NISPOM

No changes recorded yet — we are watching, and nothing has been published.

1. 2024-02-12 Comment period on the proposed NISPOM amendment closed
2. 2021-02-24 NISPOM rule took effect; contractors had 6 months to implement it, and 18 months for SEAD 3 foreign travel reporting to DoD

1. 2023-12-13
   NISPOM Second Amendment (proposed) Draft

   DoD proposed amendments on SEAD 3 implementation and costs, protection and reproduction of classified information, CUI, National Interest Determinations and personnel clearance eligibility; comments closed 12 February 2024. source

2. 2021-08-19
   32 CFR part 117 (as amended August 2021) AmendmentCurrent text

   Extended the date by which contractors under DoD security cognizance must report and obtain pre-approval of unofficial foreign travel to DoD. source

3. 2020-12-21
   NISPOM rule (32 CFR part 117) Major version

   Codified the NISPOM in the Code of Federal Regulations and incorporated SEAD 3 reporting requirements for cleared contractor personnel; effective 24 February 2021. source

Applies to cleared contractors and other non-government entities given access to classified information, throughout bidding, award, performance and termination.

Who

All industrial, educational, commercial or other non-government entities granted access to classified information by executive branch agencies or by foreign governments. source

Contract lifecycle

Covers classified information released in bids and proposals, negotiation, award, performance and termination of contracts, agreements, licences and grants. source

Insider threat

Contractors must establish and maintain an insider threat program led by an appointed insider threat program senior official. source

SEAD 3 reporting

The rule incorporates SEAD 3, under which cleared contractor personnel report activities such as foreign travel and foreign contacts. source

Foreign ownership

A contractor under foreign ownership, control or influence must negotiate and implement an acceptable mitigation measure to keep its entity eligibility. source

Classified systems

Contractor information systems that handle classified information must be managed with risk-based protective measures under CSA-provided guidance. source

Pending amendment

The 2026 Unified Agenda lists the NISPOM Second Amendment at the final rule stage, with final action planned for July 2026. source

Contractors need a favourable entity eligibility determination, inspect themselves at least once a year and take part in recurring government security reviews.

Entity eligibility

A favourable entity eligibility determination for access to classified information remains in effect until it is terminated or revoked. source

Government reviews

The CSA conducts recurring security reviews, announced or unannounced, at a scope and frequency it sets by risk; taking part is required to keep eligibility. source

Self-inspection

Contractors conduct a formal self-inspection at least annually, keep a written report, and the senior management official certifies it to the CSA each year. source

Classified systems

Self-inspections of information systems that process classified information are verified at least every 12 months. source

The CSA can invalidate or revoke a contractor's entity eligibility, which shuts it out of new classified work.

Invalidation

While invalidated, a contractor may not bid on or be awarded new classified contracts; it may continue existing ones only if the government contracting activity agrees. source

Revocation

The CSA may revoke eligibility if the contractor is unable or unwilling to protect classified information or to comply with the rule; classified material must then be returned or disposed of. source

Employees

Contractors must immediately deny classified access to any employee whose eligibility is denied, suspended or revoked. source

Unauthorized disclosure

Cleared employees are briefed that unauthorized disclosure of classified information can bring criminal, civil or administrative consequences. source

1. Law text 32 CFR part 117 – National Industrial Security Program Operating Manual (NISPOM)
2. Law text NISPOM final rule (21 December 2020)
3. Law text NISPOM amendment (19 August 2021)
4. Law text NISPOM amendment, proposed rule (13 December 2023)
5. Guidance Unified Agenda entry RIN 0790-AL52 (NISPOM Second Amendment)

1. CMMC

   CMMC assesses how defense contractors protect controlled unclassified information; the NISPOM governs cleared contractors' protection of classified information.

2. DFARS 252.204-7012

   DFARS 252.204-7012 is a contract clause on safeguarding covered defense information and reporting cyber incidents; the NISPOM is the rule for classified information.

3. NIST SP 800-171

   NIST SP 800-171 sets requirements for controlled unclassified information in non-federal systems; the NISPOM sets requirements for classified information and systems.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to NISPOM (RSS)