Guidance

Industry Security Assurance Centre

Find out about the Industry Security Assurance Centre (ISAC) and its associated responsibilities.

Overview

The Industry Security Assurance Centre is responsible for providing relevant defence contractors with up-to-date security and business continuity policy and guidance.

We provide specialist and relevant advice to reduce security and business continuity risks and amplify Ministry of Defence (MOD) and government security policy requirements. These security services are provided to DE&S and the defence industry. This includes the provision of visit and visitor clearances through the International Visits Control Office (IVCO).

Contact us

For routine security enquiries please contact the Security Advice Centre: DESPSyA-SecurityAdviceCentre@mod.gov.uk

Industry Security Assurance centre: ISAC-Group@mod.gov.uk

Industry Security Assurance Centre responsibilities

We are responsible for:

  • assisting UK companies in obtaining Facility Security Clearance (FSC) and/or Industry Personnel Security Assurance (IPSA) status when contractually required to hold classified material at SECRET (Foreign CONFIDENTIAL) or above
  • helping UK companies to verify the security status of foreign facilities and citizens through liaison with national security authorities
  • approving the hand carriage of classified material being taken overseas by casual courier
  • co-ordinating of all international visits, inward and outward; for security cleared UK nationals to MOD, overseas government and defence industry sites
  • approving some transportation plans relating to the movement of bulky, classified assets travelling within the UK and overseas
  • sponsoring personnel security clearances for primary security controllers and their deputy at an FSC facility and IPSA personnel security controllers and their deputy, if required.

The ISAC Vault

The ISAC Vault is the website we use to share security advice and policy with FSC and IPSA facilities. The available documentation is to promote effective security governance.

National security vetting and government contracting

Access more information on security vetting and clearance

Security awareness

Understanding UK threat levels

The threat of international terrorism comes from a diverse range of sources and a threat could manifest itself from a lone individual or group. The terrorist threat can take a number of forms, as terrorists may use a variety of methods of attack to achieve their objectives.

While the UK has faced a variety of terrorist threats in the past, a unique combination of factors place the current threat on a scale not previously encountered.

The terrorists draw their inspiration from a global message articulated by internationally recognisable figures.

The threat from terrorism when overseas

Information on threats to personal safety arising from terrorist activities, political unrest, lawlessness, violence, natural disasters, epidemics, anti-British demonstrations and aircraft/shipping safety. It is designed to help you make informed decisions about whether or not to travel to a particular country.

The threat of espionage

The UK is a high priority espionage target and a number of countries are actively seeking UK information and material to advance their own military, technological, political and economic programmes.

The International Visits Control Office

The IVCO is responsibile for:

  • assisting UK defence contractors in obtaining visit clearance
  • establishing and maintaining records of the staff cleared for overseas visits
  • acting as a focal point to ascertain the permitted levels of access to UK classified material allowed by foreign nationals
  • simplifying the procedures for issuing security assurances and for transmitting them to the appropriate authorities

It consists of 2 sections:

  • Inward: visits to the UK: visits by all foreign nationals to UK defence contractor sites, MOD (HQ) buildings and MOD agencies
  • Outward: visits from the UK: visits by security cleared UK nationals to overseas government, contractor and military sites

When contacting us:

  • only contact IVCO to speed up existing visit requests if it is absolutely vital. Priority is given to processing requests rather than dealing with telephone calls, which can delay this
  • applications for inward and outward visits are dealt with in strict rotation. Please ensure that your request for visit (RfV) application forms are submitted correctly completed and don’t submit visit requests which fall out with the agreed timescales
  • avoid emergency visit requests unless they really are cases of genuine emergency
  • please only contact the IVCO office in emergencies, all other queries can be sent by email or fax as listed in the contact us section below

Opening hours:

Monday to Thursday: 11am to 4pm Friday: 10am to 3pm.

Please note that we are closed everyday between 12pm and 1pm

Due to severe staff shortages within IVCO, and a high volume of short notice visits requests, there may be delays in the processing of visit requests and responding to queries.

Before submitting a query, please note:

Urgent queries only should be emailed to despsya-ivco@mod.gov.uk. A normal service will resume as soon as possible and we apologise for any inconvenience caused.

Outward visits

Personnel who need to travel overseas to access or discuss classified material, including information or sensitive areas in foreign defence establishments and contractor’s facilities need to be aware of the IVCO procedures, explained here.

Request for visits are sometimes being submitted to IVCO incorrectly which delays the process. As we have a very strict lead time for all visits it results in incorrect visits submissions being rejected.

To avoid this:

  • please ensure that an up to date index card is attached to the visit request, when the visitors are new to your organisation or if there are new details of their clearance or passport
  • if the visit is an emergency, attach a justification letter which must be from the host
  • for all amendment visits please state the IVCO reference in section 1 of the form and also state which amendment it is (Eg. amendment 1, amendment 2, etc)
  • only complete sections 1 to 3, and 5 to 13 of the request for visit form, sections 14 and 15 must remain empty
  • on the site to be visited section of the form (Annex A), you must state a full name, fax and email details
  • incomplete submissions will result in rejection of this visit by IVCO
  • please make sure that the visitor has the relevant clearance to match the required level of classification (section 11 of the form) and that their clearance expiry date matches the entire visit dates (section 7 of the form). If these do not match then the visitor will be removed from the request for visit form

Completion of personal index cards

Indicate whether it is a new record or an amendment to a previously issued card. A valid ‘proof of vetting’ (POV) number and date must be quoted.

Visits where access is required at confidential or above

RfVs must be submitted where access is confidential or above (except for visits between the parties to the LoI framework).

Visits where access does not exceed restricted:

  • RfVs must be submitted to IVCO for any visits to any country not listed below
  • IVCO do not require RfVs to be submitted for visits to MOD establishments or defence contractor sites in Belgium, Czech Republic, Luxembourg, Netherlands, Portugal, LoI countries and US defence contractor sites (note: all US military site visits ‘must’ be processed through IVCO)

Amendments to visit requests are limited to:

  • visit dates cannot be extended if this change will result in the visit being valid for longer than 1 year
  • dates cannot be amended to bring start date of visit forward
  • only visitors can be added. Extra sites cannot be added to visit requests (Maximum of 10 amendments per visit request)

For emergency visits:

10 workings days lead time are needed for emergency visits. An emergency visit can only last for a maximum of 30 days, and a justification letter from the host must be submitted to IVCO for all emergency requests.

The US

General points to remember:

  • the US lead time is 30 working days
  • a valid fax number for the point of contact (PoC) is essential, who must be a US national and still be in post at the site to be visited
  • zip codes (postcodes) must be supplied for all sites

NATO HQ

General points to remember:

  • a separate visit request is required for each visit to NATO HQ
  • an annual pass will only be permitted if a visitor requires to visit at least twice a month, every month

General

Points to remember:

  • only 1 (one) subject per visit request
  • NATO agencies (NETMA, NC3A etc), visits must be a separate request
  • the maximum number of visitors per visit is 100 (amendments can be made as and when necessary)

Inward visits

Foreign nationals visiting a UK MOD establishment or UK defence contractor site that require access to classified information or access to a sensitive area must provide official confirmation of their security clearance in the form of a RfV. The lead time for standard visits is 20 working days notice from the day that the RfV arrives at IVCO.

Visitors should initiate the visit request and must ensure that it is approved by and transmitted through their own national security authorities (NSA) who should send the RfV to their embassy/high commission in London. The embassy/high commission should process the RfV to IVCO.

Once an RfV has been received by IVCO it will be forwarded to the relevant MOD project authority. They consider the acceptability of the proposed visit including the clearance level required and advise on any information that can/cannot be seen or areas that can/cannot be accessed by the visitor.

The current lead time for emergency visits (inwards) is 10 working days. This does not include the day the visit is received in IVCO or the start date of the visit.

All visits and queries can be sent by despsya-ivco@mod.gov.uk or fax: 0117 9234924.

Opening hours are: Monday to Thursday, 11am to 12pm and 1pm to 4pm; and Friday 10am to 12pm and 1pm to 3pm.

Visits by foreign nationals of MISWG, LoI and NATO member nations, Australia and New Zealand

Where access does not exceed ‘OFFICIAL-SENSITIVE’, IVCO no longer require RfVs for visits to MOD establishment or defence contractor sites by members of MISWG, LoI and NATO.

Prior arrangement and agreement of such visits must be made between visitor and site to be visited. Ruling is applicable to one time and recurring visits of less than 21 days only.

Visits by foreign nationals of all other nations

Where access does not exceed ‘OFFICIAL-SENSITIVE’, RfVs must be submitted to IVCO for any visits to a MOD establishment, or defence contractor sites, by nationals from any country other than MISWG, LoI and NATO.

Visits by foreign nationals of all nations

Where access is SECRET or above RfVs must be submitted from all nations except parties of the LoI framework agreement.

Recurring visits

If regular visits are needed to a MOD establishment or defence contractor site a RfV should be submitted for a recurring visit.

A visitor can have more than one recurring visit running concurrently for different projects and different sites. A recurring RfV can only be valid for a period of 1 year.

Emergency visits

Emergency visits require 10 working days notice and can only last for 30 days. A justification letter from the host must be submitted to IVCO for all emergency requests.

Amendments to visit requests

Visit dates cannot be extended if this change will result in the visit being valid for longer than 1 year. Dates cannot be amended to bring the start date of a visit forward to an earlier date. Only visitors can be amended. Additional sites can not be added to a RFV.

Frequently asked questions

What is a security aspects letter?

The ‘secret matter’ in an invitation to tender (ITT) or contract containing DEFCON 659A must be defined to the contractor in writing. The special obligations laid upon the contractor become legally effective only when the MOD has issued a notice in writing, defining which aspects of the ITT or contract are graded at OFFICIAL-SENSITIVE or above. This is achieved by means of a security aspects letter (SAL) written by the contracting authority, or by the inclusion of a security aspects clause in the ITT or contract. A SAL provides a contractual means of ensuring that security is addressed in the work that a Contractor is undertaking. A SAL is not required if the Contractor will not be exposed to any classified material graded above OFFICIAL. In such cases the Contractor must still be informed of their security obligations via DEF CONS included in the contract.

The contractor is required to confirm in writing that he understands and will implement the terms of the SAL or clause. The SAL is the legal instrument under which a UK contractor may be prosecuted under the Official Secrets Act. The SAL must therefore be issued to the contractor with the ITT or contract document. DE&S PSyA’s office must be informed in advance if this is not possible.

Do I have a designated field adviser?

In most cases, DE&S PSyA assurance advisors are assigned by region These regions are: Scotland; England (North); England (East); England (West); England (South East) and London; England (South West) and Wales; and Hampshire. For details of your assurance advisor please contact the Security Advice Centre.

What are the timescales involved for hand carriages and transportation plans?

The required notice periods for hand carriages are:

  • EU/RoW (exc Australia/US) - 2 working days
  • US/Australia - 5 working days.

For transportation plans the required notice periods are:

  • within UK - 3 working days notice
  • EU (except Italy) - 5 days
  • US/Italy/Australia/rest of world - 10 days

Please note that due to current resource issues we may not be able to approve ‘emergency requests’ with shorter lead times.

Contact details for the Defence Courier Service

The Defence Courier Service (DCS) is based at:

Defence Courier Service
West End Road
RUISLIP
Middlesex
HA4 6DQ

Telephone: 020 8589 3432 or see the British Forces Post Office services guide

How does my company gain a Facility Security Clearance (FSC)?

Facility Security Clearance (FSC) formerly known as ‘List X’ refers to contractors or subcontractors which have been formally assessed by the relevant Government authority and reached the required standard as defined in GoVS 007 – Security to hold, process or manufacture materiel at SECRET (foreign CONFIDENTIAL) or above on the company premises. FSC is not available on request, it must be sponsored by a contracting authority (CA).

The CA can be:

  • a Ministry of Defence entity: This is extensively, but not invariably, in the form of a project team (PT).
  • another government department: A number of UK Government departments, may also award a facility FSC status.
  • an existing FSC holding company: An enterprise with an existing government contract may act as a contracting authority to one or more third-party subcontractors who may inherit the responsibility to hold classified assets. Any move to appoint a subcontractor must be approved by the original contracting authority.
  • NATO: Where a contract requires a UK enterprise to hold NATO CONFIDENTIAL (or above) information at their facility, the contracting authority will require assurance from DE&S PSyA’s office that the facility is suitable for FSC status.
  • overseas governments and their contractors. In the event that an overseas contracting authority require a UK enterprise to be awarded FSC, the UK government may complete this on their behalf Key requirements for FSC status:
  • a contract at SECRET (foreign CONFIDENTIAL) or above
  • a requirement either for the work to be done on the contractor’s premises or for classified information to be held on site

Who is my contact for IT accreditation?

For sites with existing accredited systems please contact Defence Assurance and Information Security.

NATO visit questions

What is a Blue Card?

This is the old terminology for a personal index card (a form completed by all UK defence contractors wishing to visit overseas defence sites).

What does proof of vetting (POV) on the personal index card stand for?

This is the abbreviation for POV. Once an individual has been vetted by the DBS-NSV a proof of vetting reference number is generated. IVCO require the POV for proof of security vetting.

What are the required lead-times for visits to NATO agencies?

The lead time for visits to all NATO agencies is 4 weeks.

Which form should be used for visits to NATO agencies?

For all visits to NATO HQ the NATO HQ pass application form must be used. For visits to all other NATO agencies, the normal request for a visit form must be used.

Can I submit a visit request for multiple NATO agencies?

No. Only one agency can be submitted per visit request.

When can I apply for an annual pass for NATO HQ?

To be eligible for an annual pass you must visit NATO HQ at least twice a month, every month for a year.

When do I receive my NATO HQ pass?

On arrival at NATO HQ there will be a pass waiting for your collection.

When does my annual NATO HQ pass expire?

All annual passes expire on the 31 October.

How many individuals can be placed on a visit request?

New visit requests should have no more than 100 names listed (however, 10 Amendments can be made during the visits duration again with a maximum of 100 names each time).

How many amendments can be made to a visit request?

A maximum of 10 amendments can be made per visit request.

Inward visits questions

How much notice is required for a foreign national to visit a UK defence or FSC site?

IVCO require 20 working days notice (4 weeks) for all visits.

What is a RfV?

RfV is the abbreviation for the request for visit form (which must be completed for visit requests). The UK host company should advise visitors of the IVCO procedures and if necessary provide a copy of the RfV. The form should be completed by the foreign national (although companies are permitted to complete the form and email/fax a copy overseas for the signatures in Section 10 of the form).

How much notice is required for an emergency visit?

IVCO must have a minimum of 5 full working days notice.

Who should complete the justification for an emergency visit?

All emergency visit requests must be supported by a letter of justification. It is the responsibility of the UK host to provide written justification (on headed paper).

How many individuals can be placed on a visit request?

New visit requests should have no more than 100 names listed (however, 10 amendments can be made during the visit duration, again with a maximum of 100 names each time).

How many amendments can be made to a visit request?

A maximum of 10 amendments can be made per visit request.

Can I amend the site details on a visit request?

No. Amendments are limited to visitors and visit dates only.

Can I extend a current visits expiry date?

If the visit is recurring, has not already expired and has not exceeded 12 months then yes a visit can be extended (but please remember the maximum period for a recurring visit is 12 months).

What is MISWG?

Multi-national Industrial Security Working Group (please refer to the IVCO guidance notes).

PSyA documents

LOI request for visit form

NATO HQ pass application form

Request for visit (RFV) form

Published 12 December 2012
Last updated 13 March 2024 + show all updates
  1. Updated Facility Security Clearance (FSC) policy and guidance for UK Defence contractors and MOD contracting authorities.

  2. Updated 'Facility Security Clearance (FSC) policy and guidance for UK Defence contractors and MOD contracting authorities'.

  3. Updated 'Facility Security Clearance (FSC) policy and guidance for UK Defence contractors and MOD contracting authorities'.

  4. Updated information under 'Inward visits' and 'Emergency visits' sections.

  5. Added 'Facility Security Clearance (FSC) policy and guidance for UK Defence contractors and MOD contracting authorities'.

  6. Email address under 'The International Visits Control Office' updated.

  7. 'Overview', 'Contact us', 'Industry Security Assurance Centre responsibilities' 'The ISAC Vault', 'National security vetting and government contracting', 'Security awareness' and 'Frequently asked questions' sections updated.

  8. Updated contact details.

  9. ListXtranet Account Application form added

  10. Added new documents for digital signature instructions and List X Notice 2015/03.

  11. Added contact details.

  12. Included PDF version of Request for visit form.

  13. Updated contact details under the 'restricted website' section.

  14. Updated the bullet points for 'how does my company become list X'.

  15. Amended email address.

  16. Amended email address.

  17. Updated content in line with the Government Security Classifications, and updated information about processing IVCO inward visits.

  18. Removed Christmas notice.

  19. Uploaded 'Request for visit' form and added information about IVCO shutdown during the Christmas and New Year period.

  20. Updated Courier service address

  21. First published.