{"id":13323,"date":"2023-04-18T06:18:00","date_gmt":"2023-04-18T13:18:00","guid":{"rendered":"https:\/\/www.syteca.com\/?page_id=13323"},"modified":"2025-06-18T06:18:48","modified_gmt":"2025-06-18T13:18:48","slug":"nispom-change-2-and-h-r-act-666","status":"publish","type":"page","link":"https:\/\/www.syteca.com\/en\/solutions\/meeting-compliance-requirements\/nispom-change-2-and-h-r-act-666","title":{"rendered":"NISPOM Conforming Change 2 and Insider Threat and Mitigation Act of 2017 requirements and insider threat program"},"content":{"rendered":"\n\t\t
\n\t\t\t\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t <\/div>\n\n\t \n\n\t \n\n\t \n\t \t\t\t<\/div>\n\t \t\t<\/div>\n\t \t<\/div>\n\t <\/div>\n\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n

NISPOM Change 2 and H.R.666<\/h1>\n\n\n\n

Monitor insider activity. Detect anomalies. Respond to incidents. ALL-IN-ONE<\/strong><\/p>\n\n\n\n\t\t

\n\t\t\t\n\t\t\t\n\n\t\t\t\t\n\t\t\n\t\t\t\t\t\n\t\t\t\t\tAccess the Demo Portal \n\t\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t<\/a>\n\t\t\t\n\n\n\t\t\t\t\n\t\t\n\t\t\t\t\t\n\t\t\t\t\tGet in Touch \n\t\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t<\/a>\n\t\t\t\n\n\t\t\t \n\t\t<\/div>\n\t\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t
\n\t\t\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n

NISPOM Conforming Change 2 and Insider Threat and Mitigation Act of 2017 specified a new set of requirements for your insider threat program. Learn more about these regulations, the importance of the introduced changes, and tools to help you empower insider threat protection within your company.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t

\n\t\t\t\n\t\t\t\n\n
\"\"<\/figure>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t
\n\t\t\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n

What is NISPOM?<\/h2>\n\n\n\n

DoD 5220.22-M National Industrial Security Policy Operating Manual (NISPOM) is a set of requirements and guidelines for implementation, published by the US Department of Defense and applicable to all third party providers and subcontractors working with US government on any projects that may involve classified information.<\/p>\n\n\n\n

NISPOM was created with the purpose of protecting all sensitive information regarding national security, and as a result, any company that has contracts with the Department of Defense or the Defense Security Service (DSS) can be a subject to NISPOM regulations.<\/p>\n\n\n\n

An additional NISPOM requirement related to insider threats took effect on 18 May. Called Change 2, it requires companies to establish a fully-fledged insider threat program in order to deter, detect and respond to potential incidents.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t

\n\t\t\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n

NISPOM Change 2 requirements<\/h2>\n\n\n\n

The insider threat program requirement states that any data related to insider threats needs to be collected and stored in a single centralized location for analysis and reporting. The form of this central hub and the methods of collecting and centralizing all the necessary data can depend on the specifics of your organization.<\/p>\n\n\n\n

The main set of requirements for compliance with Conforming Change 2 include:<\/p>\n\n\n\n

Establish and maintain an insider threat program<\/p>\n\n\n\n

NISPOM requires that companies maintain an insider threat program, including gathering<\/strong>, integrating <\/strong>and reporting <\/strong>any information potentially relevant to insider threats. This program should be consistent with other legislation in this area, including the National Insider Threat Policy, Minimum Standards for Executive Branch Insider Threat Programs, and E.O. 13587.<\/p>\n\n\n\n

Designate a senior employee as the chief manager of an insider threat program<\/p>\n\n\n\n

Companies need to designate an employee to establish and manage their insider threat program as a senior official. Such an employee needs to have US citizenship, and be cleared in connection with the FCL.<\/p>\n\n\n\n

Conduct insider threat training<\/p>\n\n\n\n

The insider threat program senior official needs to ensure that all employees involved with the program, as well as any employees with a sufficient level of clearance complete insider threat training that CSA considers appropriate.<\/p>\n\n\n\n

Such training should generally include counterintelligence and security fundamentals, laws and regulations regarding gathering and handling of data, as well as general indicators of insider threats and methods used by adversaries to recruit personnel, among other things.<\/p>\n\n\n\n

Monitor user activity on classified networks<\/p>\n\n\n\n

Companies need to implement measures that allow detection activity indicative of insider threats on classified networks. Such measures need to correspond to the guidance issued by the CSA (Cognizant Security Agency), as well as other federal regulations with regard to tools that can be used in federal agencies.<\/p>\n\n\n\n

The capability to collect screen captures<\/strong>, full application content<\/strong>, and keystrokes <\/strong>are only some of the requirements that federal laws (in this case, CNSS Directive No. 504) pose for monitoring tools used for insider threat detection.<\/p>\n\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\n\t\t

\n\t\t\t\n\t\t\t\n\n\t\t
\n\t\t\t\n\n\t\t\t\n\n\t\t
\n\t\t\t\n\t\t\t\n\n

Department of Homeland Security Insider Threat and Mitigation Act of 2017<\/h2>\n\n\n\n

The Department of Homeland Security Insider Threat and Mitigation Act of 2017<\/a> was approved by the House of Representatives on 31 January. This legislation is similar to NISPOM Change 2 in that it requires the establishment of an insider threat program, but this time the subject is the Department of Homeland Security itself.<\/p>\n\n\n\n

The main requirements of the Department of Homeland Security Insider Threat and Mitigation Act of 2017 include:<\/p>\n\n\n\n