Contractors are required to establish an information management system to protect and control classified information in their possession.

• A. True
• B. False
• C. Not sure
• D. Depends on contract

Answer: (A)

Contractors who handle classified information must have a formal information management system to protect and control that information. The NISPOM requires cleared contractors to establish, document, and implement an information security program that covers all forms of classified material—paper, electronic, and other media. This information management system provides the framework for classification and marking, access control, handling, storage, transport, destruction, incident reporting, and training, ensuring accountability and safeguarding across the contractor’s organization and any subcontractors. While contracts may specify additional duties, the baseline obligation to protect classified information is universal, not dependent on a specific contract.