Government-wide Personnel Security Clearance Process
What We Found
The government-wide personnel security clearance process continues to face challenges in the timely processing of clearances, measuring the quality of investigations, and ensuring the security of related information technology systems.

Since our 2019 High-Risk Report, the rating for the action plan criterion improved from not met to partially met. Our assessment of the other four criteria remains unchanged.
Leadership commitment: met. The Security Clearance, Suitability, and Credentialing Performance Accountability Council (PAC) continues to serve as the entity responsible for driving government-wide implementation of security clearance reform, among other efforts.
The PAC is chaired by the Deputy Director for Management of the Office of Management and Budget (OMB) and is comprised of three other principal members—the Director of National Intelligence (DNI), the Under Secretary of Defense for Intelligence and Security, and the Director of the Office of Personnel Management (OPM) (hereafter PAC Principals).
The PAC continues to make progress in leading agencies to complete long-standing key reform initiatives. Continued and coordinated leadership by the PAC will be important as it works to complete these initiatives, including the government-wide implementation of continuous vetting—a process to review the background of relevant personnel at any time to determine if they continue to meet applicable requirements—and performance measures to gauge the quality of the entire security clearance process.
In addition, the Office of the Director of National Intelligence (ODNI) and OPM have issued various guidance documents, including an executive correspondence in February 2020, that include measures designed to help further eliminate the backlog of background investigations. The administration completed the transfer of the government-wide background investigation mission from OPM to DOD by October 2020. The Defense Counterintelligence and Security Agency (DCSA), which was created as a result of the transfer of the background investigations mission from OPM to the Department of Defense (DOD), serves as the government’s primary investigative service provider and conducts more than 95 percent of the government’s background investigations. DCSA reported that the backlog of investigations declined from approximately 725,000 cases in April 2018 to about 220,000 cases in October 2020.
Senior DOD leadership has also set long-term goals for the development of the National Background Investigations Services (NBIS)—an information technology (IT) system that will be a key component for implementing reforms to the clearance process—and has worked with OPM on the transfer to DOD of the legacy IT systems that support the background investigations process. DCSA assumed operational control of OPM’s legacy IT systems on October 1, 2020, and will maintain those systems until they are replaced by NBIS.
Capacity: partially met. As in 2019, the PAC continues to partially meet the capacity criterion as it transitions the background investigations function from OPM to DOD. OPM and DOD facilitated the transfer of more than 99 percent of National Background Investigations Bureau (NBIB) employees, totaling around 3,000 individuals, to DCSA by September 30, 2019. DCSA officials stated that they transferred 33 remaining OPM personnel around October 1, 2020, and are transferring $266 million in contracts, including those related to OPM’s legacy IT systems.
In our 2019 High-Risk Report, we stated that OMB, ODNI, and DOD should coordinate with responsible executive branch agencies to identify the resources needed to effectively implement reform initiatives within established time frames. In 2020, DCSA began to identify the resources agencies needed to implement Trusted Workforce 2.0, an effort designed to reform and align the three current personnel vetting processes: personnel security clearances, suitability for government employment or fitness to work on behalf of the government, and personnel credentialing.
However, DCSA officials stated that they have not yet developed a strategic workforce plan that identifies the workforce needed to meet the current and future demand for its services. DCSA officials told us that they plan to begin working on a strategic workforce plan once they have more fully established their new agency.
In addition, ODNI should assess the potential effects of continuous vetting on agency resources and develop a plan to address those effects.
Action plan: partially met. The PAC now partially meets the action plan criterion as ODNI, DOD, and OPM have adopted some action plans to reduce the backlog of investigations and to transfer the legacy IT systems that support the background investigation process. Specifically, an NBIB Backlog Mitigation plan issued in December 2018 outlined various mitigation measures to reduce the investigative backlog.
However, PAC officials stated that they have not completed plans to meet clearance processing timeliness objectives or finalized new performance management goals for Trusted Workforce 2.0. Completing the plans and finalizing the goals would help position the PAC in addressing the revised timeliness objectives included in the National Defense Authorization Act (NDAA) for Fiscal Year 2020.
The PAC Principals have issued some guidance to advance personnel vetting reform efforts under Trusted Workforce 2.0. For example, the DNI issued guidance related to continuous evaluation in 2018 and 2019. The DNI and Director of OPM—the Security Executive Agent and the Suitability and Credentialing Executive Agent, respectively—also issued additional implementation guidance in 2020 for continuous vetting—a process similar to continuous evaluation that includes additional data sources to review an individual’s background.
In addition, in January 2021 ODNI and OPM published the Core Vetting Doctrine in the Federal Register for public comment. The Core Vetting Doctrine describes the main principles of Trusted Workforce 2.0 as the overarching framework for the vetting process for the federal workforce. However, ODNI and OPM have not issued other key guidance documents including revised Federal Investigative Standards and Adjudicative Guidelines.
Monitoring: partially met. The PAC continues to partially meet the monitoring criterion by tracking and reporting publicly on the progress of reforms to the clearance process through www.performance.gov—a website that provides information on the performance of executive branch agencies. In addition, the DNI collected data from agencies to monitor the clearance process, including data on the timeliness of investigations and adjudications, reciprocity, and continuous evaluation. Further, DCSA developed a detailed project schedule to monitor the development of NBIS.
ODNI also developed a performance measure to assess investigation quality and collect data using the Quality Assessment Reporting Tool to assess the extent that agencies meet this measure. However, ODNI is not collecting information from all agencies on this measure. Additionally, ODNI officials told us that ODNI does not have measures to assess the quality of the end-to-end process including the adjudication phase. ODNI officials told us that they are modernizing, centralizing, and automating the collection of data from agencies for the clearance process. Officials told us that the automated capabilities will enable them to collect, analyze, and report on the end-to-end personnel vetting process.
Further, additional actions are needed to monitor the performance of the government-wide personnel security clearance process. For example, several statutes require the DNI, in coordination with the other PAC Principals, to annually report on aspects of the clearance process, including certain matters related to the timeliness of clearances.
In its fiscal year 2019 annual report to congressional committees, ODNI reported clearance timeliness information for intelligence community agencies in a section of the report focused on the intelligence community. However, ODNI had collected timeliness information from additional agencies but excluded that information from the report. According to ODNI, this was due to some delays in reporting by a limited number of agencies in light of the government shutdown that fiscal year. Providing more complete timeliness information in annual reports to congressional committees will facilitate improved monitoring and oversight of the clearance process.
Demonstrated progress: partially met. The PAC continues to partially meet the demonstrated progress criterion by reducing the backlog of background investigations, as we discussed earlier. ODNI officials attributed the progress to reducing the backlog, in part, to two executive memorandums issued jointly by ODNI and OPM in June 2018 and February 2020.
These memorandums contain measures designed to reduce the investigation backlog, such as authorizing agencies to defer periodic reinvestigations or apply interim continuous vetting requirements to satisfy periodic reinvestigation requirements.
In addition, DOD has made progress developing NBIS as a secure, shared service for background investigations. DOD created a detailed schedule to manage the development of NBIS and is continuing to refine the schedule over time. DOD officials explained that they developed this schedule using an approach that allows them the flexibility to adapt to unforeseen obstacles when developing NBIS.
Further, the PAC has made mixed progress on the timeliness of completing background investigations and adjudications across government agencies. For example, the average time for executive branch agencies to complete the fastest 90 percent of investigations for initial secret clearances improved from 162 days in fiscal year 2018 to 58 days in fiscal year 2020. However, the PAC has not made progress to increase the number of executive branch agencies that met the timeliness objectives. Specifically, the percent of the 37 agencies providing data that met the timeliness objectives in fiscal year 2020 remained constant or increased for three objectives compared to fiscal year 2018, but decreased for the remaining three objectives. In addition, less than half of executive branch agencies providing data met the timeliness objectives for every measure in fiscal year 2020 except the objective for reinvestigations, as shown in table 7 below.
Table 7: Percent of Executive Branch Agencies That Met Timeliness Objectives for the Fastest 90 Percent of Security Clearances, Fiscal Years 2018 – 2020
|
Percent of agencies meeting objectives in fiscal year |
||||
Phase in the clearance process |
Type of clearance |
Objective |
2018 |
2019 |
2020a |
Investigation |
Initial Secret |
40 |
3 |
3 |
3 |
|
Initial Top Secret |
80 |
13 |
9 |
18 |
|
Reinvestigations |
150 |
13 |
22 |
51 |
Adjudication |
Initial Secret |
20 |
45 |
34 |
32 |
|
Initial Top Secret |
20 |
47 |
33 |
27 |
|
Reinvestigations |
30 |
69 |
50 |
35 |
Source: GAO analysis of Office of the Director of National Intelligence data. | GAO-21-119SP
aFiscal year 2020 data include statistics only for the first three quarters of fiscal year 2020. The COVID-19 pandemic affected executive branch agencies’ operations and resulted in reporting delays, according to ODNI officials.
In addition, PAC officials told us that they began an evidence-based review by evaluating data on the time it has taken agencies to complete the clearance process, as we recommended in December 2017. Such a review could result in adjustments to the objectives. However, the PAC has not completed that effort.
Finally, officials stated that DOD and OPM have not completed efforts to secure OPM’s legacy IT systems used for the personnel security clearance process, including implementing further security improvements to OPM’s IT environment to ensure that key security controls are in place and operating as intended.
We placed the government-wide personnel security clearance process on the High-Risk List in January 2018 because it faces significant challenges related to (1) the timely processing of clearances, (2) measuring investigation quality, and (3) ensuring IT security, among other things.
Timeliness. The executive branch has been unable to consistently process personnel security clearances within established timeliness objectives.
Quality. A high-quality personnel security clearance process minimizes the risks of unauthorized disclosures of classified information and helps ensure that information about individuals with criminal histories or other questionable behavior is identified and assessed.
While the executive branch has taken some steps to measure quality, it has not (1) established measures to ensure the quality of the entire security clearance process, and (2) collected complete data to fully assess performance.
IT Security. DOD is building and managing the development of NBIS, which will replace OPM’s legacy IT systems. However, OPM has only made limited progress to remediate all identified weaknesses in its IT systems to ensure that key security controls are in place and operating as intended.
We have made numerous recommendations to PAC members to address risks associated with the personnel security clearance process since 2011, including 14 that are currently open. In addition, in March 2018, we outlined necessary actions and outcomes—anchored in each of our five criteria for removal from the High-Risk List—and our prior recommendations that have to be addressed for this area to be removed from our High-Risk List. These actions and outcomes are outlined below and are directed to OMB, ODNI, DOD, and OPM, unless a lead agency is indicated.
To make progress on meeting capacity, these agencies should
- coordinate with responsible executive branch agencies to complete the effort to identify the resources needed to effectively implement personnel security clearance reform effort initiatives within established time frames (OMB, ODNI, DOD);
- develop and implement a comprehensive strategic workforce plan that identifies the workforce needed to meet the current and future demand for its services (DOD); and
- assess the potential effects of continuous evaluation on agency resources and develop a plan to address those effects, such as modifying the scope of periodic reinvestigations, changing the frequency of periodic reinvestigations, or replacing periodic reinvestigations for certain clearance holders (ODNI).
To make progress on an action plan, these agencies should
- complete plans to meet clearance processing timeliness objectives and finalize new performance management goals for Trusted Workforce 2.0; and
- issue key guidance documents for Trusted Workforce 2.0.
To make progress on monitoring, these agencies should
- develop and report to Congress annually on government-wide, results-oriented performance measures for the quality of the entire security clearance process (ODNI);
- develop performance measures for continuous evaluation that agencies must track and regularly report to ODNI;
- develop performance measures for reciprocity determinations to monitor the extent of government-wide reciprocity and report on those metrics to Congress (ODNI); and
- develop government-wide performance measures on the quality of the entire security clearance process and collect complete data to assess performance for the measures developed (OMB, ODNI).
To improve on demonstrating progress, these agencies should
- complete an evidence-based review of the investigation and adjudication timeliness objectives for completing the fastest 90 percent of initial secret and initial top secret security clearances as well as periodic reinvestigations, and adjust the objectives if appropriate; and
- improve and secure personnel security clearance IT systems, including implementing further security improvements to its IT environment, including contractor-operated systems, to ensure that key security controls are in place and operating as intended (DOD, OPM).
Congressional Actions Needed
However, the reporting requirements from the NDAA for Fiscal Year 2018—including the annual timeliness assessments—expire at the end of 2021. Similar to what we stated in our December 2017 report, if Congress has found the information provided in response to these requirements to be beneficial, it may consider extending or renewing the requirements and expanding the scope of those reporting requirements to include information about performance measures on reciprocity determinations and quality in the clearance process.
