Maintaining a Facility Clearance (FCL) involves more than just initial approval; it requires ongoing diligence and compliance with DCSA regulations. This article provides key responsibilities and considerations in maintaining your FCL with a focus on maintaining clearances for Key Management Personnel (KMP).
Maintaining an FCL Means Keeping These Obligations Current
The DCSA expects a cleared defense contractor to keep these areas in good standing at all times, and a lapse in any one of them can put your facility clearance under review. Here’s what ongoing maintenance covers:
Key Management Personnel (KMP) - Keep your SMO (Senior Management Official), FSO (Facility Security Officer), and ITPSO (Insider Threat Program Senior Official) cleared and in place, and report any change. This is the area most contractors get wrong, so it gets the most attention below.
Personnel Security Clearances (PCL) - Maintain eligibility for every cleared employee, including continuous vetting and self-reporting obligations.
Security Vulnerability Assessments (SVA): DCSA conducts periodic security reviews to ensure ongoing compliance.
Training and Awareness - The FSO must provide initial and annual security training and awareness programs for cleared employees. The ITPSO must provide insider threat awareness training annually for cleared employees.
Self-Inspection and the DCSA Security Review - Run your required annual self-inspection and prepare for DCSA's periodic security review and rating.
Reporting Changed Conditions - Report changes in ownership, FOCI (Foreign Ownership, Control or Influence), or company structure that could affect the clearance.
Safeguarding Classified Information - Protect any classified material you store or handle according to your DD Form 254 and DCSA guidance.
Key Management Personnel Are the Company Officials DCSA Requires to Be Cleared
Key management personnel (KMP) are the senior officials a company must have cleared as a condition of its facility clearance (FCL). DCSA requires three core KMP roles: the Senior Management Official (SMO), the Facility Security Officer (FSO), and the Insider Threat Program Senior Official (ITPSO). Each must hold a personnel security clearance (PCL) at the same level as the facility clearance.
One person can hold more than one role. At many small contractors, the same individual serves as both FSO and ITPSO. The responsibilities stay separate, however, and DCSA tracks each role on its own.
The Three Required KMP Roles Carry Different Responsibilities
Text
| Role | Who typically fills it | Core responsibility | Clearance required |
| Senior Management Official (SMO) | CEO, president, or most senior official at the cleared location | Accepts accountability for the FCL and for protecting classified information | Yes, at the FCL level |
| Facility Security Officer (FSO) | Appointed security lead | Runs the day-to-day security program and DCSA compliance | Yes, at the FCL level |
| Insider Threat Program Senior Official (ITPSO) | Often the FSO or another senior official | Establishes and runs the insider threat program | Yes, at the FCL level |
KMP Must Be U.S. Citizens or Be Formally Excluded
Every KMP who needs access to classified information must be a U.S. citizen and hold an eligible personnel clearance. Officials who hold a title or a board seat but do not need access can be removed from the requirement through a formal exclusion action, documented by a board resolution. Exclusion is common for investors and outside directors. It keeps the FCL intact without clearing people who never touch classified work.
KMP Requirements Continue for the Life of the Clearance
When a KMP leaves, a new officer steps in, or a role changes hands, the company reports the change to DCSA through the National Industrial Security System (NISS). Personnel clearances also carry ongoing reporting duties under SEAD 3, which sets the activities cleared individuals must self-report while their clearance is active.
Timing matters. A gap in a required KMP role is one of the fastest ways to put an FCL in jeopardy.
Every Cleared Employee Has to Stay Eligible, Not Just Your KMP
Your KMP are not the only people whose clearances you have to maintain. Every employee with access to classified information must keep an active personnel clearance, and that eligibility is now monitored continuously rather than through periodic reinvestigation.
Under continuous vetting, DCSA checks enrolled personnel against government and public data sources on an ongoing basis. A flag can surface at any time, not just at a scheduled review.
On top of that, two separate reporting duties run in parallel:
Individual self-reporting - SEAD 3 requires each cleared employee to self-report specific activities while their clearance is active, including foreign travel, foreign contacts, and certain financial events.
Company reporting - Separately, your company has its own duty to report adverse information about a cleared employee to DCSA as soon as it becomes aware of it, whether or not the employee self-reported it.
The practical takeaway for a contractor: build reporting into your normal operations so a required disclosure never depends on someone remembering to make it.
Training Keeps Your People Compliant between Reviews
DCSA requires ongoing security education for everyone with access to classified information. Two pieces matter most for staying compliant.
Every cleared employee receives an initial security briefing before they access classified material, then annual refresher training after that. Your insider threat program also carries its own annual awareness training, which ties back to the ITPSO role in the KMP structure above. Keep dated records of who completed what. Training records are among the first things DCSA asks for during a security review.
You Inspect Your Own Program Every Year, and DCSA Reviews It on Its Own Cycle
Two separate checks keep an FCL honest, and contractors often confuse them.
The first is your own. You are required to conduct a formal self-inspection of your security program at least annually, review the results with senior management, and certify completion to DCSA in writing. The second is DCSA's. On its own schedule, DCSA conducts what it now formally calls the Security Review and Rating Process (SRRP), still known informally by many contractors as a "Vulnerability Assessment." DCSA rates facilities on a five-level scale, from Superior down to Unsatisfactory. A rating below Satisfactory puts your FCL at risk and can trigger a Compliance Improvement Process.
Treat the annual self-inspection as your dry run for the DCSA review. The findings you catch and fix yourself are the ones that never become DCSA findings. For a closer look at what DCSA reviews and where contractors tend to fall short, see What Is a DCSA Facility Inspection?
Losing KMP Compliance Can Suspend or Revoke the Clearance
DCSA can suspend or revoke a facility clearance when a company fails to maintain the required KMP structure. A revoked FCL stops all classified work and disqualifies the company from the contracts that require it. For a defense contractor, that reaches revenue and the company's standing with the prime or agency that sponsored the clearance.
The most common KMP failures are avoidable:
An FSO leaves and no cleared replacement is named.
The ITPSO role was never formally assigned.
A change in KMP went unreported past the deadline.
Changes to Your Company Can Change Your Clearance
DCSA has to be told when something material about your company changes. That includes a change in ownership, a new foreign investment or relationship, a change in operating name or address, and a change in the officials who control the company.
Foreign ownership, control, or influence gets the closest look. A change in your foreign interest can require an updated SF-328 and, in some cases, a FOCI mitigation plan before classified work continues. These are reportable events with no set grace period. DCSA expects self-reporting as soon as the change is known, so route them to your FSO immediately rather than waiting for a scheduled review.
For the full picture on both topics, see our guides on changed conditions that affect a facility clearance and foreign ownership, control, or influence (FOCI).
A Recurring Maintenance Rhythm Keeps an FCL from Lapsing
Most FCL problems trace back to a routine task that slipped. Use this checklist to keep the clearance current between DCSA reviews.
| Maintenance Task | Cadence | Typically owned by |
| Confirm SMO, FSO, and ITPSO are filled and cleared to the FCL level | Ongoing, verify quarterly | FSO |
| Report changes to key management personnel through NISS | As changes occur | FSO |
| Run the required security self-inspection | Annually | FSO |
| Deliver refresher security and insider threat training | Annually | FSO / ITPSO |
| Review cleared employee eligibility and continuous vetting status | Ongoing | FSO |
| Report changed conditions (ownership, FOCI, structure) | As changes occur | FSO / SMO |
| Update the SF-328 when ownership or foreign interest changes | As changes occur | FSO / SMO |
| Prepare for the DCSA periodic security review | Ahead of each review cycle | FSO |
ISI Keeps KMP Structures Contract-Ready
ISI manages KMP requirements for defense contractors as part of full facility clearance support, from initial sponsorship through ongoing compliance. Of the FCL applications ISI submitted to DCSA in 2026 that have reached a final decision, 100% were approved, with an average turnaround of 61 days.
If your KMP structure has a gap, or you want it reviewed before DCSA does, schedule a consultation. ISI's team handles the filing, the exclusions, and the reporting so your clearance stays intact.
SECURE AND MAINTAIN YOUR FCL WITH CONFIDENCE
Partner with ISI for expert, cost-effective legal and compliance support. Avoid delays, reduce costs, and move forward with a trusted advisor by your side.
Proven success rate – 99% client approval
21 Day Average FCL Approval Time
Top-tier FCL expertise at a fraction of law firm costs
Support that goes beyond obtaining a FCL
FAQs about Key Management Personnel
Who are the key management personnel in a facility clearance?
KMP are the cleared company officials DCSA requires for an FCL: the Senior Management Official (SMO), the Facility Security Officer (FSO), and the Insider Threat Program Senior Official (ITPSO). Each holds a personnel clearance at the facility clearance level.
Do key management personnel have to be U.S. citizens?
KMP who need access to classified information must be U.S. citizens. Officials who do not need access can be formally excluded through a board resolution.
Can one person hold more than one KMP role?
Yes. The same individual can serve as FSO and ITPSO, which is common at small contractors. Each role keeps its own responsibilities.
What happens when a KMP leaves the company?
The company reports the change to DCSA through NISS and names a cleared replacement for any required role. An unfilled FSO or ITPSO role can put the facility clearance at risk.
What regulation governs key management personnel?
The NISPOM, codified as 32 CFR Part 117 since February 2021, sets the KMP requirements DCSA enforces.
