Facility clearance, from sponsorship to keeping it.

Submits the sponsorship request in the National Industrial Security System (NISS), uploading the justification: usually the DD Form 254, the SOW or PWS, and any required GCA authorization. Sponsorship can happen during the solicitation if the company needs classified access to compete.

Cannot sponsor itself. Before sponsorship it should get a CAGE code through DLA CAGE (a prime contractor must also register in SAM.gov), name a point of contact, and check that the level on the sponsorship matches the DD Form 254. The future FSO should apply for a PKI or ECA token right away: NISS cannot be reached without one, and it can take several weeks.

Reviews the sponsorship and either rejects it with an explanation or accepts it and places the company in process. NISS then sends a Welcome Email to the company’s point of contact, with the case deadlines.

Registers in NCAISS and NISS with the FSO’s token and claims the FCL package. Reads the Welcome Email, the FCL Orientation Handbook and the FCL Orientation Videos, and has the likely KMP start gathering their SF 86 information.

Submits its FCL package in NISS: a legal organizational chart showing ownership and control up to the ultimate parent; formation and governance documents; ownership records (stock ledger, capitalization table or membership list); meeting minutes; the KMP list with names, titles, citizenship and personal email; the DD Form 441 (441-1 for a cleared branch); the SF 328 with a supplemental response for every “yes”; exclusion resolutions; and parent documents if DCSA needs them. The documents for each business structure are in Sections 4.2 and 4.5 of the Handbook.

The senior management official (SMO), the facility security officer (FSO) and the insider threat program senior official (ITPSO) are always essential KMP; the FSO and ITPSO must be U.S. citizen employees. Others, typically the board chair, CEO or president, an LLC’s managers or members, or a sole owner, are essential as DCSA decides from the governance documents. Essential KMP must be cleared at the FCL’s level or higher; KMP who are not essential are excluded by exclusion resolution.

Once the package is in, DCSA initiates an investigation for each essential KMP who lacks a clearance at the FCL’s level, and emails the due date. Each completes the SF 86 in eApp and submits electronic fingerprints through SWFT; paper forms and hard-copy fingerprint cards are not accepted. DCSA’s web page still gives Day 45 for this step; follow the date in DCSA’s email. For an upgrade, the FSO initiates these requests.

Investigates and adjudicates each KMP. The final FCL waits until every essential KMP is cleared at its level. At the GCA’s written request, DCSA can also process a negotiator or mission-critical employee who is not a KMP; the FCL does not wait for them.

Evaluates the whole ownership structure against the eligibility requirements, weighing ownership, business operations, finances, personnel and business conduct; doubts are resolved in favor of national security. It may grant an interim FCL once there is no unmitigated FOCI and the essential KMP hold eligibility at the interim level.

Stays responsive to DCSA’s questions and gets familiar with the NISPOM (32 CFR Part 117). If a delay would seriously affect the contract, the GCA, not the company, can ask DCSA to expedite; prioritization is not guaranteed.

Sets up at least two DISS account holders within 30 days, and has the FSO and ITPSO complete their required training within 6 months. Reports changed conditions to DCSA: ownership or control, name or address, KMP, bankruptcy and material FOCI changes, with an updated SF 328 where FOCI changes. Certifies its self-inspection in NISS. It may not use the FCL in advertising, though it may advertise positions that require a clearance.

Its Industrial Security Representative holds an initial orientation and assessment within 120 days, then oversees the company. The FCL stays in effect while the company has a classified contract and a need for access, until it is terminated or revoked. DCSA can invalidate it, blocking new classified bids and awards, while a problem is corrected.