 1984 and Changes thereto.

C1.1.4. Responsibilities. Security responsibility for contracts awarded to industry is set forth below (see Chapter 8 for contracts awarded to foreign industry).

C1.1.4.1. The contractor is required to comply with the security provisions of the ISM (reference (a)) and with any additional security requirements established by the contract, regardless of the geographical location of the classified material.

17 CHAPTER 1

C1.1.4.2. Within the U.S., Puerto Rico, or a U.S. possession or trust territory, the Deputy Director (Industrial Security) shall assume security cognizance for all contractor facilities within the region, and shall perform CSO functions prescribed in this Regulation on behalf of all UAs with respect to all contractor facilities within the region. However, in the case of contractor facilities located on a UA installation, certain security actions may be performed by the Commander or Head of the installation concerned (see paragraph C1.1.9.). The Director of Industrial Security, Pacific Region, is assigned security cognizance for contractor facilities performing in U.S. trust territories or possessions in the Pacific area, and the Director of Industrial Security, Southeastern Region, is assigned security cognizance for contractor facilities performing in Puerto Rico, and U.S. possessions in the Atlantic and Caribbean areas.

The appropriate CSO may make the necessary arrangements with the Commander or Head of the UA installation located closest to the contractor's operations to perform industrial security supervision and inspections of such, operations on his or her behalf.

Upon completion of the arrangement, the CSO will notify the HQ activity of the UA installation involved and the Deputy Director (Industrial Security). HQ DIS, as to the identity and the location of the Commander or activity performing the required industrial security supervision. If the above arrangements are not feasible, a security representative from the appropriate CSO shall make the required security inspections.

The frequency of such inspections may be modified with the approval of the Deputy Director (Industrial Security), HQ DIS.

C1.1.4.3. Outside the areas enumerated in subparagraph C1.1.4.2., above, the UA awarding the classified contract shall assume responsibility for all security aspects of contract supervision (see paragraph C1.1.17.) unless the UA requests this responsibility be undertaken by DIS.

C1.1.4.4. The Director, DISCO shall assume responsibility for all industrial PCL functions prescribed by this Regulation. Except in cases pertaining to owners, officers, directors, partners, regents, trustees, or executive personnel (OODEPs), which are transmitted through the CSO, contractors deal directly with DISCO on all PCLs, transfers of PCLs, and issuances of security assurances. The DISCO shall:

C1.1.4.4.1. Process and issue PCLs for contractor personnel, including those employees located on UA installations;

C1.1.4.4.2. Maintain the PSCF of contractor FCLs and PCLs;

C1.1.4.4.3. On request, furnish PCL information on contractor employees, including those on UA installations;

18 CHAPTER 1

C1.1.4.4.4. On application by a U.S. contractor, make a security assurance determination predicated upon a Letter of Consent (LOC) (DISCO Form 560); and

C1.1.4.4.5. Advise the Commander or Head of a UA installation whenever the security clearance for a contractor employee, who is duty stationed with a contractor activity on his/her installation, has been suspended, denied, or revoked.

C1.1.4.5. When shipping SECRET material by commercial carrier, UAs are from MTMC, and responsible for obtaining the necessary routing instructions for utilizing a carrier that has been qualified by MTMC and has been granted an appropriate FCL by the CSO. The MTMC, in turn, shall be responsible for ensuring that a qualified carrier, which has been granted an appropriate FCL by the CSO is used,1 except where use of prepaid commercial bill of lading (CBL) has been authorized in the appropriate contract or approved by the contracting officer concerned.2 SECRET material shall be shipped by Government bill of lading (GBL) or CBL annotated thereon: "To be converted to a Government Bill of Lading." In addition, the notation, "Protective Security Service Required," shall be reflected on all copies of the bill of lading (BL).

An annotated GBL must be converted to a CBL before payment is made. The BLs will be maintained in a suspense file to follow up on overdue or delayed shipments.

C1.1.5. Arrangement of Regulation. This Regulation covers the essential policies and procedures with respect to safeguarding classified information. It is divided into chapters, sections, and paragraphs. Each chapter is designated by subject, and covers a separate aspect of industrial security. The sections are designated by title and contain a breakdown of the subject covered by the chapter into related divisions. The paragraphs are a further division of the sections. The Regulation is designed to permit subsequent insertions of additional sections and paragraphs within the appropriate chapter.

C1.1.6. Amendment of Regulation. This Regulation will be amended from time to time. Unless otherwise specified in any amendment, compliance with an amendment shall not be mandatory until 30 days after date of publication, although compliance shall be authorized from the date of its publication.

1 Non-DoD UAs may issue their own routing instructions; however, when doing so they will ensure that only commercial carriers that have been qualified by MTMC and granted an appropriate FCL by the CSO are utilized.

2 In such cases, the SECRET shipment shall be routed via a cleared commercial carrier under a tariff, tender, or contract that provides PSS in accordance with DoD 5220.22-C (reference (b)).

19 CHAPTER 1

C1.1.7. Distribution and Use of Regulation. This Regulation is intended for the use and guidance of industrial security and procurement activities of the UAs. It shall be distributed through normal channels to staff and operating activities concerned with industrial security and procurement matters. This Regulation is not applicable to industrial management, and is not intended for distribution to industry. Parts or all of this Regulation may be made available to industrial management, when judged to be in the interest of a UA.

C1.1.8. User Agency Procedures Under This Regulation. UAs may augment this Regulation by prescribing more detailed regulations and operating instructions as may be required and that are not inconsistent with this Regulation. The application of these procedures shall be guided by the twofold objective of establishing uniformity and maintaining maximum security, consistent with the accomplishment by each UA of its assigned mission. Two copies of each implementing regulation or instruction issued by a UA shall be furnished to the Director, DIS, ATTN: Deputy Director (Industrial Security) for information.

C1.1.9. Contractor Activities on a User Agency Installation

C1.1.9.1. The Commander or Head of a UA installation shall provide security supervision of contractors and their employees located on the installation as follows:

C1.1.9.1.1. For installations located outside of the U.S., Puerto Rico, or a U.S. possession or trust territory, the contractor and his or her employees shall be considered to be visitors. In such cases the procedures set forth in subparagraph C1.1.9.5., below, shall apply.

C1.1.9.1.2. For installations located within the U.S., Puerto Rico, or a U.S. possession or trust territory, the contractor and his or her employees shall be considered to be visitors, or the Commander or Head of the installation may elect to declare the contractor activity a facility under one of the following criteria if the:

C1.1.9.1.2.1. Contractor's operation is sufficiently complex to warrant assignment of an area such as a suite of offices, a building or portion thereof, or a segregated work area;

C1.1.9.1.2.2. Contractor's operation is to be of a quasi-permanent nature;

C1.1.9.1.2.3. Contractor maintains management control over his or her operations; or

20 CHAPTER 1

C1.1.9.1.2.4. Contractor is in a position to maintain separate security procedures. FCLs shall not be established on the installation solely for the purpose of permitting a contractor entry authorization into a controlled area unless access to classified information is required in the performance of the contract.

C1.1.9.2. If, in light of the foregoing, the Commander or Head of the UA installation decides that the contractor's on-installation activity requires a FCL, he or she shall request the CSO in whose geographical area the installation is located (see Appendix 2 for listing of CSOs and boundaries) to assume security cognizance of the facility. The Commander or Head of the installation shall request the CSO to perform all cognizant security functions provided for in this Regulation, or he or she shall notify the CSO in writing that he or she has elected to perform the following security actions.

C1.1.9.2.1. Accomplish the FCL survey and furnish the CSO a copy of the "Facility Security Clearance Survey" (DD Form 374), the DD Form 441 or the "Appendage to Department of Defense Security Agreement" (DD Form 441-1), the "Certificate Pertaining to Foreign Interests" (DD Form 441s), and exclusion certificates, as required.

C1.1.9.2.2. Ensure that the contractor has prepared a standard practice procedure (SPP), covering the contractor's operations on the UA installation.

C1.1.9.2.3. Ensure that the contractor observes required security controls through periodic inspections in accordance with the schedule prescribed by paragraph C4.1.4., and furnish to contractors letters of requirements resulting from such inspections, if appropriate.

C1.1.9.2.4. Ensure that the contractor maintains engagement control over his or her operations.

C1.1.9.2.5. Ensure that prompt remedial action is taken where security conditions are deficient in the contractor's operation.

C1.1.9.2.6. Review, when appropriate, contractor control of incoming visitors to contractor facilities on the installation.

C1.1.9.2.7. Ensure that the DoD security education program is implemented by the contractor and, as required, conduct defensive security briefings required by paragraph 5u, ISM (reference (a)).

21 CHAPTER 1

C1.1.9.2.8. Conduct investigation of contractor security violations, including loss, compromise, or suspected compromise of classified information in accordance with Chapter 5. If the services of a governmental investigative agency are required, request services from the appropriate military investigative agency.

C1.1.9.2.9. Furnish to the facility, guidance on the application of security requirements including establishment or disestablishment of closed or restricted areas.

Requests from the contractor for interpretations of the requirements of the ISM shall be forwarded to the CSO.

C1.1.9.2.10. Request from DISCO interim PCLs for contractor personnel when required to prevent crucial delay in the negotiations or performance of the contract.

C1.1.9.2.11. Ensure that the contractor reports promptly to the CSO and the Commander or Head of the UA installation any incidents that involve espionage, sabotage, subversive activity, or the loss, compromise, or suspected compromise of classified information.

C1.1.9.2.12. Recommend to the CSO the termination, revocation, or suspension of the FCL, as appropriate.

C1.1.9.2.13. Conduct the briefing and debriefing of the facility security supervisor (FSO), the COMSEC custodian, and alternate COMSEC custodian when there is a COMSEC account or there is a requirement to establish a COMSEC account (see paragraph C2.3.15.). Brief and debrief only the FSO if no COMSEC account is required.

C1.1.9.3. When the security actions outlined in subparagraph C1.1.9.2., above, are performed by the Commander or Head of the installation, the following actions shall be accomplished by the CSO:

C1.1.9.3.1. Grant the FCL to the contractor provided the pre-clearance survey has been completed and the required forms are in order.

C1.1.9.3.2. Assign an industrial security specialist to accompany the installation security inspector during special or scheduled inspections upon request or as otherwise appropriate after coordination with the Commander or Head of the UA installation.

22 CHAPTER 1

C1.1.9.3.3. Verify FCL and safeguarding ability, when requested (see subparagraph C1.1.11.2.).

C1.1.9.3.4. Terminate, revoke, or suspend FCLs, as appropriate.

C1.1.9.4. Reports of initial "Facility Security Clearance Survey," recurring inspections reported on "Industrial Security Inspection Report" (DD Form 696), letters of requirements to the contractor, and reports resulting from investigations conducted in accordance with Chapter 5 shall be exchanged between the Commander or Head of the UA installation and the CSO.

C1.1.9.5. If the Commander or Head of the UA installation does not elect to clear contractors on his or her installation as facilities, he or she shall provide appropriate security supervision and shall be responsible for the following:

C1.1.9.5.1. Provide written instructions specifying those security actions:

C1.1.9.5.1.1. That will be performed for the contractor by the installation, such as providing storage facilities, guard service, mail and freight services, and visit control; and

C1.1.9.5.1.2. For which joint action may be required, such as the packaging and addressing of classified transmittals, and control of visitors.

C1.1.9.5.2. Ensure that the contractor has prepared a SPP covering the contractor's activities on the UA installation, if appropriate.

C1.1.9.5.3. Ensure that the contractor observes required security controls through periodic inspections in accordance with the schedule prescribed by paragraph C4.1.4., and furnish to contractors letters of requirements resulting from such inspections, if appropriate.

C1.1.9.5.4. Ensure that prompt remedial action is taken when security conditions are deficient in the contractor's operation.

C1.1.9.5.5. Ensure that the DoD security education program is implemented by contractors and, as required, conduct defensive security briefings required by paragraph 5u, ISM (reference (a)).

C1.1.9.5.6. Conduct investigation of contractor security violations, including loss, compromise, or suspected compromise of classified information.

23 CHAPTER 1

C1.1.9.5.7. Conduct the briefing and debriefing of the FSO, the COMSEC custodian, and alternate COMSEC custodian when there is a COMSEC account or there is a requirement to establish a COMSEC account (see paragraph C2.3.15.). Brief and debrief only the FSO if no COMSEC account is required.

C1.1.9.5.8. Furnish to the contractor guidance on the application of security requirements to the contractor's operations.

C1.1.9.5.9. Forward requests from the contractor for interpretations of the ISM (reference (a)) to the CSO.

C1.1.9.5.10. Request from DISCO interim PCLs for contractor personnel, when required, to prevent crucial delay in the performance of the contract.

C1.1.9.5.11. Ensure that the contractor reports promptly any incidents that involve espionage, sabotage, subversive activity, or the loss, compromise, or suspected compromise of classified information. In addition, the CSO of the visiting contractor's facility shall be advised concerning the incident.

C1.1.9.6. For those installations located outside of the U.S., Puerto Rico, or a U.S. possession or trust territory, where the Commander or Head of the UA installation has relinquished security responsibilities to DIS, the Office of Industrial Security International (OISI) and/or the appropriate CSO will be responsible for ensuring that the security actions outlined in subparagraph C1.1.9.5., above, are accomplished.

C1.1.10. Expenditure of Funds for Security. The CSO shall not commit the Government to reimburse the management of a facility for funds expended in connection with the facility's security program. In the case of a cost-reimbursement-type contract, the allowability of security costs is determined by the contracting officer in accordance with the terms of the contract and with the cost principles of the Federal Acquisition Regulation (FAR) (reference (gg)). Under a fixed-price contract, the initial contract price includes all applicable security costs. An equitable adjustment may be made in the initial contract price when, as indicated in the contract security clause, the security classification or security requirements under the contract are changed by the Government and the change results in an increase or decrease in the contract price.

24 CHAPTER 1

C1.1.11. Disclosure of Classified Information to a Contractor by User Agency Contracting Activities

C1.1.11.1. Prior to the disclosure of any classified information to a facility, the contracting activity of the UA shall determine that the contractor's facility has a valid FCL equal to, or higher than, the category of classified information to be disclosed. If the facility will be required to have physical possession of classified material, the contracting activity shall also determine that the facility has the ability to properly safeguard the classified information to be disclosed to, or developed by, the facility. (This determination may be made at the same time as the FCL verification.)

Such determinations shall be based on the:

C1.1.11.1.1. Contracting activity's knowledge of the ability of the facility to adequately safeguard the material to be developed or released, based upon a current contractual relationship involving classified material of the same or higher category as that to be released or developed under the new contract or program; or

C1.1.11.1.2. Written verification by the Personnel Investigations Center (PIC) - Central Verifications Activity (CVA),3 mailing address:

Defense Investigative Service

PIC-CVA

P.O. Box 1211 Baltimore, MD 21203-1211 Telephone Number: (301) 633-4820 or the CSO if appropriate, of the safeguarding ability of the facility in the event that the procuring contracting activity does not have the knowledge required in subparagraph C1.1.11.1.1., above. In this connection, the contracting activity shall furnish to the PIC-CVA or CSO of the facility information available (description, quantity, end item, and classification of the information related to the proposed contract or program, and any other facts) to assist the PIC-CVA or CSO in making such a determination.

3 Under the following circumstances, the PIC-CVA will not be able to respond and requesters shall make inquiries to the appropriate CSO: (1) requests involving the transfer of material that would require more than two cubic feet of storage,

(2) requests involving commercial carriers under the provision of paragraph 17c(5)(c), Industrial Security Manual (reference (a)), and (3) requests for certification of security clearance and safeguarding ability to the Defense Technical Information Center.

25 CHAPTER 1

C1.1.11.2. The PIC-CVA, or the CSO if appropriate, shall furnish written verification to the contracting activity as to whether a facility has an appropriate FCL and has the appropriate safeguarding capability for the classified material involved.

Unless otherwise notified (superseded) in writing by the PIC-CVA or CSO, each verification furnished in accordance with this paragraph shall remain valid for a period of 1 calendar year from the date of issuance. In the event a FCL has not been issued, the requester shall be so advised. Further action shall not be taken unless a formal request to clear the facility is received by the CSO.

C1.1.11.3. The verification of safeguarding ability furnished by the PIC-CVA or CSO shall be based upon inspections conducted in accordance with this Regulation, or in the event the facility is not on the current inspection schedule, upon a visit that has been made to the facility to obtain the required data. Written verification shall be dispatched within 5-working days from receipt of inquiry.

C1.1.11.4. In the event the FCL must be revalidated or raised to an appropriate level, or the facility must provide adequate safeguards in order to comply with the requirements of the ISM (reference (a)), the requestor shall contact the CSO, which will advise them of the nature of such actions, and of the estimated time required to complete such actions. Moreover, the requester shall be asked to advise as to whether the CSO should initiate action to have the FCL revalidated or raised to an appropriate level. Additional action shall not be taken by the CSO unless the requester advises that it is necessary to bring the FCL to a valid status. In such cases, appropriate action shall be initiated promptly by the CSO and the requester shall be informed when action is completed.

C1.1.11.5. When noncontract-related classified material is released under a Scientific and Technical Information Release Program, or a classified contract is awarded that requires classified reports to be disseminated to other individuals or firms in accordance with a standard mailing or distribution list, the sponsoring, releasing, or contracting activity, as appropriate, has the following responsibilities in order to make certain the intended recipients are eligible to receive the classified information.

C1.1.11.5.1. Verify initially the need-to-know, FCL, and safeguarding capability of the recipients of the reports, unless this requirement is levied on the prime contractor.

26 CHAPTER 1

C1.1.11.5.2. Ensure that the recipients of classified material are provided appropriate classification guidance and instructions, to ensure proper identification, control, accountability, handling, protection, and ultimate disposition of classified information, to include specific retention authority, which the individual or company may be required to use in its operations and for discussions involving classified information.

C1.1.11.5.3. Notify appropriate PIC-CVA, or appropriate CSO(s), if applicable, and the prime contractor of any change in the mailing list.

C1.1.11.5.4. Require in the contract or other appropriate written notification that the releasing activity or the prime contractor making the distribution of the reports determines the storage and safeguarding capability of the recipient from the PIC-CVA, or appropriate CSO, if applicable, prior to making the first release of any reports. Subsequent releases of material may be made without reverification of storage and safeguarding ability until such time as the distribution list is revised to delete the recipient.

C1.1.11.6. The FCL verification notification shall be retained for 1 year, after which it shall be destroyed. The recipient of the verification notification shall be immediately notified should a change occur adversely affecting the level of the FCL or the safeguarding ability of the facility.

C1.1.11.7. The DISCO shall not verify FCLs or safeguarding ability. This information shall be obtained from the PIC-CVA or the CSO of the facility, if applicable.

C1.1.12. Disclosure of Classified Information to a Subcontractor by a Prime Contractor.

C1.1.12.1. Prior to the disclosure of any classified information to a subcontractor, the prime contractor shall determine that the subcontractor has a valid FCL equal to or higher than the category of classified information to be disclosed, unless there is an existing contractual relationship between the parties involving classified information of the same or higher category as that to be released or developed under the new subcontract. A prime contractor, having verified a prospective subcontractor's FCL, shall obtain the written approval of the contracting office of the

27 CHAPTER 1

private contract concerned, prior to disclosure of TOP SECRET information4 to the prospective subcontractor.

C1.1.12.2. If the prospective subcontractor will be required to have physical possession of TOP SECRET, SECRET, or CONFIDENTIAL material during the pre-contract or performance stages of the classified subcontract, the prime contractor shall, in addition to verifying the subcontractor's FCL, also determine that the subcontractor has the ability to…