International contract security requirements

What to expect during the contracting process

Canadian organizations can expect a number of actions to occur during the following 3 phases of the contracting process.

Security assurances for Canadian organizations

The CSP provides security assurances to foreign governments for Canadian organizations bidding on classified foreign contracts.

Security assurances for foreign organizations

Canadian organizations wanting to subcontract to a foreign organization must contact the CSP to confirm the possibility to subcontract and to request a foreign security assurance, as appropriate.

During the request process, your organization will need to provide a:

• point of contact for the foreign organization along with the:
  • email address
  • telephone number
  • physical address
  • country of origin
• government or international organization contract number
• security levels and requirements of the contract (for example, state whether your subcontractor will need access to classified information and assets or access only to a specific secure work site)

If available, you can also provide the organization's business registration number, equivalent to your Canadian Procurement Business Number:

• for subcontractors based in the United States (US), this number is called the Commercial and Government Entity (CAGE) code
• for subcontractors based in a North Atlantic Treaty Organization (NATO) country, this number is called the NATO Commercial and Government Entity (NCAGE) code

Security assurances for foreign personnel

The CSP conducts foreign security assurances for employees who hold personnel security clearances in countries that share bilateral security instruments with Canada.

To request a security assurance for foreign personnel, you must provide the CSP with the following information:

• name, place of residence, place of birth, date of birth and citizenship of the employee
• name and address of their employer
• government-issued identification, such as a social security number in the US or national identity card number in other countries
• government or international organization contract number

North Atlantic Treaty Organization clearances for organizations

Organizations bidding on NATO opportunities must meet the NATO security requirements listed in the procurement documents.

A NATO facility security clearance (FSC) gives access, at the appropriate security level, to information and assets to the level of:

• NATO Confidential
• NATO Secret
• Control of Secret Material in an International Command (COSMIC) Top Secret^{Footnote 1}

For contracts requiring access to NATO restricted information and assets, contact the CSP by sending an email: tpsgc.dgsssiprojetintl-dobissintlproject.pwgsc@tpsgc-pwgsc.gc.ca.

How organizations get a North Atlantic Treaty Organization facility security clearance

• If your organization requires a NATO FSC at the level of the NATO security requirements, contact the Contract Security Program to validate your clearance for the NATO solicitation request
• If your organization does not have a NATO FSC clearance, learn how to obtain security screening for your organization

North Atlantic Treaty Organization personnel security clearance

Once your organization is granted a NATO FSC, you need to request NATO personnel security clearances for employees to gain access to NATO classified information and assets.

To help Canadian organizations access international contracts involving classified information, Canada has negotiated bilateral security instruments with various countries and international organizations.

The countries and international organizations are:

• Albania
• Australia
• Belgium
• Brazil
• Bulgaria
• Chile
• Denmark
• European Space Agency (ESA)
• European Union (EU)
• Finland
• France
• Germany
• Israel
• Italy
• Latvia
• NATO
• Netherlands
• New Zealand
• Norway
• Singapore
• South Africa
• Spain
• Sweden
• Switzerland
• United Kingdom
• United States

The Multinational Industrial Security Working Group

Canada is part of the Multinational Industrial Security Working Group (MISWG) that consists of NSAs, DSAs and their representatives who are responsible for industrial security in their country. The MISWG mission is to:

• promote, improve and harmonize common international industrial security best practices
• safeguard classified and certain other forms of government-controlled information in order to confront current and emerging security threats and challenges within its scope

Adoption of common templates and exchange procedures facilitate the implementation and operation of international programs and projects among the MISWG membership.

This international working group consists of:

• all NATO countries (except Iceland)
• Australia
• Austria
• Israel
• Japan
• New Zealand
• Singapore
• Switzerland
• European Commission (observer)
• European Defence Agency (observer)
• ESA (observer)
• NATO Office of Security (observer)
• Organisation for Joint Armament Co-operation (OCCAR) (observer)

The suitability of an alternative solutions approach is always considered on a case-by-case basis and is at the exclusive discretion of the CSP. These alternative solutions depend on:

• the existence of a bilateral security instrument for the exchange of classified information
• the location of the foreign suppliers and their facilities (for example, within a member country of NATO or of the EU)
• the nature of information to be shared
• the adequacy of the other country's privacy legislation

Security clauses for international alternative solutions

An alternative solution mainly uses security clauses to specify the security requirements. These clauses ensure that foreign contractors or subcontractors safeguard Canadian protected information according to similar standards as Canadian suppliers on various aspects, such as:

• personnel security screening
• physical security
• information technology security
• protection of personal information

Security clauses also cover compliance visits, security breaches and the measures to be taken in case of loss or compromise of Protected A or Protected B assets and information exchanged under a contract or subcontract.

Security clauses for international alternative solutions are:

• contract-specific
• valid for the life of the contract or subcontract
• not transferable between contracts or subcontracts