International contract security requirements

What to expect during the contracting process

Canadian organizations can expect a number of actions to occur during the following 3 phases of the contracting process.

Security assurances for Canadian organizations

The Public Services and Procurement Canada's Contract Security Program provides security assurances to foreign governments for Canadian organizations bidding on classified foreign contracts.

Security assurances for foreign organizations

Canadian organizations wanting to subcontract to a foreign organization must contact Public Services and Procurement Canada's Contract Security Program to confirm the possibility to subcontract and to request a foreign security assurance, as appropriate.

During the request process, your organization will need to provide a:

• point of contact for the foreign organization:
  • include the email address, telephone number, physical address and country of origin
• contract number
• security levels and requirements of the contract:
  • for example, state whether your subcontractor will need access to classified information and assets or access only to a specific secure work site

If available, you can also provide the organization's business registration number, equivalent to your Canadian Procurement Business Number:

• for subcontractors based in the United States, this number is called the Commercial and Government Entity (CAGE) Code
• for subcontractors based in a North Atlantic Treaty Organization (NATO) country, this number is called the NATO Commercial and Government Entity (NCAGE) Code

Security assurances for foreign personnel

Public Services and Procurement Canada's Contract Security Program conducts foreign security assurances for employees who hold personnel security clearances in countries that share bilateral security instruments with Canada.

To request a security assurance for foreign personnel, you must provide the program with the following information:

• name, place of residence, place of birth, date of birth and citizenship of the employee
• name and address of their employer
• contract number
• government-issued identification, such as a Social Security Number in the United States or national identity card number in other countries

North Atlantic Treaty Organization clearances for organizations

Organizations bidding on NATO opportunities must meet the security requirements listed in the procurement documents.

A NATO facility security clearance gives access, at the appropriate security level, to information and assets to the level of:

• NATO Confidential
• NATO Secret
• Control of Secret Material in an International Command (COSMIC) Top Secret^{Footnote 1}

For contracts requiring access to NATO Restricted information and assets, contact Public Services and Procurement Canada's Contract Security Program by sending an email to tpsgc.dgsssiprojetintl-dobissintlproject.pwgsc@tpsgc-pwgsc.gc.ca.

Organizations may need to request a designated organization screening with document safeguarding capability at the level of Protected A.

How organizations get a North Atlantic Treaty Organization clearance

• If your organization requested a NATO clearance at the level of the NATO security requirements:
  • contact Public Services and Procurement Canada's Contract Security Program to validate your clearance for the NATO solicitation request
• if your organization does not have a NATO clearance:
  • learn how to obtain security screening for your organization

North Atlantic Treaty Organization clearances for personnel

Once your organization is granted a NATO facility security clearance, you need to request NATO personnel security clearances for employees to gain access to NATO information and assets.

Bilateral security instruments

To help Canadian organizations access international contracts involving classified information, Canada has negotiated bilateral security instruments with various countries and international organizations.

The countries and international organizations are:

• Australia
• Belgium
• Brazil
• Bulgaria
• Chile
• Denmark
• European Space Agency
• European Union institutions
• Finland
• France
• Germany
• Israel
• Italy
• Latvia
• NATO
• Netherlands
• New Zealand
• Norway
• Singapore
• South Africa
• Spain
• Sweden
• Switzerland
• United Kingdom
• United States

The Multinational Industrial Security Working Group

Canada is part of the Multinational Industrial Security Working Group that consists of senior government officials responsible for contract security. The group works to achieve shared security practices and procedures for the exchange of classified information required in international programs and contracts.

This international working group consists of:

• all NATO countries (except Iceland)
• Australia
• Austria
• Finland
• Israel
• New Zealand
• Sweden
• Switzerland
• European Commission (observer)
• European Defence Agency (EDA) (observer)
• European Space Agency (ESA) (observer)

When international alternative solutions may be used

In cases where there is no bilateral security instrument covering Protected A or Protected B information, customized international alternative solutions may be developed.

These alternative solutions depend on:

• the existence of a bilateral security instrument for the exchange of classified information
• the location of the foreign suppliers and their facilities (for example, within a member country of NATO or of the European Union)
• the nature of information to be shared
• the adequacy of the other country's privacy legislation

Security clauses for international alternative solutions

An alternative solution mainly uses security clauses to specify the security requirements. These clauses ensure that foreign contractors or subcontractors safeguard Canadian protected information according to similar standards as Canadian suppliers on various aspects, such as:

• personnel security screening
• physical security
• information technology security
• the protection of personal information

Security clauses also cover compliance visits, security breaches and the measures to be taken in case of loss or compromise of Protected A or Protected B assets and information exchanged under a contract or subcontract.

Security clauses for international alternative solutions are:

• contract-specific
• valid for the life of the contract or subcontract
• not transferable between contracts or subcontracts

How to determine if international alternative solutions are possible