ATT0077 DCSA FCL Orientation Handbook.pdf

Facility Clearance Orientation Handbook

Defense Counterintelligence and Security Agency

Industrial Security Entity Vetting Directorate

July 2026

Page | 2 Return to Contents

Table of Contents Points of Contact Resources Page Index Welcome Message

1.0 Overview of the NISP

1.1 FCL Lifecycle

1.2 FCL Roadmap

2.0 Facility Security Officer (FSO) Responsibilities and Deadlines

2.1 Before Sponsorship Acceptance

2.2 After Sponsorship Acceptance

2.3 Post-FCL Determination

3.0 FCL Process Overview

3.1 FCL Package Submission

3.2 FCL Upgrade Information

3.3 Expedite Request Guidelines

3.4 FCL Adjudication

3.5 FCL Appeals Process

3.5.1 The FCL Denial, Revocation, and Appeals Process:

4.0 FCL Package Submission Guidance

4.1 Key Management Personnel (KMP) Identification

4.1.1 Required (Essential) KMP verses Excluded KMP

4.1.2 Senior Management Official (SMO)

4.1.3 Facility Security Officer (FSO)

4.1.4 Insider Threat Program Senior Official (ITPSO)

4.1.5 Other KMP

4.2 Business Structure-Specific KMP and Required Documentation

4.3 Special Purpose Entities

4.3.1 Branch Office/Division

4.3.2 Joint Venture (JV)

4.3.3 Tribal Entity

4.4 Upgrades

4.5 Additional Guidance on FCL Package Documentation

5.0 Excluded Parent Process

5.1 Sponsored Facility and Excluded Parent Definitions and Responsibilities

5.2 Excluded Parent Workflow Example

6.0 Accounts and Systems

7.0 Tools and Training

7.1 FSO Training

Page | 3

7.2 Insider Threat Program Training

Appendix A: Common KMP Authorities by Position Appendix B: Sample DD-441, SF-328, and SF-328 Signature Pages

B.1 DD Form 441 Completion Sample B.2 SF-328 Certification B.3 SF-328 Certification (Signature Block) Example

Appendix C: Sample Organizational Charts C.1 Sole Proprietorship C.2 LLC (Member-Managed) C.3 LLC (Manager-Managed) C.4 Corporation C.5 Joint Venture C.6 Complex Business Structure C.7 University Structure C.8 Branch Offices

Appendix D: FCL Package Common Errors List Appendix E: FCL Package RFI Process Appendix F: FCL Discontinuation Appendix G: PKI/ECA – access to NCAISS and NISS Appendix H: Common Acronyms Appendix I: Proposed Exclusion Resolution Templates

I.1 Highest Cleared Entity Noting Excluded Entity’s Exclusion and Resolution to Exclude Parent Organization I.2 Exclusion Resolution of Corporate Organization I.3 Exclusion Resolution for LLC Member (Organization) I.4 Exclusion Resolution for Certain Directors, Officers, and LLC Member or Manager (if Person)

Page | 4

Points of Contact

Facility Clearance Process, Update Requests, and Package-Related Questions

• Entity Vetting Directorate Knowledge Center o Email: dcsa.quantico.mbx.ev-vtd@mail.mil o Phone: (878) 274-2000 (option 2, then 1)

National Industrial Security System (NISS)-Related Questions or Issues

• NISS Technical Line Phone: (878) 274-2000 (option 2, then 3)

National Background Investigation Services (NBIS) eAPP (electronic application)

• For applicant support with eAPP, contact the Applicant Knowledge Center (AKC) o Email: dcsa.boyers.dcsa.mbx.applicant-knowledge-center@mail.mil o Phone: (878) 274-5091 o Hours 6:00 a.m. – 5:00 p.m. EST

DoD Help Desk Information

• DoD PKI Help Desk (DISA) o Email: disa.gsd.maops@mail.mil o Phone: (844) 347-2457 Option 1,3,4

• DoD PKE Help Desk (DISA) o Email: dodpke@mail.mil

• ECA Program Office (DISA) o Email: disa.meade.mae.list.pkieca@mail.mil

• CAC Support (DMDC) o http://www.cac.mil/common-access-card/developer-resources/ o Email: cacsupport@mail.mil

• Vendor ECA Support – Check DoD Cyber Exchange Site for Current Vendor List o https://public.cyber.mil/pki-pke/help/

• IdenTrust, Inc.

o http://www.identrust.com/certificates/eca/index.html

Email: helpdesk@identrust.com Phone: (888) 882-1104

• WidePoint - Operational Research Consultants, Inc. (ORC) o http://www.eca.orc.com/

Email: wcsc.helpdesk@widepoint.com Phone: (800) 816-5548

Post-FCL and DCSA Field-Related Questions or Concerns

• DCSA Field Offices and Contact Information o https://www.dcsa.mil/Industrial-Security/Field-Locations/

Page | 5

Resources Page

Policy

• 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM Rule) o https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117

• DTM 24-004

o https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dtm/DTM-24-

004.PDF?ver=xjHWilUsiMyXVOt7kR3t_g%3d%3d (note: expiration date extended)

• DoD Manual 5220.32 o Volume 1 (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522032v1.PDF?ver =1BFNVqOKXaqdXcO618H-yg%3D%3D) o Volume 2 (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522032v2.PDF?ver =6r6Wq0aBhS44uQvw8Vne_w%3D%3D)

• 48 CFR 52.204-18, Commercial and Government Entity Code Maintenance.

o https://www.ecfr.gov/current/title-48/section-52.204-18 o https://www.acquisition.gov/far/52.204-16#FAR_52_204_16__d3091e43

Forms

• Exclusion Resolutions

• DD-441

o https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0441.pdf

• DD-441-1

o https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0441-1.pdf

• SF-328

o https://www.gsa.gov/reference/forms/certificate-pertaining-to-foreign-interests

• SF-86

o https://www.opm.gov/forms/pdf_fill/sf86.pdf

• DD254

o https://www.esd.whs.mil/Directives/forms/dd0001_0499/DD254/#:~:text=Form%20Num ber%3A%20DD%20254&text=Title%3A%20Department%20of%20Defense%20Contra ct,Security%20Classification%20Specification%20(Download%20Instructions)&text=Ed ition%20Date%3A%2004%2F01%2F2018 r

Training and Guidance

• FCL Orientation Videos – Under Construction

• NCAISS/NISS User Guide o https://www.dcsa.mil/Portals/128/Documents/IS/DCSA_NCAISS_PS3_NCAISS_User_

Guide.pdf

• NISS Industry Onboarding o https://www.dcsa.mil/Systems-Applications/National-Industrial-Security-System- NISS/NISS-Industry-Onboarding/

Page | 6

Systems

• Defense Logistics Agency (DLA) o https://www.dla.mil/Vendor-Information-Hub/Table-of- Contents/Details/Article/3606127/registration-renewal-and-cage-creation-in-system-for-award-management-sam/#Signing%20Up%20VS%20Registering

• System for Award Management (SAM) o https://sam.gov/

• Defense Information System for Security (DISS) o https://www.dcsa.mil/Systems-Applications/Defense-Information-System-for-Security-

DISS/

• Fingerprint service providers o https://www.dcsa.mil/is/swft/swftresources/

• NCAISS

o https://www.dcsa.mil/Systems-Applications/National-Industrial-Security-Program-NISP-

Central-Access-Information-Security-System-NCAISS/

• NISS

o https://www.dcsa.mil/Systems-Applications/National-Industrial-Security-System-NISS/

Obtaining Public Key Infrastructure (PKI) or External Certification Authority

(ECA)

PKI and ECA Resources

• PKI Interoperability Website:

o https://public.cyber.mil/pki-pke/interoperability/

• ECA PKI Support Organizations:

o https://public.cyber.mil/pki-pke/help/

• ECA

o https://public.cyber.mil/eca/

• DoD ECA X.509 Certificate Policy o https://dl.dod.cyber.mil/wp-content/uploads/eca/pdf/unclass-eca_cp.pdf

• Frequently Asked Questions o https://www.cyber.mil/faqs

Page | 7

Index

• Adjudication: 20-24

• Appeals: 24-26

• Branch: 31-32, 33-34, 56

• Corporation: 28, 30, 32-33, 44-45, 52, 64

• Discontinuation: 14, 59-61

• Excluded Parent (XP): 36-38, 47, 57

• Facility Security Officer (FSO): 13-19, 27-35, 39-43

• FCL Lifecycle: 11

• FCL Process Roadmap: 12

• Insider Threat Program Senior Official (ITPSO): 17, 27-30, 42-43

• Key Management Personnel (KMP): 9, 14-18, 23, 27-35, 44-45, 57-58

• Legal Organizational Chart: 49-56

• Limited Liability Company (LLC): 29-30, 32-34, 44-45, 50-51

• Limited Liability Partnership: 31

• Limited Partnership/General Partnership: 31, 44, 54

• Parent Entity: 9-10, 27, 30, 34-38, 47, 58

• Senior Management Official (SMO): 17, 27-36, 42, 57-58

• SF-328: 5, 18-19, 29-30, 33-37, 47-48, 57-58

• Ultimate Excluded Parent: 33-38

• University/College (Academic Institution): 28, 31, 55

• Upgrade: 14, 18-19, 28-29, 33, 59-60

Page | 8

Welcome Message

On behalf of the Defense Counterintelligence and Security Agency (DCSA), welcome to the facility clearance (FCL) process. Your facility has recently been sponsored for access to classified information by a government contracting activity (GCA), cleared contractor, or foreign government under the National Industrial Security Program (NISP) for performance on a classified government contract.

DCSA will be overseeing your FCL and security program as the cognizant security office (CSO) administering the NISP on behalf of the Department of War (DoW) and 35 other federal agencies (https://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/NISP- Signatories/).

DCSA considers its relationship with industry as a vital partnership in the safeguarding of U.S. national security. We are committed to supporting your facility throughout and beyond the FCL process while under DoW cognizance. The importance of your organization in the protection of U.S national security interests cannot be overstated - whether your facility provides critical hardware, innovative software, essential services, or any other contribution to DoW or the defense industrial base - you play a crucial role in supporting and enabling U.S. warfighters. This immense responsibility requires a proactive, unwavering commitment to security across the entire enterprise.

The requirements, restrictions, and other safeguards which cleared facilities must implement are outlined in 32 Code of Federal Regulations (CFR) Part 117, National Industrial Security Program Operating Manual (NISPOM) Rule (https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-

117) . This Handbook does not replace the NISPOM Rule and it is your organization’s responsibility to meticulously review the sections and chapters of the NISPOM Rule applicable to your security program to fully understand your obligations under the security agreement your facility is about to execute with the U.S. Government (DD Form 441, https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0441.pdf).

DCSA looks forward to partnering with you and your facility. Please do not hesitate to reach out to the Knowledge Center or your Industrial Security Representative as you begin navigating the FCL process.

Matthew Kitzman Deputy Assistant Director Entity Vetting Directorate

Page | 9

1.0 Overview of the NISP

The NISP was established by Executive Order 12829, as amended, in January 1993 for the protection of classified information. The NISP applies to all executive branch departments and agencies, and to all cleared contractor facilities located in the United States, its territories, and possessions. The Secretary of War has entered into agreements with other federal departments and agencies to provide industrial security services, current listing is available at: https://www.dcsa.mil/Industrial-Security/National- Industrial-Security-Program-Oversight/NISP-Signatories/.

Participation is voluntary, but access to classified information will not be permitted unless a facility agrees to, and abides by, NISP requirements. When your facility receives its FCL, it will be subject to provisions of the 32 Code of Federal Regulations (CFR) Part 117, National Industrial Security Program Operating Manual (NISPOM Rule) https://www.ecfr.gov/current/title-32/subtitle-A/chapter- I/subchapter-D/part-117. You are expected to review and become familiar with 32 CFR Part 117. The FCL Orientation Handbook is not intended to replace 32 CFR Part 117, it is simply a guide to inform and assist with navigating the FCL process.

An FCL is an administrative determination that a facility is eligible to access classified information. The process begins with a government agency, or a prime contractor submits a sponsorship in the National Industrial Security System (NISS) database. Following acceptance of the sponsorship, the Facility Security Officer (FSO) will receive a welcome email directing the facility to obtain a NISS account and provide documentation. This welcome email officially starts the clock on several critical, time-sensitive actions. This FCL Orientation handbook is your comprehensive guide, designed to walk you through each stage of this process and help ensure a successful outcome.

Phase Required Action & Timeline

1. PKI Token Application

The appointed FSO must immediately apply for a Public Key Infrastructure (PKI) token. This is required for National Industrial Security System (NISS) access and can take several weeks to arrive.

2. FCL Package Submission

The facility has 20 days to submit its initial FCL package. This must include key business documents and identify Key Management Personnel (KMP), such as the Senior Management Official (SMO), FSO, and Insider Threat Program Senior Official (ITPSO).

3. Personnel Security (PCL)

Essential KMP must be processed for a Personnel Security Clearance (PCL) at or above the requested FCL level and complete the SF-86 via eAPP or successor system. Non-essential KMP must be formally excluded.

4. DCSA

Coordination

Throughout the entire process, the FSO must remain highly responsive and readily available to answer any inquiries from DCSA.

5. Final Adjudication

DCSA evaluates the complete package for risks—including Foreign Ownership, Control, or Influence (FOCI)—to ensure granting the

Page | 10 clearance aligns with U.S. national security interests.

The classification levels in the NISP are CONFIDENTIAL, SECRET, and TOP SECRET. Your facility’s FCL level is based on the classified contract requirements, the solicitation, DD-254, security classification letter, or other accepted documentation. DCSA may issue an interim FCL prior to issuance of the final FCL. For an interim FCL, DCSA must first validate that there is no unmitigated FOCI, and the essential key management personnel (KMP) - individuals required to be cleared in connection with the FCL - have eligibility determinations at the interim level or higher. A final FCL (also known as an Entity Eligibility Determination) cannot be issued until the first four stages of the FCL lifecycle have been completed and all essential KMP are cleared at the final level of the requested FCL.

Please note, essential KMP are required to hold the same level personnel security clearance (PCL) or higher as the FCL before the final FCL can be issued. PCL background investigation and adjudication processing timelines may result in delays issuing the final FCL. Non-essential KMP, who are not required to hold PCLs in connection with the FCL, must be excluded via Exclusion Resolution.

If there are other facilities within the same legal structure, such as a parent or member entities, a decision will be made to clear or exclude these entities by DCSA during the initial review of the FCL Package in NISS. Additionally, when FOCI is present, the timelines for processing the FCL will likely be extended due to the required review, analysis, and potential implementation of FOCI risk treatment.

Page | 11

1.1 FCL Lifecycle

The FCL processing times are unique to each company. This orientation handbook is designed to guide you through a “right the first time” submission to minimize delays and focus on company readiness.

Ensuring first-time accuracy on your forms and providing swift responses to DCSA inquiries are the most critical factors within your control to accelerate your package.

Page | 12

1.2 FCL Roadmap

Page | 13

2.0 Facility Security Officer (FSO) Responsibilities and Deadlines

Welcome to the National Industrial Security Program (NISP). As a Facility Security Officer (FSO), you are central to your organization's security, acting as the primary liaison to DCSA to ensure regulatory compliance.

Be prepared and available to discuss your facility’s business structure, personnel, and promptly respond to questions from DCSA. Throughout this period, your ability to answer questions and work with other parts of your organization to collect and provide information is crucial.

Immediate Action: Apply for Your Public Key Infrastructure (PKI) or External Certification Authority (ECA) token.

You must apply for your PKI token; it is essential for secure authentication to access NISS. The process to acquire a PKI token can take several weeks.

2.1 Before Sponsorship Acceptance

Once DCSA accepts the FCL sponsorship in NISS, the FSO will have strict deadlines for document submission. The information below can help you get ahead of the requirements and be prepared if you know your facility will be awarded a classified contract:

• Anyone conducting business with the U.S. government is required to have and maintain a Commercial and Government Entity (CAGE) code through the Defense Logistics Agency (DLA) CAGE (DLA CAGE) database through the life of the contracts, and prime contract holders are required to be registered with SAM.gov (48 CFR 52.204-18 and FAR 52.204-18).

Once an account is created in DLA CAGE, a Unique Entity ID will be issued, and a CAGE code will be generated for them. Additional guidance on how to receive a CAGE code and register with DLA CAGE and SAM can be found at DLA.

• To submit the documentation DCSA requires, the FSO will first need to ensure they have a PKI or ECA to access the NISP Central Access Information Security System (NCAISS), the system housing the National Industrial Security System (NISS). NISS is the system-of-record where all FCL-related information is housed and processed. It can take two weeks or more to obtain an ECA, so it is best practice to get the process started early. PKIs take longer to process and typically require a Common Access Card. See the Resources Page for more information on PKI certificates and a list of DoD approved PKI vendors.

• In addition to the FCL Orientation Handbook, DCSA’s FCL Orientation Videos provide a detailed, narrated guide to the FCL process, including associated milestones and deadlines.

You can watch them as many times as needed for reference. https://www.dcsa.mil/Industrial- Security/Entity-Vetting-Facility-Clearances-FOCI/Facility-Clearances/ are a detailed, narrated guide that will walk through the FCL process. DCSA strongly encourages FSOs to take the necessary time to view these videos. Along with the FCL Orientation Handbook, these videos provide all the information needed to meet all requirements for the FCL process.

After you have thoroughly reviewed the information contained in the videos, handbook, and attached documents, please direct any questions to the DCSA Entity Vetting Directorate Knowledge Center. Direct any NISS technical questions to the NISS Technical Line.

Page | 14

2.2 After Sponsorship Acceptance

Once DCSA accepts the sponsorship, the timeline begins. During the first 20 days following acceptance of the FCL sponsorship request, it is your responsibility to identify your facility’s business structure and provide required documentation and forms in NISS.

There are two deadlines during the FCL process:

1. Required legal documentation and DCSA forms must be submitted through an initial FCL package in NISS within 20 days of receiving the NISS-generated Welcome E-mail (Day 1).

• It is the FSO’s responsibility to ensure all required documentation is submitted within the allotted timeframe, and provided documentation is complete and accurate. Failure to do so may result in FCL processing delays or discontinuation of the facility’s FCL request.

• Once the documentation is submitted, the FSO should ensure they are available to respond to calls or emails from DCSA requesting additional information or clarification.

• DCSA implements an approach, wherein the facility has two chances to address any discrepancies, or missing information preventing DCSA from processing the FCL package. Should the facility fail to provide the requested information within the two allotted attempts, DCSA will discontinue the process, EVEN IF it is before the 20-day deadline. Please see Appendix F for further guidance.

2. Upon receipt of the FCL Package, DCSA will review the PCL status of the essential KMP.

Any essential KMP without a PCL, or a PCL at a lower level than the FCL, will be initiated for an investigation request by DCSA. Once the background investigation(s) are initiated, the FSO will receive an email from DCSA with instructions and a due date for the investigation submission and fingerprints.

• Please include the personal email address for all essential KMP on the KMP tab within the NISS FCL package. This information is needed to send the required documentation to start the security clearance eligibility process.

• For an FCL Upgrade, the FSO is responsible for initiating background investigation(s), for its essential KMP including updated fingerprints. DCSA will provide a courtesy email to the FSO upon completion of the Review and Triage Stage of the Upgrade FCL Package, which will include a suspense date for SF-86 via eAPP, or successor system, and fingerprint submittal.

There are two categories of individuals who must be submitted for a PCL during the sponsorship acceptance process:

1. Essential Key Management Personnel (KMP): Essential KMP who do not have the appropriate

PCL eligibility must complete the SF-86 form electronically via eAPP and submit electronic fingerprints, or successor systems.

a. The Process: Once the FCL package is submitted, DCSA will email these individuals directly with instructions to access eAPP (or its successor system)..

b. How to prepare: All KMP should familiarize themselves with the requirements of

Page | 15 holding a PCL. Because paper forms are not accepted, KMP should download the SF-86 PDF to gather their background information offline before logging in.

https://www.opm.gov/forms/pdf_fill/sf86.pdf .

2. Negotiator or Mission Critical Employee: DCSA will process PCLs for individuals identified as the negotiator, or a mission critical employee who is not a KMP, at the request of the GCA.

a. The Process: The GCA will provide written notification to DCSA which will include the individuals’ name and position. DCSA will contact the facility to obtain necessary information for the individuals to start the PCL process.

b. How to Prepare: Identify which personnel may require a PCL during the pre-award phase, or at the start of the contract due to knowledge or a skillset that is necessary immediately to support the mission. Per the DoD Manual 5220.32, Volume 1, Section 4.11 National Industrial Security Program: Industrial Security Procedures for Government Activities, https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522032v1.PD F?ver=1BFNVqOKXaqdXcO618H-yg%3D%3D, The negotiator typically requires

Electronic fingerprints must be submitted to DCSA via Secure Web Fingerprint Transmission (SWFT). There are numerous methods for submitting electronic fingerprints. Most companies that are new to the NISP either receive assistance with this from their prime contractor, another cleared facility or use a third-party service provider. A list of third-party service providers can be found on DCSA’s website https://www.dcsa.mil/is/swft/swftresources/. Please note that the locations listed are headquarters offices and do not indicate all the areas the provider serves. Many providers have nationwide locations or offer fingerprint card conversion services, in which a hard copy fingerprint card can be mailed for conversion to the proper electronic format and uploaded to SWFT. Whatever method or provider you use, you should verify that the fingerprints are being submitted to DCSA via SWFT, as many organizations submit fingerprints to other agencies through other systems.

2.3 Post-FCL Determination

Once DCSA issues an FCL, the facility and KMP are required to comply with 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM Rule) https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117 and implement an effective security program. Your facility’s assigned Industrial Security Representative (ISR) will reach out within 120 days of the FCL being issued to conduct a brief assessment of your facility’s compliance with 32 CFR Part 117 requirements and implementation of the facility security program and insider threat program.

The FCL initial orientation meeting is conducted by an ISR assigned from the local field office after the FCL is granted. Please be prepared to discuss the following topics with the ISR:

• Facility’s 32 CFR Part 117 https://www.ecfr.gov/current/title-32/subtitle-A/chapter- I/subchapter-D/part-117 requirements

• Facility’s Security Program https://www.cdse.edu/Training/Toolkits/FSO-Toolkit/

• Facility’s Insider Threat Program https://www.cdse.edu/Training/Toolkits/Insider-

Threat-Toolkit/

• When requested, provide KMP U.S. citizenship verification (accepted documentation for citizenship is located at: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-

Page | 16

I/subchapter-D/part-117/section-117.10#p-117.10(c)

Page | 17

3.0 FCL Process Overview

A Facility Clearance (FCL), also known as an entity eligibility determination, is an administrative approval for a company to access classified information. To obtain an FCL, a company must prove a legitimate need for access, be organized and located within the United States or its territories and have a history of lawful business conduct. Furthermore, essential key management personnel (KMP) must hold appropriate personnel security clearances, and the company must not be under any unmitigated foreign ownership, control, or influence. The process formally begins when a sponsorship request is accepted and a welcome email is sent, which directs the company to register in the National Industrial Security System (NISS).

The NISPOM Rule defines an FCL as an administrative determination that, from a national security standpoint, a company is eligible for access to classified information at the same or lower classification level as the clearance being granted (32 CFR 117.3(b) https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117/section-117.3#p- 117.3(b)) An FCL may also be called an entity eligibility determination (32 CFR 117.3(b) https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117/section-117.3#p- 117.3(b)) though FCL is the common term.

To obtain an FCL, a facility must meet the eligibility requirements listed in 32 CFR 117.9(c) (https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117/section-117.9) and meet PCL requirements for essential KMP (32 CFR 117.9 ;https://www.ecfr.gov/current/title- 32/subtitle-A/chapter-I/subchapter-D/part-117/section-117.9). It is important to understand to be favorably adjudicated for FCL, a facility must meet the eligibility requirements below and must not pose an unacceptable risk to national security interest.

• Have a legitimate need for the requested FCL, either in terms of access to classified, or other accepted situations.

• Be organized and existing under the of the United States, one of the fifty States, the District of Columbia, or an organized U.S. territory (Guam, Commonwealth of the Northern Marianas Islands, Commonwealth of Puerto Rico, and the U.S. Virgin Islands); or American Indian or Alaska Native tribe under whose laws the entity is chartered has been formally acknowledged by the Assistant Secretary—Indian Affairs, of the U.S. Department of the Interior.

• Be located in the United States or its territories.

• Have a record of integrity and lawful conduct in business dealings.

• The SMO, FSO, ITPSO, and other essential KMPs hold a PCL at the same or higher level than the FCL, and not be excluded from participating in USG contracts or agreements IAW § 117.7(b)(1) https://www.ecfr.gov/current/title-32/section-117.7#p-117.7(b)(1) through § 117.7(b)(3) https://www.ecfr.gov/current/title-32/section-117.7#p-117.7(b)(3).

o Note: a requirement to have background investigations to meet position or contract requirements or for access to a physical space(s) does not meet the eligibility requirements for an FCL. Please ensure you understand how your facility meets this requirement as verification will be emphasized throughout the FCL lifecycle.

• Not be under FOCI to such a degree that access to classified information would be inconsistent with national interest, in the judgement of DCSA as representative of the CSA.

• Maintain sufficient authorized and cleared employees to manage and implement the requirements of the NISP.

• Does not pose an unacceptable risk to national security interest, in the judgement of DCSA as

Page | 18 representative of the CSA.

• Meet all the requirements governing access to classified information.

Once the sponsorship request is accepted, a welcome email will be sent automatically. This is Day 1 of this process. The welcome email identifies specific deadlines for your facility and guides you to register for an account within the NISS, DoD’s system of record for tracking FCL-related actions and information for entities in the NISP.

3.1 FCL Package Submission

Once all the required business documents are collected and reviewed, upload into NISS under the “Submit My FCL Package.” To populate the package and upload documents, you will need to have a NISS account and be using one of the following roles:

• FSO

• Alternate FSO

• Other Security Staff – This role is for anyone else tasked to perform security-related work supporting the FSO or alternate FSO

Once the FCL package has been populated with all required information and documents, submit the FCL package for DCSA’s review. Guidance for submission of the FCL package is located in NISS under the “Access the External Knowledge Base” quick link. Prior to submitting the FCL package, review the applicable Business Structure Slick Sheet and the FCL Package Common Errors List found in Appendix D. This will assist in avoiding many common mistakes, which result in the FCL package being returned for revision and will delay the FCL process. After you have submitted the FCL package, ensure the FCL Package status in NISS has been updated to “Submitted.”

3.2 FCL Upgrade Information

If your facility has been sponsored to upgrade the FCL level, the FCL process is largely the same with some key differences. The facility should have an established NISS account, as well as primary and alternate Defense Information System for Security (DISS) https://www.dcsa.mil/Systems-Applications/Defense-Information-System-for-Security-DISS/ account holders. The facility will submit an FCL package to the assigned ISR and annotate any changes. Note: All FCL upgrades will remain assigned to the local field office, and the FCL packages will be reviewed by the facility’s currently assigned ISR. DCSA will continue to oversee the FCL process and triage for risk indicators.

While completing the FCL upgrade package, the KMP list must be verified or updated in accordance with any changes the facility has made. The KMP may need to submit a new or upgrade PCL request and fingerprints to upgrade their PCLs, if they are not already cleared at the same or higher level than the FCL upgrade. One key difference in the FCL process for an upgrade is that the FSO is responsible for initiating the upgrade PCL investigation request for the KMP, and the alternate DISS account holder will initiate the investigation request for the FSO. The upgrade PCL investigation requests should be initiated once the FSO has submitted the FCL package in NISS. Prompt submission of the FCL package will prevent any

Page | 19 delays in processing times.

It is recommended that when submitting the NISS upgrade FCL package, the FSO reviews and/or updates the SF-328 to ensure it is accurate. The facility’s FCL package will once again be reviewed, triaged, and analyzed for any potential FOCI.

3.3 Expedite Request Guidelines

GCAs may submit a request to expedite via email to Entity Vetting the FCL process at any point for a specific facility if a delay significantly impacts the classified contract. This request allows DCSA to evaluate and potentially prioritize the FCL processing based on the urgency and impact of the situation.

The expedite request must be submitted on the official letterhead of the requesting GCA responsible for the classified contract and must include the following:

Impact Statement:

The GCA should provide a detailed explanation of the potential impact on the classified contract's cost, schedule, and performance if the FCL process is not expedited. This explanation must address any performance consequences that could jeopardize mission success or national security.

Contract Information:

1. The contract number and relevant details about the classified effort

2. A description of the facility's role and responsibilities under the contract

3. Identify the facility by name and CAGE code

Rationale for Expedite:

1. Justification for why the FCL process must be prioritized

2. Any supporting documentation that provides context for the urgency of processing

Once complete, the letterhead memorandum must be signed by an authorized GCA representative and submitted through the Sponsorship Request via NISS. Once submitted, DCSA will evaluate each request on a case-by-case basis. Submission does not guarantee prioritization. The decision to prioritize FCL processing will depend on:

1. The validity and urgency of the stated impacts

2. Resource availability and competing priorities

3. Submission of an expedite request does not guarantee prioritization, but incomplete or vague submissions are likely to result in delays or denials

Page | 20

3.4 FCL Adjudication

The FCL adjudicative process involves a comprehensive evaluation of the facility’s suitability for access to classified information. The FCL eligibility requirements indicate the facility must not pose an unacceptable risk to national security interests, as stated in the Eligibility Requirements https://www.ecfr.gov/current/title-32/part-117#p-117.9(c). As part of this determination, DCSA will consider all available information and weigh various factors, including allegiance to the United States and foreign influence. All doubts will be resolved in favor of national security. The final determination is based on a reasonable judgment of whether granting or continuing the FCL is clearly consistent with the interests of national security.

Category A - Ownership The Concern: Foreign ownership and interests, including, but not limited to business, financial, and property interests, are a national security concern if they result in divided allegiance. There may be a national security concern if circumstances in which a facility may be manipulated or persuaded to help a foreign person, group, organization, or government in a way inconsistent with U.S. interests or susceptible to pressure or coercion by any foreign interest.

Examples that could raise security concerns include but not limited to:

- Foreign Ownership:

o A foreign interest: (A) has the power to control or influence issues affecting the entity's management or operations and/or (B) shares people, processes, or information with the facility that could result in unauthorized access to classified information or adversely affect the performance of a classified contract or agreement.

o Ownership or control, in whole or in part, by a foreign government.

- Unvetted New Ownership:

o A facility merged with or was acquired by another facility and that facility is not eligible for an FCL or cannot be effectively excluded from access to classified operations at the cleared facility.

o Shared people, processes, or information with the new owner that could result in unauthorized access to classified information or have an adverse impact on the performance of classified contracts.

- Other factors that would indicate or demonstrate a capability on the part of foreign interests to control or influence the operations or management of the business organization.

o Cleared facility personnel report to foreign citizens.

o The facility or its management has affiliations with foreign state-owned entities or organizations affiliated with a foreign government.

Page | 21

Category B - Business Operations The Concern: Business activities that may allow an unvetted facility access to classified, sensitive, or proprietary information at the U.S. facility.

- Joint Ventures & Partnerships:

o The facility or its controlling interest has formed a joint venture with a foreign facility or organization.

o The facility or its controlling interest has formed a joint venture with an uncleared facility or organization.

- Supply Chain Concerns:

o The facility or its controlling interest uses foreign sources for parts, components, research and development (R&D), assembly, or software coding in critical defense programs or technology.

o The facility or its controlling interests own or operate subsidiary supply-chain nodes, i.e. factories, warehouses, or distribution centers in a country of special concern.

o Reliance on foreign-produced hardware and software that may include design vulnerabilities that could provide foreign actors with access to a facility’s networks and information.

o Reliance on foreign entities to provide critical parts, components, assembly, coding, R&D, or manufacturing that could affect the quality or availability of the facility’s products or services.

- Legal Business Status:

o The facility or its controlling interest is forfeited, not in good standing, suspended or dissolved.

- Unreported FCL Change Conditions:

o The facility has undergone changes to their business structure to include changes which resulted in foreign ownership, control, or influence that would adversely affect their ability to continue to work on classified contracts.

Category C - Financials The Concern: Failure to satisfy debts and meet financial obligations may indicate poor financial outlook, a lack of judgment or an unwillingness to abide by rules and regulations, all of which can raise questions about a facility’s viability and ability to protect classified or sensitive information. Financial distress can also be caused or exacerbated by, and thus can be a possible indicator of, other issues of security concern. A facility that is financially overextending is at greater risk of insolvency, targeting, pressure, accepting risky foreign investments and insider threats.

Page | 22

- Bankruptcy:

o The facility or its controlling interest has filed for bankruptcy.

- Excessive or Foreign Debt:

o Excessive indebtedness, significant negative cash flow, a history of late payments or of non-payment, or other negative financial indicators.

o Reliance on foreign entities for financing.

- Negative Financial Health:

o The facility or its controlling interest is found to be financially insolvent.

o The facility or its controlling interest is at risk of default.

o A history of not meeting financial obligations.

o Failure to file annual Federal, state, or local income tax returns or failure to pay annual Federal, state, or local income tax as required.

- Foreign Investment:

o The facility or its controlling interest has received direct or indirect investment from a foreign entity.

o The facility or its controlling interest has received private investment from a foreign entity.

- Suspicious Financial Activity:

o Susceptibility or a willingness to compromise sensitive and classified information and technologies in exchange for money or investments to keep the facility viable.

o Sudden unexplained reversal of a negative financial situation or repayment of large debts.

o Deceptive or illegal financial practices such as filing deceptive loan statements and other intentional financial breaches of trust.

o Conducting business or financial activities inside a sanctioned country.

o Receiving loans from individuals or non-financial institutions.

Category D - Personnel Considerations The Concern: Criminal activity creates doubt about an individual’s judgment, reliability, and/or trustworthiness and which may be predictive of their willingness or ability to protect U.S. national security. By its very nature it calls into question a person’s ability or willingness to comply with laws, rules, and regulations. A pattern of conduct, including those for relatively minor offenses, may, when taken in combination cast doubt on the individual’s judgment, reliability, or trustworthiness. Failure to adhere to the laws of the U.S. may be relevant if the violation of law is harmful to stated U.S. interests. An individual who engages in acts against the U.S. or provides support or encouragement to those who do has already demonstrated a willingness to compromise national security.

Page | 23

- Foreign Management and Influence:

o A foreign national is in a position of control that allows them to influence facility management or operations through direct or indirect affiliation.

o Cleared facility key management personnel (KMP) has ties to foreign subsidiaries or foreign facilities, including serving as members of boards or leadership teams.

o The facility KMP are employed on behalf of a foreign government, including foreign intelligence service, foreign military service, foreign diplomatic service, or foreign political office.

- Criminal Activity:

o Facility KMP is engaged in criminal activity, i.e. fraud, embezzlement, money laundering and insider trading.

o Facility KMP is involved in unauthorized technology transfer.

o Facility KMP is involved in economic and government espionage against U.S.

targets.

o Facility KMP is engaged in conduct that is indicative of untrustworthy or unreliability to include breach of client confidentiality, release of proprietary information, unauthorized release of sensitive corporate or government protected information.

- Suspicious Associations:

o Facility KMP associate or engage with a terrorist group or extremist movement (foreign or domestic).

o Facility KMP are found in watch lists in connection with the decisions of a regulatory body for international trade.

o Facility KMP associate or engage with organizations advocating the overthrow of the U.S. Government.

o Facility KMP are associated with the threat of violence, against a current or former Government official or Agency.

- Personnel Security Clearance Eligibility Concerns:

o Essential KMP are uncleared or not cleared to the level of the FCL.

o Personnel reassignments are occurring to circumvent personnel security clearance requirements tied to the facility, even though the individuals' roles and responsibilities remain largely unchanged.

Category E - Business Conduct The Concern: Facilities must have a record of integrity and lawful conduct in their business dealings and not pose an unacceptable risk to national security interest.

- Criminal Activity:

o The facility or its controlling interest is engaged in criminal activity.

- Sanctions/Restrictions:

Page | 24 o The facility or its controlling interest is found on watch lists in connection with the decisions of a regulatory body for international trade.

o The facility or its controlling interest is doing business with an organization found on watch lists in connection with the decisions of a regulatory body for international trade.

o The facility or its controlling interest is subject to international or U.S. sanctions.

- Suspicious Associations:

o The facility or its controlling interest, associate or engage with a terrorist group or extremist movement.

o The facility or its controlling interest, associate or engage with organizations advocating the overthrow of the U.S. Government.

o The facility or its controlling interest, associate or engage with criminal organizations.

- NISP Compliance:

o The facility failed to protect classified, proprietary, or sensitive information (e.g., sharing of protected information, admission of mishandling protected information).

o The facility failed to report a compromise or mishandling of classified information.

o The facility or its controlling interest has been excluded or debarred from performing on government contracts.

o Gross negligence or lax security practices.

o Failure to comply with rules or regulations that result in damage to national security, regardless of whether it was deliberate or negligent.

o Unwillingness to comply or fix known security vulnerabilities.

o Record of non-compliance with pertinent U.S. laws, regulations, and contracts.

3.5 FCL Appeals Process

If a facility’s Facility Clearance is denied or revoked, a written Statement of Reason will be provided. The facility can challenge the decision by submitting a detailed response and opportunity to discuss with government officials. The final determination is based upon the best interest of national security.

3.5.1 The FCL Denial, Revocation, and Appeals Process:

Step 1 – “Intent to Deny or Revoke Package” includes Notice of Intent to Deny or Revoke, Statement of Reasons (SOR) and Opportunity to Respond The “Intent to Revoke Package” is comprised of three documents, which 1) notifies a company of DCSA’s intent to revoke their FCL, 2) lists security concerns within a Statement of Reasons (SOR) which support grounds for revocation, and 3) provides the company an opportunity to respond with clarifying information.

Page | 25

The package is sent to the company’s personnel listed under the firm’s profile within DCSA’s National Industrial Security System (NISS) and consists of the following:

1. Notice of Intent to Revoke/Deny Memorandum:

- Provides a summary of the security concerns and supporting risk information.

- Instructions for responding to the SOR.

- A list and description of the information in the decision to Deny/Revoke FCL determination.

2. SOR:

- Provides the company written notice for the Denial/Revocation.

- Accompanies the Notice of Intent to Deny/Revoke.

- Identifies the reasons based on the FCL Adjudicative Guidelines for the intent to Deny/Revoke.

3. Opportunity to Respond:

- Gives company the opportunity to provide clarifying information, plans to remedy, correction of inaccurate information, or any other information or substantive changes to the factors listed in the SOR within 15 calendar days of the date of the Notice of Intent to Revoke/Deny Memorandum.

- Failure to respond within 15 calendar days will result in the immediate move to issue a denial or revocation. The specific calendar due date will be clearly stated.

Step 2 – Final Determination is made with notification of Appeals Rights When a facility clearance is denied or revoked, the company will receive a notification explaining their right to appeal the decision within 30 calendar days, including the procedures and timelines for doing so.

Purpose of notification of appeals rights include:

Ensures Due Process:

- The right to be notified of adverse actions and to respond.

- Provides a mechanism for challenging adverse decisions.

- Ensure that facility clearance decisions are made in accordance with fair procedures and legal requirements.

Promotes Fairness and Transparency:

- Ensures impartial review of facility clearance appeals.

- Fosters objective consideration of all evidence presented during the appeal process.

- Guarantees companies the opportunity to present their case fully and openly during the appeal.

Step 3 – Appeal Submission The facility’s appeal must clearly and comprehensively state the specific grounds for challenging the decision. In response DCSA must ensure decisions are consistent with overarching DoD policy and legal frameworks for an appeals process.

Examples of appeal submission may include:

Formal Written Document:

- Cite specific information or documents that contradict the agency's findings. Be precise and avoid generalizations.

Page | 26

- Identify the specific regulation, policy, or legal standard that the agency allegedly misapplied or violated.

- Describe the specific corrective actions and enhanced security measures that the facility has implemented to mitigate the agency's concerns.

Request for Meeting with DCSA to Verbally Present Appeal:

- Facility can request to meet with DCSA representatives to state its case.

- Provides an opportunity to respond to follow up or amplifying questions in real-time to aid in the decision-making process.

Step 4 – FCL Denial/Revocation Independent Review Board The primary purpose is to provide an independent review of DCSA's preliminary decision to deny or revoke an FCL which will be submitted to the Associate Director, Industrial Security for a final determination. This helps ensure fairness, impartiality, and adherence to established procedures.

Purpose of the review board:

Objective Assessment:

- The board is comprised of impartial members from different DCSA mission areas.

- Thorough review of all relevant documents, including the documentation to support the recommendation, SOR, the facility's response, witness statements, and any other evidence submitted by either party.

- The review board will make a recommendation to the Associate Director, Industrial Security, after reviewing all relevant information related to the proposed denial or revocation.

- The Associate Director, Industrial Security will consider the review board’s recommendation and make a final determination whether to accept the board’s recommendation and issue a notification letter to the facility.

Clear and Transparent Procedures:

- If the intent to deny or revoke is upheld, the notification letter will include as much detail as possible. Some details may be redacted if supporting information is classified.

Step 5 – Appeal Determinations Appeals decisions will be escalated to the Associate Director for Industrial Security. The Associate Director will review the appeal and will either uphold the initial decision or choose to reinstate or grant the FCL with conditions.

Notification to the Contractor:

- A detailed explanation of why the appeal was or was not granted.

- If the denial or revocation was based on specific security deficiencies, the facility should take steps to correct those deficiencies if they are interested in pursuing an FCL in the future.

- The Associate Director, Industrial Security will consider the review board’s recommendation and make a final determination whether to accept the board’s recommendation and issue a notification letter to the facility.

Page | 27

4.0 FCL Package Submission Guidance

This section details the required business structure documents and KMP list identification to submit in the facility’s FCL…