For a small contractor, the FSO manages personnel-security workflows, HR supplies employment facts, and managers establish the work-related need for access. The government determines clearance eligibility. Dividing these duties explicitly helps prevent an accepted offer, a system account, or a manager’s request from being mistaken for authorization to receive classified information.

• Separate decisions: Employment, eligibility, and access each need their own owner and completion evidence.
• Limit sharing: Managers need assignment status, not an employee’s clearance questionnaire.
• Connect handoffs: Offers, transfers, absences, changed duties, and departures should trigger security review.
• Cover gaps: Name qualified backups and review unresolved work with management.

How should FSO personnel-security duties work at a small contractor?

Begin with the security program’s assigned responsibilities: confirming access prerequisites, coordinating personnel-security processing, maintaining required records, providing briefings, and handling security reporting. Assign supporting tasks to HR, managers, IT, and the insider-threat official. The senior management official remains accountable for facility management and operations.

The security-official provisions in 32 CFR 117.7 distinguish management accountability, the FSO’s direction of security measures, and the insider threat program senior official’s program duties. Although a small staff may combine functions, the work still needs identifiable owners, because putting every task under an FSO heading can conceal missing employment notices and management decisions.

Build the assignment around events. For each event, identify who starts the task, who performs it, who has authority to decide, and who receives confirmation. The matrix below is a suggested internal allocation, not an agency-mandated organization chart. Confirm the local arrangement against the company’s operations and cognizant security agency guidance.

What employment information should HR own?

HR should provide accurate offer acceptance, employment dates, contact details, organizational assignment, and departure information through approved channels. Those facts support security work without giving HR authority to determine national security eligibility. Keep the employment record and the security workflow linked through status updates.

A useful handoff says what changed, when it takes effect, which position is affected, and whom security can contact. It also identifies whether the date is confirmed or tentative, and if a planned start moves, HR should send the correction to the same security owner rather than assume the payroll update reaches every relevant office.

Questionnaire access is narrower. Under 32 CFR 117.10(d), the FSO or specifically designated contractor employee reviews the SF 86 for adequacy and completeness. The rule restricts internal sharing and other uses of that information. A manager’s desire to understand a delay does not turn the employee’s questionnaire into a recruiting document.

For a candidate, the practical distinction matters immediately. Confirm the destinations separately. Ask where to send employment paperwork and where to submit security material. If a recruiter requests detailed questionnaire answers in ordinary hiring correspondence, ask the security office to clarify the authorized process before supplying them.

What must the hiring manager establish?

The manager should explain what duties require classified access and what information the employee needs for the assignment. The contractor must determine that access is essential to classified-contract performance. Clearance eligibility alone does not establish need-to-know for every project or document.

Describe the actual work rather than copying a generic clearance requirement into every requisition. Identify the contract, anticipated duty location, required classification level, and any customer-controlled access conditions through appropriate channels so security can check whether the position description matches the access being requested.

Managers should also identify permissible work while access is pending. An offer is insufficient. Permissible work remains a staffing decision subject to the contract and security rules. The recurring obligations behind FSO requirements for cleared contractors become easier to meet when managers communicate assignment changes before they take effect.

What happens between an accepted offer and access?

HR confirms the offer status, the manager establishes position need, and security checks existing eligibility or the appropriate processing path. Before classified access, the applicable eligibility, need-to-know, nondisclosure agreement, and briefing requirements must be satisfied. Employment onboarding and classified access need separate completion records.

Pre-employment processing has conditions. Under 32 CFR 117.10(f), the contractor may initiate an investigation before employment when immediate classified access is required, the contractor has made a written employment commitment, and the candidate has accepted in writing. The commitment must indicate employment will begin within 45 days of eligibility being granted at the level needed for the work.

That is an employment-commitment condition, not a government investigation deadline. The distinction matters when discussing how an employer sponsors an employee clearance with a candidate. Security should explain which step is pending without promising an adjudication date or treating every pending case as a negative decision.

The training and briefing requirements in 32 CFR 117.12 include an initial security briefing before access. Record its completion separately from general orientation. A completed benefits session or company laptop setup does not establish that security prerequisites have been met.

Where do IT and the insider-threat official enter?

IT should act on approved account and equipment requests and route relevant security observations through the established process. The insider threat program senior official establishes and executes the insider-threat program; when that person is not the FSO, the FSO must be an integral member. Define the connections without collapsing these responsibilities.

A standard business account, an authorized classified-system account, and permission to receive particular classified information are distinct matters. Specify which authority approves each requested action. Where classified information systems are involved, include the information systems security manager’s applicable responsibilities rather than assigning them automatically to an ordinary IT help desk.

The reporting requirements in 32 CFR 117.8 call for internal procedures that make cleared employees aware of reporting responsibilities to the FSO. They also prohibit adverse-information reports based on rumor or innuendo. A sound handoff records what was observed and routes it for the appropriate security action, rather than circulating speculation as an adjudicative finding.

Which changes need a security handoff?

Use leave, transfer, remote-work requests, duty changes, and changes in location as internal review triggers. The required security action depends on the facts, contract, and agency guidance. An internal review trigger is not a claim that every such event requires a government report or terminates eligibility.

For a transfer, the manager should describe the new tasks and information needs so security can check continuing access and customer requirements, while a remote-work proposal should identify the authorized work and environment before the assignment changes. An employee’s home connection does not establish permission to perform classified work there.

Extended leave requires coordination rather than a blanket rule. HR confirms the employment situation, the manager explains the expected return and duties, and security determines the applicable access and record actions. Keep reporting instructions available to the employee through the authorized channel. The wider NISPOM personnel-security framework supports checking the specific duty rather than inventing a universal leave rule.

What should the termination handoff contain?

Coordinate the employment end, access changes, debriefing, equipment return, required reporting, and record updates. The rule requires contractor debriefing and record annotation at employment termination and other specified access-ending events. Ending employment is not itself a government revocation of clearance eligibility.

HR supplies the confirmed effective date, the manager identifies customer assignments and materials, IT completes the authorized account actions, and security handles debriefing, required status reporting, and security records, with each function acknowledging completion of its own work. Use an acknowledgment from each responsible office so an unanswered departure notice remains visible as unfinished work.

Departure does not erase reporting obligations. The adverse-information provision expressly says termination does not negate the required report. Keep that obligation distinct from ordinary separation paperwork and avoid describing an unresolved allegation as a government determination.

How should a small company cover absences and review exceptions?

Name trained, authorized backups for each recurring function and establish a management review of unfinished work. A monthly exception review is a useful operating choice, not a regulatory deadline. Urgent matters must follow their applicable reporting instructions instead of waiting for that meeting.

Review overdue handoffs, unconfirmed access actions, missing completion evidence, upcoming staff absences, and decisions requiring executive resources. Each item should have an owner, next action, and escalation route. Prepare coverage in advance. A qualified backup needs usable instructions and permitted access before the primary employee becomes unavailable.

Frequently Asked Questions

Can HR decide that someone is eligible for a clearance?

No. The government determines national security eligibility. HR owns employment facts and hiring administration, while the contractor establishes the classified work requirement and security coordinates the appropriate process.

Should managers receive an employee’s completed SF 86?

The questionnaire review provisions restrict internal sharing and use beyond adequacy and completeness. Give managers the assignment status they are authorized to receive, and direct questions about handling questionnaire information to the security office.

Does every employee need a clearance?

The contractor bases the requirement on duties and classified-contract needs. The rule limits eligibility requests to the employees and consultants necessary for operational efficiency and prohibits building a cache of cleared employees.

What should an FSO candidate ask about shared duties?

Ask who sends employment changes, who authorizes access, and who covers security work during absence. Request the company’s actual handoff matrix and trace a recent onboarding or departure through it, identifying the owner and completion evidence for every security action.