Facility Security Clearance: Requirements, Process, and Upkeep

To qualify for a facility security clearance, your company needs a government or prime-contractor sponsor, a U.S.-organized corporate structure that can pass a foreign-influence review, cleared key management personnel, and a working internal security program that the Defense Counterintelligence and Security Agency (DCSA) verifies on site. DCSA issues facility clearances (FCLs) at three levels: Confidential, Secret, and Top Secret. The government pays for the clearance investigations themselves, but the staffing and physical infrastructure needed to qualify come out of your budget.

You Cannot Apply on Your Own

The first thing to understand is that a company cannot request its own FCL. A government contracting activity (GCA) or an already-cleared prime contractor must sponsor you, confirming that you have a legitimate need to access classified information.¹ That creates a chicken-and-egg problem: you need a clearance to perform classified work, but you generally need the work to justify the clearance.

Sponsorship takes one of two forms. Pre-award sponsorship happens when a GCA determines you need classified access to bid on a contract. It requires the solicitation number, written authorization confirming classified access is needed during the pre-award stage, and a pre-award DD Form 254. Post-award sponsorship follows a contract win and includes the DD Form 254, the statement of work, and any GCA authorization for security requirements beyond the baseline.² The DD Form 254 tells your company exactly what classification levels and categories of classified information the contract involves.³

Sponsorship requests flow through the National Industrial Security System (NISS), DCSA’s system of record for the National Industrial Security Program.¹ For a small business trying to break in, the most realistic path is usually subcontracting under a cleared prime who can sponsor you.

Your Company Structure Must Pass Scrutiny

The company must be organized under U.S. law so that it falls within U.S. jurisdiction. The governing rules sit in the National Industrial Security Program Operating Manual (NISPOM), codified at 32 C.F.R. Part 117.⁴

The most heavily scrutinized part is the Foreign Ownership, Control, or Influence (FOCI) review. DCSA needs to determine whether any foreign person, company, or government has enough influence over your business to threaten classified information. You begin by completing Standard Form 328, Certificate Pertaining to Foreign Interests, disclosing ownership percentages, foreign ties, corporate structure, and debts to foreign entities.⁵

If FOCI exists, your company must mitigate it through a formal agreement scaled to the degree of foreign influence:

A Board Resolution applies when a foreign entity owns some stock but not enough to elect a board representative.⁶
A Security Control Agreement (SCA) applies when a foreign entity is entitled to board representation but does not effectively own or control the company.
A Special Security Agreement (SSA) applies when a foreign entity effectively owns or controls the company. Access to the most sensitive information, such as Top Secret, Sensitive Compartmented Information, or Special Access Programs, under an SSA requires the GCA to complete a National Interest Determination.
Voting Trust or Proxy Agreements are the most restrictive instruments, used when direct foreign ownership is substantial enough that the foreign owner’s voting rights must be transferred to cleared U.S. trustees or proxy holders.

Companies operating under an SSA, SCA, Voting Trust, or Proxy Agreement must also establish a Government Security Committee of cleared U.S. citizen board members who oversee classified and export-controlled matters, and DCSA meets with these committees at least annually.⁶

Once FOCI is resolved, your company executes DD Form 441, the Department of Defense Security Agreement, which formalizes your obligation to protect classified information and comply with the NISPOM.⁷

Key Management Personnel Must Hold Clearances

Your company cannot hold an FCL unless certain individuals within it hold personal clearances at the same level. The NISPOM defines these Key Management Personnel (KMPs) as your senior management official, your facility security officer, your insider threat program senior official, and every other official who holds a majority interest or has authority to influence management decisions or classified contract performance.⁴ In practice that means:

The Senior Management Official (SMO), with authority over daily operations.
The Facility Security Officer (FSO), who runs the security program.
The Insider Threat Program Senior Official (ITPSO).
Board members, owners, and officers who can direct or influence company operations or classified work.

Each KMP completes Standard Form 86 (SF-86), Questionnaire for National Security Positions. The SF-86 covers employment, residences, foreign contacts, financial records, and criminal history, and is submitted electronically through DCSA’s eApp system, which replaced e-QIP.⁸ The government covers the cost of the investigations themselves.

If a KMP already holds an active clearance from another federal agency, reciprocity should apply. Under Security Executive Agent Directive 7 (SEAD 7), agencies must accept existing background investigations and eligibility determinations, and the receiving agency must decide within five business days of receiving the request.⁹ Reciprocity covers the clearance itself. Separate employment suitability or fitness determinations fall outside its scope.

You Must Build a Working Security Program

Before DCSA grants the FCL, your company must show it has a functioning program to protect classified information. DCSA verifies this in person.

Facility Security Officer

The FSO is the person DCSA holds responsible for your entire security program: document control, security education, visitor procedures, reporting, and NISPOM compliance. FSOs must complete a mandatory training curriculum through the Center for Development of Security Excellence (CDSE) covering industrial security fundamentals, facility clearances, personnel clearances, FOCI, safeguarding, derivative classification, and self-inspection. For a possessing facility, that comes to fourteen courses.¹⁰ At small companies the FSO role is sometimes an additional duty. Larger companies hire dedicated FSOs, with experienced hires drawing roughly $80,000 to $100,000 or more nationally depending on clearance level and location.

Insider Threat Program

Every cleared contractor must establish an insider threat program under a designated ITPSO, whose job is to detect, deter, and mitigate risk from people inside the organization who might compromise classified information intentionally or through negligence. The ITPSO coordinates with the FSO and ensures employees understand what to report. This is a NISPOM requirement and DCSA reviews it during security assessments.

Security Education

Your FSO must give every employee an initial security briefing before they access classified information, followed by annual refresher training. Employees also need briefings when they change assignments involving different classification levels, and a debriefing when they leave or no longer need access.

Physical Infrastructure and What It Costs You

Investigations are on the government. Infrastructure is on you, and this is where companies entering the classified space are most often caught off guard.

If your contract requires storing classified material on-site, making you a “possessing facility,” you need GSA-approved security containers. Shipping alone runs $400 to $1,500 depending on delivery method and location.¹¹ Contracts involving Sensitive Compartmented Information may require building or accrediting a SCIF, which runs $350 to $1,000 per square foot depending on construction requirements and location.

Beyond storage, budget for alarm and intrusion detection systems, access control for restricted areas, secure communications equipment where required, and the ongoing salary of your FSO and any supporting security staff. A non-possessing facility, which accesses classified information at government or prime contractor sites but does not store it, has significantly lower infrastructure costs. You still need the personnel clearances and the administrative program.

How Long the Process Takes

Once your sponsor submits the request through NISS, your company assembles the FCL package: the completed SF 328, the DD Form 441, KMP SF-86 submissions through eApp, and your facility’s security documentation. DCSA then investigates the company’s structure and the KMPs’ backgrounds, and sends representatives to verify physical security measures, review your security procedures manual, and interview KMPs.¹²

Plan for the process to take longer than you’d like. Based on DCSA data from early 2026, the 90th-percentile processing time for a Secret-level (Tier 3) personnel investigation runs roughly five months, and a Top Secret (Tier 5) investigation runs roughly nine months. Those figures cover the personnel investigation piece. The overall FCL timeline depends on FOCI resolution, how quickly your company submits a complete package, and whether DCSA needs follow-up information. Incomplete packages are the most common source of delay. Missing a single document in your SF 328 or having a KMP’s SF-86 kicked back for errors can add weeks.

Keeping the Clearance

Getting the FCL is only the start. Maintaining it requires continuous NISPOM compliance, and DCSA actively monitors cleared facilities.

Reporting Changes

Your company must promptly report changes that could affect eligibility, including ownership or control changes, KMP departures and replacements, any material change to previously reported foreign interests (submitted via an updated SF 328), discussions or agreements that could lead to foreign control, termination of operations or bankruptcy, and name or address changes for the company or any cleared facility.

Continuous Vetting

All cleared personnel are enrolled in Continuous Vetting, an automated system that monitors financial, criminal, and terrorism databases along with public records on an ongoing basis.¹³ When something flags, such as an arrest, foreign travel, unusual financial activity, or a credit issue, DCSA reviews the alert to decide whether further action is needed. This replaced the old periodic reinvestigation model. For your business it means a cleared employee’s off-duty conduct can trigger a review at any time.

Security Reviews and Ratings

DCSA conducts periodic security reviews and assigns one of five ratings: superior, commendable, satisfactory, marginal, or unsatisfactory.¹⁴ A marginal or unsatisfactory rating means DCSA identified serious deficiencies. A single poor review does not automatically revoke your clearance, but it triggers increased oversight and corrective action requirements, and persistent problems can lead to suspension or revocation. Your FSO should run annual self-inspections to catch problems first, and the CDSE curriculum includes a dedicated self-inspection course.¹⁰

If a Clearance Is Denied or Revoked

Individual personnel clearance denials and revocations go through the Defense Office of Hearings and Appeals (DOHA). The individual can request a hearing before a DOHA administrative judge, present evidence, and cross-examine witnesses, then appeal to the DOHA Appeal Board.¹⁵ After a final denial or revocation, the individual must wait one year before reapplying and must show the underlying issues are resolved.

For the company, losing a KMP’s clearance can directly jeopardize the FCL, especially if that person is the sole SMO or FSO. Having backup personnel cleared and ready is one of the smartest moves a small cleared contractor can make.

1
Defense Counterintelligence and Security Agency. Facility Clearances
2
Office of Naval Research. Roadmap – Getting Facility Clearance FCL Sponsorship
3
Acquisition.GOV. 48 CFR 504.471 – Contract Security Classification Specification
4
eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM)
5
Nuclear Regulatory Commission. SF-328, Certificate Pertaining to Foreign Interests
6
Defense Counterintelligence and Security Agency. Mitigation Agreements
7
Department of Defense. DD Form 441 – Department of Defense Security Agreement
8
Defense Counterintelligence and Security Agency. Electronic Questionnaires for Investigations Processing (e-QIP)
9
Defense Counterintelligence and Security Agency. DCSA Reciprocity Program
10
Center for Development of Security Excellence. FSO Program Management for Possessing Facilities (IS030.CU)
11
General Services Administration. Ordering Security Containers
12
Defense Counterintelligence and Security Agency. Updated Sponsorship and Facility Clearance Package Submission Procedures
13
Defense Counterintelligence and Security Agency. Continuous Vetting
14
Defense Counterintelligence and Security Agency. Security Review and Rating Process
15
Defense Counterintelligence and Security Agency. FAQs – Facility Security Officers