Personnel Security Clearances: Actions Needed to Address Significant Data Reliability Issues That Impact Oversight
Fast Facts
The government’s security clearance process helps ensure that federal employees who can access classified information are trustworthy. It has been on our High Risk List since 2018.
The Office of the Director of National Intelligence oversees the security clearance process and needs quality data to do so. But we found that the Office doesn't have accurate and complete data about different parts of the clearance process, including how long it takes to grant a clearance.
Of the security clearance data we reviewed from FY 2024, more than 60% was inaccurate or incomplete. We recommended addressing this and other issues to improve oversight.
Picture of paper with "Classified" information stamp.
Highlights
Why This Matters
Federal agencies must vet individuals who will need security clearances to access classified information. In 2018, we put this process on our High-Risk List partly due to delays and IT systems issues. The Office of the Director of National Intelligence (ODNI) oversees the efficiency and effectiveness of the process. ODNI has stated that consistent data are vital to meeting these responsibilities.
GAO Key Takeaways
In 2019, ODNI began requiring over 100 agencies that vet cleared personnel to submit data on timeliness, the number of investigations completed, and other key aspects of the personnel security clearance process. But more than 60 percent of the data we reviewed were not reliable across eight reporting requirements and seven agencies.
ODNI officials look closely at data measuring the time for agencies to complete the process. Of the timeliness data we analyzed, 86 percent were inaccurate—a third by 20 percent or more. Most of these inaccuracies were due to a calculation method inconsistent with ODNI guidance. This affected the timeliness measurement of 95 percent of the clearances completed across the government. Agency officials stated they revised their method to align with ODNI’s guidance for data collected starting in fiscal year (FY) 2025. However, much of the data reported to Congress and the public from 2020–2024 has underestimated the time to complete the clearance process.
ODNI reviews data it collects from agencies, but not in a way that aligns with data reliability principles. It also has not issued adequate guidance to agencies for assessing their data. Addressing these gaps will ensure ODNI and Congress have more reliable data to enable better oversight.
Personnel Security Clearance Data for Seven Selected Agencies, Third Quarter of Fiscal Year 2024
How GAO Did This Study
We analyzed FY 2024 data from ODNI and
- Departments of Defense, Energy, and the Treasury
- General Services Administration
- National Capital Planning Commission
- National Geospatial-Intelligence Agency
- U.S. Agency for International Development
We also compared ODNI’s oversight to key practices and interviewed officials.
Recommendations
We make four recommendations, including that ODNI implement a process to assess the reliability of agencies’ security clearance data and issue guidance to agencies on assessing data. ODNI did not explicitly agree or disagree with these but raised concerns, which we addressed.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Director of National Intelligence |
Priority Rec.
The Director of National Intelligence should develop and implement a process that guides ODNI's efforts to assess agencies' security clearance data. This process should incorporate data reliability practices or principles, such as those found in our data reliability guide or those established by DAMA International. (Recommendation 1) |
ODNI did not state whether it agreed or disagreed with this recommendation. In its comments, ODNI suggested revising recommendation 1 to remove reference to our data reliability principles, noting that these principles are designed for auditors and that ODNI lacks the infrastructure or expertise to conduct audits. While ODNI is correct that we follow our principles to ensure we use reliable data to inform our audits, any agency that collects data can adapt and apply the principles in the guide for its own purpose. Furthermore, ODNI could incorporate data reliability practices or principles from other organizations that reflect a similar intent as our guide on data reliability. We revised our report to highlight another source of these practices and principles, DAMA International. We also revised our recommendation to acknowledge that ODNI should incorporate data reliability practices or principles-whether from our guide, DAMA International's, or another, similar source-into a process to assess agency data. We will continue to follow up on the status of this recommendation.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should issue and monitor agencies' adherence to guidance clarifying the agencies' role in assessing data to improve the reliability of the data they report to ODNI. The guidance should require agencies to assess the characteristics, quality controls, and limitations of their data, using data reliability practices or principles, and address any gaps. (Recommendation 2) |
ODNI did not state whether it agreed or disagreed with this recommendation. In its comments, ODNI suggested removing language from this recommendation that it ensure agencies adhere to ODNI-issued data reliability guidance. ODNI described two reasons for this suggestion. First, it stated that it does not have traditional enforcement abilities and uses a collaborative approach to encourage agency compliance with data reporting responsibilities. Second, it stated that ensuring such adherence would be difficult and resource intensive. To the first point, as we describe in our report, as the Security Executive Agent, the DNI is responsible for overseeing the personnel security clearance process, including its quality, timeliness, consistency, and integrity. The Security Executive Agent is further required to review agencies' programs to determine whether they are being implemented in accordance with Executive Order 13467. As such, it has the authority to issue guidelines and instructions to the heads of agencies. Such guidance can help ensure appropriate uniformity, centralization, efficiency, effectiveness, timeliness, and security in the personnel security clearance process. In carrying out these oversight responsibilities, ODNI should work with agencies to implement its guidance on security clearance data reliability. To the second point, we recognize that it may be complicated for ODNI to ensure other federal agencies adhere to the data reliability guidance it issues. Therefore, we revised our recommendation to state that ODNI should monitor, rather than ensure, agencies' adherence to such guidance. We will continue to follow up on the status of this recommendation.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should define, at each relevant agency, the senior data official's role for assessing the reliability of the agency's data, and ensure agencies have identified these accountable officials. (Recommendation 3) |
ODNI did not state whether it agreed or disagreed with this recommendation. In its comments, ODNI stated that departments and agencies are to identify Senior Implementation Officials responsible for implementing Trusted Workforce 2.0. ODNI also stated it could issue guidance to those officials regarding their agencies' practices to ensure data are reliable. We will continue to follow up on the status of this recommendation.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should analyze and update, to the maximum extent practicable, ODNI's personnel vetting policy framework to incorporate GAO's key practices for evidence-building and performance-management activities and apply those practices in its oversight of the clearance process. (Recommendation 4) |
ODNI did not state whether it agreed or disagreed with this recommendation. In its comments, ODNI suggested we remove specific reference to our key practices for evidence-building and performance-management activities in this recommendation. ODNI stated that there is already a periodic review process under the Trusted Workforce 2.0 personnel vetting reform effort. We recognized this process in our report. However, as we also described in the report, ODNI has not effectively used a data-driven approach in its oversight activities. Incorporating our key practices into its oversight could help ODNI more effectively manage and assess the personnel security clearance process. We will continue to follow up on the status of this recommendation.
|