Company Security Officer (CSO)

A Company Security Officer (CSO) is the person an organization appoints to act as its official point of contact with the Contract Security Program (CSP) at Public Services and Procurement Canada (PSPC). The CSO is accountable to the CSP for contract-security matters, so every message about the organization's security status, clearances and obligations runs through this role. PSPC sets out the role in its roles and responsibilities guidance for security officers.

The CSO also ensures that the organization meets the applicable security requirements throughout the contract lifecycle. The term belongs to Canada's federal industrial-security framework and appears alongside the Alternate Company Security Officer (ACSO). It is closely tied to organization security clearances, personnel security screening, protected or classified information, NATO clearances and the Contract Security Manual.

Appointing a CSO for organization screening

An organization must appoint a CSO in order to be screened by the CSP. PSPC's guidance on appointing a security officer states that CSP-screened organizations must appoint one CSO, and that this applies to all types of organization security clearances. An ACSO may also be required or appointed alongside the CSO.

The CSO must be security-screened at the same level as the organization. A company seeking a clearance at a given level therefore needs a CSO who holds screening at that level.

Organization screening is not optional for security-sensitive work. Organizations bidding on Government of Canada or foreign-government solicitations that include security requirements must be screened through the CSP, as described on PSPC's page on obtaining security screening for an organization.

What the CSO does during a contract

The Contract Security Manual applies to organizations registered in the CSP and to Canadian or foreign contracts for which PSPC is responsible. These are contracts that require an organization to safeguard government information or assets, or to access protected or classified information.

• After award, the organization must give its CSO the contract's security requirements and the Security Requirements Check List (SRCL).
• The CSO must ensure those security requirements are met throughout the contract lifecycle.
• The CSO must also ensure they are met before anyone gains access to protected or classified information.

The full duties are set out in the Contract Security Manual.

Personnel clearances, subcontracts and NATO briefings

The CSO controls several specific transactions with the CSP.

• Personnel clearances: only a CSO or ACSO may request an individual's security clearance on behalf of an organization registered in the CSP. See PSPC's page on the security clearance request.
• Subcontracts: for security-sensitive subcontracting, the prime contractor's CSO or ACSO must complete the relevant SRCL and private-sector organization-screening forms and obtain the required security clauses. The rules are on the subcontracting security requirements page.
• NATO work: for employees who need a NATO clearance, the CSO or ACSO requests the NATO security briefing, briefs the employees on their responsibilities and retains the signed briefing record.

What a CSO means for a supplier bidding on Canadian public contracts

If a solicitation carries security requirements, your organization needs a screened CSO before it can be cleared through the CSP. Name the person early, confirm that they hold screening at the level the organization is seeking, and consider appointing an ACSO as well. Once a contract is awarded, route the SRCL and the contract's security requirements to the CSO. If you plan to subcontract security-sensitive work, your CSO or ACSO handles the paperwork for the subcontractor.