I will quote just what PSPC said, as they are more experienced in this than I am. PSPC said, “It's important [that a distinction be made] between the security clearance...of an organization or staff and a capability [requested] of an organization. It's not necessary for an organization to have the capability [at the time] the contract is awarded...it's normal for a contract to be awarded without a capability”—which is us—“having been verified [by] the contract security program.” Otherwise, there has to be an amendment to withdraw that requirement, as it was not necessary, which is what happened for this contract.
On March 13th, 2024. See this statement in context.