Contract Security Requirements

Contract Security Requirements are the security obligations a contractor must meet when a government or NATO contract involves protected or classified information, assets, sites, or other security-sensitive work. They state what the supplier must do to keep that material safe for the life of the contract.

In Canada, the term covers the requirements that private-sector organizations must follow to safeguard government information and assets provided to, or produced by, them under an awarded contract. Public Services and Procurement Canada sets these out in the Contract Security Manual, which applies to contracts involving Canadian, NATO, or foreign classified information, assets, or sites.

How a Canadian federal contract sets its security requirements

In Canadian federal procurement, security requirements are administered through the Contract Security Program (CSP) of Public Services and Procurement Canada. They are established at the start of the procurement process through the Security Requirements Check List, form TBS/SCT 350-103. The project authority completes the checklist to outline the security requirements of the contract.

The checklist then becomes part of the bid-solicitation documents. The contracting authority must include the approved security clauses and supplementary remarks in the contract documentation, so a supplier sees the requirements before it submits a bid.

CanadaBuys guidance tells buyers to identify security requirements on the front page of the contract, standing offer, or supply arrangement and to complete a checklist. Buyers must also send the contract and any amendments to the Contract Security Program within two working days of issuing them. The full instruction appears in the CanadaBuys buyer's guide on elements to consider at award.

Obligations a contractor can carry

The specific obligations depend on the contract, but they can include:

• obtaining or maintaining clearances for the organization and for its personnel
• protecting classified material and information systems
• controlling physical access to sites and assets
• complying with applicable national and NATO security policies
• ensuring that subcontractors meet the applicable requirements

Security requirements in NATO contracts

In NATO contracting, the requirements are normally set out in contract-specific security documents. These include a Contract Security Clause, a Security Classification Guide, a Security Aspects Letter, or programme and project security instructions. A NATO security clause can address personnel security, physical security, security of information, communications and information-systems security, and industrial security.

NATO contracting terms state that contractors working with NATO classified information may be required to hold an appropriate Facility Security Clearance. Personnel who need access may require an appropriate Personnel Security Clearance, a briefing, and need-to-know authorization. These conditions are set out in the ACT General Terms and Conditions. Access is generally limited to individuals who hold the required clearance and have a need to know.

Terms that appear alongside security requirements

• Facility Security Clearance (FSC): clearance for the contractor's facility.
• Personnel Security Clearance (PSC): clearance for individuals whose duties require access to classified information.
• Security Requirements Check List (SRCL): the Canadian form used to identify and describe security requirements in a procurement.
• National Security Authority (NSA) and Designated Security Authority (DSA): national authorities responsible for implementing applicable NATO security requirements.

What this means for a supplier bidding on Canadian public contracts

Check the front page of the solicitation and the bid documents for a security requirement before you commit to bidding. If a Security Requirements Check List is attached, read it together with the security clauses and supplementary remarks, because these form part of the contract you would sign.

Confirm early whether your organization and the people who would do the work hold clearances at the required level. For work tied to NATO, expect a possible Facility Security Clearance and matching Personnel Security Clearances. If you plan to use subcontractors, confirm that they can meet the same requirements, since the contractor is responsible for ensuring they do.