In the defence environment, a place where cutting-edge technology often intersects with national security, protecting classified information is paramount. From advanced weapon systems to strategic intelligence, the data driving these projects is a prime target for sabotage and espionage. The UK’s ability to protect its national interests and those of its allies depends on maintaining the integrity and confidentiality of sensitive information. This responsibility extends beyond the Ministry of Defence (MOD) itself. It reaches out to the supply chain contractors, research bodies, and technology partners.
To safeguard this network, the MOD enforces strict protective security standards, one of the most significant being the Facility Security Clearance (FSC). FSC is the assurance that a supplier’s physical environment can protect classified information to MOD standards. It not only protects information, it effectively determines whether a company can participate in certain defence projects at all. This said, not being FSC certified does not preclude a company from bidding for MOD contracts. This blog will explore some intricacies surrounding FSC and its requirements.
My key word of advice; speak to experts regarding the viability of attaining FSC status. There are a lot of rumours and preconceived notions surrounding this subject, many of them are inaccurate and outdated.
What is Facility Security Clearance (FSC)?
Facility Security Clearance, formerly known as List X, is a critical accreditation required for organisations planning or holding contracts to safeguard UK Government assets classified as SECRET or above, or International Partners’ assets classified CONFIDENTIAL or above (hereafter referred to as ‘classified above OFFICIAL’), on their own premises. Simply put, FSC ensures your business adheres to strict physical and procedural security controls for protecting highly sensitive assets and information from threats including espionage and internal breaches, using approved equipment (See the NPSA Catalogue of Security Equipment – CSE Products | NPSA. FSC does not consider IT or OT system assurance any further than to ensure that systems inside the FSC have met specific MOD system assurance standards. Information assets may be classified into three types: OFFICIAL, SECRET, and TOP SECRET, with detailed guidance available in the Government Security Classifications Guide.
The requirement for FSC is defined in the MOD Facility Security Clearance Policy and Guidance (v1.4, March 2024), which supplements the government-wide protective standard GovS 007: Security. Each clearance is facility-specific. Large organisations with multiple sites must obtain separate FSCs for each location where classified work is undertaken. The clearance gives the MOD’s Contracting Authority (CA) confidence that information and assets entrusted to a supplier are handled securely and in accordance with UK and international security obligations.
FSC status is linked to a contract which requires a business to be able to hold, handle and store classified information at SECRET or above. Once the contract completes, the need to maintain FSC status no longer stands, unless the business is working on another contract which requires FSC status.
Why was List X changed to FSC?
FSC is the updated version of an older system called List X. It matches the name used in other countries, like Facility Clearance in the USA, while still keeping the strong UK rules. Incidentally, at the same time the security focus switched from external physical attacks and attempts to gain unauthorised access to guarding against internal insider threats.
These changes make FSC better suited to today’s threats, without making the protection any weaker.
- Name and What It Covers: List X focussed on guarding against physical external attempts to gain unauthorised access to confidential information.
FSC takes into account not just external physical threats but also those posed by insiders. Insiders can be disenfranchised employees or contractors influenced by Nation State or Organised Crime threat actors.
- Who Runs It: For MOD, the DE&S Industry Security Assurance Centre (ISAC) is responsible for FSC accreditation and assurance in relation to MOD contracts and contracts with International Defence Organisations. Additional ISAC responsibilities include Industry Personnel Security Assurance (IPSA), together with administration of the FSC and IPSA Databases, the promulgation of Security Notices and other security guidelines, and advice or instructions via the ISAC Vault (restricted access website), or other appropriate methods.
All other Government Departments manage their own FSC requirements.
- Who Can Get It and How Flexible It Is: FSC like List X, requires companies to be registered with Companies House and that a minimum of 50% of the Board membership hold UK Nationality. The FSC Board Level Contact (BLC) and Security Controller must hold SC clearances.
- To apply for FSC status you must have:
- A Contract requiring you to hold, handle and store SECRET information as part of your contract delivery;
- A Security Aspects Letter (SAL) related to the contract;
- A sponsor for your application, this likely to be the Prime company you will be contracted to or perhaps MOD itself.
FSC status, like a security clearance, is directly associated with a contract. Once the contract completes, there is no longer a requirement to hold FSC or a security clearance for that contract.
Core Requirements and Key Roles Under FSC
Key roles include:
Board Level Contact (BLC): A senior executive, UK-resident British national or approved dual national, responsible for overall security governance within the organisation. Must hold and maintain the appropriate National Security Vetting (NSV) clearance and ensure standards are met across all security domains.
Facility Security Controller (FSC Sy Ctlr): Manages the day-to-day security operations of the facility under the direction of the BLC. Larger suppliers may have dedicated or group Sy Ctlrs with deputies or local security contacts at different sites.
Personnel Security Controller (PSC): Oversees personnel vetting, deciding which employees require NSV clearance and maintaining accurate records. In smaller organisations, this role may be combined with the Sy Ctlr.
Other roles may be required depending upon the purpose and use of the FSC but these are defined on a case-by-case basis. The roles listed above are the very minimum required for an FSC.
FSC’s Direct Impact on Your Business
FSC is the enabler to working on classified defence programmes. Holding FSC status demonstrates to MOD and/or your Prime Contractor, your business is capable of handling sensitive classified information.
However, you are not allowed to advertise the fact your business holds FSC status. Associating the term FSC with a physical address is itself a breach of security, as this combination of data is classified as OFFICIAL- SENSITIVE.
- Enables Access to Classified Contracts: FSC is a prerequisite for any project where a supplier must handle, store, or produce information or equipment classified above OFFICIAL. Without it, the organisation cannot legally receive or work with classified material, regardless of technical capability.
- Pre-Award Requirement: For contracts involving classified information (e.g., SECRET or TOP SECRET), the MOD requires suppliers to hold a valid FSC before contract award. Even if a supplier wins the technical bid, the contract cannot proceed until clearance is granted.
- Provisional Access During Tendering: A Provisional FSC may be issued during the Invitation to Tender (ITT) stage, allowing limited access to certain classified aspects for bid preparation. However, full FSC must be achieved before any contract is signed or classified assets are transferred.
- Influences Tender Shortlisting: While the MOD must treat all bidders equally, suppliers already holding FSC often have a competitive advantage. They can engage more freely in security-sensitive discussions and respond faster to classified tender requirements.
- Essential for Subcontractor Participation: Prime contractors holding FSC can only share classified information with FSC-cleared subcontractors. Subcontractors without clearance are excluded from classified work packages, limiting their role in the supply chain.
- Enables International Collaboration: FSC is also required for projects involving international defence partners (e.g., NATO). It confirms that the supplier meets UK and international security standards, enabling participation in multinational classified programmes.
- Compliance and Continuity: Maintaining FSC ensures uninterrupted eligibility for future tenders and prevents operational disruption. Loss of clearance due to non-compliance can lead to suspension, termination, or exclusion from classified projects.
Read more: FSC FAQs
Closing Thoughts
FSC demands continuous diligence, investment and maintenance to match changes in the threat state. Companies are obligated to notify ISAC of changes, undergo regular audits, and address breaches promptly and may be subject to short notice spot checks under the terms of contractual agreements. Failure to keep up risks penalties or revocation under the National Security Act 2023.
Pera Prometheus specialises in helping businesses navigate the complex process of obtaining FSC accreditation. Our experts provide tailored guidance to ensure your organisation meets all MOD requirements efficiently and with confidence. Beyond accreditation, we offer ongoing support to maintain compliance and uphold the highest security standards keeping your business trusted, competitive, and ready to collaborate across the Defence Industry.
Not sure that FSC is practical or achievable for your Business? Conduct a FSC Gap Analysis to enable you to make an informed decision.
Stay Safe, Stay Secure
