Compliance
List X
A Ministry of Defence designation for a contractor site approved to hold UK classified information at SECRET or above.
Definition
List X is the Ministry of Defence designation for a contractor site in the UK that has been approved to hold government classified information at SECRET or above on its own premises. It attaches to a specific site rather than to a company as a whole, so an organisation may hold List X status at one facility and not at another. Where a contract requires classified material to be held, processed or discussed on supplier premises, List X status is a threshold requirement.
How it works in practice
A company does not apply for List X on its own initiative. Sponsorship comes from a government customer or a prime contractor with a genuine contractual need, and the process is triggered by that requirement. Assessment covers physical security of the site, personnel security including National Security Vetting for staff who will access the material, information system accreditation, and governance arrangements. The company must appoint a Security Controller as the point of accountability, and the site is subject to inspection and periodic reassessment.
The distinction that catches suppliers out is between holding classified material and merely working on classified programmes. Work carried out entirely on government premises, or at a classification below SECRET, may not require List X at all. Conversely, a contract that appears to be routine services can require it if the supplier will hold classified documentation on its own site. Reading the security aspects letter and the security conditions in the tender is the only reliable way to establish which applies.
For defence bids, List X sits alongside other assurance requirements rather than replacing them. JOSCAR is the sector's supplier registration and prequalification database, Cyber Essentials or a higher cyber standard is commonly mandated, and ISO 27001 is frequently expected for information security management. Procurements for defence and security work may also run under the Defence and Security Public Contracts Regulations 2011 rather than the general regime.
Common questions
Can a company apply for List X status directly?
No. Sponsorship by a government customer or a prime contractor with a contractual requirement is needed before an assessment begins. This means status generally follows a specific opportunity rather than being obtained speculatively in advance of bidding.
Does List X apply to the whole company?
No. It applies to a designated site. A company operating from several locations needs approval for each site where classified material will be held, and moving premises requires reassessment.
How does it relate to security clearance for individuals?
They are separate but linked. List X concerns the site. National Security Vetting concerns individuals, at levels such as Security Check and Developed Vetting. A List X site must have appropriately cleared personnel, and both elements are assessed.
Is List X required for all defence contracts?
No. Many defence contracts involve no classified material on supplier premises and therefore no List X requirement. It is driven by whether classified information at SECRET or above will be held or processed at the supplier's own site, which the security conditions in the tender documents will state.
