FCL_Orientation_Handbook_10OCT18.pdf

Defense Security Service Industrial Security Field Operations

FCL Orientation Handbook

October 2018

Defense Security Service FCL Orientation Handbook

Page | 2 Return to Contents

Contents

Welcome Message

1.0 Overview of the National Industrial Security Program (NISP)

2.0 FSO Responsibilities and Deadlines in the FCL Process

3.0 FCL Roadmap

4.0 Telephonic and FCL Orientation Meeting Preparation

4.1 Telephonic Survey

4.2 FCL Initial Orientation Meeting

5.0 Business Structure and Excluded Tier Entities

5.1 Business Structure Required Documents

5.2 Required Forms

6.0 Specific Business Structure Guidance

6.1 Corporation:

6.2 LLC:

6.3 Partnership:

6.4 Educational Institute:

6.5 Sole Proprietorship:

6.6 Branch Or Division Office:

6.7 Joint Venture:

7.0 Excluded Tier Entity Process

7.1 Excluded Tier Entity Requirements

7.2 Entity Roles and Responsibilities

8.0 Highest Cleared Tier Entity

8.1 Process Flow

8.2 Entity Roles and Responsibilities

9.0 Accounts and Systems

10.0 Training

10.1 FSO Training

10.2 Insider Threat Program Training

Appendix A: Defining KMP Authorities of Position

Appendix B: Exclusion Resolutions

B.1 Highest Cleared Entity Noting Excluded Entity’s Exclusion and Resolution to Exclude Parent Organization

B.2 Exclusion Resolution of Corporate Organization

B.3 Exclusion Resolution for LLC Member (Organization)

B.4 Exclusion Resolution for Certain Directors, Officers, and LLC Member (if Person)

Page | 3

Welcome Message

On behalf of the Defense Security Service (DSS), welcome to the first step in the Facility Clearance (FCL) process. We recently received a request from a Government Contracting Activity (GCA) or cleared contractor to sponsor your facility for a FCL under the National Industrial Security Program (NISP) for performance on a classified government contract.

DSS is delegated security administration responsibilities and is the Cognizant Security Office (CSO) on behalf of the Department of Defense (DoD). As the CSO, DSS will advise and assist your facility during the FCL process and while you are under our cognizance in the NISP. The requirements, restrictions, and other safeguards that cleared companies must put in place are outlined in the National Industrial Security Program Operating Manual, referred to as the NISPOM. The NISPOM can be located on the DSS website, at www.dss.mil in the most requested links section. You are encouraged to review the chapters that are applicable to your security program at this time in order to understand the requirements of the agreement you are about to enter into. The NISPOM defines a Facility Clearance as an administrative determination that, from a national security standpoint, a company is eligible for access to classified information at the same or lower classification level as the clearance being granted.

In order to obtain a Facility Clearance, a company must meet the eligibility requirements listed in the NISPOM 2-102, and meet personnel security clearance requirements for certain Key Management Personnel, or KMPs, also discussed in NISPOM chapter 2, section 1. It is important to understand that in order to be eligible for a Facility Clearance, an organization’s employees must need access to information that is classified at the Facility Clearance level requested. A requirement to have background investigations to meet position or contract requirements or for access to a physical spaces is not the same as a requirement to access classified information and does not meet the eligibility requirement for a Facility Clearance. Please ensure you understand this requirement and how your company meets it as verification of this will be a point of emphasis throughout the Facility Clearance process.

The below chart represents the first 45 days of the FCL process as well as the follow up after your FCL is issued. Day 1 of this process starts when you receive the Welcome Email identifying specific deadlines for your company and guiding you to register for an account with the National Industrial Security System

(NISS).

FCL Roadmap FCL Orientation

Handbook Day 1- Day 5

Telephonic Survey

Day 5 – Day 10

Complete Document Upload

Day 10 – Day 20

FCL Initial Review Day 20 - 45

Post FCL Outreach First Year Under NISP

DSS to provide FSOs an educational, user friendly, and informative guide to navigate the FCL process.

FCB personnel to guide FSOs through FCL process, NISS system, explain Deadlines, and help identify documents and forms required per company’s business structure

FSOs to upload all documents and forms per its company’s Business structure into NISS

ISRs to review company’s FCL package and prepare for Initial FCL Orientation meeting FSOs to submit KMP e-QIPs and fingerprints and prepare for meeting

DSS reaches out to facilities residing in NISP under a year to determine compliance with NISPOM implementation of a facility security program, and assess the facility’s potential risk to National Security.

http://www.dss.mil/

Page | 4

1.0 Overview of the National Industrial Security Program (NISP)

The NISP was established by Executive Order 12829, as amended, in January of 1993 for the protection of classified information. The NISP applies to all executive branch departments and agencies, and to all cleared contractor facilities located within the United States, its territories and possessions.

Participation is voluntary, but access to classified information will not be permitted otherwise. When your facility receives its FCL, it will be subject to provisions of the NISPOM. You will find a link for downloading the NISPOM at the DSS web site (http://www.dss.mil) under the Industrial Security tab.

You are expected to review and become familiar with the NISPOM. The FCL Orientation Handbook is not intended to replace the NISPOM.

The classification levels in the NISP are CONFIDENTIAL, SECRET, and TOP SECRET. The FCL level your facility receives is based upon the classified contract you have been awarded and its requirements. DSS may be able to issue an interim FCL prior to issuance of the final FCL. In order to be issued an interim FCL, DSS must first validate that there is no unmitigated foreign ownership, control, or influence (FOCI), KMPs have personnel clearances at the interim level or higher, and the initial orientation meeting has been completed.

A final FCL cannot be issued until required KMP are cleared at the final level of the requested FCL, there are no open changed conditions that would impact the FCL, and the initial orientation meeting has been completed.

If your company has other companies in its legal structure, such as parent or member companies, a decision will be made to either clear or exclude them. The assigned DSS Industrial Security Representative (ISR) will decide course of action during their review of the documentation in NISS.

Please note: Facilities where KMP do not already possess the level of personnel security clearance required for the FCL may significantly impact the amount of time it takes to issue an FCL since KMP required to be cleared in connection with the FCL will have to go through the investigation and clearance adjudication process.

A facility where Foreign Ownership, Control, or Influence (FOCI) is present will also take a longer time to clear because these facilities must undergo satisfactory FOCI mitigation.

http://www.dss.mil/

Page | 5

2.0 FSO Responsibilities and Deadlines in the FCL Process

Over the course of the next 45 days it is your responsibility to identify your company’s business structure and provide required documentation and forms. To make this process transparent, the FCL Orientation Handbook provides a roadmap to guide you along the FCL process. In addition to the FCL Orientation Handbook, a DSS Industrial Security Representative will contact you shortly to assist in obtaining your facility’s FCL.

There are three deadlines during the FCL process:

1. Required legal documentation and DSS forms must be submitted in NISS within 20 days of receiving the Welcome E-mail (Day 1)

2. KMP Electronic Questionnaire for Investigations Processing (e-QIPs) must be submitted within 45 days of receiving the Welcome E-mail (Day 1)

3. KMP fingerprints should be submitted at the same time as the e-QIP submission or within 14 days after submitting KMP e-QIPs

Essential KMP(s) who do not have personnel security clearance eligibility, have not held a personnel security clearance in more than 24 months, or whose background investigations are out of scope will need to complete a Standard Form 86 (SF 86) and submit electronic fingerprints. You will not have access to e‐QIP until you receive instructions to do so. However, it is strongly encouraged that you obtain a copy of the SF 86 and begin to gather the data that will need to be entered in e‐QIP. Please note that the PDF or paper version of the SF 86 cannot be submitted. You must enter this information in e‐QIP. However, the questions are the same and the PDF version can be used to assist you in gathering the necessary data.

Electronic fingerprints must be submitted to the Office of Personnel Management, or OPM, via the Secure Web Fingerprint Transmission (SWFT). There are numerous methods for submitting electronic fingerprints. Most companies that are new to the NISP either receive assistance with this from their prime contractor or another cleared company or they use the services of a third party service provider.

A list of third party service providers can be found on DMDC’s website. Please note that the locations listed are headquarters offices and do not indicate this is the only area the provider serves. Many providers have nationwide locations or provide fingerprint card conversion services, in which a hard copy fingerprint card can be mailed to them for conversion to the proper electronic format and uploading to SWFT. Whatever method you use, you should verify that the fingerprints are being submitted to OPM via SWFT as many organizations submit fingerprints to other agencies via other systems.

First Year Post FCL Responsibilities:

Once the Facility Clearance Branch (FCB) issues an FCL, you are required to comply with the DoD 5220.22-M “National Industrial Security Program Operation Manual (NISPOM)” and implement a security program. Your company’s assigned ISR will reach out 120 days after the FCL is issued to conduct a brief assessment of your facility’s compliance with NISPOM requirements and implementation of its facility security program and additionally, per NISPOM Change 2, effective May 2016, an insider threat program.

Page | 6

3.0 FCL Roadmap

Page | 7

4.0 Telephonic and FCL Orientation Meeting Preparation

4.1 Telephonic Survey

A telephonic survey will be conducted by a DSS representative within 10 days of the facility being placed in process. You will need to familiarize yourself with this handbook in preparation for the call.

Please be prepared to discuss and ask questions on the following topics:

Reason the company is being processed for a facility clearance and the need for classified access Company business structure KMPs requiring PCLs and Excluded KMPs Tier Entity/Excluded Parent process and required documentation NISS submission process e-QIP submission process

4.2 FCL Initial Orientation Meeting

The FCL initial orientation meeting is conducted by an ISR assigned from the local field office. Please be prepared to discuss the following topics with the ISR during their on-site visit to the facility:

Company’s NISPOM requirements Facility’s Security Program Facility’s Insider Threat Program Provide KMP U.S. citizenship verification (current or expired passport or a birth certificate, and government issued photo ID)

Page | 8

5.0 Business Structure and Excluded Tier Entities

The following section details the required business structure and excluded tier entity forms and documents to submit in your company’s FCL Package in NISS.

Please note: In accordance with ISL 2006-02, #12 when only one person within an organization requires access to classified information and that person and members of their immediate family are the sole owners of the organization, that person should work as a consultant and would not require a Facility Clearance.

5.1 Business Structure Required Documents

Business Structure Business Records Required PCLs for KMPs

Sole Proprietorship Business License Fictitious Name Certificate Recent changes to company structure

Owner of sole proprietorship Senior Management Official

(SMO)

FSO

General Partnership Business License Fictitious Name Certificate Partnership Agreement Legal Organization Chart Board/Company Meeting Meetings* Recent changes to company structure

SMO

FSO

All General Partners, except:

Single Partner (must be cleared) Management Committee (all committee members must be cleared)

Limited Partnership Business License Fictitious Name Certificate Partnership Agreement Certificate of Limited Partnership Legal Organization Chart Board/Company Meeting

Meetings* Recent changes to company structure

SMO

FSO

All General Partners, except:

Single Partner (must be cleared) Management Committee (all committee members must be cleared)

Limited Partners need PCL if they work on classified contracts or need access to classified information

Joint Venture (JV) Business License Fictitious Name Certificate JV Agreement Legal Organization Chart Board/Company Meeting

Meetings* Recent changes to company structure

SMO

FSO

JV Partners must be excluded or cleared if their duties require access to classified information

Officials working on JV are cleared if their duties require access to classified information

Privately Held Corporation Business License Fictitious Name Certificate Articles of Incorporation By-Laws Stock Ledger Legal Organization Chart Board/Company Meeting

Meetings* Recent changes to company structure

SMO

FSO

Chairman of the Board Vice Chair of Board, if provisions for rotating or Pro Tem duties Corporate Officials are cleared if their duties require access to classified information

Page | 9

Business Structure Business Records Required PCLs for KMPs Publicly Held Corporation Business License

Fictitious Name Certificate Articles of Incorporation By-Laws Most recent SEC filings Legal Organization Chart Board/Company Meeting

Meetings* Recent changes to company structure

SMO

FSO

Chairman of the Board Vice Chair of Board, if provisions for rotating or Pro Tem duties Corporate Officials are cleared if their duties require access to classified information classified information

Limited Liability Company Business License Fictitious Name Certificate Certificate of Formation or

Articles of Organization Legal Organization Chart Operating Agreement LLC Meeting Meetings* Recent changes to company structure

SMO

FSO

LLC Members are cleared if their duties require access to classified information

Managers

College/University Charter Board/University Meeting

Meetings* Legal Organization Chart Recent changes to university structure

SMO

FSO

President Regents/Trustees/Directors are cleared if their duties require access to classified information

*Include the most recent Meeting Minutes and any Meeting Minutes to reflect changes to a company’s address, name, KMPs, etc.

** If Business Structure is not identified, discuss with ISR during Telephonic Survey

Legal Organization Chart must be submitted in the FCL Package when the sponsored facility is owned by another legal entity. It shall reflect all U.S. and foreign parent companies including their affiliates. The Legal Organization Chart shall identify the associations between the cleared facilities and the ultimate parents, including the percentages of ownership, FCL status, CAGE codes and other helpful information explaining the relationship among the companies in the chain of ownership.

Excluded KMPs: DSS will determine which Officers and Directors of the company not accessing classified information are considered excluded, and do not need a PCL. The company must submit exclusion resolutions for these Officers and Directors (see Appendix B).

If Key Management Personnel are cleared for contractual performance reasons and not in connection with the FCL then this difference needs to be identified.

**FOR MORE INFORMATION ON KMP ROLES SEE APPENDIX A

Page | 10

5.2 Required Forms

Forms To Include on Forms

SF 328; Certificate Pertaining to Foreign Interests

Certificate pertaining to a company’s foreign interests Execute two original SF 328 forms for DSS and contractor retention SF 328 must be signed by an employee or representative of the company who has actual authority to execute agreements with the U.S. Government on behalf of the company

One witness signature is required Upload signed SF 328 into NISS Provide all supplemental responses to affirmative SF 328 questions

SF 328

Key Management Personnel (KMP) Form

Spell out entire KMP names Social Security Number not required for excluded KMPs KMPs must match the Articles of Organization, by-laws or amendments

Proof of Citizenship If applicable

Citizenship verification in the form of a U.S. Passport, Birth Certificate, or Certificate of Naturalization for all KMP(s) requiring personnel security clearance processing.

DD Form 441 Agreement between your organization and the United States Government that details the security responsibilities of both the cleared organization and the United States Government

Execute two original DD 441 forms for DSS and contractor retention.

DD 441 must be signed by an employee or representative of the company who has actual authority to execute agreements with the U.S. Government on behalf of the company.

One witness signature is required Upload signed DD 441 into NISS The date on page 1 and the Government Representative section on page 2 should be left blank.

DD Form 441

DD Form 441-1 If applicable

Attachment to the DD Form 441 listing cleared divisions or branch offices that are included in and covered by the provisions of the organization's Security Agreement and Certificate Pertaining to Foreign Interest.

DD Form 441-1

As a general note for all business types, organizations must register their business with a physical address. The physical address is the actual address where the organization is located and does not have to be in the state of incorporation/organization. This is the address DSS uses for the Facility Clearance and is considered the home office. The CAGE code registration must also match this address. Organization may also have a registered agent address, which typically must be in the state of incorporation/organization and is usually the address documents and notices, such as annual report filings, are mailed to by the Secretary of State.

Some states and jurisdiction do not require certain types of organizations to have all documents referenced. In these cases, it may be very difficult for DSS to determine if and when the organization meets NISPOM requirements. Some documentation outlining the governance and structure of the organization and the roles and responsibilities of the organization’s officials will be required to determine eligibility for a Facility Clearance.

http://www.esd.whs.mil/Portals/54/Documents/DD/forms/sf/sf0328.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0441-1_2017.pdf

Page | 11

6.0 Specific Business Structure Guidance

6.1 Corporation:

The business documents required for a privately or publicly held corporation include the Certificate or Articles of Incorporation, which are filed with the Secretary of State’s office in the state or jurisdiction where the corporation is incorporated, Corporate Bylaws describing the rules governing the regulation of a corporation’s internal affairs, initial and most recent Shareholder and Board of Directors Meeting Minutes, as well as those approving any significant changes to the Corporation, a stock ledger listing the individuals and organizations that hold stock in or shares of the corporation or SEC filings for publicly-held corporations, and a legal organization chart showing the corporation’s ownership and its connections to other business entities. You may also wish to include a legal organization chart showing the internal management structure of the company.

The KMP list for a corporation must include all shareholders, if they are people, directors, and officers.

Shares or stock of a corporation may be held by either people or other organizations. If held by people, these people are called share or stock holders and must be listed on the KMP list with their ownership percentages. If organizations, they are considered “tiered parents” and should be listed in “Package Summary Comments for DSS” under the “Industry-DSS Package Comments” section of the FCL package in NISS. Shareholder control and authority varies. Shareholders, either people or organizations, are not typically required to be cleared simply because they are shareholders. However, if they have significant control or authority over the cleared corporation, they may require a clearance.

Directors, not including the Chairman of the Board, typically do not hold authority that would prevent them from being effectively excluded but this may vary from corporation to corporation. The Chairman of the Board must always be cleared. If a corporation has a rotating Chairman, those who may hold this position must be cleared to the appropriate level prior to filling the role and should be processed for clearances accordingly.

In most corporations, those holding the titles of Chief Executive Officer and President typically hold the highest day‐to‐day management authority, and must be cleared. Most corporations also have a Secretary and Treasurer and possibly a Vice President or Vice Presidents. Traditional authority associated with these roles would allow them to be effectively excluded. Other officer titles designated in the bylaws must also be listed on the KMP list. Typically, these officers report to the CEO or President and can be effectively excluded.

For all shareholders, directors, and officers, each corporation should review the authorities and roles and compare these to the exclusion criteria in NISPOM 2‐106 and the typical responsibilities associated with each role described in the Facility Clearance Orientation Handbook to make a preliminary determination about whether or not they can be effectively excluded. The assigned Industrial Security Representative will make the final decision regarding exclusion upon analyzing the corporation as a whole.

Finally, the FSO and ITPSO must be listed on the KMP list and must be cleared or processed for a personnel security clearance at the level of the facility clearance requested.

Page | 12

6.2 LLC:

The business documents required for a Limited Liability Company, or LLC, include the Certificate or Articles of Organization, which are filed with the Secretary of State’s office in the state or jurisdiction where the company is organized, an Operating Agreement, which describes the governance of the LLC's business and financial and managerial rights and duties, initial and most recent Member or Manager Meeting Minutes, as well as those approving any significant changes to the Company, a membership ledger that lists the individuals and organizations that hold membership interest in the company, and a legal organization chart showing the company’s ownership and its connections to other business entities. You may also wish to include a legal organization chart showing the internal management structure of the company.

The KMP list for an LLC must include all members, if people, and managers, as well as officers, if they are described in the company’s Operating Agreement.

LLCs are a relatively new type of business structure that allows for greater flexibility than the traditional business structures. As a result, their setup can vary widely. The legal requirements for an LLC also vary widely by state and jurisdiction.

Members of an LLC are the owners of the company, similar to shareholders of a corporation, and may be people or other organizations. In an LLC, the management of the company is either automatically vested in the members by virtue of their being members (called “member‐managed”) or vested in a separately designated manager, managers, or board of managers (manager‐managed). Members are not generally required to be cleared simply because of their ownership interest. However, this will vary depending on their specific authority to control or influence the business.

Managers of an LLC are generally required to be cleared as it is extremely rare that they have a level of authority that would allow them to be effectively excluded. In an LLC with multiple managers with varying levels of interest or a Board of Managers or similar executive body, this may vary. However, the chairman or manager with majority interest will almost definitely be required to be cleared.

Because of the flexibility of an LLC, LLCs may create corporate‐style officer positions but this is relatively rare. Often, members and managers refer to themselves using corporate‐style titles, such as CEO and President, because they are more recognizable in the business world, without outlining these in the business documents. For the purpose of the KMP list for DSS, companies should enter any and all titles that are outlined in business documents and refrain from including titles that are only used in practice.

Whether or not the individuals in these positions require a clearance will depend on their role as described in the business documents. These titles vary from being essentially “in name only” titles to holding responsibility similar to that of a corporation so they can be difficult to assess.

Please note that because of the flexibility of LLCs, it is possible to have an LLC that is owned by another organization and member‐managed, making the owning organization the manager. Most organizations that are set up this way did this by default without fully explaining how the owning organization would “manage” the day‐to‐day operations of the LLC. In most cases, the way these LLCs are operating does not align with the description in their business documents. It can be extremely difficult for DSS to determine if and when these LLCs meet NISPOM requirements for a facility clearance.

The FSO and ITPSO must be listed on the KMP list and must be cleared or processed for a personnel security clearance at the level of the facility clearance requested.

Page | 13

6.3 Partnership:

There are three common types of partnership: General Partnerships, Limited Partnerships, and Limited Liability Partnerships although other types may exist in some states or jurisdictions. A General Partnership consists of all General Partners. A Limited Partnership consists of one or more General Partners and one or more Limited Partners.

Limited Liability Partnerships are more similar to LLCs, with Partners being similar to Members, and are formed through Articles of Organization. For the purpose of this section, we will focus on General Partnerships and Limited Partnerships

For Limited Partnerships, a Certificate of Limited Partnership is filed with the Secretary of State’s office.

General Partnerships are typically formed without official registration with a Secretary of State, although some jurisdictions may require a Business License, a Fictitious/Trade Name Registration, or other similar documentation. Regardless, General Partnerships must provide documentation to DSS that demonstrates their legal existence as a General Partnership, the name they are doing business under, and the jurisdiction whose laws they are organized and operating under.

Note that organizations that use General Partnership, General Partners, or GP in the name are rarely actually General Partnerships. Most often, they register as another business type such as an LLC. For example, ABC General Partners, LLC is an LLC and not a General Partnership for the purpose of NISP participation and you should refer to the section of this Orientation on LLCs for the business document and KMP requirements. However, if there is a Partnership Agreement in addition to an Operating Agreement in this scenario, both should be provided to DSS.

A partnership agreement is a contract between two or more business partners that establishes the responsibilities of each partner and general rules about the partnership. Partnership Agreements may not be required for all partnership types in all states. However, DSS will need to be provided with some documentation that outlines the responsibilities of the partners and the basic rules and structure of the partnership in order to determine if or when it meets the eligibility requirements for a Facility Clearance.

You must provide a legal organization chart showing the partnership’s ownership and any connections to other business entities. You may also wish to include a legal organization chart showing the internal management structure of the company.

The KMP list for a General or Limited Partnership should include all General and Limited Partners who are people. General or limited partners that are organizations must alternatively be listed in “Package Summary Comments for DSS” under the “Industry-DSS Package Comments” section of the FCL package in NISS.

General partner is the name given to partners that have active involvement in managing the partnership. As such, General Partners must be cleared. Both General Partnerships and Limited Partnerships have at least one General Partner.

Limited partner is the name given to a partner that does not participate in management of the business.

As such, Limited Partners can generally be effectively excluded. General Partnerships do not have any Limited Partners. Limited Partnerships may have one or more Limited Partners in addition to their General Partner(s). Like Members of an LLC and Shareholders of a Corporation, Partners may be people or other organizations. If a General Partner is an organization, it must be clear in business documents

Page | 14 what person or people are managing the business and how they are doing so. If this is not clear in business documents, it may be difficult or impossible for DSS to determine when or if the Partnership meets eligibility requirements for a Facility Clearance.

6.4 Educational Institute:

Educational institutions vary widely in how they are established and governed, which may change the required business documents and KMP identification significantly. Each institution should review its record thoroughly and compare its structure to that of other business types, if applicable.

In general, a charter is given by provincial, state, regional, and sometimes national governments to legitimize the university's existence. If the charter does not describe how the organization is run and who has authority to manage the organization, a separate document, such as bylaws or a constitution, must be provided.

Board Meeting Minutes from a Board of Regents/Trustees/Directors/Managers or other executive or governing board must be provided if they are needed to support existence of or significant changes to the organization or the designation or elections of members of the board or officers.

A legal organization chart must be provided to show the organization’s ownership, if applicable, and any connections to other business entities. You may also wish to include a legal organization chart showing the internal management structure of the organization.

The KMP list for colleges and universities varies. However, in general, it must include all officials described as having a role in the governance of the organization in governance documents.

Typically, the President of a University or College is the highest management authority and must be cleared. The management of the business affairs of the organization may be accomplished through a Board of Regents/Trustees/Directors/Managers or other type of executive or governing body.

Depending on their level of authority, all or some may be able to be effectively excluded. However, a chairman or quorum may need to be cleared. In a college or university, another official, such as a program manager or director, may be responsible for classified contracts. This person must be cleared.

6.5 Sole Proprietorship:

The requirements for legal registration of a sole proprietorship vary by state and jurisdiction and there are often multiple options. DSS requires documentation demonstrating that the sole proprietorship is legally organized and existing as a sole proprietorship and identifying the jurisdiction whose laws it is operating under. Depending on the state, this may be a business license, a fictitious name certificate, a certificate of sole proprietorship or another similar document.

The KMP list for a sole proprietorship must include the sole proprietor. The sole proprietor is the owner

Page | 15 of a sole proprietorship and must always be cleared to the level of the Facility Clearance.

Additionally, the FSO and ITPSO must be listed on the KMP list and must be cleared or processed for a personnel security clearance at the level of the facility clearance requested.

6.6 Branch Or Division Office:

A branch office or division is a separate location of an existing legal entity, referred to as a multiple facility organization (MFO). Because a branch office is part of the same legal entity as its home office, they must have the same legal name. In most cases, only the home office requires a facility clearance. A branch office or division only requires a separate Facility Clearance issued by DSS if it will need to be able to safeguard collateral classified information within that office. If it will need to exclusively safeguard classified information that is not under DSS cognizance, a Facility Clearance issued by DSS is not required, but other requirements will need to be met as determined by the organization that does have cognizance. If no safeguarding is needed at the branch office, administrative security requirements, such as personnel security clearance processing and training, are handled by the home office via its security program.

For branch offices that do require a Facility Clearance, the home office must always be cleared to the same or a higher level as the branch office. If you are a branch office or division and your home office is not cleared or in-process for a facility clearance, please contact the DSS Knowledge Center immediately.

Because the majority of the legal business documents and forms required are provided by the home office, the FCL package requirements for a branch office or division are minimal. The required documents include any business records of the legal entity that apply specifically to the branch office, such as meeting minutes establishing a new office location, a KMP list, a DD Form 441‐1, which is signed by home office, and a legal organization chart.

The KMP list for a branch office is the only type of KMP list in which the individuals listed are not required to be designated in legal business documents. The KMP list for a branch office should include a SMO specific to the site, which is the person who has senior management authority at that office, the branch office FSO and the ITPSO. The ITPSO must be listed on the branch office KMP list even if this is a corporate‐wide ITPSO.

6.7 Joint Venture:

Joint Ventures are becoming more and more popular. Joint Ventures, or JVs, can be formed in a couple of ways.

A JV by Contract is generally a team of two or more legal business entities that has entered into a contract together to work on a specific project. They do not form a separate legal operating entity, but have a contract that outlines the terms of their arrangement.

Alternatively, a JV can be formed following a similar agreement between two or more organizations to form a legal operating entity, such as a Corporation, an LLC, or a Partnership to serve as the JV.

There are 2 key points to consider with JVs:

Page | 16

First, in accordance with NISPOM 2‐102b, in order to be eligible for a Facility Clearance, an organization must be legally organized and existing in the United States. Therefore, JVs by contract that have not formed a legal registered operating entity are not eligible for a Facility Clearance.

Second, JVs may be either populated or unpopulated. This means that the JV entity either itself has employees or does not have employees, in which case the employees remain employees of the organizations that make up the JV. In accordance with NISPOM 1‐201, 1‐202b, 2‐104, the FSO, the ITPSO, and the SMO must be employees of the organization holding the Facility Clearance. Therefore, the JV must have an employee(s) who hold these positions. There may be regulations that provide that a JV may not be populated with individuals intended to perform on contracts awarded to the JV. That is, the JV may have its own separate employees to perform administrative functions, but may not have its own separate employees to perform on contracts awarded to the JV. Note that this scenario does not conflict with the NISPOM requirements to have employees performing administrative security functions.

If a classified contract is awarded to the JV, the JV needs a Facility Clearance. If the contracts is exclusively awarded to one or both JV partners, those organizations require Facility Clearances.

Business records and KMP requirements are determined by the type of legal entity. For example, many JVs organize as LLCs. This organization should have Articles of Organization, and an Operating Agreement. Although, it may also have a JV Agreement or it may cover the operation of the organization as both an LLC and a JV in one or the other. Both the Operating agreement and the JV Agreement should be provided to DSS, if both exist.

Page | 17

7.0 Excluded Tier Entity Process

The objective of this process is to clear the sponsored facility and identify tiered companies to exclude from access to classified information. A tiered company, also known as a parent company, is defined as a company owning at least a majority of another company’s voting securities. DSS determines if tiered companies are required to obtain an FCL or can be excluded from access to classified information. If a tiered company needs to be cleared, it will also be placed in process and cleared concurrently with the company that was awarded the contract.

NOTE: Parent companies should be identified in “Package Summary Comments for DSS” under the “Industry-DSS Package Comments” section of the FCL package in NISS. Please include the parent company’s legal name, CAGE Code, address, and a designated Point of Contact’s name, email address and phone number.

7.1 Excluded Tier Entity Requirements

The process flow below outlines the required documents the sponsored facility must provide to DSS on behalf of any intermediate excluded entities and the ultimate excluded entity. In this process neither the ultimate excluded entity nor any of the intermediate tiered entities hold a FCL.

Sponsored Facility:

Company A

First Tier Excluded Entity:

Company B

Second Tier Excluded Entity: Company C

Third Tier Excluded Entity: Company D

Ultimate Excluded Entity: Company E

1) Provides company org chart, KMP lists and business records to Ultimate Excluded Parent

2) Provides company org chart, KMP lists and business records to Ultimate Excluded Parent

3) Provides company org chart, KMP lists and business records to Ultimate Excluded Parent

4) Compiles excluded entity companies org charts, KMP lists and business records

5) Consolidates a SF-328 for the excluded entities

Acknowledges exclusion of the Excluded Entities from access to classified information.

Resolution for intermediate excluded entities

8) Submits excluded entities documentation into NISS; submits Subsidiary Exclusion Resolution into NISS

7) Provides documents to Sponsored Facility

9) Submits all NISS documents and forms required per its Business Structure

Page | 18

7.2 Entity Roles and Responsibilities

Entity Responsibility Intermediate Parent/Owner Entity

Submits Company’s Organization Chart, KMP List, and Business Records to Ultimate Cleared Entity

Ultimate Parent/Owner Entity

Provides all Entities Organization Charts, KMP Lists, and Business Records to Sponsored Facility

Provides Sponsored Facility the requested Exclusion Resolution on behalf of its company and Intermediate parents to be Excluded

Sponsored Facility (Highest Cleared Facility)

Submits Parent entities to be Excluded Organization Charts, KMP Lists, Business Records, and Exclusion Resolution for entities

Submits Subsidiary Exclusion Resolution acknowledgement

Submits all required NISS Forms and Documents per its Business Structure

Page | 19

8.0 Highest Cleared Tier Entity

The process flow below documents the required documents the Sponsored Facility and Highest Cleared Entity must provide to DSS on behalf of any Intermediate Excluded Entities and the Ultimate Excluded Entity. In this process the Highest Cleared Entity holds a FCL and provides DSS updates on behalf of the Ultimate Excluded Entity and Intermediate Tier Entities. Highest Cleared Entity previously submitted all required Documents and Forms for Excluded Entities during its FCL process.

8.1 Process Flow

Sponsored Facility:

Company A

First Tier Excluded Entity:

Company B

Second Tier Excluded Entity: Company C

Third Tier Excluded Entity: Company D

Ultimate Excluded Entity: Company E

Acknowledges exclusion of the parent company from access to classified information

Information for Excluded Entities previously submitted by Highest Cleared Entity during its FCL process

1) Submits company updates to Ultimate Excluded Entity

2) Submits company updates to Ultimate Excluded Entity

5) Submits Subsidiary Exclusion Resolution into e- FCL

4) Submits Excluded Entities information for Sponsored Facility

3) Submits all Excluded Entity company updates to Highest Cleared Facility

6) Submits all documents and forms required per its Business Structure

8.2 Entity Roles and Responsibilities

Entity Responsibility Intermediate Entity Submit changes to Ultimate Entity, if applicable

Ultimate Entity Provides Intermediate Entity changes to Highest Cleared Entity, if applicable

Highest Cleared Entity Provides Entity changes to DSS, if applicable

Sponsored Facility Submits all required NISS Forms and Documents per its Business Structure

Submits Subsidiary Acknowledgement of Exclusion Resolution

Page | 20

9.0 Accounts and Systems

The table below outlines the Accounts and Systems the FSO must activate or leverage to submit additional documents for its Facility to receive its FCL and to maintain a compliant security program after obtaining the FCL.

Accounts Reason for Account Description Commercial and Government Entity (CAGE) Code

Provides a standardized method to identify your Specific facility

The CAGE Code is a five-character ID number used extensively within the federal government, assigned by the Department of Defense’s Defense Logistics Agency (DLA). If your company does not already have a CAGE Code for the facility requiring clearance, one may be obtained by visiting System for Award Management (SAM).

SAM LINK

Joint Personnel Adjudication System (JPAS)

System to serve as the record to perform comprehensive personnel security, suitability, and credential eligibility management.

*Account MUST be established within 30 days of the FCL being issued.

JPAS is the system of record for personnel security clearances. All PCL eligibility and access records for KMPs and those requiring access to classified information must be kept up-to-date in JPAS. Because a person cannot view or take action on their own JPAS record, cleared companies must have at least two (2) JPAS account holders to comply with NISPOM requirements. The Defense Manpower Data Center (DMDC) is the functional manager of JPAS. Full JPAS Account Request procedures are available on their website.

JPAS LINK

The Defense Information System for Security (DISS)

System to serve as the record to perform comprehensive personnel security, suitability, and credential eligibility management.

Once fully deployed, DISS will replace JPAS.

DISS provides secure communications between Adjudicators, Security Officers, and Component Adjudicators in support of eligibility and access management.

DISS LINK

Electronic Questionnaires for Investigations Processing(e-QIP)

Submit KMP information through this system as part of the PCL process e-QIP allows the user to electronically enter, update and transmit their personal investigative data over a secure internet connection to a requesting agency.

E-QIP LINK

National Industrial Security System (NISS) System of Record for Facility Clearances *NISS is behind a system called the NISP Central Access Information Security System (NCAISS). This web‐based application provides PKI‐based authentication for DSS applications. You will need a PKI certificate to obtain access to NCAISS and NISS.

NISS replaces and expands upon capabilities of two legacy systems, ISFD, and e-FCL, and automates the Initial Facility Clearance process. This system also expands access and transparency to security professionals’ facility information.

NISS LINK

Secure Web Fingerprint Transmission

(SWFT)

Submit KMP fingerprints through SWFT or third party vendor to complete KMP’s PCL process *Account created after Facility is issued its

FCL.

SWFT allows the submission of fingerprints to be uploaded electronically through its system. (All fingerprint images that are provided in support of background investigations must be captured and submitted electronically) For SWFT access, submit DMDC’s new Personnel Security System Access Request (PSSAR) form to the DMDC Contact Center for processing

SWFT LINK

Security Training, Education, and Professionalization Portal (STEPP)

Provides courses for Contractor’s security professionals

Program maintaining the list of courses DSS provides to security professionals. The courses are intended for use by Department of Defense and other U.S. Government personnel and contractors within the NISP.

STEPP LINK

https://www.sam.gov/ https://psa.dmdc.osd.mil/psawebdocs/docPage.jsp?p=JPAS https://psa.dmdc.osd.mil/psawebdocs/docPage.jsp?p=DISS https://nbib.opm.gov/e-qip-background-investigations/ https://cdse.usalearning.gov/login/index.php

Page | 21

10.0 Training

Training Classes Link

Center for Development of Security Excellence (CDSE) Toolkits https://www.cdse.edu/toolkits/index.html

FSO Toolkit https://www.cdse.edu/toolkits/fsos/index.php ITPSO Toolkit https://www.cdse.edu/toolkits/insider/index.php

The CDSE Toolkits are a repository of role-based resources that serve as a one-stop shop for security essentials. Each toolkit points you to the resources you need to help perform your role. The FSO Toolkit and Insider Threat Toolkit will be one of your most important resources while you are participating in the NISP.

10.1 FSO Training

A list of the required FSO Training is available in the FSO Toolkit. FSO’s of companies that will require safeguarding should sign up for the FSO Program Management for Possessing Facilities. FSO’s of companies that do not require safeguarding should sign up for FSO Orientation for Non‐Possessing

Facilities. Both courses are offered on the Security Training, Education and Professionalization Portal, or

STEPP, which is available on the DSS website under Information Systems. You will need to take each course as well as the corresponding exam. The sooner you take this training, the easier it will be to set up your security program and understand your requirements under the NISP.

10.2 Insider Threat Program Training

The requirements for your Insider Threat Program can be found in NISPOM 1‐202 and ISL 2016-02. You are required to nominate an Insider Threat Program Senior Official (ITPSO). This person will be considered a KMP along with the FSO, SMO, and other KMP(s). The ITPSO can be the same individual as the FSO, or it can be a different person. Corporate families are able to nominate a corporate ITPSO.

The ITPSO MUST take training within 30 days of being formally appointed ITPSO. The ITPSO may choose to use an existing training course to meet this requirement called Establishing an Insider Threat Program for your Organization. This course is offered on STEPP, which is available on the DSS website under

Information Systems.

The ITPSO must also certify that a written Insider Threat Program is in place. Your ISR will talk to you more about this when they are onsite for the Initial Orientation Meeting. Additional information, including a plan template and job aid, is available at the Industry Insider Threat and Resources link in the most requested links section of the DSS website.

https://www.cdse.edu/toolkits/index.html https://www.cdse.edu/toolkits/fsos/index.php https://www.cdse.edu/toolkits/insider/index.php

Page | 22

Appendix A: Defining KMP Authorities of Position KMP Role Authorities of the Position

CEO Highest ranking executive manager in a corporation or organization’s by-laws or organizational documents

Responsible for the overall success/management of the organization Ultimate authority to make final decisions for an organization Responsibility for creating, planning, implementing, and integrating the strategic direction/vision of an organization Reports to a Board of Directors and serves at the discretion of the Board of Directors

President Creates, communicates, and implements the organization's vision, mission, and overall direction

Leads, guides, directs, and evaluates the work of other executive leaders including senior vice presidents, vice presidents and directors

Formulates and implements the strategic plan that guides the direction of the business

Oversees the organization in accordance with the direction established in the strategic plans

Chairman of the Board Trusted with the responsibility of chairing a board or organization Governs the board according to the bylaws of the organization. The chairman must attend the board meetings and committees regularly.

Committed to board duties and has vast knowledge of the organization itself Evaluates annual performance of the organization Chairman rarely involves themselves in the company's day-to-day operations, instead concentrating on the bigger picture and…