A Guide to Obtaining a Facility Security Clearance
Obtaining a Facility Security Clearance (FCL) is a complex process that requires careful planning, rigorous adherence to security requirements, and ongoing commitment to protecting classified information. By understanding the steps involved, organizations can navigate the FCL process successfully and contribute to national security efforts.
This guide provides an overview of what FCLs are and the process for obtaining an FCL clearance.
What is a Facility Security Clearance?
A Facility Security Clearance (FCL) is an administrative determination that a facility is eligible for access to classified information. An FCL is granted by the Defense Counterintelligence and Security Agency (DCSA) and is necessary for facilities that require access to classified information to fulfill government contracts.
How Does an FCL Differ from a Personnel Clearance (PCL)?
Unlike the FCL, which is granted to a company or organization, a Personnel Clearance (PCL) is granted to an individual and allows them to access classified information up to a certain level. This clearance is based on a background investigation of the individual’s character, financial history, reliability, and loyalty to the United States. The FCL process, on the other hand, is an assessment of an organization’s ability to safeguard classified information, including its security measures, personnel security practices, and information systems security.
What Are the Different Facility Security Clearance Levels?
There are three different classification levels of FCLs, corresponding to the levels of classified information an organization needs to access: Confidential, Secret, and Top Secret. The specific requirements for each FCL level are outlined in the National Industrial Security Program Operating Manual (NISPOM), but, in short, the difference between these levels is determined by the sensitivity of the information and the stringency of the facility requirements necessary in order to protect it.
Possessing vs. Non-Possessing Facilities
In addition to the FCL, a company can apply as a Possessing or Non-Possessing Facility. Possessing means the facility will safeguard classified information at the facility’s address. Non-Possessing means the safeguarding of classified information is done at the customer’s site, or at other government locations. Note that the Possessing authority is issued separately from the FCL and can be awarded at Confidential, Secret, or Top Secret level.
7 Steps to Obtaining a Facility Security Clearance
1. Sponsorship
The first step in obtaining an FCL is getting sponsorship. Companies cannot apply for an FCL directly; a cleared U.S. government agency or a prime contractor with an FCL must sponsor the facility for the clearance. This sponsor must justify why the facility needs access to classified information.
2. Submission of the Sponsorship Package
Once sponsorship is confirmed, the sponsor must submit a sponsorship package to the DCSA through the National Industrial Security System (NISS). This package typically includes:
- Prime Sponsorship
- Sponsored facility’s Information
- DD Form 254
- Performance Work Statement
- Subcontract Sponsorship
- Sponsored facility’s information
- DD Form 254
- Performance Work Statement / Statement of Work
- Subcontract Agreement
- Written approval from GCA (Government Contracting Activities)
3. Review of the Sponsorship Package
DCSA conducts a review of the information submitted with the sponsorship package to ensure that there is justification for an FCL to be considered.
4. Submission of the FCL Package
Once DCSA approves the sponsorship package, the company will have 20 days to submit their business documentation and identify their Key Management Personnel (KMP) in NISS. This is referred to as the FCL Package. The business documentation and KMP positions required are based on the company’s legal structure.
5. DCSA’s Review Process
When the FCL package is submitted, DCSA conducts an initial review to ensure that the facility meets the basic requirements. Based on that review, the facility will be assigned to a specific team within DCSA. Facilities with less complex structures are processed by DCSA’s Tier 1 Team, while more complex structures are processed by the Tier 2 Team. Both teams are responsible for conducting a business analysis review using the information in the FCL Package and open resources (such as the company’s website).
Once the analysis is completed, the facility is passed to another DCSA representative who will conduct a thorough Foreign Ownership Control and Influence (FOCI) investigation. As that investigation is being completed, any uncleared KMP who require a PCL will have their PCL investigation initiated.
6. Initial Orientation Meeting (IOM)
As part of the FCL Sponsorship Process, an Industrial Security Representative (ISR) from DCSA will be required to conduct an on-site meeting with the Facility Security Officer (FSO). This meeting is required for the ISR to understand and verify the information submitted through the sponsorship and FCL packages and ensure the FSO understands all requirements outlined in the 32 CFR Part 117 (NISPOM). For organizations being sponsored as a Possessing facility, DCSA will need to verify the entity’s ability to store classified material in compliance with the NISPOM.
7. FCL Issuance
Once the business analysis, FOCI investigation, and KMP clearances are completed and favorable, an FCL can be issued.
FAQs about Facility Security Clearance
The DCSA advertises that FCL processing time takes 45 days in their FCL Orientation Handbook, but in reality the process typically takes several months or even up to a year depending on the complexity of the case, the level of security clearance required, and the DCSA’s current backlog of applications.
While the request process and the granting of an FCL doesn’t have a direct cost to the contractor (i.e. there’s no application fee), the organization applying is responsible for all the costs of implementing and maintaining the security procedures required for FCL eligibility. The cost of these measures can vary greatly depending on the size of the organization and the level of FCL required (i.e. Confidential, Secret, or Top Secret).
FCL denials can stem from various issues, but two of the most common reasons are the absence of a DD 254 or the inability of a Key Management Personnel (KMP) to obtain clearance. These factors often hinder the approval process and can significantly impact a company’s security standing.
Maintaining an FCL involves more than just initial approval; it requires ongoing diligence and compliance with DCSA regulations as they significantly impact an entity’s FCL status. It’s best to get familiar with the variety of factors that can impact an organization’s FCL status, before making any big changes to things like legal status, address, ownership, or operating name (among many others).
A facility clearance remains valid as long as a company has an active classified contract with the government or a cleared contractor that entails a continued need to access classified information to fulfill its contractual obligations. A company’s FCL may need adjustment if the scope or classification level of a classified contract changes.
The DCSA also typically conducts annual reviews of facilities with FCLs to ensure continued compliance with security requirements. If a company’s classified contract ends or the company no longer needs access to classified information, the FCL may be deactivated or downgraded, but it can usually be reactivated pretty quickly when needed due to prior vetting.
Yes, a facility can have multiple security clearances at different levels. It’s not uncommon for companies working with classified information to have separate areas or projects, each with its own designated security requirements and controls commensurate with the level of classified information in use.
Revocation of a Facility Security Clearance would have serious consequences for a company’s company’s operations, reputation, and financial standing, and would require swift action to prioritize compliance. The immediate consequences would be loss of access to vital information, the termination of ongoing contracts and subsequent financial loss, a temporary suspension from bidding on new contracts, and potential legal action from the government or other parties affected by the loss of classified information. Severe violations can result in permanent revocation, but more often companies are faced with a temporary suspension or a temporary downgrade in security status (i.e. from Top Secret to Secret) in order to address specific issues.
Find Out How IsI’s Managed Security Services Can Help Your Company Obtain FCL Status
Obtaining your FCL clearance is no easy feat. It is an arduous process that can pull you away from the day-to-day of your business. Fortunately, at ISI, our team of FCL experts are here to support your organization throughout this process. Schedule a free consultation today to learn more about IsI’s Facility Clearance Services.
