NAICS Code Lookup Guide

What is NAICS?

The North American Industry Classification System (NAICS) is the standard used by federal statistical agencies to classify business establishments. PRIAMtiv uses a simplified 2-digit sector code to identify each tenant's industry. This code drives risk assessment question selection and category weighting.

Where NAICS Codes Are Used

Module	Purpose	File
Company Registration	Tenant owner selects industry during registration	`src/components/RegistrationForm.tsx`
Tenant Profile	Stored as `naicsCode` on the tenant document	`src/types/tenant.types.ts`
Risk Assessment (DAG Engine)	Determines which question nodes are visible based on `naicsInclude` / `naicsExclude` visibility rules	`src/lib/dag-engine.ts`
Risk Scoring	Category weights may vary by industry	`src/lib/risk-scorer.ts`
Company Profile Display	Shows industry name alongside code	`src/types/company.types.ts`

NAICS codes are NOT used in the Asset Management module. Asset types (Customers, Suppliers, Devices, Vehicles) do not require or store NAICS codes. The NAICS code is a tenant-level property set once by the tenant owner.

Supported NAICS Codes

The application uses the codes defined in db/NAICS-codes.json. Most are 2-digit sector codes (three as hyphenated ranges, for sectors that span multiple numbers), plus 4-digit MVP industry profiles nested under some of those sectors — see .claude/commands/PRIAM-NAICS-migration-instructions.md for the migration this 4-digit tier belongs to. This table was previously out of sync with the actual file (it listed sectors like 11, 21, 42, 53, 56, 61, 71, 72, 92 that were never actually present) — corrected below to match db/NAICS-codes.json exactly.

Code	Industry	Risk Categories
`00`	(Industry Not Set)	(none)
`22`	Utilities	operational, resilience, climate, cyber, regulatory
`2211`	Electric Power Generation, Transmission and Distribution (MVP profile)	operational, resilience, climate, cyber, regulatory
`23`	Construction	operational, safety, financial, strategic
`31-33`	Manufacturing	strategic, operational, resilience, reputation, financial
`3222`	Converted Paper Product Manufacturing (MVP profile)	strategic, operational, resilience, reputation, financial
`3251`	Basic Chemical Manufacturing (MVP profile)	strategic, operational, resilience, reputation, financial
`44-45`	Retail Trade	cyber, regulatory, financial, reputation
`4452`	Specialty Food Retailers (MVP profile)	cyber, regulatory, financial, reputation
`48-49`	Transportation and Warehousing	safety, regulatory, operational
`4841`	General Freight Trucking (MVP profile)	safety, regulatory, operational
`4842`	Specialized Freight Trucking (MVP profile)	safety, regulatory, operational
`51`	Information	resilience, operational, strategic, cyber, financial
`5132`	Software Publishers (MVP profile)	resilience, operational, strategic, cyber, financial
`52`	Finance and Insurance	regulatory, financial, reputation
`5242`	Agencies, Brokerages, and Other Insurance Related Activities (MVP profile)	regulatory, financial, reputation
`54`	Professional, Scientific, and Technical Services	financial, regulatory, strategic, cyber, reputation
`5413`	Architectural, Engineering, and Related Services (MVP profile)	financial, regulatory, strategic, cyber, reputation
`55`	Management of Companies and Enterprises	strategic, operational, reputation, cyber, financial
`62`	Health Care and Social Assistance	regulatory, cyber, reputation, operational, resilience, safety
`624`	Social Assistance	regulatory, cyber, reputation, operational, safety
`6241`	Individual and Family Services (MVP profile)	regulatory, cyber, reputation, operational, safety
`6243`	Vocational Rehabilitation Services (MVP profile)	regulatory, cyber, reputation, operational, safety
`81`	Other Services (except Public Administration)	operational, financial, reputation

(MVP profile) rows are the 11 industry groups from the NAICS Migration & MVP Scoping plan (issue #405 and children). Their risk_mapping above is inherited from the parent sector as a placeholder — refining it per-industry is issue #409's job, not done yet.

Code Format

NAICS codes in this application use one of two formats:

Simple 2-digit: "11", "62", "92" — most sectors
Range: "31-33", "44-45", "48-49" — sectors that span multiple 2-digit codes

Range Code Handling

The DAG engine expands range codes into individual codes for matching. For example, a tenant with NAICS code "31-33" is expanded to ["31", "32", "33"] before comparison against question visibility rules.

// From src/lib/dag-engine.ts
private expandNaicsCode(code: string): string[] {
  if (code.includes('-')) {
    const [start, end] = code.split('-').map(Number);
    const codes: string[] = [];
    for (let i = start; i <= end; i++) {
      codes.push(String(i));
    }
    return codes;
  }
  return [code];
}

How NAICS Codes Flow Through the System

Registration Form
  └─> POST /api/auth/register-verify
        └─> Firestore: tenants/{tenantId}.naicsCode = "62"

Risk Assessment Start
  └─> POST /api/assessment/start
        └─> Reads tenant.naicsCode
        └─> DAGEngine.getInitialQuestions()
              └─> Evaluates VisibilityRule.naicsInclude / naicsExclude
              └─> Returns only questions relevant to the tenant's industry

Visibility Rules in Question DAGs

Each question node in a DAG can have visibility rules that reference NAICS codes:

{
  "nodeId": "cyber-q1",
  "visibilityRules": {
    "naicsInclude": ["51", "52", "54", "62"],
    "naicsExclude": ["11"]
  }
}

naicsInclude: If set, the question is only shown to tenants whose NAICS code matches one of these values. If empty or absent, the question is shown to all industries.
naicsExclude: If the tenant's NAICS code matches any of these values, the question is hidden. Exclude rules take precedence over include rules.

API Endpoints

GET `/api/data/naics-codes`

Returns the full list of NAICS codes from db/NAICS-codes.json. No authentication required.

Response: Array of objects with naics_code, name, risk_mapping, and optional subcategories.

GET/PATCH `/api/tenant/social-impact`

Reads or updates the tenant's socialImpact value (1-10 scale). This is used alongside the NAICS code during risk scoring.

Adding New NAICS Codes

Edit db/NAICS-codes.json and add a new entry with naics_code, name, and risk_mapping.
If the new code needs industry-specific questions, update the DAG seed data in db/risks/ and add appropriate naicsInclude rules to relevant question nodes.
Re-seed the database: pnpm seed:dags
The registration form and NAICS API will automatically pick up the new code.

Common Developer Questions

Q: Why don't Customer assets have a NAICS code field? A: NAICS codes classify the tenant's own industry, not their customers' industries. The code is set once at the tenant level and used exclusively by the Risk Assessment engine.

Q: What happens if a tenant has no NAICS code set? A: The code defaults to "00" (Industry Not Set). The Risk Assessment module will prompt the tenant owner to set their industry before starting an assessment.

Q: How do I add industry-specific risk questions? A: Add naicsInclude rules to question nodes in the DAG seed files under db/risks/. See src/types/risk.types.ts for the VisibilityRule interface.

Q: Where is NAICS code validated? A: During registration, via the auth.schemas.ts validation (z.string().min(1)). The registration form uses a dropdown populated from the NAICS codes API, preventing invalid entries.

Last Updated: 2026-03-09