View source for National Industrial Security Program

The '''National Industrial Security Program''', or '''NISP''', is the nominal authority (in the [[United States]]) for managing the needs of private industry to access [[classified information in the United States|classified information]].

The NISP was established in 1993 by '''Executive Order 12829'''.<ref>{{cite web|url=http://www.fas.org/irp/offdocs/eo12829.htm|title=Executive Order 12829|work=FAS website|accessdate=2007-04-01}}</ref>  The [[United States National Security Council|National Security Council]] nominally sets policy for the NISP, while the Director of the [[Information Security Oversight Office]] is nominally the authority for implementation.  Under the ISOO, the [[Secretary of Defense]] is nominally the Executive Agent, but the NISP recognizes four different Cognizant Security Agencies, all of which have equal authority: the [[United States Department of Defense|Department of Defense]], the Department of Energy, the [[Central Intelligence Agency]], and the [[Nuclear Regulatory Commission]].<ref>{{cite web | url=http://www.dss.mil/isec/nispbrochure.pdf| title=NISP Brochure | publisher=[[Defense Security Service|DSS]]| format=PDF | archiveurl=http://web.archive.org/web/20060420050102/http://www.dss.mil/isec/nispbrochure.pdf | archivedate=2006-04-20 | accessdate=2007-04-01}} (59 KB)</ref>

==NISP Operating Manual (DoD 5220.22-M)==
A major component of the NISP is the '''NISP Operating Manual''', also called '''NISPOM''', or '''DoD  5220.22-M'''.<ref>{{cite web|url=http://www.dss.mil/isp/fac_clear/download_nispom.html|title=Download NISPOM|publisher=[[Defense Security Service|DSS]]|accessdate=2010-11-10}}</ref>  The NISPOM establishes the standard procedures and requirements for all government contractors, with regards to classified information.  {{As of|2015}}, the current NISPOM edition is dated 28 Feb 2006.  Chapters and selected sections of this edition are:

<!-- Editor's Note: As these are copied right from the NISPOM TOC, please preserve the exact text of the section headings if you add links.  Use pipes to link to Articles where the names don't match. -->
* Chapter 1 - General Provisions and Requirements
* Chapter 2 - [[Security clearance|Security Clearances]]
** Section 1 - Facility Clearances
** Section 2 - Personnel Security Clearances
** Section 3 - Foreign Ownership, Control, or Influence (FOCI)
* Chapter 3 - Security Training and Briefings
* Chapter 4 - [[Classified information|Classification]] and Marking
* Chapter 5 - Safeguarding Classified Information
* Chapter 6 - Visits and Meetings
* Chapter 7 - [[Subcontractor|Subcontracting]]
* Chapter 8 - Information System Security
* Chapter 9 - Special Requirements
** Section 1 - RD and FRD
** Section 2 - [[Critical Nuclear Weapon Design Information|DoD Critical Nuclear Weapon Design Information (CNWDI)]]
** Section 3 - Intelligence Information
** Section 4 - [[Communications security|Communication Security (COMSEC)]]
* Chapter 10 - International Security Requirements
* Chapter 11 - Miscellaneous Information
** Section 1 - [[TEMPEST]]
** Section 2 - [[Defense Technical Information Center]] (DTIC)
** Section 3 - Independent Research and Development (IR&D) Efforts
* Appendices

===Data sanitization===
DoD 5220.22-M is sometimes cited as a standard for [[Sanitization (classified information)|sanitization]] to counter [[data remanence]].  The NISPOM actually covers the entire field of government-industrial security, of which [[Sanitization (classified information)|data sanitization]] is a very small part (about two paragraphs in a 141 page document).<ref>{{cite web|url = http://www.dss.mil/documents/odaa/nispom2006-5220.pdf#page=75|title = National Industrial Security Program Operating Manual (NISPOM)|accessdate = 2013-03-07|author = DoD|publisher = [[Defense Security Service|DSS]]|date = 2006-02-28|pages = 8–3-1|format = PDF|authorlink = United States Department of Defense}} (1.92 MB)</ref> Furthermore, the NISPOM does not actually specify any particular method.  Standards for sanitization are left up to the Cognizant Security Authority.  The [[Defense Security Service]] provides a ''Clearing and Sanitization Matrix'' (C&SM) which does specify methods.<ref>{{cite web|url=http://www.oregon.gov/DAS/OP/docs/policy/state/107-009-005_Exhibit_B.pdf| title=DSS Clearing & Sanitization Matrix|publisher=[[Defense Security Service|DSS]]| format=PDF|date=2007-06-28|accessdate=2011-04-26}} (98 KB)</ref>  As of the June 2007 edition of the DSS C&SM, overwriting is no longer acceptable for sanitization of magnetic media; only degaussing or physical destruction is acceptable.

Unrelated to NISP or NISPOM, [[National Institute of Standards and Technology|NIST]] also publishes a Data Sanitization standard, including methods to do so. Revision 1 was released as a Draft<ref>{{cite web|url=http://csrc.nist.gov/publications/drafts/800-88-rev1/sp800_88_r1_draft.pdf|title=Special Publication 800-88: Guidelines for Media Sanitization|publisher=[[National Institute of Standards and Technology|NIST]]|date=September 2006|format=PDF|accessdate=2012-12-05}} (428 KB)</ref> in September 2012.

<!-- Editor's Note: This information appears to be difficult to find.  Many people are citing the older version of the document. -->

==References==
<References/>

==External links==
* [http://www.archives.gov/isoo/policy-documents/eo-12829.html "National Industrial Security Program"] [http://www.archives.gov/isoo/policy-documents/eo-12829.pdf PDF]

{{Wikipedia|National Industrial Security Program}}

[[Category:Establishments by United States executive order]]
[[Category:United States intelligence agencies]]
[[Category:United States Department of Defense agencies]]
[[Category:Classified documents]]
[[Category:Data security]]
[[Category:United States government secrecy]]