Facility clearance (FCL) basics: sponsorship, levels and the DD Form 254
What a facility security clearance is, why you need a sponsor, what DCSA evaluates under 32 CFR Part 117 (NISPOM), how the DD Form 254 sets security requirements, and what primes check.
- Reading time
- 4 min read
- Last reviewed
- Sources
- 3 official sources
On this page
A facility security clearance (FCL) is an administrative determination that a company is eligible, from a national security standpoint, for access to classified information at a given level: Confidential, Secret or Top Secret. For most contractors the clearance is granted by the Defense Counterintelligence and Security Agency (DCSA), which administers the National Industrial Security Program (NISP) for DoD and many other agencies. The rules contractors follow are the NISP Operating Manual, codified at 32 CFR Part 117 and usually called the NISPOM.
You cannot apply on your own
The single most misunderstood rule: a company cannot request its own FCL. It must be sponsored by a Government contracting activity or by a cleared contractor (typically a prime) that needs the company to have access to classified information for a specific contract, subcontract or pre-contract activity. Sponsorship is how the system ensures clearances exist only where there is a real need.
That makes teaming the most common path to a first FCL: a cleared prime with a classified requirement sponsors a capable subcontractor. If you want classified work, build relationships with primes that have it, and be ready to move quickly when they sponsor you.
What DCSA evaluates
To be eligible, a company must, among other things:
- Be organized and existing under the laws of the United States and located in the United States or its territories
- Have key management personnel cleared in connection with the FCL, including the senior management official, the facility security officer (FSO) and the insider threat program senior official
- Have no unmitigated foreign ownership, control or influence (FOCI). FOCI is not disqualifying by itself, but it must be identified and mitigated under 32 CFR 117.11
- Meet the security program requirements of 32 CFR Part 117, including an insider threat program, training and reporting
Processing time varies with the company's complexity and the investigations its key personnel need, so start early and keep the paperwork complete.
Levels, and what the levels do not include
| Term | What it means |
|---|---|
| Confidential, Secret, Top Secret | The three FCL levels. The FCL must be at least as high as the access the contract requires. |
| Safeguarding (storage) | A separate approval to store classified material at your facility. Many cleared companies hold an FCL without approved storage. |
| SCI and SAP access | Sensitive Compartmented Information and Special Access Program access are separate determinations made by the responsible agency, on top of the FCL. "TS/SCI" in a requirement means a Top Secret FCL plus SCI access approvals. |
| Personnel clearance (PCL) | An individual's eligibility for access. Contractor employees' access under the NISP depends on their employer holding an FCL at the right level. |
The DD Form 254
Classified contracts include the DD Form 254, Contract Security Classification Specification. It tells the contractor the classification level of the information involved, whether safeguarding is required, and the specific security requirements of the contract. The security requirements clause at FAR 52.204-2 ties those obligations into the contract. When a prime issues a classified subcontract, it prepares a DD Form 254 for the subcontractor, so the prime's security team becomes a key partner in your onboarding.
Watch out: A DD Form 254 can contain sensitive program details. Treat it as controlled: never upload it to general-purpose tools, and never post it to TeamingIndex, which does not accept DD Form 254 attachments or any other security documentation.
Keeping an FCL
An FCL is a continuing obligation, not a one-time approval. Under 32 CFR Part 117 a cleared company maintains an insider threat program, conducts self-inspections, trains its cleared employees, reports changed conditions (such as ownership or key management changes) and adverse information, and participates in DCSA security reviews. Losing track of these obligations can put the clearance at risk.
Checklist for primes evaluating a cleared partner
Checklist: tick items as you go (saved in this browser only)
Common pitfalls
- "We're cleared" when only people are. Individual clearances do not give a company an FCL. Ask which one the partner means.
- Sponsoring too late. If a subcontractor needs an FCL to perform, the sponsorship lead time belongs in the capture plan, not after award.
- Confusing FCL and safeguarding. A Secret FCL without storage approval cannot hold Secret material on site.
- Ignoring FOCI. New foreign investment can trigger reporting and mitigation obligations that affect an existing clearance.
How TeamingIndex helps
- Filter for partners by minimum clearance: Secret or higher, Top Secret or higher, or partners with an accredited SCIF (SCIF on site).
- FCL badges show who vouches for them: self-attested, or verified by TeamingIndex, with the review date.
- TeamingIndex stores clearance metadata only. For the related export-control rules that often apply to the same programs, see ITAR and EAR basics.
Not legal advice. TeamingIndex guides are general information to help you plan, not legal advice. Regulations, clauses and program rules change and solicitations can tailor them: always work from the current regulation and the clauses in your solicitation, and confirm decisions with your contracting officer or counsel.
Official sources
Primary regulations and program pages this guide was checked against on . Read them for the authoritative text.