ISOO Joint Notice 2024-1.pdf

ISOO Joint Notice 2024-01: Joint Ventures and Entity Eligibility Determinations

October 5, 2023

Authorities

1. Executive Order 13526, Classified National Security Information.

2. 32 CFR 2004, National Industrial Security Program (NISP) Directive.

3. 32 CFR 117, National Industrial Security Program Operating Manual (NISPOM).

4. 13 CFR 121.103(h), Affiliation based on joint ventures (13 CFR 121 is the SBA’s Small Business Size Regulation).

Purpose

5. This Joint Notice provides guidance on entity eligibility determinations (EEDs; also, sometimes called facility security clearances (FCLs)) for joint ventures (JVs) in the National Industrial Security Program (NISP). The need for clarification arose in light of the recent Small Business Administration (SBA) rule (Oct. 16, 2020), which addresses JVs under the SBA’s programs, and a subsequent Government Accountability Office (GAO) decision (Aug. 27, 2021) that interpreted the SBA rule without addressing NISP requirements and 32 CFR 2004 or how the two interconnect, thus adding to the confusion. ISOO has received requests for clarification from several agencies. This notice provides agencies with guidance clarifying how the SBA regulations interact with NISP requirements.

JVs under the NISP

6. Under the NISP’s regulations at 32 CFR 2004, any legal entity that will access classified information pursuant to a legitimate government requirement (e.g., contract or similar agreement) must undergo an EED.1 This includes JVs that are legal entities and have been awarded a contract or agreement that requires access to classified information to perform on the contract.

7. In general, when a JV (treated as a parent entity for NISP purposes) is awarded a classified contract covered by the NISP, the JV and any partners to the JV (treated as sub-entities of the JV, for NISP purposes), must hold EEDs in order to access the information. However, if the JV is established by contract (not a separate legal entity), is unpopulated (no employees of the joint venture itself will be performing work connected with classified information), or other similar situations, and thus will not be involved with or otherwise influencing performance on

1 Throughout this notice, the phrases “undergo an EED” or “hold an EED” reflect the requirement for entities to go through the eligibility determination process and be cleared before performing on a classified contract; they do not indicate that the entity must already have an EED before they bid on a classified contract.

the security work/accessing the classified information, the JV will generally not have to hold a separate EED itself, though the partners to the JV must then hold EEDs.

8. A NISP Cognizant Security Agency (CSA) will assess the business structure of the joint venture and sub-entities awarded (or being considered for) the classified contract to determine which of them will need to have an EED. In part, this assessment will depend on which entity(ies) within the JV structure will be performing on or influencing the contract and the relationship between the entities and the classified information. The NISP regulation at 32 CFR 2004.32(a)(1) states:

“The responsible CSA determines whether an entity is eligible for access to classified information. An entity may not have access to classified information until the responsible CSA determines that it meets all the requirements in this section. In general, the entity [including a JV] must be eligible to access classified information at the appropriate level before the CSA may consider any of the entity’s subsidiaries, sub-contractors, or other sub-entities [including JV partner entities] for eligibility. However, when the subsidiary will perform all classified work, the CSA may instead exclude the parent entity [including a JV] from access to classified information rather than determining its eligibility. In either case, the CSA must consider all information relevant to assessing whether the entity’s access poses an unacceptable risk to national security interests.”

9. Under the NISP, an entity must be legally organized and existing in the U.S. to be eligible for an EED. A JV may have administrative staff that do not perform on the classified contract. However, NISP security officials (such as the Facility Security Officer (FSO) and Senior Management Official) must be employees of the entity that holds the EED.

10. A JV formed as a separate legal entity may be awarded a classified contract and may hold an EED in its own right, although as with any U.S. legal entity, it is not required to hold an EED in order to be awarded the classified contract. The EED can be processed after contract award if the JV must have an EED to perform on the classified contract. Additionally, as noted in footnote 1, a prime JV offeror cannot be required to already hold an EED in order to submit an offer on a classified contract.

a. If the JV holds an EED in its own right, it may be populated and its employees can perform on the classified contract (which includes influencing performance of the security work). It may also be unpopulated (i.e., has no employees that perform on the classified contract, though it may have administrative employees). However, if the JV holds an EED and does not perform on the classified contract, then the partner(s)/sub-entity(ies) that will perform on the classified contract must hold an EED as well. In either case, the NISP security officials can be employees of the JV itself because it holds an EED.

b. If the JV does not hold an EED in its own right, its employees cannot perform on the classified contract and NISP security officials cannot be employees of the JV. In such a case, the subordinate legal entity or entities that perform(s) on the classified contract must have the required EED and the NISP security officials must be employees of the subordinate entity or entities with the EED, rather than of the JV.

11. A JV formed ‘by contract’ in which the JV is not a separate legal entity cannot be awarded a classified contract in its own right and cannot hold an EED. Instead, the legal entity or entities that make up the JV are awarded the classified contract directly and must hold the necessary EED, have the employees who will perform on the classified contract, and also employ the NISP security officials. The JV itself must be unpopulated (in terms of employees that perform on the classified contract), but may have administrative employees.

JVs under SBA regulations at 13 CFR 121.103(h)

12. In 13 CFR 121.103(h), the SBA allows a JV between a non-eligible partner (a large business mentor or another small business that does not possess the required socio-economic status to qualify for the SBA program) and an eligible small business partner in order to assist in the business development of the lead small business partner. SBA assumes that the lead small business partner lacks the necessary capacity to perform on the contract on its own and enters the JV arrangement in order to gain expertise that will assist it to be able to perform on similar contracts on its own in the future. SBA requires, however, that the lead small business partner perform meaningful work relating to the primary and vital requirements of the contract.

13. As a result, the type of JV covered by the SBA regulations at 13 CFR 121.103(h) expressly cannot hire individuals to perform on a contract awarded to the JV (it cannot be “populated”). Instead, the work must be performed by employees of the partners to the JV.

Prohibiting the JV from being populated enables the SBA to track each sub-entity’s work and ensures that some benefit flows back to the small business partner.

14. With this specific type of JV in mind, the SBA rule states that a JV under 13 CFR 121 may be awarded a contract involving access to classified information when either the JV itself or the JV’s individual subordinate partner(s) that will perform the necessary security work has/have the required EED. The rule also states that the JV does not have to hold an EED if the partner entity/entities that will access classified information have one, because the JV itself will not be performing the work involving the classified information (also called “security work”).

The SBA rule and the NISP

15. The NISP contemplates that any entity that will access or exercise influence and control over classified information under a contract (or equivalent) must undergo an EED. The SBA rule does not materially change the requirements under the NISP regarding which entities must undergo EEDs.

16. In the type of JV covered by the SBA rule, the SBA does not permit the JV itself to perform work requiring access to classified information, nor does it permit the JV to have employees that perform such work. The SBA rule’s statement that a JV formed pursuant to this rule is not required to hold an EED is thus generally in alignment with the NISP because the rule envisions that the JV itself will not be accessing or otherwise influencing the classified information or performance on the classified contract.

17. As envisioned by the SBA, all work involving classified information under the SBA programs covered by 13 CFR 121.103 will be performed by one or both of the individual partners to the JV and by their employees, not by the JV entity itself. Under the NISP, a NISP CSA will assess the business structure of the legal entity awarded the classified contract to determine the entity’s eligibility for an EED or an appropriate exclusion from classified information under NISP rules at 32 CFR 2004.32(a)(1). The SBA rule does not change this.

However, if the legal entity awarded the classified contract is an unpopulated JV formed pursuant to this SBA regulation, the NISP CSA will exclude the JV from access to classified information (rather than determining its eligibility for access) unless the JV’s structure or potential influence, access, or control over the classified information/contract indicates it must also have an EED.2 Although the SBA rule suggests that the JV can include NISP security officials as administrative employees of the JV itself, this is only the case under NISP rules if the JV is formed as a legal entity and holds an EED.

18. Under the SBA rule, when security work is the primary purpose of the procurement, the lead small business partner must possess the required EED because it must perform meaningful work relating to the security aspects of the classified contract.

(a) This does not mean, however, that only the lead small business partner must possess the required EED. Each partner that will perform any security work must possess the required EED.

(b) Where access to classified information is an ancillary function of the classified contract, either partner may perform the security work under the SBA regulation.

The lead partner to the JV need not possess the required EED provided that all security work will be performed by the non-lead partner to the JV. However, if any security work is to be done by the lead partner to the JV, the lead partner must possess the required EED. Where both partners to the JV will perform some security work, both partners must individually possess the required EED.

(c) The SBA rule does not contemplate any entity without the required clearance performing work for which they must hold an EED under NISP requirements.

Although the NISP does not make a determination as to whether an entity needs to have an EED based on whether security work is the primary or an ancillary purpose of the classified contract, SBA’s requirements in this regard do not conflict with the NISP framework because they are rooted in the question of which legal entity has a legitimate requirement to access classified information, which is the NISP baseline.

19. The responsible NISP CSA determines in each case whether an entity needs an EED and considers all relevant information in making that determination. As a result, it is not appropriate to assert that JVs under SBA’s programs covered by 13 CFR 121.103(h) will never need to hold

2 If, for example, the JV has its own employees to perform administrative functions unrelated to contract performance on the classified contract but those employees have, or will have, access to the classified information, the NISP CSA may determine that the JV must undergo an EED.

an EED. The responsible CSA (or designated Cognizant Security Office) assesses the business structure and governance documents of the legal entity that has the contract award for a JV covered by 13 CFR 121.103 on a case-by-case basis, as they do in other cases.

This joint notice has been coordinated with DoD. Please direct any questi ns regarding this ISOO "Joint Notice to: isoo@nara.gov.

WILLIAM P. FISCHER

Acting Director Information Security Oversight Office