Federal Facility Security Levels: What Contractors Need to Know About the ISC Framework

Every federal building in the United States gets assigned a number between one and five. That number, the Facility Security Level, determines everything from how many cameras go on the walls to whether a maintenance technician needs an escort to change a light bulb. If you do any kind of contract work inside federal buildings, this rating system controls your daily operations in ways that are worth understanding thoroughly.

The Interagency Security Committee Runs the Show

The Interagency Security Committee, housed under CISA within the Department of Homeland Security, publishes the Risk Management Process standard. The current edition dates to March 2021, and it applies to every nonmilitary federal facility in the country. DoD buildings follow their own Unified Facilities Criteria, though off-installation leased spaces used by DoD fall under the ISC standard as well.

The ISC standard does two things. First, it provides a scoring method for classifying buildings into one of five Facility Security Levels (FSL I through FSL V). Second, it prescribes baseline countermeasures for each level. A Level I building might need a basic visitor log and a single camera at the entrance. A Level V facility might require blast-resistant construction, dedicated guard forces, anti-vehicle barriers, and 24-hour monitoring by armed personnel.

For contractors, this matters because the FSL assigned to a building shapes the Performance Work Statement on every service contract associated with it. The FSL determines your clearance requirements, your access procedures, the equipment standards you need to meet, and often the insurance coverage you must carry.

Five Factors That Determine the Rating

The ISC does not assign FSLs arbitrarily. The standard uses five weighted factors, and a Facility Security Committee at each building scores them to produce the final level.

Mission criticality. How important is the work performed inside this facility? A Social Security field office processing benefit claims has moderate mission criticality. A federal data center running classified networks has very high mission criticality. Buildings that support national defense or law enforcement operations score higher on this factor than those housing routine administrative functions.

Symbolism. Some buildings represent the federal government in a way that makes them attractive targets. A courthouse with the seal of the United States over the entrance scores higher on symbolism than a leased office suite with no exterior signage. Federal buildings named after prominent figures, those with significant historical importance, or facilities that regularly appear in media coverage all receive elevated symbolism scores.

Facility population. The ISC counts the maximum number of people who occupy the building on any given day, including employees, contractors, and visitors. A facility with 2,500 daily occupants creates a different risk profile than one with 85. Higher population means higher consequences in an incident, which pushes the security level up.

Facility size. Total square footage factors into the equation. Larger buildings have more points of entry, more ground to cover with surveillance, longer perimeters to secure, and more complex building systems that create potential vulnerabilities. A 400,000-square-foot VA medical center scores differently than a 3,000-square-foot recruiting office.

Threat to tenant agencies. This factor looks at the agencies occupying the space and the specific threats they face. A building housing DEA field agents, for instance, faces a different threat environment than one occupied by the Bureau of Labor Statistics. The ISC considers both foreign and domestic threat intelligence when scoring this factor.

Each factor gets scored on its own scale, and the totals map to a final FSL between I and V. The Facility Security Committee, made up of representatives from every tenant agency plus the building’s security organization, makes the final determination. GSA manages the process for most government-owned and leased buildings. The VA runs its own process for medical centers and clinics.

What Each Level Looks Like in Practice

The jump between levels is not gradual. Each step up brings a meaningful increase in security requirements that directly affects contractor operations.

FSL I (Minimum Security). Small field offices, standalone kiosks, rural outposts. Think a Social Security office in a strip mall or a USDA service center in a small town. Requirements are minimal: basic locking hardware, a visitor sign-in process, and limited access during non-business hours. Maintenance contractors working in FSL I buildings generally move freely during business hours with standard identification.

FSL II (Low Security). Mid-size office buildings with moderate foot traffic. Many GSA-leased office spaces fall into this category. Requirements include electronic access control on main entries, CCTV coverage of primary entrances and parking areas, and a formal visitor management process. Contractors need building-specific credentials and typically sign in through a security desk.

FSL III (Medium Security). Regional offices, federal courthouses, mid-size agency headquarters. This level adds perimeter intrusion detection, more extensive camera coverage, dedicated security personnel during business hours, and controlled parking. Maintenance contractors at FSL III buildings often need background investigations completed before badge issuance. After-hours work requires coordination with on-site security.

FSL IV (High Security). Large federal complexes, major courthouses, agency headquarters with sensitive operations. FSL IV facilities have armed guard forces, vehicle barriers at entry points, X-ray screening for bags and packages, magnetometers at pedestrian entries, and hardened utility and mechanical spaces. Contractors working at this level face daily screening procedures and may need escorts to access certain areas. Tool and equipment inventories get checked in and checked out.

FSL V (Very High Security). Critical national security facilities, intelligence community buildings, major military-adjacent installations. The requirements at this level include everything from blast-resistant glazing to anti-ram barriers, redundant communications systems, and continuous armed security patrols. Contractors at FSL V facilities typically need active security clearances, undergo thorough vetting, and work under direct oversight. Even routine maintenance tasks get planned through the facility security office weeks ahead of time.

Why This Matters for Maintenance Contractors

If your company services federal buildings, the FSL tells you what to expect before you ever set foot on the property.

Staffing and clearance planning. An HVAC technician who can walk into an FSL I building with a driver’s license and a badge request form may need a completed National Agency Check with Inquiries (NACI) background investigation before accessing an FSL III facility. At FSL IV and above, you might need personnel with active Secret clearances. These requirements affect hiring timelines, employee retention, and labor costs. A proposal that does not account for clearance processing time is a proposal that will fail during performance.

Equipment and access logistics. Higher FSL buildings restrict what enters the facility. At FSL IV, every toolbox, piece of equipment, and material delivery gets screened. Large maintenance projects at high-security buildings require detailed logistics plans for getting materials through the security perimeter. Renovation projects involving demolition or construction equipment need advance coordination with the Facility Security Committee.

Work scheduling. Security levels influence when and how work gets performed. Many FSL III and above facilities prefer maintenance and renovation work during off-hours, which means night shifts and weekends. At FSL IV and V, even off-hours work requires security escort, which creates scheduling dependencies your project timeline must account for.

Insurance and bonding. Contracts at higher FSL buildings frequently require elevated insurance limits. General liability of $5 million or more is common at FSL IV. Some facilities require specific terrorism risk coverage. If your bonding capacity cannot support these requirements, those contracts are out of reach regardless of your technical qualifications.

Why This Matters for Security Service Providers

Companies providing guard services, monitoring, or security assessments at federal buildings need to match their capabilities to the FSL.

At FSL I and II, unarmed guards with basic training and standard operating procedures cover most requirements. At FSL III, guards need additional training in access control systems, CCTV monitoring, and incident response protocols. FSL IV introduces armed guard requirements, which bring Federal Protective Service (FPS) certification, weapons qualifications, and use-of-force documentation.

The ISC standard also requires that security contractors demonstrate proficiency with the specific electronic security systems installed at the facility. If the building runs a Lenel access control system and a Genetec VMS platform, your guards need documented training on those specific systems, not generic “access control” certificates.

Practical Steps for Contractors

Check the FSL before you bid. The FSL is not classified information. It appears in the solicitation documents, usually in the Performance Work Statement or in a security attachment. If it is missing, ask the contracting officer. The FSL tells you immediately what your labor costs, clearance requirements, and insurance needs will be. Skipping this step leads to bad estimates.

Build your FSL capability profile. Know which levels your company can realistically serve. If your workforce does not include cleared personnel, FSL IV and V contracts are not viable targets today. Focus your business development on the levels where you can perform without stretching your capabilities thin.

Invest in clearance capacity if you want to move up. Processing a Secret clearance takes four to six months on average. If your growth strategy includes FSL IV work, start the clearance process for key employees well before you need them on a contract. Having cleared personnel ready to deploy gives you a concrete advantage over competitors who would need to start clearances after award.

Document your experience by FSL. Past performance evaluations that mention the facility security level carry weight with evaluators. “Completed a $1.2 million HVAC replacement at an FSL III VA medical center” tells a contracting officer more about your capabilities than “completed HVAC work at a government building.” Be specific.

The FSL system is not going away, and the ISC continues updating its standards to address emerging threats. Contractors who understand the framework and build their operations around it win more work and execute it with fewer problems. The alternative, figuring it out after contract award, creates delays that contracting officers remember the next time your name appears on a proposal.