1. Defense Security Service Facility Sponsorship Process for a sponsor and sponsored company
October, 2017
Presented by:
Jeremy Hargis
Defense Security Service

2. Eligibility requirements (NISPOM 2-102)
Facility Clearances (FCLs) in the National Industrial Security Program (NISP)
A facility clearance (FCL) is an administrative determination that, from a national security standpoint, a company is eligible for access to classified information at the same or lower classification category as the clearance being granted.
Eligibility requirements (NISPOM 2-102)
Need access to classified information in connection with a legitimate government requirement.
Lawfully organized and existing
Have a reputation for integrity and lawful conduct
Not under significant Foreign Ownership, Control, or Influence
In order to be eligible for an FCL, an organization’s employees must need access to information that is classified at the FCL level requested. A requirement to have background investigations to meet position or contract requirements (such as IT-I, IT-II or HSPD-12 requirements or to obtain a CAC) or for access to a physical space (such as unescorted access to a military installation or to enter a SCIF or SAPF) is not the same as a requirement to access classified information and does not meet the eligibility requirement for an FCL.

3. FCL Process Overview
The initial FCL process changed in to increase transparency, improve communication of expectations, and streamline the FCL process. The improved process establishes specific deadlines a new company must meet in order to successfully complete the FCL process.
Phase 1 (by Day 20): Submit complete business records in the National Industrial Security System (NISS)
Phase 2 (by Day 45): Submit complete investigation requests via the Electronic Questionnaires for Investigations Processing (e-QIP) system for Key Management Personnel (including electronic fingerprints within 14 days of submission)
The focus of this presentation will be on how the requirements for business records and key management personnel determinations differ by business structure. This information may also be applicable to existing cleared companies considering changing business structures or reporting other change conditions.
Disclaimer: All examples used are fictitious and should not be associated with specific organizations. Examples are based on TYPICAL business terminology, associated roles and responsibilities, and the most common scenarios. However, every organization is different and each organization’s complete information will be reviewed as a whole and analyzed on its merit. Organizations applying for an FCL should carefully review the guidelines in the FCL Orientation Handbook and the NISPOM along with their own business records to identify which information applies to their organization and consult appropriate legal counsel, if necessary. DSS cannot provide business advice and nothing in this presentation should be construed as such advice.

4. The sponsor role within the FCL process
Validate the sponsored company is capable of meeting eligibility requirements
Does the company have a reputation of lawful conduct?
Is the company ready to meet all requirements within the FCL process?
If FOCI is involved, ensure the company is briefed and the impact of the FCL issuance timelines.
1. Uploading documents
Legal business records filed with Secretary of State offices or other regulatory jurisdictions required by law to demonstrate eligibility for an FCL in accordance with NISPOM 2-102b. Examples are Articles or Certificates or Incorporation/Organization, business licenses, fictitious name certificates, etc.
Documents required to identify KMPS. KMPs are the individuals or entities holding senior management official authority or positions that would enable them to adversely affect the organization’s policies or practices in the performance of classified contracts and their roles and responsibilities. Examples are Bylaws, Operating Agreements, Partnership Agreements, JV Agreements, and Meeting Minutes.
Documents required to understand significant changes to the business structure. Examples include Certificate of Name Change, Certificate of Conversion, Asset Purchase Agreements, Stock Transfer documents, or Meeting Minutes.
Exclusion Resolutions
*Note that the names of some business record vary depending on the state. However, if the e-FCL package seems to be indicating that you are to provide different documentation than you have, you may have chosen the wrong Business Structure type.
2. Completing forms
SF-328; Certificate Pertaining to Foreign Interests
Summary Data Sheet
KMP List
Tiered Parent List
DD Form 441/DD Form 441-1
Miscellaneous Documents
The business records and KMPs vary the most depending on business structure so we’ll discuss those for each business type in a few minutes. First, let’s tackle the other forms.
Before you can complete the required forms for the e-FCL submission, you must gather the required business documents* for your organization and review them carefully so that you can identify your organization’s business structure, key management personnel (KMP), and tiered entities. You can obtain this information by referring to specific business documents, typically the document that evidences the creation/existence of the organization as a legal entity.
*Depending on the state your company is organized under, some business documents may be named differently or are not required.

5. The sponsor role within the FCL process
Officially sponsor the company for an FCL
Sponsor is required to issue a DD Form 254 to the company per NISPOM 7-102
Sponsor is responsible for submitting a sponsorship letter and DD Form 254 to DSS.
Sponsorship letter and DD Form 254 is required to be complete and provide a detailed justification for the requested FCL when sent to DSS.
Sponsor is responsible for validating the request has been accepted by DSS.
UNCLASSIFIED

6. The sponsor role within the FCL process
Advise and assist the company during the FCL process
Recommend participation in telephonic survey call with DSS and company
Ensure company understands discontinue points within the FCL process and meets the required timeframes for submission of information
Assist with submission of required information within NISS
Assist with submission of required e-QIPs and fingerprinting
These documents do not vary substantially by business type. Please consult the e-FCL Submission Site User Guide for guidance on completing these forms.

7. The sponsor role within the FCL process
Value of sponsor being directly involved in FCL process
Increased probability the FCL process will be conducted efficiently and effectively, assisting your company with meeting deliverables on the classified contract
Decreased probability the FCL process will be discontinued due to missed timeframes, delaying performance and negatively impacting your company
Sponsor could earn enhancement for category 4: Information/Product Sharing w/in Community
UNCLASSIFIED

8. General FCL Process
A complete initial NISS package consists of two main sections:
Uploading business records
Legal business records
Documents required to identify KMPs
Significant changes to business structure
Completing forms
SF-328; Certificate Pertaining to Foreign Interests
Summary Data Sheet
KMP List
Tiered Parent List
DD Form 441/DD Form 441-1
Miscellaneous Documents
Exclusion Resolutions
UNCLASSIFIED

9. Key Management Personnel (KMP) General Information
The term KMP encompasses the Facility Security Officer (FSO), the Insider Threat Program Senior Official (ITPSO), all owners (if people), officers, and members of the management or executive board (including the Chairman). All persons holding these positions, as described in the business records should be listed on the KMP list, regardless of whether they require a PCL or access to classified information.
The Senior Management Official (SMO) is required to be cleared in connection with the FCL in accordance with NISPOM The SMO is the person who is the senior management authority of the organization per the organization’s business documents.
The FSO is designated by the organization and is responsible for supervising and directing security measures necessary for implementing applicable requirements of the NISPOM.
The ITPSO is the senior official responsible for establishing and executing the organization’s insider threat program.
We’ll discuss the specific business types next and I’ll cover KMP lists for each type as we go through them. However, I first want to define a few KMP terms.
Officers that should be listed on the KMP list must be identified in the business records. The most common confusion stems from the title of Vice President in a corporation. A corporate Vice President listed in the by-laws would be listed on the KMP list. A Senior Vice President of Operations would not be listed on the KMP list (unless Senior Vice President of Operations is designated in the bylaws).
When identifying the SMO and who needs to be cleared, DSS looks at the roles and responsibilities in addition to the titles used. The titles discussed in the slides that follow are the based on the TYPICAL responsibilities associated with that role.
One of the biggest reasons for rejection of e-FCL packages is that information provided does not match business documents. It is not uncommon for an organization’s officials to use a different title, in practice, than they hold in the business documents. The most common example of this is a Chief Executive Officer, or CEO, of a Limited Liability Company, or LLC. Most LLCs are governed by members or managers and do not designate corporate-style officers, such as a CEO, in their Operating Agreements. However, the people managing these companies often use the title of CEO because it is more recognizable in the business world. For the purposes of the KMP List and e-FCL package, an organization must use the official titles recorded in business documents. If a person’s actual responsibilities do not align with those outlined in the business documents, it may not be possible for DSS to determine when, or if, the organization meets the eligibility requirements for an FCL.
Likewise, any positions required on the KMP list that are indicated as required for the organization in its business records must be listed on the KMP list, even if vacant (if this is the case, the position title should be added using the “Add Vacancy” feature). An example of this is a corporation whose bylaws state that its Board of Directors will consist of 3 Directors but it has only elected 2 Directors. This corporation would list the 2 elected Directors and make a third Director entry using the “Add Vacancy” feature. On the other hand, if a corporation’s bylaws state the corporation may have up to 3 Directors, this corporation would enter only the 2 elected Directors on the KMP list.
The FSO, ITPSO, and SMO must be US citizens, employees of the company, and cleared to the level of the FCL.

10. Key Management Personnel (KMP) Exclusions
Some non-SMO/FSO/ITPSO KMP positions must also be occupied by individuals who are cleared to the level of the FCL, while others may be occupied by individuals who are excluded in accordance with NISPOM
Generally, a KMP may be excluded when the organization’s executive body affirms that the person in this position will not require or have access to classified information and does not occupy a position that would enable them to adversely affect the organization’s policies or practices in performance of classified contracts.
This must be supported by business documents describing the position responsibilities.
Note that it is not enough to say the person will not require access to classified information in order to “exclude” them. They must also not be in a position that would enable them to adversely impact classified contracts. The most common example of this is a person who is authorized to enter into contracts on behalf of the company.
Each organization should make a preliminary identification of KMP who may be excluded and prepare, execute, and provide appropriate exclusion resolutions in their e-FCL package. This will be validated through analysis of the complete e-FCL package upon receipt.
The decision regarding who must be cleared and who can be effectively excluded as KMPs of a cleared company will take into account the need to keep clearances to a minimum while also operating in the best interest of national security. Any KMP who requires access to classified information must be cleared regardless of their KMP role.

11. FCL process for Branch Office/Division
Branch/division offices only require a clearance if they require the ability to safeguard classified information that is under DSS cognizance
For branch offices that do require an FCL:
Home office (HOF) must always be cleared to the same or a higher level as the branch office
BUSINESS DOCUMENTS REQUIRED:
Any business records of the legal entity that apply specifically to the branch office
KMP list
DD Form 441-1
KMP IDENTIFICATION:
*SMO is the person with highest management authority at that office and does not have to be designated in the business documents
*FSO
*ITPSO
A BRANCH OFFICE or DIVISION is a separate location of an existing legal entity. Because they are part of the same legal entity, they must have the same legal name.
A BRANCH OFFICE or DIVISION only requires a separate FCL if it will need to be able to safeguard collateral classified information within that office. If it will need to exclusively safeguard classified information that is not under DSS cognizance, a FCL issued by DSS is not required, but other requirements will need to be met as determined by the organization that does have cognizance. If no safeguarding is needed at the branch office, administrative security requirements, such as PCL processing and training, are handled by the home office (HOF) via their security program.
For branch offices that do require an FCL:
Home office (HOF) must always be cleared to the same or a higher level as the branch office
BUSINESS DOCUMENTS REQUIRED:
Any business records of the legal entity that apply specifically to the branch office, such as meeting minutes establishing a new office location
KMP list
DD Form 441-1: Signed by home office
A LEGAL ORGANIZATION CHART shows a business entity’s ownership and connections to other business entities. It is recommended that all business entities provide a legal organization chart, regardless of its simplicity, to show a visual representation of the ownership of the organization.
KMP IDENTIFICATION:
SMO (specific to site)
FSO
ITPSO – must be listed on the branch office KMP list even if this is a corporate-wide ITPSO

12. Resources FCB Website: http://www.dss.mil/isp/fac_clear/fac_clear.html
DSS Improved FCL Process Webinar: pdf
FCL Orientation Handbook: clearances/FCL_Orientation_Handbook_18FEB15.pdf
e-FCL Submission Site User Guide: FCL_Submission_Site_User_Guide.pdf
E-FCL Submission Requirements Job Aid: sion_Requirements_Final_Job_Aid.pdf

13. UNCLASSIFIED
Questions?