DOD_5220.22-M.pdf

DoD 5220.22-M

NATIONAL

INDUSTRIAL

SECURITY

PROGRAM

OPERATING

MANUAL

February 28, 2006

February 28, 2006

FOREWORD

As required by Executive Order 12829 and under the authority of DoD Directive 5220.22, “National Industrial Security Program (NISP),” September 27, 2004, this Manual reissues DoD 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM),” January 1995 (hereby canceled). It provides baseline standards for the protection of classified information released or disclosed to industry in connection with classified contracts under the NISP.

This Manual cancels DoD 5220.22-S-1, “COMSEC Supplement to the Industrial Security Manual for Safeguarding Classified Information,” August 1983.

Users of the NISPOM are encouraged to submit recommended changes through their Cognizant Security Agency to the designated representative of the Secretary of Defense in his capacity as the Executive Agent for the NISP pursuant to Presidential guidance at the following address:

Department of Defense Under Secretary of Defense for Intelligence ATTN: OUSD(I)/ODUSD(CI&S), Room 3A666 5000 Defense Pentagon Washington, D.C. 20301-5000

TABLE OF CONTENTS

page

Foreword

Table of Contents

References

AL1. Acronyms

CHAPTER 1. GENERAL PROVISIONS AND REQUIREMENTS

Section 1. Introduction 1-100. Purpose........................................................................................................1-1-1 1-101. Authority.....................................................................................................1-1-1 1-102. Scope ...........................................................................................................1-1-2 1-103. Agency Agreements ..................................................................................1-1-2 1-104. Security Cognizance..................................................................................1-1-2 1-105. Composition of Manual.............................................................................1-1-2 1-106. Manual Interpretations...............................................................................1-1-3 1-107. Waivers and Exceptions to this Manual ..................................................1-1-3 Section 2. General Requirements 1-200. General...........................................................................................................1-2-1 1-201. Facility Security Officer (FSO) ..................................................................1-2-1 1-202. Standard Practice Procedures......................................................................1-2-1 1-203. One-Person Facilities...................................................................................1-2-1

1-204. Cooperation with Federal Agencies and Officially Credentialed Representatives of Those Agencies........................................................................1-2-1

1-205. Security Training and Briefings..................................................................1-2-1 1-206. Security Reviews..........................................................................................1-2-1 1-207. Hotlines..........................................................................................................1-2-1 1-208. Classified Information Procedures Act (CIPA)........................................1-2-2 Section 3. Reporting Requirements 1-300. General ........................................................................................................1-3-1 1-301. Reports to be Submitted to the FBI..........................................................1-3-1 1-302. Reports to be Submitted to the CSA........................................................1-3-1 1-303. Reports of Loss, Compromise, or Suspected Compromise...................1-3-2 1-304. Individual Culpability Reports..................................................................1-3-3

CHAPTER 2. SECURITY CLEARANCES

Section 1. Facility Clearances 2-100. General ........................................................................................................2-1-1 2-101. Reciprocity..................................................................................................2-1-1

2-102. Eligibility Requirements............................................................................2-1-1 2-103. Processing the FCL....................................................................................2-1-1 2-104. PCLs Required in Connection with the FCL..........................................2-1-1 2-105. PCLs Concurrent with the FCL................................................................2-1-1 2-106. Exclusion Procedures ................................................................................2-1-1 2-107. Interim FCLs ..............................................................................................2-1-2 2-108. Multiple Facility Organizations (MFOs).................................................2-1-2 2-109. Parent-Subsidiary Relationships...............................................................2-1-2 2-110. Termination of the FCL.............................................................................2-1-2 2-111. Records Maintenance ................................................................................2-1-2 Section 2. Personnel Security Clearances 2-200. General ........................................................................................................2-2-1 2-201. Investigative Requirements.......................................................................2-2-1 2-202. Procedures for Completing the Electronic Version of the SF 86..........2-2-1 2-203. Common Adjudicative Standards ............................................................2-2-2 2-204. Reciprocity..................................................................................................2-2-2 2-205. Pre-employment Clearance Action..........................................................2-2-2 2-206. Contractor-Granted Clearances ................................................................2-2-2 2-207. Verification of U.S. Citizenship ...............................................................2-2-2 2-208. Acceptable Proof of Citizenship...............................................................2-2-2 2-209. Non-U.S. Citizens ......................................................................................2-2-3 2-210. Access Limitations of an LAA.................................................................2-2-3 2-211. Interim PCLs ..............................................................................................2-2-3 2-212. Consultants .................................................................................................2-2-3 Section 3. Foreign Ownership, Control, or Influence (FOCI) 2-300. Policy .............................................................................................................2-3-1 2-301. Factors............................................................................................................2-3-1 2-302. Procedures.....................................................................................................2-3-2 2-303. FOCI Action Plans.......................................................................................2-3-2 2-304. Citizenship of Persons Requiring PCLs....................................................2-3-3 2-305. Qualifications of Trustees, Proxy Holders, and Outside Directors ........2-3-4 2-306. GSC................................................................................................................2-3-4 2-307. TCP................................................................................................................2-3-4 2-308. Annual Review and Certification...............................................................2-3-4 2-309. Limited FCL .................................................................................................2-3-5

2-310. Foreign Mergers, Acquisitions and Takeovers and the Committee on Foreign Investment in the United States (CFIUS) ...............................................2-3-5

CHAPTER 3. SECURITY TRAINING AND BRIEFINGS

Section 1. Security Training and Briefings 3-100. General ........................................................................................................3-1-1 3-101. Training Materials......................................................................................3-1-1 3-102. FSO Training..............................................................................................3-1-1 3-103. Government-Provided Briefings ..............................................................3-1-1 3-104. Temporary Help Suppliers........................................................................3-1-1

3-105. Classified Information Nondisclosure Agreement (SF 312).................3-1-1 3-106. Initial Security Briefings............................................................................3-1-1 3-107. Refresher Training .....................................................................................3-1-1 3-108. Debriefings .................................................................................................3-1-1

CHAPTER 4. CLASSIFICATION AND MARKING

Section 1. Classification 4-100. General..................................................................................................... 4-1-1 4-101. Original Classification............................................................................ 4-1-1 4-102. Derivative Classification Responsibilities............................................ 4-1-1 4-103. Security Classification Guidance .......................................................... 4-1-1 4-104. Challenges to Classification................................................................... 4-1-2 4-105. Contractor Developed Information ....................................................... 4-1-2 4-106. Classified Information Appearing in Public Media............................. 4-1-2 4-107. Downgrading or Declassifying Classified Information....................... 4-1-3 Section 2. Marking Requirements 4-200. General ........................................................................................................4-2-1 4-201. Marking Requirements for Information and Material............................4-2-1 4-202. Identification Markings .............................................................................4-2-1 4-203. Overall Markings .......................................................................................4-2-1 4-204. Page Markings............................................................................................4-2-1 4-205. Component Markings................................................................................4-2-1 4-206. Portion Markings........................................................................................4-2-1 4-207. Subject and Title Markings.......................................................................4-2-2 4-208. Markings for Derivatively Classified Documents..................................4-2-2 4-209. Documents Generated Under Previous E.O.s.........................................4-2-3 4-210. Marking Special Types of Material..........................................................4-2-3 4-211. Marking Transmittal Documents .............................................................4-2-3 4-212. Marking Wholly Unclassified Material...................................................4-2-3 4-213. Marking Compilations...............................................................................4-2-3 4-214. Marking Miscellaneous Material .............................................................4-2-4 4-215. Marking Training Material........................................................................4-2-4 4-216. Downgrading or Declassification Actions ..............................................4-2-4 4-217. Upgrading Action.......................................................................................4-2-4 4-218. Inadvertent Release....................................................................................4-2-4

CHAPTER 5. SAFEGUARDING CLASSIFIED INFORMATION

Section 1. General Safeguarding Requirements 5-100. General...........................................................................................................5-1-1 5-101. Safeguarding Oral Discussions...................................................................5-1-1 5-102. End of Day Security Checks.......................................................................5-1-1 5-103. Perimeter Controls........................................................................................5-1-1 5-104. Emergency Procedures................................................................................5-1-1

Section 2. Control and Accountability 5-200. Policy...........................................................................................................5-2-1 5-201. Accountability for TOP SECRET............................................................5-2-1 5-202. Receiving Classified Material...................................................................5-2-1 5-203. Generation of Classified Material ............................................................5-2-1 Section 3. Storage and Storage Equipment 5-300. General...........................................................................................................5-3-1 5-301. GSA Storage Equipment.............................................................................5-3-1 5-302. TOP SECRET Storage................................................................................5-3-1 5-303. SECRET Storage .........................................................................................5-3-1 5-304. CONFIDENTIAL Storage .........................................................................5-3-1 5-305. Restricted Areas............................................................................................5-3-1 5-306. Closed Areas.................................................................................................5-3-1 5-307. Supplemental Protection..............................................................................5-3-2 5-308. Protection of Combinations to Security Containers, Cabinets, Vaults and Closed Areas......................................................................................................5-3-2 5-309. Changing Combinations..............................................................................5-3-2 5-310. Supervision of Keys and Padlocks.............................................................5-3-2 5-311. Repair of Approved Containers..................................................................5-3-2 5-312. Supplanting Access Control Systems or Devices ....................................5-3-3 5-313. Automated Access Control Systems..........................................................5-3-3 5-314. Electronic, Mechanical, or Electro-mechanical Devices.........................5-3-4 Section 4. Transmission 5-400. General ........................................................................................................5-4-1 5-401. Preparation and Receipting.......................................................................5-4-1 5-402. TOP SECRET Transmission Outside a Facility.....................................5-4-1 5-403. SECRET Transmission Outside a Facility..............................................5-4-1 5-404. CONFIDENTIAL Transmission Outside a Facility..............................5-4-1 5-405. Transmission Outside the United States and Its Territorial Areas........5-4-1 5-406. Addressing Classified Material.................................................................5-4-2 5-407. Transmission Within a Facility.................................................................5-4-2 5-408. SECRET Transmission by Commercial Carrier ....................................5-4-2 5-409. CONFIDENTIAL Transmission by Commercial Carrier ....................5-4-3 5-410. Use of Couriers, Handcarriers, and Escorts.............................................5-4-3 5-411. Use of Commercial Passenger Aircraft for Transmitting Classified Material .................................................................................................5-4-3 5-412. Use of Escorts for Classified Shipments..................................................5-4-4 5-413. Functions of an Escort ...............................................................................5-4-4 Section 5. Disclosure 5-500. General ........................................................................................................5-5-1 5-501. Disclosure to Employees...........................................................................5-5-1 5-502. Disclosure to Subcontractors ....................................................................5-5-1 5-503. Disclosure between Parent and Subsidiaries...........................................5-5-1 5-504. Disclosure in an MFO ...............................................................................5-5-1 5-505. Disclosure to DoD Activities....................................................................5-5-1 5-506. Disclosure to Federal Agencies ................................................................5-5-1

5-507. Disclosure of Classified Information to Foreign Persons ......................5-5-1 5-508. Disclosure of Export Controlled Information to Foreign Persons........5-5-1 5-509. Disclosure to Other Contractors ...............................................................5-5-1 5-510. Disclosure of Classified Information in Connection with Litigation....5-5-1 5-511. Disclosure to the Public.............................................................................5-5-1 Section 6. Reproduction 5-600. General ........................................................................................................5-6-1 5-601. Limitations..................................................................................................5-6-1 5-602. Marking Reproductions.............................................................................5-6-1 5-603. Records........................................................................................................5-6-1 Section 7. Disposition and Retention 5-700. General ........................................................................................................5-7-1 5-701. Retention of Classified Material...............................................................5-7-1 5-702. Termination of Security Agreement ........................................................5-7-1 5-703. Disposition of Classified Material Not Received Under a Specific Contract ...................................................................................................................5-7-1 5-704. Destruction..................................................................................................5-7-1 5-705. Methods of Destruction.............................................................................5-7-1 5-706. Witness to Destruction...............................................................................5-7-2 5-707. Destruction Records...................................................................................5-7-2 5-708. Classified Waste.........................................................................................5-7-2 Section 8. Construction Requirements 5-800. General ........................................................................................................5-8-1 5-801. Construction Requirements for Closed Areas.........................................5-8-1 5-802. Construction Requirements for Vaults ....................................................5-8-1 Section 9. Intrusion Detection Systems 5-900. General ........................................................................................................5-9-1 5-901. CSA Approval............................................................................................5-9-1 5-902. Central Monitoring Station .......................................................................5-9-1 5-903. Investigative Response to Alarms............................................................5-9-1 5-904. Installation...................................................................................................5-9-2 5-905. Certification of Compliance......................................................................5-9-2 5-906. Exceptional Cases ......................................................................................5-9-2

CHAPTER 6. VISITS and MEETINGS

Section 1. Visits 6-100. General ........................................................................................................6-1-1 6-101. Classified Visits..........................................................................................6-1-1 6-102. Need-to-Know Determination..................................................................6-1-1 6-103. Visits by Government Representatives....................................................6-1-1 6-104. Visit Authorization.....................................................................................6-1-1 6-105. Long-Term Visitors ...................................................................................6-1-1 Section 2. Meetings 6-200. General ........................................................................................................6-2-1 6-201. Government Sponsorship of Meetings....................................................6-2-1

6-202. Disclosure Authority at Meetings.............................................................6-2-2 6-203. Requests to Attend Classified Meetings..................................................6-2-2

CHAPTER 7. SUBCONTRACTING

Section 1. Prime Contractor Responsibilities 7-100. General.......................................................................................7-1-1 7-101. Responsibilities..........................................................................7-1-1 7-102. Security Classification Guidance...............................................7-1-1 7-103. Responsibilities (Completion of the Subcontract).....................7-1-2 7-104. Notification of Unsatisfactory Conditions.................................7-1-2

CHAPTER 8. INFORMATION SYSTEM SECURITY

Section 1. Responsibilities and Duties 8-100. General ..............................................................................................................8-1-1 8-101. Responsibilities.................................................................................................8-1-1 8-102. Designated Accrediting/Approving Authority.............................................8-1-1 8-103. IS Security Manager (ISSM)..........................................................................8-1-1 8-104. Information System Security Officer(s) (ISSO) ..........................................8-1-2 8-105. Users of IS.........................................................................................................8-1-3 Section 2. Certification and Accreditation

8-200. Overview........................................................................................................8-2-1 8-201. Certification Process.....................................................................................8-2-1 8-202. Accreditation..................................................................................................8-2-1

Section 3. Common Requirements 8-300. Introduction.................................................................................................8-3-1 8-301. Clearing and Sanitization ..........................................................................8-3-1 8-302. Examination of Hardware and Software .................................................8-3-1 8-303. Identification and Authentication Management .....................................8-3-1 8-304. Maintenance ...............................................................................................8-3-2 8-305. Malicious Code ..........................................................................................8-3-2 8-306. Marking Hardware, Output, and Media ..................................................8-3-3 8-307. Personnel Security......................................................................................8-3-3 8-308. Physical Security .......................................................................8-3-3 8-309. Protection of Media ...................................................................8-3-3 8-310. Review of Output and Media.....................................................8-3-3 8-311. Configuration Management .......................................................8-3-3 Section 4. Protection Measures 8-400. Protection Profiles......................................................................................8-4-1 8-401. Level of Concern........................................................................................8-4-1 8-402. Protection Level .........................................................................................8-4-1 8-403. Protection Profiles......................................................................................8-4-1 Section 5. Special Categories 8-500. Special Categories......................................................................................8-5-1 8-501. Single-user, Stand-alone Systems ............................................................8-5-1

8-502. Periods Processing .....................................................................................8-5-1 8-503. Pure Servers................................................................................................8-5-1 8-504. Tactical, Embedded, Data-Acquisition, and Special-Purpose Systems ...................................................................................................................8-5-2 8-505. Systems with Group Authenticators ........................................................8-5-2 Section 6. Protection Requirements 8-600. Introduction.................................................................................................8-6-1 8-601. Alternate Power Source (Power)..............................................................8-6-1 8-602. Audit Capability.........................................................................................8-6-1 8-603. Backup and Restoration of Data (Backup)..............................................8-6-1 8-604. Changes to data (Integrity)........................................................................8-6-2 8-605. Data Transmission (Trans)........................................................................8-6-2 8-606. Access Controls (Access)..........................................................................8-6-2 8-607. Identification and Authentication (I&A) .................................................8-6-3 8-608. Resource Control (ResrcCtrl) ...................................................................8-6-3 8-609. Session Controls (SessCtrl).......................................................................8-6-3 8-610. Security Documentation (Doc).................................................................8-6-4 8-611. Separation of Function Requirements (Separation) ...............................8-6-5 8-612. System Recovery (SR) ..............................................................................8-6-5 8-613. System Assurance (SysAssur)..................................................................8-6-5 8-614. Security Testing (Test) ..............................................................................8-6-5 8-615. Disaster Recovery Planning......................................................................8-6-6 Section 7. Interconnected Systems

8.700. Interconnected Systems Management......................................................8-7-1 8-701. Controlled Interface (CI) Functions .........................................................8-7-1 8-702. Controller Interface Requirements...........................................................8-7-2 8-703. Assurances for CIs .....................................................................................8-7-2

CHAPTER 9. SPECIAL REQUIREMENTS

Section 1. RD and FRD 9-100. General...........................................................................................................9-1-1 9-101. Authority and Responsibilities....................................................................9-1-1 9-102. Unauthorized Disclosures ...........................................................................9-1-1 9-103. International Requirements.........................................................................9-1-1 9-104. Personnel Security Clearances....................................................................9-1-1 9-105. Classification.................................................................................................9-1-1 9-106. Declassification.............................................................................................9-1-2 9-107. Challenges to RD/FRD Classification.......................................................9-1-2 9-108. Marking .........................................................................................................9-1-2 Section 2. DoD Critical Nuclear Weapon Design Information (CNWDI) 9-200. General...........................................................................................................9-2-1 9-201. Background ...................................................................................................9-2-1 9-202. Briefings.........................................................................................................9-2-1 9-203. Markings........................................................................................................9-2-1 9-204. Subcontractors...............................................................................................9-2-1

9-205. Transmission Outside the Facility...............................................................9-2-1 9-206. Records ..........................................................................................................9-2-1 9-207. Weapon Data.................................................................................................9-2-1 Section 3. Intelligence Information 9-300. Background.................................................................................................9-3-1 9-301. Definitions...................................................................................................9-3-1 9-302. Key Concepts .............................................................................................9-3-1 9-303. Control Markings Authorized for Intelligence Information..................9-3-2 9-304. Limitation on Dissemination of Classified Intelligence Information ...9-3-2 9-305. Safeguarding Classified Intelligence Information..................................9-3-3 9-306. Inquiries.......................................................................................................9-3-3 Section 4. Communication Security (COMSEC) 9-400. General ........................................................................................................9-4-1 9-401. Instructions..................................................................................................9-4-1 9-402. Clearance and Access Requirements.......................................................9-4-1 9-403. Establishing a COMSEC Account...........................................................9-4-1 9-404. COMSEC Briefing and Debriefing Requirements ................................9-4-1 9-405. CRYPTO Access Briefing and Debriefing Requirements....................9-4-2 9-406. Destruction and Disposition of COMSEC Material ..............................9-4-2 9-407. Subcontracting COMSEC Work..............................................................9-4-2 9-408. Unsolicited Proposals ................................................................................9-4-2

CHAPTER 10. INTERNATIONAL SECURITY REQUIREMENTS

Section 1. General and Background Information 10-100. General ......................................................................................................10-1-1 10-101. Applicable Federal Laws ........................................................................10-1-1 10-102. Bilateral Security Agreements................................................................10-1-1 Section 2. Disclosure of U.S. Information to Foreign Interests 10-200. Authorization for Disclosure ...................................................................10-2-1 10-201. Direct Commercial Arrangements..........................................................10-2-1 10-202. Contract Security Provisions...................................................................10-2-1 Section 3. Foreign Government Information 10-300. General ......................................................................................................10-3-1 10-301. Contract Security Requirements ............................................................10-3-1 10-302. Marking Foreign Government Classified Material .............................10-3-1 10-303. Foreign Government RESTRICTED Information and “In Confidence”

Information..............................................................................................................10-3-1 10-304. Marking U.S. Documents Containing FGI...........................................10-3-1 10-305. Marking Documents Prepared For Foreign Governments.................10-3-1 10-306. Storage and Control .................................................................................10-3-2 10-307. Disclosure and Use Limitations .............................................................10-3-2 10-308. Transfer......................................................................................................10-3-2 10-309. Reproduction ............................................................................................10-3-2 10-310. Disposition ................................................................................................10-3-2 10-311. Reporting of Improper Receipt of Foreign Government Material.....10-3-2

10-312. Subcontracting..........................................................................................10-3-2 Section 4. International Transfers 10-400. General................................................................................................... 10-4-1 10-401. International Transfers of Classified Material.................................... 10-4-1 10-402. Transfers of Freight .............................................................................. 10-4-1 10-403. Return of Material for Repair, Modification, or Maintenance......... 10-4-2 10-404. Use of Freight Forwarders ................................................................... 10-4-2 10-405. Handcarrying Classified Material ....................................................... 10-4-2 10-406. Classified Material Receipts ................................................................ 10-4-3

10-407. Contractor Preparations for International Transfers Pursuant to Commercial and User Agency Sales ................................................................ 10-4-3 10-408. Transfers of Technical Data Pursuant to an ITAR Exemption........ 10-4-3

Section 5. International Visits and Control of Foreign Nationals 10-500. General.......................................................................................................10-5-1 10-501. International Visits....................................................................................10-5-1 10-502. Types and Purpose of International Visits .............................................10-5-1 10-503. Emergency Visits......................................................................................10-5-1 10-504. Requests for Recurring Visits..................................................................10-5-1 10-505. Amendments.............................................................................................10-5-1 10-506. Visits Abroad by U.S. Contractors .........................................................10-5-1 10-507. Visits by Foreign Nationals to U.S. Contractor Facilities ....................10-5-2 10-508. Control of Access by On-Site Foreign Nationals..................................10-5-2 10-509. TCP............................................................................................................10-5-3 10-510. Security and Export Control Violations Involving Foreign Nationals10-5-3 Section 6. Contractor Operations Abroad.

10-600. General ......................................................................................................10-6-1 10-601. Access by Contractor Employees Assigned Outside the United States ...........................................................................................................10-6-1

10-602. Storage, Custody, and Control of Classified Information Abroad by Employees of a U.S. Contractor......................................................................10-6-1 10-603. Transmission of Classified Material to Employees Abroad...............10-6-1 10-604. Security Briefings.....................................................................................10-6-2

Section 7. NATO Information Security Requirements 10-700. General.......................................................................................................10-7-1 10-701. Classification Levels ................................................................................10-7-1 10-702. NATO RESTRICTED............................................................................10-7-1 10-703. NATO Contracts.......................................................................................10-7-1 10-704. NATO Facility Security Clearance Certificate......................................10-7-1 10-705. PCL Requirements ...................................................................................10-7-1 10-706. NATO Briefings.......................................................................................10-7-1 10-707. Access to NATO Classified Information by Foreign Nationals..........10-7-1 10-708. Subcontracting for NATO Contracts .....................................................10-7-1 10-709. Preparing and Marking NATO Documents..........................................10-7-1 10-710. Classification Guidance ...........................................................................10-7-2 10-711. Further Distribution..................................................................................10-7-2 10-712. Storage of NATO Documents ................................................................10-7-2

10-713. International Transmission ......................................................................10-7-2 10-714. Handcarrying.............................................................................................10-7-3 10-715. Reproduction.............................................................................................10-7-3 10-716. Disposition.................................................................................................10-7-3 10-717. Accountability Records............................................................................10-7-3 10-718. Security Violations and Loss, Compromise, or Possible Compromise............................................................................................................10-7-3 10-719. Extracting from NATO Documents.......................................................10-7-3 10-720. Release of U.S. Information to NATO ..................................................10-7-4 10-721. Visits ..........................................................................................................10-7-4

CHAPTER 11. MISCELLANEOUS INFORMATION

Section 1. TEMPEST 11-100. General................................................................................................... 11-1-1 11-101. TEMPEST Requirements.................................................................... 11-1-1 11-102. Cost......................................................................................................... 11-1-1 Section 2. Defense Technical Information Center (DTIC) 11-200. General ......................................................................................................11-2-1 11-201. User Community......................................................................................11-2-1 11-202. Registration Process.................................................................................11-2-1 11-203. Safeguarding Requirements....................................................................11-2-1 11-204. DTIC Downgrading or Declassification Notices.................................11-2-1 11-205. Questions Concerning Reference Material...........................................11-2-1 11-206. Subcontracts..............................................................................................11-2-1 Section 3. Independent Research and Development (IR&D) Efforts 11-300. General ......................................................................................................11-3-1

11-301. Information Generated Under an IR&D Effort that Incorporates Classified Information............................................................................................11-3-1

11-302. Classification Guidance...........................................................................11-3-1 11-303. Preparation of Security Guidance ..........................................................11-3-1 11-304. Retention of Classified Documents Generated Under IR&D Efforts11-3-1

APPENDICES

Appendix A. Cognizant Security Office Information.................................................................................A-l Appendix B. International Visits Standard Request for Visit Format (RFV)........................................ B-l Appendix C. Definitions ............................................................................................................................. C-l

SUPPLEMENTS TO THE NISPOM

NISPOM Supplement........................................................................................................DoD 5220.22-M-Sup 1

REFERENCES

(a) Executive Order 12829, “National Industrial Security Program,” January 6, 1993

(b) Executive Order 12958, “Classified National Security Information, April 17, 1995

(c) Section 2011 et seq. of title 42, United States Code, “Atomic Energy Act of 1954,” as amended

(d) Section 781 of title 50, United States Code, “Internal Security Act of 1950”

(e) Section 403 of title 50, United States Code “National Security Act of 1947”

(f) Executive Order 12333, “United States Intelligence Activities,” December 8, 1981

(g) Executive Order 13355, “Strengthened Management of the Intelligence Community,”

August 27, 2004

(h) Public Law 108-458, “Intelligence Reform and Terrorism Prevention Act of 2004,” 118 Stat. 3638, December 17, 20041 (i)Section 552(f) of title 5, United States Code, “Government Organization and Employees”

(j) DoD 5220.22-C, “Carrier Supplement to the Industrial Security Manual for Safeguarding Classified Information,” October 1986

(k) Title 18 USC, Appendix 3, “Classified Information Procedures Act (CIPA)”

(l) Section 552 of title 5, United States Code, “Freedom of Information Act”

(m) Section 552a of title 5, United States Code, “Privacy Act of 1975”

(n) Section 2170 of Title 50, United States Code Appendix, “Defense Production Act of 1950”

(o) Director of Central Intelligence Directive 6/92, “Manual for Physical Security Standards for SCI Facilities,” November 18, 2002

(p) Underwriters Laboratories, Inc., UL Standard 2050, “National Industrial Security Systems”

(q) Title 10, Code of Federal Regulations, Part 1045, Subparts A, B, and C, “National Security Information,” December 22, 1997

(r) DoD Directive 5120.2, “Access to and Dissemination of Restricted Data,” January 12,

(s) Department of Energy Order 5610.2, “Control of Weapon Data,” August 1, 1980

(t) Sections 793, 794, and 798 of title 18, United States Code, Chapter 37, “Espionage and Censorship”

(u) Section 2751 et seq. of title 22, United States Code, “Arms Export Control Act (AECA),” June 30, 1976, as amended

(v) App. 2401 et seq. of title 50, United States Code, “The Export Administration Act of 1979 (EAA),” September 29, 1979, as amended

(w) Title 22, Code of Federal Regulations, Parts 120-130, “International Traffic in Arms Regulations,” current edition

(x) Section 130(c) of title 10, United States Code, “Authority to Withhold from Public Disclosure Certain Technical Data”

(y) Section 1101(a)(22) and Section 1401, subsection (a) of title 8, United States Code, “Aliens and Nationality”

1 Not codified 2 Available from the Central Intelligence Agency

(z) Title15, Code of Federal Regulations, parts 368.1-399.2, “Export Administration Regulation (EAR),” current edition

AL1. Acronyms

AL.1.1. AECA Arms Export Control Act AL.1.2. ASC Alarm Service Company

AL.1.3. BL Bill of Lading

AL.1.4. CAGE Commercial and Government Entity AL.1.5. CFIUS Committee on Foreign Investment in the United States AL.1.6. CFR Code of Federal Regulations AL.1.7. CI Counterintelligence AL.1.8. CIA Central Intelligence Agency AL.1.9. CM Configuration Management AL.1.10. CNWDI Critical Nuclear Weapons Design Information AL.1.11. COMSEC Communications Security AL.1.12. COR Central Office of Record AL.1.13. CRYPTO Cryptographic AL.1.14. CSA Cognizant Security Agency AL.1.15. CSO Cognizant Security Office AL.1.16. CUSR Central United States Registry AL.1.17. CVA Central Verification Activity

AL.1.18. DAA Designated Accrediting/Approving Authority AL.1.19. DCID Director of Central Intelligence Directive AL.1.20. DGR Designated Government Representative AL.1.21. DNI Director of National Intelligence AL.1.22. DOD Department of Defense AL.1.23. DOE Department of Energy AL.1.24. DOJ Department of Justice AL.1.25. DSS Defense Security Service AL.1.26. DTIC Defense Technical Information Center

AL.1.27. EAA Export Administration Act AL 1.28. EPA Environmental Protection Agency

AL.1.29. FBI Federal Bureau of Investigation AL.1.30. FCC Federal Communications Commission AL.1.31. FCL Facility (Security) Clearance AL.1.32. FGI Foreign Government Information AL.1.33. FOCI Foreign Ownership, Control or Influence AL.1.34. FOUO For Official Use Only AL.1.35. FRD Formerly Restricted Data AL.1.36. FRS Federal Reserve System AL.1.37. FSCC NATO Facility Security Clearance Certificate AL.1.38. FSO Facility Security Officer

AL.1.39. GAO Government Accountability Office AL.1.40. GCA Government Contracting Activity AL.1.41. GCMS Government Contractor Monitoring Station AL.1.42. GFE Government Furnished Equipment AL.1.43. GSA General Services Administration AL.1.44. GSC Government Security Committee

AL.1.45. IC Intelligence Community

AL.1.46. IDS Intrusion Detection System AL.1.47. IFB Invitation for Bid AL.1.48. IR&D Independent Research & Development AL.1.49. IS Information System AL.1.50. ISCAP Interagency Security Classification Appeals Panel AL.1.51. ISOO Information Security Oversight Office AL.1.52. ISSM Information System Security Manager AL.1.53. ISSO Information System Security Officer AL.1.54. ITAR International Traffic in Arms Regulations

AL.1.55. LAA Limited Access Authorization AL.1.56. LAN Local Area Network AL.1.57. MFO Multiple Facility Organization

AL.1.58. NACLC National Agency Check with Local Agency Check and Credit Check AL.1.59. NASA National Aeronautics and Space Administration AL.1.60. NATO North Atlantic Treaty Organization AL.1.61. NIAG NATO Industrial Advisory Group AL.1.62. NID National Interest Determination AL.1.63. NISP National Industrial Security Program AL.1.64. NISPOM National Industrial Security Program Operating Manual AL.1.65. NISPOMSUP National Industrial Security Program Operating Manual Supplement AL.1.66. NOFORN Not Releasable to Foreign Nationals AL.1.67. NPLO NATO Production Logistics Organization AL.1.68. NRC Nuclear Regulatory Commission AL.1.69. NSA National Security Agency AL.1.70. NSF National Science Foundation AL.1.71. NSI National Security Information

AL.1.72. OADR Originating Agency's Determination Required AL.1.73. ORCON Dissemination and Extraction of Information Controlled by Originator

AL.1.74. PCL Personnel (Security) Clearance AL.1.75. PROPIN Proprietary Information Involved

AL.1.76. RD Restricted Data AL.1.77. RDT&E Research, Development, Technical and Engineering AL.1.78. REL TO Authorized for Release to AL.1.79. RFP Request for Proposal AL.1.80. RFQ Request for Quotation AL.1.81. RFV Request for Visit

AL.1.82. SAP Special Access Program AL.1.83. SBA Small Business Administration AL.1.84. SCA Security Control Agreement AL.1.85. SCI Sensitive Compartmented Information AL.1.86. SCIF Sensitive Compartmented Information Facility AL.1.87. SDDC Surface Deployment and Distribution Command AL.1.88. SIO Senior Intelligence Officer AL.1.89. SOIC Senior Official of the Intelligence Community AL.1.90. SSA Special Security Agreement AL.1.91. SSBI Single Scope Background Investigation AL.1.92. SSP Systems Security Plan

AL.1.93. TCO Technology Control Officer

AL.1.94. TCP Technology Control Plan AL.1.95. TP Transportation Plan

AL.1.96. UL Underwriters' Laboratories AL.1.97. USAID United States Agency for International Development AL.1.98. USC United States Code AL.1.99.