Certifications and compliance for Facility Security Officers
Certifications and compliance
What governs a facility services vendor on a cleared site, what IH Services holds, and what we hand your security office before anyone walks through the gate. In short, the certifications and compliance record behind every IH Services crew.
IH Services operates a DoD Cleared Workforce under a dedicated Facility Security Officer trained to 32 CFR Part 117 (NISPOM), and DCSA administers the security program. We also manage the information we handle for clients in alignment with NIST SP 800-171, and we run safety through the 5-4-0 program: EMR 0.90, 2026 TRIR 1.45. Every task carries a completion record, while every controlled-area visit reconciles with your access log. Specifics about personnel and clearances go to your security office through the FSO, not onto a web page.
The certifications and compliance stack, in plain language
A cleared site asks three questions of every vendor: can your people be in the space, can you prove what they did there, and, above all, can you handle our information? The table answers each one for IH Services and, in addition, names the standard behind it.
Requirement by requirement
| Requirement | What it governs | IH Services posture |
|---|---|---|
| Personnel and facility access | Who may enter controlled and closed areas, under what clearance or escort, and how the site records it. Your FSO sets this under the site’s security plan. | DoD Cleared Workforce. Dedicated FSO trained to 32 CFR Part 117. Access records reconcile with your badge and escort logs. |
| 32 CFR Part 117 (NISPOM) | How cleared contractors protect classified information and run their security programs. | Security program administered under DCSA; FSO trained to Part 117 and available to your security office. |
| Export control (ITAR, EAR) | Who may be present where export-controlled technical data or hardware is visible. | Experience in ITAR and DFARS environments; staffing and access handled with your export-compliance lead. |
| NIST SP 800-171 and CMMC | Protection of federal contract information and controlled unclassified information on contractor information systems. | Aligned to NIST SP 800-171 for information we handle. CMMC applies only where a flow-down names a level for that information, and we respond to the level named. |
| Quality systems (AS9100, customer surveillance) | Evidence that facility work supporting production happens as specified, with documentation. | Completion, access, and corrective-action records from R3 Secure FacilityOps, available for customer walks and audits. |
| Safety (OSHA) | Recordable incidents, training, and the insurer’s view of risk. | 5-4-0 safety program. EMR 0.90. 2026 TRIR 1.45. |
| Registration | Identity in federal and prime supplier systems. | SAM registered. CAGE 1JXW7. UEI EGR9H17YE9H3. Full record on the supplier qualification page. |
This page describes how IH Services operates. It is not legal or regulatory interpretation; your security, export-compliance, and contracts teams determine what applies at each site.
Audit-ready facility services: certifications and compliance you can prove
An auditor does not ask whether the floor is clean. Rather, they ask who cleaned it, when, with what, and whether that person had permission to be in the room. A vendor who answers with assurances fails that question, whereas a vendor who answers with records passes it before the walk starts.
IH Services keeps three records on every site. To begin with, completion records: each scheduled task closed with time, location, and photo evidence where your site allows cameras. Then access records: every controlled-area visit logged so it reconciles with your own badge and escort data. Finally, corrective-action records: root cause, containment, closure, and the preventive control that followed.
The result for you is a report you pull rather than a week you spend assembling one. For your quality team, likewise, it is evidence they can forward without editing.
Certifications and compliance hand-off before mobilization
FSO introduction
To begin with, our FSO contacts yours, confirms the site’s access requirements, and agrees the process for personnel submissions.
Personnel roster
After that, we submit names, roles, and status through your approved channel, never by unsolicited email and never on a public page.
Access and escort plan
Then we agree which areas, which shifts, which people, and how our records will reconcile with your logs.
Records format
Finally, you receive a sample completion record and corrective-action record, so your quality and security teams know what they will get and how often.
Secure Facility Maintenance Risk Review. For sites with controlled or closed space, we run a short review with your security team: escort-hour burden, access documentation, and cleared-workforce capacity against the production plan. It produces observations and recommended actions rather than an accreditation or a compliance finding. Of course, we agree an NDA first.
Certifications and compliance questions security leaders ask
Which facility services vendors need a facility clearance?
A company needs a facility clearance (FCL) when the company itself must access classified information to perform a contract. Most custodial, grounds, and maintenance work does not, because the crew works in and around controlled space without access to the information inside it. Instead, a cleared site needs three things from a facility vendor: cleared or clearable personnel, an access process the site FSO controls, and documentation of who was where. Your FSO and the sponsoring prime decide what applies at each site, and IH Services’ Facility Security Officer then works through that process with yours.
What does 32 CFR Part 117 (NISPOM) require of service vendors on a cleared site?
32 CFR Part 117, the National Industrial Security Program Operating Manual, governs cleared contractors and how they protect classified information. For a service vendor, its effect arrives through the site’s own security procedures, such as who may enter controlled areas, under what clearance or escort, and with what records. IH Services also runs its security program under DCSA with a dedicated FSO trained to 32 CFR Part 117. As a result, someone who speaks your FSO’s language manages the vendor side of those procedures. Specifics about personnel and access go to your security office through the FSO, since we do not publish them.
Does CMMC apply to janitorial and facility services vendors?
CMMC governs contractor information systems that process, store, or transmit federal contract information or controlled unclassified information. In other words, it is a cybersecurity requirement, not a building-services requirement, and it reaches a facility vendor only when a flow-down names a level for information that vendor handles. IH Services aligns to NIST SP 800-171 for the information it handles on a client’s behalf and also responds to any CMMC level a flow-down names. Nothing about custodial or maintenance work itself, however, requires CMMC.
What safety metrics should you ask a facility services vendor for?
Ask for the experience modification rate (EMR) as well as the current-year total recordable incident rate (TRIR), as numbers with a year attached. For example, IH Services’ EMR is 0.90, and its 2026 TRIR is 1.45, delivered through the 5-4-0 safety program.
What certifications and compliance records should a facility vendor keep for audits?
Three kinds. To begin with, completion records for every scheduled task: time, location, and who did it, with photo evidence where the site allows. Then access records for controlled areas that reconcile with the site’s own badge and escort logs. Finally, corrective-action records with root cause and closure. IH Services produces these through R3 Secure FacilityOps, so a customer walk or an AS9100 surveillance visit becomes a report you pull rather than a week you spend.
Would your FSO like to talk to ours?
The fastest way to settle access, records, and clearance questions is a 20-minute call between the two security offices, so we will set it up.