Facility Security Clearances for Software Companies: How an FCL Works

#saas#federal-market

By — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.

Most software companies sell to the government without ever touching classified information. Some, especially those selling into the Department of War (DoW) and the intelligence community, reach a point where a prime or an agency says the next contract requires a facility clearance. That request often arrives late in a pursuit, and it cannot be met quickly.

This guide covers what a facility clearance is, how a company gets one, who inside the company has to be cleared, how foreign ownership is handled and what changes once the clearance is granted. The rules cited here are from FAR Subpart 4.4, Safeguarding Classified Information Within Industry, the FAR 52.204-2 Security Requirements clause and the National Industrial Security Program Operating Manual (NISPOM) at 32 CFR Part 117.

What a facility clearance is

A facility clearance (FCL) is an administrative determination that a company is eligible for access to classified information at a stated level: Confidential, Secret or Top Secret. The NISPOM calls it an entity eligibility determination. It attaches to a legal entity at a location, which is why the paperwork asks for the company’s CAGE code.

The program behind it is the National Industrial Security Program (NISP), established by Executive Order 12829. FAR 4.402 points contracting officers to the NISPOM for the requirements that apply to contractors, and FAR 52.204-2 goes into contracts that may require access to classified information. For the Department of War and the many agencies that rely on its industrial security services, the clearance is processed and overseen by the Defense Counterintelligence and Security Agency (DCSA).

A facility clearance is not the same as permission to store classified material at your office. A company can hold an FCL and do all of its classified work at a government or prime contractor site. Safeguarding classified material on your own premises is a separate approval with its own physical and information system requirements.

You cannot apply for one yourself

The single most important rule: a company cannot request its own facility clearance. Under 32 CFR 117.9, processing starts only when the company is sponsored by a government contracting activity or by a cleared contractor that needs it for a classified contract or a classified bid. The sponsor has to show a bona fide classified procurement need.

For a software company, the sponsor is usually one of two parties:

  • An agency that intends to award you a contract requiring classified access.
  • A cleared prime that wants you as a subcontractor on classified work. This is the more common route for smaller companies, and it is one reason teaming and subcontracting relationships matter so much in defense work.

The NISPOM also sets basic eligibility conditions. The company must be organized and existing under the laws of the United States and located in the United States or its territories, must have a reputation for integrity and lawful conduct in its business dealings, and must not be under foreign ownership, control or influence to a degree that granting the clearance would be inconsistent with the national interest.

Key management personnel

A facility clearance depends on the people who run the company. The NISPOM requires the senior management official, the facility security officer (FSO) and the insider threat program senior official to be cleared at the level of the facility clearance. Other key management personnel, such as officers and board members, either are cleared or are formally excluded from access to classified information, with the exclusion recorded by the company.

In practice this means:

  • Name an FSO early. The FSO runs the security program, maintains records, handles reporting and is DCSA’s day-to-day contact. In a small company the role is often part time, but it has to be filled by a U.S. citizen employee who completes the required training.
  • Expect leadership to go through investigations. The executives who must be cleared are processed for personnel clearances as part of the facility clearance.
  • Structure matters. Parent companies, holding companies and investors can bring their own requirements into the review.

The facility clearance comes first. Employees can be processed for personnel clearances only through a cleared company with a need for them to have access, which is why a company without an FCL cannot simply hire its way into classified work.

Foreign ownership, control or influence

Every company processed for a facility clearance completes Standard Form 328, Certificate Pertaining to Foreign Interests. It asks about foreign ownership, foreign debt, income from foreign sources, foreign board members and similar ties. For venture-backed software companies with international investors or customers, this is often the step that takes the longest.

Foreign interests do not automatically disqualify a company. When DCSA finds the company is under foreign ownership, control or influence (FOCI), it can be mitigated with an agreed instrument. The NISPOM describes several, ranging in strength from a board resolution, through a security control agreement and a special security agreement, to a proxy or voting trust agreement. The stronger instruments limit what foreign owners can see and control. Some, such as a special security agreement used for access to proscribed information, can also require a separate national interest determination by the government.

The practical point: review your cap table, investor rights and board composition before a sponsor asks. Changes after the clearance is granted have to be reported.

The DD Form 254

The DD Form 254, Contract Security Classification Specification, tells the contractor what classified access a specific contract requires: the level, the types of information, where the work is performed and which security requirements apply. An agency issues it to the prime; the prime issues its own DD Form 254 to each cleared subcontractor.

Read it as part of the contract. It decides whether you need safeguarding at your own facility, whether your systems will process classified information and which reporting and marking requirements flow down to you.

Not the same as CUI and CMMC

Software companies often conflate these. Controlled Unclassified Information is, as the name says, unclassified. Protecting it is a matter of contract clauses such as DFARS 252.204-7012, the controls in NIST SP 800-171 and CMMC certification. None of that is administered through the NISP or results in a facility clearance.

The reverse is also true. Holding a facility clearance does not satisfy a CMMC requirement on an unclassified contract. Many defense software companies need both programs, run by different people under different rules. Compliance claims in either program are only as good as the evidence behind them; a self-attested posture is not a verified one.

Once the clearance is granted

A facility clearance is an ongoing obligation, not a one-time approval. Under the NISPOM, a cleared company is expected to:

  • Run an insider threat program led by its insider threat program senior official.
  • Train cleared employees at initial briefing and on a recurring basis.
  • Report changed conditions, such as changes in ownership, key management personnel or the company’s name or address, along with adverse information about cleared employees and suspicious contacts.
  • Self-inspect its security program, with the senior management official certifying the self-inspection annually, and take part in DCSA security reviews.

A clearance can be invalidated or terminated if the company stops meeting the requirements or no longer has a classified need.

What this means for a software company

  • Do not start the clearance before the contract need exists. Without a sponsor there is no process. Put effort instead into the relationships, usually with cleared primes, that create a sponsored opportunity.
  • Prepare the inputs anyway. Clean corporate records, a current SAM.gov registration and CAGE code, a named FSO candidate and a clear picture of foreign ownership are what slow most companies down.
  • Plan for time. Processing depends on the company’s structure, FOCI and how quickly executives complete their investigations. Ask your sponsor and DCSA for current expectations rather than relying on a rule of thumb.
  • Keep CUI work separate in your planning. A CMMC program for unclassified contracts and a NISP program for classified contracts answer different questions.
  • Read the current rule text. The FAR is being rewritten under the Revolutionary FAR Overhaul, and the NISPOM has been revised before. Confirm the provisions your sponsor and contracting officer apply.

Where this fits

A facility clearance is the gate to classified federal work, and for a software company it is opened by someone else: an agency or a cleared prime that needs you on a classified contract. The work you can do in advance is getting the company ready to be sponsored, with leadership, ownership and security roles that will hold up in review.

Score your company’s federal readiness to see how your registration and compliance profile look next to the other categories federal buyers review.

Frequently Asked Questions

Can a software company apply for a facility clearance on its own?

No. Under the National Industrial Security Program Operating Manual, 32 CFR Part 117, a company is processed for a facility clearance only when it is sponsored by a government contracting activity or by a cleared contractor that needs it to perform on a classified contract or a classified bid. Without a sponsor and a bona fide classified requirement, there is nothing to process.

Is a facility clearance the same as CMMC or handling CUI?

No. Controlled Unclassified Information is unclassified, and protecting it is governed by contract clauses such as DFARS 252.204-7012, NIST SP 800-171 and CMMC. A facility clearance is an eligibility determination for access to classified information under the National Industrial Security Program. A company can need one, both or neither, and meeting one regime does not satisfy the other.

Who in the company has to be personally cleared?

The senior management official, the facility security officer and the insider threat program senior official must hold personnel clearances at the level of the facility clearance. Other key management personnel either are cleared or are formally excluded from access to classified information, depending on their role.

The CMMC brief

What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.

The brief is not open for requests yet. Email us and we will send it the moment it is.