COVID-19 Effects on Cleared Contractors
Client Alert | 1 min read | 04.02.20
On March 30, 2020, the Defense Counterintelligence and Security Agency (DCSA) published COVID-19 NISP Guidance to describe for cleared industry how DCSA will conduct its oversight mission during the pandemic. That guidance includes, among other things:
- DCSA has suspended all enhanced security vulnerability assessments (ESVA) and other on-site activities. DCSA Industrial Security Representatives (ISR) will instead conduct continuous monitoring engagements through virtual outreach.
- Cleared contractors with safeguarding remain responsible for ensuring classified material remains appropriately secured, even in areas implementing mandatory quarantines. DCSA provides guidance regarding handling end-of-day checks of security containers, approved closed areas, and special access program facilities during the pandemic.
- Cleared contractor personnel furloughed or not in pay status should be removed from access in JPAS and need not complete annual refresher training. Overdue training must be completed within 60-days of returning to normal operations.
- DCSA will extend all information systems’ Authorizations to Operate (ATO) expiring before April 18, 2020 for an additional 90 days. Security Control Assessment (SCA) activity will continue, but the on-site portion will be deferred.
- DCSA will continue to process facility clearance (FCL) actions. However, the inquiries telephone line is suspended, and contractors seeking status updates or other assistance may instead leave detailed voicemail messages on the Knowledge Center line at 888-282-7682 or e-mail the Facility Clearance Branch (FCB) at dcsa.fcb@mail.mil.
- The Department of Defense (DoD) Consolidated Adjudication Facility (CAF) call center is temporarily suspended. Inquiries may be e-mailed to whs.meade.dodcaf.mbx.dodcaf-callcenter@mail.mil, and an agent will follow up.
Contacts
Insights
Client Alert | 13 min read | 06.12.26
The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024, with direct application across the EU. Full application begins 11 December 2027, but one of its most operationally demanding provisions takes effect in just under 100 days, on 11 September 2026: the mandatory vulnerability and incident reporting under Article 14 CRA.
Client Alert | 6 min read | 06.11.26
CMS Announces New Medicaid Eligibility Requirements: Implications for Managed Care Plans
Client Alert | 7 min read | 06.11.26
Qatar Rewrites the Playbook: What the New Public M&A Rules Mean for Market Participants
Client Alert | 6 min read | 06.09.26
Is Stock-a-palooza Over? Supreme Court allows SEC to Pursue Disgorgement



