Contracts concerned

The French regulations define two kinds of contract providing access to classified information.

1. “Classified” contracts where the contractor keeps protected information or material required for execution of the contract at its own premises. In this case, the contractor is responsible for their protection. This kind of contract requires:

  clearance of the legal entity of the company (*), that the contractor’s premises be suitable for storing and protecting the protected information or material concerned, the suitability, where appropriate, of the computer systems on which such information will be processed,

  clearance of all personnel requiring access to protected information or material for the purposes of executing the contract. Every classified contract includes a security annex. It is possible to subcontract protected work under such a contract.

2. Contracts with “security clauses” when the contractor does not need to keep protected information or material. In this case, the personnel at the contractor company who have access to classified information, as required for the execution of the contract, at the premises of the organisation or company placing the contract. This kind of contract requires:

  clearance of the legal entity of the company (*),

  clearance of all personnel requiring access to protected information or material for the purposes of executing the contract. There is no need to check the suitability of premises or computer systems since in this case the prime contractor remains liable for the security of protected information or material. Every contract with security clauses includes a security annex. It is possible to subcontract protected work under such a contract.

(*) Clearance of the legal entity of a company constitutes, in the case of classified contracts or contracts with security clauses placed by a Ministry of Defence body or subcontracted from such a body, authorisation granted by a clearance authority to its departments to place such contracts with the company concerned.