NAICS Code Lookup Guide

What is NAICS?

The North American Industry Classification System (NAICS) is the standard used by federal statistical agencies to classify business establishments. PRIAMtiv uses a simplified 2-digit sector code to identify each tenant's industry. This code drives risk assessment question selection and category weighting.

Where NAICS Codes Are Used

Module	Purpose	File
Company Registration	Tenant owner selects industry during registration	`src/components/RegistrationForm.tsx`
Tenant Profile	Stored as `naicsCode` on the tenant document	`src/types/tenant.types.ts`
Risk Assessment (DAG Engine)	Determines which question nodes are visible based on `naicsInclude` / `naicsExclude` visibility rules	`src/lib/dag-engine.ts`
Risk Scoring	Category weights may vary by industry	`src/lib/risk-scorer.ts`
Company Profile Display	Shows industry name alongside code	`src/types/company.types.ts`

NAICS codes are NOT used in the Asset Management module. Asset types (Customers, Suppliers, Devices, Vehicles) do not require or store NAICS codes. The NAICS code is a tenant-level property set once by the tenant owner.

Supported NAICS Codes

The application uses the codes defined in db/NAICS-codes.json. All codes are 2-digit sector codes, with three range codes for sectors that span multiple numbers.

Code	Industry	Risk Categories
`00`	(Industry Not Set)	(none)
`11`	Agriculture, Forestry, Fishing and Hunting	strategic, operational, climate, environmental, regulatory, safety
`21`	Mining, Quarrying, and Oil and Gas Extraction	regulatory, safety, operational, financial, strategic
`22`	Utilities	operational, resilience, climate, cyber, regulatory
`23`	Construction	operational, safety, financial, strategic
`31-33`	Manufacturing	strategic, operational, resilience, reputation, financial
`42`	Wholesale Trade	cyber, regulatory, financial, reputation
`44-45`	Retail Trade	cyber, regulatory, financial, reputation
`48-49`	Transportation and Warehousing	safety, regulatory, operational
`51`	Information	resilience, operational, strategic, cyber, financial
`52`	Finance and Insurance	regulatory, financial, reputation
`53`	Real Estate and Rental and Leasing	financial, operational, reputation
`54`	Professional, Scientific, and Technical Services	financial, regulatory, strategic, cyber, reputation
`55`	Management of Companies and Enterprises	strategic, governance, operational, reputation, cyber
`56`	Administrative and Support and Waste Management	regulatory, cyber, reputation
`61`	Educational Services	(none defined)
`62`	Health Care and Social Assistance	regulatory, cyber, reputation, operational, resilience, safety
`71`	Arts, Entertainment, and Recreation	safety, operational, reputation
`72`	Accommodation and Food Services	regulatory, safety, reputation
`81`	Other Services (except Public Administration)	operational, financial, reputation
`92`	Public Administration	resilience, operational, strategic

Code Format

NAICS codes in this application use one of two formats:

Simple 2-digit: "11", "62", "92" — most sectors
Range: "31-33", "44-45", "48-49" — sectors that span multiple 2-digit codes

Range Code Handling

The DAG engine expands range codes into individual codes for matching. For example, a tenant with NAICS code "31-33" is expanded to ["31", "32", "33"] before comparison against question visibility rules.

// From src/lib/dag-engine.ts
private expandNaicsCode(code: string): string[] {
  if (code.includes('-')) {
    const [start, end] = code.split('-').map(Number);
    const codes: string[] = [];
    for (let i = start; i <= end; i++) {
      codes.push(String(i));
    }
    return codes;
  }
  return [code];
}

How NAICS Codes Flow Through the System

Registration Form
  └─> POST /api/auth/register-verify
        └─> Firestore: tenants/{tenantId}.naicsCode = "62"

Risk Assessment Start
  └─> POST /api/assessment/start
        └─> Reads tenant.naicsCode
        └─> DAGEngine.getInitialQuestions()
              └─> Evaluates VisibilityRule.naicsInclude / naicsExclude
              └─> Returns only questions relevant to the tenant's industry

Visibility Rules in Question DAGs

Each question node in a DAG can have visibility rules that reference NAICS codes:

{
  "nodeId": "cyber-q1",
  "visibilityRules": {
    "naicsInclude": ["51", "52", "54", "62"],
    "naicsExclude": ["11"]
  }
}

naicsInclude: If set, the question is only shown to tenants whose NAICS code matches one of these values. If empty or absent, the question is shown to all industries.
naicsExclude: If the tenant's NAICS code matches any of these values, the question is hidden. Exclude rules take precedence over include rules.

API Endpoints

GET `/api/data/naics-codes`

Returns the full list of NAICS codes from db/NAICS-codes.json. No authentication required.

Response: Array of objects with naics_code, name, risk_mapping, and optional subcategories.

GET/PATCH `/api/tenant/social-impact`

Reads or updates the tenant's socialImpact value (1-10 scale). This is used alongside the NAICS code during risk scoring.

Adding New NAICS Codes

Edit db/NAICS-codes.json and add a new entry with naics_code, name, and risk_mapping.
If the new code needs industry-specific questions, update the DAG seed data in db/risks/ and add appropriate naicsInclude rules to relevant question nodes.
Re-seed the database: pnpm seed:dags
The registration form and NAICS API will automatically pick up the new code.

Common Developer Questions

Q: Why don't Customer assets have a NAICS code field? A: NAICS codes classify the tenant's own industry, not their customers' industries. The code is set once at the tenant level and used exclusively by the Risk Assessment engine.

Q: What happens if a tenant has no NAICS code set? A: The code defaults to "00" (Industry Not Set). The Risk Assessment module will prompt the tenant owner to set their industry before starting an assessment.

Q: How do I add industry-specific risk questions? A: Add naicsInclude rules to question nodes in the DAG seed files under db/risks/. See src/types/risk.types.ts for the VisibilityRule interface.

Q: Where is NAICS code validated? A: During registration, via the auth.schemas.ts validation (z.string().min(1)). The registration form uses a dropdown populated from the NAICS codes API, preventing invalid entries.

Last Updated: 2026-03-09