Getting Started 22 min read

How to Get a Security Clearance for Government Work: The Complete Guide

A complete guide to security clearances for government contractors: why you cannot apply on your own, the FCL and PCL two-track system, FOCI mitigation instruments, the 13 SEAD 4 adjudicative guidelines, DD Form 254 and FAR 52.204-2 contract triggers, interim eligibility, SEAD 7 reciprocity, the public trust vs. clearance distinction, clearance levels from Confidential to TS/SCI, and Trusted Workforce 2.0 continuous vetting.

Tiatun T.

Tiatun T.

Federal Sales Consultant · Apr 24, 2026

Infographic titled How to Get a Security Clearance for Government Work: The Complete Guide, featuring icons for Facility Clearance FCL, Personnel Clearance PCL, Sponsorship and DCSA Process, NISPOM 32 CFR Part 117, and Trusted Workforce 2.0 Continuous Vetting, alongside a silhouetted contractor walking through a vault door labeled Authorized Personnel Only, with a DD Form 254 and SF-86 questionnaire in the foreground, a NISPOM book, a Clearance Approved badge, and the U.S. Capitol in the background

This article explains how security clearances actually work in United States government contracting — from the legal framework and sponsorship requirements to the step-by-step process for both companies and individuals. By the end, you will understand who can sponsor a clearance, what a Facility Clearance (FCL) and Personnel Security Clearance (PCL) are, how adjudication decisions are made, and what the government’s Trusted Workforce 2.0 modernization means for your timeline.


The First Thing Most People Get Wrong: You Cannot Apply on Your Own

Think of a clearance less like a professional license you earn independently and more like a key that a building owner issues you because you work there and need access to do your job.

The single most common misconception is that a person or company can simply “apply” for a security clearance. They cannot. A federal agency or a cleared contractor must sponsor you, and that sponsorship must be tied to a specific, documented need to access classified information — what the regulations call a bona fide need-to-know [3][4].

This sponsorship requirement is codified in the National Industrial Security Program Operating Manual (NISPOM), now found at 32 CFR part 117, which became effective on February 24, 2021, replacing the legacy DoD 5220.22-M manual format [3]. The broader legal authority is Executive Order 12829, which established the National Industrial Security Program (NISP) [4].

Practical implication

You cannot stockpile clearances speculatively. Every clearance must trace back to a contract requirement, a solicitation with classified access needs, or a pre-award sponsorship tied to a specific effort. If you are a subcontractor, your prime — not you — typically initiates sponsorship with the government, which is one reason understanding subcontractor flowdown obligations for classified contracts is critical before you sign a teaming agreement.


Two Parallel Tracks: Facility Clearance (FCL) and Personnel Security Clearance (PCL)

In the contractor world, two types of clearances run in parallel, and confusing them is a costly mistake. The Facility Clearance (FCL) is granted to the company itself. The Personnel Security Clearance (PCL) is granted to the individual people who will actually handle classified material. You generally need both: a cleared facility with cleared people inside it.

How a Company Gets a Facility Clearance (FCL)

A Government Contracting Activity (GCA) or a cleared prime contractor must sponsor your company for an FCL by certifying that a bona fide need for classified access exists on a specific effort. The Defense Counterintelligence and Security Agency (DCSA) then manages the FCL process [3][11].

Before DCSA will process your FCL, your company must meet several prerequisites:

  • Distinct legal entity: Your firm must be a legally organized business (LLC, corporation, etc.) — not a sole proprietorship doing business informally.
  • SAM.gov registration with a Unique Entity Identifier (UEI) and Commercial and Government Entity (CAGE) code. GovBidLab’s free UEI Lookup tool can help you confirm your identifiers are active and correct — a common stumbling block in FCL applications.
  • Key Management Personnel (KMP) identified: You must designate a Senior Management Official (SMO) and a Facility Security Officer (FSO). Both must be U.S. citizens.
  • Foreign Ownership, Control, or Influence (FOCI) review: DCSA evaluates whether any foreign entity has ownership, control, or influence over your firm. If FOCI exists, you must implement an approved mitigation measure before the FCL can be granted.

The table below summarizes the common FOCI mitigation instruments, ranging from least restrictive to most restrictive:

Mitigation Instrument When Typically Used Level of Restriction
Board Resolution Minor foreign interest, no controlling influence Least restrictive
Security Control Agreement (SCA) Foreign ownership exists but is not controlling Moderate
Special Security Agreement (SSA) Foreign entity has significant ownership or control High
Proxy Agreement Foreign entity is effectively the owner; U.S. proxy board governs Very high
Voting Trust Agreement Similar to Proxy; voting rights transferred to cleared U.S. trustees Most restrictive

FOCI timing warning

For small businesses considering acquisitions or foreign investment, FOCI mitigation should be addressed early in due diligence — not after you win a contract. A delayed FOCI resolution can stall an FCL for months, and an unmitigated FOCI finding can result in FCL denial.

The FCL is issued at the level required by the highest classification the company will handle: Confidential, Secret, or Top Secret. That level dictates the rigor of your internal security program, your information system accreditation requirements, and your incident-reporting obligations under 32 CFR part 117 [3].

How an Individual Gets a Personnel Security Clearance (PCL)

Once your company holds (or is processing) an FCL, the sponsoring employer initiates a clearance request for each individual who needs classified access. The individual then completes Standard Form 86 (SF-86) through the government’s eApp system. Fingerprints are submitted, and for higher clearance levels such as Top Secret, a subject interview is conducted by a background investigator [3][6].

Adjudication follows the 13 national Adjudicative Guidelines established by Security Executive Agent Directive 4 (SEAD 4), issued by the Office of the Director of National Intelligence (ODNI) [6]. These 13 guidelines are not pass/fail checklists; adjudicators weigh the “whole person” against factors including:

  • Allegiance to the United States
  • Foreign influence and foreign preference
  • Financial considerations (debt, bankruptcy, unexplained wealth)
  • Drug involvement and substance misuse
  • Criminal conduct
  • Personal conduct (honesty and candor)
  • Handling protected information
  • Psychological conditions, sexual behavior, alcohol consumption, outside activities, use of information technology, and other factors

Candor is non-negotiable

Having a financial issue or past drug use does not automatically disqualify you. Adjudicators assess recency, frequency, mitigation, and the likelihood of recurrence. What will almost certainly disqualify you is dishonesty on the SF-86. Candor is a core adjudicative value.

Non-U.S. citizens generally cannot be granted a security clearance. In limited, narrowly defined cases, a Limited Access Authorization (LAA) may be issued — up to the Secret level — for specific needs, but this is the exception, not a planning assumption [3].


The Contract Instruments That Trigger the Whole Process

How does a contractor know that a contract involves classified work? Two key instruments provide the answer.

FAR 52.204-2 (Security Requirements)

The contracting officer includes this clause in the solicitation and resulting contract whenever access to classified information is required [1]. Found in FAR subpart 4.4 (Safeguarding Classified Information Within Industry), it puts the contractor on notice that NISP rules apply.

DD Form 254 (Contract Security Classification Specification)

The single most important security document on a classified contract. It specifies the classification levels involved, what classified access the contractor needs, where classified work can be performed, and what safeguarding requirements apply [2]. Prime contractors must flow down a DD 254 to each cleared subcontractor.

Proposal managers take note

Ensure the DD 254 is complete and accurate before onboarding subcontractors. An incomplete or incorrect DD 254 is one of the most frequent causes of delays in getting subcontractor personnel cleared and onto a program. Review DFARS 204.404-70 and PGI 204.4 for the DoD-specific requirements governing DD 254 preparation and distribution [2].


Interim Clearances, Reciprocity, and the Public Trust Distinction

Interim Clearances

The government can grant interim eligibility — a temporary clearance — after favorable initial checks (such as a clean fingerprint return and favorable review of the SF-86), allowing a person to begin classified work while the full investigation continues. Interim eligibility is not guaranteed, and it can be withdrawn at any time if derogatory information surfaces during the investigation [3]. For program managers planning staffing timelines, interim eligibility is often the critical path item, not the final adjudication.

Reciprocity

SEAD 7 requires that agencies accept existing, current clearances from other agencies when the underlying investigation and adjudication are current and comparable [8]. In practice, if an employee already holds a valid Secret clearance adjudicated by one agency, another agency should not require a brand-new investigation for Secret-level access. There are limited exceptions — for example, agencies with mission-unique access requirements such as Sensitive Compartmented Information (SCI).

When reciprocity is not honored, it often comes down to administrative friction or incomplete records in the government’s personnel security systems. Practitioners should ensure their employees’ clearance records are current in the Defense Information System for Security (DISS) — or its successor components under the National Background Investigation Services (NBIS) platform — before assuming reciprocity will be seamless.

Public Trust vs. Security Clearance

A frequent source of confusion: a public trust determination is not a security clearance. Public trust positions (designated as moderate or high risk) involve access to sensitive but unclassified information and are adjudicated under 5 CFR part 731 (suitability and fitness for government employment) [9]. Security clearances, by contrast, authorize access to classified national security information. Understanding the distinction matters because the sponsoring process, investigation scope, and legal authorities differ significantly between the two.


Trusted Workforce 2.0: What Is Changing

The federal government is in the midst of a major modernization effort called Trusted Workforce 2.0 (TW 2.0), and it fundamentally changes how cleared personnel are monitored after their initial clearance is granted [10].

Under the legacy model, cleared personnel underwent periodic reinvestigations — every 5 years for Top Secret and every 10 years for Secret and Confidential. TW 2.0 replaces this calendar-based approach with continuous vetting (CV), sometimes called “enroll and monitor.” Instead of a full reinvestigation every five or ten years, the government continuously checks automated data sources — financial records, criminal databases, travel data, and other feeds — and triggers a deeper investigation only when a new risk indicator emerges [10].

For proposal and program planning, the practical takeaway is that clearance maintenance is becoming less about “when is the reinvestigation due” and more about “is the person’s record clean on an ongoing basis.”

Separate but parallel requirements

Do not confuse clearance requirements with cybersecurity compliance requirements. Programs that require classified access (governed by NISPOM and FAR 52.204-2) increasingly also require compliance with Controlled Unclassified Information (CUI) handling rules under DFARS 252.204-7012 and NIST SP 800-171, as well as DoD’s Cybersecurity Maturity Model Certification (CMMC). These are parallel but legally distinct obligations. GovBidLab’s free CMMC Calculator can help you estimate your current posture.


Clearance Levels at a Glance

Clearance Level Classified Access Authorized Investigation Scope Legacy Reinvestigation Cycle TW 2.0 Approach
Confidential Confidential information Tier 1 / Tier 3 (varies) Every 15 years (historically), then 10 years Continuous vetting
Secret Secret and Confidential Tier 3 investigation Every 10 years Continuous vetting
Top Secret Top Secret, Secret, and Confidential Tier 5 investigation (formerly SSBI) Every 5 years Continuous vetting
TS/SCI Top Secret + Sensitive Compartmented Information Tier 5 + additional IC adjudication Every 5 years + polygraph (some IC agencies) Continuous vetting + IC-specific requirements

Note: TS/SCI is not technically a separate “clearance level” — it is Top Secret eligibility plus an additional SCI access determination made by the Intelligence Community. But in contractor recruiting and BD, it is universally treated as a distinct category.


Positioning Your Company for Classified Work

If you are a small or mid-sized firm trying to break into classified contracting, the process is not as impenetrable as it looks, but it does require deliberate sequencing. You cannot get a clearance without a sponsor, and you will not get a sponsor without demonstrating credible capability on a relevant effort. This is where learning how to win government contracts at the unclassified level first — building past performance, relationships with primes, and a solid capability statement — creates the foundation for entering the classified space.

A well-crafted capability statement is often your first introduction to a cleared prime who might sponsor your FCL. GovBidLab’s free Capability Statement Generator can help you build one that clearly articulates your differentiators, past performance, and socioeconomic designations — all of which matter when a prime evaluates whether to invest in sponsoring your facility clearance.

BD professionals: monitor these signals

Monitor solicitations on SAM.gov for the presence of FAR 52.204-2 and references to a DD 254. These are your signals that a contract involves classified work. Start your FCL and FOCI discussions before the proposal is due — not after award. Treating security compliance as a capture activity, not an afterthought, is what separates experienced cleared contractors from those who lose time after award.


What to Do Next

If you are new to this process, start by confirming your company’s SAM.gov registration, UEI, and CAGE code are current and accurate — these are non-negotiable prerequisites before DCSA will even open an FCL case. Then identify whether any upcoming contract opportunities you are pursuing include FAR 52.204-2 or reference a DD 254. If they do, reach out to the prime contractor or contracting officer to discuss sponsorship and timeline before proposal submission.

For individuals: understand that your clearance journey begins when an employer sponsors you — focus on keeping your financial, legal, and personal records in order so that the SF-86 process goes smoothly.

Explore GovBidLab’s free tools — including the UEI Lookup, NAICS Code Lookup, and CMMC Calculator — to verify your registrations and assess your readiness today.


Glossary of Terms Used in This Article

Term Definition
AdjudicationThe government’s formal process of reviewing a completed background investigation and deciding whether to grant, deny, or revoke a security clearance based on national guidelines.
Bona fide need-to-knowA legitimate, documented requirement for a person or company to access specific classified information in order to perform on a contract or government mission.
CAGE codeA five-character identifier assigned to entities that do business with the federal government, used in procurement and logistics systems.
CMMCA DoD framework requiring contractors to meet specific cybersecurity standards to handle Controlled Unclassified Information. Separate from clearance requirements.
Continuous vetting (CV)An ongoing, automated review of cleared personnel using government databases, replacing the older model of periodic reinvestigations at fixed intervals.
CUI (Controlled Unclassified Information)Government information that requires safeguarding but is not classified. Governed by different rules than classified information.
DCSAThe federal agency responsible for administering the NISP, processing facility and personnel clearances for industry, and overseeing contractor security programs.
DD Form 254The document attached to a classified contract that specifies what classification levels apply, what access the contractor needs, and what safeguarding measures are required.
DFARSDoD-specific additions to the FAR that impose additional requirements on defense contracts.
DISSThe government IT system that tracks personnel security clearances and facility clearances. Being replaced by components of NBIS.
eAppThe electronic application system used by individuals to complete the SF-86 questionnaire. It replaced the older e-QIP platform.
FARThe primary set of rules governing how federal agencies buy goods and services from contractors.
FCL (Facility Clearance)A determination that a contractor’s facility meets the security standards required to access, handle, and store classified information at a specified level.
FOCIA condition where a foreign entity has the power, direct or indirect, to influence a U.S. company’s management or operations. Must be mitigated before an FCL is granted.
FSO (Facility Security Officer)The individual at a cleared contractor responsible for managing the company’s industrial security program on a day-to-day basis.
GCAThe specific federal office that awards and administers a contract.
IC (Intelligence Community)The collective group of 18 U.S. government organizations that carry out intelligence activities, including CIA, NSA, DIA, and others.
KMP (Key Management Personnel)Senior officers, directors, or partners of a contractor who hold positions that could influence the company’s management or policies regarding classified information.
LAA (Limited Access Authorization)A narrow authorization that may allow a non-U.S. citizen to access classified information up to the Secret level under specific, limited circumstances.
NBISThe government’s next-generation IT platform for background investigations and personnel vetting, replacing legacy systems including DISS.
NISPThe government-wide program, established by E.O. 12829, that governs how classified information is shared with and protected by private industry.
NISPOMThe operating manual for the NISP, now codified at 32 CFR part 117. It sets the rules contractors must follow when handling classified information.
PCL (Personnel Security Clearance)A determination that an individual is eligible to access classified information at a specified level.
SAM.govThe federal government’s official system where entities register to do business with the government, find contract opportunities, and manage entity data.
SCI (Sensitive Compartmented Information)Classified intelligence information that requires special access controls and handling beyond those for ordinary Top Secret information.
SEADPolicy directives issued by the Director of National Intelligence governing personnel security standards across the federal government.
SF-86The detailed questionnaire that individuals must complete as part of the background investigation for a security clearance, covering personal history, finances, foreign contacts, and other areas.
SMO (Senior Management Official)The executive at a cleared contractor who has ultimate authority and responsibility for the company’s security program.
TW 2.0 (Trusted Workforce 2.0)A government-wide reform initiative modernizing how personnel are vetted, including the shift from periodic reinvestigations to continuous vetting.
UEI (Unique Entity Identifier)The unique identifier assigned to entities registered in SAM.gov, replacing the former DUNS number.

References

  1. FAR Subpart 4.4, “Safeguarding Classified Information Within Industry,” and FAR 52.204-2, “Security Requirements.” Federal Acquisition Regulation (GSA/DoD/NASA). https://www.acquisition.gov/far/subpart-4.4
  2. DFARS 204.4 and PGI 204.4, “Administrative Matters — Safeguarding Classified Information Within Industry.” Defense Federal Acquisition Regulation Supplement. https://www.acquisition.gov/dfars/204.4
  3. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM).” Department of Defense. Effective February 24, 2021. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117
  4. Executive Order 12829, “National Industrial Security Program.” The White House, January 6, 1993 (as amended). https://www.archives.gov/federal-register/executive-orders/1993.html
  5. Executive Order 12968, “Access to Classified Information.” The White House, August 2, 1995 (as amended). https://www.archives.gov/federal-register/executive-orders/1995.html
  6. Security Executive Agent Directive (SEAD) 4, “National Security Adjudicative Guidelines.” Office of the Director of National Intelligence (ODNI), effective June 8, 2017. https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines.pdf
  7. Security Executive Agent Directive (SEAD) 3, “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position.” ODNI. https://www.dni.gov/index.php/ncsc-how-we-work/ncsc-security-executive-agent/ncsc-sead
  8. Security Executive Agent Directive (SEAD) 7, “Reciprocity of Background Investigations and National Security Adjudicative Determinations.” ODNI. https://www.dni.gov/index.php/ncsc-how-we-work/ncsc-security-executive-agent/ncsc-sead
  9. 5 CFR Part 731, “Suitability,” and 5 CFR Part 1400, “Designation of National Security Positions.” Office of Personnel Management (OPM). https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-731
  10. Trusted Workforce 2.0 Policy Materials. Office of the Director of National Intelligence (ODNI) and Office of Personnel Management (OPM). https://www.opm.gov/investigations/suitability-executive-agent/policy/trusted-workforce-2-0/
Getting StartedSecurity ClearanceFCLDCSANISPOM