Industry Security Assurance Centre

15.4.2026 - | Her Majesty's Revenue and Customs

Find out about the Industry Security Assurance Centre (ISAC) and its associated responsibilities.

Overview

The Industry Security Assurance Centre (ISAC) is responsible for providing relevant defence contractors with up-to-date security and business continuity policy and guidance.

We provide specialist and relevant advice to reduce security and business continuity risks and amplify Ministry of Defence (MOD) and government security policy requirements. These security services are provided to the National Armaments Director Group (NADG) and the defence industry. This includes the provision of visit and visitor clearances through the International Visits Control Office (IVCO).

Contact us

For routine security enquiries please contact the Industry Security Assurance Centre: ISAC[email protected]

Industry Security Assurance Centre responsibilities

We are responsible for:

• Assisting UK companies in obtaining Facility Security Clearance (FSC) and/or Industry Personnel Security Assurance (IPSA) status when contractually required to hold classified material at SECRET (Foreign CONFIDENTIAL) or above.
• Helping UK companies to verify the security status of foreign facilities and citizens through liaison with national security authorities.
• Approving the hand carriage of classified material being taken overseas by casual courier.
• Approving some transportation plans relating to the movement of physical, classified assets travelling overseas.
• Sponsoring personnel security clearances for primary security controllers and their deputy at an FSC facility and IPSA personnel security controllers and their deputy, if required.

The ISAC Vault

The ISAC Vault is the website we use to share security advice and policy between NADG and FSC and IPSA facilities. The available documentation is to promote effective security governance.

National security vetting and government contracting

Access more information on security vetting and clearance.

Security awareness

Understanding UK threat levels

The threat of international terrorism comes from a diverse range of sources and a threat could manifest itself from a lone individual or group. The terrorist threat can take a number of forms, as terrorists may use a variety of methods of attack to achieve their objectives.

While the UK has faced a variety of terrorist threats in the past, a unique combination of factors place the current threat on a scale not previously encountered.

The terrorists draw their inspiration from a global message articulated by internationally recognisable figures.

The threat from terrorism when overseas

Information on threats to personal safety arising from terrorist activities, political unrest, lawlessness, violence, natural disasters, epidemics, anti-British demonstrations and aircraft/shipping safety. It is designed to help you make informed decisions about whether or not to travel to a particular country.

The threat of espionage

The UK is a high priority espionage target and a number of countries are actively seeking UK information and material to advance their own military, technological, political and economic programmes.

The International Visits Control Office

The responsibilities of the International Visits Control Office (IVCO):

• To process visit requests for foreign nationals who are required to visit MOD, Royal Navy, or Facility Security Clearance (FSC) sites in the UK.
• To process visit requests for security cleared FSC Contractors seeking to visit overseas government, military and contractor sites.
• To process all requests for security cleared UK Nationals wishing to visit either the North Atlantic Treaty Organization (NATO) HQ or a NATO Agency.
• To advise UK Defence Industry, MOD, and overseas governments on the International Visits Control process.

Please note: IVCO is not responsible for processing military/government personnel visiting to military/government establishment. However there are exception sites, and your point of contact will advise you if a submission is required.

IVCO Contact information

E-mail: DES-PSyA-IVCO@mod.gov.uk
Tel: +44303 379 8813
Opening times: 10am to 3pm, Monday to Friday

Please note we will be unable to deal with requests or queries outside these hours. Calls to IVCO should only be made within the times specified above.

Types of Visits

There are several types of visits that IVCO can process. The type of visit required can be selected on the appropriate form.

One-time

• Valid for up to 3 years (inwards only) 1 year (outwards).
• Valid only for the site(s) and subject specified at the outset.
• Maximum 100 visitors per visit request.

Recurring

• Covers a period of up to 12 months.
• No limit to the number of visits within the 12 months.
• Valid only for the site(s) and subject specified at the outset.

Emergency

• A visit that has not met IVCO’s required lead times.
• Only valid for a 30-day period.
• Only accepted in exceptional circumstances.
• Must be supported by a Letter of Justification (LoJ). This Letter of Justification must: be headed on host company paper, include the reason for the late RFV submission, justify the importance of visit and include the reason that the visit cannot be rearranged within the standard lead times.

Amendments

• Enables visitors to be added to an extant visit (up to 100 visitors per amendment: a maximum of 10 amendments per visit).
• Enables the end date to be extended (must not exceed the date limit of the original visit type, e.g. an extension to a recurring visit cannot exceed 12 months).
• Additional sites cannot be added as an amendment to an RFV.
• Dates cannot be amended to bring start date of visit forward.

International Agreements

• Multinational Industrial Security Working Group (MISWG)/NATO.
• Visits to member states that do not exceed 21 days in duration and/or OFFICIAL-SENSITIVE in classification can be arranged directly between site security establishments without prior IVCO approval.

European Defence Industry Restructuring (EDIR) Framework Agreement (also known as the LOI)

• Visits up to OFFICIAL-SENSITIVE can be arranged directly between facilities.
• Visits can proceed up to SECRET on agreed shareable projects ONLY (Project teams to advise).
• LOI /EDIR should be completed and sent directly to the security controller at the host site.
• If the visit exceeds 21 days (regardless of classification) a copy of the completed LOI /EDIR needs to be submitted to IVCO for retention ONLY IVCO approval is not required.

Please see below list for MISWG members:

• Albania
• Australia
• Austria
• Belgium
• Bulgaria
• Canada
• Croatia
• Czech Republic
• Denmark
• Estonia
• Finland
• France
• Germany
• Greece
• Hungary
• Israel
• Italy
• Japan
• Latvia
• Lithuania
• Luxembourg
• Montenegro
• Netherlands
• New Zealand
• North Macedonia
• Norway
• Poland
• Portugal
• Romania
• Slovakia
• Slovenia
• Spain
• Sweden
• Switzerland
• Turkey
• UK
• USA

Outward Visits

• Any UK Defence and Industry personnel travelling overseas to access or discuss classified material (including information or sensitive areas), who are visiting any industry with FSC, or military/government must submit an eRFV.

Outward Visit Procedure

• UK visitor: complete sections 1, 2, 3 and 5 to 12 of the e-RFV form and forward the e-RFV to the Security officer. Please note if the visit classification is Restricted/OFFICIAL-SENSITIVE or above, a government or military point of contact must be named in Annex 1 (Military sites may require 2 points of contact).
• Security Officer: complete Section 13 of the e-RFV to confirm they have checked that the visitor’s clearances stated on the e-RFV are correct and valid for the duration of the visit and then forward the request on to IVCO.
• IVCO: complete Sections 4, 14 and 15 and forward the completed e-RFV to the relevant Embassy/National Security Agency.

Please note: once submitted to the embassy or National Security Agency, IVCO do not receive updates. Please liaise with your host to determine the status of the visit. Security classification of the visit and individuals’ security clearances must be stated in full, i.e. SECRET or TOP SECRET no abbreviations will be accepted.

NATO Visits Procedure

• NATO Agencies: Require an eRFV to be submitted. The security classification of the visit and the security clearances of the visitors must be written in full, prefixed by NATO. For example, NATO SECRET. Visitors must hold a minimum of NATO SECRET to access NATO agency sites.
• NATO HQ: require a NATO HQ Pass application form to be completed. Unfortunately, eRFV forms are not accepted for visits to NATO HQ.
• There are 2 types of passes: temporary or annual.
• Annual pass requests will only be permitted if the visitor requires regular access at least twice a month. For every other visit, the request must instead be for a temporary pass.
• UK Visitor: must complete sections 2 - 5 of the NATO HQ Pass Application form and forward to their security officer.
• Security Officer: completes section 6 and forwards application to IVCO for processing.
• Visitors must have valid security clearance. The expiry date of the security clearance must be declared, or the application will be rejected.
• IVCO will notify the requester of submission and provide the NATO reference number, which will be needed for access to site.
• If wifi access is required, it must be stated in Section 5 of the NATO Pass Application.

Outward Visit Lead Times

Standard lead time is 25 working days’ notice for processing e-RFVs for countries not listed below.

Please check minimum lead times on the table below for country to be visited these are the countries minimum requirement and do not allow IVCO to conduct their checks therefore please add an additional week on top.

All countries emergency visit requests require a minimum of 10 working days’ notice and must be supported by a letter of justification (LOJ) from the host site.

Lead times for both MISWG and other countries/NATO Organisations:

Lead times (in weeks) for visits to MISWG member countries:

Lead times (in weeks) for visits to other countries/NATO organisations that are not part of MISWG

Additional information for outward visits

US

• Do not use PO Box addresses.
• Zip codes (postcodes) must be supplied for all sites.
• Only use unclassified email addresses.
• The US minimum lead-time is 30 working days. This means that the RFV must be in the US DoD visit system at least 30 working days prior to the requested start date of the visit. To process the RFV via the British Embassy Washington this means that the RFV must be submitted to IVCO at least 35 working days prior to the start date of the visit.
• Emergency visits have a 14-day lead time. These requests must be marked as ‘One-Time short notice visit’ instead of emergency visits. Urgent visit requests outside this lead time will be automatically rejected unless the visit is in support of a mission critical operation, which must be backed up by a BDSUS 1* sponsor.
• There must be a DoD PoC if there is a requirement to see protectively marked information. If there is no DoD PoC, the US Company must have either an Export License or Technical Assistance Agreement or other relevant approvals in place. This should be quoted in the subject field of the RFV. - The US DoD will shut down towards the end of the year for the New Year Moratorium, official dates are added to the ISAC Vault once received. All visits to the US must be submitted before the shutdown period, taking into consideration their 6-week lead time. The embassy will only accept visit requests that are deemed mission critical during this time.

Norway

• Norway will only accept the e-RFV template. (To edit it, save the document to the desktop, open and edit it).
• Norway will not accept visit requests that extend beyond the current calendar year. For example, a year’s visit starting 01/06/2023 must end on 31/12/2023 and a new RFV submitted for the period in 2024.

Israel

• Israel will not accept visit requests that extend beyond the current calendar year. For example, a year’s visit starting 01/06/2023 must end on 31/12/2023 and a new RFV submitted for the period in 2024. Israel can only accept RFV’S using the word tools RFV they are unable to open e-RFV.

Inward Visits

Foreign nationals visiting a MOD, military or FSC contractor site that require access to protectively marked information and/or access to a restricted area must provide official confirmation of their security clearance in the form of an RFV.

Inward Visit Procedure

• Foreign National (Visitor): complete Sections 1-12 of the e-RFV form and forward the e-RFV to the Foreign Nationals’ Security Officer. Please note if the visit classification is Restricted/O-S or above, a MOD or military point of contact MUST be named in Annex 1. (IVCO will reject the RFV if one is not supplied).
• The Foreign Nationals’ Security Officer: complete Section 13 of the e-RFV and forward the request on to their National Security Advisor (NSA), London based Embassy or High Commission.
• NSA, London based Embassy or High Commission: complete Section 14 and 15 and forward the complete e-RFV to IVCO.
• IVCO: Processes the e-RFV in accordance with the information provided, and in conjunction with the relevant authority. The authority will consider whether the visit is justified, and that the clearance level required is acceptable. They will advise on any information that can/cannot be seen or areas that can/cannot be accessed by the visitor.
• IVCO: Once the appropriate authority is content for the visit to proceed, IVCO will issue a formal approval letter to the Security Officer at the host site(s).
• IVCO: informs the NSA, London based Embassy or High Commission of the outcome.

Inward Visit Lead Times

All inward visit applications must be submitted on an electronic Request for Visit (eRFV) form and forwarded to IVCO.

• 20 working days (not including date of submission) for recurring (visit can last up to one year) and one-time visits (visit can last up to three years).
• 10 working days for amendments.
• 10 working days (not including date of submission) for emergency visits (visit can only last up to 30 days).

Frequently asked questions

What is a security aspects letter?

The ‘secret matter’ in an invitation to tender (ITT) or contract containing DEFCON 659A must be defined to the contractor in writing. The special obligations laid upon the contractor become legally effective only when the MOD has issued a notice in writing, defining which aspects of the ITT or contract are graded at OFFICIAL-SENSITIVE or above. This is achieved by means of a security aspects letter (SAL) written by the contracting authority, or by the inclusion of a security aspects clause in the ITT or contract. A SAL provides a contractual means of ensuring that security is addressed in the work that a contractor is undertaking. A SAL is not required if the Contractor will not be exposed to any classified material graded above OFFICIAL. In such cases the contractor must still be informed of their security obligations via DEF CONS included in the contract.

The contractor is required to confirm in writing that he understands and will implement the terms of the SAL or clause. The SAL is the legal instrument under which a UK contractor may be prosecuted under the Official Secrets Act. The SAL must therefore be issued to the contractor with the ITT or contract document. ISAC’s office must be informed in advance if this is not possible.

Do I have a designated field adviser?

In most cases, ISAC assurance advisors are assigned by region. These regions are: Scotland; England (North); England (East); England (West); England (South East) and London; England (South West) and Wales; and Hampshire. For details of your assurance advisor please contact the Security Advice Centre.

What are the timescales involved for hand carriages and transportation plans?

The required notice periods for hand carriages are:

• EU/RoW (exc Australia/US) - 2 working days.
• US/Australia - 5 working days.

For transportation plans the required notice periods are:

• Within UK - 3 working days notice.
• EU (except Italy) - 5 days.
• US/Italy/Australia/rest of world - 10 days.

Please note that due to current resource issues we may not be able to approve ‘emergency requests’ with shorter lead times.

Contact details for the Defence Courier Service

The Defence Courier Service (DCS) is based at:

Telephone: 020 8589 3432 or see the British Forces Post Office services guide

How does my company gain a Facility Security Clearance (FSC)?

Facility Security Clearance (FSC) formerly known as ‘List X’ refers to contractors or subcontractors which have been formally assessed by the relevant government authority and reached the required standard as defined in GoVS 007 – Security to hold, process or manufacture materiel at SECRET (foreign CONFIDENTIAL) or above on the company premises. FSC is not available on request, it must be sponsored by a contracting authority (CA).

The CA can be:

• A Ministry of Defence entity: This is extensively, but not invariably, in the form of a project team (PT).
• Another government department: A number of UK government departments, may also award a facility FSC status.
• An existing FSC holding company: An enterprise with an existing government contract may act as a contracting authority to one or more third-party subcontractors who may inherit the responsibility to hold classified assets. Any move to appoint a subcontractor must be approved by the original contracting authority.
• NATO: Where a contract requires a UK enterprise to hold NATO CONFIDENTIAL (or above) information at their facility, the contracting authority will require assurance from ISAC’s office that the facility is suitable for FSC status.
• Overseas governments and their contractors. In the event that an overseas contracting authority require a UK enterprise to be awarded FSC, the UK government may complete this on their behalf. Key requirements for FSC status:
• A contract at SECRET (foreign CONFIDENTIAL) or above.
• A requirement either for the work to be done on the contractor’s premises or for classified information to be held on site.

Who is my contact for IT accreditation?

For sites with existing accredited systems please contact CyDR.

ISAC documents

Related links

• Defence Industry Security Association
• Foreign & Commonwealth Office
• The Security Service
• US Defence Security Service
• HMG Security Policy Framework

https://www.gov.uk/guidance/industry-security-assurance-centre