Overview

The Industry Security Assurance Centre is responsible for providing relevant defence contractors with up-to-date security and business continuity policy and guidance.

We provide specialist and relevant advice to reduce security and business continuity risks and amplify Ministry of Defence (MOD) and government security policy requirements. These security services are provided to DE&S and the defence industry. This includes the provision of visit and visitor clearances through the International Visits Control Office (IVCO).

Contact us

For routine security enquiries please contact the Industry Security Assurance centre: ISAC-Group@mod.gov.uk

Industry Security Assurance Centre responsibilities

We are responsible for:

• assisting UK companies in obtaining Facility Security Clearance (FSC) and/or Industry Personnel Security Assurance (IPSA) status when contractually required to hold classified material at SECRET (Foreign CONFIDENTIAL) or above
• helping UK companies to verify the security status of foreign facilities and citizens through liaison with national security authorities
• approving the hand carriage of classified material being taken overseas by casual courier
• approving some transportation plans relating to the movement of physical, classified assets travelling overseas
• sponsoring personnel security clearances for primary security controllers and their deputy at an FSC facility and IPSA personnel security controllers and their deputy, if required.

The ISAC Vault

The ISAC Vault is the website we use to share security advice and policy between DE&S and FSC and IPSA facilities. The available documentation is to promote effective security governance.

National security vetting and government contracting

Access more information on security vetting and clearance

Security awareness

Understanding UK threat levels

The threat of international terrorism comes from a diverse range of sources and a threat could manifest itself from a lone individual or group. The terrorist threat can take a number of forms, as terrorists may use a variety of methods of attack to achieve their objectives.

While the UK has faced a variety of terrorist threats in the past, a unique combination of factors place the current threat on a scale not previously encountered.

The terrorists draw their inspiration from a global message articulated by internationally recognisable figures.

The threat from terrorism when overseas

Information on threats to personal safety arising from terrorist activities, political unrest, lawlessness, violence, natural disasters, epidemics, anti-British demonstrations and aircraft/shipping safety. It is designed to help you make informed decisions about whether or not to travel to a particular country.

The threat of espionage

The UK is a high priority espionage target and a number of countries are actively seeking UK information and material to advance their own military, technological, political and economic programmes.

The International Visits Control Office

The responsibilities of the International Visits Control Office (IVCO):

• to process visit requests for foreign nationals who are required to visit MOD, Royal Navy, or Facility Security Clearance (FSC) sites in the UK
• to process visit requests for security cleared FSC Contractors seeking to visit overseas Government, Military and Contractor sites
• to process all requests for security cleared UK Nationals wishing to visit either NATO HQ or a NATO Agency
• to advise UK Defence Industry, MOD UK, and overseas Governments on the International Visits Control process

Please note: IVCO are not responsible for processing Military/Government Personnel visiting to Military/Government Establishment however there are exception sites, and your point of contact will advise you if a submission is required.

IVCO Contact information

E-mail: DESPSyA-IVCO@mod.gov.uk
Tel: +4430 015 98813
Opening times: 10am to 3pm, Monday to Friday

Please note we will be unable to deal with requests or queries outside these hours. Calls to IVCO should only be made within the times specified above.

Types of Visits

There are several types of visits that IVCO can process. The type of visit required can be selected on the appropriate form.

One-time

• valid for up to 3 years (inwards only) 1 year (outwards)
• valid only for the site(s) and subject specified at the outset
• maximum 100 visitors per visit request

Recurring

• covers a period of up to 12 months
• no limit to the number of visits within the 12 months
• valid only for the site(s) and subject specified at the outset

Emergency

• a visit that has not met IVCO’s required lead times
• only valid for a 30-day period
• only accepted in exceptional circumstances -must be supported by a Letterwritten ofjustification Justificationletter (LoJ).from the host site and the following Thisis Letterthe ofrequirement Justificationfor must:the be letter of justification, headed on host company paper, include the reason for the late RFV submission, justifyimportance theof importanceattendance of visitvisitors and include the reason that the visit cannot be rearranged within the standard lead times.arranged

Amendments

• enables visitors to be added to an extant visit (up to 100 visitors per amendment: a maximum of 10 amendments per visit)
• enables the end date to be extended (must not exceed the date limit of the original visit type. e.g., an extension to a recurring visit cannot exceed 12 months)
• additional sites cannot be added as an amendment to an RFV
• dates cannot be amended to bring start date of visit forward

International Agreements

• multinational Industrial Security Working Group (MISWG) / NATO
• visits to member states that do not exceed 21 days in duration and/or OFFICIAL SENSITIVE in classification can be arranged directly between site security establishments without prior IVCO approval.

European Defence Industry Restructuring (EDIR) Framework Agreement (Also Known as the LOI)

• visits up to OFFICIAL SENSITIVE can be arranged directly between facilities.
• visits can proceed up to Secret on agreed shareable projects ONLY (Project teams to advise)
• LOI /EDIR should be completed and sent directly to the security controller at the host site
• if the visit exceeds 21 days (regardless of classification) a copy of the completed LOI /EDIR needs to be submitted to IVCO for retention ONLY IVCO approval is not required

Please see below list for MISWG members:

• Albania
• AustraliaCanada
• AustriaFinland
• BelgiumIsrael
• BulgariaLuxembourg
• CanadaNorway
• CroatiaSlovenia
• Czech RepublicUK
• DenmarkAustralia
• EstoniaCroatia
• FinlandFrance
• FranceItaly
• GermanyMontenegro
• GreecePoland
• HungarySpain
• IsraelUSA
• ItalyAustria
• JapanCzech Rep
• LatviaGermany
• LithuaniaJapan
• LuxembourgNetherlands
• MontenegroPortugal
• NetherlandsSweden
• New ZealandBelgium
• North MacedoniaDenmark
• NorwayGreece
• PolandLatvia
• PortugalNew Zealand
• Romania
• SlovakiaSwitzerland
• SloveniaBulgaria
• SpainEstonia
• SwedenHungary
• SwitzerlandLithuania
• TurkeyNorth Macedonia
• UKSlovakia
• USATurkey

Outward Visitsvisits

• any UK Defence and Industry personnel travelling overseas to access or discuss classified material (including information or sensitive areas), who are visiting any industry with FSC, or Military/Government must submit an eRFV

Outward Visit Procedure

• UK Visitor: complete the following sections 1, 2 3 and 5 to 12 of the e-RFV form and forward the e-RFV to the Security officer. Please note if the visit classification is Restricted/Official-Sensitive or above, a government or military point of contact mustMUST be named in Annex 1 (Military sites may require 2 points of contact)
• Security Officer: complete Section 13 of the e-RFV to confirm they have checked that the visitor’s clearances stated on the e-RFV are correct and valid for the duration of the visit and then forward the request on to IVCO
• IVCO: complete Sections 4, 14 and 15 and forward the completed e-RFV to the relevant Embassy/National Security Agency

Please note: once submitted to the Embassy or National Security Agency IVCO do not receive updates. Please liaise with your host to determine the status of the visit. Security classification of the visit and individuals’ security clearances must be stated in full, i.e., Secret or Top Secret no abbreviations will be accepted.

NATO Visits Procedure

• NATO Agencies: Require an eRFV to be submitted. The securitySecurity classification of the visit and the securitySecurity clearancesClearances of the visitors must be written in full, prefixed by NATO. For example, NATO Secret. Visitors must hold a minimum of NATO Secret to access NATO agency sites
• NATO HQ: require a NATO HQ Pass application form to be completed. Unfortunately, an eRFV formsis are not accepted for visits to NATO HQ
• Therethere are 2 types of passes: temporary or annual
• Annualan annual pass requests will only be permitted if the visitor requires regular access at least twice a month.month, Foreach everymonth, otheranything visit,else thewill requestneed mustto instead be for a temporary pass
• UK Visitor: must complete sections 2 - 5 of the NATO HQ Pass Application form and forward to their security officer
• Security Officer: completes section 6 and forwards application to IVCO for processing.
• Visitorsvisitors must have valid security clearance. The expiry date of the security clearance mustMUST be declared, or the application will be rejected
• IVCO: will notify the requester of submission and provide the NATO reference number, which will be needed for access to site
• Ifplease note if WIFI access is required, it must be stated in Section 5 of the NATO Pass Application

Outward Visit Lead Times

Standard lead time is 25 working days’ notice for processing e-RFVs for countries not listed below. 

Please check minimum lead times on the table below for country to be visited these are the countries minimum requirement and do not allow IVCO to conduct their checks therefore please add an additional week on top.

All countries emergency visit requests require a minimum of 10 working days’ notice and must be supported by a letter of justification (LOJ) from the host site.

Lead times for both MISWG and other countries/NATO Organisations: 

Lead times (in weeks) for visits to MISWG member countries:

Lead times (in weeks) for visits to other countries/NATO organisations that are not part of MISWG

Additional information for outward visits

US

• do not use PO Box addresses
• zip codes (postcodes) must be supplied for all sites
• only use unclassified email addresses
• The US minimum lead-time is 30 working days. This means that the RFV must be in the US DoD visit system at least 30 working days prior to the requested start date of the visit. To process the RFV via the British Embassy Washington this means that the RFV must be submitted to IVCO at least 35 working days prior to the start date of the visit.
• Emergency visits have a 14-day lead time. These requests must be marked as ‘One-Time short notice visit’ instead of emergency visits. Urgent visit requests outside this lead time will be automatically rejected unless the visit is in support of a mission critical operation, which must be backed up by a BDSUS 1* sponsor.
• There must be a DoD PoC if there is a requirement to see protectively marked information. If there is no DoD PoC, the US Company must have either an Export License or Technical Assistance Agreement or other relevant approvals in place. This should be quoted in the subject field of the RFV. - The US DoD will shut down towards the end of the year for the New Year Moratorium, official dates are added to the ISAC Vault once received. All visits to the US must be submitted before the shutdown period, taking into consideration their 6-week lead time. The embassy will only accept visit requests that are deemed mission critical during this time.

Norway

• Norway will only accept the e-RFV template.  (To edit it, save the document to the desktop, open and edit it)
• Norway will not accept visit requests that extend beyond the current calendar year. For example, a year’s visit starting 01/06/2023 must end on 31/12/2023 and a new RFV submitted for the period in 2024

Israel

• Israel will not accept visit requests that extend beyond the current calendar year. For example, a year’s visit starting 01/06/2023 must end on 31/12/2023 and a new RFV submitted for the period in 2024. Israel can only accept RFV’S using the word tools RFV they are unable to open e-RFV.

Inward Visits

Foreign nationals visiting a UK MOD, Military or FSC contractor site that require access to protectively marked information and/or access to a restricted area must provide official confirmation of their security clearance in the form of an RFV.

Inward Visit Procedure

• Foreign National (Visitor): complete Sections 1-12 of the e-RFV form and forward the e-RFV to the Foreign Nationals’ Security Officer.  Please note if the visit classification is Restricted/O-S or above, a UK MOD or Military point of contact MUST be named in Annex 1. (IVCO will reject the RFV if one is not supplied)
• The Foreign Nationals’ Security Officer: complete Section 13 of the e-RFV and forward the request on to their National Security Advisor (NSA), London based Embassy or High Commission
• NSA, London based Embassy or High Commission: complete Section 14 and 15 and forward the complete e-RFV to IVCO
• IVCO: Processes the e-RFV in accordance with the information provided, and in conjunction with the relevant authority. The authority will consider whether the visit is justified, and that the clearance level required is acceptable. They will advise on any information that can/cannot be seen or areas that can/cannot be accessed by the visitor
• IVCO: Once the appropriate authority is content for the visit to proceed, IVCO will issue a formal approval letter to the Security Officer at the Host site(s)
• IVCO: informs the NSA, London based Embassy or High Commission of the outcome

Inward Visit Lead Times

All inward visit applications must be submitted on an electronic Request for Visit (eRFV) form and forwarded to IVCO.

• 20 Working days (not including date of submission) for recurring (Visit can last up to 1 year) and one-time visits (visit can last up to 3 years)
• 10 Working days for Amendments
• 10 Working days (not including date of submission) for Emergency visits (Visit can only last up to 30 days)

Frequently asked questions

What is a security aspects letter?

The ‘secret matter’ in an invitation to tender (ITT) or contract containing DEFCON 659A must be defined to the contractor in writing. The special obligations laid upon the contractor become legally effective only when the MOD has issued a notice in writing, defining which aspects of the ITT or contract are graded at OFFICIAL-SENSITIVE or above. This is achieved by means of a security aspects letter (SAL) written by the contracting authority, or by the inclusion of a security aspects clause in the ITT or contract. A SAL provides a contractual means of ensuring that security is addressed in the work that a Contractor is undertaking. A SAL is not required if the Contractor will not be exposed to any classified material graded above OFFICIAL. In such cases the Contractor must still be informed of their security obligations via DEF CONS included in the contract.

The contractor is required to confirm in writing that he understands and will implement the terms of the SAL or clause. The SAL is the legal instrument under which a UK contractor may be prosecuted under the Official Secrets Act. The SAL must therefore be issued to the contractor with the ITT or contract document. DE&S PSyA’s office must be informed in advance if this is not possible.

Do I have a designated field adviser?

In most cases, DE&S PSyA assurance advisors are assigned by region These regions are: Scotland; England (North); England (East); England (West); England (South East) and London; England (South West) and Wales; and Hampshire. For details of your assurance advisor please contact the Security Advice Centre.

What are the timescales involved for hand carriages and transportation plans?

The required notice periods for hand carriages are:

• EU/RoW (exc Australia/US) - 2 working days
• US/Australia - 5 working days.

For transportation plans the required notice periods are:

• within UK - 3 working days notice
• EU (except Italy) - 5 days
• US/Italy/Australia/rest of world - 10 days

Please note that due to current resource issues we may not be able to approve ‘emergency requests’ with shorter lead times.

Contact details for the Defence Courier Service

The Defence Courier Service (DCS) is based at:

Telephone: 020 8589 3432 or see the British Forces Post Office services guide

How does my company gain a Facility Security Clearance (FSC)?

Facility Security Clearance (FSC) formerly known as ‘List X’ refers to contractors or subcontractors which have been formally assessed by the relevant Government authority and reached the required standard as defined in GoVS 007 – Security to hold, process or manufacture materiel at SECRET (foreign CONFIDENTIAL) or above on the company premises. FSC is not available on request, it must be sponsored by a contracting authority (CA).

The CA can be:

• a Ministry of Defence entity: This is extensively, but not invariably, in the form of a project team (PT).
• another government department: A number of UK Government departments, may also award a facility FSC status.
• an existing FSC holding company: An enterprise with an existing government contract may act as a contracting authority to one or more third-party subcontractors who may inherit the responsibility to hold classified assets. Any move to appoint a subcontractor must be approved by the original contracting authority.
• NATO: Where a contract requires a UK enterprise to hold NATO CONFIDENTIAL (or above) information at their facility, the contracting authority will require assurance from DE&S PSyA’s office that the facility is suitable for FSC status.
• overseas governments and their contractors. In the event that an overseas contracting authority require a UK enterprise to be awarded FSC, the UK government may complete this on their behalf Key requirements for FSC status:
• a contract at SECRET (foreign CONFIDENTIAL) or above
• a requirement either for the work to be done on the contractor’s premises or for classified information to be held on site

Who is my contact for IT accreditation?

For sites with existing accredited systems please contact CyDR.

Inward visits questions

How much notice is required for a foreign national to visit a UK defence or FSC site?

IVCO require 20 working days notice (4 weeks) for all visits.

What is a RfV?

RfV is the abbreviation for the request for visit form (which must be completed for visit requests). The UK host company should advise visitors of the IVCO procedures and if necessary provide a copy of the RfV. The form should be completed by the foreign national (although companies are permitted to complete the form and email/fax a copy overseas for the signatures in Section 10 of the form).

How much notice is required for an emergency visit?

IVCO must have a minimum of 5 full working days notice.

Who should complete the justification for an emergency visit?

All emergency visit requests must be supported by a letter of justification. It is the responsibility of the UK host to provide written justification (on headed paper).

How many individuals can be placed on a visit request?

New visit requests should have no more than 100 names listed (however, 10 amendments can be made during the visit duration, again with a maximum of 100 names each time).

How many amendments can be made to a visit request?

A maximum of 10 amendments can be made per visit request.

Can I amend the site details on a visit request?

No. Amendments are limited to visitors and visit dates only.

Can I extend a current visits expiry date?

If the visit is recurring, has not already expired and has not exceeded 12 months then yes a visit can be extended (but please remember the maximum period for a recurring visit is 12 months).

What is MISWG?

Multi-national Industrial Security Working Group (please refer to the IVCO guidance notes).

PSyA documents

LOI request for visit form

PDF, 71.4 KB, 2 pages

NATO HQ pass application form

PDF, 158 KB, 1 page

Request for visit (RFV) form

MS Word Document, 107 KB

Electronic request for visit (RFV) form

PDF, 1.08 MB, 1 page

Digital signature instructions for requst for visit e-form

PDF, 1.05 MB

ListXtranet account application form

MS Word Document, 80.7 KB

This file may not be suitable for users of assistive technology.

Request an accessible format.

If you use assistive technology (such as a screen reader) and need a version of this document in a more accessible format, please email ddc-modinternet@mod.gov.uk. Please tell us what format you need. It will help us if you say what assistive technology you use.

Facility Security Clearance (FSC) policy and guidance for UK Defence contractors and MOD contracting authorities

PDF, 277 KB, 28 pages

Related links

• Defence Industry Security Association
• Foreign & Commonwealth Office
• The Security Service
• US Defence Security Service
• HMG Security Policy Framework