Security in Contracts

Security in Contracts is the set of security requirements, controls and processes that a department establishes, documents, applies and monitors for contracts or other arrangements involving sensitive information, assets, sites or systems. The requirements depend on the sensitivity of the information or assets, the location and type of work, and whether the supplier must safeguard, process or produce sensitive information or assets.

In the Government of Canada, the term is a formal security-control heading in the Treasury Board Secretariat's Directive on Security Management. It appears in the Mandatory Procedures for Security in Contracts and Other Arrangements. NATO procurement applies the same concept through contract-specific security clauses and security packages for contracts involving NATO classified information.

What the Treasury Board procedures require of departments

The mandatory procedures place the main duties on the contracting department. A department must define security requirements that apply to all of its contracts or arrangements. It must also establish a process for identifying the security requirements of each specific contract or arrangement.

Those requirements are not uniform. They are based partly on the sensitivity of the information, assets or sites involved, and on the location and type of work. Departments must also verify and monitor supplier compliance and integrate security considerations into their procurement processes. The full text is published by the Treasury Board Secretariat.

Controls that can appear in a contract

For contracts involving sensitive information, assets, sites or systems, departmental controls can fall into three groups:

• Physical security for the sites or assets involved.
• Information-system security for systems that hold or process sensitive information.
• Administrative or operational controls, such as security points of contact, subcontractor management, security awareness and training, and incident reporting and response.

A given contract may use some or all of these, depending on what the supplier will handle and where the work takes place.

How NATO contracts apply security requirements

NATO contracting authorities use security clauses where the contractor will access or generate NATO classified information, material or equipment, or needs unescorted access to NATO Class II security areas. A NATO contract security package can include a Contract Security Clause, Programme/Project Security Instructions, a Security Classification Guide and a Security Aspects Letter, as set out in the ACT General Terms and Conditions.

The contractor is responsible for safeguarding NATO classified information, material and equipment entrusted to it or generated during contract performance. It must comply with NATO requirements and with the applicable national security authority or designated security authority.

NATO general terms for site-access contracts also require suppliers and their personnel to follow site-security instructions. Where NATO facility or personal clearances are required, the supplier must clarify the applicable additional security measures before work or deliveries begin. These terms are published in the NATO Headquarters general terms and conditions.

Clearances and the Facility Security Officer

Some NATO solicitations require clearances for both the company and its people. One example is an invitation for bid that calls for a minimum NATO Secret Facility Security Clearance for the contractor and NATO Secret Personal Security Clearances for the employees performing the work.

For contracts involving NATO classified information or unescorted access to NATO Class II areas, NATO terms may also require the contractor to appoint a Facility Security Officer. This person supervises contract security measures and liaises with the relevant security authorities.

What it means for a supplier bidding on Canadian public contracts

Security requirements are set contract by contract, so read each solicitation for the sensitivity of the information, assets or sites involved and the type and location of the work. Expect the department to verify and monitor your compliance once the contract is awarded.

Plan for the administrative controls as well as the physical and system ones. These include a named security point of contact, management of subcontractors, security awareness and training, and a process for reporting and responding to incidents. If you pursue NATO-related work, confirm early whether the solicitation requires facility and personal clearances or a Facility Security Officer, and clarify any additional security measures before work or deliveries start.