Federal Workforce: Actions Needed to Improve the Transfer of Personnel Security Clearances and Other Vetting Determinations
GAO-24-105669
Published: Jan 22, 2024. Publicly Released: Jan 22, 2024.
Fast Facts
The government's security clearance and other "personnel vetting" processes help ensure that federal employees are trustworthy.
Personnel vetting decisions are supposed to be reciprocal: if one agency clears an employee, that employee should be able to transfer to another agency without a new background check.
But the Offices of Personnel Management and the Director of National Intelligence—who oversee the vetting processes—don't have good data on how often this works. We recommended addressing this and other challenges, such as agency access to a classified IT system.
The personnel security clearance process is on our High Risk List.
Highlights
What GAO Found
The Office of the Director of National Intelligence (ODNI) and the Office of Personnel Management (OPM)—two agencies with key personnel vetting oversight responsibilities—do not have reliable data on the extent to which agencies have honored previously granted vetting determinations, known as reciprocity. GAO found that reciprocity data ODNI collected from agencies were inconsistent and incomplete, as described below.
- Data were inconsistent. Agencies sometimes reported data to ODNI by component and other times at the agency level, according to ODNI officials. For example, in fiscal year 2019, the Treasury Department reported data by each of its components for the first two quarters but reported data at the department level in the third quarter, according to ODNI officials.
- Data were incomplete. Two of five agencies GAO analyzed did not report required data to ODNI on the frequency with which they determined individuals were ineligible for reciprocity. ODNI officials said they did not know how many agencies should report data to them, but have initiated an assessment to do so.
By following best practices for evaluating the reliability of data—such as tracing a sample of data records to or from source documents to assess the accuracy and completeness of the data—ODNI could improve its oversight of security clearance reciprocity.
ODNI and OPM have not fully addressed all reciprocity-related challenges that agencies and contractors face (see figure). For example, 28 of the 31 agencies GAO surveyed stated that information technology (IT) systems at times did not have complete information needed to make reciprocity determinations. If ODNI and OPM took actions to mitigate this and other challenges, agencies may be able to grant reciprocity more often and more quickly.
Reciprocity Challenges That Agencies and Contractors Face
Contractors reported that agencies did not provide updates when the security clearance reciprocity process was delayed. If ODNI develops and implements a plan to ensure that contractors are informed about the status of reciprocity determinations, contractors may be able to plan projects and hire personnel better, which could have positive effects on government contracts.
Why GAO Did This Study
Personnel vetting processes help ensure the trustworthiness of the federal government's workforce. Federal agencies vet personnel to determine whether they are suitable for employment or eligible to access classified information, among other things. Agencies are generally required to accept personnel vetting determinations that other agencies have previously made. This reciprocity can promote personnel mobility and help reduce skills gaps.
GAO was asked to review personnel vetting reciprocity issues. This report assesses the extent to which ODNI and OPM have (1) collected reliable data on agency reciprocity in the personnel vetting processes and (2) addressed reciprocity challenges that agencies and contractors face.
GAO analyzed ODNI data on reciprocity for fiscal years 2019 through 2021, and data from five agencies selected to obtain a diverse set of perspectives. GAO also surveyed a nongeneralizable sample of 31 agencies and 600 contractors (293 responded).
Recommendations
GAO made eight recommendations to ODNI and OPM, including that ODNI follow best practices to evaluate the reliability of data, ODNI and OPM develop and implement a plan to ensure that IT systems contain complete and accurate information, and ODNI develop and implement a plan to inform contractors about the status of reciprocity determinations. OPM concurred with the recommendations directed to it. ODNI did not provide formal comments on the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Director of National Intelligence |
Priority Rec.
The Director of National Intelligence should follow best practices for evaluating the reliability of the data that agencies submit related to security clearance reciprocity. Such best practices include interviewing knowledgeable officials about their data systems, reviewing data system documentation to determine if data entry controls are sufficient, and tracing a sample of data to or from source documents to assess the accuracy and completeness of the data. (Recommendation 1) |
ODNI did not state whether it concurred with the recommendations directed to it. In September 2024, ODNI provided GAO a written statement describing actions ODNI had taken or planned to take to address the recommendations in our report. Regarding this recommendation, ODNI stated that the Director of National Intelligence (DNI) has issued policies and employed best practices to increase the quality of agency data. ODNI also emphasized that agencies are responsible for the integrity of data and that it has issued policies communicating this responsibility. For example, ODNI referred to the Common Principles in Applying Federal Personnel Vetting Adjudicative Standards issued in July 2022. ODNI stated that provisions in the Principles direct agencies to verify that information they record in national repositories are current, accurate, and complete. We recognize that agencies are responsible for ensuring their data are complete and accurate. However, ODNI acknowledges that it also has a responsibility for reviewing agencies' data and stated that its metrics team reviews agencies' data, identifies discrepancies, and communicates with agencies about any errors it observes. ODNI also stated that the Security Executive Agent National Assessment Program evaluates agencies practices in documenting data to ensure data are properly recorded. In addition, ODNI stated that in the steps it takes to monitor and evaluate agencies' data, it employs best practices; however, ODNI does not describe or provide any documentation of specific best practices it employs such as those we described in our report. To fully implement this recommendation, ODNI needs to adopt and follow best practices for evaluating the reliability of agencies' data.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should develop and implement a plan that addresses agencies' concerns that led them to mistrust some other agencies' security clearance processes. (Recommendation 2) |
ODNI did not state whether it concurred with the recommendations directed to it. In its September 2024 statement, ODNI stated that a key premise of the Trusted Workforce 2.0 reform of the personnel vetting processes is to maximize efficiency and uniformity to cultivate trust in the processes. ODNI stated that the executive branch had issued multiple policies that constitute a plan and the policies emphasized standardization and consistency across the government, among other things. Also, ODNI discussed the Security Executive Agent National Assessment Program (SNAP) team that engages with agencies regularly to remind them of their responsibilities under SEAD 7, which establishes reciprocity requirements. ODNI's statement also points out that its SNAP team acts to dispel agency resistance to accepting existing background investigations. This resistance led us to recommend that ODNI develop and implement a plan to address this issue. While the broad Trusted Workforce 2.0 policies that ODNI refers to emphasize consistency and uniformity, none are focused on addressing agency mistrust. To fully implement this recommendation, ODNI should develop and implement a plan that addresses agencies' concerns that led them to mistrust some other agencies' security clearance processes.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should facilitate access to secure facilities and systems for agencies to ensure they can make reciprocity determinations. (Recommendation 3) |
ODNI did not state whether it concurred with the recommendations directed to it. In September 2024, ODNI stated that agencies with limited access to secure facilities could ask their investigative service provider to perform record checks of Scattered Castles to facilitate reciprocity. ODNI also stated that Intelligence Community Standard 705-02 requires an accreditation official from an agency to authorize personnel from an outside agency to use a secure facility. As a result, ODNI stated that it would be untenable and perhaps impossible for ODNI to attempt to facilitate the accesses required to secure facilities by outside departments and agencies. We recognize that agencies that operate secure facilities would be required to approve specific access agreements with outside agencies. We also recognize that ODNI may not have the capacity to facilitate each specific access agreement. However, we disagree that it is untenable for ODNI to facilitate such access in any capacity. As the Security Executive Agent, the DNI is responsible for ensuring reciprocity and issuing reciprocity related guidance. Therefore, ODNI is the agency in the best position to facilitate such access across the government. For example, ODNI may be able to facilitate access by sharing information about excess capacity in secure facilities and issuing guidance to facilitate such access. To fully implement this recommendation, ODNI needs to identify and implement an approach to facilitate access to secure facilities and systems for agencies to ensure they can make reciprocity decisions.
|
| Office of the Director of National Intelligence |
Priority Rec.
The Director of National Intelligence, in coordination with the Director of the Defense Counterintelligence and Security Agency, should develop and implement a plan to ensure that current and future IT systems used for personnel vetting contain complete and accurate information required to make security clearance reciprocity determinations. (Recommendation 4) |
ODNI did not state whether it concurred with the recommendations directed to it. In September 2024, ODNI stated that Intelligence Community Policy Guidance (ICPG) 704.5, Intelligence Community Personnel Security Database Scattered Castles requires agencies to ensure all data in the system are accurate, valid, appropriately classified, and submitted weekly, at a minimum. However, this policy existed at the time of our review and nonetheless agency survey respondents reported that IT systems contain inaccuracies and are incomplete. In addition, ODNI cited efforts to ensure that future IT systems contain complete and accurate information. For example, ODNI stated that it plans to continue working with DCSA through myriad working groups to ensure that the National Background Investigation Services (NBIS) will contain accurate and current data necessary for security clearance reciprocity decisions. However, ODNI did not describe any specific actions it planned to take to address the gap we reported. To fully implement this recommendation, the Director of National Intelligence should develop and implement a plan to ensure that current and future IT systems used for personnel vetting contain complete and accurate information required to make security clearance reciprocity determinations.
|
| Office of Personnel Management | The Director of the Office of Personnel Management, in coordination with the Director of the Defense Counterintelligence and Security Agency, should develop and implement a plan to ensure that current and future IT systems used for personnel vetting contain complete and accurate information required to make suitability, fitness, and credentialing reciprocity determinations. (Recommendation 5) |
OPM concurred with this recommendation. While OPM did not specifically state how it would address this recommendation, it agreed that enhancements to the reciprocity system are needed to improve the mobility of individuals. OPM also stated that it will continue to work with DCSA regarding the requirements for the National Background Investigation Services IT system. In October 2024, the Acting Director of OPM provided GAO a written statement on the actions OPM had taken and planned to take in response to the recommendations to OPM in this report. OPM reiterates that enhancements to the government-wide reciprocity system are needed to improve mobility of individuals. In addition, OPM discusses planned actions to improve NBIS capabilities that would address a challenge we reported that is not related to this recommendation. OPM also discusses the recently issued Personnel Vetting Performance Management Implementation Guidance (PMIG) that ODNI and OPM issued, but the response does not explain how the guidance would ensure that IT systems contain complete and accurate information required to make reciprocity decisions. Further, we also reviewed the PMIG and did not identify aspects of the guidance that would address this recommendation. To close this recommendation, we would expect OPM to develop and implement a plan to ensure that current and future IT systems used for personnel vetting contain complete and accurate information required to make reciprocity determinations.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should issue clarifying guidance, such as by updating Security Executive Agent Directive 7, to address whether communicating with prior agencies is permitted in the security clearance reciprocity process and, if so, under what circumstances. (Recommendation 6) |
ODNI did not state whether it concurred with the recommendations directed to it. In its September correspondence, ODNI stated that guidance on reciprocity states that when a previous investigation is at the appropriate level and there are no indicators of potential risk, agencies should accept a prior trust determination without additional investigative or adjudicative activity. ODNI also stated that no communication between departments and agencies would be needed for reciprocity decisions.However, as we reported, 30 of the 31 agency respondents to our survey told us that they communicated with other agencies regularly during the reciprocity process. For example, officials from one agency told us that CVS sometimes includes an alert in an individual's file that requires agencies to contact the former agency prior to granting reciprocity. Further, as we also reported, ODNI officials provided conflicting information at different points during our review on the role of communication in the reciprocity process. In one interaction, ODNI officials acknowledged that agencies communicate with one another and during another interaction ODNI officials stated that information sharing is not part of the reciprocity process. In its September 2024 statement, ODNI reported that it plans to review Security Executive Agent Directive 7 to determine if changes are needed to align with Trusted Workforce 2.0. However, ODNI did not indicate if this review would consider clarifying the role of communication with prior agencies in the reciprocity process. To fully implement this recommendation, ODNI needs to issue clarifying guidance to address whether communicating with prior agencies is permitted in the security clearance reciprocity process and, if so, under what circumstances.
|
| Office of Personnel Management | The Director of the Office of Personnel Management should develop and implement supplemental policies to ensure that federal agencies consistently share information with other agencies attempting to grant suitability, fitness, and credentialing reciprocity. (Recommendation 7) |
OPM concurred with this recommendation. OPM stated that it will develop and implement policies that promote timely information sharing among agencies by building on Trusted Workforce 2.0 policies that have emphasized information sharing. In its October 2024 statement, OPM refers to information sharing provisions in several Trusted Workforce 2.0 policies such as the PMIG and the Federal Personnel Vetting Core Doctrine. The provisions in these policies are constructive; however, all but one that OPM cites were issued at the time of our review. Further, all the policies OPM cites are broad policies that do not address the information sharing gap we reported. To fully implement this recommendation, we would expect OPM to develop and implement supplemental policies to ensure that federal agencies consistently share information with other agencies attempting to grant suitability, fitness, and credentialing reciprocity.
|
| Office of the Director of National Intelligence | The Director of National Intelligence should develop and implement a plan that accounts for contractor and agency concerns—with consideration of resource and privacy issues—to ensure that contractors are informed about the status of reciprocity determinations when there are delays. (Recommendation 8) |
ODNI did not state whether it concurred with the recommendations directed to it. In its September 2024 correspondence, ODNI stated that implementing our recommendation is not feasible because it would be burdensome to agencies due to the large volume of reciprocity applications. ODNI also stated that privacy and security issues would preclude an efficient or practical process to communicate with contracting organizations. However, we reported that officials from two agencies told us their agencies already provide status updates to contractors and an official from a third agency said sending regular updates could be feasible if the process was automated. ODNI also stated that it would continually analyze information it collects related to the PMIG to improve reciprocity determinations across the executive branch. However, ODNI did not discuss any specific actions it would take to implement our recommendation. To fully implement this recommendation, ODNI needs to develop and implement a plan to inform contractors about the status of reciprocity determinations.
|
Full Report
GAO Contacts
Public Inquiries
Topics
Background investigationsBest practicesClassified informationCompliance oversightCriminal investigationsData reliabilityFederal contractorsFederal workforceInformation systemsIntelligence communityMilitary intelligenceNational securityPersonnel managementPersonnel security clearances