Facility Security Clearance Basics: A Primer on the Process

Author, David Fletcher

Having a facility security clearance (FCL) can open the door to new opportunities and customer relationships for United States government contractors. An understanding of the process and early planning can help smooth the road from application to issuance. This article provides an overview of the steps required to obtain an FCL from the Defense Counterintelligence and Security Agency (DCSA), a US Department of Defense agency and the cognizant security authority for cleared contractors in the defense industrial base, and highlights key related considerations as you form and grow your business.

Establishing a ‘need to know’

DCSA will consider a company for an FCL only if the company has established a need to access classified information. Such a need arises when a company is awarded (or in some cases, is pursuing) a government prime contract or subcontract that will legitimately require the company to access classified information in the performance of the contract. The contractual documents indicate this need through the inclusion of a DD Form 254, Department of Defense Contract Security Classification Specification (DD254), specifying the security requirements and associated level of clearance necessary for a particular procurement. This lays the foundation for the “need” DCSA will require to consider a company for an FCL.

Sponsorship

To initiate the process of applying for an FCL, the company must be sponsored by either the relevant government customer agency or the cleared prime contractor with which the company will enter a subcontract containing a DD254. Companies cannot apply directly to DCSA for an FCL in the absence of this sponsorship. The sponsorship request goes directly to DCSA and outlines the justification for processing the applicant company – i.e., the underlying requirement for access to classified information. DCSA reviews the sponsorship request, and may approve or deny it or request additional information. If approved, the company will receive an introductory email from DCSA, beginning the application process, with identified deadlines and important instructions about how to proceed. It is important to note that before the sponsorship request is submitted, the company should identify its facility security officer (FSO), as their contact information must be included with the sponsorship request.

Preparing the application

The applicant’s submission of supporting materials to DCSA in response to DCSA’s welcome email includes key business information and documentation. Given the detail and volume, contractors are well served by preparing these materials ahead of time in anticipation of their sponsorship for an FCL. Failure to timely provide the application materials to DCSA once the FCL process has begun can result in rejection of the application.

As a starting point, ensure basic corporate records are in order, such as your operating agreement, bylaws, certificate of incorporation and shareholders’ agreements. Confirm that your registration in the System for Award Management is active and up to date, and that your company’s address and website information is current and accurate. Prepare a corporate organizational chart showing the relationship between all entities, if applicable, and a full ownership chain, including all shareholders with 5% or greater interests. Create a list of the company’s key management personnel (KMP), which includes at minimum the FSO and the company’s senior management official, and may also include other officers and directors, and gather from these individuals their full legal name, date and place of birth, social security number and clearance information. Essential KMP must have a personnel security clearance at or above the level of the facility clearance – if any KMP are not cleared, they should begin preparing an application for a personnel clearance, which must be issued before the company receives its FCL. Fill out the DD Form 441, Department of Defense Security Agreement, and Standard Form 328 (SF 328), Certificate Pertaining to Foreign Interests (available on DCSA’s website). These materials will go a long way toward ensuring the company can timely respond to DCSA’s requests for information once the application process begins.

FOCI

The SF 328 is the primary method by which DCSA seeks to identify contractors that may be under foreign ownership, control or influence (FOCI). A company under FOCI may not be issued an FCL or granted access to classified information unless and until DCSA considers such FOCI to be effectively mitigated. FOCI can result from various circumstances, ranging from traditional ownership considerations, such as a foreign parent company, to less direct means of influence, such as large debt obligations to foreign lenders.

The SF 328 includes detailed instructions about how to analyze and respond to each of its nine questions. The relative brevity of the form at first glance leaves some with the misimpression that completing it is a simple task, but it can be quite complex and time-consuming to do so accurately. Plan to involve stakeholders in a range of company departments, management and ownership in the process. If DCSA identifies FOCI in its analysis, the appropriate form of mitigation will depend on the circumstances, and may entail board resolutions, a security control agreement, special security agreement or proxy agreement, with a variety of required ancillary agreements to address electronic communications, visitation procedures, affiliated operations and other aspects of the company’s operations. Negotiating the FOCI mitigation plan will extend the timeline for processing the company’s FCL application, so build this into the company’s expectations if it is relevant to your business.

Entity structuring considerations

The aspects of the company that DCSA considers in processing an FCL application, such as its organizational chart, KMP and FOCI, suggest companies can take steps as early as formation to prepare for the eventual step of seeking an FCL if doing so is potentially part of the long-term business plan. For example, an entity may wish to limit the participation of foreign shareholders or investors, identify US citizens with (or eligible for) personnel clearances for key company management roles, and scrutinize potential foreign customer relationships and other foreign connections and affiliations. Some entities choose to establish subsidiaries dedicated exclusively to US government business and structure those subsidiaries with the requirements and restrictions attendant to classified operations in mind. This is an element of early planning you can do to prepare for the process and minimize the administrative burdens associated with obtaining an FCL.

Review process

The typical timeline for DCSA’s processing of a new FCL application assumes the company will provide all required documents and forms within 20 days of DCSA’s welcome email. DCSA assigns an industrial security representative to review the package initially and conduct an orientation meeting. Any necessary FOCI mitigation is negotiated and approved. DCSA’s website, the National Industrial Security Program Operating Manual (NISPOM) and DCSA’s FCL Orientation Handbook provide useful and important information about the overall process, requirements and what contractors can expect. Typically, processing takes three to six months, depending on the complexity of the company’s individual circumstances and responsiveness to DCSA’s information requests. If FOCI mitigation is required, it could add six months to one year to the overall timeline for receiving an FCL.

FCL issuance and maintenance

DCSA will issue a contractor an FCL when it has completed its review and determined that the company is eligible for access to classified information. FCLs remain valid as long as the company has an active classified contract and a continuing need for access. The company must report any changes in conditions that affect its FCL, such as ownership changes, changes to KMP, acquisitions and divestitures within the corporate family, and address or facility updates. While the FCL is active, a company must operate in accordance with the NISPOM regulation, so maintaining familiarity with ongoing compliance obligations and an open line of communication with its points of contact at DCSA is key. With a dedicated compliance program and oversight, a company can maintain its FCL in good standing and enjoy the benefits of access to sensitive government programs and customers that this unique certification affords.