Communications Security (COMSEC)

Communications Security (COMSEC) encompasses the measures used to protect telecommunications and information transmitted over communication systems from unauthorized access, interception, or exploitation, including the use of cryptographic equipment, key management, emission security, and physical security of communication devices.

What is COMSEC?

COMSEC is a discipline within the national security community managed by the National Security Agency (NSA) and overseen under Committee on National Security Systems (CNSS) policy. It covers four main areas: cryptosecurity (use of NSA-approved algorithms and equipment), transmission security (preventing interception of signals), emission security (preventing unintentional electromagnetic signal leakage), and physical security (protecting COMSEC equipment and key material from physical compromise). Defense contractors who operate secure voice and data communication systems, particularly those using classified networks like SIPRNET or Special Access Programs (SAPs), must comply with COMSEC requirements including proper use of NSA-approved cryptographic equipment, adherence to key management procedures, and physical security of cryptographic key material. COMSEC accounts are tracked through the Electronic Key Management System (EKMS) and its successor, Key Management Infrastructure (KMI). Personnel who manage COMSEC accounts at cleared facilities undergo specific training and hold formal COMSEC custodian responsibilities under NISPOM-related procedures.

Why COMSEC matters for government contractors

Contractors supporting classified programs that involve secure voice, encrypted data links, or secure communications infrastructure must understand and implement COMSEC requirements. COMSEC failures, such as improper key management or use of non-NSA-approved equipment on classified networks, can result in ATO revocation, security violations, and potential compromise of classified information.

Example

A defense communications firm is contracted to install and maintain secure voice equipment at a classified facility. The firm designates a COMSEC custodian who completes required training and establishes a COMSEC account through the government sponsor. All cryptographic key material is handled in accordance with CNSS policy, with key changes logged and superseded key material destroyed using NSA-approved procedures.

Frequently Asked Questions

What types of equipment fall under COMSEC?

COMSEC equipment includes NSA-certified encryption devices (called Type 1 equipment), secure phones (STE, VIPER), encrypted radios, and key fill devices used to load cryptographic keys into secure communications equipment. All Type 1 COMSEC equipment must be registered with the government and handled under strict accountability procedures.

Who is responsible for COMSEC at a contractor facility?

Each cleared contractor facility with COMSEC equipment designates a COMSEC Custodian and a Primary COMSEC Account Manager (PCAM). These individuals are formally responsible for safeguarding, accounting for, and properly disposing of all COMSEC material and equipment in their account.

What is key management in the COMSEC context?

Key management refers to the generation, distribution, loading, storage, and destruction of cryptographic keys used by COMSEC equipment. The government manages key material through the Key Management Infrastructure (KMI), and COMSEC custodians follow strict procedures for loading, tracking, and destroying keys to prevent compromise.

How does COMSEC relate to cybersecurity?

COMSEC and cybersecurity are related but distinct disciplines. COMSEC focuses on protecting communications through cryptographic and physical means. Cybersecurity (as governed by NIST RMF) focuses on protecting information systems from cyber threats. Both apply to defense contractor environments, and they are increasingly integrated under the broader NSS (National Security Systems) security framework.