National Industrial Security Program

The National Industrial Security Program (NISP) is the framework through which the U.S. government authorizes private-sector contractors, universities, and other non-government entities to access, handle, store, and generate classified national security information in support of government contracts. Without NISP participation and the clearances it grants, a contractor organization has no legal basis to receive classified material, no matter how specialized or capable the company may be in its technical domain.

What is National Industrial Security Program?

NISP was established by Executive Order 12829 (1993), subsequently amended by Executive Orders 13691 and 13467, and is operationalized through 32 CFR Part 117, the National Industrial Security Program Operating Manual (NISPOM). The Defense Counterintelligence and Security Agency (DCSA) serves as the Cognizant Security Agency (CSA) for DoD and for most non-DoD executive branch agencies that have delegated security oversight to DCSA. Certain agencies, including elements of the intelligence community, serve as their own CSAs.

NISP operates through two primary authorization instruments. The Facility Clearance (FCL) authorizes the contractor organization to access classified information at a designated level; it is tied to the physical locations, information systems, and corporate structure of the entity. The Personnel Security Clearance (PCL) authorizes specific individual employees to access classified information up to their designated level. Both are required for classified contract performance.

NISPOM specifies detailed requirements across physical security (approved storage equipment, access controls), information system security (requirements for classified processing on government-furnished or contractor-owned systems), insider threat programs (mandatory detection and reporting programs established under EO 13587), self-inspection requirements (annual facility-conducted reviews), and adverse information reporting (FSO obligation to report security concerns on cleared employees). DCSA conducts periodic security vulnerability assessments of cleared facilities; findings of non-compliance can result in FCL suspension, FCL revocation, or referral for administrative action.

Why it matters for contractors

NISP participation is not optional for cleared work; it is a binary prerequisite. A contractor that has never held an FCL must begin the sponsorship and approval process well before contract performance is expected to start, as the FCL process involves a pre-eligibility review, a facility inspection, and final DCSA determination that collectively take months. For new market entrants pursuing classified opportunities, the NISP onboarding timeline is often the single longest lead item in their cleared contract readiness plan.

Once enrolled in NISP, contractors carry ongoing compliance obligations. The Facility Security Officer (FSO) role is mandatory for every cleared facility; the FSO manages clearance administration, security education, self-inspections, and all DCSA interaction. Under-resourcing the FSO function is a common source of compliance findings. Contractors that accumulate unresolved findings risk FCL suspension, which immediately disqualifies them from classified performance and can trigger termination for default on contracts that require cleared access.

Example

A cybersecurity firm wants to bid on a Top Secret software development contract for an intelligence community customer. Before the firm can receive the classified performance work statement or participate in any classified discussions, it must obtain an FCL at the Top Secret level through DCSA. The firm establishes a cleared facility meeting NISPOM physical and information system security standards, designates a full-time FSO, implements a documented insider threat program, and passes a DCSA pre-eligibility security review. Only after DCSA grants the FCL can the firm receive the classified solicitation and begin the clearance process for individual employees who will perform on the contract.