Security Clearances and Eligibility in NATO Procurement

NATO classifies information according to the harm its unauthorised disclosure would cause. In practice there are four levels most relevant to suppliers: NATO UNCLASSIFIED, NATO RESTRICTED, NATO CONFIDENTIAL and NATO SECRET. Higher classifications exist but are rarely encountered in ordinary procurement work.

NATO UNCLASSIFIED is not formally classified but is still intended for official use only and is not freely distributed. Unauthorised disclosure of NATO RESTRICTED information could be disadvantageous to NATO's interests and already triggers baseline protective measures. NATO CONFIDENTIAL covers information whose disclosure could seriously harm NATO, while NATO SECRET applies to information whose disclosure could cause grave harm. The higher the level, the stricter the requirements on premises, IT systems, personnel and the entire supply chain.

For a bidder, the key is identifying which classification level applies to the specific role you would play in a given contract — the tender title or the general nature of the programme does not always reveal whether your own part touches classified information.

A Facility Security Clearance is confirmation, issued by a national security authority, that a company meets the requirements for handling information at a given classification level. An FSC is never a generic stamp — it always applies to a specific level and often to a specific site or facility.

The assessment covers physical security of premises, protection of IT systems, personnel reliability, transparency of ownership and management, and assurance that the company is not subject to foreign influence that could compromise security. FSCs are issued by each country's national security authority, and equivalent authorities operate in every NATO member state.

In practice, an FSC is needed whenever a contract requires handling classified information either during the bidding stage or during contract execution — not only once the contract has already been signed.

Beyond company-level clearance, every individual who will handle classified information must hold a Personnel Security Clearance valid up to the required level. A PSC is always personal and does not automatically transfer if someone changes employer or role.

Holding a clearance is not enough on its own: access to classified material also always requires a justified need-to-know. In practice this means the project team must be named and the necessary clearances initiated well before work begins, since the clearance process directly affects staffing plans and schedules.

Processing times and practices vary by country and by case, so current requirements and expected timelines should always be confirmed with your own national security authority.

Many NATO tenders require a formal declaration of eligibility, in which the bidder confirms it meets the security and background requirements of the contract. Some programmes also require national sponsorship — confirmation from the bidder's own government or a designated national authority that the company is an acceptable party to the procurement.

Sponsorship and eligibility declarations are often tied to the buyer's need to trace the entire supply chain and ensure sensitive information or technology does not end up with unauthorised parties. This is particularly relevant for higher-classification programmes and those involving subcontractors from multiple countries.

A substantial share of procurement run by NATO and its bodies — including the NSPA and the NCIA — is entirely unclassified or, at most, NATO UNCLASSIFIED. This includes routine goods, maintenance services, training, consulting and much of the construction work NATO commissions.

This means many companies can start as NATO suppliers without ever obtaining a dedicated security clearance. Eligibility for this work typically depends on other factors, such as an NCAGE code, registration in the relevant portal, a recognised quality system and financial soundness. A classification requirement usually enters the picture once a contract touches technical details of defence systems, operational planning or critical infrastructure.

Handling classified information is not limited to paper documents. It also covers storage and transmission of electronic data, discussions held in protected spaces, physical access control and approval of equipment used to process the material. In practice this can mean dedicated, accredited IT systems, locked archive facilities, access control and regular security training for staff.

The higher the classification level, the more precisely these arrangements must be documented, and the more often compliance may be inspected. It is best to plan these practices as part of a broader security management system rather than as a one-off addition for a single contract.

A security clearance requirement is usually stated already in the procurement notice or early in the tender documents, often in the section describing the programme's classification level and required clearances. The requirement may apply to the whole contract or only to specific parts of it, such as technical annexes or particular project phases.

It pays to read the tender carefully, including annexes and technical specifications, since security requirements are often set out in a separate document — such as a Security Aspects Letter or equivalent — that is not always visible from the main body of the tender at first glance.

Because processing facility and personnel clearances takes time and cannot be rushed retroactively, preparation should begin well before an interesting tender is actually published. In practice this means contacting your national security authority as soon as your company identifies the NATO market as a strategic area of interest.

It also helps to map out in advance which people in the organisation are likely to need a personnel clearance and to start their process alongside the company-level FSC application. This considerably shortens the time it takes to submit your first classified bid.

Clearance processes require both financial investment and internal effort: preparing applications, potentially adjusting premises and systems to meet requirements, and training staff. The scope of this effort scales directly with the classification level sought — the higher the level, the broader the requirements typically placed on facilities and systems.

It is best not to evaluate the cost and timeline against a single contract, but as a longer-term investment that opens the door to multiple future classified procurements under the same clearance.

Salpa monitors notices published by NATO's procurement bodies — including the NSPA, NCIA, ACT, ACO and NATO HQ — and analyses them with AI. Every notice summary, delivered in Finnish, Swedish or English, states whether the procurement requires a security clearance or is open, so you immediately see which competitions you can enter today and which need advance preparation.

Category-based alerts mean you don't have to scan every notice manually — you are notified only about the procurements that match your industry and readiness level. You can try the service with a 14-day free trial.