FSOtools
Open the Atlas

FSOtools · Knowledge desk · For Facility Security Officers

Your daily security desk.

Find the right form, open the right system, and get to the guidance behind your next task.

12 task shortcuts13 form references15 topic areas34 accepted answers

01 / THE DESK

Start with your task

Shortcuts to the guides, tools and questions for the work in front of you.

02 / THE DESK

Common questions

36 questions selected from Reddit, ClearanceJobs, official FAQs and practitioner resources. Use the starting resources while answers are developed. This is a curated selection, not a frequency ranking; discussion links explain topic selection, not compliance requirements.

Starting as an FSO

What should a new FSO review during the first month?

Answer in development

Starting resources

Why this question?

New FSOs ask how to establish an initial work plan.

Discovery sources, not answer citations:

Starting as an FSO

Which security-program duties still apply at a non-possessing facility?

Answer in development

Starting resources

Why this question?

Storage status affects what new FSOs expect their program to cover.

Discovery sources, not answer citations:

Vetting systems & record maintenance

What do active, current, eligible and expired mean when discussing a clearance?

Answer in development

Starting resources

Why this question?

Public questions repeatedly mix record status, access and investigation dates.

Discovery sources, not answer citations:

Vetting systems & record maintenance

how long should a clearance be maintained in DISS if there is no active cleared work

Read existing answer · source revalidation required

Starting resources

Why this question?

Employment gaps raise recurring affiliation and access-maintenance questions.

Discovery sources, not answer citations:

Vetting systems & record maintenance

Which DISS date should be used to determine when a periodic questionnaire update is due?

Answer in development

Starting resources

Why this question?

Renewal confusion and a 2026 official process update make date selection a research priority.

Discovery sources, not answer citations:

Vetting systems & record maintenance

How does an interim clearance not being granted differ from a final denial?

Answer in development

Starting resources

Why this question?

Repeated interim questions mix employment contingencies with final eligibility.

Discovery sources, not answer citations:

Vetting systems & record maintenance

How should an FSO resolve a loss-of-jurisdiction record?

Answer in development

Starting resources

Why this question?

Job changes and incomplete actions raise record-resolution questions.

Discovery sources, not answer citations:

Vetting systems & record maintenance

What should be verified before requesting reciprocity?

Answer in development

Starting resources

Why this question?

Crossover threads raise questions about existing determinations and receiving-agency requirements.

Discovery sources, not answer citations:

Vetting systems & record maintenance

Where should industry users find current DISS and NBIS Initiate/Review instructions?

Answer in development

Starting resources

Why this question?

Official transition notices and practitioner coverage identify a changing system workflow.

Discovery sources, not answer citations:

Vetting systems & record maintenance

How should an FSO request a status update or escalate a delayed personnel action?

Answer in development

Starting resources

Why this question?

Processing delays are a recurring theme in the FSO survey overview and public questions.

Discovery sources, not answer citations:

Reporting & personnel events

Who receives a report when an employee has multiple employers or a Reserve affiliation?

Answer in development

Starting resources

Why this question?

Multiple affiliations create uncertainty over reporting destinations.

Discovery sources, not answer citations:

Reporting & personnel events

How do SF 86 foreign-contact questions differ from ongoing contact reporting?

Answer in development

Starting resources

Why this question?

Discussions often mix application questions with continuing reporting requirements.

Discovery sources, not answer citations:

Reporting & personnel events

How should an FSO distinguish mental-health treatment from a reportable circumstance?

Answer in development

Starting resources

Why this question?

Public reporting questions and official FAQs show the need for careful scope distinctions.

Discovery sources, not answer citations:

Personnel eligibility & access

May an FSO share an employee's SF 86 with management for other purposes?

Read existing answer · source revalidation required

Starting resources

Why this question?

The same confidentiality question appears in both Reddit and practitioner coverage.

Discovery sources, not answer citations:

Personnel eligibility & access

How should an applicant correct an SF 86 omission after submission?

Answer in development

Starting resources

Why this question?

Application questions raise uncertainty about correcting submitted information.

Discovery sources, not answer citations:

Personnel eligibility & access

What clearance-status information can an FSO give a hiring manager without sharing questionnaire details?

Answer in development

Starting resources

Why this question?

Privacy and hiring-delay themes intersect in management status requests.

Discovery sources, not answer citations:

Facility clearance & FOCI

What must be resolved before a non-possessing facility begins storing classified material?

Answer in development

Starting resources

Why this question?

A practitioner question specifically concerns changing safeguarding status.

Discovery sources, not answer citations:

Vetting systems & record maintenance

How does clearance eligibility differ from SCI or SAP access?

Answer in development

Starting resources

Why this question?

Crossover discussions and official FAQs highlight additional program-access questions.

Discovery sources, not answer citations:

03 / THE DESK

Systems & support

Open official information pages for current access, user guidance and support. System roles and transitions change; follow the agency’s current instructions.

NBIS & eApp

Background-investigation and applicant resources. Check DCSA DISS resources for current industry Initiate/Review instructions.

Official guidance and access

DCSA systems directory

Find current access routes for eMASS, STEPP, identity management and other DCSA applications.

Official guidance and access

04 / THE DESK

Forms directory

Official sources for blank forms and instructions. Inclusion does not mean a form applies to every facility.

DD 254 · Contract Security Classification Specification

Contract classification requirements and related security guidance. Start here for contract-specific questions.

WHS official form page and download

Reference link checked 2026-09-12. Check edition and applicability at the source.

DD 441 · Department of Defense Security Agreement

Security agreement reference for the facility-clearance process.

WHS official form page and download

Reference link checked 2026-09-12. Check edition and applicability at the source.

DD 441-1 · Appendix to Department of Defense Security Agreement

Companion appendix to the security agreement; confirm its use for the entity's organization.

WHS official form page and download

Reference link checked 2026-09-12. Check edition and applicability at the source.

SF 312 · Classified Information Nondisclosure Agreement

Individual nondisclosure agreement. Signing and access authorization are separate questions.

Official form source

Reference link checked 2026-09-11. Check edition and applicability at the source.

SF 328 / Form 328 · Certificate Pertaining to Foreign Interests

Foreign-interest disclosures. Use DCSA's currently linked form and instructions; verify submission-specific requirements.

DCSA guidance and process resources

Reference link checked 2026-09-11. Check edition and applicability at the source.

SF 86 · Questionnaire for National Security Positions

Personnel investigation questionnaire. Review scope, handling and privacy belong in the accompanying Q&A.

Official form source

Reference link checked 2026-09-11. Check edition and applicability at the source.

SF 700 · Security Container Information

Container information form reference; use the official listing for availability and instructions.

ISOO official security forms directory

Reference link checked 2026-09-30. Check edition and applicability at the source.

SF 701 · Activity Security Checklist

Activity security checklist reference; determine applicable local and agency requirements before use.

ISOO official security forms directory

Reference link checked 2026-09-30. Check edition and applicability at the source.

SF 702 · Security Container Check Sheet

Security-container check-sheet reference and official form source.

Official form source

Reference link checked 2026-09-11. Check edition and applicability at the source.

DCSA 147 · Open Storage Approval Checklist

Open-storage approval checklist and process guide are linked from DCSA's NISP resources page.

DCSA guidance and process resources

Reference link checked 2026-09-11. Check edition and applicability at the source.

SF 703 · Top Secret Cover Sheet

Official security cover-sheet reference and availability information.

ISOO official security forms directory

Reference link checked 2026-09-30. Check edition and applicability at the source.

SF 704 · Secret Cover Sheet

Official security cover-sheet reference and availability information.

ISOO official security forms directory

Reference link checked 2026-09-30. Check edition and applicability at the source.

SF 705 · Confidential Cover Sheet

Official security cover-sheet reference and availability information.

ISOO official security forms directory

Reference link checked 2026-09-30. Check edition and applicability at the source.

OCTOBER 2026 / OPERATIONAL REFERENCES

October 2026 operational references

For DISS/eApp, clearance timelines, and the October 1 facility procedures, read the October field update. Use the DCSA official-visitor checklist and security-review and corrective-action guide.

These dated operational references are separate from the accepted answers below; an answer’s acceptance and source-review status have not changed.

05 / THE DESK

Accepted answers

Published wording reviewed by the maintainer. These answers carry historical source references and need source revalidation before reuse.

Accepted wordingContracts & DD 254

What happens to classified material when a contract ends?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

After the normal two-year period, continued possession must have authorization. A follow-on DD 254 can authorize transfer to the new contract. Otherwise, request extended retention from the GCA, with a final DD 254 documenting the retention period and disposition. WHS also recognizes formal written GCA retention authorization, so those two form routes are not exclusive.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingPersonnel eligibility & access

What should I verify before granting an employee classified access?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

Verify need-to-know, appropriate eligibility, a signed NDA and required briefings. Review the DD 254, attachments and classification guidance for the actual work, including government-client requirements flowed through the prime to subcontractors. Satisfy applicable contract and program requirements before granting access.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingPersonnel eligibility & access

What must happen when a cleared employee leaves the company?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

Post-separation CSR procedure without a DISS relationship remains unverified.

Report separation, document the debriefing and update access records. Departure does not end the duty to report relevant adverse information discovered afterward, including supported information concerning suspected timecard or employment fraud.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingContracts & DD 254

Who prepares and revises a subcontract DD 254?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

The company issuing the subcontract DD 254 determines who is authorized to certify it. That person may be its FSO, a contracting official, or another authorized representative; certification is not reserved to a particular contractor job title. For a government-issued DD 254, the certifier is the contracting officer or an authorized representative.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingContracts & DD 254

What does DD 254 tell the FSO, and what does it not establish?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

The DD 254, its attachments and incorporated references communicate the classified contract’s security requirements. The FSO uses them to identify required clearance and safeguarding levels, performance locations, special access or handling requirements, and classification guidance. The form specifies requirements; it does not itself grant a clearance, approve storage, authorize employee access or confer original classification authority. The FSO must verify those prerequisites, resolve missing or conflicting guidance, and track revisions. It also does not replace applicable CUI or cybersecurity contract clauses.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingContracts & DD 254

What should I do when the DD 254 conflicts with other contract instructions?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

Request clarification from the GCA, coordinating through the prime where applicable. If unresolved, use the classification-challenge process. During that challenge, protect the information at the assigned or proposed classification level, whichever is higher.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingFacility clearance & FOCI forms

When must a company submit or update SF 328?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

Read answer
A company must submit SF 328 during the entity eligibility determination process and update it when significant changes occur to previously submitted FOCI information under 32 CFR §117.11(c); a corporate family may submit a consolidated response as allowed by CSA guidance. Section 117.8(c)(7)(v) requires reporting material changes through an updated SF 328 under CSA instructions without repeating unchanged answers. The official SF 328, revision 7/2026, reviewed as supplemental evidence outside the approved library, requires a complete explanation of how FOCI has changed since the last submission and annual certification that prior responses have not changed, following the reviewing CSA's guidance. This general annual-certification instruction is distinct from §117.11(i)(2)'s annual implementation and compliance report for contractors under a voting trust, proxy agreement, SSA, or SCA. Discussions, consultations, or agreements that may reasonably lead to effective foreign ownership or control require written reporting and forwarding any Schedule 13D received; negotiations for a foreign merger, acquisition, or takeover also require the §117.11(c)(2) notice and specified transaction documents. The current form states that it also supports eligibility for certain Department of War contracts under section 847 of Public Law 116-92 and the DoW Enhanced Security Program, so follow the requesting activity's instructions for those uses. Use the current form, which identifies the previous edition as obsolete; as prudent practice, retain dated submissions and certifications, document materiality decisions, review FOCI facts regularly, and ask the CSA when significance is uncertain rather than waiting for an annual cycle. The annual-certification due date, submission channel, applicability timing for entities already on file, and any related ISL were unresolved in this answer and must be confirmed with DCSA; the form and current guidance also needed approved-library intake.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingPersonnel eligibility & access

Does signing SF 312 by itself authorize access to classified information?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

Signing the NDA alone does not authorize classified access. The employee also needs valid need-to-know and favorable eligibility at the appropriate level; access must remain within the contractor's clearance and applicable contract/program requirements. Based on 32 CFR 117.10(a)(1)(iii) and (g).
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingPersonnel eligibility & access

May an FSO share an employee's SF 86 with management for other purposes?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

The FSO or designated reviewer reviews it for adequacy and completeness, provides the required written notice, and must not share its information within the entity or use it for another purpose. A management request does not change that restriction. Based on 32 CFR 117.10(d)(1)-(2); separate reporting duties require separate analysis.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingFOCI

What is required for an SF 328 update?

Source revalidation required · Recorded release: nist-172-r3-intake-20260911

Read answer
Under 32 CFR §§117.11(c) and 117.8(c)(7)(v), submit SF 328 during the entity eligibility determination and update it when significant or material changes occur to previously submitted FOCI information, following CSA guidance without repeating unchanged answers; a corporate family may use a consolidated response when CSA guidance permits. The official SF 328, revision 7/2026, reviewed as supplemental evidence outside the approved library, identifies the prior edition as obsolete and requires a complete explanation of changes since the last submission, the name and date of referenced supporting documents, completion of mandatory items, and certification by an authorized person able to bind the entity with a witness signature; the completed form is CUI. The form also requires annual certification affirming that prior responses have not changed, following the reviewing CSA's instructions. This general annual certification is distinct from §117.11(i)(2)'s implementation and compliance report for contractors under a voting trust, proxy agreement, SSA, or SCA. Report discussions, consultations, or agreements that may reasonably lead to effective foreign ownership or control in writing and forward any Schedule 13D received; negotiations toward a foreign merger, acquisition, or takeover additionally require the §117.11(c)(2) notice, including transaction type, potential investor identity, a FOCI mitigation plan, and the specified agreements and organizational documents. Report associated ownership, control, KMP, name, or address changes under §117.8(c)(7)(i)–(iii). As prudent practice, compare current facts with the last submission, document materiality decisions, submit promptly after a material change, and retain the form, explanatory narrative, supporting documents, certifications, and CSA correspondence. The annual-certification due date, submission channel, effective date for entities already on file, and any related ISL remained unresolved, and automated access to the DCSA guidance pages was blocked; confirm these matters and uncertain materiality decisions with the ISR or FOCI office and request approved-library intake of the form and guidance.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

Accepted wordingGeneral

how long should a clearance be maintained in DISS if there is no active cleared work

Source revalidation required · Recorded release: dd254-dec1999-lifecycle-fix-20260915

There is no fixed time limit for maintaining an employee’s eligibility record under a contractor’s DISS Security Management Office (SMO) merely because the employee is not currently performing classified work. The important distinction is whether a continuing requirement for classified access exists. If that requirement has ended but the contractor reasonably expects future classified access, the contractor should remove the access entry while retaining the SMO affiliation and continuing required vetting, reporting, and training; DCSA sets no fixed deadline for restoring access under that arrangement. If future classified access is not reasonably expected, the contractor should follow the out-processing procedure unless a separate, legitimate unclassified duty supports continued SMO affiliation. DCSA permits such affiliation for purposes including unclassified system access and positions of trust, with the Government Contracting Activity responsible for funding, submitting, and managing those investigations. A customer’s requirement for an “active T3” therefore needs to be clarified in writing: a T3 investigation, favorable adjudication, clearance eligibility, and classified access are distinct, and a CUI-related investigation requirement alone does not establish a need for classified access. The FSO should maintain accurate DISS records and document the basis for each access entry and SMO relationship. This follows 32 CFR 117.10(a)–(b) and (i), 117.12(l), and [DCSA’s DISS Management guidance, pages 1–3](https://www.dcsa.mil/Portals/128/Documents/CTP/tools/Guidance%20for%20DISS%20Management%20Final%2020250127.pdf); the specific customer’s T3 requirement must still be verified.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · 117.10(a)–(b), (i); 117.12(l)
  • dcsa-job_aids-aid-diss-management · pages 1–3
Accepted wordingGeneral

Should our DD254s identify the additional corporate location because CUI is handled there, even though classified information is not?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

A location handling only CUI does not belong in the DD Form 254's classified-performance blocks solely for that reason. Item 8 addresses locations where classified information is accessed and stored, or only accessed, and an entry limits classified performance to the listed locations; Items 6 through 8 should therefore reflect the applicable cleared facilities and classified-performance locations. For a classified contract that also requires CUI, address CUI through Items 10j and 11l and GCA-provided protection guidance in Item 13, and comply with the contract's CUI protection and training requirements under 32 CFR §§117.15(l) and 117.12(f). Any requirement to identify CUI processing locations or systems comes from the contract and agency guidance, rather than Item 8, and a CUI-only location does not need an FCL merely because it handles CUI. The Government must identify the applicable CUI; refer ambiguous designation or handling questions to the contracting activity for a written determination rather than assuming either CUI or unrestricted status. Check the contract's CUI clauses and the additional location's system requirements, request missing Item 13 guidance in writing when the CUI items are marked but instructions are absent, and retain the GCA's written direction. Apply the same distinction when issuing subcontract DD Form 254s, flowing the applicable CUI guidance through Item 13 without presenting a CUI-only location as a classified-performance site.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · 32 CFR 117.15(l) Safeguarding CUI
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · 32 CFR 117.12(f) CUI training
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · 32 CFR 117.3, definition of CUI
  • dcsa-forms-dd254-instructions · Item 8, 8(2), 8a
  • dcsa-forms-dd254-instructions · Item 10j; Item 11l
Accepted wordingFacility clearance sponsorship and subcontract DD254 approval

Can a cleared prime sponsor a non-possessing subcontractor for a TS facility clearance and issue a TS-only subcontract DD254 without explicit COR approval when SCI is not required?

Source revalidation required · Recorded release: doha-v9-exceptions-20261003

A cleared prime may sponsor a subcontractor for a facility clearance at the level needed for a legitimate U.S. Government classified-access requirement. The prime must hold an FCL at the same or higher level as its subcontractor, communicate applicable security requirements, and include the security requirements clause and DD Form 254 (or equivalent) in the subcontract (32 CFR §§117.9(a)(5), 117.17(a)(1)). If the subcontractor lacks the required FCL, the DD Form 254 instructions say the prime or GCA must sponsor it. When the subcontractor will access classified information only at a Government or another cleared contractor’s site and will not safeguard it at its own facility, the instructions direct the DD Form 254 to show ‘None’ in Item 1b, ‘access elsewhere’ in Item 11a, and the actual performance location in Item 8a. The cited NISPOM provisions do not establish a blanket COR-specific preapproval rule for every subcontract; the applicable GCA determines restrictions or preapproval requirements, and prior GCA approval is required for subcontracts involving intelligence information, including non-SCI intelligence. Check the prime contract and DD Form 254 for any additional approval conditions before proceeding.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · 32 CFR §§117.9(a)(5), 117.17(a)(1); pp. 35, 80
  • dcsa-forms-dd254-instructions · FCL sponsorship; Items 1b, 2b(4), 8a, 10e(4), 11a; pp. 1, 2, 5, 7
Accepted wordingpersonnel-clearances

Can a cleared contractor submit Secret PCL investigation requests for employees before a contract award or DD 254 is in hand? What justifies the need, and how are investigations initiated (NBIS/DISS/eApp) and by whom?

Source revalidation required · Recorded release: doha-v9-exceptions-20261003

Read answer
Only in a narrow way, and not before the company is in the facility clearance process: a facility with no Secret entity eligibility determination (FCL) cannot request clearances for its staff on its own. A contractor cannot apply for its own FCL, so a GCA or a currently cleared contractor must sponsor it, which the rule allows at any point in the contracting life cycle where access is needed, including the solicitation or competition phase (32 CFR 117.9(a)(10)). Once the entity eligibility process is under way, the company must submit investigation requests for its senior management official, FSO, ITPSO, and any other KMP the CSA identifies (117.9(d)(1)(v)), and the rule separately lets the contractor designate employees who require access during the negotiation of a contract or the preparation of a bid or quotation, to be processed for PCL eligibility concurrent with the entity determination (117.9(e)(1)). Those designated employees' eligibility does not hold up the entity determination unless they are KMP, but neither they nor the company may have access to classified information until the entity eligibility determination and their own PCL eligibility have both been granted (117.9(a)(4), 117.9(e)(2)), and the limits in 117.10(a)(5) and (a)(7) still apply: the minimum number necessary, no cache of cleared employees, and only the contractor's own employees or consultants. My reading is that this concurrent-processing provision is tied to bid and negotiation needs, so staff needed only for performance after award would normally be requested once the FCL (final, or interim, which the CSA may grant at its sole discretion under 117.9(h)) is in place, and a candidate not yet employed also needs the accepted written employment commitment and the 45-day start requirement in 117.10(f). The library does not state how DCSA sequences this in practice, when the company can first submit anything, or which system (NBIS, eApp, or DISS) it uses before the FCL exists, so those points are unresolved here and should be confirmed with the DCSA ISR or the sponsoring GCA or prime. As prudent practice rather than a stated requirement, do not submit anyone for a PCL until the sponsorship is accepted, and keep written support for each person's role in the bid or negotiation. This is not legal advice.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:34;32 CFR 117.9(a)(4)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:35;32 CFR 117.9(a)(10)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:36;32 CFR 117.9(d)(1)(v), 117.9(e)(1)-(2)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:37;32 CFR 117.9(h)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:40;32 CFR 117.10(a)(5),(a)(7)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:42;32 CFR 117.10(f)
Accepted wordingPersonnel security

When DISS shows Loss of Jurisdiction and no current eligibility, what should an FSO do before the person again needs classified access, and does the status itself require a new investigation?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

A DISS entry of Loss of Jurisdiction (LOJ) means there is no current eligibility for classified access. Do not grant access until DCSA Trust Decision (Adjudications) enters an eligibility that supports the required access. DCSA explains that LOJ can be entered when a person is out-processed from DISS and no longer has a DoD affiliation before DCSA can make a favorable eligibility determination. The next processing step depends on the record. DCSA's DISS FAQ says that when no eligibility is displayed and access is required, initiate a new initial investigation through the current DISS process. If an existing investigation is awaiting adjudication after affiliation was lost, DCSA's Trust Decision FAQ directs the FSO to establish a new owning relationship and submit a DISS Customer Service Request for an adjudication action. Review the investigation and case history first; LOJ alone does not identify which processing path applies. Follow current CSA instructions for the questionnaire and fingerprints. 32 CFR §117.10(e) requires fingerprints to be submitted in accordance with CSA guidance, and §117.10(j)(2) requires a new eligibility determination when a break in employment resulted in loss of eligibility. Do not rely on an old continuous-evaluation enrollment date as proof of current eligibility or assume that a generic “CV Update” is the required action. Confirm the current DISS status and procedure with the cognizant security authority if the record history does not make the next step clear.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.10(e), fingerprints under CSA guidance; §117.10(j)(2), new eligibility determination after break in employment resulting in loss of eligibility, p. 43
  • external-dcsa-trust-decision-adjudications-faq · “Why does eligibility reflect a Loss of Jurisdiction?”; LOJ means no eligibility and access must stop until TD(A) records supporting eligibility; DCSA current FAQ URL
  • external-dcsa-diss-faq · “If a subject has break in service,” no eligibility showing means initiate new initial investigation; DCSA current FAQ URL
Accepted wordingGeneral

For CMMC Level 2 scope, when one physical endpoint accesses three virtual machines that process, store, or transmit CUI, which assets belong in the assessment scope, and does the rule require monitoring licenses per physical device, VM, or VDI session?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Read answer
Part 117 does not resolve this CMMC scoping question: 32 CFR §117.18(f) places unclassified systems that process, store, or transmit CUI outside NISPOM's system-security requirements and directs contractors to comply with their contract requirements. For CMMC Level 2, distinguish a virtual machine from a virtual desktop infrastructure (VDI) client endpoint. Under 32 CFR §170.19(c)(1), a system or VM that processes, stores, or transmits CUI is a CUI Asset and belongs in the assessment scope; it must be documented in the asset inventory, system security plan, and scope network diagram, and assessed against Level 2 requirements. An endpoint hosting a VDI client can be out of scope only when it is configured so that it does not process, store, or transmit CUI beyond keyboard, video, and mouse signals sent to the VDI client. If it does not meet that condition, do not assume it is out of scope; classify and document it under the applicable asset category, which may include a Contractor Risk Managed Asset when the rule's conditions are met. Security Protection Assets that provide security functions to the assessment scope are also in scope for requirements relevant to those capabilities. The scenario describes three VMs, not necessarily a VDI arrangement. If each VM handles CUI, each is within the CUI-asset scope; a single physical endpoint does not, by itself, remove those logical systems from the scope. The regulation defines assessment scope and asset treatment. It does not prescribe a number of commercial EDR or SIEM licenses per physical endpoint, VM, VDI session, or provider. That count depends on the monitoring product's licensing terms and architecture; it cannot be resolved from §170.19 alone. Confirm the inventory and architecture with the assessor and determine license counts from the selected provider's terms.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.18(f), p. 87; current approved DCSA Library release `doha-retire-phantom-rows-20260923`
  • external-32-cfr-part-170-section-170-19 · §170.19(a), (c)(1), Table 3; official GovInfo current CFR text, https://www.govinfo.gov/link/cfr/32/170?link-type=pdf&sectionnum=19&year=mostrecent
Accepted wordingGeneral

How should a contractor reconcile a DD Form 254 that identifies a Secret facility clearance and Secret safeguarding at its site with a separate SCI access requirement for performance at another location, and what should it do if the form's blocks appear inconsistent?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Read answer
For a DoD contract requiring contractor personnel to access SCI, your correction is right on the key point: DoD Manual 5105.21, Volume 3 requires a valid contractual need to sponsor the contractor for a Top Secret FCL, and the contractor company must possess a final Top Secret FCL. An interim Top Secret FCL is insufficient for SCI access. Contractor employees performing work on SCI contracts must separately meet SCI eligibility requirements and be indoctrinated. That company-level final Top Secret FCL requirement is distinct from whether a particular company location is approved to safeguard SCI. The DD Form 254 and its attachments should identify where classified work and access occur and the safeguarding level required at each location. Thus, a contractor may have a final Top Secret FCL while a particular site is authorized to safeguard only Secret, if SCI access and performance occur at another authorized SCI location and the contract documents accurately describe the arrangement. A Top Secret FCL does not by itself authorize a site to store or process SCI or establish that it is an accredited SCIF. For a DoD contract, DoDM 5105.21, Volume 3, Enclosure 3, paragraphs 2–3, supplies the SCI-specific contractor FCL requirements. Under 32 CFR §117.3(b), the CSA separately assesses eligibility for categories such as SCI when additional requirements apply, and a favorable entity eligibility determination alone does not convey authority to store classified information. Under §117.23(b), contractors must follow applicable Intelligence Community directives and policies. The official DD Form 254 instructions say to mark Item 10e(1) only when the contractor requires SCI access to perform, and to state applicable SCI caveats in Items 13 or 14. Confirm Item 8 performance locations and the narrative against the actual work and access path. If the form appears inconsistent, do not infer SCI access, site authorization, or safeguarding authority from a checkbox or FCL level alone. Ask the GCA/security reviewing official for a corrected DD Form 254 or written clarification, and confirm the company’s FCL and each location’s SCI access/safeguarding authorization with the cognizant security authority before affected work or access proceeds. These DoDM provisions address DoD SCI contracts; for another department or agency, verify its applicable SCI policy and CSA instructions.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.3(b), entity eligibility determination, p. 12
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.23(b), intelligence information, p. 115
  • external-dodm-5105-21-volume-3 · Enclosure 3, paragraphs 2–3, pp. 44–45; official DoD issuance listing shows Volume 3 with Change 2, 09/14/2020; https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/510521m_vol3.pdf
  • dcsa-forms-dd254-instructions · DD Form 254 Instructions (April 2018, updated 2025-07-11), Item 10e(1), Items 13–14; https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254-Inst.pdf
  • external-dcsa-fcl-guidance · Facility Clearances, sponsorship/eligibility overview; https://www.dcsa.mil/FCL/
Accepted wordingGeneral

When a cleared contractor changes its operating address or moves to a fully remote workforce, what must it report to the CSA, and does NISPOM specify which residential address becomes the principal office?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

32 CFR §117.8(c)(7)(ii) requires a contractor to report a change in the entity’s operating name or address, or the address of any location determined eligible for access to classified information. The regulation does not define a special ‘fully remote’ principal-office address rule or say that a registered-agent address automatically satisfies the reporting requirement. Before changing the address used for the cleared entity or a cleared location, identify which address is changing in corporate records, SAM/CAGE records, the contract, and the CSA’s facility records. Notify the CSA through its current process and confirm whether a cleared location is being closed, replaced, or retained, and how the records and any safeguarding capability should be updated. A remote workforce does not by itself answer those facility-specific questions. If the change affects the ability to safeguard classified material, §117.8(c)(9) separately requires reporting an emergency that renders the location incapable of safeguarding as soon as possible; §117.8(c)(8) requires reporting changes in storage requirement or capability. Do not infer from these provisions that a remote home is automatically an approved cleared location or that every remote employee’s home must be listed. Obtain the CSA’s direction for the entity’s actual facility status and any contract-specific requirements.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.8(c)(7)(ii), p. 31; §117.8(c)(8)–(9), p. 32
Accepted wordingGeneral

How should an FSO notify DCSA when a person no longer requires a pending personnel investigation or adjudication, and is there an automatic 60-day closure after the person’s affiliation ends?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Do not assume that removing an affiliation automatically cancels an investigation or adjudication, or that the case will close within a universal 60-day period. 32 CFR Part 117 does not establish that 60-day cancellation rule. DCSA’s current “Maintaining Personnel Vetting Clearances” guidance says that when a person separates while an investigation is open, the system notifies Trust Decision (Adjudications) to determine whether cancellation is needed. It directs the FSO to submit a DISS Customer Service Request when separation occurs and a personnel action is pending, including a pending investigation request or adjudication. The system/CSA determines the appropriate action; do not promise a cancellation or processing time. Use the current system instructions for the case’s stage. DCSA’s NBIS/DISS swivel-seat guidance says that if a person leaves while an investigation request is still in initiation or review, cancel the request before removing the affiliation. If it has already advanced to adjudication, report the separation and pending action through the current DISS CSR process and obtain case-specific direction from DCSA/PSMO-I. Keep the operational record limited to the status and access requirement; do not put private medical or other sensitive case details in a general wiki.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.10(a)(5), p. 39; §117.10(f), pp. 41–42
  • external-dcsa-maintaining-personnel-vetting-clearances · DCSA web guidance, sections “Company Separations” and “Customer Service Requests”; https://www.dcsa.mil/Industrial-Security/Entity-Vetting-Facility-Clearances-FOCI/Facility-Clearances/Maintaining-Personnel-Vetting-Clearances/
  • external-dcsa-diss-nbis-swivel-seat · DCSA DISS/NBIS Swivel Seat Actions PDF, actions when person leaves during investigation initiation/review; https://www.dcsa.mil/Portals/128/Documents/IS/NBIS/DISS_NBIS_Swivel_Seat.pdf
Accepted wordingGeneral

May a contractor rescind a conditional offer or set a clearance deadline when an applicant’s eligibility remains pending, and may the FSO use SF 86 information to make that employment decision?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Read answer
32 CFR §117.10(f)(2) addresses a specific pre-employment commitment: it must state that employment will begin within 45 days after the employee is granted eligibility at a level that allows the person to perform the associated contract or U.S. Government requirement. It does not say that eligibility pending is a denial, and it does not itself create a blanket rule either prohibiting rescission or authorizing rescission when a stated deadline passes. Section 117.10(f)(1) permits a pre-employment investigation request when immediate classified access is required at the start of employment and the written-offer conditions are met. Section 117.10(a)(5) separately limits requests to the minimum employees and consultants needed for operational efficiency and contractual obligations. The SF 86 is subject to a separate restriction: the FSO or designated reviewer reviews it for adequacy and completeness only, may not share its information within the entity, and may not use it for another purpose (§117.10(d)(1)–(2)). Do not use the questionnaire itself to make an employment or security-suitability decision, predict adjudication duration, or treat a pending result as a denial. If facts independently trigger a separate reporting duty, assess and handle that duty under its own rule; it does not authorize repurposing the SF 86. Whether an employer may apply a clearance condition to a particular job or end an employment relationship because the individual cannot perform classified contract duties without eligibility depends on the actual contract requirement, offer terms, and applicable employment law. The FSO should not decide that issue from SF 86 contents. Confirm the documented access requirement with the contracting/security officials and refer the employment decision to the employer’s counsel or HR process; these NISPOM paragraphs do not resolve every employment scenario.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.10(a)(5), p. 39; §117.10(d)(1)–(2), p. 41; §117.10(f)(1)–(2), p. 42
  • external-dcsa-self-inspection-handbook · DCSA Self-Inspection Handbook for NISP Contractors, §117.10(f)(2), p. 117.10-4; https://www.dcsa.mil/Portals/128/Documents/CTP/tools/Self-Inspection_Handbook_NISP.pdf
Accepted wordingGeneral

When does a cleared contractor need a Technology Control Plan, what does it cover, and can existing visitor procedures suffice?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Under 32 CFR §117.12(a)(3)(v), a TCP is required to control foreign-national access at cleared contractor facilities and for long-term or extended foreign visits, unless the CSA finds existing facility procedures adequate. The regulation places procedures at the facility level; that can involve company-wide responsibilities and operating controls, but it does not mean every room or every type of information is subject to identical restrictions. The TCP must control access to all export-controlled information. In applicable FOCI mitigation cases, the CSA-approved TCP also addresses unauthorized foreign-national access to protected information and limits access to information covered by U.S. Government disclosure authorization. These provisions do not say that every CUI item or all classified information automatically belongs in every TCP. Define the protected information and the controls from the applicable information controls, export/disclosure authorizations, contract requirements and CSA direction. Existing visitor procedures may suffice only if the CSA determines they are adequate; a visitor policy is not automatically a substitute.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.12(a)(3)(v), p. 100; chunk dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026:b13dcfa20f445b61
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.11(c)(1), p. 53; chunk dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026:cd51d18d51f0114f
Accepted wordingGeneral

When a single-owner company performs classified contract work through an individual who is its only worker, should the relationship be treated as a consultant arrangement or as a subcontract, and what controls the DD Form 254 and facility-clearance requirements?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Read answer
The NISPOM does not make “single owner” or “only worker” a categorical test. Under 32 CFR §117.3, a consultant is an individual under contract and compensated directly to provide professional or technical assistance in a role requiring classified access. Section 117.17 defines a subcontract as an agreement by a contractor to furnish supplies or services for performance of a prime contract or another subcontract; the definition includes service agreements and other procurement actions that require or will require classified access. Start with the actual contractual relationship and work: identify who contracted with the prime, who is furnishing the services, who is paid under that agreement, what classified task creates the access requirement, and whether classified information must be safeguarded. A direct agreement and direct compensation to the individual may fit the consultant definition. An agreement with a separate company to furnish services may be a subcontract even when its owner is the only person performing the work. Do not classify the arrangement from the worker count, LLC label, or existing FCL alone. For a subcontract requiring classified access, the prime must establish a legitimate U.S. Government requirement, communicate the security requirements, and incorporate the security requirements clause and DD Form 254 or equivalent into the solicitation and subcontract. If the subcontractor must possess classified information, it needs the appropriate entity eligibility determination and safeguarding capability. For self-employed consultants, §117.9(l) assigns the decision whether an entity eligibility determination is needed to the responsible CSA. Align the contract documents, access path, and DD Form 254 with the actual relationship, and resolve uncertainty with the contracting parties and cognizant CSA before access is provided.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.3, consultant and subcontract definitions, pages 9–10
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.9(l), self-employed consultants, page 38
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.17(a)(1), classified subcontract requirements, pages 80–81
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.17(h)(2), disclosure to subcontractors, page 74
Accepted wordingGeneral

What is a reasonable processing timeline for a new Secret FCL sponsorship or FCL upgrade?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

DCSA does not publish a universal completion estimate for a new FCL sponsorship or upgrade. Its current Facility Clearances FAQ says it cannot provide a timeline because processing depends on multiple variables, including whether the facility responds to required requests and submits accurate, complete information. Follow the case-specific milestones and deadlines in the DCSA welcome email and package instructions, respond promptly to requests for information, and use NISS or the assigned ISR/DCSA Knowledge Center for case-specific status.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.9(a)(1), (d), pages 35–36
  • external-dcsa-fcl-faq · DCSA Facility Clearances FAQ: “How long does the FCL process take?”; https://www.dcsa.mil/FCL/
Accepted wordingGeneral

How should a contractor with an existing non-possessing TS FCL add two locations where a new contract requires Secret safeguarding, and how should it determine whether each site needs a separate FCL?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

An existing non-possessing FCL does not by itself authorize classified safeguarding at additional locations. Under 32 CFR §117.9(i), the cognizant security agency (CSA) determines whether branch offices are eligible for access when they need access and meet the applicable requirements. The rule does not set a mileage or state-line test for a separate branch FCL. The FCL decision and the separate safeguarding approval are related but distinct determinations (§117.9(a)(3), (c)(6)). First confirm whether each site is part of the same legal entity or a separate entity, whether classified access and safeguarding are required there, and which contract/DD Form 254 covers each performance location. DCSA directs industry to submit FCL sponsorship requests through NISS; where the facility lacks an FCL at the required level, an FCL or upgrade request is required. DCSA identifies DD Form 441-1 for a branch or division office. FAR 4.402(d)(2)(ii) requires a corresponding unique CAGE code for each contractor performance location listed on the DD Form 254. Have the FSO submit the appropriate NISS change-condition or FCL package only after confirming the pathway with the assigned ISR/CSA. Ask whether the location can be added within the existing multiple-facility organization, needs DD Form 441-1 and its own branch eligibility/safeguarding approval, or is a separate legal entity requiring separate processing. Do not rely on a generic one-hour, distance, or out-of-state rule; the governing sources do not establish one. Confirm the correct NISS package, DD Form 441/441-1, SF 328 updates, facility/CAGE identifiers, and DD Form 254 locations with the ISR/CSA before allowing safeguarding at either site.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.9(a)(3), (i), pages 36–38
  • dcsa-cfr-far-current-2026-01 · FAR 4.402(d)(2)(ii), page 4.4-1
Accepted wordingGeneral

What role, if any, does a contractor Facility Security Officer have in obtaining a Tier 4 Public Trust investigation for a contractor employee?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

For a Tier 4 Public Trust process, do not infer FSO duties from the NISPOM or from the FSO title. The current library’s 32 CFR Part 117 addresses industrial-security requirements for classified information disclosed to or developed by U.S. Government contractors (§117.1(a)); it does not establish one general Public Trust workflow for every contractor FSO. DCSA describes the sponsoring agency as initiating a vetting request, after which the applicant submits information through NBIS eApp. Operationally, a contractor should not assume an FSO role beyond tasks specified in the applicable contract and instructions the sponsoring agency gives the company. Individual agency clauses may assign contractor screening or administrative tasks, so verify them rather than generalizing across customers. For the specific contract, ask the COR and agency security office to confirm who initiates, the current system and forms, fingerprint process, any company or FSO tasks, determination authority, and approved way to transmit personal information.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.1(a), page 1
Accepted wordingContract and access basis

How should FSO workflows establish the contractual relationship and individual need for classified access?

Source revalidation required · Recorded release: dd254-dec1999-lifecycle-fix-20260915

For a U.S. contractor supplying a foreign customer, establish the access basis by tracing the foreign-customer contract through the U.S. contractor's applicable export or disclosure authority, the authorized and appropriately cleared subcontractor, and the individual's assigned duties and need-to-know. The contract establishes the work requirement, while the authorizations define the permitted export or disclosure scope; the route need not begin with a U.S. Government prime contract. A license alone does not establish every access prerequisite: review the security requirements flowing through the contract chain, authorized parties and conditions, entity and personnel eligibility, individual access prerequisites, and international transfer arrangements under 32 CFR §§117.10(a)(1), 117.17, and 117.19(b)(3)–(5), (d). Collect the actual contract, authorization, security guidance, and assignment evidence for the transaction; missing links remain unresolved, and this general answer does not assess a particular license or transaction.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:39;chars:0-4072
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:40;chars:0-4208
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:88;chars:0-4231
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:89;chars:0-4270
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:91;chars:0-3834
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:87;chars:0-4203
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:82;chars:0-4161
Accepted wordingPersonnel security

How should a contractor handle an adverse-information report when a cleared individual attributes a positive THC test to a CBD product?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

Under 32 CFR §117.8(c)(1), contractors report qualifying adverse information about employees who have classified-access eligibility to the CSA under the rule, SEAD 3, and CSA-provided guidance; they must not report rumor or innuendo. DCSA ISL 2021-02, revised in 2024, expressly says it does not clarify whether CBD product use is reportable. It warns that commercial labels may not reliably disclose THC and that a urinalysis result indicating illegal drug use may result in adverse action affecting eligibility. Do not tell an employee that CBD use is categorically reportable or nonreportable, or that a positive result by itself determines eligibility. Follow current CSA/customer reporting directions; if the known facts meet the adverse-information standard, report verified facts and clearly identify the employee's explanation as their account. SEAD 4, Guideline H, identifies a positive test for an illegal drug as a potential security concern and lists circumstances that may mitigate concern, including circumstances that make recurrence unlikely and do not cast doubt on current reliability, trustworthiness, or judgment. The person's efforts to understand the product and circumstances of use may be presented only as possible context or mitigation for the adjudicator to weigh. NISPOM does not create a special formal burden of proof for CBD product due diligence, and due diligence is not an automatic defense. The agency adjudicator, not the FSO, decides how the facts affect eligibility. Record the facts and explanation without labeling the event ‘accidental’ or ‘involuntary’ as an adjudicative conclusion.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.3(b), adverse information definition; §117.8(c)(1), page 29
  • dcsa-isl_current-2021-02-sead-3-rev-2024 · Adverse Information section and footnote 2, page 2; current status in approved manifest
  • dcsa-sead-sead-4-adjudicative-guidelines · Guideline H, paragraphs 24–26, pages 17–18
Accepted wordingFacility clearance & FOCI

How does DCSA's published process handle a DoD covered joint venture that needs classified access?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

DCSA's currently published covered-joint-venture instructions describe covered-JV handling for a DoD classified contract when the JV is awarded that contract and every participating venturer holds an active facility clearance at the level required for the JV or higher. DCSA says it does not issue a DoD FCL to the covered JV itself, but the JV still has a NISS sponsorship and active profile; DCSA validates the venturers' FCL status and the classified-contract requirement. If any venturer lacks the required FCL, DCSA says the JV must be processed for an FCL. The published package includes a GCA-approved security plan identifying key management personnel and the venturer managing the JV's security program, SF 328s from the JV and venturers, governance and ownership records, and exclusion resolutions. DCSA says the field office associated with the managing venturer provides oversight and that the JV must keep its NISS profile current when material conditions change. The official DoW issuances index lists DTM 24-004, Change 1, with an expiration date of July 31, 2026. DCSA's public resource page still describes the process under that DTM, but the public sources reviewed do not establish post-expiration policy status. Treat this as DCSA's currently published process description, and obtain current written direction from DCSA Entity Vetting and the GCA before relying on it for a new sponsorship or material status change. This process description is DoD-specific; do not assume another agency follows it.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · §117.3(b), entity eligibility definition; §117.17(a)(1), classified subcontract eligibility requirements
  • external-dcsa-naesoc-covered-jv · NAESOC Resources, ‘What are covered Joint Ventures (JV) in NISP?’; current public operational procedure; https://www.dcsa.mil/Industrial-Security/The-National-Access-Elsewhere-Security-Oversight-Center-NAESOC/NAESOC-Resources/
  • external-dod-dtm-24-004-change-1 · Attachments 2–3; procedure referenced by DCSA page; official document states expiration effective July 31, 2026; https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dtm/DTM-24-004.PDF
  • external-dow-issuances-dtm-index · DTM-24-004 listing and expiration date July 31, 2026; https://www.esd.whs.mil/DD/DoD-Issuances/DTM/
Accepted wordingDD Form 254 performance locations

Which classified performance locations must appear on a DD Form 254, and how are additional locations and CAGE codes recorded?

Source revalidation required · Recorded release: doha-retire-phantom-rows-20260923

DD Form 254 Item 8 identifies the locations where classified information will be accessed or stored, or only accessed. Item 8a records the facility name and full address; when there are additional locations, identify them in Item 13 or a continuation page as the form instructions direct. FAR 4.402(d)(2) requires a corresponding unique CAGE code for each listed contractor or subcontractor performance location, except that a Government facility uses its agency location code. Subcontractor locations requiring classified access must be listed. Item 8 limits classified contract performance to the locations identified, so coordinate the locations with the contracting activity and confirm they match the facility’s approved security status.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-far-current-2026-01 · FAR 4.402(d)(2)(i)–(iii), page 4.4-1; chunk dcsa-cfr-far-current-2026-01:7944229822962415
  • WHS DD Form 254 Instructions, April 2018 · Item 8 and 8a, pages 4–5; https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254-Inst.pdf
Accepted wordingFacility clearance and safeguarding locations

When does a branch office need separate FCL handling or safeguarding approval, and how is it listed under a home office?

Source revalidation required · Recorded release: not recorded

For a single legal entity with a home office and branch offices, DCSA recognizes a multiple-facility organization and uses DD Form 441-1 to list covered branch or division offices. DCSA’s FCL Orientation Handbook says a branch needs its own facility clearance when it must safeguard collateral classified information there; where no safeguarding is needed, security administration can remain with the home office. The current NISPOM requires applicable security provisions at each cleared facility location. The sources do not establish a mileage-based rule for whether a branch can be managed under the home office. Confirm the legal structure, safeguarding need, CAGE/location records and security coverage with the assigned ISR through NISS before filing; do not change the principal office or assume a separate sponsorship solely because the site is distant.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • DCSA Facility Clearances · Overview and branch/division office guidance; https://www.dcsa.mil/FCL/
  • DCSA FCL Orientation Handbook (2018) · Section 6.6 Branch or Division Office; https://www.dcsa.mil/Portals/91/Documents/CTP/Facility%20Clearance/FCL_Orientation_Handbook_10OCT18.pdf
  • 32 CFR Part 117 robot-readable approved library release · §117.7(e), contractor operations across cleared facility locations; release doha-retire-phantom-rows-20260923
Accepted wordingPersonnel security and reciprocity

How does DOE handle reciprocity requests for a DoD contractor clearance, and what timing or reinvestigation expectations apply?

Source revalidation required · Recorded release: not recorded

A DoD clearance may support DOE reciprocity, but the cognizant DOE security office must verify eligibility, investigation scope and required level. DOE says an active Top Secret clearance with an investigation completed within five years can support a Q access authorization without a new investigation; a higher requested level or an out-of-scope/exception case can require additional investigation. The available DOE sources do not establish a universal ‘under 30 days’ timeline; route submissions through the DOE contract security office and confirm current processing steps there.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • DOE Departmental Vetting Policy and Outreach FAQs · Reciprocity FAQ, questions on current Top Secret eligibility, five-year investigation window and exceptions; https://www.energy.gov/ehss/departmental-vetting-policy-and-outreach-faqs
  • DOE O 472.2A, Personnel Security · Attachment 1, contractor requirements, sections 3–4; https://www.energy.gov/documents/personnel-security
Accepted wordingNon-authoritative business practice

Where can a contractor begin when seeking commercial errors-and-omissions and cyber insurance?

Source revalidation required · Recorded release: not recorded

For commercial errors-and-omissions or cyber insurance, a practical starting point is to consult an insurance broker who can compare available policies and providers. This is general business practice, not DCSA or NISPOM guidance.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • No citations recorded.
Accepted wordingControlled Unclassified Information

How would you transport CUI material from one location to another

Source revalidation required · Recorded release: doha-robot-lf-20260929

Read answer
To transport Controlled Unclassified Information (CUI) material from one location to another, an authorized holder must ensure the material is protected against unauthorized access or observation through direct physical control, an opaque physical barrier, or approved shipping channels, while strictly avoiding any external CUI markings on the transport container. Under government-wide CUI regulations (32 CFR Part 2002) and DoD guidance (DoDI 5200.48), while general CUI protection falls outside core NISPOM rules unless incorporated into a contract (32 CFR § 117.15(l)), physical CUI transported outside a controlled environment must remain under the authorized holder’s direct control or be secured inside at least one physical barrier, such as an opaque folder, pouch, or locked briefcase (32 CFR § 2002.14(c)). When transmitting physical CUI between locations or entities, authorized holders may use the United States Postal Service (including First Class Mail or Parcel Post), any commercial delivery service, or internal interoffice mail systems, and should employ in-transit tracking and accountability tools to monitor delivery (32 CFR § 2002.14(d); DoDI 5200.48, Section 4.1.e(2)). Packages and parcels must be addressed specifically to a designated recipient, and authorized holders are explicitly prohibited from placing CUI markings or otherwise indicating the presence of CUI on the outside of any envelope, parcel, or shipping container (32 CFR § 2002.20(i)). Any accompanying transmittal document must bear a CUI indicator on its face alongside instructions specifying its unclassified or decontrolled status upon enclosure removal (32 CFR § 2002.20(j)). Furthermore, if CUI is transported on electronic or removable media, the data must be encrypted using FIPS-validated cryptography in compliance with NIST SP 800-171 system requirements (DFARS clause 7012 in subpart 252.204; 32 CFR § 2002.14(g)), and if the material is designated as CUI Specified rather than CUI Basic, the FSO must verify whether underlying statutory or contract authorities (such as export controls) mandate additional handling or courier restrictions (32 CFR § 2002.14(b)(2)).
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32cfr-2002-cui · page:10;chars:0-4657
  • dcsa-cfr-32cfr-2002-cui · page:16;chars:9076-11671
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:77;chars:0-4220
  • dcsa-dodi-dodi-5200-48-cui · block:1;chars:63136-67878
Accepted wordingpersonnel-clearances

If a contractor that already holds an FCL expects to be awarded a classified contract, can it submit uncleared people for a PCL before the contract is awarded?

Source revalidation required · Recorded release: doha-v9-exceptions-20261003

Read answer
Generally no for performance staff, but not for exactly the reason that there is no awarded contract. The rule ties a PCL request to need, not to the award date: the contractor must determine that access to classified information is essential to performing tasks or services related to the fulfillment of a classified contract (32 CFR 117.10(a)(1)(i)), and it must limit requests to the minimum number of employees and consultants necessary and may not use requests to build a cache of cleared employees (117.10(a)(5)). An expectation of award, by itself, does not establish that need, so submitting people only because you think the award is coming would be hard to defend. The exception is the pre-award phase itself: the rule lets a contractor designate employees who require access to classified information during the negotiation of a contract or the preparation of a bid or quotation, and those employees are processed for PCL eligibility (117.9(e)(1)). That provision is written for processing concurrent with the entity eligibility determination, so for a company that already holds its FCL I read it as showing that a documented bid or negotiation need can support a pre-award request, not as authority for a general pre-award clearance pipeline; the library does not say how DCSA treats these requests when the FCL already exists, so confirm that with your ISR. The limits still apply: you may submit requests only for your own employees or consultants, not for non-employees or subcontractor employees (117.10(a)(7)); an uncleared candidate who is not yet on your payroll can be submitted only if you have made a written employment commitment that the candidate has accepted in writing, the person needs access immediately on starting, and employment begins within 45 days of the grant of eligibility (117.10(f)); and no one may be given access until they have a need-to-know, eligibility at the right level, and a signed NDA (117.10(a)(1)(iii)). Practically, if the person does not need access to classified information to prepare the bid or negotiate, wait for the award or the DD Form 254, and keep written support for the need of anyone you do submit earlier. This is not legal advice.
Sources and applicability

Maintainer acceptance is not regulatory approval. Verify the cited edition, current guidance and the facts of your work before relying on this answer.

  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:36;32 CFR 117.9(e)(1)-(2)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:39;32 CFR 117.10(a)(1)(i), (a)(1)(iii)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:40;32 CFR 117.10(a)(5), (a)(7)
  • dcsa-cfr-32-cfr-part-117-up-to-date-as-of-7-24-2026 · page:42;32 CFR 117.10(f)

06 / THE DESK

Browse all topics

15 topic areas · 93 questions without a published answer. Questions in development are a research queue, not instructions.

Contracts & DD 254

Identify contract direction, classification guidance and subcontract responsibilities.

Personnel eligibility & access

Distinguish eligibility, access, need-to-know and questionnaire handling.

Facility clearance & FOCI

Entity eligibility, foreign interests, ownership and key management personnel.

Reporting & personnel events

Separate individual disclosures, entity reporting and security incidents.

Physical safeguarding & visits

Storage, checks, visitors and access at other locations.

  • How do SF 700, SF 701 and SF 702 differ?Answer in development
  • When is open-storage approval needed and where does DCSA 147 fit?Answer in development
  • What must be checked before a classified visit?Answer in development
  • How do I address a security container found unsecured?Answer in development
  • What records support end-of-day security checks?Answer in development
  • What should a classified-material destruction record contain?Answer in development

Classification & markings

Use source guidance and distinguish original from derivative classification.

  • Who may make an original classification decision?Answer in development
  • What sources support derivative classification?Answer in development
  • What should I do when classification guidance is missing or ambiguous?Answer in development
  • How are classification challenges raised and documented?Answer in development
  • How should an FSO resolve conflicting classification markings?Answer in development
  • What derivative-classification training records should be retained?Answer in development

CUI & information systems

Contract-specific information protection and system responsibilities.

Program management & training

Run a documented security program and keep references current.

Vetting systems & record maintenance

Find the right starting point for DISS, NBIS, investigation requests and status questions.

Visits & meetings

Plan incoming and outgoing visits, visitor verification and classified meetings.

  • What information belongs in a classified visit request?Answer in development
  • How should an FSO verify an incoming visitor before access?Answer in development
  • What should be checked before hosting a classified meeting?Answer in development
  • How should changes or cancellations to a visit be handled?Answer in development
  • Does a visit request also satisfy a host’s badge or installation-entry requirements?Starting resources · answer in development

Foreign travel & international work

Organize questions about travel, foreign visitors and international contracts.

Insider threat program

Connect program responsibilities, training, referrals and self-assessment.

  • How do the FSO and ITPSO divide insider threat responsibilities?Answer in development
  • What records support an insider threat program self-assessment?Answer in development
  • How should an insider threat referral be routed and documented?Answer in development
  • What should be included in insider threat awareness training?Answer in development

Security incidents & response

Find resources for loss, compromise, unsecured storage and system contamination.

  • What information should be preserved after a suspected security incident?Answer in development
  • How should an FSO coordinate a suspected classified spill?Answer in development
  • How do initial incident reports and follow-up reports differ?Answer in development
  • How should corrective actions after a security incident be documented?Answer in development

Records & continuity

Organize security files, responsibilities and handovers without storing records in this wiki.

  • What should an FSO handover package contain?Answer in development
  • How should security records be organized for an inspection?Answer in development
  • How do I establish retention periods for different security records?Answer in development
  • What should be reviewed when an alternate FSO takes over?Answer in development
  • How can a small security team track training, clearances, visits and open actions?Starting resources · answer in development

Starting as an FSO

Training, appointment, outside support and continuity for a new security officer.

07 / THE DESK

Official references & training

Start with applicable regulations and contract direction. Agency job aids and training explain practice; verify the edition and applicability of each resource.

DCSA NISP tools & resources

Job aids, DD 254 instructions, the self-inspection handbook and security-incident resources.

Browse DCSA resources

CDSE security toolkits

Find classification, CUI, personnel vetting and security education resources.

Browse training toolkits

NARA CUI Registry

CUI categories and links to their associated authorities and guidance.

Open the registry

DCSA DISS resources

Official job aids, industry continuous-vetting guidance and personnel-system resources.

Open DISS resources

DCSA adjudication FAQs

Official questions about eligibility, reciprocity, special access and adjudication.

Read the agency FAQs

Visitor requirements: a host example

DARPA’s published visitor instructions. Use the actual receiving host’s directions for each visit.

Read DARPA visitor guidance

About this desk

A starting point for your work.

Task shortcuts connect existing FSOtools guides with official resource directories. Answers are published only after maintainer acceptance; source verification is a separate step. Questions marked “Answer in development” have no published guidance yet.

Common questions were researched 2026-09-30. Public discussions help identify useful topics; replies are not copied or treated as authority. “Why this question?” records each discovery source and whether a page or search excerpt was reviewed.

Use your applicable contract, DD 254, current regulations and agency direction to resolve a specific situation. This public reference does not collect personnel records or case information. Search stays in your browser and is cleared on reload.

Resource navigation expanded October 1, 2026. That date does not renew the source review of an answer, form or linked tool.

Back to top ↑