Is my company ready for cleared government work? Readiness map and do I need a SCIF

›THE PROBLEM

The problem: what first-time cleared contractors underestimate

Companies that decide to enter cleared federal work almost always underestimate the same thing. It is not the difficulty of the security requirements. It is the number of separate readiness problems that have to be solved at once, and the order they have to be solved in.

A company arrives believing it has one problem, usually stated as "we need a facility clearance" or "we need a SCIF". It normally has six. The entity and its registrations have to be correct. The security question has to be settled: whether classified information is genuinely in scope, and who would sponsor a clearance if it is. The cyber obligations have to be met, because most cleared work carries Controlled Unclassified Information alongside it. The facility question has to be answered honestly, which frequently means answering that no facility is needed. There has to be real work to capture. And on the day after award, the company has to be able to actually run the contract.

Those six are not equally hard, and they are not independent. A wrong answer early makes later work worthless. This page is built to sequence them.

›WHAT USUALLY GOES WRONG

What usually goes wrong

01 · SEQUENCE

Buying the facility before confirming the requirement

The most expensive mistake on this list. A company signs a lease, or commissions a design, on the strength of an expectation. The requirement then changes, or turns out to be performed in customer space, and the money is spent against nothing. Confirm the requirement, then scope the space.

02 · SPONSORSHIP

Assuming a facility clearance can be obtained in advance

It cannot. A facility clearance is granted against a real classified requirement held by a Government Contracting Activity or a cleared prime, and a company cannot sponsor itself. Companies lose quarters preparing packages nobody has agreed to submit.

03 · CONFLATION

Treating an FCL and a SCIF as the same problem

They are different determinations about different things. One is about a company, the other about a physical space. A facility clearance by itself does not require a SCIF, and a great many cleared companies never build one because their people work inside government facilities.

04 · CYBER

Discovering the cyber obligations after award

Federal Contract Information and Controlled Unclassified Information arrive with clause obligations attached. A System Security Plan written after award, against a boundary nobody drew, is remediation rather than compliance, and it is more expensive in both money and schedule.

05 · CLEARANCE TIMING

Bidding staff who are not cleared and cannot be in time

Personnel clearance processing has its own clock, and it is not the contract's clock. A staffing plan that assumes cleared people on day one, without a path to get them there, turns a win into a performance problem.

06 · EXECUTION

Winning work the back office cannot carry

Contract administration, timekeeping, invoicing and compliance records are unglamorous and decisive. A company that wins before these exist spends its first year of cleared work fixing them under audit conditions.

›WHAT YOU NEED TO KNOW

What you need to know

What should a contractor consider before bidding cleared work?

Before bidding cleared work, a contractor should establish four things: whether the requirement genuinely involves classified information or only Controlled Unclassified Information, who would sponsor a facility clearance if one is needed, where the work will physically be performed, and what the contract obliges the company to do about cyber safeguarding. A facility clearance cannot be obtained in advance of a real classified requirement, so the sponsorship question usually decides whether a bid is realistic. Sponsorship comes from a Government Contracting Activity or a cleared prime, never from the bidding company itself.

How do security requirements affect bid strategy?

Security requirements set the cost, the schedule and often the teaming structure of a bid. Personnel clearance processing time can exceed the period of performance ramp, so a bid that assumes cleared staff on day one may be undeliverable. A facility requirement named in a DD-254 puts construction or accreditation on the critical path. Where a company cannot meet a requirement alone, the usual answer is to team with a cleared partner and perform in the partner or customer space, which changes the price and the risk profile of the bid rather than disqualifying it.

What is the difference between CMMC readiness, assessment and certification?

Readiness is internal work: implementing the requirements, writing the System Security Plan, maintaining a Plan of Action and Milestones, and submitting a self-assessment to SPRS. Assessment is the formal evaluation of that work against the CMMC program in 32 CFR Part 170, whether self-assessed or conducted by an authorized third party. Certification is the outcome, and it is not something a consultant can grant. An authorized C3PAO or the Department of Defense certifies CMMC status.

Do I need a SCIF, or is a facility clearance enough?

They answer different questions. A Facility Clearance is a determination that a company is eligible to access classified information. A SCIF is an accredited physical space for Sensitive Compartmented Information. A facility clearance by itself does not require a SCIF, and many cleared companies never build one, because their people work inside government or prime facilities. What creates a facility requirement is storing or processing classified material at your own location, or a contract or DD-254 that names one. Accreditation itself rests with the applicable Accrediting Official or Cognizant Security Authority.

›CHECK YOUR READINESS

Check your readiness

Two tools. The first maps all six readiness areas at once. The second answers the facility question on its own, because it is the question people most often get wrong in both directions. Both run entirely in your browser. Nothing is transmitted unless you ask for a summary at the end.

Do not enter classified information or CUI. Planning-level answers only.

TOOL 01

Your cleared work readiness map

Answer what you can. Anything you leave blank, or mark as not sure, becomes an item to confirm rather than a mark against you. Where you tell the map there is no classified requirement, the clearance and facility questions retire themselves.

01BUSINESS

The entity and the registrations a contracting officer looks for first.

1. Is your company a US legal entity in good standing?

2. Is your SAM.gov registration active?

3. Do you have a CAGE code?

4. Do your NAICS codes match the work you intend to sell?

5. How do you intend to contract?

6. Have you identified the customer you are selling to?

02SECURITY

Whether classified information is in scope, and who would sponsor you if it is.

7. Does the work you are pursuing involve classified information?

8. Have you identified who could sponsor a facility clearance?

9. Do you have someone who could serve as Facility Security Officer?

10. At a high level, is there foreign ownership, control or influence in your company?

03CYBER

What contract data you will hold, and whether the paperwork behind it exists.

11. Will you handle Federal Contract Information or Controlled Unclassified Information?

12. Do you have a System Security Plan covering that data?

13. Have you submitted a NIST SP 800-171 self-assessment to SPRS?

14. Do you maintain a Plan of Action and Milestones?

15. Do external service providers hold or process that data for you?

04FACILITY

Where the work happens, and whether anything has to be stored where you are.

16. Will the work be performed at a customer facility?

17. Would classified material need to be stored on your premises?

18. Does the requirement call for secure space that you control?

19. Do you already have space that has been through accreditation?

05CAPTURE

Whether there is real work to win, and whether you could write the proposal.

20. Have you identified specific opportunities?

21. What past performance can you cite?

22. Do you have teaming relationships in place?

23. Could you produce a compliant proposal on a deadline?

06EXECUTION

What has to work on the day after award.

24. Do you have contract administration in place?

25. Could you staff the work if you won it?

26. Do the people who would run the work hold personnel clearances?

27. Would your invoicing and compliance processes hold up to audit?

TOOL 02

Do I actually need a SCIF?

Most people asking this question mean one of about six different things. Before the questions, here are the distinctions, because the answer usually falls out of them. The short version: a facility clearance by itself does not require a SCIF.

Facility Clearance (FCL)A determination about a company: that this legal entity is eligible to access classified information. It says nothing about buildings.
Personnel Clearance (PCL)A determination about a person. People hold personnel clearances, companies hold facility clearances, and the two are processed separately.
Access to classified informationBeing permitted to see or use classified information, normally at someone else's accredited location. Access by itself does not require space of your own.
Classified storageKeeping classified material at your location, in approved containers or in space built for it. Storage is the point at which a security requirement becomes a facility requirement.
Performance at customer facilitiesCleared people working inside government or prime space. The accreditation belongs to the customer, and most first classified contracts are performed this way.
Company-controlled classified workClassified work performed in space you lease or own and are responsible for. This is the change that pulls facility planning into your scope.
SCIFA Sensitive Compartmented Information Facility, built and managed to ICD-705 and its technical specification, and accredited by the applicable Accrediting Official or Cognizant Security Authority for SCI.
SAPFA Special Access Program Facility. Its requirements come from the program's own security authority rather than from a single public specification.
Closed areaA collateral secure area under 32 CFR 117, used for open storage or discussion of collateral classified information. It is not a SCIF, and it is usually a much smaller undertaking.
Other secure spacesControlled access areas, restricted areas, secure rooms and approved container storage. A great many requirements land here rather than on a purpose-built facility.

07YOUR REQUIREMENT

Five questions. Answer not sure wherever you genuinely are not sure, and the module will tell you what information it would need instead of guessing.

1. What does the requirement involve?

2. Where will the work be performed?

3. Must classified material be stored on your premises?

4. Does the contract or DD-254 identify a facility requirement?

5. Is customer or partner space available to you?

Both tools need JavaScript to assemble your result, but every question is on this page and every one of them is worth answering on paper. To have Salian read your answers, email contact@saliandefense.com with your answers to the questions above. Do not enter classified information or CUI. Planning-level answers only.

Methodology

The map has no model behind it and nothing is ranked. Each answer is either an item that appears in place, an open item, or an item to confirm. A group with no open items reads as appearing in place. Answers that do not apply are retired rather than counted against you: where you tell us there is no classified requirement, the clearance and facility questions drop out of the map. Nothing you enter leaves your browser unless you ask for a summary. The facility module works the same way, and where the deciding facts are open it says so and names them rather than guessing.

This readiness map is for informational and planning purposes only. It does not determine eligibility for a Facility Clearance, constitute legal or security advice, or represent a determination by DCSA or any other government authority. Facility Clearance determinations are made by the appropriate government authority based on the specific facts of the company, contract, ownership structure, personnel, and classified requirement. Do not enter classified information or Controlled Unclassified Information into this tool.

›WHAT SALIAN DOES

What Salian does

FACILITIES

Secure facilities, scoped through to accreditation

Site evaluation, design coordination, construction management, and accreditation package preparation with coordination through the applicable Accrediting Official or Cognizant Security Authority, then sustainment after occupancy. One schedule and one accountable contract rather than five vendors and the seams between them.

CLEARANCE READINESS

Facility clearance readiness and sponsorship path support

Preparing the company, the ownership picture, the Key Management Personnel roles and the corporate paperwork so a package is ready when a sponsor is. Sponsorship comes from a Government Contracting Activity or a cleared prime. Salian helps you identify and prepare for the sponsorship path.

COMPLIANCE

Industrial security and cyber compliance readiness

NISP program support, and readiness work against NIST SP 800-171 and the CMMC program: boundary definition, System Security Plan, Plan of Action and Milestones, and the evidence a later assessment will ask for.

ADVISORY

Scoping, capture and program recovery

Reading a solicitation or a DD-254 for what it actually obliges you to build, sizing the security scope inside a bid, and stepping into work that has stalled. We can advise on this because we build it.

›WHAT SALIAN DOES NOT CONTROL

What Salian does not control

The determinations belong to the government, and no consultant, this page included, can make or promise them.

DCSA, or the applicable Cognizant Security Agency, determines facility clearances; the applicable Accrediting Official or Cognizant Security Authority accredits facilities; an authorized C3PAO or the Department of Defense certifies CMMC status.

Sponsorship is the same kind of fact. It comes from a Government Contracting Activity or a cleared prime with a classified requirement it can name. Salian helps you identify and prepare for the sponsorship path, and will tell you plainly when the answer is that there is not one yet.

›WHAT HAPPENS NEXT

What happens next

Run the readiness map above and read the six lines. The open items are the work, in the order the map lists them.
If the facility question is live, run the second tool. If it tells you that you do not need space of your own, that is the result, and there is nothing further to buy.
Where a facility clearance is genuinely the next problem, work the gates in the FCL readiness self-check.
Where a requirement points at secure space, scope it in the project readiness tool before anyone draws it, and use the cost estimator for a planning range.
Where FCI or CUI is in scope, separate readiness from assessment and certification in the CMMC Academy.
If you would like a person to read the map with you, send the summary from either tool. We reply within one business day, and we will tell you if the honest answer is that you do not need us yet.

›SOURCES

Sources

The authorities behind the questions on this page. All retrieved 2026-09-02. These are a starting point for your own reading and for legal review, not a substitute for either.

SAM.gov registration System for Award Management, GSA. https://sam.gov
CAGE code Commercial and Government Entity code, assigned by the Defense Logistics Agency. https://cage.dla.mil
32 CFR 117 (NISPOM) National Industrial Security Program Operating Manual rule, DoD and DCSA. ecfr.gov, title 32, part 117
DCSA facility clearance process SF-328, DD-254 and DD-441, Defense Counterintelligence and Security Agency. dcsa.mil, NISPOM rule
32 CFR 2002 (CUI) Controlled Unclassified Information program, ISOO at the National Archives. ecfr.gov, title 32, part 2002
DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. ecfr.gov, title 48, 252.204-7012
DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement. acquisition.gov, DFARS 252.204-7021
32 CFR 170 (CMMC program) Cybersecurity Maturity Model Certification Program, DoD. ecfr.gov, title 32, part 170
ICD-705 Intelligence Community Directive 705 and its technical specification, for the secure facility module. dni.gov, Intelligence Community Directives

›TALK TO SALIAN

Talk to Salian

Run the tools first. If they tell you that a facility clearance is not your next problem, or that you do not need secure space of your own, that is a real answer and you should act on it rather than on a sales conversation. If the open items are real and you would rather not work them alone, describe the requirement and we will tell you which problem it actually is.

Discuss your project Advisory