Facility Security Clearance (FCL)

A Facility Security Clearance (FCL) is a determination by the Defense Counterintelligence and Security Agency (DCSA) that a contractor organization and its key management personnel are eligible to access classified information and to possess classified material in the performance of a classified contract.

What is a Facility Security Clearance?

The FCL is the organizational-level counterpart to an individual's Personnel Security Clearance (PCL). While a PCL determines that a specific individual is trustworthy to access classified information, the FCL determines that the contractor company itself has the organizational integrity, management accountability, and physical security infrastructure necessary to safeguard classified information entrusted to it.

FCLs are granted at specific classification levels - Confidential, Secret, or Top Secret - corresponding to the highest level of classified information the company will need to access. The FCL level is driven by the classified contract requirements rather than by the company's choice. A company can hold an FCL at multiple facilities if it operates from multiple locations, with each location receiving its own FCL determination based on that location's classified work requirements.

Key requirements for obtaining an FCL include: Key Management Personnel (KMP) - senior officials who can influence the company's operations and who must individually qualify for clearance eligibility; a Facility Security Officer (FSO) trained and certified to manage the company's security program; adequate physical security at the facility (typically including a locked storage area or secure room for classified materials, and a SCIF for Top Secret/SCI work); and information security systems meeting applicable requirements. DCSA inspects cleared contractor facilities at regular intervals (typically every one to four years depending on FCL level and risk profile) to verify ongoing compliance with the National Industrial Security Program Operating Manual (NISPOM).

Why FCL matters for government contractors

The FCL is the organizational credential that determines whether a company can compete for and perform classified contracts. Without an FCL, a company cannot receive a DD Form 254, cannot access classified government data rooms, cannot employ cleared personnel in classified roles, and cannot bid on most classified contract opportunities. Building FCL readiness - KMP eligibility, FSO training, physical security infrastructure - is a meaningful investment that must be planned strategically, not initiated the week a classified contract opportunity appears.

Example

A defense technology startup with 40 employees wins a DoD SBIR Phase II contract that involves classified design specifications for a sensor system. The prime contractor requires the startup to hold a Secret-level FCL. The startup identifies a cleared FSO from a prior employer and hires her as its security director. The CEO and CTO (as KMPs) submit security questionnaires to DCSA. The company installs a GSA-approved security container for classified document storage and prepares its physical security documentation. DCSA processes the FCL application and conducts an initial facility inspection. Six months after application submission, the company receives its Secret FCL and begins receiving classified technical data packages from the government.

Frequently Asked Questions

How long does it take to get an FCL?

FCL processing timelines vary based on DCSA workload and the complexity of the company's organizational structure (particularly for foreign ownership, control, or influence (FOCI) issues). Secret FCLs typically process in four to eight months. Top Secret FCLs may take eight to eighteen months or longer. Companies should begin the FCL process as early as possible in a classified program's development - ideally before proposal submission if the requirement is known.

What is a Foreign Ownership, Control, or Influence (FOCI) issue?

FOCI is a significant complication in FCL processing. If a foreign person or entity owns, controls, or has the ability to influence the management decisions of a US contractor, DCSA must assess whether that foreign interest poses a security risk. FOCI mitigation measures range from a board resolution limiting foreign influence to a Special Security Agreement (SSA) with Government Security Committee oversight for companies with significant foreign ownership. FOCI issues substantially lengthen FCL processing time.

Who is the Facility Security Officer and what do they do?

The Facility Security Officer (FSO) is the company official responsible for managing the contractor's industrial security program and serving as the primary interface with DCSA. The FSO conducts employee briefings and debriefings, manages classified document control, reports security violations, prepares for and participates in DCSA inspections, and maintains the company's security program documentation. DCSA provides FSO training resources, and many companies hire experienced FSOs from prior government or contractor security roles.

Can a company have an FCL without any current classified contracts?

Yes, though this situation is unusual. A company may maintain an FCL between classified contracts to preserve cleared personnel and organizational readiness. However, DCSA may inquire about the basis for maintaining an FCL without an active need, and the administrative overhead of maintaining the FCL compliance program without associated revenue may make it impractical for smaller companies to maintain an FCL during extended gaps between classified contracts.