How a company gets a facility clearance

A facility clearance (FCL) is an administrative determination that, from a security viewpoint, an entity is eligible for access to classified information of a certain level and all lower levels. The rule is 32 CFR part 117, the National Industrial Security Program Operating Manual (NISPOM). Two facts shape the process. A company cannot apply for its own clearance; a government customer or a cleared contractor must sponsor it. And under 32 CFR 117.9, neither the company nor its employees may access classified information until the cognizant security agency has made that determination.

The rule and who administers it

The NISPOM was first published in 1995 as Department of Defense (DoD) Manual 5220.22, according to the December 21, 2020 final rule that moved it into the Code of Federal Regulations. The rule took effect February 24, 2021. It states that once part 117 took effect, DoD would no longer publish the manual as a DoD policy issuance. Section 117.1 gives contractors until 6 months from February 24, 2021 to implement the rule.

Part 117 names five cognizant security agencies (CSAs): DoD, the Department of Energy, the Nuclear Regulatory Commission, the Office of the Director of National Intelligence, and the Department of Homeland Security. For DoD, section 117.6 makes the Defense Counterintelligence and Security Agency (DCSA) the cognizant security office, which oversees the program for DoD components and for non-DoD agencies that have agreements with DoD.

An FCL is not a storage approval. Section 117.9 treats eligibility for access as separate from approval to safeguard classified material at the company, and bars a contractor from using its FCL for advertising or promotional purposes.

Sponsorship and eligibility

Section 117.9(a)(10) is direct: a contractor or prospective contractor cannot apply for its own entity eligibility determination. A government contracting activity (GCA) or a currently cleared contractor may sponsor an entity at any point when it needs access to take part, including the solicitation or competition phase. A prime contractor needs an FCL even when all access will be limited to its subcontractors, at the same or a higher level.

Section 117.9(c) sets the eligibility tests. The entity must need access in connection with a legitimate U.S. Government or foreign government requirement, be organized under U.S. law and located in the United States, have a record of integrity and lawful conduct, and not be under foreign ownership, control, or influence (FOCI) to a degree inconsistent with the national interest.

The GCA supplies the security guidance. Under section 117.13, it goes in the contract security classification specification, which the 2020 rule identifies for DoD as the DD Form 254. The Federal Acquisition Regulation (FAR) clause 52.204-2, Security Requirements, in its March 2021 text, requires the contractor to comply with the DD Form 441 security agreement, including part 117. The 2020 rule describes the DD Form 441 as an agreement between DCSA and the cleared entity to comply with the NISPOM and to be subject to inspections.

Key management personnel

Part 117 defines key management personnel (KMP) as the senior management official (SMO), the facility security officer (FSO), the insider threat program senior official (ITPSO), and all other officials who hold majority interest or stock, or who have direct or indirect authority over the entity's management, operations, or classified contract performance.

At a minimum, section 117.9(d)(1) requires the entity to identify the SMO, appoint U.S. citizen employees as the FSO and the ITPSO, and submit personnel security investigation requests for the SMO, FSO, ITPSO, and any other KMP the CSA names. Some officials can be formally excluded from access, but the FSO and ITPSO may not be temporarily excluded. Once granted, an FCL stays in effect until it is terminated or revoked.

Foreign ownership, control, or influence

Under section 117.11, a U.S. entity is under FOCI when a foreign interest has the power, direct or indirect, to decide matters affecting its management or operations in a way that could result in unauthorized access to classified information or adversely affect a classified contract. Every entity completes Standard Form (SF) 328, the Certificate Pertaining to Foreign Interests, during processing; GSA lists the current revision as 07/2026. Section 117.11(b) weighs factors in the aggregate, including any record of espionage against U.S. targets, the type and sensitivity of the information the entity would access, and the source, nature, and extent of FOCI.

An entity found to be under FOCI while in process is ineligible until mitigation measures satisfy the CSA. The rule lists a board resolution, a security control agreement, a special security agreement, and a voting trust or proxy agreement, which vests the foreign-owned stock's voting rights in cleared U.S. citizens.

DCSA's stated steps

A June 2022 DCSA briefing, "Roadmap to Getting a Facility Clearance", lays out the sequence. The sponsor submits the request in the National Industrial Security System (NISS), and DCSA's Facility Clearance Branch checks for a bona fide need for access. The roadmap starts a clock on day one, sets day 20 as the deadline to upload the initial FCL package in NISS, and sets day 45 as the deadline to submit the KMP personnel clearance package. Before an FCL is issued, KMP clearances must be adjudicated, DCSA must complete an internal vetting assessment and any FOCI mitigation, and the company must hold an orientation meeting with a DCSA industrial security representative. The briefing says the government funds FCL and personnel clearance processing. The briefing cites the older manual numbering, such as NISPOM 2-102, although part 117 took effect in February 2021.

What to check

• Who is the sponsor, a GCA or a cleared contractor, and is there a bona fide need for access on the contract or solicitation?
• Does the classified contract come with a DD Form 254, and if not, was the GCA notified as section 117.13 requires?
• Are the SMO, FSO, and ITPSO identified, and are the FSO and ITPSO U.S. citizen employees?
• Has the company completed an SF 328, and does any foreign interest have power over its management or operations?
• Does company advertising or promotion use its FCL, which section 117.9(a)(9) bars?
• Does a guide cite part 117 sections or the older DoD Manual 5220.22 paragraphs?

Sources

1. 132 CFR Part 117 - National Industrial Security Program Operating Manual (NISPOM) · Electronic Code of Federal Regulations (up to date as of October 20, 2026)
2. 232 CFR 117.9 - Entity eligibility determination for access to classified information · Electronic Code of Federal Regulations
3. 3National Industrial Security Program Operating Manual (NISPOM); Final Rule · Department of Defense, Federal Register, 85 FR 83300 (December 21, 2020)
4. 4Roadmap to Getting a Facility Clearance/FCL Sponsorship · Defense Counterintelligence and Security Agency briefing (June 2022), hosted by the Office of Naval Research
5. 552.204-2 Security Requirements · Acquisition.gov (clause dated March 2021)
6. 6Certificate Pertaining to Foreign Interests (SF 328) · U.S. General Services Administration forms library (current revision 07/2026)

Where this shows up in our work

• LEDGER, auditable Army acquisition decisions turns a trade study into a package where every number cites its source and AI drafts but never decides.
• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.