Personnel Vetting: Sustained Leadership Is Critical to DOD's New Approach to Its Background Investigation System
Fast Facts
This statement discusses our work on the Department of Defense's system for background investigations.
It is largely based on the following reports:
Personnel Vetting: DOD Needs to Enhance Cybersecurity of Background Investigation Systems
Additionally, it updates data from our prior work and shares preliminary observations of ongoing work related to this topic.
DOD has addressed some of our recommendations. We will monitor its continued efforts.
Note: The Congressional hearing we prepared this statement for was canceled.
The Capitol building with text that reads, "GAO Testimony to Congress."
Highlights
What GAO Found
The Department of Defense (DOD) is developing the National Background Investigation Services (NBIS)—an IT system for conducting background investigations for most federal agencies and over 13,000 industry organizations that work with the government. However, delays have hindered NBIS deployment. DOD initially planned for NBIS to be fully operational in 2019 and changed its deadline several times. It now projects major development to be complete by the end of fiscal year 2027.
DOD’s Missed Deployment Targets for the National Background Investigation Services (NBIS) Program, as of August 2025
DOD paused the NBIS program in 2024 and has since taken a new approach to its management and oversight of the program. In March 2024, DOD appointed a new Defense Counterintelligence and Security Agency (DCSA) director and NBIS program manager and subsequently revised its previous plans to develop an entirely new IT system. As of September 2025, DOD plans to migrate personnel vetting data to the cloud and modernize legacy systems. DOD also transferred some authority over the NBIS program to the Office of the Under Secretary of Defense for Acquisition and Sustainment in early 2024 as part of its efforts to address NBIS delays, cost overruns, and technical issues; and it created the NBIS Requirements Governance Board to regularly review the program.
GAO is currently reviewing DOD’s new schedule and cost estimate for NBIS following recent reforms. In contrast to its past approach, DCSA has stated that it intends to meet all of GAO’s scheduling best practices with the use of a software tool instead of an integrated master schedule for NBIS. DCSA has also taken some action consistent with GAO’s best practices for cost estimating, including completing an independent cost estimate. DCSA now projects spending an additional $2.2 billion on NBIS development, in addition to costs of $2.4 billion it spent on NBIS and legacy systems since fiscal year 2017.
Leadership is critical to the development of the NBIS system and the successful implementation of Trusted Workforce 2.0. Setbacks in NBIS development have led to delays in achieving Trusted Workforce 2.0 milestones. New DCSA leadership in 2024 set the program on a path that is intended to show marked improvements. However, sustained leadership by DOD will be critical to achieving personnel vetting reform.
Why GAO Did This Study
U.S. government personnel vetting processes, such as background investigations, rely on IT systems to process data on millions of federal employees and contractor personnel. Since 2018, the government has undertaken a major reform of personnel vetting called Trusted Workforce 2.0. DOD has been developing NBIS as the new IT system for personnel vetting.
This statement summarizes information on (1) DOD efforts to revise its approach to NBIS development, (2) GAO’s ongoing work on the most recent NBIS schedule and cost estimate, and (3) the importance of sustained leadership for NBIS to achieve personnel vetting reforms under Trusted Workforce 2.0.
This statement is based on GAO’s prior reports on NBIS from December 2021 through June 2024 as well as ongoing work. To perform prior and ongoing work, GAO analyzed information on NBIS from DCSA and the Office of Personnel Management, and interviewed knowledgeable officials.
Recommendations
In prior reports, GAO made one matter for congressional consideration to require DCSA to develop a reliable schedule and cost estimate for NBIS and 15 recommendations to DOD to improve NBIS program management and cybersecurity. One recommendation related to program management remains open. GAO will continue to monitor this high-risk area.