Who is responsible for safeguarding classified information in custody or control?

• A. Government
• B. Contractors
• C. Security Officers
• D. The information owner

Answer: (B)

When classified information is in someone else’s custody or control, the duty to protect it rests with the custodian—the entity that has possession of the information. In the National Industrial Security Program, a contractor that receives or stores classified information becomes the custodian and must put in place the full safeguarding measures: limit access to authorized personnel, store it in approved secure facilities or use approved secure systems, follow proper handling and marking procedures, protect electronic data with approved security controls, and promptly report any security incidents. The information owner determines classification and who needs to know, but does not carry out day‑to‑day safeguarding once the information is entrusted to a contractor. Government policy and oversight set the rules, and security officers enforce them, but the actual responsibility for safeguarding in custody lies with the custodian—the contractor.