A Cognizant Security Authority is one of five senior federal officials designated under Executive Order 12829 to oversee how private contractors handle classified information within the National Industrial Security Program. Each authority is responsible for a distinct category of classified data, and every cleared contractor falls under the jurisdiction of at least one of them. The authorities set the security rules a contractor must follow — physical safeguarding, personnel vetting, information handling, foreign ownership review — as a condition of doing classified work for the federal government.
The Five Officials and What Each Covers
Executive Order 12829, as amended by Executive Order 13691 in 2015, names five Cognizant Security Authorities. The list grew from four to five when the 2015 amendment added the Department of Homeland Security.1National Archives. Executive Order 12829 – National Industrial Security Program (as amended by EO 13691)
The Secretary of Defense holds the broadest portfolio and serves as executive agent for the entire program. Most of the cleared contractor population sits under this authority because most classified work supports the defense industrial base.
The Director of National Intelligence controls access to intelligence sources and methods, including Sensitive Compartmented Information. The DNI can inspect and monitor contractor facilities handling intelligence information directly, or delegate that task to the Secretary of Defense through a written agreement.1National Archives. Executive Order 12829 – National Industrial Security Program (as amended by EO 13691)
The Secretary of Energy and the Nuclear Regulatory Commission share jurisdiction over information classified under the Atomic Energy Act of 1954, which covers Restricted Data and Formerly Restricted Data related to nuclear weapons design and production. The Energy Department’s role predates the NISP itself, tracing back to the Atomic Energy Act’s government-wide framework for classifying nuclear information.2Department of Energy. Statutes, Regulations, and Directives for Classification Program
The Secretary of Homeland Security, added by the 2015 amendment, oversees classified information shared under designated critical infrastructure protection programs.1National Archives. Executive Order 12829 – National Industrial Security Program (as amended by EO 13691)
Each authority manages its slice of the classified world based on the legal jurisdiction of the underlying agency. A contractor always knows which federal official holds final authority over its security program because that jurisdiction is fixed by statute and executive order, not by the individual contract.
One Rulebook Across All Five: the NISPOM
Having five authorities could easily produce five sets of conflicting rules. It doesn’t, because the Secretary of Defense issues and maintains the National Industrial Security Program Operating Manual — the NISPOM — with the concurrence of the other four authorities. The manual is codified at 32 CFR Part 117 and applies to every cleared contractor regardless of which agency awarded the contract.3eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM)
The NISPOM’s physical security requirements are detailed and specific. Contractors must store classified material in GSA-approved security containers, vaults built to Federal Standard 832, or open storage areas constructed to meet federal specifications. Storage rules differ by classification level — Confidential, Secret, and Top Secret each have their own requirements.4eCFR. 32 CFR 117.15 – Safeguarding Classified Information When classified material is too large or operationally impractical to lock in a container, a contractor may establish a “Closed Area” — a specially constructed space that itself meets the safeguarding standards a container would provide.5eCFR. 32 CFR 117.3 – Acronyms and Definitions
Destruction of classified material follows equally rigid protocols. Contractors must destroy documents according to the disposition instructions in the contract security classification specification and the destruction equipment standards in 32 CFR 2001.42(b).3eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM) The manual also imposes reporting obligations on cleared employees who travel abroad or experience life changes that could affect their security eligibility.
How Authority Reaches the Contractor: Cognizant Security Offices
The agency heads who serve as Cognizant Security Authorities don’t personally inspect contractor facilities or process clearance paperwork. Those functions are delegated to Cognizant Security Offices. For the Secretary of Defense, the Defense Counterintelligence and Security Agency performs the field-level industrial security work: facility security reviews, clearance processing, and compliance monitoring. The other authorities either maintain their own offices or enter agreements for DCSA to handle oversight on their behalf.6eCFR. 32 CFR 2004.22 – Agency Responsibilities
DCSA’s security reviews produce ratings that directly affect a contractor’s ability to compete for classified work. A contractor either operates in “general conformity” with the NISPOM or it doesn’t. Those in general conformity may earn a Superior, Commendable, or Satisfactory rating. A contractor that falls below general conformity receives a Marginal or Unsatisfactory rating. Critical vulnerabilities, systemic weaknesses, or serious security problems automatically push a contractor out of general conformity.7Defense Counterintelligence and Security Agency. Security Review and Ratings An Unsatisfactory rating can trigger suspension of a facility clearance, effectively shutting the contractor out of classified programs.
What a CSA Decides About a Contractor
The most consequential decisions a Cognizant Security Authority makes about a specific contractor involve facility clearance eligibility and, when relevant, foreign ownership.
Facility Clearance Eligibility
A company cannot apply for a facility clearance on its own. A government contracting activity or an already-cleared contractor must sponsor the applicant through the National Industrial Security System, with supporting documentation including a DD Form 254 (the contract security classification specification), a statement of work, and government authorization.8Defense Counterintelligence and Security Agency. Facility Clearances
Once sponsored, the company must meet the eligibility requirements at 32 CFR 117.9. It must be organized under U.S. law, be physically located in the United States, and have a record of integrity and lawful conduct. It cannot be under foreign ownership, control, or influence to a degree inconsistent with national security. And it must appoint three security officials — a Senior Management Official, a Facility Security Officer, and an Insider Threat Program Senior Official — all holding personal security clearances.9eCFR. 32 CFR 117.9 – Entity Eligibility Determination for Access to Classified Information
Facility clearances come in three levels matching the classification hierarchy: Confidential, Secret, and Top Secret. Each authorizes access to that level and everything below it. DCSA reviews the sponsorship request and either places the company “in-process” or rejects it. Common rejection reasons include discrepancies between the sponsorship request and the DD Form 254, missing government authorization, or a contract that doesn’t actually require access to classified material.8Defense Counterintelligence and Security Agency. Facility Clearances
Foreign Ownership, Control, or Influence
If a cleared company has foreign ownership, the CSA does not automatically deny the clearance. It evaluates whether the relationship can be managed through a formal mitigation instrument. The two most restrictive options are the Voting Trust Agreement and the Special Security Agreement.10Defense Counterintelligence and Security Agency. Mitigation Agreements
Under a Voting Trust Agreement, the foreign owner transfers legal title in the company to U.S. citizen trustees approved by DCSA. The foreign investor surrenders all ownership prerogatives, and the trustees exercise full control. Because the separation is absolute, companies operating under a VTA face no restrictions on accessing any category of classified information, including Top Secret, Sensitive Compartmented Information, and Restricted Data.
A Special Security Agreement takes a lighter touch. The foreign owner retains a seat at the table through inside directors who participate in business management, while cleared U.S. citizen outside directors monitor decisions to prevent unauthorized access. The tradeoff is restricted access: a company under an SSA may need a National Interest Determination before working with the most sensitive categories of information.10Defense Counterintelligence and Security Agency. Mitigation Agreements
Reporting Obligations and Enforcement
A Cognizant Security Authority’s rules carry real consequences, and the NISPOM imposes specific reporting duties that contractors ignore at their peril. If classified material is lost or suspected to be compromised, the contractor must promptly submit an initial report to the CSA. Suspected espionage, sabotage, terrorism, or subversive activities require prompt written notification to the nearest FBI field office; an initial phone call is acceptable, but written follow-up must come after. If an emergency renders the facility incapable of safeguarding classified material, the contractor must report that condition as soon as possible.11eCFR. 32 CFR 117.8 – Reporting Requirements The regulation uses “promptly” rather than fixed hour counts, and each CSA may issue additional guidance that tightens those timelines.
Cleared employees and their employers also have ongoing reporting duties for events that could affect security eligibility, including foreign travel, foreign contacts, significant financial changes, and arrests. Federal agencies maintain hotlines for employees to report security irregularities, and the NISPOM makes clear those hotlines supplement rather than replace the contractor’s own responsibility to investigate and report.12eCFR. 32 CFR 117.7 – Procedures
The most serious violations can trigger criminal prosecution. Under 18 U.S.C. § 793, anyone entrusted with national defense information who allows it to be removed, lost, stolen, or destroyed through gross negligence faces up to ten years in prison and fines. Knowingly transmitting classified information to an unauthorized person carries the same maximum penalty.13Office of the Law Revision Counsel. 18 USC Chapter 37 – Espionage and Censorship That criminal exposure is what gives a CSA’s administrative rules their bite. A sloppy security program is not just a contract issue. It can be a felony.