2021-17688. National Industrial Security Program Operating Manual (NISPOM); Amendment

AGENCY:

Office of the Under Secretary of Defense for Intelligence & Security, Department of Defense (DoD).

ACTION:

Final rule; technical amendment.

SUMMARY:

DoD is amending its NISPOM regulation to extend the implementation date for those contractors under DoD security cognizance to report and obtain pre-approval of unofficial foreign travel to the Department of Defense.

DATES:

This rule is effective August 19, 2021.

FOR FURTHER INFORMATION CONTACT:

Valerie Heil, 703-692-3754.

SUPPLEMENTARY INFORMATION:

This final rule amends 32 CFR part 117, “National Industrial Security Program Operating Manual (NISPOM)” final rule that published in the Federal Register on December 21, 2020 (85 FR 83300). The rule includes reporting requirements for contractor personnel who have been granted eligibility for access to classified information through the National Industrial Security Program to follow Security Executive Agent Directive (SEAD) 3, “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position.” Reporting requirements in the rule include provisions for covered individuals to report and obtain pre-approval of unofficial foreign travel. DoD received comments from regulated parties concerning how burdensome it would be for contractors under DoD security cognizance to submit individual foreign travel reports. Regulated parties recommended DoD modify its IT system so multiple or batched foreign travel reports can be submitted in a single submission. DoD agrees with this recommendation and intends to modify its IT system. However, DoD cannot complete modifications to its IT system before the original implementation date of August 24, 2021. This amendment will extend until August 24, 2022, the implementation date for those contractors under DoD security cognizance to report and obtain pre-approval of unofficial foreign travel to DoD to allow for the modifications to DoD's IT system to be completed. If a government contracting activity's (GCA) contract separately requires reporting or pre-approval of unofficial foreign travel (i.e., contains a provision requiring such reports other than by incorporating the NISPOM), the contractor should consult with the GCA on when and where to submit such reports and the procedures for obtaining pre-approval.

Exception to Notice and Comment

This regulation can be effective immediately, notwithstanding the general requirement in the Administrative Procedure Act (APA) for advance notice and comment. Principally, this rule follows from a final rule with comment. This final rule is a logical outgrowth of the notice and comment incorporated in the prior final rule, because it is directly responsive to public comments made in response to the final rule. Several commenters specifically requested a delay in the August 24, 2021 implementation date. For example, one commenter stated that for contractors under DoD security cognizance, reporting foreign travel and foreign contacts will be impractical for companies of size without a mass or bulk upload capability that doesn't exist in the system as designed today. Further, the commenter stated this capability should be pursued and aligns with one of the stated goals of SEAD 3, which encourages “automation and centralization.” Even absent the prior notice and comment incorporated in the final rule, this rule would be exempt from the APA's notice-and-comment requirement, because it satisfies the good-cause exception in 553(b)(3)(B). Specifically, notice-and-comment rulemaking is “unnecessary,” id., because as noted in the preamble, DoD already took comments on its NISPOM regulation and the regulated parties affected by the regulation requested that the Department change its IT system before they must report and obtain pre-approval of unofficial foreign travel to DoD. Indeed, DoD is amending the NISPOM regulation for the purpose of extending the implementation date at the request of the regulated parties affected by the rule who provided comments on the NISPOM regulation during a previous notice and comment period provided for the final rule. The need for this change to DoD's IT system was discovered in the comments received on the NISPOM regulation. While DoD desired to modify its IT system before the original implementation date to meet the requested change by the regulated parties, the Department discovered through the comment process that such modification is not feasible. DoD has therefore concluded that there is good cause to dispense with the advanced notice-and-comment rulemaking requirements in 5 U.S.C. 553.

Regulatory Analysis

Executive Order 12866, “Regulatory Planning and Review” and Executive Order 13563, “Improving Regulation and Regulatory Review”

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distribute impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. It has been determined that this rule is a significant regulatory action. Accordingly, the rule has been reviewed by the Office of Management and Budget (OMB) under the requirements of these E.O.s.

Congressional Review Act

This rule is not a “major rule” as defined by 5 U.S.C. 804(2).

Public Law 96-354, “Regulatory Flexibility Act” (5 U.S.C. Chapter 6)

The Under Secretary of Defense for Intelligence and Security, pursuant to a delegation of authority from the Secretary of Defense, certifies that this final rule would not, if promulgated, have a significant economic impact on a substantial number of small business entities in accordance with the Regulatory Flexibility Act (5 U.S.C. 601) requirements since a contractor cleared legal entity may, in entering into contracts requiring access to classified information, negotiate for security costs determined to be properly chargeable by a Government Contracting Activity.

Public Law 96-511, “Paperwork Reduction Act” (44 U.S.C. Chapter 35)

It has been determined that this rule does not impose any new information collection or record keeping requirements under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).

Section 202, Public Law 104-4, “Unfunded Mandates Reform Act”

Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) (2 U.S.C. 1532) requires agencies to assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. This final rule will not mandate any requirements for State, local, or tribal governments, nor will it affect private sector costs.

Executive Order 13132, “Federalism”

E.O. 13132 establishes certain requirements that an agency must meet when it promulgates a final rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. This final rule will not have a substantial effect on State and local governments.

List of Subjects in 32 CFR Part 117

• Classified information; Government contracts; USG contracts
• National Industrial Program (NISP); Prime contractor
• Subcontractor

Accordingly, 32 CFR part 117 is amended as follows:

PART 117— NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL (NISPOM)

1. The authority citation for 32 CFR part 310 continues to read as follows:

Authority: 32 CFR part 2004; E.O. 10865; E.O. 12333; E.O. 12829; E.O. 12866; E.O. 12968; E.O. 13526; E.O. 13563; E.O. 13587; E.O. 13691; Pub. L. 108-458; Title 42 U.S.C. 2011 et seq.; Title 50 U.S.C. Chapter 44; Title 50 U.S.C. 3501 et seq.

2. In § 117.1, paragraph (b)(3) is revised to read as follows:

§ 117.1

Purpose.

* * * * *

(b) * * *

(3) Prescribes that contractors will implement the provisions of this part no later than 6 months from February 24, 2021, with the exception of requirements for reporting foreign travel to the Department of Defense prescribed in SEAD 3 and implemented through this rule. Contractors under the security cognizance of the Department of Defense will begin reporting foreign travel to the Department of Defense no later than 18 months from February 24, 2021.

Dated: August 12, 2021.

Patricia L. Toppings,

OSD Federal Register Liaison Officer, Department of Defense.