Why contractor security clearance is ripe for review

The vetting process that too often acts as an inefficient gatekeeper for the UK’s most sensitive roles must be modernised, and that includes banishing the ‘Catch-22.’

‘You need a contract-offer to pass security clearance, but you won’t get a contract-offer because you don’t have security clearance.’

It’s notoriously known as the ‘Catch-22’ of security clearance, and unfortunately, I do know it’s still alive and kicking contractors today.

While I briefly mentioned this dilemma in my security clearance guide for ITContracting.com, I acknowledge that I didn’t name it, writes Better Hiring Institute chair Keith Rosser, a director at Reed Screening.

The Catch-22 is at odds with government guidance

That said, I am aware that not getting a role because you don’t have clearance (and remember you can’t get clearance without a role) still goes on in 2024 — even if it shouldn’t, according to the government’s guidance.

The same piece of official guidance further states — or at least claims: “Government contracting procedures make sure that there is no competitive advantage in having prior security clearances.”

Security vetting for contractors is complex and inefficient

However, social media posts show contractors still say they cannot apply for a role as they have no Security Clearance (SC) but correctly report they cannot obtain SC without an offer of a role.

Some newcomers to contracting might be forgiven for believing that while the above must be the ‘Catch’ part, the ‘22’ must stand for the numerous other challenges that the complex and generally inefficient national security vetting process poses.

I’ll sum up those challenges with three quick questions.

1: Does the new role require a slightly higher level of clearance/screening than the previous role, even though the role is similar?

A: Unfortunately, often ‘Yes.’

The different levels of screening and vetting can be frustrating for contractors.

A contractor can move from one assignment to another, largely performing the same role, but in a different context which means increased vetting is required.

2: Is the contractor permitted to apply for the role before the screening is done?

A: Technically, ‘Yes.’

The contractor can apply for a role without vetting already conducted.

But in practice, the preference might well be for a screened candidate (not that adverts are permitted to discriminate against unscreened /uncleared candidates according to Cabinet Office guidance published in 2007).

3: Who conducts the screening on behalf of the contractor, and will the screening be completed in time for the contractor to start?

A: ‘It depends.’

Arguably the most challenging of security clearance issues (bar the Catch-22), the first part of this two-part question ‘Who does the vetting?’ has no single answer.

It may be the end client, the recruitment company, or even the umbrella company.

So the unhelpful answer is ‘It does depend’ — typically on the level of vetting. Indeed, some of the highest vetting needs to be carried out centrally by a trained investigating officer!

The identity of the vetting party depends also on the end-client’s policy.

And it can further depend on the capability of the recruiter. Not many recruitment companies have a formal vetting business (like we do). However, some agencies will have a formal outsourcing arrangement in place, under which the vetting will be conducted by neither the recruiter nor the client, but by a third-party employee screening business.

‘Sorry the contract will have started by then’

As to the second part of the question (‘Will the screening be completed in time for the contractor to start?’), remember that contractors without SC are technically able to apply for SC-required roles, yet agencies can be responsible for sponsoring the vetting, and if they don’t agree to do the vetting quickly, the contractor may miss out on the assignment’s start date.

N.B. The government says candidates should not be expected to hold an existing security clearance simply to apply for posts that require vetting “except where such posts are short term and need to be filled urgently.”

Security vetting? It’s not for the faint-hearted….

As you can see security vetting can be complex for contractors!

It’s also diverse. It ranges from an accreditation check in the aviation sector to security checks when dealing with highly sensitive information.

Some contractors may have to go through the developed or enhanced security checks process too. And any contractor working with public figures may well be told to complete counter-terrorism checks.

While security vetting sounds complicated, the basic idea is that all vetting is proportionate or in line with the specifics of the role.

It sounds simple, but it isn’t in practice.

What does vetting include?

In general terms, vetting includes and affected contractors should prepare themselves for:

• ID checks;
• Five-year employment/education checks;
• a Basic Disclosure (DBS or Disclosure Scotland) Check where required;
• Security questionnaire(s);
• A company records check; and
• An interview (in some cases), and interviews with close associates for the highest security levels.

What can make national security vetting more challenging is that the contractor often receives mixed messages about what level of vetting they need, and who will conduct that vetting!

How long does vetting last?

Officially, a security clearance lasts five years in most cases, but sometimes it can last 7 or 10 years.

The five-year term generally applies to contractors who remain in the same role, with the same end-client.

But beware — if the role and/or the end-client changes, security clearance can become a bit of a Wild West! In fact, the 5/10-year rules suddenly don’t generally apply where the contractor is changing supplier and end client.

How long does vetting take?

This is tricky to answer because every scenario is unique.

Different vetting levels come with different requirements.

For standard Security Vetting (BS7858) when all information is provided upfront, it should be complete within one week.

Yet as every case is different, the best thing contractors can do is;

Be ready with the relevant information and complete the online forms as quickly as possible.

All vetting should now be electronic, including digital Right To Work and DBS/DS checks (paper copies are still available), driven by electronic forms smart-phone enabled.

Is security vetting efficient?

As you can probably tell from some of my answers to the questions higher up, on the whole, no, security vetting isn’t efficient.

I’d go further — in general, security clearance is manual and slow.

There is a great need to modernise in this area — ideally by taking the best of recent Home Office and DBS/DS innovation, adding the best of industry innovation (such as chat automation and HMRC checks) and then creating an aim to set a new expectation around how long, on average, vetting should take.

And it shouldn’t be long!

For the highest levels of vetting, yes, there does need to be more manual aspects like security interviews and investigations, but elsewhere (such as BS7858), there is a good opportunity for a review. This is something a few UK Government agencies and the Better Hiring Institute are currently embarking on.

The future: review security clearance, prioritise portability, and banish the Catch-22

The solution to the not-insignificant number of ‘problems’ that security clearance and vetting faces (and maybe ‘22’ at the outset was to overstate it!), is portability.

Contractors should be given a system that permits them to carry their vetting around with them, or at least carry clearances around with them for other end-clients to use where the vetting corresponding to the clearance was completed in the last 12 months. So if it’s within the last year, then it should be acceptable for the next organisation to use.

As a non-executive board director working for Disclosure Scotland, when I started with another arm’s length body of the Scottish Government, my previous vetting was accepted.

But perhaps it was only accepted because it related to working for part of one, large organisation.

True portability of security clearances is what we really need, whereby security vetting by one organisation is subsequently acceptable to another organisation. That would really rid the space of the notorious Catch-22 of security clearance.

Spring forward – hopefully

On behalf of the Better Hiring Institute, my colleagues and I will be back in parliament next Spring on our mission of “Making UK Hiring the Fastest Globally” and the portability of vetting is high up on that agenda. So while progress is slow, it is moving forward at least.