If you run any type of business that operates, delivers services to, or bids within the HMG or MOD environment, you have almost certainly asked this question at least once:
“Is BPSS actually a security clearance?”
The short answer is NO and getting this wrong can cost you contracts, delay onboarding, or even land you in compliance trouble. Getting it correct can save you money.
Let us clear it up once and for all in plain English.
If you Google: “Is BPSS a security clearance?” the answer will be:
No, the Baseline Personnel Security Standard (BPSS) is not a formal security clearance. It is a mandatory pre-employment screening process and the minimum standard required for anyone who needs access to UK government assets.
United Kingdom Security Vetting (UKSV), part of the Cabinet Office, is crystal clear on 2 things:
- BPSS is not a security clearance and it is not UKSV’s responsibility to assure BPSS processes or approvals.
- BPSS is the minimum standard to confirm an individual’s:
- Identity
- Right to work in the UK
- Employment history
- Criminal Record (unspent convictions)
Personnel must pass a BPSS check before they can be granted unrestricted access to government assets or MOD sites.
Where the confusion usually lies is that before an individual can achieve a UK security clearance (such as a Counter Terrorist Check (CTC), Security Check (SC), Developed Vetting (DV), enhanced SC (eSC), or enhanced DV (eDV)), BPSS is a pre-requisite.
BPSS vs Security Clearance — A Simple Comparison
BPSS is the starting point and is an essential stage toward gaining a security clearance. Security clearance is the deeper assessment for roles requiring access to classified material. The difference can be understood quickly by comparing the two processes.
BPSS
- Not a clearance
- Checked and recorded by your company
- Confirms identity and basic integrity
- Grants access to OFFICIAL information and in certain exceptions can, with the data owner’s permission, allow occasional controlled access to SECRET information
- BPSS can provide access to international CONFIDENTIAL or RESTRICTED classified information
- Involves a basic criminal record check
- Completed within days
- Includes a basic Disclosure and Barring Service (DBS) check which can be done in England and Wales on the gov.uk portal
Security Clearance
- Formal national security clearance
- Issued by UKSV
- Grants access to OFFICIAL, SECRET or TOP SECRET information, depending on the level of clearance which is held (Need-to-Know principle still applies)
- Includes detailed checks on finances, travel, personal history and character
- Can take months to complete
When Do You Actually Need BPSS for MOD and Defence Contracts?
It is wise to presume BPSS is required, unless the customer confirms otherwise. Many defence audits have highlighted inconsistent or missing BPSS records across supply chains, so taking a cautious approach is better for compliance. For most defence sector suppliers, the answer is simple. You will normally need BPSS whenever:
- The contract involves routine access to UK Government Departments, including Ministry of Defence sites, systems or information
- The role uses Government data classified at the OFFICIAL or OFFICIAL SENSITIVE level
- A Defence Procurement Questionnaire or Invitation to Tender specifically mentions BPSS
- A Statement of Requirement refers to baseline vetting or baseline screening
What BPSS Checks and What It Does Not Check
BPSS contains four mandatory elements. Recording all four clearly will help your business remain compliant during audits or contract reviews.
- Identity check: Verification of name, date of birth and nationality using formal documents such as a passport or driving licence. Digital identity routes may also be used if they meet Government standards.
- Right to work check: This must follow the Home Office rules for right to work. For example physical document inspection for British and Irish nationals or the online share code route for visa holders.
- Basic criminal record check: This identifies unspent convictions. It is completed through Basic DBS in England and Wales, Disclosure Scotland or AccessNI. BPSS does not require any disclosure of spent convictions.
- Employment history check: Verification of the last three years of employment and education, with explanations for any gaps.
What BPSS Does Not Include
- Credit or financial checks
- Personal references or interviews
- Checks on foreign associations
- Counter Terrorist Check
- Security Check or Developed Vetting
- Overseas police certificates unless the employer chooses to request them
Organisations holding or applying for Facility Security Clearance (FSC) should be aware that MOD Defence Security Assurance (DSA) auditors routinely review BPSS records as part of the accreditation process. Missing records, gaps in documentation or inconsistent employer decisions are among the most common findings raised during FSC audits. Getting your BPSS records in order is not just good practice, it is a direct FSC requirement.
How Long Does BPSS Really Take To Accomplish?
The time required depends mostly on how quickly the individual provides their documents. Typical times are:
- Basic DBS or Disclosure Scotland certificate issued in two to ten days
- Full BPSS file complete in five to fourteen days
- Digital identity and right to work checks completed on the same day
The most common delays defence SMEs encounter are:
- Gaps in employment history
- Lack of right to work evidence
- Previous addresses outside the United Kingdom
- Waiting for the criminal record certificate
- Errors in personal information
What Happens When a BPSS Check Raises a Concern?
It is important to understand that neither United Kingdom Security Vetting (UKSV), the Disclosure and Barring Service (DBS) nor Access Northern Ireland (AccessNI) makes the employment decision, the employer does. If a check raises a concern, such as an unspent conviction, a significant employment gap or an address history that cannot be verified, the employer must decide whether to proceed.
Before reaching that decision, give the individual the opportunity to provide additional information or clarification. Whatever decision is made, document it. Inconsistent decisions across your workforce are a compliance risk, particularly during MOD and FSC audits.
Simple BPSS Checklist for SMEs
Use this exact checklist to stay compliant, it aligns with Cabinet Office templates:
- Valid identity documents verified in person, digitally, or via Public Register of Authentic travel and identity Documents Online (PRADO)
- Right to work checked and digitally confirmed (Home Office share code; save evidence)
- Basic criminal record certificate received (dated within last 6 months; unspent only)
- Last 3–5 years employment/education/gaps verified (contact referees early; document overseas risks)
- Signed BPSS declaration from the individual (use the official Verification Record template)
- All evidence stored securely for audit (minimum 12 months post-employment or no longer than necessary; GDPR-compliant)
- Keep a digital record of results, MOD auditors now expect it for FSC sites
- Document the employer’s decision where a check raises a concern, consistent, recorded decisions are essential for FSC audit readiness.
Final Thoughts
With the Cyber Security and Resilience Bill advancing through Parliament (introduced November 2025), defence SMEs must integrate BPSS into their broader resilience plans. Achieving the BPSS standard should not require much more than your usual robust onboarding procedures and should be relatively easy to implement. It certainly should not cost you £££s of pounds as some service providers seem to be requesting.
Pera Prometheus works with defence contractors and supply chain organisations to build BPSS processes that are consistent, well documented and ready to withstand MOD audit scrutiny. From setting up compliant onboarding procedures to preparing for FSC accreditation, we can help you get it right.
If you have any questions then Pera Prometheus can always help, just get in touch to arrange an initial call.
Stay Safe, Stay Secure
