Executive Brief
The Department of Defense (DoD) will soon retire a term cleared contractors have used for decades.
Facility Security Clearance (FCL) is moving toward a new name, Entity Eligibility Determination (EED), and the Facility Security Officer (FSO) title will be referenced as the Entity Security Officer (ESO). The new language centers on the organization and its people, and it opens a clearer path for small and non-traditional firms.
- Where it came from: The Office of the Under Secretary of War for Intelligence and Security (OUSW(I&S)) presented the change at the 2026 Virtual Defense Counterintelligence and Security Agency (DCSA) Security Conference in September.
- What EED covers: The organization, its legal entity, and its Key Management Personnel (KMP) are evaluated for trustworthiness and classified access.
- What stays the same: Commercial and Government Entity (CAGE) codes are unchanged, and the terminology update leaves underlying requirements in place.
- Where it lives: The change is part of the rewrite of DoD Manual (DoDM) 5220.32, Volume 1, which remains in formal coordination with no publication date announced.
Dig deeper below to learn more.
Why the Language is Changing
- Legacy design: DoDM 5220.32, Volume 1 was built for a pre-digital, facility-centric era.
- The gap: A paper-based, 1993 National Industrial Security Program (NISP) model now serves a cloud-based, globally connected Defense Industrial Base (DIB).
- The wording: "Facility Security Clearance" suggests a physical building, vault, or dedicated Sensitive Compartmented Information Facility (SCIF) must exist before an organization can be vetted. The MITRE Fast-Tracking Acquisition Security Transformation (FAST) study found that small and non-traditional software firms hesitate over the real estate overhead that term implies.
- The evidence base: FAST produced 155 recommendations across 74 challenge areas, drawing on input from over 6,700 industry representatives. A Government Accountability Office (GAO) industrial security report identified similar structural bottlenecks.
What Entity Eligibility Determination Means
- Focus on the entity: EED clarifies that the organization or legal entity, along with its KMP, is evaluated for trustworthiness and classified access.
- Two separate ideas: Entity vetting and physical safeguarding become distinct concepts, and safeguarding approval remains its own step in the process.
- Regulatory alignment: The terminology aligns DoDM 5220.32 with 32 Code of Federal Regulations (CFR) Part 2004 (NISP) and 32 CFR Part 117, the National Industrial Security Program Operating Manual (NISPOM) Rule.
- Familiar review steps: The briefing's entity review includes DCSA orientation, a Foreign Ownership, Control, or Influence (FOCI) assessment, and KMP background investigations. Our guide to obtaining a facility security clearance walks through each stage.
EED at a Glance
|
Topic
|
Current Term or Rule
|
Proposed Change
|
|
Entity vetting label
|
Facility Security Clearance (FCL)
|
Entity Eligibility Determination (EED)
|
|
Security officer title
|
Facility Security Officer (FSO)
|
Entity Security Officer (ESO)
|
|
Security review cycle
|
12/18-month cycle for all facilities
|
36-month cycle for lower-risk facilities
|
|
Break in access
|
Administrative termination after 24 months (does not apply to cleared contractors with an active FCL)
|
Five-year administrative termination window
|
The proposed terms above reflect the conference briefing and may shift once the manual is published.
What Changes for the FSO
- Terminology: The briefing referenced the new ESO title alongside the EED name change.
- Requirements: Presenters described the terminology changes as administrative and linguistic, with underlying requirements in place.
- Accountability: Classified Infrastructure as a Service (CIaaS) offers shared, pre-approved commercial classified infrastructure. Presenters stated that using it leaves ultimate responsibility for the security program with the company's security officer.
- Cross-functional reach: Security officers already work at the intersection of industrial security, cybersecurity, and contract eligibility. See Who Is Responsible for Protecting CUI for how that coordination plays out.
Related Changes in the Same Manual Rewrite
- 36-month review cycle: Lower-risk facilities would move to a 36-month security review cycle, replacing the 12/18-month cycle that treated all facilities alike. DCSA gains capacity for high-sensitivity facilities and emerging threats. DCSA is still working through whether some facilities stay on a 12-month cycle based on risk factors such as classified information systems, access-elsewhere status, and violation history.
- Five-year eligibility window: The “two-year cliff” ends administrative termination of entity and personnel eligibility after a 24-month break in access. The proposed window is five years, aligned with continuous vetting standards. A cleared contractor with an active FCL and completed, updated KMP PCLs is not subject to the cliff, so the change helps companies and defense personnel return after a gap, so they don’t have to re-start the process from scratch. It reduces reinvestigation churn, lowers re-entry costs, and preserves cleared talent across contract gaps.
- Standardized field tools: DCSA is deploying enterprise analytic tools across all field offices by December 2026 to address the "zip-code security" inconsistency GAO identified.
- Unified field structure: DCSA completed a reorganization of Industrial Security and Field Operations into a unified command.
- CIaaS pilots: Pilots run at select locations, with El Segundo and Colorado Springs under evaluation for expansion. Government partners include the Defense Innovation Unit (DIU) and the Space Development Agency (SDA).
Where the Rewrite Stands
- In progress: Presenters described adjudicating several hundred comments, with no firm publication date.
- Source note: These details come from the conference briefing and reflect the draft as presented. Final language may shift at publication.
- Open channels: Presenters encouraged proactive outreach. Questions can go to your Industrial Security Representative (ISR), your FSO network, or contacts at the National Classification Management Society (NCMS) and the National Defense Industrial Association (NDIA).
What Cleared Contractors Can Do Now
- Stay on current requirements: Existing FCL and NISPOM obligations remain in effect until the manual publishes.
- Inventory your terminology: List policies, standard operating procedures, training materials, and contract language that reference "FCL" and "FSO" so updates move quickly later.
- Confirm your KMP roster: KMP are part of the entity evaluation, and their completed, updated Personnel Security Clearances (PCLs) are a key component of your active FCL. Keep records current and review change conditions that affect an entity’s facility clearance.
- Review access gaps: Note any personnel or entities without current access that the five-year window may affect. A cleared contractor with an active FCL and completed, updated KMP PCLs is not subject to the cliff.
- Check inspection readiness: Take the Industrial Security Readiness Quiz for a quick view of your posture, and review how to maintain a facility clearance.
- Brief leadership and contracts teams: Share the update so internal stakeholders recognize the new terms when they appear.
FAQs
Is FCL officially renamed EED today?
Not yet. EED is the new name in a draft of DoD Manual 5220.32, and the draft is still being reviewed. Until the final manual is published, companies can keep using the term, “FCL,” and following the current requirements.
Does my CAGE code change?
No. Presenters stated that CAGE codes are unchanged. Only the associated terminology and status labels are being updated.
Does EED change how classified information is safeguarded?
EED addresses entity vetting. Safeguarding approval remains its own step, and presenters described the terminology updates as administrative.
Does using CIaaS shift responsibility away from my security officer?
No. Presenters stated that CIaaS is a resource, and ultimate responsibility for the security program stays with the company's FSO or ESO.
What is the two-year cliff?
Current policy terminates entity and personnel eligibility administratively after a 24-month break in access. A cleared defense contractor with an active FCL and completed, updated KMP PCLs is not subject to it. The proposed five-year window eases re-entry for returning companies and defense personnel.
Helpful ISI Links
Reference Resources