The initial contract bidding proposals are themselves vague and unclassified, but detail the Company clearance level (FCL) and Personnel Clearance level (PCL) requirements.
Cleared companies have network links with the Gov for when these contracts are being put out as Requests for Proposals (RFPs).
The Cleared companies then submit their RFP, which includes budgets, manpower, etc, etc, etc... This then results in the Gov comparing and contrasting the bids, usually going with the lowest bid by the best rated company (companies get project ratings almost like an EBAY seller as they complete projects for different Gov entities).
The winning company is issued a DD-254 form (Department of Defense Contract Security Classification Specification) along with all the "Normal" contract stuff.
The DD-254 grants the company the ability to work that specific cleared contract, to clear personnel to work the project, and (if listed) to subcontract parts of the job to other cleared companies by issuing sub-contract DD-254's.
If that subcontract company already has a FCL (as listed in the ISFD database)it is a relatively simple process to bring them in to work.
If they are a totally uncleared company, it depends on what the subcontracted duties are... for example, a Cleared company has the contract to maintain all services for an embassy overseas somewhere... they handle electrical work, plumbing, HV/AC, etc inside, along with maintaining exterior beautification. All the people working inside the building will have PCL's and be part of a cleared company, but the company can hire a local uncleared company to handle Lawn services outside the embassy, simply assigning one or two cleared people to overwatch them when at work.
Now, if, for example, The Gov starts a project to train combat small drone operators... they decide they need to hire a company with a team of skilled maintenance techs to maintain the drones, and there isn't any such company out there, but there is a local company who does that exact work for a local Drone racing circuit... The Gov or a Cleared company would approach them with the idea of becoming a cleared company or forming a LLC sub-company that could then be sponsored for a FCL to work classified contracts and then get it's workers clearances to work the project. It's a rather complex process, but it how almost every cleared company got its start sometime in the past.
This explanation is somewhat anecdotal but one method that is used is misinformation or partial information.
I had a friend that knew an experienced machinist. This machinist got a contract to make 4 or 5 small, uniquely shaped objects for what must have been some research center. The objects themselves were all different, and had no features that would indicate a specific function. There were no round surfaces, just many angles that seemed to have no rhyme or reason.
A couple of years later, the F-117 Nighthawk was shown to the public. Instantly, the machinist knew what he was making. He was making parts for a scale wind tunnel model of the F-117. Lockheed had broken down the design into a puzzle and had many different shops make a few of the pieces.
Typically the individuals working would already have clearance. The company that gets the contract would adhere to federal policies and making sure only personnel with clearance can be a part of the project.
This is common since all the new airplanes and missiles are developed by private companies like Raytheon, Boeing, Lockheed, Northrop Grumman, etc.
You have to go through a vetting and security clearance process before you can even consider bidding on high security government contracts. Once you get those clearances, you're on a list of companies that the government will sent out an RFQ (request for quotation) to. The RFQ's themselves are considered to be classified information, so they don't get disbursed beyond where they absolutely need to go.
Usually they don't approach one company (although this happens). Usually they post the unclassified part of the solicitation to fedbizopps.com and hold a meeting for prospective bidders. Companies that wish to attend the meeting and receive written information on the solicitation must have facility security clearances, and the people who attend the meeting must have clearances.
The contractor has to have a security clearance. Security clearances are expensive and difficult to attain, so if you can get one, you get access to a lot of well-paid jobs.
The contract will also usually stipulate a lot of oversight and security protocols which must be adhered to like only using approved computing devices with special software installed.