(a) General. This section applies to all contractors with entity eligibility determinations, except as provided in § 117.22 for entity eligibility determinations for participation in the CCIPP under the cognizance of DHS.
(1) Prior to the entity being granted an entity eligibility determination for access to classified information, the responsible CSA must have determined that:
(i) The entity is eligible for access to classified information to meet a legitimate USG or foreign government need.
(ii) Access is consistent with national security interests.
(2) The CSA will provide guidance on processing entity eligibility determinations for entity access to classified information.
(3) The determination of entity eligibility for access is separate from the determination of a classified information safeguarding capability (see § 117.15).
(4) Neither the contractor nor its employees will be permitted access to classified information until the CSA has made an entity eligibility determination (e.g., issued an FCL).
(5) The requirement for a favorable entity eligibility determination (also referred to in some instances as an FCL) for a prime contractor includes instances where all access to classified information will be limited to subcontractors. A prime contractor must have a favorable entity eligibility determination at the same or higher classification level as its subcontractors.
(6) Contractors are eligible for storage of classified material in connection with a legitimate USG or foreign government requirement if they have a favorable entity eligibility determination and a classified information safeguarding capability approved by the CSA.
(7) An entity eligibility determination is valid for access to classified information at the same or lower classification level.
(8) Each CSA will maintain a record of entity eligibility determinations made by that CSA.
(9) A contractor will not use its favorable entity eligibility determination for advertising or promotional purposes. This does not prohibit the contractor from advertising employee positions that require a PCL in connection with the position.
(10) A contractor or prospective contractor cannot apply for its own entity eligibility determination. A GCA or a currently cleared contractor may sponsor an entity for an entity eligibility determination at any point during the contracting or agreement life cycle at which the entity must have access to classified information to participate (including the solicitation or competition phase).
(b) Reciprocity. If an entity has an appropriate, final entity eligibility determination, a CSA will not duplicate the entity eligibility determination processes performed by another CSA. If a CSA cannot acknowledge an entity eligibility determination to another CSA, the involved entity may be subject to duplicate processing in accordance with 32 CFR part 2004.
(c) Eligibility requirements. To be eligible for an initial entity eligibility determination or to maintain an existing entity eligibility determination, the entity must:
(1) Need access to classified information in connection with a legitimate USG or foreign government requirement, and access must be consistent with U.S. national security interests as determined by the CSA.
(2) Be organized and existing:
(i) Under the laws of the United States, one of the fifty States, the District of Columbia, or an organized U.S. territory (Guam, Commonwealth of the Northern Marianas Islands, Commonwealth of Puerto Rico, and the U.S. Virgin Islands); or
(ii) Under the laws of an American Indian/Alaska Native tribal entity if:
(A) The American Indian or Alaska Native tribe under whose laws the entity is chartered has been formally acknowledged by the Assistant Secretary - Indian Affairs, of the U.S. Department of the Interior.
(B) The contractor is organized and continues to exist, during the period of the eligibility under a tribal statue or code, or pursuant to a resolution of an authorized tribal legislative body.
(C) The contractor has submitted or will submit records such as a charter, certificate of organization, or other applicable tribal documents and statute or code provisions governing the formation and continuation of the entity, for CSA determination that the entity is tribally chartered.
(3) Be located in the United States or its territorial areas.
(4) Have a record of integrity and lawful conduct in its business dealings.
(5) Have a SMO, FSO, and ITPSO who have and who maintain eligibility for access to classified information and are not excluded from participating in USG contracts or agreements in accordance with § 117.7(b)(1) through § 117.7(b)(3).
(6) Not be under FOCI to such a degree that a favorable entity eligibility determination for access to classified information would be inconsistent with the national interest, in the judgment of the CSA.
(7) Maintain sufficient authorized and cleared employees to manage and implement the requirements of this rule in accordance with CSA guidance.
(8) Not pose an unacceptable risk to national security interests, in the judgment of the CSA.
(9) Meet all requirements governing access to classified information established by the CSA or the relevant authorizing law, regulation, or government-wide policy.
(d) Processing the entity eligibility determination. The CSA will assess the entity's eligibility for access to classified information based on its business structure.
(1) At a minimum, the entity will:
(i) Provide CSA-requested documentation within timelines established by the CSA.
(ii) Have and identify the SMO.
(iii) Appoint a U.S. citizen employee as the FSO.
(iv) Appoint a U.S. citizen employee as the ITPSO.
(v) Submit requests for personnel security investigations for the SMO, FSO, ITPSO, and those other KMP identified by the CSA as requiring eligibility for access to classified information in connection with the entity eligibility.
(2) If the entity is under FOCI with a special security agreement (SSA) as the proposed method of FOCI mitigation, and the GCA requires the entity to have access to proscribed information, the CSA must consider the measures listed in § 117.11(d) as part of the entity eligibility determination.
(e) Other personnel eligibility determinations concurrent with the entity eligibility determination.
(1) Contractors may designate employees who require access to classified information during the negotiation of a contract or the preparation of a bid or quotation pertaining to a prime contract or a subcontract. These designated employees will be processed for a determination of eligibility for access to classified information (i.e., PCL eligibility) concurrent with entity's entity eligibility determination.
(2) The entity eligibility determination is not dependent on the PCL eligibility for access to classified information by such employees, provided none of these employees are among those listed in paragraph (c)(5) of this section. Even so, the employees will not be granted access to classified information until both a favorable entity eligibility determination and PCL eligibility has been granted.
(f) Exclusion procedures. If a CSA determines that certain KMP can be excluded from access to classified information, the contractor will follow the procedures in accordance with § 117.7(b)(5)(ii).
(g) Temporary exclusions. As a result of a changed condition, the SMO or other KMP who require eligibility for access to classified information in connection with the facility entity eligibility determination may be temporarily excluded from access to classified information while in the process of a PCL eligibility determination provided:
(1) The SMO or other KMP are not appointed as the FSO or ITPSO. FSOs and ITPSOs may not be temporarily excluded. A cleared employee must always be appointed to fulfill the requirements of these positions in accordance with this rule.
(2) An employee, cleared to the level of the entity eligibility determination, must be able to fulfill the NISP responsibilities of the temporarily excluded KMP in accordance with this rule while the temporary exclusion is in effect.
(3) The applicable CSA may provide additional guidance on the duration of a temporary exclusion from access to classified information based on circumstances, business structure, and other relevant security information.
(4) The contractor's governing board affirms the exclusion action, and provides a copy of the exclusion action to the CSA. The organization's governing body will document this action.
Table 1 to Paragraph (g)(4) Temporary Exclusion Resolutions
| Type of affirmation | Language to be used in exclusion action |
|---|---|
| Affirmation for Temporary Exclusion from Access to Classified Information | Pending a final determination of eligibility for access to classified information by the U.S. Government, [insert name and position] will not require, will not have, and can be effectively and formally excluded from access to all classified information disclosed to the entity. |
| Affirmation for Temporary Exclusion from Higher Level Classified Information | Pending a final determination of eligibility for access to classified information at the [insert SECRET or TOP SECRET] level, [insert name and position] will not have, and can be effectively and formally excluded from access to higher-level classified information [specify which higher level of information]. |
(h) Interim entity eligibility determinations. The CSA may make an interim entity eligibility determination for access to classified information, in the sole discretion of the CSA. See § 117.10(l) for access limitations that also apply to interim entity eligibility determinations.
(i) An interim entity eligibility determination is made on a temporary basis pending completion of the full investigative requirements.
(ii) If the contractor with an interim entity eligibility determination is unable or unwilling to comply with the requirements of this rule and CSA-provided guidance regarding the process to obtain a final entity eligibility determination, the CSA will withdraw the interim entity eligibility.
(i) Multiple facility organizations. The home office must have an entity eligibility determination at the same level as the highest entity eligibility determination of an entity within the MFO. The CSA will determine whether branch offices are eligible for access to classified information if the branch offices need access and meet all other requirements.
(j) Parent-subsidiary relationships. When a parent-subsidiary relationship exists, the CSA will process the parent and the subsidiary separately for entity eligibility determinations.
(1) If the CSA determines the parent must be processed for an entity eligibility determination, then the parent must have an entity eligibility determination at the same or higher level as the subsidiary.
(2) When a parent and subsidiary or multiple cleared subsidiaries are collocated, a formal written agreement to use common security services may be executed by the entities, subject to the approval of the CSA.
(k) Joint ventures. A joint venture may be granted eligibility for access to classified information if it meets the eligibility requirements in paragraph (c) of this section, including:
(1) The joint venture must be established as a legal business entity (e.g. limited liability company, corporation, or partnership). A joint venture established by contract that is not also established as a legal business entity is not eligible for an entity eligibility determination.
(2) The business entity operating as a joint venture must have been awarded a classified contract or sponsored by a GCA or prime contractor for an entity eligibility determination in advance of a potential award for which the business entity has bid pursuant to paragraph (c) of this section.
(3) The business entity operating as a joint venture must have an employee or employees appointed as security officials or KMP pursuant to § 117.7(b).
(l) Consultants. The responsible CSA will determine when there is a need for self-employed consultants requiring access to classified information to be considered for an entity eligibility determination.
(m) Limited entity eligibility determination (Non-FOCI).
(1) The applicable CSA may choose to allow a GCA to request limited entity eligibility determinations for a single, narrowly defined contract, agreement, or circumstance and specific to the requesting GCA's classified information. This is not the same as a limited entity eligibility determination in situations involving FOCI, when the FOCI is not mitigated or negated.
(i) Limited entity eligibility determinations (or FCLs) involving FOCI will be processed in accordance with § 117.11(e).
(ii) This paragraph (paragraph (m) of this section) applies to limited entity eligibility determinations for purposes other than FOCI mitigation in accordance with 32 CFR part 2004. Additional guidance may be provided by the responsible CSA.
(2) An entity must be sponsored for a limited entity eligibility determination by a GCA in accordance with the sponsorship requirements contained in paragraph (c) of this section. The contractor should be aware that the sponsorship request from the GCA to the CSA must also include:
(i) Description of the compelling need for the limited entity eligibility determination that is in accordance with U.S. national security interests.
(ii) Specific reason(s) or rationale for limiting the entity eligibility determination.
(iii) The GCA's formal acknowledgement and acceptance of the risk associated with this rationale.
(3) The entity must otherwise meet the entity eligibility determination requirements set out in this rule.
(4) Access limitations are inherent with the limited entity eligibility determination and are imposed upon all of the entity's employees regardless of citizenship.
(5) Contractors should be aware that the CSA will document the requirements of each limited entity eligibility determination it makes, including the scope of, and any limitations on, access to classified information.
(6) Contractors should be aware that the CSA will verify limited entity eligibility determinations only to the requesting GCA. In the case of multiple limited entity eligibility determinations for a single entity, the CSA verifies each one separately only to its requestor.
(7) The applicable CSA administratively terminates the limited entity eligibility determination when there is no longer a need for access to the classified information for which the CSA approved the limited entity eligibility determination.
(n) Termination of the entity eligibility determination. Once granted, a favorable entity eligibility determination remains in effect until terminated or revoked. If the entity eligibility determination is terminated or revoked, the contractor will return all classified material in its possession to the appropriate GCA or dispose of the material as instructed by the CSA. The contractor should be aware that it may request an administrative termination or the CSA may:
(1) After coordination with applicable GCAs, administratively terminate the entity eligibility determination because the contractor no longer has a need for access to classified information.
(2) Revoke an entity eligibility determination if the contractor is unable or unwilling to protect classified information or is unable to comply with the security requirements of this rule.
(o) Invalidation of the entity eligibility determination. The CSA may invalidate an existing entity eligibility determination. While the entity eligibility determination is in an invalidated status, the contractor may not bid on or be awarded new classified contracts or solicitations. The contractor may continue to work on existing classified contracts if the GCA agrees.
(p) Records maintenance. Contractors will maintain the original CSA designated forms for the duration of the entity eligibility determination in accordance with CSA-provided guidance.