What is a DCSA Facility Inspection?

BLUF;

A DCSA facility inspection, officially known as a Security Review and Rating Process, evaluates how well cleared contractors protect classified information and comply with NISPOM. Understanding what DCSA reviews, how ratings work, and maintaining year-round readiness can help protect your Facility Security Clearance (FCL) and avoid costly compliance gaps.

What is a DCSA Facility Inspection?

A DCSA facility inspection, also known as a Security Review and Rating Process (SRRP), is a formal evaluation of how well your organization complies with the National Industrial Security Program Operating Manual (NISPOM), codified at Title 32 of the Code of Federal Regulations (CFR) Part 117.

This process sits at the center of how the Defense Counterintelligence and Security Agency (DCSA) protects classified information across the defense industrial base on behalf of the Department of War (DoW). If your organization holds an FCL, participation isn’t optional.

• DCSA personnel look for alignment between written policy, system configurations, personnel training, and what’s happening on the ground
• It’s tied directly to an FCL. Significant or unresolved security deficiencies can put your facility’s FCL and ability to perform classified work, at risk
• Every NISP facility is subject to this review on a regular basis

Who Conducts a DCSA Facility Inspection?

Each cleared contractor is assigned an Industrial Security Representative (ISR) from DCSA. The ISR serves as DCSA’s primary interface with the cleared contractor and plays a key role in evaluating NISPOM compliance during the security review process.

Your ISR is also typically the same point of contact you work with throughout the life of your FCL, not just during a formal review.

• Coordinates/conducts the recurring security review and coordinates the facility’s security rating
• Serves as your primary point of contact for reporting requirements and questions
• Reviews updates in the National Industrial Security System (NISS) between formal reviews

What DCSA Reviews During an Inspection

A DCSA facility inspection covers far more than a single filing cabinet or a single system. DCSA security review teams are looking at how security is built into daily operations.

• FCL status, including Key Management Personnel (KMP) listings and any exclusion resolutions
• Foreign Ownership, Control, or Influence (FOCI) documentation, where applicable
• Personnel security processes, including clearance eligibility and briefings
• Physical security controls for storing and handling classified material
• The Insider Threat Program, evaluated as an operating program rather than a policy statement
• Classified information systems and whether required security controls are consistently applied
• Self-inspection records and whether identified vulnerabilities and corrective actions are being properly addressed

How DCSA Ratings Work

DCSA rates facilities on a five-level scale. Where your facility lands affects your standing, and in some cases, your ability to keep your FCL at all.

• Superior
• Commendable
• Satisfactory
• Marginal
• Unsatisfactory

DCSA also distinguishes between general conformity and not in conformity. A facility found not in conformity may be placed into a Compliance Improvement Process to address the gaps. Facilities that are not in general conformity may receive a Marginal or Unsatisfactory rating and may require additional corrective action through DCSA’s compliance processes.

How Often DCSA Inspections Happen

There isn’t a universal calendar for DCSA facility inspections; every NISP facility is subject to a recurring review.

• The timing and scope of reviews are risk-informed and can vary based on the circumstances of each facility (complexity of operations)
• Some organizations may see longer intervals between formal reviews
  • DCSA does not publish a single inspection calendar that applies to every facility
• Regardless of interval, continuous readiness matters more than knowing an exact date
• DCSA’s refined rating framework under the Security Review and Rating Process took effect in October 2024, and it was designed to reduce subjectivity and increase consistency across ratings.

How to Prepare for a DCSA Facility Inspection

• Keep records current across NISS, the Defense Information System for Security (DISS), and the National Background Investigation Services (NBIS)
• Run self-inspections with the same rigor you’d expect from an ISR
• Make sure personnel understand their role in protecting classified information, not just the FSO
• Document your Insider Threat Program as an active process, including who reviews anomalous behavior and what triggers escalation
• Loop in FSO support early if your team is stretched thin or your facility has grown since your last review

Key questions this article answers

• What is a DCSA facility inspection?
• What does DCSA review during a facility inspection?
• How does DCSA rate a facility?
• How often does DCSA conduct facility inspections?
• How can a company prepare for a DCSA facility inspection?

Looking for help with compliance and inspections? Contact us today.