FSFSOtools
GitHub Open the Atlas

Clearance process · Detailed map

Government and industry roles

Compare what federal agency and cleared-industry roles do at each stage, from the documented need through access, maintenance and separation.

Two lanes, one access-control principle

View sources ↓

Lane 1

Government employee

Federal civilian or military member

  1. 1

    Define position, mission, and trust decision

    Owner: Agency management and personnel-vetting/security office. Establish the position’s duties, risk/sensitivity designation, whether classified access is required, required level, and any separate suitability, fitness, or credentialing decision.

    Gate: If duties do not require classified access, stop the clearance path; continue only the applicable suitability, fitness, or credentialing process. A sensitive position or PIV need alone is not a clearance.

    Output: Documented position requirement and the sponsoring office.

  2. 2

    Check for existing trust and choose the pathway

    Owner: Sponsoring agency security/personnel-vetting office. Search authorized records for an existing investigation, adjudication, continuous-vetting enrollment, exceptions, and access status.

    Decision: If prior trust meets the new position’s requirements, use transfer/reciprocity rules and resolve any exceptions. If the new risk tier or access level is higher, request only the additional vetting needed. If there is no usable determination, initiate initial vetting.

    Handoff: The agency tells the applicant which process and system apply.

  3. 3

    Applicant submits questionnaire and identity data

    Owner: Applicant, supported by the agency’s designated personnel-vetting staff. Complete the assigned form/questionnaire and releases in the agency’s current system, provide required fingerprints, and answer follow-up requests accurately.

    Review: The agency checks package adequacy and completeness, resolves missing items, then releases the request to its authorized investigative service provider (ISP).

    Output: Accepted investigation request. Questionnaire, suitability, credentialing, and classified-access forms depend on the designated determination.

  4. 4

    Investigation and follow-up

    Owner: Authorized ISP. Conduct the checks and inquiries for the required tier; contact records, employers, schools, references, and the applicant as applicable.

    Handoff: The applicant responds to interview and clarification requests. The ISP resolves leads, documents results, and returns the completed investigative record to the requesting adjudicative authority.

    Possible branch: Incomplete coverage or unresolved information may require additional investigative work before adjudication.

  5. 5

    Adjudication and notice

    Owner: Agency adjudicator or authorized adjudicative entity. Evaluate the record under the criteria for the decision actually required: suitability, fitness, credentialing, national-security position eligibility, and/or eligibility for classified access.

    Outcome: Favorable, favorable with conditions/exception where authorized, or proposed/unfavorable. Any notice, response, appeal, or review path depends on the domain and agency procedure. Employers and FSOs do not adjudicate national-security eligibility.

  6. 6

    Record eligibility; resolve any interim status

    Owner: Authorized agency authority records the determination and any conditions or restrictions in the approved system. The employee receives the applicable notice and instructions.

    Gate: A pending case does not itself authorize access. Any temporary or interim access requires a separate affirmative decision by an authority allowed to grant it, and remains limited by its terms.

    Output: Current eligibility status at the appropriate level, which is still not blanket access.

  7. 7

    Authorize access to specific information

    Owner: Authorized agency/mission official and security authority. Confirm active eligibility, a current official duty and mission requirement, need-to-know, required nondisclosure agreement, security briefing, and any SCI/SAP or other program approval.

    Gate: Access may open only after every applicable condition is met. Need-to-know is specific to the information and task; clearance eligibility alone does not grant it.

    Output: Approved access for a defined scope, recorded by the responsible security office.

  8. 8

    Maintain, transfer, upgrade, or close

    Owner: Employee, supervisor, agency personnel-vetting/security office, and program security staff according to assigned responsibilities. Continuous vetting, required training, information updates, and agency-directed reviews continue while affiliated.

    Change gate: New duties, a higher tier, transfer to another agency, break in affiliation, loss of need, or a program change routes to the applicable upgrade, transfer-of-trust, re-establishment, or withdrawal process.

    Exit: Agency withdraws access, updates system records, recovers credentials/material, conducts required debriefs, and communicates any continuing obligations.

Lane 2

Industry employee

Employee of a cleared contractor

  1. 1

    Establish the contract and worker relationship

    Owner: Government Contracting Activity (GCA), prime contractor, and performing subcontractor. Identify the contract or subcontract, the customer’s classified requirement, the performing legal entity, each contractual link, the work assigned to this person, and whether it requires access or safeguarding.

    Gate: If no valid Government requirement flows through the contract chain to the work and person, stop the clearance path. An individual or company cannot create its own NISP need by seeking a clearance.

    Output: Documented need, performing entity, customer/security points of contact, and classified performance scope.

  2. 2

    Set contract and facility security requirements

    Owner: GCA and prime security office, with the subcontractor’s FSO. Translate the classified requirement into the contract security specification and applicable flow-down; identify classification level, access, safeguarding, performance locations, systems, and any SCI/SAP instructions.

    Decision: If the contractor entity must receive or safeguard classified information, the Government sponsor initiates the required facility-clearance process. An existing FCL must match the required level and cannot replace location approval or contract security guidance.

    Output: Contractual basis and security requirements aligned to the actual work and entity.

  3. 3

    Confirm employment and individual need

    Owner: Employer/program manager and FSO. Confirm the individual is employed or has the written employment commitment allowed by the rule, and that assigned duties—not merely a job title—require classified access for the contract.

    Decision: Determine the access level and whether current eligibility can satisfy it. Request only the minimum people needed for actual operational and contractual duties.

    Output: Documented person-to-work-to-contract link supporting sponsorship.

  4. 4

    FSO initiates; applicant completes the package

    Owner: FSO or designee initiates through the current DCSA/NBIS process; applicant completes the requested questionnaire, releases, and fingerprints.

    FSO limit: Review SF 86 only for adequacy and completeness as permitted by 32 CFR §117.10(d). Do not use the questionnaire for another purpose or share its information within the company.

    Handoff: Submit the complete request to DCSA/authorized investigative service provider.

  5. 5

    Investigation and applicant follow-up

    Owner: Authorized ISP. Conduct the scope required for the eligibility request and collect/corroborate relevant information. The investigator may interview the applicant and contact records, employers, schools, references, or other sources.

    Applicant action: Respond to interview and clarification requests promptly; correct omissions through the authorized process. An incomplete investigation may return for additional work.

  6. 6

    Government adjudication

    Owner: Government adjudicative authority. Evaluate the completed investigation under national-security adjudicative criteria and applicable procedures.

    Outcome: Favorable eligibility, authorized conditions, or an unfavorable/contested path with applicable notice and review rights. The company, FSO, prime, and contracting officer do not grant, deny, or revoke eligibility.

  7. 7

    Verify eligibility and separately authorize access

    Owner: FSO checks status; customer/authorized holder and program security authority establish access. Confirm eligibility level, contract and current employment need, need-to-know, SF 312, briefings, and SCI/SAP approvals.

    Facility gate: Confirm company eligibility and the specific approved location/system for any safeguarding. Personnel eligibility, facility eligibility, safeguarding authority, and actual access are separate determinations.

    Output: Limited access to the contract information and duties approved.

  8. 8

    Maintain affiliation and continuous vetting

    Owners: Employee reports through assigned channels; FSO/company reports required matters to the CSA; prime and subcontractor keep flow-downs and access records aligned; customer security officials control Government-site access.

    Respond to DCSA continuous-vetting requests and questionnaire updates. Current DoD contractor instructions include a five-year PVQ update cycle keyed to the PVQ Date in DISS. See the separate Personnel Reporting Requirements page for event duties and recipients.

  9. 9

    Change, transfer, or end the relationship

    Trigger: New contract/customer, subcontract flow-down, duties, work location, safeguarding need, loss of need-to-know, employment change, break in affiliation, or separation.

    Owners: Employer/FSO and prime update access and personnel records; GCA/customer resolves changed contract requirements; CSA determines the required facility/personnel status actions.

    Exit: Remove system/site access, recover credentials and material, conduct required debrief, record the termination, and retain any separate report obligations. Do not transfer eligibility or classified work by assumption.

The sponsoring authority, not the applicant or FSO acting alone, controls eligibility and access decisions.