One sentence in 32 CFR 117.9(a)(10) decides whether your company can hire a cleared engineer this year: “A contractor or prospective contractor cannot apply for its own entity eligibility determination.” Someone else has to ask, and until they do, no employee of yours may touch classified information.

Why can’t a company apply for its own facility clearance?

Because the FCL answers a government question, not a business one. The right to initiate belongs to a government contracting activity (GCA) or an already-cleared contractor. DCSA puts it in seven words: contractors cannot sponsor themselves for an FCL.

A sponsor may act “at any point during the contracting or agreement life cycle … (including the solicitation or competition phase).” The gate is not strictly post-award; it opens whenever classified access becomes necessary. Know what it is. DCSA’s Facility Clearance Branch put it plainly in a June 2022 briefing: an FCL “is not a clearance for a specific location, site or building, but is granted based on the ownership, authority and control of the KMPs.” They inspect your cap table, not your lobby.

Who can sponsor you, and which route is realistic?

Two sponsor types exist: a government contracting activity, or, in the rule‘s words, “a currently cleared contractor.” No minimum level is attached, so do not rule out a SECRET-cleared partner sponsoring you into TOP SECRET. The level rule at 117.9(a)(5) binds a prime to hold an FCL at or above its subs’; that governs performance, not who may sponsor.

The prime route is not a favour. Section 117.17(a)(2)(i) makes the prime verify a sub’s eligibility in the CSA-designated database, and its duty to initiate is broader than the pre-award case most explainers cite. Paragraph (a)(2)(ii) is unconditional: if a prospective sub lacks the determination, “the prime contractor will request that the CSA of the subcontractor initiate the necessary action.” Press for that post-award too. Section 117.17(a)(3) then keeps processing alive when eligibility cannot be granted in time for the current bid.

Thin justification kills sponsorships. Two of the briefing’s five top rejection reasons name the defect outright: no obvious bona fide need for classified access, and a solicitation with no pre-award classified requirement. The rest are paperwork: missing GCA authorization above NISPOM baseline, an incorrect DD-254, and a request that contradicts it.

How long does an FCL take?

Nobody knows, and the government says so. DCSA’s FAQ answers with “DCSA is unable to provide a timeline due to many variables.” No DCSA, GAO or budget document publishes an average days-to-FCL figure; the day counts circulating online come from vendor blogs.

Two deadlines are published, both counted from the Welcome Email NISS sends on accepting the sponsorship. DCSA’s current Facility Clearances page puts governance documents and forms at Day 20, and says “the KMP investigation request submission and electronic fingerprints are due by Day 45.” Each date “is provided in the Welcome Email and does not exclude weekends or holidays.”

Ignore the fingerprint grace period still circulating from the 2021 FCL Orientation Handbook, which allowed prints “within 14 days after” the request. DCSA’s live page and its own June 2022 roadmap slide both put fingerprints on Day 45 alongside the request. Booking prints for Day 46 to Day 59 blows a hard deadline, and DCSA names facility responsiveness “by the deadline dates” as the first thing driving FCL processing time.

Day 45 is your deadline to submit, not DCSA’s to decide, and not wholly yours to drive: the roadmap conditions it, “once FCL Package is approved, FSOs will submit KMP e-QIPs and fingerprints,” and on an initial sponsorship “FCB will initiate e-QIPs for KMPs who need to be cleared.” You cannot file until DCSA has reviewed the Day-20 package and opened the request, so if that has not landed by roughly Day 30, call the Knowledge Center. Hitting the milestones, the briefing adds, “does not mean the FCL process is finished.”

The queue is the one real trend line. DCSA’s FY2027 budget justification reports pending cases at 247 for FY2025, down from 307 and 482. That is a snapshot of a queue, not a duration. Converting 247 cases into weeks is invented arithmetic.

Your own bench moves the schedule more than the queue. The handbook warns that a company whose essential KMP lack clearances at the required level “may experience significant time impacts,” and that any KMP who has not held one in more than 24 months restarts with a fresh SF-86. A CFO whose clearance lapsed in 2023 is your critical path, the same arithmetic as the time-to-billing problem.

An interim FCL can bridge the gap, but its two halves come from different places. Section 117.9(h) grants it in the CSA’s “sole discretion” and sets no criteria; the three conditions companies are measured against come from the 2021 handbook, not the rule: no unmitigated foreign ownership, KMP cleared at the interim level, orientation done.

What does DCSA require before it will say yes?

Nine conditions in 117.9(c), structural not procedural: a legitimate need for classified access, organization under US or federally acknowledged tribal law, a US location, a record of integrity, cleared people in three named roles, no disqualifying foreign ownership, enough cleared employees, no unacceptable security risk, and whatever else the CSA demands.

Two of the nine read wider or narrower than summaries suggest. Condition (2) has a second branch: an entity chartered under the laws of an American Indian or Alaska Native tribal entity qualifies where the tribe is “formally acknowledged by the Assistant Secretary—Indian Affairs,” the entity exists under a tribal statute, code or legislative resolution, and it files charter records for the CSA’s tribally-chartered determination. Tribal and Alaska Native corporations are not shut out, but carry three documentary conditions nobody else does. Condition (5) is not only that the SMO, FSO and ITPSO hold clearances: they must also “not [be] excluded from participating in USG contracts or agreements.”

Three roles carry names: a senior management official, a US-citizen facility security officer and a US-citizen insider threat program senior official, all three cleared, one employee allowed to hold more than one post. “Key management personnel” reaches past that, covering anyone holding majority interest or stock and anyone with “direct or indirect authority to influence or decide issues affecting the management or operations of, the entity or classified contract performance.” A silent investor with a board veto qualifies. Being KMP is not the same as being required to hold a clearance, but exclusion is not yours to elect. Under 117.7(c) other KMP go on the list “subject to CSA concurrence,” and the CSA then either requires them cleared or “allow[s] the entity to formally exclude” them. DCSA’s page: it “will make the final determination of which KMPs are required to be cleared.” The board resolution, whose wording Table 1 to 117.7(c)(2) dictates verbatim, executes that decision rather than making it. So collect SF-86 data and a personal email for every borderline investor-director and parent officer.

One prerequisite genuinely sits outside the regulation: the CAGE code. Get it first, via SAM.gov or the Defense Logistics Agency; DCSA warns that starting without one can cause “significant delays or discontinuation.” The forms are not housekeeping. Section 117.11(c) requires the SF 328, 117.7(b)(2)(ii) the FSO and ITPSO appointments in writing, and 117.7(c)(2) prescribes the exclusion resolution’s language word for word, so do not draft it freehand. Only DD Form 441 sits outside part 117. Processing is government-funded, so the real bill is compliance with 32 CFR part 117, which is where the money goes.

Why do two-thirds of FCL packages come back?

DCSA’s December 2025 newsletter says it plainly: of roughly 1,500 to 1,700 packages a year, 67% are returned because something was missing or incomplete. Three causes are named: ownership charts, SF 328 answers, and KMP lists that contradict the governance documents.

The chart failure is the one DCSA lists first, and the most avoidable. Companies submit org charts of people when DCSA wants a chart of companies resolving upward to whoever controls the ultimate parent. On the SF 328, DCSA singles out question 5, foreign contracts, where “vague or incomplete explanations” most often send a package back. The foreign ownership question is no checkbox: under 117.11(a)(3), an entity later found under FOCI is ineligible until mitigation satisfies the CSA.

A DCSA memo effective 1 March 2023 published numbers from the other end of the pipe: sponsorship packages cycled 1.93 times on average with a 53% rejection rate, initial or upgrade FCL packages 2.5 times with a 70% rejection rate, against a target of 1.1 and 15%. Do not read the 2025 figure as an improvement on those. Returned and rejected are different events, and the 67% blends package types the memo reported separately.

That memo also put teeth in the second attempt: a sponsorship package resubmitted with the same defects is rejected and pulled from the queue; an FCL package in that position is discontinued, though the sponsorship survives.

Should you be chasing an FCL at all?

Often, no. DCSA discontinues packages where the contract needs IT-level access, suitability determinations or base access rather than classified access, and says those investigations belong to the government activity. A background-check requirement is not a classified-access requirement.

The Orientation Handbook is unusually direct: needing background investigations for a position, a contract or physical access “is not the same as a requirement to access classified information and does not meet the eligibility requirement for a Facility Clearance.” Companies burn quarters on that misreading. If your scope is controlled unclassified data, your obligation runs through CMMC instead.

Oversight after entry is the second caveat. GAO reported in April 2026 that roughly 5,000 facilities, 40% of the program, hold no classified material on site and are supervised remotely by one center, the NAESOC. Participants in all 12 of GAO’s focus groups reviewed it badly, though they were 80 DCSA regional staff, 24% of that workforce, not industry describing its own service.

The data cutting the other way deserves equal space. DCSA’s December 2025 newsletter counts 4,652 rated security reviews for fiscal 2025 against a target of 4,000, over 99% satisfactory or higher and 711 superior. That is not a regime failing at its core function. The two government counts disagree: the FY2027 budget logs 4,591 reviews under a different label, and it is the budget figure that generates the coverage number. DCSA reaches roughly 49% of the 9,370 facilities requiring annual assessments, and officials told GAO that each year a review slips they find 1.5 to 2.5 times more vulnerabilities.

What the clearance lets you do, and what it does not

It makes your entity eligible for access. It does not authorize you to store anything: access eligibility and approval to safeguard classified material on site are separate determinations under 117.9(a)(3). You need both.

A prime needs its own FCL even when all the classified work sits with subcontractors, at its subs’ level or higher. You may not advertise the clearance: 117.9(a)(9) forbids using a favorable entity eligibility determination “for advertising or promotional purposes.” The carve-out in that paragraph is the commercially important half, re-published to industry by DCSA in February 2026: you may advertise positions that require a personnel clearance. That is the line between marketing your FCL and sponsoring individual clearances.

The FCL has no expiry date. It runs until terminated or revoked, and if it goes, 117.9(n) gives two lawful paths: return all classified material to the appropriate GCA “or dispose of the material as instructed by the CSA.” Wait for that instruction. The sanction to fear is the intermediate one: while a determination is invalidated, 117.9(o) bars you from new classified contracts, though existing ones may continue if the GCA agrees. The FY2027 budget logs 24 invalidations and no revocations in fiscal 2025.

Frequently Asked Questions

Can we bid on a classified contract without a facility clearance?

Usually yes. Section 117.17(a)(1)(ii)(A) says prospective subcontractors “are not required to possess an entity eligibility determination to receive or bid on the solicitation” when no classified access is needed pre-award. What you cannot do is perform: any facility awarded classified work, prime or sub, must hold an active FCL.

How much does a facility clearance cost?

Nothing in fees. DCSA funds the processing of both personnel and facility clearances; its Facility Clearance Branch adds the caveat that matters: “The only cost to you to go through the process is to ensure the business is in compliance” with the NISPOM.

What happens if a key manager loses their clearance mid-process?

If it was a temporary (interim) clearance, remove them from access and from the KMP position, or, under 117.10(l)(5), “the temporary entity eligibility determination will also be withdrawn.” That does not reach a final FCL. Losing a final KMP clearance runs through the 117.9(c)(5) condition, a changed-condition report under 117.8(b)(7)(iii), and possibly invalidation under 117.9(o).

Do all our key management personnel need to read classified material?

No, and DCSA flagged the confusion in December 2025. Eligibility and access authorization differ, and it is common for a KMP to hold one without the other. An insider threat program senior official maintains eligibility as a condition of the role while never attending a classified meeting.

The practical read

Every constraint above descends from one sentence. You cannot start this process; you can only be ready when someone else starts it. The companies that clear quickly had an FSO candidate, a CAGE code, an ownership chart resolving to named individuals and an SF 328 narrative ready before a prime offered to sponsor them. The ones that stall spend Day 1 to Day 20 discovering their operating agreement contradicts their KMP list.

None of that makes the calls DCSA reserves to itself. It decides which KMP need clearing, and the SF 328 is a signed certification about foreign ownership, so have counsel read your narrative first. Ownership charts, SF 328 answers and KMP governance are what drive the 67% return rate, and DCSA’s preparation slide leads with “reach out to DCSA FCB for any questions about the process”: Knowledge Center 888-282-7682 option 3, entity vetting 878-274-2000 option 1.

Two things are worth watching. Sponsorships still go through NISS, but GAO reports DCSA has been building a replacement since April 2024 at a planned cost near $163 million, the facility-clearance module not due until fiscal 2028. And part 117, in force since 24 February 2021, has one proposed amendment unfinalized since December 2023. The FY2027 budget logs 1,132 clearances issued in fiscal 2025; two older justifications both print 831 under conflicting year labels, so read earlier years as approximate.