Security Clearance Requirements (Personnel and Facility)

Security clearance requirements are the screening conditions that Canadian government contracts place on both people and organizations before they can access protected or classified information, assets, or sensitive worksites. In federal procurement they have two parts: personnel security screening for employees, and a facility security clearance (FSC) or other organization-level screening for the contractor.

Public Services and Procurement Canada (PSPC) administers the Contract Security Program (CSP), which carries out this screening. A personnel security clearance is required before an employee may access classified information, assets, or worksites. A facility security clearance is required for an organization to obtain contracts at the classified level. The level needed depends on the sensitivity of the information, assets, or worksite and on the contract's security requirements.

Reliability status and security clearance: the personnel levels

Canada uses two families of personnel screening. Reliability status is used for access to Protected A, Protected B, and Protected C information, assets, or worksites. A security clearance is used for access to classified material at the Confidential, Secret, and Top Secret levels.

Clearance alone does not authorize access. The need-to-know principle still applies, so access must also be necessary for the person's duties.

Facility security clearance and the Company Security Officer

The FSC is the organization-level counterpart to an employee's clearance. A supplier seeking organizational screening must appoint a Company Security Officer (CSO) and, where required, an Alternate Company Security Officer (ACSO). These representatives handle security-screening administration and compliance on the supplier's behalf. PSPC publishes guidance on the roles and responsibilities of the security officer.

Common Security Requirement Check Lists published by PSPC include clauses requiring the contractor or offeror to maintain a valid FSC at the specified level throughout the performance of the contract or standing offer.

How the SRCL and solicitation clauses trigger screening

The Security Requirements Check List (SRCL) is the contract document that identifies the applicable security requirements. Federal departments and agencies trigger CSP screening through the security requirements identified for their contracts. Where an SRCL specifies a requirement, the contracting client must verify that the contractor and its personnel maintain valid security statuses throughout the contract.

Security requirements appear where a supplier or its personnel may access protected or classified information, protected or classified assets, sensitive government worksites, or government systems and cloud-service portals. RCMP contracts can extend requirements to subcontractors. One RCMP contract security guide states that contractor and subcontractor personnel must hold a clearance or status appropriate to the work, in place before work begins and maintained for the life of the contract.

NATO contracts add their own clearances

For NATO work, a NATO FSC gives an organization access, at the appropriate level, to NATO Confidential, NATO Secret, or COSMIC Top Secret information and assets. A Canadian organization may need the CSP to validate its NATO FSC before it bids. Once the organization holds the required NATO FSC, it can request NATO personnel security clearances for employees who need access. A NATO security briefing follows after the employee's Canadian personnel security clearance has been granted.

What it means for a supplier bidding on Canadian public contracts

Read the SRCL and the security clauses in every solicitation first. Work out whether the requirement covers personnel screening, organization screening, or both, because an employee's clearance does not stand in for an organization's FSC.

• Obtain or maintain the required organization screening, and appoint a CSO and, where required, an ACSO.
• Submit personnel-security forms and supporting information through the CSP.
• Make sure employees are screened at the required level before access or work begins.
• Confirm that subcontractor personnel meet the same requirements.
• Keep every status and clearance valid for the full contract term.
• For NATO bids, secure FSC validation, personnel clearances, and security briefings at the level the solicitation specifies.

PSPC's information toolkit for suppliers sets out the steps in order.