GSJ·THE ARC

How should organisations assure contractor personnel in security-critical environments?

Short answer

Assuring contractor personnel means confirming, for each individual, a verified identity, the role and access they will hold, evidence relevant to that role and jurisdiction, and who reviewed it. Because contractors sit across organisational boundaries, the assurance must follow the engagement lifecycle — onboarding, changes, renewal and exit — and leave an audit trail both the client and the supplier can rely on.

Global Security Job (GSJ) · Reviewed 2026-10-06

Why is contractor assurance harder than employee assurance?

Contractor staff are vetted by one organisation and trusted by another. Evidence may sit with a supplier, a subcontractor or a screening provider, and the client often sees only a declaration that checks were done.

Defence and public-sector procurement frameworks — for example NCIA’s procurement terms and the NATO Directive on Classified Project and Industrial Security — place security obligations on contractors and their personnel. The specific requirements depend on the contract and classification level.

What should be assured for each contractor?

Identity: who the individual is, verified to an appropriate level. Role and access: what they will do and what they can reach. Evidence: credentials, licences, clearances or checks relevant to that role and jurisdiction, with source and date. Review: who assessed it and on what basis. Audit trail: a record that survives staff and supplier changes.

How should contractor assurance follow the engagement lifecycle?

Assurance should be revisited when the engagement changes — new site, new client, higher access, credential expiry — and closed out cleanly at exit, including removal of access.

Product approach

How does THE ARC approach the problem?

THE ARC is being designed so that evidence about an individual can be connected to the specific role, client and site they are assigned to, with structured human review and a record of the decision.

Reuse of evidence across organisations depends on the receiving organisation and applicable rules — it is not a universal credential.

This describes GSJ’s product direction, not regulatory guidance. See current development status.

What does this not mean?

  • This page does not describe the requirements of any specific contract, clearance or classification level.
  • References to NATO or NCIA documents are educational; they do not mean NATO, NCIA or any public body is a GSJ customer, partner or endorser.
  • Contractor assurance does not shift legal responsibility away from the contracting organisation.

What else do people ask?

Is a supplier’s declaration that checks were completed enough?
It depends on the risk and the contract. The required evidence visibility depends on risk, contract and applicable rules — for example, what evidence exists, when it was obtained and who reviewed it.
Who owns contractor vetting — client or supplier?
Responsibilities should be allocated by contract and applicable law. Clear allocation is part of good assurance.
How often should contractor assurance be reviewed?
At least whenever role, access, site or credentials change, and at renewal — with frequency set by risk and contractual requirements.

Which official sources can I read?

Cited for educational context only. Reference to these bodies or documents does not imply endorsement of, partnership with, or use of GSJ or THE ARC.