Facility Security Officer: Duties, Training, and Reporting

A facility security officer, or FSO, is the cleared employee a defense contractor designates to protect classified information and maintain the company’s facility clearance under the National Industrial Security Program. The role is governed primarily by 32 CFR Part 117, commonly called the NISPOM Rule, and every contractor holding a facility clearance (FCL) must appoint one. The FSO reports to the Defense Counterintelligence and Security Agency (DCSA) on everything from personnel clearances to security incidents, and sits between federal oversight and the contractor’s day-to-day work.

When a Company Must Appoint One

Any company that wants to bid on or perform classified U.S. government contracts needs a facility clearance, and an FCL requires the company’s senior management official to designate an FSO in writing.¹ DCSA will not grant or maintain the clearance without a named, cleared FSO on record, so the designation is one of the first steps in the FCL process, often before any classified work can begin.

At smaller contractors, FSO duties are frequently a collateral assignment layered on top of someone’s primary job. Larger defense firms staff the position full-time, sometimes with a team of assistant FSOs. The regulatory obligations are the same either way.

What the FSO Does

Every duty flows from a single mandate in the NISPOM: supervise and direct the security measures needed to protect classified information at the facility.¹ In practice, the work falls into a handful of areas.

Written Standard Practice Procedures

Every cleared facility needs a written Standard Practice Procedures document (SPP). This is a company-specific manual that translates the NISPOM’s broad requirements into concrete procedures for that particular site.² It covers how employees handle classified documents, where those documents are stored, how visitors are processed, and what happens when something goes wrong. The FSO drafts the SPP, keeps it current, and makes sure employees actually follow it. DCSA reviews it during security assessments, so a stale or incomplete SPP is one of the fastest ways to draw scrutiny.

Security Briefings and Training

The FSO manages the full cycle of employee security awareness. New hires with clearances receive an initial briefing before touching classified material, and all cleared employees receive annual refresher training on insider threat awareness, classification markings, and reporting obligations.³ When someone leaves or no longer needs access, the FSO conducts a debriefing to reinforce their continuing obligation not to disclose classified information. DCSA audits the completion records, so tracking them matters.

Safeguarding Classified Information

At possessing facilities (those approved to store classified material on-site), the FSO oversees physical controls: GSA-approved storage containers, restricted area access, alarm systems, and end-of-day checks. All classified documents must carry proper markings identifying the level of protection required, the source of classification, and any downgrading or declassification instructions.⁴ The FSO also manages document accountability so classified material can be traced from receipt through destruction.

Visit Authorization

When cleared employees need to visit another contractor’s facility or a government site for classified work, the FSO processes visit authorization requests through DCSA. The hosting facility verifies each visitor’s clearance level and need-to-know before disclosing anything classified.⁵ Incoming visit requests work the same way in reverse. Foreign government visits carry additional requirements, including potential export authorization.

Insider Threat Program

Every cleared contractor must run an insider threat program, and the FSO either leads it or is closely integrated with the person who does. That person is the Insider Threat Program Senior Official (ITPSO), who must be a U.S. citizen, a direct employee, and cleared at the FCL level. The FSO and ITPSO can be the same person; if they aren’t, the FSO still has to be an active participant.⁶ All cleared employees must complete insider threat awareness training before getting access and annually thereafter, and the FSO keeps the records that prove it.³

Who Qualifies

The FSO must be a U.S. citizen and a direct employee of the cleared contractor. Exceptions for non-citizens are extremely narrow.¹ The individual must hold a personnel security clearance at the same level as the company’s FCL. A Secret FCL requires a Secret PCL; a Top Secret FCL requires the more extensive background investigation that goes with a Top Secret clearance.

The FSO also appears on the company’s Key Management Personnel (KMP) list, the formal roster of people whose positions could influence protection of classified information.⁷ Citizenship verification is part of the clearance process for every submitted employee, using original or certified documents like birth certificates, passports, or naturalization certificates.⁸

One boundary worth flagging: a Limited Access Authorization (LAA) is not a security clearance and does not qualify anyone to serve as FSO. LAAs are a rare mechanism DCSA may use to give a non-citizen with unique skills access to a specific classified program at no higher than Secret, and the authorization ends when that work does.⁹

Required Training

Beyond the training required of all cleared employees, the FSO must complete position-specific coursework through the Center for Development of Security Excellence (CDSE), part of DCSA. The track depends on the type of facility:

Possessing facilities, approved to store classified material on-site, follow the “FSO Program Management for Possessing Facilities” curriculum (IS030.CU), which covers physical security, document control, and classification management.¹⁰
Non-possessing facilities, whose employees access classified information only at government sites, follow the “FSO Orientation for Non-Possessing Facilities” curriculum (IS020.CU), a lighter track focused on personnel security and administrative requirements.¹¹

Courses and exams must be completed through the Security Training, Education, and Professionalization Portal (STEPP); credit is only awarded for work done within that system.¹⁰ Completion certificates are among the records DCSA reviews.

CDSE also runs the voluntary Security Professional Education Development (SPēD) Certification Program. The Security Fundamentals Professional Certification (SFPC) is the foundational credential, and FSOs who earn it can pursue the Industrial Security Oversight Credential (ISOC), designed for professionals working within the NISP.¹² These are not required.

How the Designation Becomes Official

Formal recognition involves a company action and government-system updates. The senior management official prepares an FSO appointment letter confirming the individual is a U.S. citizen and a direct employee, and the letter is uploaded into the National Industrial Security System (NISS), the primary system of record for facility-level security data.⁷

The FSO’s clearance and access records live in the Defense Information System for Security (DISS). Because individuals cannot view or act on their own DISS records, every cleared company must have at least two DISS account holders. When a company first applies for its FCL, an alternate DISS account holder initiates the FSO’s background investigation paperwork.⁷ Once DCSA accepts the submissions, the designation is official.

Reporting Obligations

Ongoing reporting is where many FSOs spend a disproportionate share of their time, and where consequences for getting it wrong come fastest.

Changed Conditions

Any event that could affect the FCL must be reported. Common triggers include changes in ownership or control, changes to KMP, actions to terminate business operations, and bankruptcy filings.¹³ Delayed reporting is treated almost as seriously as failing to report at all.

Key Management Personnel

Every change to the KMP list, whether someone joins, leaves, or changes roles, triggers a report to DCSA covering clearance status, level, and basic identifying information.¹³ When a board member or officer will not have access to classified information, the company passes a formal exclusion resolution establishing that the individual has no access and no ability to influence protection of classified material.¹⁴ DCSA provides templates, and the resolutions must be kept current.

Foreign Ownership, Control, or Influence

If foreign involvement changes materially, the FSO submits an updated SF 328 (“Certificate Pertaining to Foreign Interests”) to DCSA. Discussions or agreements that could lead to effective foreign ownership or control must be reported in writing before the deal closes.¹³ Missing a FOCI report can result in revocation of the FCL, which ends every classified contract the company holds.

Suspicious Contacts

Contractors must report suspicious contacts involving cleared employees, including efforts by anyone to obtain unauthorized access and contacts suggesting an employee may be targeted by a foreign intelligence service.¹³ Scenarios range from an unsolicited email requesting technical data to a conference encounter that feels like a recruitment pitch. The FSO documents details and submits them to DCSA.

Security Violations

When classified information is potentially lost or compromised, the FSO initiates a preliminary inquiry. The report to DCSA must cover the circumstances, the specific information involved, whether an actual compromise occurred, the individuals responsible, corrective actions taken, and a recommendation on whether a formal investigation is warranted.¹⁵

Self-Inspections and DCSA Reviews

The FSO must conduct an annual self-inspection covering the entire security program: SPP, insider threat documentation, marking practices, storage container integrity, training records, and corrective actions from prior findings. The report documents specific findings and tracks each one to resolution.

Separately, DCSA conducts periodic security reviews and assigns one of five ratings.¹⁶

Superior, the highest rating, reflects exceptional performance with no critical or systemic vulnerabilities.
Commendable indicates a strong program with minor findings only.
Satisfactory means the facility meets requirements, and it is where most facilities land.
Marginal signals significant deficiencies that need prompt correction.
Unsatisfactory reflects critical failures that may lead to suspension or revocation of the FCL.

DCSA uses a numerical scoring system that factors in the severity of findings and whether the facility is in “general conformity,” meaning no critical or systemic vulnerabilities and no serious security issues.¹⁷

Continuous Vetting

Cleared personnel used to go through periodic reinvestigations on a set schedule, typically every five years for Secret and every ten for Top Secret. Under Trusted Workforce 2.0, DCSA is replacing periodic reinvestigations with continuous vetting, an automated system that checks criminal, terrorism, financial, and public records on an ongoing basis.¹⁸ For the FSO, this shifts the work from tracking reinvestigation due dates toward responding to alerts and managing the adjudication process when a flag comes in. Full enrollment capability across agencies was reached in fiscal year 2025.¹⁹

Planning for Turnover

Losing an FSO to resignation, retirement, or reassignment creates an immediate compliance gap, because the company cannot hold its FCL without a designated FSO. The replacement has to meet the same eligibility rules: U.S. citizenship, direct employment, and a clearance at the FCL level. If no one at the company currently holds the right clearance, the FCL is in jeopardy until the new FSO is processed and approved. The change must be reported to DCSA through NISS like any other KMP change.¹³ Naming an alternate or assistant FSO who can step in without a clearance gap keeps classified work from grinding to a halt.

1
eCFR. 32 CFR 117.7 – Contractor Security Officials
2
Defense Counterintelligence and Security Agency. Standard Practice Procedures
3
eCFR. 32 CFR 117.12 – Security Education and Training
4
eCFR. 32 CFR 117.14 – Marking Requirements
5
eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual, Section 117.16
6
Center for Development of Security Excellence. Insider Threat Job Aid for Industry
7
Defense Counterintelligence and Security Agency. Facility Clearance Orientation Handbook
8
eCFR. 32 CFR 117.10 – Personnel Security Clearances
9
Defense Counterintelligence and Security Agency. Security Assurances for Personnel and Facilities
10
Center for Development of Security Excellence. FSO Program Management for Possessing Facilities IS030.CU
11
Center for Development of Security Excellence. FSO Toolkit – Curricula
12
DoD Certification Program Management Office. Security
13
eCFR. 32 CFR 117.8 – Reporting Requirements
14
Defense Counterintelligence and Security Agency. FCL Orientation Handbook – Exclusion Resolutions
15
Center for Development of Security Excellence. NISP Security Violations and Administrative Inquiries Student Guide
16
Defense Counterintelligence and Security Agency. Security Review and Rating Process
17
Center for Development of Security Excellence. Introduction to the Security Rating Score
18
Defense Counterintelligence and Security Agency. Continuous Vetting
19
Defense Counterintelligence and Security Agency. Continuous Vetting Enrollment Begins for Non-Sensitive Public Trust Federal Workforce