Security Clearances: Agencies Need Clearly Defined Policy for Determining Civilian Position Requirements
Highlights
What GAO Found
The Director of National Intelligence (DNI), as Security Executive Agent, has not provided agencies clearly defined policy and procedures to consistently determine if a position requires a security clearance. Executive Order 13467 assigns DNI responsibility for, among other things, developing uniform and consistent policies to determine eligibility for access to classified information, and gives the DNI authority to issue guidance to agency heads to ensure uniformity in processes relating to those determinations. In the absence of this guidance, agencies are using an Office of Personnel Management (OPM) tool that OPM designed to determine the sensitivity and risk levels of civilian positions which, in turn, inform the type of investigation needed. OPM audits, however, found inconsistency in these position designations, and some agencies described problems in implementing OPM’s tool. In an April 2012 audit, OPM reviewed the sensitivity levels of 39 positions in an agency within the Department of Defense (DOD) and reached different conclusions than the agency for 26 of them. Problems exist, in part, because OPM and the Office of the Director of National Intelligence (ODNI) did not collaborate on the development of the position designation tool, and because their roles for suitability—consideration of character and conduct for federal employment—and security clearance reform are still evolving. Without guidance from the DNI, and without collaboration between the DNI and OPM in future revisions to the tool, executive branch agencies will continue to risk making security clearance determinations that are inconsistent or at improper levels.
The DNI also has not established guidance to require agencies to review and revise or validate existing federal civilian position designations. Executive Order 12968 says each agency shall request or grant clearance determinations, subject to certain exceptions, based on a demonstrated need for access, and keep to a minimum the number of employees that it determines are eligible for access to classified information. The order also states that access to classified information shall be terminated when an employee no longer has a need for access, and prohibits agencies from requesting or approving eligibility in excess of actual requirements for access. During this review of Department of Homeland Security (DHS) and DOD components, GAO found that agency officials were aware of the need to keep the number of security clearances to a minimum, but were not always required to conduct periodic reviews and validations of the security clearance needs of existing positions. Overdesignating positions results in significant cost implications, given that the fiscal year 2012 base price for a top secret clearance investigation conducted by OPM is $4,005, while the base price of a secret clearance is $260. Conversely, underdesignating positions could lead to security risks. GAO found that the agencies follow varying practices because the DNI has not established guidance that requires executive branch agencies to review and revise or validate position designations on a recurring basis. Without such a requirement, executive branch agencies may be hiring and budgeting for initial and periodic security clearance investigations using position descriptions and security clearance requirements that no longer reflect national security needs. Further, since reviews are not done consistently, DHS and DOD and other executive branch agencies cannot have assurances that they are keeping the number of positions that require security clearances to a minimum.
Why GAO Did This Study
Security clearances allow personnel access to classified information that, through unauthorized disclosure, can, in some cases, cause exceptionally grave damage to U.S. national security. In 2011, the DNI reported that over 4.8 million federal government and contractor employees held or were eligible for a clearance. To safeguard classified data and manage costs, agencies need an effective process to determine whether civilian positions require a clearance. GAO was asked to examine the extent to which the executive branch has established policies and procedures for agencies to use when (1) first determining if federal civilian positions require a security clearance and (2) reviewing and revising or validating existing federal civilian position security clearance requirements. GAO reviewed executive orders and the Code of Federal Regulations and met with officials from ODNI and OPM because of their Directors’ assigned roles as Security and Suitability executive agents, as well as DHS and DOD based on the volume of clearances they process.
Recommendations
GAO recommends that the DNI issue clearly defined policy for agencies to follow when determining if federal civilian positions require a security clearance, and that the DNI and Director of OPM collaborate to revise the existing position designation tool. GAO further recommends that the DNI issue guidance to require agencies to periodically review and revise or validate the designation of their existing federal civilian positions. ODNI and OPM concurred, although OPM raised concerns with which GAO disagrees and addresses in the report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Director of National Intelligence | We recommend that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue clearly defined policy and procedures for federal agencies to follow when determining if federal civilian positions require a security clearance. |
Both the Office of the Director of National Intelligence and the Office of Personnel Management concurred with our recommendation, and jointly proposed a new chapter and part to the Code of Federal Regulations (CFR) clarifying the position sensitivity designation of national security positions. This new regulation, 5 CFR Part 1400, became effective on July 6, 2015 and provides departments and agencies with more detailed guidance on designating national security positions for federal civilian positions. Specifically, the regulation impacts civilian positions within 1) the competitive service, 2) the excepted service where the incumbent can be noncompetitively converted to the competitive service, and 3) career appointments in the Senior Executive Service. Then, following the new regulation, the Office of Personnel Management and the Office of the Director of National Intelligence issued an implementing memorandum in May 2016, which outlines actions that agencies must take, such as conducting an assessment of covered positions within 24 months, to ensure they are properly designated in accordance with the new regulation. In addition, the implementing memorandum lists affected agencies and identifies changes and differences between 5 CFR Part 1400 and the previous regulation. These actions meet the intent of our recommendation.
|
| Office of the Director of National Intelligence | In addition, we recommend that, once the policy and procedures are issued, the DNI and the Director of OPM collaborate in their respective roles as Executive Agents to revise the position designation tool to reflect that guidance. |
The Office of Personnel Management and the Office of the Director of National Intelligence concurred with our recommendation, and issued 5 CFR Part 1400 effective on July 6, 2015, which provides departments and agencies with more detailed guidance on designating national security positions for federal civilian positions. Then in November 2015, the Office of Personnel Management released an updated Position Designation Automated Tool. The tool and the accompanying glossary both indicate that they are based on 5 CFR Part 1400. Specifically the tool restates that each position in the Federal service must be evaluated for a position sensitivity designation commensurate with the responsibilities and assignments of the position as they relate to the impact on the national security. Such responsibilities and assignments include, but are not limited to, access to classified information (such as Confidential, Secret, or Top Secret). This action meets the intent of our recommendation.
|
| Office of the Director of National Intelligence | Finally, we recommend that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue guidance to require executive branch agencies to periodically review and revise or validate the designation of all federal civilian positions. |
Both the Office of Personnel Management and the Office of the Director of National Intelligence concurred with our recommendation, and jointly proposed a new chapter and part to the Code of Federal Regulations (CFR) clarifying the position sensitivity designation of national security positions. This new regulation, 5 CFR Part 1400, became effective on July 6, 2015 and provides departments and agencies with more detailed guidance on designating national security positions for federal civilian positions. Specifically, the regulation impacts civilian positions within 1) the competitive service, 2) the excepted service where the incumbent can be noncompetitively converted to the competitive service, and 3) career appointments in the Senior Executive Service. Then, following the new regulation, the Office of Personnel Management and the Office of the Director of National Intelligence issued an implementing memorandum in May 2016, which outlines actions that agencies must take, such as conducting an assessment of covered positions within 24 months, to ensure they are properly designated in accordance with the new regulation. In addition, the implementing memorandum lists affected agencies and identifies changes and differences between 5 CFR Part 1400 and the previous regulation. These actions meet the intent of our recommendation.
|