Department of Defense: National Industrial Security Program Operating Manual (NISPOM)
Highlights
GAO reviewed the Department of Defense's (DOD) new rule entitled "National Industrial Security Program Operating Manual (NISPOM)." GAO found that the final rule (1) codifies the National Industrial Security Program (NISP) Operating Manual in regulation; (2) incorporates the requirements of Security Executive Agent Directive (SEAD) 3, "Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position;" (3) provides for a single, nationwide implementation plan which will, with this rule, include SEAD 3 reporting by all contractor-cleared personnel to report specific activities that may adversely impact their continued national security eligibility, such as reporting of foreign travel and foreign contacts; (4) requires NISP Cognizant Security Agencies to conduct an analysis of such reported activities to determine whether they pose a potential threat to national security and take appropriate action; and (5) implements the provisions of section 842 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, Pub. L. No. 115-232, div. A, title VIII, subtitle E, § 842, 132 Stat. 1636, 1878 (Aug. 13, 2018), which removes the requirement for a covered National Technology and Industrial Base entity operating under a special security agreement pursuant to NISP to obtain a national interest determination as a condition for access to proscribed information.
B-332817
January 22, 2021
Chair
Ranking Member
Committee on Armed Services
United States Senate
The Honorable Adam Smith
Chairman
The Honorable Mike Rogers
Ranking Member
Committee on Armed Services
House of Representatives
Subject: Department of Defense: National Industrial Security Program Operating Manual (NISPOM)
Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Department of Defense (DOD) entitled “National Industrial Security Program Operating Manual (NISPOM)” (RIN: 0790-AK85). We received the rule on December 11, 2020. It was published in the Federal Register as a final rule with request for comment on December 21, 2020. 85 Fed. Reg. 83300. The effective date of the rule is February 24, 2021.
According to DOD, the final rule codifies the National Industrial Security Program (NISP) Operating Manual (NISPOM) in regulation. DOD stated NISPOM establishes requirements for the protection of classified information disclosed to or developed by contractors, licensees, grantees, or certificate holders (hereinafter referred to as contractors) to prevent unauthorized disclosure. In addition to adding NISPOM to the Code of Federal Regulations, DOD further stated the final rule incorporates the requirements of Security Executive Agent Directive
(SEAD) 3, “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position.” According to DOD, SEAD 3 requires reporting by all contractor-cleared personnel who have been granted eligibility for access to classified information. DOD also stated the final rule provides for a single, nationwide implementation plan which will, with this rule, include SEAD 3 reporting by all contractor-cleared personnel to report specific activities that may adversely impact their continued national security eligibility, such as reporting of foreign travel and foreign contacts. DOD stated the final rule requires NISP Cognizant Security Agencies to conduct an analysis of such reported activities to determine whether they pose a potential threat to national security and take appropriate action. Finally, DOD stated the final rule also implements the provisions of section 842 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, Pub. L. No. 115-232, div. A, title VIII, subtitle E, § 842, 132 Stat. 1636, 1878 (Aug. 13, 2018), which removes the requirement for a covered National Technology and Industrial Base (NTIB) entity operating under a special security agreement pursuant to NISP to obtain a national interest determination as a condition for access to proscribed information.
The Congressional Review Act (CRA) requires a 60-day delay in the effective date of a major rule from the date of publication in the Federal Register or receipt of the rule by Congress, whichever is later. 5 U.S.C. § 801(a)(3)(A). The Senate received the final rule on January 6, 2021. 167 Cong. Rec. S72 (daily ed. Jan. 20, 2021). The Congressional Record does not yet indicate when the House of Representatives received the final rule. The final rule was published on December 21, 2020. 85 Fed. Reg. 83300. The final rule has a stated effective date of February 24, 2021. Therefore, the final rule does not have the required 60-day delay in its effective date.
Enclosed is our assessment of DOD’s compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Shari Brewster, Assistant General Counsel, at (202) 512-6398.
Shirley A. Jones
Managing Associate General Counsel
Enclosure
cc: Patricia Toppings
OSD Federal Register Liaison Officer
Department of Defense
ENCLOSURE
REPORT UNDER 5 U.S.C. § 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
DEPARTMENT OF DEFENSE
ENTITLED
“National Industrial Security
Program Operating Manual (NISPOM)”
(RIN: 0790-AK85)
(i) Cost-benefit analysis
The Department of Defense (DOD) estimated the final rule would lead to a cost of $150.26 million and annualized costs of $10.52 million for the public and a cost of $10.82 million and annualized costs of $0.76 million for the government. DOD stated the costs would result from regulatory familiarization; evaluation of existing classified contracts to implement changes no later than 6 months from effective date; training and accepting SECRET-cleared employees on requirements to submit foreign travel reports; submitting foreign travel reports and receiving any pre-travel threat briefings or post-travel briefings based on the threat; training the government civilian employees of National Industrial Security Program Cognizant Security Agencies who provide oversight of contractor compliance with this rule; update training materials, job aids and associated tools for cleared legal entities and government agencies on these changes to the National Industrial Security Program Operating Manual. DOD also estimated the final rule will result in fewer contract performance delays by the small number of U.S. contractors with National Technology and Industrial Base ownership operating under a Special Security Agreement.
(ii) Agency actions relevant to the Regulatory Flexibility Act (RFA), 5 U.S.C. §§ 603-605, 607, and 609
DOD certified the final rule would not have a significant economic impact on a substantial number of small entities.
(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. §§ 1532-1535
DOD stated the final rule will not mandate any requirements for state, local, or tribal governments, nor will it affect private sector costs.
(iv) Other relevant information or requirements under acts and executive orders
Administrative Procedure Act, 5 U.S.C. §§ 551 et seq.
DOD stated the final rule directly involves matters relating to public grants or contracts, and is therefore expressly exempt from notice and comment procedures under section 553 of title 5, United States Code.
Paperwork Reduction Act (PRA), 44 U.S.C. §§ 3501-3520
DOD determined the final rule does not contain information collection requirements subject to the Act.
Statutory authorization for the rule
DOD promulgated the final rule pursuant to sections 2011 et seq. of title 42; sections 3001
et seq., and 3501 et seq. oftitle 50, United States Code, as well as Public Law 108-458.
Executive Order No. 12866 (Regulatory Planning and Review)
DOD determined the final rule was economically significant and stated the final rule had been reviewed by the Office of Management and Budget.
Executive Order No. 13132 (Federalism)
DOD determined the final rule will not have a substantial effect on state and local governments.