Facility Security Clearance (FCL): The Complete Guide for Defense Contractors

What Is a Facility Security Clearance (FCL)?

A Facility Security Clearance (FCL) is an administrative determination made by the Defense Counterintelligence and Security Agency (DCSA) that an organization is eligible for access to classified national security information. An FCL establishes entity eligibility for classified access; performance also depends on the contract, authorized access and applicable safeguarding requirements.

A contractor must hold the required active FCL to perform classified contract requirements. DCSA says an FCL is needed during the solicitation phase only when classified access is required to prepare the bid or proposal.

FCL vs. Personnel Security Clearance (PCL)

These two types of clearances are related but distinct:

Both are required in practice. The FCL makes your facility eligible, while PCLs authorize specific employees to handle classified materials. DCSA determines which Key Management Personnel (KMP) must obtain individual PCLs; eligible positions may instead be formally excluded from classified access.

Classification Levels

FCLs correspond to three levels of classified information, each with progressively stricter requirements:

• Confidential: The baseline classification level. Unauthorized disclosure could reasonably be expected to cause damage to national security.
• Secret: The mid-tier classification level. Unauthorized disclosure could reasonably be expected to cause serious damage to national security.
• Top Secret: The highest classification level. Unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to national security.

Your FCL level must match or exceed the highest classification level of information your facility will handle. A facility with a Secret FCL cannot access Top Secret information. Most defense contractors start with Secret.

Possessing vs. Non-Possessing Facilities

Before applying, you must determine what type of FCL your operations require.

Possessing Facilities safeguard classified information at their own physical location. This requires GSA-approved security containers or vaults, formal access control systems, and documented physical security procedures. This is the most common type for active program work.

Non-Possessing Facilities do not store classified information at their site. Employees access classified materials only at the customer's or government's secure facility. The company still requires the FCL, but physical security requirements are significantly lighter.

If you are unsure which type applies, evaluate where the classified work will actually occur: at your facility or at the customer's secure location.

The 7-Step FCL Acquisition Process

DCSA manages FCL issuance through a structured process. Here is what to expect at each stage:

Step 1: Sponsorship

You cannot self-apply for an FCL. A cleared U.S. government agency or cleared prime contractor must sponsor your facility and document a legitimate contractual need for classified access. Without this documented need, DCSA will not process the application.

If you are a subcontractor, your prime must initiate the sponsorship. If you are pursuing a direct government contract, the contracting officer or program office serves as the sponsor.

Step 2: Sponsorship Package Submission

The sponsor submits documentation through the National Industrial Security System (NISS), the government's portal for managing industrial security activities. The package typically includes:

• DD Form 441, the Department of Defense Security Agreement
• DD Form 254, the Contract Security Classification Specification, which defines what classified information the contractor will handle
• Performance Work Statement or contract details
• Company identification information

DCSA warns that incomplete or inaccurate sponsorship packages will be rejected and cause delays. Confirm your sponsor has this document correctly completed before submission.

Step 3: DCSA Package Review

DCSA reviews the sponsorship package to verify the justification is valid and the company is eligible to proceed. This is an administrative gate check before the full investigation begins.

Step 4: FCL Package Submission

DCSA identifies Day 20 as the business-document submission milestone; follow the specific deadline and instructions in your welcome email. Submit the required FCL package through NISS. This includes:

• Business formation and ownership documentation
• Identification of all Key Management Personnel (KMP)
• Foreign ownership, control, or influence (FOCI) disclosures
• Organizational structure and any parent/subsidiary relationships

Step 5: DCSA Analysis

This is the most complex phase. DCSA conducts three parallel workstreams:

1. Business analysis: Cases are routed to a Tier 1 (straightforward) or Tier 2 (complex) team based on ownership structure, size, and FOCI risk.
2. FOCI investigation: Assesses whether foreign interests could compromise the facility's ability to protect classified information.
3. KMP clearance initiation: DCSA determines which KMP require personnel clearance and whether an exclusion resolution is appropriate.

FOCI is a significant consideration for any company with foreign ownership, investment, or board influence. If DCSA identifies a FOCI condition, it may require mitigation measures such as a Special Security Agreement (SSA), Board Resolution, Proxy Agreement, or Voting Trust.

Step 6: Initial Orientation Meeting (IOM)

A DCSA Industrial Security Representative conducts an on-site meeting with your designated Facility Security Officer (FSO). The IOM verifies submitted information and confirms that your FSO understands all requirements under 32 CFR Part 117, also known as the National Industrial Security Program Operating Manual (NISPOM).

This meeting is not a pass/fail audit. It is an orientation, but your FSO is expected to demonstrate working knowledge of NISPOM requirements before the process can advance.

Step 7: FCL Issuance

Once DCSA completes the business analysis favorably, concludes the FOCI investigation, and confirms KMP clearances, the FCL is issued. You will receive formal notification and can begin performing classified work under the terms of your contracts.

Key Roles in the FCL Program

Facility Security Officer (FSO)

The FSO is responsible for day-to-day security compliance at your facility and serves as the primary point of contact with DCSA. Responsibilities include:

• Implementing all NISPOM (32 CFR Part 117) requirements
• Managing personnel clearance processing and periodic reinvestigations
• Conducting security awareness training for cleared employees
• Maintaining required security records and logs
• Reporting security violations, adverse information, and foreign contact incidents to DCSA

FSOs are expected to complete DCSA's FSO Program Management curriculum through the Center for Development of Security Excellence (CDSE). Requirements are more extensive for possessing facilities. DCSA does not issue a formal FSO certification, but completion of CDSE courses is expected and tracked.

Key Management Personnel (KMP)

KMP are individuals with the ability to direct or influence facility operations in ways that could affect the protection of classified information. This typically includes:

• Officers (CEO, CFO, COO, President)
• Directors and board members
• Managers with direct responsibility over classified programs or the FSO

DCSA determines clearance requirements from each KMP's role, responsibilities and authority. Certain KMP may be formally excluded under the NISPOM; an exclusion must satisfy the applicable conditions and cannot be assumed to resolve a clearance denial.

Timeline and Costs

Timeline: DCSA identifies Day 45 as the deadline for required KMP investigation submissions and electronic fingerprints, not a promised FCL issuance date. Obtain a case-specific schedule. Factors to discuss with DCSA and the sponsor include:

• The required eligibility level and associated investigation
• FOCI issues requiring mitigation agreements
• KMP background investigation delays
• Company ownership structures requiring deeper analysis

Do not treat submission milestones as a completion guarantee. Confirm how any FOCI review and personnel investigations affect your case.

Costs: There is no application fee for an FCL. DCSA does not charge for processing. Your organization will, however, incur real internal costs:

• FSO personnel time (often a significant portion of someone's role)
• CDSE training completion
• Physical security upgrades for possessing facilities (GSA-approved storage, alarm systems, access controls)
• Legal or consulting fees if FOCI mitigation is required
• Ongoing compliance program maintenance

These costs vary by the actual safeguarding, staffing and mitigation requirements. Obtain scoped estimates; this article does not establish a typical FCL budget.

Foreign Ownership, Control, or Influence (FOCI)

FOCI is one of the most scrutinized aspects of the FCL process. If a foreign interest has the ability, whether directly or indirectly, to direct or influence company decisions in a way that could compromise classified information, DCSA will identify a FOCI condition.

Common FOCI triggers include:

• Foreign parent company or majority shareholder
• Foreign national on the board of directors
• Foreign government as investor
• Licensing agreements that give foreign parties operational influence

A FOCI condition does not automatically disqualify you from an FCL. DCSA provides several mitigation options:

If FOCI applies to your company, engage legal counsel with cleared facility experience before proceeding.

Maintaining Your FCL

An FCL is not a one-time event. Maintaining it requires ongoing compliance across several areas:

• Annual self-inspection: The contractor must conduct a formal self-inspection at least annually; DCSA security reviews are separate oversight activities.
• Continuous reporting obligations: FSOs must report security incidents, adverse information about cleared employees, changes in ownership or KMP composition, and foreign contact.
• Personnel vetting: Follow the cognizant security agency's reinvestigation and continuous-evaluation or continuous-vetting guidance.
• Training requirements: Annual security awareness training is required for all cleared personnel.

FCL status: Confirm continued eligibility and any changed contractual need with DCSA. Holding a contract alone does not remove the obligation to meet the applicable NISPOM requirements.

Confirm that the facility's eligibility and safeguarding arrangements support the classification level required by each contract.

Common Reasons FCL Applications Are Denied or Delayed

1. Missing or incomplete DD Form 254: An incomplete sponsorship package can be rejected. This document must be properly completed by the sponsoring agency or prime contractor because it defines what classified information you will access.

2. KMP eligibility issues: DCSA determines which positions require clearance and whether an exclusion is permissible; seek case-specific direction.

3. Unresolved FOCI: Foreign ownership or influence that cannot be adequately mitigated through DCSA's available instruments.

4. Incomplete NISS submission: Missing business documentation or incomplete entity identification.

5. FSO not adequately prepared for the IOM: While not a hard denial, an unprepared FSO signals a compliance risk and can delay the process significantly.

FCL vs. CMMC: Understanding the Difference

FCLs and CMMC are both security requirements for defense contractors, but they address completely different threat domains:

Many contractors need both. If your company pursues classified DoD work and also handles CUI, you will be managing two overlapping compliance programs. There is significant overlap in the underlying security culture, however. Strong access control, personnel vetting, audit logging, and incident response practices benefit both programs.

CMMC implementation does not establish FCL eligibility or satisfy classified-system requirements. Validate each program against its applicable contract and governing requirements.

Your FCL Readiness Checklist

Before initiating the sponsorship conversation, confirm the following:

• Identified a cleared government agency or prime contractor willing to sponsor
• Have a legitimate, documented contractual need for classified access
• Identified your FSO candidate and confirmed they can complete CDSE training
• Identified all KMP and assessed any potential clearance issues
• Reviewed your ownership structure for foreign interests
• Determined facility type (possessing vs. non-possessing) and assessed physical security gaps
• Obtain a case-specific timeline from the sponsoring organization and DCSA

How CMMC Command Supports Defense Contractors Pursuing Both FCL and CMMC

An FCL does not by itself establish that an organization handles CUI or that a CMMC requirement applies. If an applicable solicitation or contract separately specifies CMMC, CMMC Command can help organize the cybersecurity preparation work:

• Free CMMC assessment: All 110 NIST SP 800-171 Rev 2 requirements with an estimated SPRS score based on user-entered statuses and DoD weights
• SSP generation: Draft documentation for the applicable CMMC cybersecurity environment; a generated draft does not establish DCSA authorization or satisfy classified-system requirements
• Policy templates: Structured starting points that must be tailored to the organization and applicable requirements
• Evidence vault: Centralized storage and tracking for your compliance artifacts

Start your free CMMC assessment and estimate an SPRS score from the statuses you enter, with no credit card required.

Sources

• DCSA facility clearance process — sponsorship, NISS submissions, KMP determinations and submission milestones.
• 32 CFR Part 117 (NISPOM) — entity eligibility, KMP exclusions, personnel security, training and self-inspection requirements.
• 32 CFR Part 170 — the separate CMMC program for applicable unclassified contract information.