Guidance

HMG Personnel Security Controls (HTML)

Updated 31 October 2022

Introduction

This guide describes the government’s personnel security and national security vetting policies and how the processes work including:

• Why and in what circumstances personnel security and national security vetting controls may be applied
• The information individuals may be asked to provide about themselves, their partner, their family and other third parties, and the checks that may be made against it
• Decision making criteria and avenues of appeal

A statement of HM Government’s personnel security and vetting policy and set of frequently asked questions and answers can be found at the end of this guide.

This guide is published by the Cabinet Office, which is responsible for protective security policy issues, including national security vetting. For more information, download the guidance. (PDF, 308kb)

Cabinet Office 31 October 2022

The Purpose of Personnel Security and National Security Vetting

1 - One of the Government’s chief responsibilities is to protect national security – that is, to safeguard the country and the community against threats to order and wellbeing. Traditionally, national security has been understood to mean the protection of the state and its vital interests from attacks by other states. Over recent decades this has broadened to include threats to the citizen and our way of life, as well as to the integrity and interests of the state more generally.

2 - To protect national security the Government must have in place a range of protective security measures. Some of these relate to employees, temporary staff or contractors in sensitive or critical posts and may include a range of personnel security and other national security controls.

3 - Government employees (and temporary staff and contractors) and individuals working in other parts of the national infrastructure potentially have access to a range of sensitive assets (personnel, physical or information) and may be at risk from a wide range of threats. These threats may be related to terrorism, espionage, sabotage or serious and organised crime, but vulnerabilities may also arise from disaffected insiders who could seek to exploit improperly, damage or compromise the assets to which they have access. Similar considerations also apply to UK nationals taking up sensitive posts in international organisations.

4 - The purpose of personnel security controls (such as recruitment checks or national security vetting) is to confirm the identity of individuals (employees and contractors) and provide a level of assurance as to their trustworthiness, integrity and reliability. Whilst personnel security controls cannot provide guarantees, they are sensible precautions that provide for the identity of individuals to be properly established. In circumstances where risk assessments indicate that the necessary thresholds are met, they provide for checks to be made of official and other data sources that can indicate whether individuals may be susceptible to influence or pressure which might cause them to abuse their position or whether there are any other reasons why individuals should not have access to sensitive assets or sites.

Determining Personnel Security Controls

Risk Management

5 - Government departments and organisations employ a risk management approach to all aspects of protective security. Government organisations assess the risks that they face by weighing up potential vulnerabilities, potential threats, and the damage that could be done to identify appropriate and proportionate security measures, including personnel security controls. Across government departments, agencies, non-departmental public bodies (NDPBs), and security regulated industries, a range of controls are in place. These include minimum recruitment controls which need to be applied to those individuals with access to government assets or access to sensitive sites within national infrastructure; and incremental controls including national security vetting.

6 - For further information please see “Risk assessment for personnel” on the Centre for the Protection of National Infrastructure (CPNI) website.

Minimum Recruitment Controls – The Baseline Personnel Security Standard (BPSS)

7 - All those with access to government assets are subject to recruitment to the requirements of the Baseline Personnel Security Standard (BPSS). This includes all applicants for employment in the civil service and armed forces and applies to both permanent and temporary staff and private sector employees working on government contracts, with access to government assets. The BPSS requires the verification of the following four elements:

a) Identity: to verify identity departments and organisations will ask candidates to provide, in advance of any final offer of employment, a selection from the following:

• Confirmation of name, date of birth and address
• National insurance number or other unique personal identifying number (where appropriate)
• Full details of previous employers (name, address and dates), over the past three years
• Confirmation of any necessary qualifications/licences
• Educational details and references where someone is new to the workforce
• Confirmation of permission to work in the UK if appropriate.

b) Employment history (past three years): As part of the BPSS, departments, and organisations must seek verification of a candidate’s employment history, i.e. previous employers, jobs held and dates employed. They must also check any periods spent overseas for a total of six months or more during the previous three years. It is for departments, agencies and organisations to decide whether they wish to obtain references from previous employers (i.e. covering aspects such as an individual’s skills or achievements) as part of their pre-employment checks.

c) Nationality and Immigration Status: The Civil Service, like any employer, is subject to the Immigration, Asylum and Nationality Act 2006 and departments and organisations are required to verify whether or not new employees have the right to remain and work in the UK. In addition, civil employment under the Crown, in particular the Home Civil Service is subject to nationality rules which are statutorily based. More information on the Civil Service Nationality Rules. Therefore, as a potential employer, all government departments, agencies or organisations will take steps to verify nationality and right to work in the UK.

d) Criminal record (unspent convictions only): successful candidates will also be required to disclose an unspent criminal record via the Basic Disclosure service operated by Disclosure Barring Service (for England and Wales from 1 January 2018), Disclosure Scotland or Access Northern Ireland. Prospective employees who have recently come to the UK or lived abroad may be asked to provide overseas police certificates or certificates of good conduct where these are available so that a similar assurance can be gained.

8 - Some departments may impose additional pre-employment checks (for example additional references). These will be explained to applicants by the appropriate recruiting department or organisation.

Further information

9 - Applicants for a vacancy who would like to know more about how to meet the requirements of the BPSS should contact the recruiting department or organisation.

10 - The BPSS represents best practice in recruitment controls and similar personnel security measures are recommended by the Centre for the Protection of National Infrastructure (CPNI) for individuals who are employed across the national infrastructure. See “A Good Practice Guide on Pre-employment Screening” at the CPNI website.

Incremental Controls – National Security Vetting

11 - In some areas of work, either within government, the armed forces, the national infrastructure, the police, or security regulated industries, more significant damage to national security could arise from the compromise of sensitive information or the abuse of access to sensitive sites, individuals or systems. The impact of such risks occurring may require additional precautions to be taken. These precautions will include enhanced physical, information and IT protective security measures.

12 - They may also include more detailed screening of employees and contractors engaged in particular roles, over and above the requirements of the BPSS which must be met before such screening can be carried out. BPSS is not a requirement for the Accreditation Check for non-government employees/contractors, for which equivalent associated background checks are conducted. In circumstances where it is assessed to be necessary and proportionate, national security vetting will be carried out. A statement of HMG’s policy on personnel security and national security vetting is at Annex A.

13 - Whilst national security vetting provides such information about an individual as is required for security purposes, the constituent checks which make up the process can only offer a “snapshot”. Consequently, information may be retained to carry out ongoing checks, and careful personnel security management arrangements will be put in place to ensure continuing assurance about an individual, whilst they work in such important and vulnerable areas.

The Vetting Process

14 - National security vetting may be carried out on recruitment and at any subsequent point when, for example, changes in duties or responsibilities require it. Individuals will be advised by their employer, contracting authority (or prospective employer/contracting authority) if and when they need to be subject to national security vetting. It is government policy that individuals should not be expected to hold an existing security clearance in order to apply for posts or contracts that require vetting, except in exceptional circumstances where such posts are short term and need to be filled urgently.

15 - No one is obliged to be subject to national security vetting. However, the occupation of a vetted post will be contingent upon successful completion of the process. Subject to a risk assessment, conditional appointments may be made, pending satisfactory completion of the process.

16 - In order to complete the national security vetting process, the vetting individual will be required to provide a range of personal information, which for some levels of national security vetting will require the completion of a form (usually electronic) known as a “Security Questionnaire.”

17 - This information may be processed by the organisation/department that requires the clearance (the sponsor) and/or passed directly to United Kingdom Security Vetting (UKSV) to carry out the checks on their behalf and assemble the information required to make a decision.

18 - Decisions on national security vetting clearances are made either by UKSV on behalf of some departments, by the department or organisation themselves or by the vetting authority of the department or organisation that requires the clearance. Paragraph 36 onwards describes the decision-making process. Overall, the objective is to ensure that the individual being vetted is a fit and proper person to hold a national security clearance, and is unlikely to be in a position where they may abuse their access, submit to pressure or bribery.

Component Checks

19 - The four levels of national security vetting clearance are described in detail at Annex B, including the combination of checks carried out. At each level of clearance there will be checks against relevant records held by the HMG or its agencies. Depending on the level of clearance, these checks will relate to:

• the individual;
• their partner and recent former partners, if any;
• their parent(s), step parent(s), legal guardian(s) or any individual who the applicant declares has had a significant influence on them during their upbringing e.g. long-term foster carer, parental figure(s) etc. (and those of their partner);
• other family members or people the individual lives with (e.g. co-residents).

20 - In respect of existing employees, departments will also check against any records they may hold about the vetting individual, including work history and behaviour. Checks may also be made of financial circumstances (credit reference and financial management generally, including any financial commitments or assets held jointly with a partner), and medical records. Interviews with the individual undergoing vetting and/or referees may be carried out to clarify any issues that arise in the course of these checks.

Informing family and partners

21 - Individuals being vetted may want to share this guidance with those individuals who could be the subject of related record checks. Where an individual is applying for a particularly sensitive post the prospective employer may offer you more detailed advice.

22 - UKSV will not contact former partners at any point of the vetting process.

23 - The security questionnaires will also ask the individual to declare any association with individuals about whom they have security concerns. In these circumstances the individual should not inform them of this.

Residency

24 - For meaningful checks to be carried out individuals will need to have lived in the UK for a sufficient period of time, depending on the level of clearance, to enable appropriate checks to be carried out and produce a result which provides the required level of assurance. Whilst a lack of UK residency in itself is not necessarily a bar to a security clearance, decision makers will need to consider what checks can be carried out and the information available upon which to make a decision. Depending on the level of clearance being carried out this will usually range from three to ten years.

Information Handling

25 - Information gathered as part of the national security vetting process will be held securely and only for so long as it is required. Relevant information will be passed to the organisations whose data is used in order to allow checks to be carried out (including the Security Service and the commercial provider of the credit reference check, where relevant) for the purposes of national security vetting.

26 - The sponsor and UKSV will maintain records of those individuals who have been security cleared, and may keep records of those refused a clearance or who have had their clearance withdrawn. If and when an individual changes jobs, these records may be shared with the prospective new employer or contracting authority if a national security vetting requirement to do so exists.

27 - Vetting records will be used to support ongoing personnel security management, for example prompting renewals of clearances when these fall due, or to provide for periodic further checks against records.

Levels of National Security Clearance

28 - There are four levels of national security vetting clearance: an Accreditation Check (AC), / Level 1 A (L1A), a Counter Terrorist Check (CTC), / from 31 October 2022 Level 1 B (L1B) Interim policy, Security Check (SC) and Developed Vetting (DV). Each is configured to provide an appropriate level of assurance in respect of a range of threats, and the impact and damage that could arise from compromise, loss or improper exploitation of the information, other assets or sites to which an individual has access.

29 - The level of enquiries may vary subject to the level of clearance required, although at each level similar considerations will inform decision making.

30 - The four levels of national security vetting clearance, together with the BPSS which underpins them (or equivalent background check for the Accreditation Check/L1A), are described in more detail at Annex B.

National Security Vetting Considerations

31 - This section describes the type of information that will be considered as part of the national security vetting process. The process seeks to provide decision makers with an assurance that the individual is suitable to exercise the responsibilities of the role for which the clearance is required, and does not present an unacceptable risk to national security. The process is not intended to catch individuals out or exclude any particular group of people other than those who present such a risk.

32 - Some enquiries into personal circumstances, finances and lifestyles will only be made directly as part of the Developed Vetting (DV) or Security Check (SC) process; the considerations described below will be relevant to all national security vetting clearance decisions. For example, whilst enquiries into an individual’s behaviour or background are not generally made as part of the Accreditation Check/Level 1A (AC/L1A) or the Counter Terrorist Check/ Level 1B(CTC/L1B), the decision maker may still take account of such factors if they come to light.

Records

33 - A range of considerations may be relevant to a vetting decision:

• Employee/Contractor records: any indication from employee or contractor records of unreliability, relevant in a security context, for example instances of disciplinary action related to abuse of trust, c carelessness, dishonesty, lack of discretion or disregard for security controls.
• Criminal record information: whilst a criminal record (the Rehabilitation of Offenders Act 1974 allows for consideration of both spent and unspent convictions for national security purposes) is not necessarily a bar to a security clearance, the decision maker will need to consider whether any conviction is relevant to their assessment of suitability. The more serious, repeated, and more recent the offence(s), the more weight may be attached to it as an indicator of possible unsuitability. Failure to declare convictions on the security questionnaire may also give rise to serious concerns.
• Traces in Security Service records: in a small number of cases, there will be national security concerns arising from checks undertaken by the Security Service against their records. These could include the individual or their family or associates having links with (or giving support to) terrorism, espionage or the proliferation of weapons of mass destruction. Where information is held by the Security Service, this does not rule out granting a clearance. If the individual, family member or associate features in a Security Service record, the Service will advise the sponsoring department or vetting authority of the relevance and significance of the information it holds.
• Financial irregularities: such as unpaid bills or debts, or other examples of poor financial judgement or management, excessive expenditure, or high levels of indebtedness.

34 - Inconsistencies, discrepancies or gaps in information provided by the individual that are not confirmed by checks against official records (for example in employment history) may prompt further enquiries.

Personal Circumstances, Personality and Lifestyle

35 - Due consideration will also be given to the individual’s personal circumstances, personality and lifestyle. The process does not require individuals to conform to a given template and recognises that everybody’s situation will be very different. Consequently, a very wide range of factors may be considered, which could indicate: potential conflicts of interest; vulnerability (direct or indirect) to pressure; instances of irresponsible behaviour; poor judgement and lack of maturity; extreme beliefs; and serious physical or psychological disorders.

Decision Making

36 - The purpose of vetting is to determine whether the individual may present a security risk such that they should not be employed in a sensitive post. Vetting decisions will be taken by the vetting authority, the department or police force which requires the clearance. Assessments will take into account all relevant information obtained during the vetting process including both positive and adverse information gathered in relation to the individual. These factors are all carefully considered along with the security requirements of the post in order to reach a reasoned conclusion as to the individual’s suitability for the level of clearance in question.

37 - The process will consider whether or not any adverse information that arises is serious enough in itself to justify refusing or withdrawing a security clearance. When information of security concern about the individual is discovered, the assessor will consider a range of factors, including, where relevant, whether the individual has been as open as possible about the information and has resolved or appears likely to favourably resolve the concerns to which it gives rise, and the risk the information poses in relation to the individual’s access to sensitive assets and/or sites.

38 - In relation to conduct which may give rise to security concerns, the assessor will consider a range of factors, including: the seriousness of the conduct, the frequency, circumstances and reasons for it; and the potential it offers for associated pressure, coercion, exploitation or duress; and its implications for the individual’s trustworthiness and reliability.

39 - When considering the security significance of personal circumstances or behaviour that can lead to vulnerability, the assessor will not allow personal and cultural bias to affect their judgement. Personal circumstances or behaviour only become of security significance if they cause vulnerability to pressure or improper influence or may cause the individual to commit security breaches.

40 - Applicants for National Security Vetting will be notified when a clearance has been granted. Where a clearance is refused or withdrawn, individuals will be informed, and provided with reasons, where possible. They will also be provided with information about the mechanisms for internal and external appeal. Subject to where equality laws require it, there is no requirement to inform applicants for employment of the reason why they have been refused employment: where the decision is on security grounds, the individual should preferably be told of the reasons, although considerations of national security or confidentiality may prevent this.

Ongoing Personnel Security Management

Renewals

41 - National security vetting clearances will be reviewed on a regular basis to ensure that they reflect changes in circumstances, so periodically individuals may be asked to complete the security questionnaires or provide personal information again, and information held by the vetting authorities may be rechecked against updated records. Reviews can also be carried out at any time if material changes in circumstances are reported or come to light.

Security Appraisals

42 - In addition, depending upon the potential damage that could arise from the compromise of sensitive assets or sites, individuals and their line managers may be asked to carry out an annual security appraisal process. This will require the individual to declare any changes in personal circumstances or any other matters that could be relevant to their continued retention of security clearance. Similarly, the individual’s line manager will be invited to comment on the individual’s security awareness and behaviour and/or raise any security concerns.

43 - Anyone working in a national security vetted post will be expected to be mindful of security controls; maintaining good levels of security will be vital. Organisations will respect their employees’ and contractors’ privacy, but will continue to assess their vetted workforce after appointment to identify any changing or suspicious patterns that could give rise to security concerns. More advice about ongoing personnel security is available from the CPNI website.

44 - All valid security clearances are portable across the majority of government departments and organisations. Clearances identified as being low risk are portable by default and will not require the importing department to review the vetting record during the transfer process. However, the receiving department or organisation maintains the right to review a clearance holder’s vetting record and consider whether they should be appointed to a post for cases identified as moderate risk and above. Organisations may decline a transfer at any level in exceptional cases where there are role specific requirements. Indeed, some roles may require additional checks before the receiving department can accept or refuse a clearance.

Adverse Vetting Decisions: Appeals Process

Internal Review Mechanisms

45 - For existing employees, the ways in which decisions to refuse or withdraw clearance may be reviewed will include an internal appeals process, independent of the original decision-making process.

46 - An internal appeal to the Head of Organisation (or nominated senior official) may result in the original decision to refuse or withdraw clearance being overturned. The internal appeal process will provide for the arbiter having access to all the material available to the original decision maker, and may (if the decision was made upon the basis of advice from the police, or the security and intelligence agencies) ask to have made available the original material upon which the assessment was made and advice was given. They will operate as transparently as possible, within the bounds of national security and third-party confidentiality. The arbiter of the internal appeal should consider (i) the decision (including scrutinising information upon which any advice relied upon was based), (ii) the decision-making process, and (iii) the level of disclosure provided to the appellant.

47 - Appeals will follow natural justice principles. Individuals who hear appeals will have had no prior involvement in the case; in particular they will not have participated in the initial decision to refuse or withdraw the clearance, nor have discussed outside the formal appeals mechanism any aspects of the case with those who participated in the original decision making. The process should provide the individual with the opportunity of a face-to-face interview, with a record of that interview being made available to them.

Security Vetting Appeals Panel

48 - The Security Vetting Appeals Panel (SVAP) is an independent advisory body which provides a final means of challenging a decision to refuse or withdraw a national security vetting clearance, once an internal appeal has been dismissed. Its members are appointed through a process of fair and open competition. A panel of three is convened to hear cases as they arise and consists of a Chair and two Members: the Chair (and Deputy Chair) are senior retired members of the judiciary.

49 - The Panel is available to hear appeals from individuals in government departments and other organisations, or those employed by contractors/sub-contractors (or self-employed contractors) of those departments and organisations, who have exhausted the internal appeals process and who remain dissatisfied with the outcome. It is not available to candidates for recruitment. (Separate SVAP arrangements exist for applicants to specific oversight bodies of the Security and Intelligence Agencies, and for staff, contractors and recruits to the agencies via the Investigatory Powers Tribunal.)

50 - Those wishing to take their case to the Panel must register their intention to appeal with the Secretariat, in writing, and within 28 days of receiving the final notification of the rejection of an internal appeal.

51 - The Panel will ask for a statement from the appellant and the organisation and a hearing will be arranged. The appellant may be accompanied by a “friend” who can help them present their case. Where the decision turns on sensitive information that cannot be shared with the appellant, the panel may in exceptional circumstances offer the appellant the opportunity to request the appointment of a special advocate if they assess that to be necessary in the interests of natural justice.

52 - The Panel will confine itself to reviewing the decision to refuse or withdraw a national security vetting clearance and the processes involved. It will make recommendations to the Head of the Department or organisation concerned in the light of its findings. It can recommend that the decision to refuse or withdraw security clearance should stand, or that the security clearance should be given or restored. It may also comment on the vetting procedures and the adequacy of the internal appeals process and make recommendations. The Panel will not become involved in examining any subsequent action taken by the organisation, nor will it be concerned in awarding compensation.

Other Review and Appeal Mechanisms

Discrimination Claims

53 - If an individual (whether an existing employee or an applicant for employment) believes that they have been unlawfully discriminated against, they may take action in the relevant statutory tribunal. Employment Tribunals in England and Wales and in Scotland, and Industrial and Fair Employment Tribunals in Northern Ireland, can hear complaints of unlawful discrimination on grounds including gender, race, disability, religion, age and sexual orientation. (In Northern Ireland, Fair Employment Tribunals can also hear complaints of unlawful discrimination on grounds of political opinion). Where complaints are made of unlawful discrimination in relation to national security vetting decisions, the fullest possible disclosure, consistent with the protection of national security, will be made to enable the substance of the complaint to be dealt with appropriately.

Data Protection

54 - If an individual considers that personal data used in the vetting process is incorrect, or has been incorrectly handled, they should, in the first instance, raise this with the relevant data controller. For AC/L1A clearances, this will be their employer or the sponsoring organisation. For CTC/L1B, SC and DV clearances, this will usually be UKSV or the relevant police force or agency, and concerns should be raised directly with them. The individual should request a copy of the relevant privacy notice, explaining how their data is processed and how to action their rights. If the individual’s concern is not satisfied after exhausting the data controller’s complaints procedures, they may submit a complaint to the Information Commissioner pursuant to the General Data Protection Regulation. An individual also has the right to apply to a court for an order that inaccurate personal data about the individual be rectified, blocked, erased or destroyed. The use of personal data for the purposes of national security vetting decisions is excluded from the reach of those statutory provisions in so far as such an exclusion is necessary for the protection of national security.

Investigatory Powers Tribunal

55 - Separate SVAP arrangements exist for applicants to specific oversight bodies of the Security and Intelligence Agencies, and for staff, contractors and recruits to the agencies via the Investigatory Powers Tribunal. The Tribunal, which is an independent body chaired by a senior judge and whose members are senior lawyers, will examine the case carefully, and has the right to examine any intelligence material. If it upholds a complaint, the Tribunal will order appropriate action to remedy the situation.

Judicial Review

56 - The mechanisms described above are separate from an individual’s right (available to both applicants for work and existing workers) to seek a Judicial Review of their case when other remedies have been exhausted. The Court in a Judicial Review will consider whether or not the original decision-making process was properly conducted; whether the conclusion it reached was a reasonable one, in all the circumstances; and whether proper and sufficient reasons have been given. Although the Court cannot replace the original decision with one of its own, it can quash the decision, and send the case back for reconsideration if it finds that either the process used to make the decision was faulty, or that the decision itself was unreasonable in the circumstances. A Judicial Review will take place if the High Court accepts that it has jurisdiction to hear the case. This should not (usually) happen unless and until all other avenues of appeal have been exhausted.

Annex A - Statement of HMG personnel security and national security vetting policy

Minimum Personnel Security Controls

1 - It is HM Government’s policy that all areas of government and the national infrastructure should include in their recruitment processes certain basic checks. These checks include verification of the applicant’s identity, employment history, their right to work in the UK and, if appropriate, checks of any unspent criminal records. Within government these controls are described in the Baseline Personnel Security Standard. In addition, the Centre for the Protection of National Infrastructure (CPNI) produces a range of relevant guidance on personnel security and makes similar advice available to the wider national infrastructure.

National Security Vetting

2 - National security vetting comprises a range of additional checks and may be applied where a risk assessment indicates it is proportionate to do so. The risk assessment process takes account of the access an individual may have to sensitive assets (physical, personnel or information) at risk from a wide range of threats. These threats include: terrorism, espionage, or other actions that could threaten the United Kingdom. The requirements of international agreements concerning the protection of allies’ information may also inform such assessments.

3 - It is government policy that individuals should not be expected to hold an existing security clearance in order to apply for posts that require vetting, except where such posts are short term and need to be filled urgently.

4 - There are four different levels of national security vetting clearance:

• Accreditation Check (AC), / Level 1A (L1A),
• Counter Terrorist Check (CTC), / from 31 October 2022 Level 1B (L1B) interim policy,
• Security Check (SC) and
• Developed Vetting (DV).

Before any such clearance is undertaken the requirements of the Baseline Personnel Security Standard (or equivalent background check for the Accreditation Check for non-government employees/contractors),must be met. Whilst the information required and the range and depth of checks undertaken at each level may vary, they are all intended to allow Government departments and organisations, the Armed Forces, police forces and other vetting authorities to assess whether individuals who are to be employed in sensitive posts or critical functions might represent a security risk either directly or indirectly.

Checks

5 - Depending on the level of clearance required, individuals subject to national security vetting (including British Citizens taking up sensitive posts in international organisations) will be asked to provide personal information about themselves, partners, family members and other associates. It may be checked, and retained for future checks, against:

• Relevant personnel records held by the employing department or company
• Criminal records (both spent and unspent as defined by the Rehabilitation of Offenders Act))
• Information held by the Security Service.
• Credit reference agency records

6 - The process may also take account of:

• Financial circumstances generally
• Third party character references
• Any medical considerations that could give rise to security concerns

7 - Interviews with the individual and referees may be carried out to establish good character and to verify information that has been provided.

Decision Making

8 - National security vetting decisions may only be taken by Government departments, agencies, the Armed Forces, police forces or relevant vetting authorities All the available information is taken into account to reach a reasoned decision on an individual’s suitability to hold a security clearance.

9 - Security clearances may be refused or withdrawn where:

• There are security concerns related to an individual’s involvement or connection with activities, organisations or individuals associated with the threats described in this Statement (or any similar new threats that emerge);
• Personal circumstances, current or past conduct indicate that an individual may be susceptible to pressure or improper influence;
• Instances of dishonesty or lack of integrity cast doubt upon an individual’s reliability;
• Other behaviours or circumstances indicate unreliability.

10 - Wherever possible existing employees will have an opportunity to discuss, comment on and challenge any adverse information that arises. However, in certain circumstances it may not be possible to share such information as this could compromise national security, the public interest or third-party confidentiality.

Avenues of Appeal

11 - Existing employees who are subject to national security vetting and either refused a security clearance or whose clearance is withdrawn may appeal against such decisions. All departments and organisations that carry out national security vetting must provide for an internal appeal process. Where individuals remain dissatisfied they may appeal to the Security Vetting Appeals Panel, an independent body.

12 - The Panel will consider the case, review the information and invite the appellant and the organisation to make representations. The Panel will make recommendations to the Head of Department or organisation in the light of its findings as to whether the decision should stand or be reviewed. The Panel may also comment on the security vetting procedures and adequacy of the internal appeal arrangements.

13 - There are no national security vetting appeal routes for applicants for employment who are refused a security clearance. There are no national security vetting appeal routes for applicants for employment who are refused a security clearance. Separate SVAP arrangements exist for applicants to specific oversight bodies of the Security and Intelligence Agencies, and for staff, contractors and recruits to the agencies via the Investigatory Powers Tribunal. Any individual may apply to an Employment Tribunal if they feel that they have been discriminated against in any part of the recruitment process

Ongoing Personnel Security Management

14 - The national security vetting process provides an assessment of the individual at the time the process is carried out, but active, ongoing personnel security management is required to ensure that a security clearance remains valid. As a minimum this will involve active consideration of the individual’s continuing conduct in respect of security matters; it will also require checks to be repeated at regular intervals.

Annex B - HMG personnel security controls

Type of control and who needs it

Baseline Personnel Security Standard (BPSS)

Individuals with any access to government assets. This means all civil servants, members of the armed forces, temporary staff in departments, and government contractors generally.

• Allow access to UK OFFICIAL assets and occasional access to UK SECRET assets
• Required to work in areas where SECRET and TOP SECRET information may be overheard
• Individuals who require access to Public Services Network (PSN)

What it involves

Verification of:

• Identity.
• Employment history (past three years).
• National and immigration (right to work) status.
• Unspent criminal record.

Additionally, individuals are required to give a reasonable account of any significant periods (a total of six months or more in the past three years) of time spent abroad.

Additional comments

The BPSS is the recognised standard for the pre-employment screening of individuals with access to government assets. It is not a formal security clearance but its rigorous and consistent application underpins the national security vetting process at CTC, SC and DV. An equivalent background check underpins the AC.

Above and beyond the BPSS, some organisations may seek references and include other enquiries (e.g. health) as part of their recruitment process.

Type of control and who needs it

Accreditation Check (AC) / Level 1A (L1A)

Individuals employed in posts which:

• Require an Airport Identification Card or UK air carrier Crew Identification Card which provides unescorted access to the security restricted area of UK airports.
• Provide UK aviation security training.
• Undertake the validation of air cargo security standards overseas for carriage of cargo to the UK.

What it involves

Verification of:

• Identity.
• Employment, education and any gaps during at least the preceding five years.
• Unspent criminal record.
• A check against records held by the UK Government or its agencies.

Additional comments

Some elements of the verification may be undertaken by the employer, airport operator or air carrier.

Checks are limited to the individual only.

An AC/L1A clearance is normally valid for up to five years, provided the sponsor organisation complies with the ongoing provision of data, as required by aviation security regulations. Where this is not done, an AC/L1A clearance is valid for 12 months.

Type of control and who needs it

Counter Terrorist Check (CTC) / Level 1B (L1B)

CTC supports Individuals who are to be employed in posts which:

• Involve proximity to public figures assessed to be at particular risk from terrorist attack.
• Give access to information or material assessed to be of value to terrorists.
• Involve unescorted access to certain military, civil, industrial or commercial establishments assessed to be at particular risk from terrorist attack.

L1B (from 31 October 2022) supports:

• Close proximity access to public figures who are assessed to be at particular risk from terrorists, hostile state actors and serious organised crime groups.
• Access to information or material assessed to be of value to terrorists, hostile state actors and serious organised crime groups.
• Unescorted access to certain military, civil, industrial and commercial establishments assessed to be at risk from terrorists, hostile state actors and serious organised crime groups.

What it involves

• Successful completion of the Baseline Personnel Security Standard.
• Completion, by the individual, of a Security Questionnaire.
• A departmental/company records check which might include e.g. personal files, staff reports, sick leave returns and security records.
• A check of both spent and unspent criminal records.
• A check of Security Service records.
• If there are any unresolved security concerns about the individual or if recommended by the Security Service, the individual may also be interviewed.

Additional comments

Checks may extend to third parties included on the security questionnaire.

A CTC/L1B (Interim Policy) clearance must be formally reviewed after 10 years (five years for non-Facility Security Clearance contractors - previously known as List X contractors) or at any time up to that point at the discretion of the vetting authority.

Type of control and who needs it

Security Check (SC)

Individuals who are to be employed in posts which:

• Require them to have long-term, frequent and uncontrolled access to SECRET assets and/or occasional, supervised access to TOP SECRET assets.

And for individuals who:

• While not in such posts, will be in a position to directly or indirectly bring about the same degree of damage.
• Will have sufficient knowledge to obtain a comprehensive picture of a SECRET plan, policy or project.
• Are being considered for employment where it would not be possible to make reasonable career progress without security clearance for access to SECRET assets.
• Require access to certain levels of classified material originating from another country or international organisation.

What it involves

• Successful completion of the Baseline Personnel Security Standard.
• Completion, by the individual, of a Security Questionnaire.
• A departmental/company records check which will include e.g. personal files, staff reports, sick leave returns and security records.
• A check of both spent and unspent criminal records.
• A check of credit and financial history with a credit reference agency.
• A check of Security Service
• Exceptionally, if there are any unresolved security concerns about the individual, or if recommended by the Security Service, the individual may also be interviewed.
• In the event of any unresolved financial concerns, the individual may also be required to complete a separate Financial Questionnaire so that a full review of personal finances can be carried out.

Additional comments

Checks may extend to third parties included on the security questionnaire.

An SC security clearance must be formally reviewed after 10 years (seven years for non-Facility Security Clearance contractors) or at any time up to that point at the discretion of the vetting authority.

Type of control and who needs it

Developed Vetting (DV) Individuals who are to be employed in posts which:

• Require them to have frequent and uncontrolled access to TOP SECRET assets or require any access to TOP SECRET codeword material.

And for individuals who:

• While not in such posts, will be in a position to directly or indirectly bring about the same degree of damage.
• Require frequent and uncontrolled access to Category I nuclear material.
• Require access to certain levels of classified material originating from another country or international organisation.

What it involves

• Successful completion of the Baseline Personnel Security Standard.
• Completion, by the individual, of a Security Questionnaire.
• A departmental/company records check which will include personal files, staff reports, sick leave returns and security records.
• A check of both spent and unspent criminal records.
• A check of credit and financial history with a credit reference agency.
• A check of Security Service records.
• A full review of personal finances.
• A detailed interview conducted by a trained Investigating Officer.
• Further enquiries, including interviews with referees conducted by a trained Investigating Officer.

Additional comments

Checks may extend to third parties included on the security questionnaire.

The full review of personal finances will include an assessment of an individual’s assets, liabilities, income and expenditure both on an individual basis and taking into account the joint position with a spouse or partner.

A DV security clearance must be reviewed every seven years or at any time up to those points at the discretion of the vetting authority.

Annex C - Frequently asked questions

What is the purpose of personnel security controls?

The purpose of personnel security controls is to ensure that a person’s character and personal circumstances are such that they can be trusted to work in a position which may involve access to sensitive assets or sensitive sites.

What threats do personnel security controls protect against?

Personnel security controls, together with other protective security measures, help to counter the threats to national security which may stem from:

• Foreign intelligence services.
• Terrorist groups.
• Those who wish to overthrow or undermine parliamentary democracy by political, industrial or violent means.
• Individuals:
  • who may be susceptible to pressure or improper influence; or
  • who have shown dishonesty or lack of integrity which throws doubt upon their reliability; or
  • who have demonstrated behaviour or are subject to circumstances which may otherwise indicate unreliability.

What are the personnel security controls?

The Government uses five levels of personnel security controls depending on the level of assurance required:

• Baseline Personnel Security Standard (BPSS)
• Accreditation Check (AC)/ Level 1A (L1A)
• Counter Terrorist Check (CTC) / from 31 October 2022 Level 1B (L1B)
• Security Check (SC)
• Developed Vetting (DV)

BPSS involves carrying out a limited number of enquiries (such as checking identity documents and employment/education references) to confirm the applicant’s identity. The requirements of the BPSS should be met before national security vetting is undertaken.

BPSS is not a requirement for the AC/L1A for non-government employees/contractors, for which equivalent associated background checks are conducted. AC/L1A involves checks of identity, employment/education history, and a check against records held by the

UK Government and its agencies. Such clearance is required by those working in roles within the aviation sector who require an Airport Identification Card or a UK air carrier Crew Identification Card, which grant unescorted access to the security restricted area of airports. It also applies to aviation security instructors and validators.

CTC/L1B involves an additional check against UK criminal and security records. Such clearance is required for access to certain establishments or public figures where there is a specific threat from terrorism (L1B clearance supports close proximity access to public figures who are assessed to be at particular risk from terrorists, hostile state actors and serious organised crime groups and access to some sensitive information.) The process for CTC/L1B clearance includes:

• BPSS pre-employment control;
• completion of a security clearance questionnaire by the candidate;
• checks against UK criminal and security records;
• it may also include an interview.

SC is the most widely held level of security clearance. It is required for jobs involving regular and uncontrolled access to sensitive information which is classified as ‘SECRET’, and some posts in international organisations. The process for SC clearance includes:

• CTC/L1B checks;
• a credit reference check;
• if considered necessary, checks against the criminal and security records of relevant foreign countries.
• it may also include an interview.

DV is the most detailed and comprehensive form of security clearance. It is required for sensitive jobs and tasks which involve long-term, frequent or uncontrolled access to ‘TOP SECRET’ material, or certain posts in international organisations. The process for DV clearance includes:

• SC checks;
• completion by the applicant of a DV questionnaire;
• a review of the applicant’s personal finances;
• Written testimony from an applicant’s referees;
• a detailed interview with an applicant conducted by a vetting officer.

Who is subject to the controls?

Personnel security controls may be applied to those in the following categories whose employment involves access to sensitive (not necessarily classified) government information, other valuable assets, or sensitive sites:

• Crown servants, including:
  • civil servants;
  • members of the security and intelligence agencies;
  • members of the armed forces; and
  • the police.
• Employees of certain other non-government organisations which are obliged to comply with the Government’s security procedures.
• Employees of contractors providing goods and services to the Government.

Who decides whether security clearance is needed?

The Cabinet Office sets the policy framework for the application of national security vetting. However, the level of clearance needed for a particular post will be decided by the department/organisation and will depend on the particular role and responsibilities of the post. If the role or responsibilities subsequently change, such that a post-holder is to have greater access to sensitive information or sites, then suitability for the new role and responsibilities will be reassessed and clearance at a higher level may be required.

National security vetting may be carried out on recruitment or at any point subsequently when changes in duties or responsibilities require it.

Why do I need security clearance?

If you have been told that you will be subject to AC/L1A, CTC/L1B, SC or DV security clearance, it is because the post you have applied for is assessed to require it because of a security risk and the damage that could arise as a result of any compromise. If you consider, either now or in the future, that your post does not require a security clearance, you should discuss this with your line manager or superior, in the first instance, or with your Departmental/Organisation Security Officer or Security Adviser.

Isn’t national security vetting intrusive?

The checks can be intrusive, particularly at the higher levels of national security vetting. However, checks are only carried out to the level necessary to safeguard national security. You are not obliged to go through the security vetting process but, if you choose not to, you will not then be appointed to the post you applied for.

What about equal opportunities and human rights?

All applicants for vetting are treated impartially and consistently, irrespective of gender, race, disability, religion, age or sexual orientation or other protected characteristics in accordance with the requirements of the Equalities Act 2010 and/or the equivalent legislation applicable in Northern Ireland.

The European Convention on Human Rights and the Human Rights Act guarantee certain rights and fundamental freedoms, including the right to privacy and freedom of expression. These rights are subject to a number of exceptions; in particular they may be subjected to such interference as is in accordance with the law and is necessary in a democratic society in the interests of national security.

Why are there so many questions – are they really necessary?

The questionnaire may initially look daunting, but most questions are straightforward. You should read through the questions to find out what is required, collect together the necessary information and allow plenty of time for completion. You must answer all questions – if you do not do so it may delay the decision about your clearance. If you are unsure about a question please ask for guidance from whoever issued you with the questionnaire.

If you realise after you have submitted the questionnaire that you have inadvertently made a mistake or omitted something, please tell your vetting authority or whoever you returned the questionnaire to. If you do not do so, any errors or omissions could be held against you during the assessment process.

Please make certain that you have signed the questionnaire in the appropriate places. This will avoid unnecessary delays in processing your application.

I used to be politically active and I think that the Security Service may hold a record on me. Will it affect my security clearance?

The Security Service only holds records on individuals so far as is necessary and proportionate for national security purposes. It does not hold records on people just because they are politically active.

Where information about you is held by the Security Service this does not rule out granting a clearance. The Service will advise the sponsoring department of the relevance and significance of the information it holds.

Will my clearance be refused if I have a criminal record?

Each case will be judged on its merits and will take into account a number of things e.g. the seriousness of the offence; the length of time since it was committed; your age at the time; and any other special circumstances. It is important that you are completely honest about your criminal history, including spent convictions (that is, older convictions that would not normally have to be disclosed to a potential employer) and police cautions. Any attempt to conceal information could be taken as evidence of unreliability or dishonesty and may affect the granting of security clearance.

Do I have to have lived in the UK for a set period of time?

To enable meaningful checks to be carried out you will normally need to have lived in the UK for a sufficient period of time. Depending on the level of clearance being carried out this will usually range from three to ten years. Whilst a lack of UK residency in itself is not necessarily a bar to a security clearance, decision makers will need to consider what checks can be carried out and the information available upon which to make a decision.

I’m tempted to keep quiet about something in my past and hope no-one finds out

Lying or concealing information on a security questionnaire or at interview is viewed very seriously because it is taken as evidence of unreliability and/or dishonesty. Indeed, your security clearance could be refused because you lied, even though what you were seeking to conceal would not in itself have caused a problem. Furthermore, your security clearance could be removed at a later date if the lie subsequently came to light.

Will the information obtained during the vetting process remain confidential?

All information obtained will be treated in strict confidence and protected from unauthorised access.

What about data protection legislation such as GDPR?

The General Data Protection Regulation came into force on 25 May 2018 and places robust safeguards over the handling of your personal data.

This is explained in detail within the National Security Vetting privacy notice, which you can read here. If an individual has concerns regarding how their personal data has been handled, they should raise this with the data controller in the first instance and be provided with the relevant privacy notice explaining how their data is processed and how to action their rights. For AC/L1A, the data controller will be the employer/sponsoring organisation. For CTC/L1B, SC and DV, the data controller will be UKSV.

Who decides whether a security clearance will be granted?

The employing or contracting department, or the relevant vetting authority, will make the final decision in light of all the available information obtained during the vetting process.

Will I be told whether a security clearance has been granted?

If you are an existing member of staff applying for security clearance, you will be informed of the result of the vetting process. If a clearance has been refused, you will be given the reasons unless considerations of national security and maintaining the confidential nature of information provided preclude this. If you are an unsuccessful applicant for employment you will not necessarily be informed of the reason your application was unsuccessful.

What happens after I have been given a security clearance?

Your security clearance will be subject to regular review. It is important that you maintain the standards of security expected and notify any changes in your personal circumstances, where relevant (e.g. marriage, change of partner, criminal convictions, etc.) to your vetting authority.

Your security clearance will normally lapse once you have completed the work for which the clearance was granted.

Can I appeal against an adverse vetting decision?

If you are a current employee, your employing department (or vetting authority) will have an internal appeal mechanism in place. If, after appealing internally, you remain dissatisfied with the decision you can appeal to the independent Security Vetting Appeals Panel whose details will be made available to you at the time of your internal appeal.

Separate SVAP arrangements exist for applicants to specific oversight bodies of the Security and Intelligence Agencies, and for staff, contractors and recruits to the agencies. If you are in this category, please ask your contact at the relevant agency or body for more information.

The following questions apply to applicants for CTC/L1B, SC and/or DV only.

What will I be asked if I am interviewed?

Interviews are carried out routinely at DV and occasionally at CTC/L1B or SC level. The interview, which will be conducted by a vetting officer, will be wide-ranging and cover most aspects of your life. The aim is to obtain a rounded picture of you as an individual to determine whether you will be able to cope with access to sensitive material at the highest levels.

In addition to assessing whether you may present a security risk the aim is to protect you from situations which could potentially present you with a conflict of interest or any other difficulty.

You should expect to be asked about your family background, past experiences, health, sex life, drinking habits, experience (if any) of drug taking, financial affairs, general political views (though not what party you support), hobbies, foreign travel and connections. All these questions are asked for a purpose and you must be as frank as possible.

If you would feel more comfortable discussing certain matters with a different vetting officer you should say so and efforts will be made to arrange a second interview. Be candid: it is in your interest that full and accurate information is provided and the correct decision is reached.

Why should I provide confidential medical information?

It is important to know whether you have suffered from certain medical or psychological conditions which could have a bearing on your fitness to handle very sensitive information. Where this is the case the questionnaire explains how medical information will be obtained and safeguarded if required. Your vetting authority may require the name and address of your doctor, whom they may contact.

Who should I name as referees and what will they be asked?

This is only required at DV level. You should name people who know you well and who between them have known you for a significant period of your life. They will be asked to describe you and your way of life, attitudes, and abilities in order to provide a rounded picture of you as an individual. The vetting officer will be trying to verify and complete the information provided by you.

What is the purpose of a financial check and what does it entail? Financial checks are carried out at DV and at SC level. A check will be made with a credit reference agency and you may be asked to complete a Financial Questionnaire so that a full review of your personal finances can be carried out. This will include assets, liabilities, income and expenditure owned both individually and jointly with a spouse or partner. Its purpose is to assess whether you are or have been in serious financial difficulty or show signs of financial irresponsibility to the extent that you could become vulnerable to financial inducement.

There is no need to worry about a mortgage or credit card or other similar liability (e.g. a student loan) where it is in line with your ability to manage the repayments.