A Facility Clearance, or FCL, is a government determination that your company is eligible to access classified information, and the core facility clearance requirements are simple to list but demanding to meet: a U.S.-organized company operating on U.S. soil, a sponsor with a real classified contract need, cleared senior leadership, no disqualifying foreign ownership, and a security program that meets the National Industrial Security Program Operating Manual (NISPOM) codified at 32 CFR Part 117.1United States Department of State. Facility Security Clearance (FCL) FAQ Meeting them once is not enough. The clearance carries continuous reporting duties, and any of them can put the FCL at risk.
Who Can Qualify
Federal regulation 32 CFR 117.9 sets out the conditions a company must satisfy before the Defense Counterintelligence and Security Agency (DCSA) will issue an FCL.2eCFR. 32 CFR 117.9 – Entity Eligibility Determination The company must be organized under the laws of the United States, a state, the District of Columbia, a U.S. territory, or a federally recognized tribal entity. The facility itself must sit within the United States or its territorial areas. The business must have a legitimate need to access classified material tied to a government contract or program, a record of lawful conduct, and no debarment from federal contracting. Neither the company nor its key management personnel can be barred from doing business with the government.
Two conditions catch applicants off guard. The first is the leadership requirement: your Senior Management Official (SMO), Facility Security Officer (FSO), and Insider Threat Program Senior Official (ITPSO) must each hold personnel clearances at the level of the company’s FCL before that FCL can be granted. The second is foreign ownership, control, or influence, known as FOCI. If a foreign interest is significant enough to make classified access inconsistent with national security, DCSA will not clear the company until that influence is mitigated.
You Need a Sponsor Before You Can Apply
A company cannot walk into DCSA and request a clearance on its own. Sponsorship comes from a Government Contracting Activity (GCA) or an already-cleared defense contractor, and the sponsor must document a real procurement need for the applicant to access classified information.3Defense Counterintelligence and Security Agency. Facility Clearance Sponsorship Instructions That need is usually shown through a DD Form 254, the Contract Security Classification Specification, prepared by the contracting officer.4General Services Administration. Processing Security Requirements Checklist (DD Form 254)
The practical result is a chicken-and-egg problem for smaller firms. You need a classified contract to justify the clearance, and you need the clearance to perform the contract. In most cases, a prime contractor pulls an uncleared subcontractor into a classified project and initiates sponsorship, or a government agency selects an uncleared vendor and holds award of the classified work until the FCL comes through.1United States Department of State. Facility Security Clearance (FCL) FAQ The wait can run many months, and clearance is not guaranteed at the end of it.
Forms You’ll File
The application package is submitted through the National Industrial Security System (NISS), DCSA’s secure portal for managing industrial security between government and industry.5Defense Counterintelligence and Security Agency. National Industrial Security System (NISS) Three forms carry the weight of the application.
The SF 328, Certificate Pertaining to Foreign Interests, is where the government evaluates FOCI. Ten questions ask whether any foreign person directly or indirectly owns 5% or more of the company’s equity securities, whether non-U.S. citizens serve on the board or in senior management, and whether any foreign government holds an interest in the business.6Defense Counterintelligence and Security Agency. Instructions for Completion of the Certificate Pertaining to Foreign Interests Ownership below 5% still gets reported if the holder can influence management appointments. Inaccurate answers can stall or sink the entire application.
The DD Form 441, Department of Defense Security Agreement, is the binding contract between your company and the government. Signing it commits the business to maintain a security program that complies with 32 CFR Part 117 and to protect classified information from unauthorized disclosure for the life of the clearance.7Department of Defense. DD Form 441 – Department of Defense Security Agreement
The DD Form 254, prepared by the sponsoring contracting officer, identifies the specific classification levels and categories of information the contract involves. It ties your clearance request to a real piece of work.
People Who Must Be Cleared
DCSA reads your corporate governance documents to identify Key Management Personnel (KMP): the people who hold majority interest or can influence classified operations. Depending on your structure, KMP typically include the president or CEO, board members, the SMO, the FSO, the ITPSO, and any stockholder in a controlling position.8Center for Development of Security Excellence. Facility Clearances in the NISP
Not every KMP needs a personal clearance, but the SMO, FSO, and ITPSO do, at the level of the company’s FCL.2eCFR. 32 CFR 117.9 – Entity Eligibility Determination In a corporation, the Chairman of the Board must also be cleared. If the chair rotates among board members, every board member needs a clearance. DCSA makes the final call on which additional roles require vetting based on the bylaws and articles of incorporation.
The FSO role is heavier than most first-time applicants expect. Beyond running personnel clearance processing, briefings, and the annual self-inspection, the FSO is the primary point of contact for DCSA. The FSO must be a U.S. citizen and cleared to the facility’s level. For possessing facilities, DCSA requires FSOs to complete the full IS030.CU curriculum through the Center for Development of Security Excellence, covering industrial security, information security, personnel clearances, FOCI, reporting, self-inspections, safeguarding, derivative classification, and transmission procedures.9Center for Development of Security Excellence. FSO Program Management for Possessing Facilities IS030.CU At smaller companies the FSO job can eat significant time, and underestimating it is a common early mistake.
Clearance Levels and Whether You Store Classified Material
FCLs come in three levels: Confidential, Secret, and Top Secret. The level granted matches the highest classification of information you need to access under the contract.10Center for Development of Security Excellence. Clearances in Industrial Security – Putting It All Together If any portion of the work involves Top Secret material, the whole facility needs a Top Secret FCL. Higher levels mean deeper personnel investigations and stricter physical security.
Separate from the level, every FCL is either possessing or non-possessing. A possessing facility can store classified documents and hardware on its own premises in approved containers and vaults. A non-possessing facility has access-only status: employees can view classified material at a government site or a prime contractor’s office but cannot bring it home to their own building. The cost gap is large. Possessing facilities must use GSA-approved security containers, vaults meeting Federal Standard 832, and intrusion detection systems meeting UL Standard 2050 or an equivalent CSA-approved standard, with monitoring by cleared personnel around the clock for Secret and Top Secret storage.11eCFR. 32 CFR 117.15 – Safeguarding Classified Information Many smaller contractors start non-possessing for that reason.
How Long It Takes and Interim Options
The process is not fast. Personnel background investigations alone can run 30 to 65 days for Confidential, 55 to 90 days for Secret, and 90 to 180 days for Top Secret, with complex cases going longer. The full facility timeline depends on how quickly you submit complete documentation, how many KMP need investigations, and whether FOCI issues surface.
DCSA can issue interim personnel clearances to keep work moving. These are based on a preliminary SF-86 review, a favorable fingerprint check, proof of U.S. citizenship, and a clean local records review, and they generally stay in place until the full investigation is adjudicated.12Defense Counterintelligence and Security Agency. Interim Clearances Interim clearances are not available for every access level or program, and they can be pulled if derogatory information turns up.
Handling Foreign Ownership, Control, or Influence
FOCI is one of the most common reasons applications get delayed or denied, but a FOCI finding is not automatically fatal. DCSA offers mitigation instruments matched to the degree of foreign involvement:13Defense Counterintelligence and Security Agency. Mitigation Agreements
- A Board Resolution is used when a foreign entity owns voting stock but not enough to elect a board representative.
- A Security Control Agreement applies when the company is not effectively owned or controlled by a foreign entity, but the foreign interest is entitled to board representation. No access limitations apply.
- A Special Security Agreement is used when a foreign entity effectively owns or controls the company. Access to the most sensitive categories (Top Secret, SCI, SAP, COMSEC, or Restricted Data) may require a separate National Interest Determination.
- A Voting Trust Agreement or Proxy Agreement applies when a foreign entity effectively owns or controls the company. Voting rights of foreign-owned stock transfer to cleared U.S. citizens approved by DCSA. A Voting Trust also transfers legal title to the trustees; a Proxy does not. Neither restricts eligibility for classified access.
DCSA picks the appropriate instrument based on the totality of the FOCI profile, not just one factor on the SF 328.
Keeping the Clearance
Getting the FCL is not the end of the work. Under 32 CFR 117.8, cleared contractors must promptly report:14eCFR. 32 CFR 117.8 – Reporting Requirements
- Any change in ownership, including stock transfers that affect control.
- Any change to the operating name or address of the company or any cleared location.
- Any change to KMP, including whether new KMP are cleared, at what level, and their citizenship.
- Any action to terminate operations, imminent bankruptcy, or reorganization that could affect FCL validity.
- Any material change to previously reported FOCI information, filed as an updated SF 328, along with any discussions or agreements that could reasonably lead to effective foreign ownership or control.
Separately, NISPOM requires an annual self-inspection of the security program. DCSA expects documented findings, tracked corrective actions, and evidence that identified issues were resolved. A checklist with no follow-up signals weak oversight and draws scrutiny at the next DCSA assessment.
How a Clearance Can End
An FCL can end three ways. Administrative termination is routine: if a company has not performed classified work in 12 months and cannot show a current government need, DCSA sends a 30-day notice and closes the clearance. It is a clean exit, but a company that lets its FCL lapse will need to run the full process again for future classified work.8Center for Development of Security Excellence. Facility Clearances in the NISP
Invalidation is an interim measure. DCSA invalidates an FCL when circumstances undermine the security program’s integrity or create a potential for compromise, but the problem may be correctable. While invalidated, the company cannot receive new classified contracts. Fix the underlying issues and the clearance can be restored.
Revocation is permanent. The facility’s cleared status is stripped, access to classified information stops immediately, and the company must turn over all classified materials. In limited cases, a GCA with an existing contract may allow the company to finish that work under an invalidated status before the revocation takes effect. DCSA turns to revocation when a contractor refuses to take corrective action or has repeatedly shown it cannot protect classified information.