Introduction
Facility Security Clearance (FSC) is the UK government's formal assurance that a specific organisation, at a specific site, can protect classified assets to the standard its contract demands.
If your company works with the Ministry of Defence or a UK government department, this isn't a badge you apply for on a whim. It is a site-and-organisation-specific approval tied directly to a genuine contractual need.
This guide is for defence suppliers, government contractors, and any organisation that may need to store, process, or manufacture classified material on its own premises.
A common snag: teams confuse FSC with an individual's SC or DV clearance. They are not the same, and the mix-up can delay a bid or push back a contract start date. This guide explains what FSC requires, how sponsorship works, what assessors examine, and what happens after approval.
Key Takeaways
- FSC clears an organisation and a named facility, not an individual employee.
- A sponsoring contracting authority and genuine contract need must exist before you apply.
- Personnel vetting, IPSA, and physical security support FSC but aren't interchangeable with it.
- Classified work at your premises can't start until FSC is confirmed and must be maintained for the contract term.
What Is Facility Security Clearance and Why Is It Used?
FSC gives a contracting authority confidence that a named organisation and site can safely hold, process, or manufacture classified government material at the level its contract requires. In plain terms: it's proof that your people, premises, and procedures are fit to handle assets that go beyond routine sensitivity.
According to the MOD's Facility Security Clearance Policy and Guidance, FSC applies where UK SECRET-or-above assets, or international CONFIDENTIAL-or-above assets, are held on a supplier's own premises. That's a specific, defined threshold, not a general sector requirement.
FSC vs Personal Security Clearances
This is where most confusion starts. A facility being cleared doesn't automatically clear the people inside it, and cleared individuals can't handle classified material at an uncleared site.
- BPSS is baseline pre-employment screening, not formal national security vetting.
- CTC, SC, and DV are individual clearance levels, assigned based on role sensitivity.
- FSC operates alongside these, not instead of them.
GOV.UK's national security vetting guidance confirms these individual levels are entirely separate from facility-level assurance.
From "List X" to FSC
If you've worked in defence procurement for a while, you've probably heard the term "List X." That's the legacy name. The MOD renamed it to Facility Security Clearance, and current guidance uses FSC throughout.
You may still spot "List X" in older contracts or industry conversations, but use current terminology in new documentation.
Why Contracting Authorities Require It
FSC exists to guard against unauthorised access, insider threats, espionage, and loss of classified assets through supplier weaknesses. It's a supply-chain safeguard, not paperwork for its own sake.
One restriction: FSC is not a quality mark or a marketing certification. MOD guidance explicitly prohibits publicising FSC status or referencing employee clearance levels in advertising or exhibition material. Disclosure is restricted to HMG personnel or other FSC-accredited suppliers.
FSC Requirements and Process in the UK
You can't apply for FSC just because you'd like the status. A contracting authority, prime contractor, government department, or eligible international organisation must first establish a genuine classified-work requirement tied to a real contract.
The Role of the Security Aspects Letter
The Security Aspects Letter (SAL) is the document that starts the FSC process. Under the MOD's SAL and Contractual Security Conditions notice, a SAL is required when pre-contract activity or the contract itself involves OFFICIAL-SENSITIVE-or-above aspects. It sets out classification and handling conditions—and that is what triggers the FSC conversation.
The Practical Process, Step by Step
- Confirm the contract requirement — does classified material need to be held, processed, or manufactured at your own site?
- Secure sponsorship — clarify classification level, site scope, and personnel needs with the contracting authority.
- Build the security foundation — governance structures, physical controls, secure storage, access controls, incident procedures, and documented company security instructions.
- Establish IPSA capability where applicable — this covers responsibility for vetting and managing cleared personnel at an organisational level.
- Submit through the current government or MOD process and cooperate with due diligence, site reviews, and evidence requests.
- Remedy gaps, complete the assessment, and maintain controls once approved.
Who Owns This Internally
Senior management carries the accountability here. A Board Level Contact supports policy and corrective action, while a Facility Security Controller manages daily site security, staff instructions, and breach reporting.
One of MOD's baseline eligibility checks is simple company registration: your organisation must be properly registered with Companies House before sponsorship can proceed. Basic registration or filing gaps often stall a process that otherwise looks security-ready—something firms such as VJM Global see when handling UK entity formation and corporate governance documentation.
Even with sponsorship and registration in place, assessors don't isolate one control. They review the whole regime: physical security, personnel arrangements, governance, procedures, reporting lines, and how classified assets move through your business.
Where FSC Applies and What Affects the Requirement
FSC is tied to a facility, not a company as a whole. A business running three sites might need separate consideration for each one that handles classified material — clearance at one location doesn't extend automatically to another.
Typical Settings
FSC commonly comes up in:
- Defence manufacturing and engineering
- Aerospace
- Secure technology development and cyber programmes
- Critical government infrastructure projects
But the sector alone doesn't decide anything. The contract determines the requirement, not the industry label.
When FSC May Not Be Necessary
- Only OFFICIAL or OFFICIAL-SENSITIVE information is involved (below the FSC threshold)
- Classified assets are accessed only at a government or already-approved customer site
Both scenarios still depend on what the SAL and contracting authority specify, so don't assume either exemption without checking the actual contract terms.
What Shifts the Requirement
Several factors change how demanding the process becomes:
- Classification level and volume of material involved
- Whether assets are physical, digital, or both
- Site layout and access arrangements
- Staff roles and subcontractor involvement
- Ownership or Board-level changes
- Your organisation's existing security maturity
One point that trips people up: FSC doesn't automatically assure your IT systems or cyber controls. Those sit under separate requirements, such as Def Stan 05-138, which sets cyber-risk profiles specific to the contract. Facility and personnel assurance run on a parallel track to cyber compliance, not as a substitute for it.
Common Issues and When FSC Is Not Appropriate
Several assumptions push suppliers toward FSC when they do not need it, or leave real applications underprepared.
Misconception one: every defence supplier needs FSC. Not true. The real question is whether classified assets must be handled at your own premises under the specific contract. Plenty of suppliers work entirely within OFFICIAL-level information or on client sites and never trigger the FSC threshold.
Misconception two: FSC replaces individual SC or DV clearance. It doesn't. Facility and personnel requirements are planned separately, and both usually apply where the work genuinely demands it.
Buying a safe isn't enough. FSC covers governance, personnel, procedures, physical protection, reporting, and ongoing compliance together. A locked room or an alarm system addresses one slice of a much broader picture.
Even when FSC is the right path, the same preparation gaps keep stalling approval.
What Actually Delays Approval
- Starting without a confirmed sponsor
- Unclear contract or SAL requirements
- Incomplete security documentation
- Premises unsuitable for the classification level
- Unclear internal ownership of security responsibilities
- Incomplete personnel records
- No plan for subcontractor involvement
When Not to Pursue FSC
Applying speculatively, without a qualifying contract, wastes time and resources. The same goes for chasing FSC purely as a marketing advantage — MOD explicitly restricts publicising clearance status, so there's no promotional upside anyway.
MOD states there's no accreditation fee itself, but organisations still cover site upgrades, secure equipment, and staff time to prepare. Timelines vary with facility complexity, readiness, and assessor availability. There is no single published turnaround, so treat any fixed-week promise with scepticism.
Conclusion
FSC confirms that a specific organisation and facility can meet a defined classified-work requirement. It does not clear individuals, and it is not a general business certification for marketing credibility. The process starts with a genuine contract and a sponsor, then depends on coordinated governance, personnel assurance, physical safeguards, and documented procedures working together.
Foundational details decide outcomes: company registration, governance structures, and clear ownership of responsibilities. Treat FSC preparation as an early-stage priority, not a last-minute checklist. Verify current MOD, ISAC, and contract-specific requirements before you commit resources, and revisit them as your contracts evolve.
Frequently Asked Questions
What is facility security clearance in the UK?
FSC is an organisational and site-specific assurance process confirming a supplier's premises can protect classified material at the required level. It's separate from personal security clearances like SC or DV, which apply to individuals, not sites.
How do I obtain a facility security clearance in the UK?
You need a qualifying contract requirement and an eligible sponsor, typically a contracting authority or prime contractor. From there, you prepare your security controls and complete the current government assessment process before classified work begins.
What are the different levels of security clearance in the UK?
FSC covers the facility. Individual levels (BPSS, CTC, SC, and DV) cover personnel and vary by role sensitivity. The contract and classification involved determine which combination applies.
How much does an FSC certificate cost?
MOD states there's no fee for the accreditation itself, but organisations typically pay for premises upgrades, secure equipment, policy documentation, and staff time. Costs vary too much by site and classification to quote a fixed figure.
How long does the facility security clearance process take in the UK?
Timing depends on sponsorship speed, facility complexity, how much remedial work is needed, and assessor availability. There's no official standard duration, so avoid relying on any fixed timeframe you see quoted elsewhere.
Does "List X" still exist in the UK?
"List X" is the legacy name for what's now officially called Facility Security Clearance. You may still see the old term in older documents, but current MOD guidance uses FSC exclusively.
