The 30-second answer
Reliability status is the baseline federal security screening, and it has two parts that work together.
Your organization needs Designated Organization Screening (DOS) at the reliability level. Your individual employees working on the contract each need personnel reliability status. The organization piece must be in place before personnel screenings can be processed.
Both are administered by Public Services and Procurement Canada's Contract Security Program. There's no government processing fee. Personnel reliability status takes 7 business days for simple files and up to 120 business days for complex ones. Organization screening typically takes 4 to 9 months for first-time applicants. When a tender notice says "Reliability required," it almost always means both.
Reliability status vs. security clearance
The federal government uses two distinct categories of screening, and the gap between them is bigger than it sounds.
Security clearance covers access to CLASSIFIED information, in three escalating levels:
- Confidential clearance for Confidential-level material
- Secret clearance for Secret-level material
- Top Secret clearance for the highest-classified material
Secret and Top Secret are not parallel options to Reliability. They're built on top of it. Every Secret clearance holder also holds reliability status, because the Secret screening adds checks on top of the reliability baseline rather than replacing it.
Contractors often say "we have Reliability" or "we have Secret" as if they're shopping from the same menu. Inside the system, Reliability is the first gate. Secret and Top Secret are second and third.
Personnel screening vs. organization screening
Two screenings, one word. This is where SMBs lose contracts.
Personnel screening screens an individual person. It's what most contractors mean colloquially when they say "I have Reliability." It applies to a specific employee, contractor, or subcontractor.
Organization screening screens a company. PSPC calls it Designated Organization Screening (DOS) at the reliability level, or Facility Security Clearance (FSC) at higher levels. Before any of your employees can be screened to work on a federal contract, your company has to be screened.
The order is rigid. Your company gets DOS first. Your employees get personnel screening second. If the contract involves storing PROTECTED information at your premises, your premises also need a separate certification (Document Safeguarding Capability).
PSPC will not process individual employee files for a company that doesn't have DOS in place, except under narrow conditions tied to active procurement participation. So if you've never had federal security screening before and you're looking at a tender with a Reliability requirement that closes in 30 days, the math doesn't work. The organization piece alone takes longer than that.
The other thing to know: organization screening has to be sponsored. You can't apply for DOS independently. A federal department, an existing cleared company, or a specific tender for which you've been pre-qualified must sponsor your application. Most SMBs get sponsored for the first time when they win a contract requiring it, or when a federal buyer encourages them to apply ahead of an upcoming procurement.
How long does it take and what does it cost?
PSPC's official processing times for personnel screening:
| Type of request | Processing time |
|---|---|
| Reliability status, simple | 7 business days |
| Reliability status, complex | 120 business days |
| Secret clearance, simple | 75 business days (plus reliability screening) |
| Secret clearance, complex | 120 business days (plus reliability screening) |
A "simple" request is one where the applicant's background can be verified without out-of-country checks, with no adverse information. A "complex" request gets triggered by any of: living abroad continuously for 6 months or more during the assessment period, a needed deeper review of criminal or credit history, adverse information in the file, or for Secret-level requests, validation of loyalty to Canada.
The 7-business-day simple track is genuinely fast when it applies. For SMBs hiring recent immigrants, employees who studied abroad, or candidates with anything unusual in their history, the realistic timeline is closer to the 120-business-day window.
The clock only starts once PSPC receives a properly completed request. Errors, missing fingerprints, or missing documents reset everything to zero.
The Contract Security Program does not charge a processing fee. The applicant or organization pays for fingerprinting (typically $50 to $120 per applicant through an accredited provider) and police certificates from any country where the applicant lived for 6 months or more. Foreign certificates can run $100 to $500 each, and translation and authentication costs add up if the candidate has lived in multiple countries.
Don't bid blind on security requirements.
Paste a CanadaBuys URL — BidFit flags every security clause and tells you whether the timeline is realistic for your firm.
What does a reliability status actually screen for?
A personnel reliability status screening covers:
- Verification of identity through 2 pieces of identification (1 with photo)
- 5- to 10-year employment history with verifiable references
- 5- to 10-year address history
- Criminal record check via fingerprints submitted to the RCMP
- Credit check, particularly for any role with financial responsibility
- Out-of-country verifications for any period of 6 months or more spent abroad
The threshold standard is "honesty and trustworthiness." Reliability is not a deep loyalty assessment (that's reserved for Secret and above). It's a confirmation that the individual is who they say they are, has no significant adverse history, and can be trusted with PROTECTED information.
Permanent residents can usually hold reliability status. Citizenship is not strictly required at the reliability level, though specific contracts can impose citizenship requirements as additional mandatory criteria. Secret and Top Secret almost always require Canadian citizenship.
Reliability does not transfer to higher levels automatically. If your employee holds reliability and the contract escalates to Secret, that's a new screening request with new wait times.
How to know if a tender requires Reliability
Federal tender notices use a standard format for security requirements. The relevant section is usually titled "Security Requirements" or "Personnel and Organization Security Requirements," and it appears in the bid document, not on the CanadaBuys notice page itself.
The clauses look like this:
The Contractor/Offeror must, at all times during the performance of the Contract/Standing Offer, hold a valid Designated Organization Screening (DOS) at the level of RELIABILITY, issued by the Contract Security Program (CSP), Public Services and Procurement Canada (PSPC).
The Contractor's personnel requiring access to PROTECTED information, assets or work sites must EACH hold a valid personnel security screening at the level of RELIABILITY, granted or approved by the CSP, PSPC.
When you read this section, look for three things: the required level (Reliability, Confidential, Secret, Top Secret), whether it applies to the organization, the personnel, or both (almost always both), and whether Document Safeguarding Capability is required at your premises.
We've covered how security requirements appear in tender documents in How to read a CanadaBuys tender notice (with annotated examples). Security clauses are also a frequent source of mandatory criteria — miss one and you're out before evaluation begins.
The provisional clearance option for bids
A 2021 change to the Contract Security Program gave SMBs a meaningful break. For PSPC-led procurements, you no longer need to hold the full required clearance at bid closing. You need to hold it by the date of contract award.
If you need to access protected information to prepare your bid, a provisional clearance can be issued, valid only for the duration of the bid solicitation. Provisional clearances let you participate in procurements you couldn't otherwise touch, on the understanding that the full clearance must be in place before any contract is signed.
This matters most for first-time bidders. You can pursue a contract requiring Reliability without already having it, as long as you have a credible path to obtaining it before award. "Credible path" needs to actually exist, though. If your bid wins and you can't complete the screening within the contracting authority's tolerance window (typically 60 to 90 days after award), the contract can be cancelled and re-awarded to the next-ranked bidder.
The safer move for SMBs planning to bid federal work regularly: start the Designated Organization Screening process before you have a specific tender in hand. The 4-to-9-month organization timeline becomes a non-issue if you start it ahead of time.
Common SMB mistakes
The mistakes that cost SMBs contracts at the security stage are almost always one of these.
Treating Reliability as a one-step process. A bidder reads "Reliability required" and assumes employees can apply directly to PSPC. They can't. The organization needs DOS first, the organization sponsors personnel screenings, and the timelines stack on top of each other.
Underestimating processing times for international applicants. SMBs with employees who studied abroad, immigrated within the past decade, or worked outside Canada will routinely hit the complex-request pathway. If your bid is staffed primarily by such candidates, plan for 120 business days, not 7.
Misreading the security requirements section. Reliability sounds like the lowest possible bar, so SMBs sometimes glance at it and move on. They miss that the contract also requires Document Safeguarding Capability, or specific citizenship requirements layered on top. Read the full section, not just the level header.
The best mitigation is to treat the Contract Security Program as infrastructure, not paperwork. Get DOS in place ahead of need. Have at least two cleared employees (or a credible plan to clear them) before bidding contracts that require it. Don't be the SMB that wins a contract and then has to forfeit it because the security piece wasn't ready.