Personnel Security Clearances: Plans Needed to Fully Implement and Oversee Continuous Evaluation of Clearance Holders
Highlights
What GAO Found
In October 2016, the Office of the Director of National Intelligence (ODNI) took an initial step to implement continuous evaluation—a process to review the background of clearance holders and individuals in sensitive positions at any time during the eligibility period—across the executive branch, but it has not yet determined key aspects of the program, and it lacks plans for implementing, monitoring, and measuring program performance. For the first phase, agencies are to conduct certain continuous evaluation record checks against a portion of their national security population by the end of fiscal year 2017. However, ODNI has not formalized its policy on what continuous evaluation encompasses, determined what the future phases will entail or when they will occur, or developed an implementation plan. According to all seven agencies GAO interviewed, this uncertainty has affected their ability to plan for the program and estimate its costs. Without a continuous evaluation policy and a fully developed plan, full implementation—which has been delayed since 2010—may be further delayed. Moreover, ODNI lacks a plan to monitor and measure program performance, including for the first phase, which is underway. Without developing such a plan, ODNI cannot ensure that the program is being implemented consistently across the executive branch or that it is effectively identifying risks to national security.
The Department of Defense (DOD) and the Department of State (State) have designed, piloted, and evaluated continuous evaluation. Their approaches have varied in scope, size, and duration, as they pre-date ODNI's efforts to implement continuous evaluation executive branch-wide. DOD's pilot involves the most record checks and the largest population. DOD had 500,000 employees enrolled in December 2016, and it plans to enroll 1 million by the end of calendar year 2017 and all clearance holders by the end of fiscal year 2021.
Executive branch agencies meeting established timeliness goals for completing periodic reinvestigations decreased from fiscal years 2012 through 2016, and the potential effects of continuous evaluation, including on reinvestigations and resources, are unknown. While 84 percent of the executive branch agencies reviewed by GAO reported meeting the executive branch's 195-day timeliness goal for at least three of four quarters in fiscal year 2012, only 22 percent did so in fiscal year 2016. Also, a 2008 report outlined a plan to replace reinvestigations with continuous evaluation, but ODNI documentation indicates that this is no longer the intent. While agencies expressed varying views about changes to reinvestigations—such as modifying their scope—officials from five agencies stated that the continuous evaluation program will increase their workloads and costs if no other changes are made to the requirements. DOD officials said they cannot afford to conduct both continuous evaluation and reinvestigations, as DOD estimates that more frequent reinvestigations for certain clearance holders will cost $1.8 billion for fiscal years 2018 through 2022. Although agencies have identified increased resources as a risk of the program, ODNI has not assessed the program's potential effects on agency resources. Without assessing the potential effects once ODNI has further defined the program, implementing continuous evaluation could lead to further delays and backlogs in reinvestigations, and could increase agency costs.
Why GAO Did This Study
Continuous evaluation is a key executive branch initiative to more frequently identify and assess security-relevant information, such as criminal activity. Implementing a continuous evaluation program has been a long-standing goal, with implementation milestones as early as 2010 and DOD pilots dating back to the early 2000's.
GAO was asked to review efforts to implement continuous evaluation. This report assesses the extent to which (1) ODNI has implemented an executive branch-wide program and developed plans to monitor and measure its performance; (2) DOD and other agencies have designed, piloted, and evaluated continuous evaluation and (3) agencies completed timely periodic reinvestigations from fiscal years 2012-2016, and the potential effects of continuous evaluation on reinvestigations. GAO reviewed documentation, analyzed timeliness data, and interviewed officials from ODNI and other agencies. This is a public version of a sensitive report that is being issued concurrently. Information that ODNI and State deemed sensitive has been omitted.
Recommendations
GAO is making six recommendations, including that ODNI formalize its policy on continuous evaluation, develop an implementation plan as well as a plan to monitor and measure program performance, and assess the potential effects of continuous evaluation on agency resources. ODNI concurred with the recommendations, but disagreed with aspects of GAO's conclusions. GAO continues to believe the conclusions are valid, as discussed in the report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Director of National Intelligence | The Director of National Intelligence should issue a Security Executive Agent Directive for continuous evaluation to formalize the program, which includes, among other things, an expanded definition of continuous evaluation in advance of the next phase of implementation. (Recommendation 1) |
ODNI generally concurred with this recommendation. The Office of the Director of National Intelligence issued Security Executive Agent Directive 6: Continuous Evaluation (SEAD 6) on January 12, 2018.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should, in coordination with the Continuous Evaluation Working Group, develop an implementation plan for continuous evaluation across the executive branch that includes a schedule with timeframes and expectations for agencies, such as the requirements (e.g., the size of the enrolled population in continuous evaluation) for future phases of implementation. (Recommendation 2) |
ODNI generally concurred with this recommendation. The Office of the Director of National Intelligence issued Security Executive Agent Directive 6: Continuous Evaluation Program Implementation Guidelines in March 2018. This issuance meets the intent of our recommendation. Specific details of this plan are omitted because the information is sensitive.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should develop a plan for monitoring continuous evaluation performance, to include assessing continuous evaluation at various phases of implementation. (Recommendation 3) |
ODNI concurred with this recommendation. In memorandums issued in February 2020 and January 2021, ODNI discussed plans to monitor continuous evaluation performance and required agencies to provide specific metrics regarding continuous evaluation implementation. For example, departments and agencies were required to submit a memorandum demonstrating compliance with record check requirements. The memorandums also discussed ODNI's intent to use the metrics agencies provide to help ODNI assess continuous evaluation at various phases of implementation. By developing plans to monitor continuous evaluation-including assessing continuous evaluation at various phases of implementation-ODNI will help ensure that continuous evaluation is being conducted consistently across the executive branch, and will be able to identify any needed modifications to the program. These memorandums meet the intent of our recommendation.
|
| Office of the Director of National Intelligence |
Priority Rec.
The Director of National Intelligence should develop performance measures for continuous evaluation that agencies must track and determine a process and schedule for agencies to regularly report those measures to ODNI. At minimum, these performance measures should be clear, quantifiable, objective, and linked to measurable goals. (Recommendation 4) |
ODNI generally concurred with this recommendation. In November 2023, ODNI, in coordination with OPM, issued the Federal Personnel Vetting Performance Management Standards Implementation Guidance, which includes three measures related to continuous vetting: (1) the number and percentage of eligible individuals enrolled in continuous vetting, (2) the number of new continuous vetting alerts, and (3) the average time to resolve validated continuous vetting alerts. These measures are clear, quantifiable, and objective. Further, two of these measures are linked to measurable goals. This action meets the intent of our recommendation.
|
| Office of the Director of National Intelligence |
Priority Rec.
The Director of National Intelligence should, in coordination with the Deputy Director for Management of the Office of Management and Budget in the capacity as Chair of the Security, Suitability, and Credentialing Performance Accountability Council, conduct an evidence-based review of the timeliness goal of 195 days for completing the fastest 90 percent of periodic reinvestigations and the associated goals for the different phases of periodic reinvestigations, and adjust the goal if appropriate, taking into consideration available resources, the additional workload of continuous evaluation, and the risks associated with individuals retaining access to classified information without determining their continued eligibility. (Recommendation 5) |
ODNI generally concurred with this recommendation. This recommendation is no longer valid because ODNI, in coordination with the Office of Personnel Management, has implemented Trusted Workforce (TW) 2.0 policy that replaces periodic reinvestigations with Continuous Vetting. Specifically, as of September 30, 2021, the national security workforce was required to enroll in a TW 1.25 continuous vetting capability and by September 30, 2022, this population was required to be enrolled into a TW 1.5 CV capability. Enrollment in TW 1.25 allowed for the deferral of periodic reinvestigations, and enrollment in TW 1.5 satisfied the requirement of a periodic reinvestigation, according to Trusted Workforce 2.0 policies.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should, once ODNI has further defined the continuous evaluation program, to include issuing a Security Executive Agent Directive and developing an implementation plan, in coordination with the Deputy Director for Management of the Office of Management and Budget in the capacity as Chair of the Security, Suitability, and Credentialing Performance Accountability Council, assess the potential effects of continuous evaluation on agency resources and develop a plan, in consultation with implementing agencies, to address those effects, such as modifying the scope of periodic reinvestigations, changing the frequency of periodic reinvestigations, or replacing periodic reinvestigations for certain clearance holders. (Recommendation 6) |
ODNI generally concurred with this recommendation. Since we made our recommendation, ODNI and the Performance Accountability Council (PAC) Program Management Office (PMO) have assessed the potential effects of continuous evaluation on agency resources and developed a plan to address those effects. First, in 2020, executive branch agencies focused on implementing continuous vetting (CV), which they have described as an evolution of the CE concept. Regarding the assessment and plan, in February 2021, the PAC PMO advised agencies to estimate costs to implement continuous vetting (CV) based on the alerts they would likely receive. Agencies analyzed the information that would result in CV alerts, factors in an individual's behavior that would trigger investigative work to resolve CV alerts, and estimates of the extent that those behavioral factors existed in agencies' populations. In August 2021, the Office of Management and Budget instructed agencies to prioritize obtaining funding to implement Trusted Workforce 2.0, including support for agencies' transition to CV. In June 2022, the PAC PMO provided agencies a cost model to calculate personnel vetting costs, including costs for CV. In addition , the DNI and the Director of the Office of Personnel Management (OPM) issued guidance that modified the requirements for periodic reinvestigations. These modifications accounted for the shift of agency resources from periodic reinvestigations to CV. In February 2020, ODNI and OPM issued guidance that established a CV requirement, referred to as Trusted Workforce 1.5. The guidance identifies the automated record checks from seven data categories that agencies are required to use under Trusted Workforce 1.5. The guidance permits agencies to cease conducting periodic reinvestigations when they have been compliant with the Trusted Workforce 1.5 requirements. After issuing the Trusted Workforce 1.5 guidance, ODNI officials stated that they recognized not all agencies were able to immediately meet those requirements. Accordingly, in January 2021 ODNI and OPM issued additional guidance for another interim phase-referred to as Trusted Workforce 1.25-that requires agencies to perform three record checks instead of seven. Agencies that enroll personnel in a system that meets the Trusted Workforce 1.25 requirements are able to defer periodic reinvestigations for those personnel subject to applicable legal and policy requirements. These actions meet the intent of our recommendation.
|