FSFSOtools
GitHub Open the Atlas

Facility clearance · Readiness check

Is your company ready to be sponsored?

Answer each question for your company. You will see what each answer means, and a summary of what to arrange. Nothing you choose is saved or sent: the check runs in your browser and forgets your answers when you leave.

This is a preparation aid, not a determination. DCSA decides eligibility, which KMP must be cleared and whether FOCI applies. Answer “Not sure” rather than guess; the check tells you what to confirm.
1Does the contract, subcontract or solicitation require your company to access classified information?

Look at the DD Form 254 or the security requirements clause. Access to Government IT systems, a suitability determination or a base pass is not classified access.

If yes:A classified requirement is the basis for an FCL. Make sure the DD Form 254 states it clearly; an unclear justification is among the most frequent reasons DCSA rejects a sponsorship.
If no:An FCL is not the path. DCSA discontinues sponsorships whose real need is IT-level access, suitability or base access; the Government activity handles those investigations.
If not sure:Confirm the requirement with the contracting officer or the prime. Ask for the DD Form 254 (or its draft) and what classified information the work involves.
2Does your company already hold a facility clearance?
If yes:Check the level in question 2a. An existing final FCL is verified in NISS, and one from another cognizant agency is honored on a reciprocal basis.
If no:You need to be sponsored for an initial FCL. The rest of this check covers what that takes.
2aIs it at the level the contract requires, or higher?
If yes:No new FCL is needed. The sponsor or prime verifies it. If the contract requires storing classified material, see question 12.
If no:You need to be sponsored for an upgrade. The sponsorship steps are the same; DCSA will tell you which KMP must be cleared at the higher level.
3Has a Government contracting activity or a cleared prime contractor agreed to sponsor you in NISS?
If yes:Help the sponsor submit a clean request. Give them your CAGE code and point of contact, and check that the level they request matches the DD Form 254.
If no:You cannot sponsor yourself. A company can be processed only after a GCA or cleared contractor sponsors it for a real classified requirement (32 CFR §117.9(a)(10)).
If not sure:Ask the contracting officer or prime who will submit the sponsorship, and when. Sponsorship can happen during the solicitation if you need classified access to compete.
4Is your company a legal entity organized under U.S. law and located in the United States?

Organized under the laws of a state, the District of Columbia or an organized U.S. territory (or, under conditions, a recognized tribe), and located in the U.S. or its territorial areas.

If yes:U.S. organization and location requirement met (32 CFR §117.9(c)(2)–(3)).
If no:The entity is not eligible as structured. A joint venture formed only by contract, for example, must first be established as a legal business entity (§117.9(k)).
If not sure:Check your formation documents with whoever handles your corporate filings.
5Does the company have a CAGE code?
If yes:Give your CAGE code to your sponsor for the sponsorship request.
If no:Get a CAGE code before sponsorship, through DLA CAGE; a prime contractor must also register in SAM.gov. DCSA warns that starting without one can cause significant delays or discontinuation.
6Has the person who will be your FSO applied for a PKI or ECA token?

The token is how the FSO signs in to NCAISS and NISS, where the FCL package is submitted. DCSA’s handbook calls applying for it the immediate first action.

If yes:Keep track of it until it arrives. Without it the FSO cannot open the FCL package when the 20-day clock starts.
If no:Apply for a PKI or ECA token now. It can take several weeks, and the Day 20 deadline runs whether or not the FSO can sign in to NISS.
If not sure:Ask your future FSO, and see DCSA’s job aid on PKI, ECA and NCAISS access for approved vendors.
7Can you name a senior management official, and appoint U.S. citizen employees as FSO and ITPSO who can be cleared?

The FSO and the insider threat program senior official must be employees of the company and U.S. citizens. The SMO, FSO and ITPSO are always essential KMP and must be cleared at the FCL’s level or higher.

If yes:Prepare their appointment letters. DCSA needs FSO and ITPSO appointment letters with the business documents, and the FCL depends on all three being cleared.
If no:Fill these roles first. An entity must have an SMO, FSO and ITPSO who hold and keep eligibility (32 CFR §117.9(c)(5), (d)(1)). None of the three can be temporarily excluded while the FCL is processed.
If not sure:Check citizenship and employment status for the people you have in mind.
8Are your governance documents current and easy to put together?

Formation and governance documents (articles, bylaws or operating agreement), ownership records (stock ledger, capitalization table or membership list), recent meeting minutes, and a legal organizational chart showing ownership and control up to the ultimate parent. The list for each business structure is in Sections 4.2 and 4.5 of DCSA’s FCL Orientation Handbook (July 2026).

If yes:Compare them against the Handbook list now, so the Day 20 package is complete the first time. DCSA allows two chances to fix a package before it discontinues the case.
If no:Start gathering governance documents now. Business documents and forms are due by Day 20 after DCSA accepts the sponsorship, counted in calendar days.
9Are your likely KMP ready to complete an SF 86 in eApp and electronic fingerprints promptly, with proof of U.S. citizenship?
If yes:Have them start collecting SF 86 information now, and find a provider that submits fingerprints electronically to DCSA through SWFT.
If no:Get your KMP ready before sponsorship. After your package is in, DCSA emails a due date for each essential KMP’s eApp and fingerprints, and the final FCL waits until they are cleared. KMP who are not essential are excluded by exclusion resolution instead.
If not sure:List who holds authority in your governance documents. DCSA decides which KMP must be cleared, based on their roles and authorities.
10Does any foreign person or entity own part of the company, have control or influence over it, or have significant financial or contractual ties with it?

Think about foreign owners or investors (directly or through a parent), foreign board members or officers, foreign lenders, and contracts or income from foreign sources. The SF 328 asks about each of these.

If yes:Expect a FOCI review, and extra time. A company found under FOCI is ineligible until mitigation acceptable to DCSA is in place (32 CFR §117.11(a)(3)). Consider involving counsel familiar with FOCI early.
If no:Answer the SF 328 carefully anyway. Several questions have their own thresholds; read the form’s instructions rather than relying on a general impression.
If not sure:Work through the SF 328 and its instructions with whoever knows your ownership, financing and contracts.
11Is the company part of a parent–subsidiary structure or a joint venture, or does it have several locations?
If yes:Plan for parent, joint venture or branch processing. DCSA reviews the whole ownership chain: a parent is cleared or formally excluded, with documents from the ultimate parent. A joint venture that needs an FCL must be a legal entity with its own security officials; a branch needs its own FCL only to store classified material. See different structures.
If no:No parent, joint venture or branch processing. A single, standalone entity avoids that extra step.
12Will the company need to store classified material at its own site?
If yes:Storage is a separate approval. The DD Form 254 should state the safeguarding requirement, and DCSA must approve your safeguarding capability in addition to the FCL (32 CFR §117.9(a)(6)).
If no:No safeguarding approval to plan for. The FCL covers access; the contract decides where the work happens.
If not sure:Check the DD Form 254 for a storage requirement. It states whether the contractor will receive, generate or store classified material.
13Is the company, or any of its key managers, listed as excluded in SAM?
If yes:Raise it with your sponsor before sponsorship. DCSA checks SAM exclusions and, with the sponsor and the agency that listed you, decides whether processing continues. An SMO, FSO or ITPSO must not be excluded from Government contracts.
If no:No exclusion issue.
If not sure:Search the exclusions on SAM.gov for the company and each key manager.

Next

See the whole process

Sponsorship, the Day 20 package, FOCI review, KMP clearances and keeping the FCL, step by step with sources.

Open the facility clearance map →

Sources: 32 CFR §117.9; 32 CFR §117.11; DCSA Facility Clearances page and checklist (read 2026-09-24); DCSA FCL Orientation Handbook (July 2026) and Quick Start Guide; DoDM 5220.32 Volume 1, Section 4. For companies under DCSA cognizance. Not legal advice.