TRANSACTION DILIGENCE · READINESS CHECKLIST

Free · No sign-in

What should I check before
acquiring a cleared contractor?

A transaction readiness checklist for investors, acquirers and corporate development teams evaluating a target that holds a facility clearance, classified contracts, accredited space or a CMMC obligation. It gives you a working list across eleven areas: what appears to be in hand, what is still open, and what needs a licensed professional before you can close on it. It does not grade the target, price the deal, or make any of the determinations that belong to the government.

Do not enter target names, deal terms or classified or CUI information. Planning-level answers only.

›THE PROBLEM

The problem: cleared assets do not transfer the way ordinary assets do

A cleared defense contractor looks, on a data room summary, like any other services or technology business: revenue, contracts, staff, a facility. What the summary usually does not show is that several of the things being acquired were granted to that specific legal entity, under that specific ownership and management picture, by a government authority that does not automatically recognize the buyer as the same company.

A facility clearance, an accredited SCIF, a system authorization, a CMMC assessment, a novated contract: each of these attaches to the entity and the people who held it at the time it was granted. A transaction changes the entity, the ownership, and often the people. What survives the close and what has to be rebuilt is not a question the target's financials answer, and it is rarely a question anyone asks early enough to plan around.

This page exists to put that list in front of a buyer before term sheet, not after.

›WHAT USUALLY GOES WRONG

What usually goes wrong

01 · CONTINUITY

Assuming the facility clearance transfers with the entity

It does not, automatically. A change of ownership or control is a changed condition the government has to be told about, and the clearance can be reviewed, conditioned or invalidated depending on what changed. Buyers who assume continuity find out otherwise after close, when the revenue they bought stops being billable.

02 · FOCI

Treating FOCI as the seller's problem, not the deal's

Foreign ownership, control or influence is assessed against the resulting company, not the target in isolation. An acquirer's own capital structure, board and debt can introduce a FOCI question that did not exist before the transaction, even where the target had none.

03 · KMP

Losing the people the clearance actually depends on

A facility clearance depends on specific Key Management Personnel being cleared, or formally excluded from classified access. A retention plan built for the business rarely accounts for who has to be cleared, excluded, or kept in place for the security posture to survive the transaction.

04 · NOVATION

Discovering a contract cannot simply be reassigned

Government contracts are not automatically assignable. Where the legal structure of the deal changes who holds the contract, novation under FAR 42.12 has to be requested and approved by the contracting officer, and that process has its own timeline that a closing calendar does not control.

05 · ACCREDITATION DEPENDENCE

Buying a facility whose accreditation may not follow it

An accredited SCIF or SAPF, and a system's authorization to operate, can depend on the accrediting decision having been made for the current entity. Whether that dependence exists, and what re-validation it requires, is a fact to establish before close, not a surprise for after it.

06 · SET-ASIDE STATUS

Missing that the deal itself can change eligibility

Small business and socioeconomic set-aside status, including SDVOSB, can change with a transaction's effect on size or ownership. A contract portfolio priced on the assumption that set-aside eligibility continues can be pricing something the transaction itself removes.

›WHAT YOU NEED TO KNOW

What you need to know

What changes after a cleared company is acquired?

A change of ownership or control in a cleared company can put its facility clearance, its accredited spaces, its system authorizations and its classified contracts all in question at once, because each of those was granted to a specific legal entity under a specific ownership and management picture. The acquirer inherits reporting obligations that begin before close, key management personnel whose clearance or exclusion status has to be re-examined, and contracts that may require novation to continue at all. None of this is automatic, and none of it is optional to plan for.

What does FOCI mean for an acquirer?

Foreign Ownership, Control or Influence describes the degree to which a foreign interest could affect a cleared company's management or classified performance. An acquirer with foreign ownership, foreign investors, foreign board representation or foreign debt above certain thresholds can trigger a FOCI review, and an acquirer without foreign ties still has to show the transaction does not introduce one. Where a target already operates under a mitigation instrument, an acquisition can also require that instrument to be revisited rather than simply carried forward.

Why is facility clearance continuity not automatic?

A facility clearance is granted to a specific company under a specific ownership, management and control structure, not to the buildings or the brand. When that structure changes at close, the clearance does not automatically transfer with it. The government requires notice of changed conditions, and depending on what changed, the clearance can be reviewed, conditioned or invalidated. Planning for continuity before close, not after, is what keeps a classified contract portfolio intact through the transaction.

What does a DD-254 inventory tell a buyer?

A DD-254 is the security classification specification attached to a classified contract, and it states the classification level, the facility requirements, the access requirements and the security guidance the contract carries. An inventory of a target's DD-254s tells a buyer what classified work actually exists, where it is performed, what facilities and clearances it depends on, and what flows down to subcontractors. Without that inventory, a buyer is pricing a classified contract portfolio it cannot actually see.

›CHECK YOUR DILIGENCE

Check your diligence

Eleven categories, drawn from where cleared transactions actually stall. Mark each item in hand, not yet, or not applicable to this transaction. Marking an item not applicable retires it and anything that only makes sense if that condition is present, rather than counting it against the target. The tool runs entirely in your browser. Nothing is transmitted unless you ask for a summary at the end.

Do not enter target names, deal terms or classified or CUI information. Planning-level answers only.

Facility clearanceLevel, status, sponsor relationships and the reporting obligations that follow a change of ownership.
Ownership and FOCIForeign ownership, investors, board and parent, and any existing mitigation instrument, named at a high level.
Key Management PersonnelWho must be cleared or excluded, and whether that continues after close.
Classified contracts and DD-254sInventory, flow-downs and performance locations for the target's classified work.
FacilitiesAccredited spaces, whether accreditation depends on the current entity, and how the space is held.
Accreditations and authorizationsSystems, ATOs and whether either depends on the seller's entity.
CMMC and NIST 800-171 postureSSP, SPRS submission, POA&M and assessment status.
Export controlITAR registration, EAR classifications and technical data handling, at a high level.
Security personnelFSO, ISSM and insider threat program lead, and the retention risk each one carries.
Contract dependenciesNovation, key personnel clauses, vehicle eligibility and set-aside status.
Change-of-control consequencesWhat must be reported, to whom, before and after close, and the tax structure behind the deal.

Your diligence checklist

For each item, choose in hand, not yet, or not applicable. Leave nothing blank if you can help it: a blank answer is treated the same as not yet.

01FACILITY CLEARANCE

Level, status, sponsor relationships and the reporting obligations that follow a change of ownership.

1. The target's current facility clearance level, or the absence of one, is documented

2. FCL status has been confirmed against DCSA records, not only the target's own representations

3. The sponsor relationship behind the FCL, a Government Contracting Activity or a cleared prime, is identified

4. The target's process for reporting changed conditions under 32 CFR 117 is documented

02OWNERSHIP AND FOCI

Foreign ownership, investors, board and parent, and any existing mitigation instrument, named at a high level.

5. Foreign ownership, investors and board composition are mapped, including indirect and beneficial ownership

6. The parent company and ultimate beneficial owner chain is documented

7. An existing FOCI mitigation instrument, if any, is identified by name: board resolution, SCA, SSA, proxy or voting trust

8. How the transaction itself changes the FOCI picture has been assessed

03KEY MANAGEMENT PERSONNEL

Who must be cleared or excluded, and whether that continues after close.

9. Key Management Personnel who must be cleared or excluded are listed by role

10. The clearance status of each listed KMP is confirmed

11. A plan exists for KMP continuity through and after close

12. Exclusion actions needed for any KMP who will not be cleared are identified

04CLASSIFIED CONTRACTS AND DD-254S

Inventory, flow-downs and performance locations for the target's classified work.

13. An inventory of classified contracts and their DD-254s exists

14. Flow-down security requirements to subcontractors are documented

15. Performance locations for classified work are identified and mapped to facilities

05FACILITIES

Accredited spaces, whether accreditation depends on the current entity, and how the space is held.

16. Accredited spaces, SCIFs, SAPFs or closed areas, are inventoried with accreditation dates

17. Whether each accreditation depends on the current legal entity or ownership has been confirmed

18. Leases and facility control, owned, leased or shared, are documented

19. A structural or engineering assessment of accredited spaces for continued suitability is scheduled

06ACCREDITATIONS AND AUTHORIZATIONS

Systems, ATOs and whether either depends on the seller's entity.

20. Systems and their authorization status, ATO or otherwise, are inventoried

21. Whether ATOs and other system authorizations depend on the seller's entity has been confirmed

22. Gaps between current authorizations and what the buyer's intended use will need are identified

07CMMC AND NIST 800-171 POSTURE

SSP, SPRS submission, POA&M and assessment status.

23. A System Security Plan exists and covers the relevant boundary

24. The current SPRS score submission and its date are confirmed

25. A Plan of Action and Milestones is current and has been reviewed

26. CMMC assessment status, self-assessed, third-party or none, and the level required by contracts are confirmed

08EXPORT CONTROL

ITAR registration, EAR classifications and technical data handling, at a high level.

27. ITAR registration status is confirmed

28. EAR classifications for relevant technical data are documented

29. How technical data is handled, stored and transferred is documented at a high level

09SECURITY PERSONNEL

FSO, ISSM and insider threat program lead, and the retention risk each one carries.

30. The Facility Security Officer is identified and their retention through close is addressed

31. The Information System Security Manager is identified and their retention through close is addressed

32. The insider threat program lead is identified

10CONTRACT DEPENDENCIES

Novation, key personnel clauses, vehicle eligibility and set-aside status.

33. Contracts requiring novation under FAR 42.12 are identified

34. Key personnel clauses that could be triggered by the transaction are identified

35. Contract vehicle eligibility implications of the transaction are assessed

36. Set-aside status that could change with size or ownership is identified

11CHANGE-OF-CONTROL CONSEQUENCES

What must be reported, to whom, before and after close, and the tax structure behind the deal.

37. What must be reported, to whom, and by when before close is documented

38. What must be reported after close is documented

39. Timing dependencies between reporting obligations and closing mechanics are mapped

40. Tax implications of the transaction structure, asset versus stock, have been reviewed

This tool needs JavaScript to assemble your result, but every item is on this page and every one of them is worth answering on paper. To have Salian read your answers, email info@saliandefense.com with your answers to the items above. Do not enter target names, deal terms or classified or CUI information. Planning-level answers only.

Methodology

The checklist has no model behind it and nothing is scored or ranked. Each item is either in hand, an item to obtain, or not applicable to this transaction. Marking an item not applicable retires it and anything that depends on it, rather than counting it against the target. Items that touch FOCI mitigation, facility or authorization continuity, export control, tax structure or CMMC assessment are routed to a licensed professional rather than treated as a task this checklist can close out. Nothing you enter leaves your browser unless you ask for a summary.

This checklist identifies operational and national security infrastructure questions worth confirming before acquiring a cleared contractor. It is for informational and planning purposes only. It does not constitute legal, tax, securities, investment or export-control advice, and it is not a determination by DCSA, any Cognizant Security Agency, an Accrediting Official, a Cognizant Security Authority, a C3PAO, or any other government or licensed authority. FOCI mitigation, facility clearance continuity and contract novation determinations rest with DCSA, the contracting officer and counsel. Do not enter target names, deal terms or classified or CUI information into this tool.

›WHAT SALIAN DOES

What Salian does

DILIGENCE

Operational and infrastructure diligence, from people who build these environments and carry them to accreditation

Salian advises on diligence and integration for transactions that touch cleared facilities, security programs, or federal contract portfolios, where the risks are specific and easy to underprice: an FCL that does not survive a change of ownership, FOCI exposure, an accreditation that lapses on a configuration change, or a contract vehicle that cannot be novated cleanly. We read the infrastructure the way we read our own projects, because we are the team that scopes, builds and carries facilities to accreditation.

FACILITY AND FCL READINESS

Reading what the facilities and the clearance actually depend on

Mapping which accreditations, authorizations and clearance relationships are tied to the current entity, and what a transaction structure would need to keep them intact or rebuild them without a performance gap.

INTEGRATION

Planning the sequence, not just the checklist

Turning an open-items list into a sequence: what has to happen before close, what can wait until after, and where the reporting timeline and the closing timeline actually collide.

ENGAGEMENT TERMS

Fee-based, with capital available where it accelerates delivery

Engagements are fee-based. Where a project warrants it Salian can put its own capital to work to accelerate delivery, with terms coming first and never on speculation.

›WHAT SALIAN DOES NOT CONTROL

What Salian does not control

The determinations belong to the government and to your own licensed professionals, and no advisor, this page included, can make or promise them.

DCSA, or the applicable Cognizant Security Agency, determines facility clearances and FOCI mitigation; contracting officers decide novation; the applicable Accrediting Official or Cognizant Security Authority accredits facilities.

Nor does Salian give legal opinions, tax advice, export-control classifications, securities advice or investment advice. Those questions belong to your counsel, your export counsel, your tax advisor, your C3PAO, and where the facility itself is in question, a structural engineer. This page routes to those professionals rather than answering in their place.

›WHAT HAPPENS NEXT

What happens next

Run the checklist above and read the eleven category lines. The open items are the work.
Take the items routed to a licensed professional to that professional directly: counsel, export counsel, tax, a C3PAO, or a structural engineer, depending on the item.
Use the suggested sequence to decide what has to close out before signing versus before close versus after close.
Where the facility question is unresolved, work it through the cleared work readiness map or the FCL readiness self-check.
Where CMMC or NIST 800-171 posture is the open item, separate readiness from assessment and certification in the CMMC Academy.
If you would like a person to read the picture with you, send the summary from the tool, download it, or email it to yourself first. We reply within one business day, and we will tell you if the honest answer is that you do not need us yet.

›SOURCES

Sources

The authorities behind the items on this page. All retrieved 2026-09-02. These are a starting point for your own reading and for legal review, not a substitute for either.

32 CFR 117 (NISPOM) National Industrial Security Program Operating Manual rule, covering FOCI and changed-conditions reporting, DoD and DCSA. ecfr.gov, title 32, part 117
DCSA FOCI overview Foreign Ownership, Control or Influence program guidance, Defense Counterintelligence and Security Agency. dcsa.mil, NISPOM rule and FOCI guidance
SF-328 Certificate Pertaining to Foreign Interests, the form filed as part of the facility clearance and FOCI process, DCSA. dcsa.mil, NISPOM rule and FCL process
FAR 42.12 Novation and Change-of-Name Agreements, FAR Council. acquisition.gov, FAR subpart 42.12

›TALK TO SALIAN

Talk to Salian

Run the checklist first. If the picture is mostly in hand, that is a real answer and worth acting on without a sales conversation. If the open items are real and you would rather not work them alone, describe the infrastructure questions and we will tell you which ones we can help with directly, and which belong with your own counsel.

Talk through the infrastructure questions Advisory