The defense industrial base is expanding, and the Department of War is actively recruiting new entrants, from venture-backed startups building autonomous systems to established IT services firms pivoting to classified work. But before any company can touch classified information, it must obtain a Facility Clearance (FCL) from the Defense Counterintelligence and Security Agency (DCSA). The FCL process is rigorous, time-sensitive, and unforgiving of incomplete submissions. Companies that understand the process before they enter it will save months. Companies that do not will learn the hard way and pay more for the lesson.
What Is a Facility Clearance, and Why Does It Matter?
An FCL is an administrative determination that a company is eligible to access classified information at a specified level: confidential, secret, or top secret. It is governed by the National Industrial Security Program Operating Manual (NISPOM), codified at 32 C.F.R. Part 117, and administered by DCSA on behalf of the Department of War and other federal agencies.
The significance extends beyond a single contract. An FCL positions a company to compete for classified work across the defense and intelligence communities, and it signals to prime contractors and government customers that the company has been vetted and is operationally ready. For startups, the FCL can be the difference between remaining a promising concept and becoming a viable defense supplier.
DCSA’s Role: Sponsor, Investigator, Adjudicator
DCSA is the cognizant security agency for the National Industrial Security Program (NISP), the partnership between the federal government and private industry to safeguard classified information. DCSA accepts sponsorship requests, reviews FCL packages, investigates potential security risks, including Foreign Ownership, Control, or Influence (FOCI), and ultimately adjudicates whether a company should receive a clearance. After the FCL is granted, the agency continues to oversee the facility’s security program through its industrial security representatives in field offices nationwide.
DCSA considers itself a partner with industry, but one with clear expectations. The agency evaluates the entire business organizational structure and relationships, not just the entity seeking clearance. If there are parent companies, private equity sponsors, or multiple tiers in the corporate chain, DCSA will examine all of them.
The Sponsorship Requirement: Getting in the Door
A company cannot self-nominate for an FCL. The process begins when a government contracting activity (GCA) or a cleared contractor (acting as a prime) submits a sponsorship request through DCSA’s National Industrial Security System (NISS). The sponsorship must establish that the company has a legitimate need to access classified information in connection with a specific contract.
The sponsorship request should be a collaborative effort between the sponsor and the company being sponsored. Incomplete or inaccurate sponsorship submissions are a leading cause of early rejections, a needlessly protracted process, and additional expense. DCSA has been clear: Submitting numerous incomplete requests will delay the overall process. Before the sponsorship is even submitted, the company should have its Commercial and Government Entity (CAGE) Code, its SAM.gov registration and UEI, and a designated facility security officer (FSO) ready to go.
The FCL Process: From Welcome Email to Clearance Grant
Once DCSA accepts sponsorship, a welcome email is sent, and the clock starts. From that point, the company has 20 days to submit its FCL package through NISS. The package must include formation and governance documents, a legal organizational chart identifying ownership and control percentages, the DD Form 441 (the security agreement with the U.S. government), the SF-328 (Certificate Pertaining to Foreign Interests), and a complete list of key management personnel (KMP).
KMP identification is where many companies stumble. Essential KMP, typically the senior management official (SMO), FSO, and Insider Threat Program senior official (ITPSO), must hold personnel security clearances (PCLs) at or above the level of the FCL sought by the company. Occasionally, some essential KMP might apply for their personal security clearance as the company seeks its FCL. Other individuals with ownership, control, or management authority will also appear on the KMP list. Those not required to be cleared must be formally excluded through an exclusion resolution. DCSA makes the final determination on who qualifies as an essential KMP based on the entity’s business structure and governance documentation.
After the package is submitted, DCSA reviews it for completeness during approximately the Day 20–45 window. If the package is incomplete, DCSA returns it with a detailed explanation. The company gets one chance to correct and resubmit. If the resubmission remains deficient in any respect, DCSA will discontinue the process. This is not a drill; the company will need to start over with a new sponsorship.
Assuming the package clears review, DCSA proceeds with a comprehensive adjudication evaluating the company’s eligibility against the requirements of 32 C.F.R. § 117.9(c). All doubts are resolved in favor of national security. An interim FCL may be granted once there is no unmitigated FOCI and the essential KMP have interim eligibility determinations. A final FCL requires all essential KMP to hold final-level clearances.
Common Pitfalls That Delay or Derail Applications
The most consistent theme across DCSA guidance is this: Preventable errors are the No. 1 cause of FCL processing delays. The agency’s own Common Errors List identifies recurring problems that are worth studying before submission.
Organizational chart deficiencies top the list. The legal organizational chart must reflect all U.S. and foreign parent companies, subsidiaries, branches, sister companies, and affiliates, with ownership and control percentages clearly identified. Mismatches between governance documents and the KMP list, such as listing titles that do not appear in the operating agreement or bylaws, will trigger a return. Failure to account for all authorized stock shares, including unissued shares and ESOPs, is another frequent issue.
On the SF-328 and DD Form 441, companies routinely submit them unsigned, improperly witnessed, or signed by individuals who lack the authority to execute agreements on behalf of the company. Affirmative answers on the SF-328 require detailed explanations; vague or incomplete responses will not suffice. And as of May 2025, DCSA implemented a significantly revised SF-328 with expanded disclosure requirements, including a threshold for reporting foreign-sourced revenue reduced to just 15%. The updated form is mandatory for all new FCL applications.
Perhaps the most critical and most controllable factor is responsiveness. Failure to communicate with DCSA, failure to meet provided due dates, and failure to submit PCL investigation requests and fingerprints on time are each independent grounds for discontinuation.
Special Considerations for Startups and Emerging Defense Companies
Defense industry startups face every challenge that established contractors face, plus a few that are uniquely their own. The most significant is FOCI.
Many startups have foreign investors on their cap tables, whether through venture capital funds with foreign limited partners, strategic investments from multinational corporations, or convertible notes held by foreign nationals. DCSA evaluates FOCI across five broad categories: ownership, business operations, financials, personnel considerations, and business conduct. Any direct or indirect investment from a foreign entity is a potential concern. Private equity involvement adds complexity because DCSA must identify all stakeholders with 5% or greater interest on a fully diluted basis, across every tier of the ownership structure.
The presence of FOCI does not automatically disqualify a company. Still, it will extend processing timelines and may require implementation of a FOCI mitigation instrument, such as a Security Control Agreement, Special Security Agreement, Voting Trust, or Proxy Agreement. Mitigation is not a quick process, and deviating from DCSA’s standard templates triggers additional layers of review.
Startups should also be aware of what is coming. On May 7, 2026, the Department of Defense published a proposed rule to extend FOCI disclosure and mitigation requirements to unclassified contracts valued at more than $5 million, implementing Section 847 of the FY2020 National Defense Authorization Act. When finalized, this rule is projected to expand DCSA’s annual FOCI caseload severalfold, a transformation that will affect thousands of contractors who have never interacted with DCSA, and the added demand on DCSA resources will almost certainly extend the average processing time for applications. Companies with complex ownership structures, including those with private equity sponsors, sovereign wealth fund investors, or multinational parent companies, should begin FOCI exposure assessments now.
The Bottom Line
The FCL process rewards preparation. Companies that invest the time to understand their own corporate structure, identify their KMP, prepare accurate documentation, and engage proactively with DCSA will move through the process efficiently. Companies that treat it as a box-checking exercise will find themselves in a cycle of returned packages, missed deadlines, and potential discontinuation.
For startups entering the defense market, the stakes are even higher. FOCI issues that could have been addressed early can become existential if discovered mid-process. A proactive posture that maps your ownership structure, cleans up your cap table, and engages experienced counsel before submitting the sponsorship request is not optional. It is the cost of entry. The defense industrial base needs new entrants, but DCSA will not lower the bar to get them through the door.