An industrial security clearance doesn’t end once it’s obtained. When can the National Security Authority (NBÚ) deny or revoke a clearance, and how can a company defend itself?
Most companies view the industrial security clearance as a one-time hurdle—something that needs to be taken care of before signing a contract and then forgotten about. The reality is different. An industrial security clearance is not a permanent advantage—the National Security Authority (NBÚ) can revoke it even while it is still valid, and the consequences are the same as if the company had never obtained it: the end of access to classified information, and often the end of the contract as well.
When an Application Is Rejected Right from the Start
For the NSA to issue a certificate, the business must, pursuant to § 46 of Act No. 215/2004 Coll., simultaneously meet three conditions:
- it is capable of ensuring the protection of classified information,
- it is financially stable—it is not in liquidation, has not been declared bankrupt, and has not been granted a settlement; it fulfills its financial obligations to the state and to third parties,
- it is security-reliable.
If the security clearance review reveals that even one of these conditions is not met, the authority, pursuant to § 51(2), will issue a decision—the application is denied, and the company will not be granted access to classified information.
An important detail that is often overlooked in practice: the application for an entrepreneur’s security clearance must also include a separate application for security clearance of the company’s statutory body, at the Confidential level or higher—regardless of the clearance level for which the company itself is applying. A company’s security clearance is therefore always linked to the security clearance of the specific individual at its helm.
When a Certificate Is Revoked Retroactively
An even more sensitive situation arises when a company already holds a certificate but nevertheless loses it. According to Section 50(5) of the Act, the Authority will revoke the certificate if it determines that the business owner:
- no longer meets any of the conditions under Section 46 (for example, has encountered financial difficulties), or
- has grossly or repeatedly violated obligations regarding the protection of classified information.
This is not merely a theoretical threat. The Constitutional Court of the Slovak Republic heard a case in 2024 in which the National Security Authority (NBÚ) revoked the certificate of a specific individual for the “Confidential” classification level—the reason being an identified security risk, specifically the individual’s dishonesty and untrustworthiness in relation to the protection of classified information. Since the individual in question was a statutory officer of a commercial company, the revocation of his personal security clearance—precisely on the basis of Section 50(5)—led to the revocation of the entire company’s industrial security certification. A single untrustworthy individual in a key position was thus able to jeopardize the entire company’s authorization. This case also confirms the point made above: the vetting of an officer is not a mere formality; it is a direct link between the fate of a single person and the fate of the company’s entire vetting process.
The company is not defenseless
The good news is that neither the decision to reject an application nor the decision to revoke a certificate is final immediately. The law (§ 30) allows for an appeal against such a decision within 15 days of the date of delivery. The appeal must be in writing and must include specific reasons why the decision should be overturned. Crucially, such an appeal has suspensive effect—meaning the decision does not take effect immediately, and the company gains time to defend itself before it actually loses access to classified information. However, this does not mean it is advisable to rely on the appeal process instead of continuously complying with the conditions—it is a last resort, not standard procedure.
Other Ways in Which a Certification May Lapse
In addition to active revocation by the authority, the law (§ 52) also recognizes “natural” methods of termination of a certificate’s validity:
- upon the expiration of the period for which it was issued (the certificate is valid for a maximum of five years from the date of issuance),
- upon the dissolution of the business (for example, by deletion from the commercial register).
In all these cases, the same obligation applies: the business must submit the certificate to the authority within five business days of the termination, and its statutory body is obligated to continue ensuring the protection of classified information against unauthorized access until the situation is resolved—in other words, these obligations do not cease to apply simply because the certificate has expired.
What to Take Away From This
An industrial security clearance is not a checkbox that is checked once and then forgotten. It is a status that a company must continuously maintain—economically, in terms of personnel, and procedurally—and this applies doubly to the person serving as the statutory body, whose clearance is directly linked to the company’s clearance. The risk, therefore, is not limited to the company itself as a legal entity: personnel changes in top management positions must be addressed with regard to the validity of the clearance, not after the fact. If, despite this, something goes wrong, the law provides the company with a means of defense in the form of an appeal with suspensive effect—but it is better to have this option in reserve than to actually need it. Regular internal monitoring of compliance with the conditions is incomparably cheaper than losing certification in the middle of an ongoing contract.
We’ll be happy to assist you with setting up and conducting ongoing checks to ensure compliance with industrial security requirements—you can find more about this service here.
