Security Clearance Guide for Defense Contractors

Security Clearance Guide for Defense Contractors

Most defense contractors understand that classified work requires clearances. Far fewer understand how the clearance process actually works, why it fails so often, or what they can do to avoid the delays that routinely cost companies six to twelve months and hundreds of thousands of dollars. This guide covers the full process: facility clearance, personnel clearance, the agencies involved, and the specific steps a company must take to get cleared and stay cleared.

Why Clearances Matter

Approximately 70,000 security-cleared positions remain unfilled across the defense industrial base (Source: ClearanceJobs Cleared Workforce Data, ClearanceJobs, 2024). The defense sector’s attrition rate runs at approximately 15%, more than double the cross-industry U.S. average (Source: Aerospace & Defense Workforce Report, Amtec, 2026). McKinsey’s analysis of the aerospace and defense talent gap found that productivity losses from talent shortages could cost a median-sized company over $300 million annually (Source: Workforce Challenges in A&D, PwC/McKinsey, 2025).

These numbers describe a structural bottleneck. Companies that hold clearances and maintain cleared workforces have access to contract vehicles that their competitors simply cannot reach. But the process to get there is neither fast nor forgiving.

Facility Clearance vs. Personnel Clearance

The clearance system operates on two distinct tracks, and both must be satisfied before a company can access classified information.

Facility Clearance (FCL) is the organizational determination. It establishes that a company, as an entity, meets the physical security, information security, and governance standards required to handle classified material at a specific level. An FCL is granted to the company, not to individuals within it.

Personnel Security Clearance (PCL) is the individual determination. It establishes that a specific person is trustworthy and eligible to access classified information. Personnel clearances are held by individuals, sponsored through their employer, and investigated by the Defense Counterintelligence and Security Agency (DCSA).

A company cannot begin processing personnel clearances until it holds a valid facility clearance. And a facility clearance has no operational value until cleared personnel are in place to execute classified work. The two processes run in sequence, not in parallel, which is why timeline planning matters so much.

FCL Classification Levels

Facility clearances are granted at three levels, each corresponding to the classification of information the facility will handle:

Confidential. The lowest classification level. Unauthorized disclosure could cause damage to national security. Relatively few contracts require only Confidential access; most classified work begins at Secret.

Secret. The most common clearance level for defense contractors. Unauthorized disclosure could cause serious damage to national security. The majority of classified contracts in the defense industrial base are at the Secret level.

Top Secret. The highest standard clearance level. Unauthorized disclosure could cause exceptionally grave damage to national security. Top Secret FCLs require more rigorous physical security, more extensive personnel investigations, and significantly longer processing timelines.

A facility cleared at a higher level can access information at that level and below. A Secret facility clearance covers both Secret and Confidential material. A company must specify the FCL level it seeks, and the sponsoring government agency must validate the need.

The Defense Counterintelligence and Security Agency (DCSA)

DCSA is the federal agency responsible for administering the National Industrial Security Program (NISP). It conducts background investigations for personnel clearances, processes facility clearance applications, monitors cleared contractor compliance with the National Industrial Security Program Operating Manual (NISPOM, 32 CFR Part 117), and maintains the National Industrial Security System (NISS), the online portal through which FCL packages are submitted and tracked.

DCSA replaced the former Defense Security Service (DSS) in 2019 and has since consolidated personnel vetting and industrial security functions under a single agency. As of early 2026, DCSA reported reducing its investigation backlog from approximately 290,000 cases to 222,000, a 24% reduction, though substantial backlogs remain (Source: Federal News Network, May 2025).

The FCL Process: Step by Step

Step 1: Obtain a Sponsoring Contract or Agreement

A company cannot self-initiate a facility clearance. Sponsorship is required. This typically comes from one of three sources:

• A classified contract or subcontract with a government agency (the DD-254, “Contract Security Classification Specification,” is the governing document)
• A pre-contract determination, where an agency anticipates classified work and sponsors the FCL in advance
• A prime contractor that subcontracts classified work and provides sponsorship through the prime’s industrial security program

Without sponsorship, the FCL application will not be accepted.

Step 2: Register in NISS

The National Industrial Security System is the DCSA online portal for submitting and managing facility clearance packages. The company must create an account, designate a Facility Security Officer (FSO), and begin compiling the required documentation.

Step 3: Prepare and Submit the FCL Package

The FCL package includes several components, and the quality of the submission determines whether the package moves forward or gets returned. The core documents include:

• Standard Form 328 (Certificate Pertaining to Foreign Interests): Discloses all foreign ownership, control, or influence. DCSA released a significantly revised SF-328 in May 2025, the first major update in seven years, expanding disclosure requirements and adding a new legal attestation (Source: DCSA SF-328 Update, DCSA, May 2025).
• DD Form 441 (Security Agreement): Establishes the company’s contractual obligation to comply with the NISPOM.
• Key Management Personnel (KMP) documentation: Identifies officers, directors, and individuals who will hold personnel clearances.
• Legal organization chart: Must match state filings exactly.
• Exclusion resolutions: Board resolutions excluding foreign nationals or uncleared individuals from access to classified information, if applicable.

Step 4: Survive the Review

This is where the process breaks down for most companies. FCL package submissions have a rejection rate exceeding 70%, with the average company requiring 2.5 submission cycles before receiving approval (Source: FCL Bottleneck Analysis, ISI Defense, 2025). Common rejection reasons include:

• Incomplete or inconsistent FOCI disclosures on the SF-328
• KMP documentation gaps
• Legal organization charts that do not match state corporate filings
• DD-441 execution errors (wrong signatories, missing dates)
• NISS submission errors and formatting issues

Each rejection cycle adds weeks to months. Companies that invest in professional FSO support and pre-submission review avoid the most common errors.

Step 5: Undergo DCSA Security Vulnerability Assessment

Once the package is accepted, DCSA will conduct a security vulnerability assessment of the facility. This evaluates physical security measures (alarm systems, access controls, classified storage), information security infrastructure, and overall compliance readiness.

Step 6: Receive FCL Determination

Upon successful completion, DCSA issues the facility clearance at the appropriate level. The company can then begin sponsoring personnel clearances for employees who will access classified information.

Personnel Clearance: The SF-86 and Investigation Process

Once a company holds an FCL, individual employees must obtain personnel security clearances. The process begins with the SF-86.

The SF-86 Questionnaire

Standard Form 86 (Questionnaire for National Security Positions) is the foundational document for personnel clearance investigations. It collects information across the following areas (Source: Standard Form 86, OPM):

• Personal identifying information, citizenship, and dual nationality
• Residence, education, and employment history (typically 10 years)
• Family members, associates, and personal references
• Foreign contacts, travel, activities, and financial interests
• Criminal history, including arrests without conviction
• Financial delinquencies, bankruptcies, and collection actions
• Drug and alcohol involvement
• Mental health treatment (limited scope)
• Prior clearances and security violations
• Subversive activities and association with organizations advocating violence

Most applicants complete the SF-86 through e-QIP (Electronic Questionnaires for Investigations Processing), the web-based submission system. The form is extensive; a thorough, accurate submission typically requires 10 to 20 hours of preparation plus document gathering.

Investigation Tiers

DCSA conducts investigations at two primary tiers for national security positions:

Tier 3 (T3): Supports Secret and Confidential clearances. Includes a national agency check, credit check, and investigation of the most recent five years of employment and residence history. Current 90th-percentile completion time is approximately 120 days, with government targets of 40 days (Source: Security Clearance Timeline, ClearedJobs.Net, 2026).

Tier 5 (T5): Supports Top Secret clearances. Includes everything in T3 plus a full field investigation covering personal interviews, reference checks, law enforcement checks, and a full scope of the most recent 10 years. Current 90th-percentile completion time runs approximately 270 days, with government targets of 75 days (Source: Security Clearance Timeline, ClearedJobs.Net, 2026).

Adjudication

After the investigation, an adjudicator reviews the findings against 13 national security adjudicative guidelines. These cover allegiance, foreign influence, foreign preference, sexual behavior, personal conduct, financial considerations, alcohol consumption, drug involvement, psychological conditions, criminal conduct, handling of protected information, outside activities, and misuse of information technology. Not every derogatory finding results in denial; the adjudicator evaluates the “whole person” concept, weighing mitigating factors against security concerns.

Foreign Ownership, Control, or Influence (FOCI)

FOCI is one of the most complex and consequential areas of the clearance process. A company is considered to be under FOCI when a foreign interest has the power, direct or indirect, to direct or decide matters affecting the management or operations of the company in a manner that could compromise classified information (Source: NISPOM, 32 CFR Part 117, DoD).

When FOCI Applies

FOCI determinations are triggered by:

• Foreign ownership of company stock or assets
• Foreign board representation or management control
• Foreign debt, licensing agreements, or technology-sharing arrangements
• Foreign government contracts or obligations
• Beneficial ownership by foreign persons or entities

FOCI Mitigation

If FOCI is identified, the company must implement a mitigation instrument approved by DCSA. Common instruments include:

• Board Resolution: For minimal foreign influence where the foreign interest does not own a controlling share
• Security Control Agreement (SCA): For cases where the foreign interest is a minority owner without operational control
• Special Security Agreement (SSA): For cases of significant foreign ownership, requiring a Government Security Committee and independent board oversight
• Proxy Agreement / Voting Trust Agreement: For cases of majority foreign ownership, where foreign owners must transfer all voting rights to cleared U.S. citizens

FOCI mitigation can add 6 to 18 months to the clearance timeline and requires ongoing compliance reporting. Companies with foreign investment should address FOCI early, ideally before pursuing an FCL.

Insider Threat Programs

All cleared contractor facilities are required to establish and maintain Insider Threat Programs under NISPOM 32 CFR Part 117 and Executive Order 13587. An Insider Threat Program must include:

• A designated Insider Threat Program Senior Official (ITPSO)
• Training for all cleared employees on recognizing and reporting insider threat indicators
• Monitoring and audit procedures for user activity on classified systems
• Reporting procedures for potential insider threats to DCSA
• Annual self-assessments and documentation of program activities

DCSA reviews Insider Threat Programs during security vulnerability assessments. Non-compliance can result in adverse FCL actions, including suspension or revocation.

Processing Timelines and Cost Expectations

Timeline Reality

The end-to-end timeline from initial sponsorship to operational cleared capability is substantially longer than most companies expect:

Phase	Typical Duration
FCL package preparation	2 to 4 months
FCL review and processing (including rejections)	4 to 12 months
Personnel clearance investigation (Secret/T3)	2 to 5 months
Personnel clearance investigation (Top Secret/T5)	5 to 12 months
Adjudication	1 to 3 months
Total (Secret, first-time company)	9 to 24 months
Total (Top Secret, first-time company)	12 to 31 months

These timelines are improving. DCSA reported reducing its initial investigation backlog to approximately 100,000 cases by January 2026, down 65% from the start of 2025 (Source: DCSA Backlog Update, DCSA, January 2026). But for individual companies, the variance remains significant.

Cost Factors

The clearance process itself does not carry direct government fees. However, indirect costs are substantial:

• Facility Security Officer (FSO) staffing or outsourced FSO services: $50,000 to $150,000+ annually
• Physical security upgrades (alarm systems, access controls, classified storage): $25,000 to $200,000+
• FOCI mitigation (if applicable): $100,000 to $500,000+ in legal and structural costs
• Insider Threat Program development and maintenance: $20,000 to $75,000 annually
• Lost revenue during processing delays: varies, but often the largest cost

Common Mistakes and How to Avoid Them

Mistake 1: Submitting the FCL package without professional review. The 70%+ rejection rate exists because companies underestimate the documentation standards. Engage an experienced FSO or industrial security consultant before your first NISS submission.

Mistake 2: Underestimating FOCI complexity. Companies with any foreign investment, board representation, or licensing arrangements should consult FOCI counsel before beginning the FCL process. Discovering FOCI issues mid-process can reset the entire timeline.

Mistake 3: Treating the SF-86 as a formality. Incomplete or inaccurate SF-86 submissions are the leading cause of personnel clearance delays. Invest the time upfront to gather documentation, verify dates, and disclose fully. The adjudicative process is more forgiving of disclosed issues than of discovered omissions.

Mistake 4: Not planning for the full timeline. Companies that assume a six-month clearance timeline and build business plans around that assumption routinely face cash flow pressure when the process extends to 12 or 18 months. Plan for the realistic range, not the optimistic case.

Mistake 5: Neglecting continuous compliance. Receiving an FCL is not the end. DCSA conducts recurring security reviews, and cleared companies must submit change condition reports (SF-328 updates, KMP changes, adverse information) within prescribed timeframes. Non-compliance triggers adverse actions.

How US Defense Group Can Help

US Defense Group works with defense technology companies that are navigating the clearance process for the first time or scaling their cleared operations. Our portfolio companies and advisory clients benefit from:

• FCL preparation support: Guidance on package preparation, NISS submission, and pre-submission review to avoid the 70%+ rejection rate on first submissions
• FSO services and infrastructure: Access to experienced Facility Security Officers and classified infrastructure through our network
• FOCI analysis and structuring: For companies with foreign investment or ownership, early-stage FOCI analysis and mitigation planning to prevent timeline delays
• Cleared workforce development: Strategies for recruiting, retaining, and pipeline-building cleared technical talent in a market with 70,000+ unfilled positions
• Compliance program development: Insider Threat Programs, NISPOM compliance, and ongoing security posture management

Next Steps

The clearance process rewards preparation and punishes improvisation. Whether you are a defense technology startup pursuing your first classified contract, a commercial company entering the defense market, or an established contractor scaling your cleared operations, the steps are the same: understand the requirements, prepare the documentation thoroughly, and build relationships with the right advisors before you need them.

Sources

• ClearedJobs.Net: Security Clearance Timeline 2026
• Federal News Network: DCSA Backlog of Security Clearance Investigations Down 24%
• DCSA: Personnel Vetting Initiative Transforms Security Clearance Investigation Process
• ISI Defense: The Facility Clearance Bottleneck
• DCSA: Facility Clearance Process Guide (NISS)
• OPM: Standard Form 86
• Amtec: U.S. Aerospace & Defense Workforce Data 2026
• PwC: Workforce Challenges in Aerospace and Defense
• ClearanceJobs: Security Clearance FAQs
• FedBiz Access: Complete Security Clearance Guide for Government Contractors 2025
• Holland & Knight: DCSA Updates Facility Security Clearance Package Submission Procedures
• iQuasar: Security Clearance Timelines and Costs in 2026