Security clearance in UK

Types of national security clearance

There are four main types of Security Clearance – Baseline, Counter Terrorist, Security Check and Developed Vetting. Below is an outline of each type of Security Clearance, along with information on the process, how long it takes, and the types of IT jobs it applies to.

The important thing to remember is that Security Clearance checks are conducted in line with a specific IT job role, and need to be requested by a company not an individual. So while Security Clearance may require some time and paperwork, if successful it will lead to a new IT job – as well as career rewards such as a good salary, role security and plenty of opportunity.

Baseline Security Clearance

There are two types of check in this category: Baseline Personnel Security Standard (BPSS) (Formally Basic Check) and Enhanced Baseline Standard (EBS) (formerly Enhanced Basic Check or Basic Check +). A BPSS or EBS aims to provide an appropriate level of assurance as to the trustworthiness, integrity, and probable reliability of prospective employees.

What is BPSS?
BPSS is an entry level security check, and will take one or two days to complete. Not technically a security clearance, it uses the Police National Computer (PNC) to make sure a candidate has no convictions. The check returns evidence of any current criminal record and un-spent convictions under the Rehabilitation of Offenders Act 1974.

A BPSS acts as a pre-employment check, signaling good recruitment and employment practice in general. The check is carried out by screening identity documents and references.

What is EBS?
An EBS is not a formal security clearance check; however it is a prerequisite for the other types of security clearances outlined next.

This type of check allows supervised access to top secret material. To attain this, the same checks as above apply, as well as a mandatory interview and references from people who are familiar with the person’s character in both home and work environment.

What IT jobs do they apply to?
Typically BPSS and EBS checks apply to jobs in the public sector and Armed Forces (both permanent and temporary) as well as private sector employees working on government contracts (e.g. contractors and consultants), who require access to, or knowledge of, confidential government assets.

BPSS and EBS Security Clearance checks are normally conducted by recruitment authorities or companies to the agreed standard. Because they underpin the national security vetting process it is vital that they are carried out properly and thoroughly and before any further vetting is completed.

Counter Terrorist Check (CTC) or (CTC Cleared)
The Counter-Terrorist Check (CTC) is most commonly required by police, legal agencies and government agencies hiring contractors. A CTC will normally take up to six months to complete and is usually valid for 3 years.

What is a CTC?
The purpose of the CTC is to prevent persons who may have connections with terrorist organizations, or who may be vulnerable to pressure from them, from undertaking certain security duties where sensitive information may be compromised.

A CTC does not allow access, knowledge or custody of protectively marked assets and information, but the Baseline Personnel Security Standard (outlined above, and normally undertaken as part of the recruiting process) does unlock some restrictions. It is carried out as part of the CTC as part of the vetting process, along with:

Departmental / Company Records Check
Security Questionnaire
Criminal Record Check
Security Service Check

What IT jobs does it apply to?
CTC Security Clearance is needed by IT professionals whose work involves:

• close proximity to public figures

• giving access to information or material vulnerable to terrorist attack

• unrestricted access to certain government or commercial establishments assessed to be at risk from terrorist attack

To gain CTC clearance you’ll normally need to have been a UK resident for a minimum of 3 years. Occasionally it may also be necessary to attend an interview with a DfT security officer. At the end of the vetting process, the information is assessed and a decision made to refuse or approve a CTC clearance.

Security Check (SC) or (SC Cleared)

Security Clearance (SC) is the most common type of vetting process. Transferable between government departments, it covers a wide range of jobs from IT and health to government, MoD, defense and private sector.

What is SC?
Valid for five years for contractors, and ten years for permanent employees, SC is for IT professionals who need substantial access to secret, occasionally top secret, assets and information.

To gain (SC) clearance you will normally need to have been a UK resident for a minimum of 5 years, and will need to successfully complete all stages of the vetting process which includes:

Baseline Personnel Security Standard
Departmental/Company Records Check
Security Questionnaire
Criminal Record Check
Credit Reference Check
Security Service Check

On completion, information is assessed and a decision made to refuse or approve the clearance application. It will usually take a minimum of six weeks to complete, and is generally reviewed every ten years.

Developed Vetting (DV)
Developed Vetting DV is the most comprehensive and expensive form of UK security vetting; and therefore only required for the most sensitive appointments and tasks.

This level of Security Clearance provides substantial unsupervised access to top secret assets, or for people working in the intelligence or security agencies. A small number of clearances are granted, and renewed annually depending on the employer, and circumstances of the employment.

What IT jobs does it apply to?
Typical DV security cleared IT jobs include positions within the MoD, government, defense and aerospace.

The stringent security check is much more specialized and job related: “A contractor would go to a specific contract role within a specific organization and the developed vetting would be tailored specifically for that contract.”

What’s involved?
To gain (DV) clearance you will normally have been a UK resident for a minimum of 10 years. You’ll also need to go through several stages of the vetting process to become approved:

Baseline Personnel Security Standard
Criminal Record Check
Departmental/Company Records Check
Completion of a (DV) questionnaire
Credit Reference Check and review of personal finances
Security Service Check
Check of medical and psychological information provided
Subject Interview and further inquiries, which will include interviews with character referees and current and previous supervisors (checking of references (social, employment, education etc) in writing, by telephone or by interview from personal friends, tutors and employers as appropriate)

On completion of the vetting process, information is assessed and a decision made to refuse or approve a DV clearance. For risk management purposes, follow-up work and monitoring is sometimes needed. This activity is known as ‘aftercare’, and may be required in connection with any of the above clearances.

How long will DV clearance take?
A DV will normally take a minimum of six months to complete. The officer assigned to the case will keep in touch during their inquiries and do their best to let you know how things are progressing. Because of the time the process takes, you shouldn’t hand in your notice to your present employer until DV clearance is granted.

Once a clearance is granted, it is only valid for a pre-determined period after which a review must be conducted. The time interval before a review is required is specified in guidance issued by the Cabinet Office but DVs are usually re-investigated after 5 years and every 7 years if there is a continuing need, depending on circumstances.

There are also a number of other types of security checks and clearances, including NATO, Metropolitan Police Vetting, Security Industry Authority, Criminal Records Bureau, Disclosure Scotland and AccessNI. These vetting procedures are in place to ensure that the candidates employed in certain sectors do not pose a risk when handling sensitive information.

NATO
Granting of NATO security clearance is handled in a similar manner to that of obtaining a national security clearance. There are four levels of security classification:

NATO RESTRICTED (NR)
NATO CONFIDENTIAL (NC)
NATO SECRET (NS)
COSMIC TOP SECRET (CTS)

MPS Vetted
Metropolitan Police Vetting is carried out for all members of the Metropolitan Police Service (police officers, police staff and members of the specials constabulary). It also applies to non police personnel including contractors, contractor representatives, consultants, volunteers and any person who requires unescorted access to MPS premises or uncontrolled access to police information.

The MPS has the following Force Vetting levels:

Initial Vetting Clearance (IVC)
Management Vetting (MV)

SIA
The Security Industry Authority operates the compulsory licensing of individuals working in specific sectors of the private security industry within the UK. Activities licensed under the Private Security Industry 2001 manned guarding includes:

Cash and Valuables in Transit
Close Protection
Door Supervision
Public Space Surveillance (CCTV)
Security guard
Immobilisation, restriction and removal of vehicles
Key Holding

Criminal Records Bureau (CRB)
CRB clearance is required for posts that involve working with children or vulnerable adults. Standard Disclosures may also be issued for people entering certain professions, such as law and accountancy. Standard Disclosures typically contain details of all convictions, cautions, reprimands and warnings held on the Police National Computer (PNC).

Enhanced CRB
These checks are required for posts involving a far greater degree of contact with children or vulnerable adults, where work involves regular caring for, supervising, training or being in sole charge i.e. teacher, scout or guide leader. Enhanced Disclosures contain the same information as the Standard Disclosures but with the addition of local police force information considered relevant by the Chief Police Officer(s).

In total, there are three official criminal record disclosure services within the UK:

CRB provides a service for England & Wales.

Disclosure Scotland is a service that manages and operates the Disclosure service in Scotland. Disclosures give details of an individual’s criminal convictions (and in the case of Enhanced Disclosures, where appropriate, non-conviction information).

Security Clearance provides a certain level of assurance at a point in time as to an individual’s suitability to have trusted access to sensitive information.

To gain Security Clearance, a person must undergo a process of examination and evaluation, involving a background check, before employment is offered to them. The system applies to people whose employment involves access to sensitive government assets, information or personnel. Security Cleared personnel can include crown servants, members of the security and intelligence agencies; members of the armed forces; the police; employees of certain other non-government organisations that are obliged to comply with the Government’s security procedures and employees of contractors providing goods and services to the Government. Government organisations in particular, including the Ministry of Defence, Central Government, Defence Estates and the Armed Forces, require Security Cleared personnel, as do companies in the private sector contracted to undertake work for these bodies.

Security Clearance is needed to protect against threats from hostile intelligence services, cyber security threats, terrorists and other pressure groups. The results of the vetting process determine who can be given access to sensitive Government information or property.

All candidates who apply for jobs that provide access to sensitive information or sites are asked to complete security questionnaires. The personal details recorded on these questionnaires enable the necessary checks to be carried out. Interviews will also be undertaken, where necessary. The depth of checks varies according to the level of access to sensitive information that the job entails.

How Do I Get A Security Clearance?

You cannot apply for Security Clearance as an individual; instead, Clearance is requested by an employer and carried out by Government agencies.

Security Clearance in the UK requires that your organisation must be sponsored. They must be contracted (or are in the process of being contracted) to work on one or more specific classified projects. Additionally, a company will need to be ‘List X accredited’ in order to act as a sponsor. List X is awarded to companies that have been through a stringent security vetting process and have a need for security cleared staff and contractors. For large contracts, an officer in the Defence Procurement Agency (DPA) or Defence Logistics Organisation (DLO) will be a sponsor. For staff in sub-contracted organisations, sponsorship will be provided through the prime contractor.

It is important to note that Security Clearance is granted for a specific period of time depending on the employment term or for a particular project. It does not provide a guarantee of future reliability, and all Security Clearances are kept under review to ensure that the necessary level of assurance is maintained. This review is carried out by Government Departments and Government-sponsored contractors, who are responsible for the oversight and ‘aftercare’ of individuals granted Security Clearance. Aftercare can be provided by these contractors where there are minor reservations as to whether Security Clearance should have been granted to an individual.

Security Clearance can be verified and transferred to a new employer if required. If you require Security Clearance for a particular role, in certain circumstances, you will not be able to start your employment until Clearance has been obtained.

The main types of National Security Vetting are listed below, and are processed by the following Government agencies:

Defence Business Services, National Security Vetting (DBS NSV)
Foreign and Commonwealth Office (FCO)
Secret Intelligence Services
Metropolitan Police Service (MPS)

Confidentiality

All personal information gathered during the Security Clearance process is handled in the strictest of confidence by the vetting agencies. In a very small number of cases, where serious risks have been identified, a case may be discussed with the security vetting unit, national security and policing authorities. In an even smaller number of cases, and only with the agreement of the person being vetted, line management may be given some relevant information and be requested to help manage the risk.

There is an extremely remote possibility of vetting information being disclosed in connection with criminal or civil proceedings.

Developed Vetting (DV)

Developed Vetting (DV) is the highest level of Security Clearance and is required for people with substantial unsupervised access to TOP SECRET assets, or for those working in the Intelligence or Security agencies.

A full DV Security Clearance process comprises the following mandatory vetting stages:

A Baseline Personnel Security Standard (BPSS), which is normally undertaken as part of the recruiting process)
Departmental / Company Records Check
DV Security Questionnaire
Criminal Record Check
Credit Reference Check and review of personal finances
Security Service Check
Check of medical and psychological information provided
Interview of applicant and further enquiries made, which will include interviews with character referees and current and previous supervisors.

On completion of the vetting process, the information collected is assessed and a decision made to refuse or approve DV Clearance. Once Clearance is granted, it is only valid for a pre-determined period, after which a review must be conducted if the Clearance is still required.

The DV Clearance process can take up to 9 months before full clearance is granted. Gaining DV Clearance will normally require you to have been a resident in the UK for a minimum of 10 years.

Security Check (SC)

A Security Check (SC, or SC Cleared) is required for people who have substantial access to SECRET or occasional controlled access to TOP SECRET assets.

A full Security Check clearance process comprises:

A Baseline Personnel Security Standard (BPSS), which is normally undertaken as part of the recruiting process
Departmental / Company Records Check
Security Questionnaire
Criminal Record Check
Credit Reference Check
Security Service Check

On completion of the process, the information collected is assessed and a decision made to refuse or approve an SC clearance. The clearance process can take between 1-3 months to complete prior to the candidate starting work. Gaining Security Clearance will normally require you to have been a resident in the UK for a minimum of 5 years.

Counter Terrorist Check (CTC)

A Counter Terrorist Check (CTC, or CTC Cleared) is a Clearance required for people who work in close proximity to public figures, or who have access to material or information that may be vulnerable to terrorist attack, or whose role involves unrestricted access to government or commercial establishments considered to be at risk from terrorist attack.

A CTC Clearance level does not allow access to, or knowledge or custody of, protectively marked assets, but the Baseline Personnel Security Standard allows a degree of access.

The CTC Clearance process involves the following mandatory stages:

Baseline Personnel Security Standard (BPSS), which is normally undertaken as part of the recruiting process)
Departmental / Company Records Check
Security Questionnaire
Criminal Record Check
Security Service Check

On completion of the vetting process, the information collected is assessed and a decision made to refuse or approve a CTC Clearance. Gaining CTC Clearance will normally require you to have been a resident in the UK for a minimum of 3 years.

NATO / NATO Cleared

NATO has four levels of security classification:

NATO Restricted (NR)
NATO Confidential (NC)
NATO Secret (NS)
COSMIC Top Secret (CTS)

NATO’s clearance levels function independent of any clearance levels for other nations. However, it is understood that for most NATO nations, granting of a NATO Security Clearance is handled in a similar manner to that of obtaining a national Security Clearance.

Metropolitan Police Service (MPS)

Metropolitan Police Service (MPS) vetting is carried out by the MPS Vetting Unit for all members of the Metropolitan Police Service, which includes police officers, police staff and members of the specials constabulary, as well as Non-Police Personnel including contactors, contractor representatives, consultants, volunteers, and any person who requires unescorted access to MPS premises or uncontrolled access to police information.

The MPS has the following Force Vetting levels:

Initial Vetting Clearance (IVC)
Management Vetting (MV)
Security Industry Authority (SIA)

Security Industry Authority (SIA)

The Security Industry Authority (SIA) operates the compulsory licensing of individuals working in specific sectors of the private security industry within the UK. The activities licensed under the Private Security Industry 2001 regulation pertain to Manned Guarding, which includes:

Cash and Valuables in Transit
Close Protection
Door Supervision
Public Space Surveillance (CCTV)
Security guard
Immobilization, restriction and removal of vehicles
Key Holding

Disclosure and Barring Services (DBS, formerly CRB) and Enhanced Disclosure and Barring Services (EDBS)

DBS checks are for positions involving certain activities and high levels of responsibility such as teaching children or dealing with vulnerable adults, and can also be obtained for certain other professions such judicial appointments or RSPCA officers.

In addition to the information provided on a Standard certificate, the Enhanced certificate also involves a police check to ascertain if any other information is held on file that may be relevant for consideration (for instance, information that has not led to a criminal conviction but may indicate a danger to vulnerable groups). The police decide what (if any) additional information will be added to the certificate using the Quality Assurance Framework.

The involvement of local police forces can mean an Enhanced check may take significantly longer to be completed than a Standard check.

An Enhanced check may only be applied for if the applicant’s job role is specified in both the Rehabilitation of Offenders Act 1974 (Exception) order 1975 and the Police Act 1997.

Basic Personnel Security Standard (BPSS, formerly Basic Check) and Enhanced Baseline Standard (EBS, formerly Enhanced Basic Check or Basic Check +)

BPSS and EPS are not formal security clearances, but are a package of pre-employment checks that represent good recruitment and employment practice.

A BPSS or EBS check aims to provide an appropriate level of assurance as to the trustworthiness, integrity, and probable reliability of prospective employees. These checks should be applied to:

All successful applicants for employment in the public sector and Armed Forces (both permanent and temporary)
All private sector employees working on government contracts (e.g. contractors and consultants), who require access to, or knowledge of, government assets protectively marked up to and including CONFIDENTIAL.

BPSS and EBS checks are normally conducted by the recruitment authorities or companies to the agreed standard. These checks underpin the national security vetting process, and therefore it is vital that they are carried out properly and thoroughly, and before any further vetting is completed.