Security Clauses

Security clauses are provisions written into government solicitation documents and contracts. They specify the security levels a supplier must meet to protect sensitive information, assets and work sites. In Canadian federal procurement they are part of the bid documents and the resulting contract, so they set conditions a supplier must satisfy, not guidance it can set aside (Public Services and Procurement Canada).

A Canadian government contract carries security requirements when performance requires access to Canadian, NATO or foreign classified information, assets or sites. Approved security clauses and supplementary remarks included in the contract documentation are legally binding (Contract Security Manual).

The SRCL and the Contract Security Program

Security clauses in Canada come mainly through the Contract Security Program (CSP) run by Public Services and Procurement Canada. The CSP provides security screening for organizations and personnel involved in Government of Canada and foreign-government solicitations and contracts that contain security requirements (Industrial security and contracting).

The requirements are identified through a Security Requirements Check List (SRCL), form TBS/SCT 350-103. The project authority completes the SRCL at the start of the procurement process, and it forms part of the bid-solicitation documents. Requisitions for contracts, standing offers or supply arrangements with a security requirement must include the SRCL, the statement of work and the relevant security documents, including CSP security clauses (CanadaBuys SRCL guidance).

Where security clauses appear

• Bid solicitations and tender notices: the security requirements are stated in the solicitation and supported by the SRCL.
• Contracts: the contracting authority inserts the approved clauses and supplementary remarks, and they are legally binding.
• Standing offers and supply arrangements: the requisition must include the SRCL and the CSP security clauses.
• Subcontracts: a contractor must obtain the applicable clauses from the CSP and insert them into the subcontract (subcontracting security requirements).
• International contracts: clauses can address Canadian, NATO or foreign requirements, and foreign suppliers may receive contract-specific clauses from the CSP.

What a supplier must satisfy

A supplier must meet the security conditions in the solicitation before contract award, and the buyer must confirm that the offeror meets them (CanadaBuys award guidance). Depending on the procurement, a supplier may need to:

• Hold the required organizational security status, such as a Designated Organization Screening.
• Maintain approved document-safeguarding capability at the specified level.
• Ensure personnel who need access to protected or classified information, assets or work sites hold the required security status.
• Obtain written approval before electronically processing, producing or storing protected information on its own information-technology systems.
• Obtain prior written CSP permission before awarding a subcontract that contains security requirements.
• Comply with the SRCL, any security guide and the applicable Contract Security Manual.

The obligations continue during the contract. Clients must verify that the contractor and its personnel hold valid security statuses before they access protected or classified information, assets or sites (CanadaBuys contract security guidance).

NATO security clauses

A NATO contract security clause can set minimum requirements for protecting NATO information. It can cover personnel security, physical security, information security, communications and information-system security, and industrial security (NATO ACT security clause). NATO procurement terms can also require personnel or facility security clearances and additional measures during contract performance (NATO HQ General Terms and Conditions).

What security clauses mean for a supplier bidding on Canadian contracts

Read the SRCL and the security clauses before you decide to bid. They tell you the organizational status, safeguarding capability and personnel clearances you need, and the buyer must confirm them before award. If you plan to subcontract, build in time to obtain CSP clauses and written permission first. Once the contract is signed, the clauses are binding, so keep your organization's and your staff's security statuses valid for the full term.