How do I get a federal security clearance to bid on government contracts in Canada?

What is the Contract Security Program?

The Contract Security Program (CSP) is run by Public Services and Procurement Canada (PSPC). PSPC says organizations bidding on or working under Government of Canada or foreign government contracts with security requirements must be security screened through the CSP. It screens both the organization itself and the employees who need access to protected or classified information, assets or work sites.

The rules organizations must follow are set out in the Contract Security Manual, which applies to organizations registered in the CSP and to the contracts PSPC is responsible for. As part of the screening, the organization signs a legal agreement with the Government of Canada.

The CSP lists four steps for an organization:

1. Get sponsored for screening.
2. Confirm the organization's legitimacy and eligibility.
3. Complete the organization screening and appoint a company security officer.
4. Screen one or more key senior officials, as required.

Can my company apply for a security clearance on its own?

No. Screening starts with sponsorship from an approved source, and PSPC states plainly that "Organizations cannot request a pre-clearance under any circumstance." For Canadian contracts, approved sources include federal procurement, security and project officers, and the security officer of a cleared organization that holds a contract with security requirements and is sponsoring a proposed subcontractor. PSPC adds that "Organizations can only sponsor other organizations by subcontracting."

To be eligible, an organization must meet at least one of these criteria:

• It responded to a solicitation that will lead to a federal contract with security requirements.
• It was awarded a contract or subcontract with security requirements.
• It has signed, or will sign, a lease with security requirements.
• It is an underrepresented supplier, sponsored by a federal approved source.
• It is involved in a multinational program or special activities sponsored by foreign governments or organizations, such as NATO.

It must also be formed or incorporated in Canada, physically located in Canada and registered to do business here. Foreign organizations cannot be sponsored through the CSP. The CSP narrowed eligibility to active participants in a procurement process in Phase 2 of its changes, effective May 2, 2022, after a five-year analysis found that close to 90% of the organizations it had screened had not been associated with a contract or subcontract with security requirements.

What is the difference between a DOS, an FSC and a provisional clearance?

The organization clearance you need depends on the level of information in the contract:

• Designated Organization Screening (DOS): required for contracts at the protected level. The Contract Security Manual says a DOS is required to access Protected A or B information or assets.
• Facility Security Clearance (FSC): required for contracts at the classified level, meaning Confidential, Secret or Top Secret information or assets.
• Provisional security clearance: for pre-solicitation and bid preparation, when your organization needs access to sensitive information to prepare a bid but does not hold the required level. It is valid only for the bid solicitation stage, and you request it through the federal procurement officer overseeing the solicitation, along with a completed AFR form.

Clearances granted on or after May 2, 2022 are valid for 2 years for a DOS and 1 year for an FSC. Renewals are tied to bidding on or holding contracts with security requirements, and PSPC says organization clearances will be terminated if the CSP cannot validate the requirement for a renewal. Upgrading to a higher level also requires sponsorship.

Safeguarding at your own site

A DOS or FSC on its own does not let you keep sensitive material at your office. Document Safeguarding Capability (DSC) allows an organization to view, possess and store protected or classified information and assets at its site, is tied to a specific site and contract, and is approved only after contract award once any corrective measures are in place. Production capability, for building or repairing protected or classified products on site, is a further safeguard approved only after DSC.

What personnel screening do my employees need?

Employees who need access to protected or classified information, assets or work sites as part of a contract, subcontract or lease must be screened before the work begins. PSPC states that "Individuals cannot initiate their own security screenings." Requests are submitted by the company security officer or alternate company security officer on the individual's behalf. The levels are:

• Reliability status: assesses honesty and reliability and grants access to Protected A and B information and assets. The Contract Security Manual says it is typically valid for 10 years.
• Secret clearance: a security clearance assesses an individual's loyalty to Canada and is needed for classified access. Secret clearances are valid for 10 years.
• Top Secret clearance: for Top Secret information and assets, valid for 5 years.

The CSP also lists enhanced security screening for personnel who support security and intelligence functions, and the Contract Security Manual says access to Protected C requires enhanced screening, for which you contact the CSP. The CSP does not charge a processing fee, though applicants pay for their own fingerprints and any police certificates.

Official processing times

PSPC publishes these processing times, counted in business days from receipt of a properly completed request:

• Reliability status: 7 business days for a simple request, 120 for a complex one.
• Secret clearance: 75 business days for a simple request, 120 for a complex one, in addition to the reliability timelines.

A request is complex when it needs extra verification, such as an out-of-country check for time spent abroad or a further review of criminal or credit history. For organizations, PSPC says a DOS takes up to 4 months and an FSC 6 months or more, and that additional organization security safeguards add to these timeframes.

What does a company security officer do, and what is the SRCL?

Every organization screened by the CSP must appoint one company security officer (CSO), the official point of contact with the CSP and accountable to it on all contract security matters. Organizations needing a DOS or FSC with multiple employees should also appoint at least one alternate (ACSO). The CSO must be an employee physically located in Canada, a Canadian citizen (permanent residents are considered case by case), screened at the same level as the organization, and directly accessible to the key senior officials on security matters.

PSPC lists the CSO's responsibilities as including:

• Informing the CSP of changes to key senior officials, legal status, ownership or location.
• Identifying employees who need screening and initiating their requests.
• Reviewing and ensuring adherence to the Security Requirements Check List and the contract security clauses.
• Requesting approval for visits to secure sites.
• Obtaining CSP approval before starting a subcontract with security requirements.

The Security Requirements Check List (SRCL), form TBS/SCT 350-103, is how a contract's security requirements are written down. The Contract Security Manual says the project authority completes it at the beginning of the procurement process, and it is part of the bid solicitation documents. It has four parts: contract information, personnel (supplier), safeguards (supplier) and authorization. Part B lists the screening level suppliers' personnel need, from reliability status through Confidential, Secret and Top Secret to NATO levels and site access.

What should bidders do when a tender has security requirements?

What I see most often is a contractor finding a good federal tender, then discovering the security requirements only days before closing. A few habits help:

1. Open the SRCL first. If a tender has one, it tells you the organization level, the personnel level and any safeguarding the work requires.
2. Check whether you need sensitive information to prepare the bid. If you do and you are not cleared, contact the procurement officer named in the solicitation about a provisional clearance early.
3. Include a complete AFR form with your proposal, and the CSP screening package if you are uncleared. PSPC says the AFR must be signed and dated within the last 6 months, and that incomplete or late information ends the process.
4. Line up your CSO and identify which employees will need reliability status or a clearance, since their screening runs on its own timeline.
5. Plan around the official timelines. The Contract Security Manual says parts of the screening, such as the DOS or FSC, must be completed before a contract is awarded.
6. If you are subcontracting to a prime, know that primes must not require subcontractors to hold a clearance before a sub-solicitation. The prime sponsors you once it holds a contract that allows subcontracting.
7. Once cleared, keep your information current with the CSP. Unreported changes or an unfilled CSO vacancy can lead to compliance enforcement action and affect your ability to bid on future solicitations.