Security Clearance Vetting for Access to Cloud Production Environments
11 July 2023
Cloud computing is the delivery of computing services such as servers, storage, databases, networking, software, analytics and intelligence over the internet. Cloud services offer many benefits such as scalability, flexibility, cost-efficiency and innovation. However, they also pose significant security risks, especially when it comes to accessing and managing sensitive data and assets in cloud production environments.
A cloud production environment is where the actual live applications and data are hosted and accessed by end-users. It is different from a cloud development or testing environment, where the applications and data are still under development or testing and not available to the public. A cloud production environment requires a high level of security and reliability to ensure that the applications and data are protected from unauthorized access, modification, deletion or disclosure.
One of the ways to achieve this level of security is to implement security clearance vetting for anyone who needs to access or manage cloud production environments. Security clearance vetting is a process of background checks that assesses the suitability of an individual to have access to sensitive information, assets or equipment. Security clearance vetting is needed to protect against threats from hostile intelligence services, cyber security threats, terrorists and other pressure groups.
Levels of Security Clearance Vetting #
There are different levels of security clearance vetting in the UK, depending on the nature and sensitivity of the information, assets or equipment involved. The main levels are:
- Baseline Personnel Security Standard (BPSS): This is not a formal security clearance but a pre-employment screening of individuals with access to government assets. It involves checks on identity, employment history, immigration status and unspent criminal record.
- Accreditation Check (AC): This is for individuals who require unescorted access to the security restricted area of UK airports or provide UK aviation security training. It involves verification of identity, employment history, unspent criminal record and a check against records held by the UK government or its agencies.
- Counter Terrorist Check (CTC) / Level 1B: This is for individuals who require access to UK OFFICIAL assets and occasional access to UK SECRET assets or work in areas where SECRET and TOP SECRET information may be overheard. It involves checks on identity, employment history, criminal record, financial situation and personal circumstances.
- Security Check (SC): This is for individuals who require substantial unsupervised access to UK SECRET assets or occasional access to UK TOP SECRET assets. It involves the same checks as CTC plus a credit reference check and a check against records held by MI5.
- Developed Vetting (DV): This is for individuals who require substantial unsupervised access to UK TOP SECRET assets or work in intelligence-related posts. It involves the same checks as SC plus a detailed interview with a vetting officer and enquiries with referees.
How to Apply for or Renew Security Clearance Vetting #
To apply for or renew security clearance vetting, you need a sponsor who is usually your human resources/personnel officer or company security controller. Your sponsor must confirm that your role requires security clearance vetting and that they have carried out the BPSS check (unless you are undergoing the AC check). Your sponsor will then create your clearance application and you will receive a link to fill out a security questionnaire online.
The security questionnaire will ask you for personal information such as your name, date of birth, address, nationality, education, employment history, financial situation, criminal record, foreign travel and contacts. You must answer all questions honestly and provide supporting documents where required. You must also give consent for your information to be verified by relevant authorities.
After you submit your security questionnaire, you may be contacted by a vetting officer for further enquiries or an interview. The vetting officer will ask you questions about your background, lifestyle, behaviour and attitudes to assess your reliability, trustworthiness and loyalty. You must cooperate fully with the vetting officer and provide any additional information or documents they request.
The decision on your security clearance vetting will be made by the risk owner who is usually your sponsor or their line manager. The decision will be based on the information gathered during the vetting process and the level of risk involved in your role. You will be notified of the outcome by your sponsor or via the National Security Vetting Service (NSVS) portal.
If you are granted security clearance vetting, you must comply with the conditions of your clearance such as reporting any changes in your personal circumstances or any incidents that may affect your suitability. You must also undergo regular reviews of your clearance depending on the level and duration of your clearance.
If you are refused security clearance vetting or your clearance is revoked or downgraded, you have the right to appeal against the decision within 28 days of being notified. You can appeal by writing to the NSVS Appeals Team explaining why you disagree with the decision and providing any new evidence to support your case. Your appeal will be considered by an independent panel who will either uphold or overturn the decision.
Security clearance vetting is a vital part of ensuring the security and integrity of cloud production environments. It helps to prevent unauthorized access, modification, deletion or disclosure of sensitive data and assets in the cloud. It also helps to protect the national security and interests of the UK and its allies.
If you work in a role that requires access to or management of cloud production environments, you should be aware of the levels, processes and responsibilities of security clearance vetting. You should also be prepared to undergo security clearance vetting and maintain your clearance throughout your employment.
Security clearance vetting is not a guarantee of future reliability and all clearances are kept under review to ensure that the necessary level of assurance is maintained. You should always act in a professional, ethical and lawful manner and report any security concerns or incidents to your sponsor or security controller.