Personnel Security Clearances: Additional Actions Needed to Ensure Quality, Address Timeliness, and Reduce Investigation Backlog

A high-quality personnel security clearance process is necessary to minimize the risks of unauthorized disclosures of classified information and to help ensure that security-relevant information is identified and assessed. The passage of IRTPA initiated an effort to reform the security clearance process government-wide.

This report assesses the extent to which (1) executive branch agencies made progress reforming the security clearance process; (2) executive branch agencies completed timely initial clearances from fiscal years 2012-2016, and reported on timeliness; and (3) NBIB has taken steps to improve the background investigation process and address the backlog. GAO reviewed documentation; analyzed timeliness data; and interviewed officials from the four PAC Principals and NBIB. This is a public version of a sensitive report that GAO issued in December 2017. Information that the DNI and OPM deemed sensitive has been omitted.

Executive branch agencies have made progress reforming the security clearance process, but long-standing key initiatives remain incomplete. Progress includes the issuance of common federal adjudicative guidelines and updated strategic documents to help sustain the reform effort. However, agencies face challenges in implementing certain aspects of the 2012 Federal Investigative Standards—criteria for conducting background investigations—including establishing a continuous evaluation program, and the issuance of a reciprocity policy to guide agencies in honoring previously granted clearances by other agencies remains incomplete. Executive branch agencies have taken recent steps to prioritize over 50 reform initiatives to help focus agency efforts and facilitate their completion. In addition, while agencies have taken steps to establish government-wide performance measures for the quality of investigations, neither the Director of National Intelligence (DNI) nor the Security, Suitability, and Credentialing Performance Accountability Council (PAC) have set a milestone for their completion. Without establishing such a milestone, completion may be further delayed and agencies will not have a schedule against which they can track progress or to which they are accountable.

The number of executive branch agencies meeting established timeliness objectives for initial security clearances decreased from fiscal years 2012 through 2016, and reporting has been limited. For example, 59 percent of the executive branch agencies reviewed by GAO reported meeting investigation and adjudication timeliness objectives for initial top secret clearances in fiscal year 2012, compared with 10 percent in fiscal year 2016. The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) required the executive branch to submit an annual report, through 2011, to appropriate congressional committees on, among other things, the time required to conduct investigations, adjudicate cases, and grant clearances. Since the requirement ended, reporting has been limited to a portion of the intelligence community. Without comprehensive reporting, Congress will not be able to monitor agencies' progress in meeting timeliness objectives, identify corrections, or effectively execute its oversight role.

The National Background Investigations Bureau (NBIB), within the Office of Personnel Management (OPM), has taken steps to improve the background investigation process, but it faces operational challenges in addressing the investigation backlog and increasing investigator capacity. While NBIB has taken positive steps to improve its oversight of background investigation contracts, it faces operational challenges in reducing the investigation backlog—which grew from 190,000 cases in August 2014 to more than 709,000 in September 2017. To increase capacity NBIB has hired additional federal investigators and increased the number of its investigative fieldwork contracts, but it has not developed a plan for reducing the backlog or established goals for increasing total investigator capacity. Without such a plan and goals, the backlog may persist and executive branch agencies will continue to lack the cleared personnel needed to help execute their respective missions. The bill for the National Defense Authorization Act for Fiscal Year 2018, passed by Congress in November 2017, would authorize DOD to conduct its own background investigations.

Congress should consider reinstating the IRTPA requirement for clearance timeliness reporting. GAO is also making six recommendations, including that the DNI and other PAC Principals set a milestone for establishing measures for investigation quality, and that NBIB develop a plan to reduce the backlog and establish goals for increasing total investigator capacity. NBIB concurred with the recommendations made to it. The DNI did not concur with GAO's conclusions and recommendations. GAO continues to believe they are valid, as discussed in the report.

The enactment of the Intelligence Reform and Terrorism Prevention Act  of 2004 (IRTPA) initiated a reform effort that includes goals and  requirements for improving the personnel security clearance process  government-wide. A high-quality personnel security clearance process is  necessary to minimize the risks of unauthorized disclosures of classified  information and to help ensure that information about individuals with  criminal histories or other questionable behavior is identified and  assessed. In 2014, emphasis on security clearance reform was renewed  following high-profile events. These events included the June 2013  disclosure of classified documents by a former National Security Agency  contractor, and the September 2013 shooting at the Washington Navy  Yard by an individual who had both access to the facility and a security  clearance. However, these reform efforts immediately faced significant  challenges. In 2014, the Office of Personnel Management (OPM)   experienced issues with respect to its largest background investigation  contractor, and it did not exercise an option to extend the contract.  According to OPM, it conducts about 95 percent of the federal  government’s background investigations. Additionally, in 2015, OPM was  subjected to a massive security breach of its information technology (IT)  systems. Moreover, OPM reports that it has a significant backlog of  background investigations, which has raised congressional concerns  about delays in processing security clearances and risks to national  security.

Executive Order 13467 established the Security, Suitability, and  Credentialing Performance Accountability Council (PAC) as the  government-wide structure responsible for driving the implementation of  and overseeing security and suitability reform efforts. The Executive  Order also designated the Deputy Director for Management of the Office  of Management and Budget (OMB) as the Chair of the PAC, and the  Director of National Intelligence as the Security Executive Agent  responsible for developing consistent policy and procedures for, among  other matters, timely investigations and adjudications.

We have issued numerous reports highlighting issues related to  personnel security clearances. For example, in 2017, we reported on  challenges related to the implementation of an executive branch-wide  continuous evaluation program, and in 2015 we reported on the need to  take steps to improve the reciprocity of security clearances among  executive branch agencies. Appendix I provides the status of  recommendations we have made to improve the personnel security  clearance process. Moreover, in our 2015 and 2017 updates to our High- Risk series, we identified the Department of Defense’s (DOD) personnel  security clearances as a previous high-risk area that we continue to  monitor to determine whether the improvements we have noted are  sustained and whether any new issues have emerged.

We began our work under the authority of the Comptroller General to  conduct evaluations on his own initiative. The Ranking Member of the  Senate Committee on Homeland Security and Governmental Affairs, the  Vice Chairman of the Senate Select Committee on Intelligence, and  Senator Jon Tester subsequently submitted requests to be addressees  for this review. Additionally, Senate Report 114-280 included a provision  that we review the transition, oversight, and operation of the newly  established National Background Investigations Bureau (NBIB), within  OPM. This report assesses the extent to which: (1) executive branch  agencies have made progress in reforming the security clearance  process; (2) executive branch agencies met established timeliness  objectives for initial personnel security clearances from fiscal year 2012  through fiscal year 2016, and reported on their timeliness; and (3) NBIB  has taken steps to improve the background investigation process and  address the investigation backlog.

This report is a public version of a sensitive report that we issued on  December 7, 2017. ODNI and OPM deemed some of the information in  our December report to be sensitive, which must be protected from public  disclosure. Therefore, this report omits sensitive information. Although the  information provided in this report is more limited, the report addresses  the same objectives as the sensitive report and uses the same  methodology.

To address our first objective, we compared the PAC’s strategic  framework for fiscal years 2017 through 2021 and quarterly progress  updates against recommendations from the PAC’s 120-day and 90-day  reviews and PAC-identified reform milestones. Additionally, we  interviewed PAC Program Management Office officials as well as officials  from OMB, OPM, the Office of the Director of National Intelligence  (ODNI), and DOD, due to their roles as principal members of the PAC.  We also interviewed officials from the Departments of Homeland Security,  Justice, and State with regard to their plans to implement continuous  evaluation—a key reform effort. We compared this information against  Standards for Internal Control in the Federal Government related to the  identification of risks and monitoring activities; criteria for assessing high- risk areas, such as leadership commitment; and best practices for  comprehensive and effective IT strategies identified in our prior work.  We also reviewed the executive branch’s guide for quality standards and  tools, and we identified and applied criteria developed from our body of  work on using results-oriented management tools to help achieve desired  program outcomes.

To address our second objective, we reviewed relevant statutes and  ODNI guidance addressing the timeliness of background investigations  and adjudications as well as reporting requirements. We also reviewed  available executive branch reports on timeliness. We obtained data from  ODNI on the timeliness of initial personnel security clearances for fiscal  years 2012 through 2016 for specific executive branch agencies. We  excluded the data reported by State to ODNI from our analysis due to a  July 2017 report by the State Office of Inspector General, which identified  a number of errors in the department’s security clearance timeliness  data. As such, we reported on the timeliness of the remaining executive  branch agencies for which ODNI provided data. To assess the reliability  of the data for the remaining executive branch agencies, we reviewed  relevant documentation and interviewed officials about data quality  control procedures. Based on these steps, we determined that the data  were sufficiently reliable for the purposes of this report. For that reason,  we did not independently test the accuracy of the agencies’ databases.

We selected the fiscal year 2012 through 2016 timeframe for our analysis  because the executive branch has not publicly reported on the timeliness  of individual executive branch agencies since fiscal year 2011. We  analyzed the data to determine the extent to which agencies are meeting  IRTPA timeliness objectives for completing the fastest 90 percent of initial  secret clearance determinations within 60 days (40 days to investigate and 20 days to adjudicate). Appendix II provides additional details on  IRTPA as it relates to personnel security clearances. We also analyzed  the extent to which agencies are meeting ODNI revised timeliness  objectives for completing the fastest 90 percent of initial top secret  clearance determinations. In addition, we reviewed relevant ODNI and  PAC reports for information regarding the timeliness of investigations and  compared it against criteria for assessing high-risk areas such as  monitoring and demonstrated progress. Finally, we interviewed PAC,  ODNI, and NBIB officials regarding timeliness challenges, efforts to  improve timeliness, and the reporting of timeliness information.

To address our third objective, we analyzed studies, organizational  charts, plans, and other documents related to the establishment,  transition, oversight, and operation of NBIB. We compared these  documents against key principles of strategic workforce planning that we  have identified in prior work, such as determining the critical skills and  competencies needed to achieve current and future programmatic results  and developing strategies that are tailored to address gaps in numbers of  people, skills and competencies, and deployment of the workforce;  selected OPM workforce planning best practices; OMB policy that  requires agencies to take actions to ensure that they have sufficient  internal capability to maintain control over functions that are core to the  agency’s mission and operations; and criteria for assessing high-risk  areas such as leadership commitment, capacity, action plans, monitoring,  and demonstrated progress. Additionally, given the OPM data breach in  2015 and a decision to shift security clearance IT functions to a new  DOD-developed and -operated National Background Investigation  System (NBIS), we examined efforts to operationalize the new system  and leveraged our recent work examining IT security at OPM. Further,  we reviewed and analyzed current and former NBIB/ Federal Investigative  Services (FIS) background investigation fieldwork services contracts to  determine investigative capacity and steps taken to improve timeliness.  FIS is the prior entity within OPM that conducted background  investigations for the federal government. We interviewed NBIB officials  to determine how NBIB was providing oversight of investigative contracts  and how that process changed in the wake of the 2014 issues related to a  major investigative service provider. We also interviewed NBIB, PAC, and  DOD officials regarding the transition, oversight, and operation of NBIB.

The performance audit upon which this report is based was conducted  from July 2016 through December 2017 in accordance with generally  accepted government auditing standards. Those standards require that  we plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives. We subsequently worked with ODNI and OPM from November  2017 to December 2017 to prepare this report for public release. This  public version was also prepared in accordance with these standards.

Personnel security clearances are required for access to certain national  security information. National security information may be classified at  one of three levels: confidential, secret, or top secret. The level of  classification denotes the degree of protection required for information  and the amount of damage that unauthorized disclosure could reasonably  be expected to cause to national security. Specifically, unauthorized  disclosure could reasonably be expected to cause (1) “damage,” in the  case of confidential information; (2) “serious damage,” in the case of  secret information; and (3) “exceptionally grave damage,” in the case of  top secret information. As part of the security clearance process,  individuals granted security clearances are investigated periodically—for  as long as they remain in a position requiring access to classified  information—to ensure their continued eligibility. As of October 1, 2015,  the latest date for which data are available, approximately 4.2 million  government and contractor employees, at nearly 80 executive branch  agencies, were eligible to hold a security clearance.

IRTPA, Executive Orders, and Recent Legislation

IRTPA. As noted earlier, IRTPA initiated a reform effort that includes  goals and requirements for improving the personnel security clearance  process government-wide. For example, IRTPA established specific  objectives for the timeliness of security clearance processing. It also  required that all security clearance background investigations and  determinations completed by an authorized investigative agency or  authorized adjudicative agency be accepted by all agencies (known as  reciprocity), subject to certain exceptions. Appendix II provides  additional details on IRTPA as it relates to personnel security clearances.

Relevant Executive Orders. The personnel security clearance process  and reform efforts are governed by various executive orders. Key  executive orders affecting personnel security clearance reform include  Executive Orders 12968, 13467, 13741, and 13764, which, among other  things, provide definitions, processes, responsibilities, and authorities  related to eligibility for access to classified information, suitability and  fitness for government employment, and security clearance reform.

Aspects of the reform effort covered by the Executive Orders include the  establishment of the PAC and NBIB, the transfer of IT responsibilities to  DOD, the definition of continuous evaluation, and the addition and  amendment of certain roles and responsibilities.

Recent legislation. Section 951 of the National Defense Authorization  Act for Fiscal Year 2017 requires, among other things, the Secretary of  Defense to develop an implementation plan for the Defense Security  Service to conduct background investigations for certain DOD  personnel—presently conducted by OPM—after October 1, 2017. The  Secretary of Defense was to submit the plan to the congressional defense  committees by August 1, 2017. DOD provided the plan to the  congressional defense committees on August 25, 2017. Section 951 also  requires the Secretary of Defense and the Director of OPM to develop a  plan by October 1, 2017, to transfer investigative personnel and  contracted resources to DOD in proportion to the workload if the plan for  the department to conduct background investigations were  implemented.

In November 2017, after the conclusion of our audit work, Congress  passed a bill for the National Defense Authorization Act for Fiscal Year  2018. The bill includes a provision that, among other things, would  authorize DOD to conduct its own background investigations and would  require DOD to begin carrying out the implementation plan required by  section 951 of the National Defense Authorization Act for Fiscal Year  2017 by October 1, 2020. It would also require the Secretary of Defense,  in consultation with the Director of OPM, to provide for a phased  transition.

Governance Structure for Security Clearance Reform Effort

To help guide the personnel security clearance reform effort, in June  2007, the Director of National Intelligence and the Under Secretary of  Defense for Intelligence established the Joint Reform Team through a  memorandum of agreement to execute joint reform efforts to achieve  IRTPA timeliness objectives and improve the processes related to  granting security clearances and determining suitability for government  employment. The team consisted of cognizant entities within OMB, OPM,  ODNI, and DOD. The team worked on improving the security clearance  process governmentwide, including providing progress reports on the  reform effort, recommendations for research priorities, and oversight of  the development and implementation of an information technology  strategy, among other things.

In June 2008, Executive Order 13467 established the PAC as the  government-wide governance structure responsible for driving the  implementation of and overseeing security and suitability reform efforts.  Its specific responsibilities include ensuring the enterprise-wide alignment  of suitability, security, credentialing, and, as appropriate, fitness  processes; working with agencies to implement continuous performance  improvement programs, policies, and procedures; establishing annual  goals and progress metrics; and preparing annual reports on results. In  addition, the PAC is to develop and continuously reevaluate and revise  outcome-based metrics that measure the quality, efficiency, and  effectiveness of the vetting enterprise, among other things. As noted  above, the Deputy Director for Management of OMB serves as the Chair  of the PAC and has authority, direction, and control over its functions.

In addition to the Deputy Director for Management of OMB, the PAC has  three additional principal members: the Director of National Intelligence,  the Director of OPM, and the Under Secretary of Defense for Intelligence.

Director of National Intelligence: The Director of National  Intelligence serves as the Security Executive Agent and is responsible  for, among other things, developing and issuing uniform and  consistent policies and procedures to ensure the effective, efficient,  timely, and secure completion of investigations, polygraphs, and  adjudications related to determinations of eligibility for access to  classified information or eligibility to hold a sensitive position. In this  role, the Director of National Intelligence is also to direct the oversight  of such investigations, reinvestigations, and adjudications.

Director of OPM: The Director of OPM serves as the Suitability and  Credentialing Executive Agent and is responsible for, among other  things, prescribing suitability standards and minimum standards of  fitness for employment.

Under Secretary of Defense for Intelligence: The Under Secretary  of Defense for Intelligence became the fourth principal member of the  PAC with the issuance of Executive Order 13741 in September  2016. Additionally, Executive Order 13467, as amended, assigns  DOD responsibility for designing, developing, operating, defending,  and continuously updating and modernizing, as necessary, IT  systems that support all background investigation processes  conducted by NBIB.

In addition, in April 2014, the PAC established the Program Management  Office to implement personnel security clearance reforms. This office  includes subject-matter experts with knowledge of personnel security  clearances and suitability determinations from OMB, ODNI, OPM, DOD,  the Department of Homeland Security, the Department of Justice, the  Department of the Treasury, and the Federal Bureau of Investigation.  Prior to the establishment of the Program Management Office, the PAC  was supported by the Joint Reform Team as well as various  subcommittees that addressed specific tasks, such as investigator and  adjudicator training and the development of performance measures.

Key Efforts to Reform the Personnel Security Clearance Process

Since 2014, there have been a number of key efforts to reform the  personnel security clearance process. For example, following the  September 2013 shooting at the Washington Navy Yard, the PAC  conducted a 120-day interagency review to assess risks inherent in the  federal government’s security, suitability, and credentialing processes.  The February 2014 report resulting from that review highlighted 37  recommendations to improve, among other things, the federal  government’s processes for granting security clearances. Some of the  recommendations address longstanding issues of the reform effort—such  as improving data sharing between local, state, and federal law  enforcement; and others are consistent with previous GAO  recommendations—such as reporting measures for the quality of  background investigations. The status of the implementation of these  recommendations is discussed later in this report.

In addition, in March 2014, OMB established Insider Threat and Security  Clearance Reform as a government-wide, cross-agency priority goal in  part to improve interagency coordination and implementation within the  area of personnel security clearances. Through this goal, the PAC and  executive-branch agencies are to work to improve oversight to ensure  that investigations and adjudications meet government-wide quality  standards. From the second quarter of fiscal year 2014 to the fourth  quarter of fiscal year 2016, the PAC has reported quarterly on, among  other things, the status of key milestones and the timeliness of initial  investigations and periodic reinvestigations for the executive branch as a  whole. As part of the cross-agency priority goal, the PAC identified  various sub goals on which to focus its work. The sub goals were  originally based on recommendations from the 120-day review and,  according to PAC Program Management Office officials, were later  updated to reflect the PAC’s strategic plans. The current sub goals are as  follows: trusted workforce, modern vetting, secure and mission-capable  IT, and continuous process improvement.

Further, in 2015, in response to the OPM data breach and at the request  of the President, the PAC conducted a second review—a 90-day  review—of the government’s suitability and security processes. In the  January 2016 summary of the review, the administration identified four  actions to create a more secure and effective federal background  investigations infrastructure. Specifically, it identified the need to: (1)  establish NBIB as the new federal entity to strengthen how the  government performed background investigations; (2) leverage IT  expertise at DOD for processing background investigations and protecting  against threats; (3) update governance authorities, roles, and  responsibilities; and (4) drive continuous performance improvement to  address evolving threats. The status of these actions is discussed later in  this report.

NBIB’s Use of Contract Investigators to Conduct Background Investigations

NBIB maintains an in-house federal investigator workforce, but according  to NBIB, as of July 2017, it relied on contract investigators to conduct  about 60 percent of the background investigations it provides to customer  agencies, such as DOD. In 2011, OPM awarded three indefinite  delivery/indefinite quantity contracts to three contractors to conduct  investigation fieldwork services—CACI Premier Technology, Inc.,  KeyPoint Government Solutions, Inc., and U.S. Investigations Services,  LLC (USIS). According to NBIB, USIS was responsible for about 65  percent of the contractor workload.

In September 2014, OPM decided not to exercise the option for the USIS  contract for fiscal year 2015. Eleven months prior, in October 2013, the  Department of Justice had announced that the government would  intervene in a civil suit against USIS, filed by a former employee under  the False Claims Act. The government alleged that the contractor had  circumvented contractually required quality reviews of completed  background investigations to increase the company’s revenues and  profits. In August 2015, the Department of Justice announced that USIS  and its parent company had agreed to a $30 million settlement in  exchange for a release of liability under the False Claims Act;  accordingly, the claims resolved by the settlement agreement were  allegations only, and there was no determination of liability. In June 2015,  OPM conducted a review of USIS cases and found that the investigations  for which USIS did not conduct the quality review were generally less  complex cases. In addition, these cases had a lower return rate from  OPM reviewers.

In September 2016, OPM awarded new indefinite delivery/indefinite  quantity contracts for investigation fieldwork services to four companies— CACI Premier Technology, Inc., KeyPoint Government Solutions, Inc.,  CSRA LLC, and Securitas Critical Infrastructure Services, Inc. The 2-year  base period for these contracts runs to the end of fiscal year 2018, and  OPM may exercise three 1-year option periods for each contract, with the  first beginning on October 1, 2018.

Executive Branch Agencies Have Made Progress Reforming the Security Clearance Process, but Long-Standing Key Initiatives Remain Incomplete

Executive branch agencies have made progress in reforming the  personnel security clearance process by, for example, issuing guidance,  such as Quality Assessment Standards to guide background  investigations, updated strategic documents to sustain the momentum of  the reform effort, and adjudicative guidelines to establish single, common  adjudicative criteria for security clearances. However, agencies face  challenges in implementing certain aspects of the 2012 Federal  Investigative Standards, including full implementation of continuous  evaluation, and the issuance of a reciprocity policy remains incomplete. In  addition, while the executive branch has taken steps toward establishing  performance measures for the quality of government-wide personnel  security clearance investigations, there is no milestone for their  completion.

The PAC Has Made Progress Reforming the Personnel Security Clearance Process

The PAC has made progress in reforming the personnel security  clearance process, as demonstrated through actions taken in response to  recommendations and milestones outlined in four key reform effort  documents: (1) the February 2014 120-day review; (2) the 2015 90-day  review; (3) the Insider Threat and Security Clearance Reform cross- agency priority goal quarterly progress updates; and (4) the PAC’s  strategic framework for fiscal years 2017 through 2021.  120-day review. According to PAC documentation, as of August 2017,  the PAC had implemented 73 percent of the 120-day review  recommendations. For example, in response to a recommendation from  the review, ODNI and OPM jointly issued Quality Assessment Standards  in January 2015, which establish federal guidelines for assessing the  quality of national security and suitability investigations. The  establishment of the standards is intended to facilitate the measurement  and continued improvement of investigative quality across the executive  branch. In response to another related recommendation, ODNI developed  the Quality Assessment Reporting Tool (QART), through which agencies  will report on the completeness of investigations. According to ODNI  officials, the QART was implemented in October 2016, and full  implementation is expected by the end of calendar year 2017.  90-day review. By January 2017, the PAC had taken steps to implement  all of the actions identified in the January 2016 summary of the 90-day  review. Specifically, Executive Order 13741, issued in September 2016,  established NBIB, within OPM, to replace FIS as the primary executive  branch service provider for background investigations. It also identified  DOD as the entity responsible for designing, developing, operating, and  securing IT systems that support NBIB’s background investigations.  Additionally, the Executive Order elevated the Under Secretary of  Defense for Intelligence to a full principal member of the PAC and  directed the PAC to review and update governance, authorities, roles,  and responsibilities. Subsequently, Executive Order 13764, issued in  January 2017, further clarified relevant authorities, roles, and  responsibilities, among other things. Further, according to PAC Program  Management Office officials, the PAC has taken steps to implement  continuous process improvements, such as developing a research and  innovation program through which it has undertaken a number of projects  aimed at improving the personnel security clearance process. In addition,  the PAC established a continuous performance improvement initiative to  develop mechanisms to improve the quality and efficiency of the end-to- end security, suitability, and credentialing vetting processes. As of July  2017, the PAC had identified seven categories of performance measures  for the end-to-end security, suitability, and credentialing processes—such  as timeliness, volume, and cost-efficiency—which it planned to implement  in a phased approach.

Cross-agency priority goal. From the second quarter of fiscal year 2014  through the fourth quarter of fiscal year 2016, the PAC reported quarterly  on the status of key initiatives, among other things, as part of the Insider  Threat and Security Clearance Reform cross-agency priority goal. For  each initiative, the PAC reported the milestone due date, the milestone  status—on track, complete, at risk, missed, or not started—and the  responsible agencies. As of the PAC’s last publicly reported quarterly  update, for the fourth quarter of fiscal year 2016, 8 of 33 initiatives were  listed as complete. According to PAC Program Management Office  officials, they have continued to track the status of these milestones  internally, and almost half of the initiatives—16 of 33—were listed as  complete as of the third quarter of fiscal year 2017. These initiatives  include the establishment of a Federal Background Investigations Liaison  Office within NBIB to oversee and resolve issues between federal, state,  and local law enforcement entities when collecting criminal history record  information for background investigations, and developing plans to  implement improved investigator and adjudicator training.

Strategic framework. The PAC has issued three documents that serve  as its updated strategic framework for the next 5 years. In July 2016, it  issued its Strategic Intent for Fiscal Years 2017 through 2021, which  identifies the overall vision, goals, and 5-year business direction to  achieve an entrusted workforce. In October 2016, it issued an updated  PAC Enterprise IT Strategy, which provides the technical direction to  provide mission-capable and secure security, suitability, and credentialing  IT systems. According to PAC Program Management Office officials, the  third document—the PAC Strategic Intent and Enterprise IT Strategy  Implementation Plan (Implementation Plan)—was distributed to executive  branch agencies in February 2017. The Implementation Plan documents  the key initiatives, targets, and measures for achieving the strategic  vision.

In March 2009, the Joint Reform Team issued an Enterprise IT Strategy,  but the PAC’s own February 2014 120-day review found that this strategy  stopped short of actions needed to develop enterprise-wide IT capabilities  to modernize, integrate, and automate agency capabilities and retire  legacy systems. It further stated that absent a strategy for integrated IT  capabilities, agencies created disparate tools designed only to meet their specific requirements and recommended the development and execution  of an enterprise reform IT strategy to ensure interoperability and improved  sharing of relevant information. We compared the PAC’s 2016 Enterprise  IT Strategy against leading practices for comprehensive and effective IT  strategies and found that it generally aligns with such practices. For  example, it contains results-oriented goals and strategies for agencies to  achieve desired results, and describes interdependencies within and  across projects.

In addition to these four key areas, PAC members noted additional  progress in reforming the personnel security clearance process.  Specifically, ODNI officials highlighted the development of seven Security  Executive Agent Directives, five of which have been issued as of August  2017, related to the use of polygraphs and social media in the  investigative process, among other things. For example, in December  2016, the Director of National Intelligence issued Security Executive  Agent Directive 4, National Security Adjudicative Guidelines. Effective in  June 2017, the directive is meant to establish the single, common  adjudicative criteria for all covered individuals who require initial or  continued eligibility for access to classified information or eligibility to hold  a sensitive position. DOD officials stated that having standardized  adjudicative criteria such as these guidelines constitutes an important  step in helping to ensure reciprocity. Additionally, a senior PAC Program  Management Office official noted that the PAC has designated eight  executive branch-wide IT shared service capabilities, such as the  electronic adjudication of certain background investigations and a new  electronic questionnaire for national security positions. According to this  official, the latter two shared services are expected to be rolled out in  2017, with the remaining six shared services being rolled out as they  become available.

Key Aspects of the 2012 Federal Investigative Standards and the Development of a Reciprocity Policy Remain Incomplete

While the PAC has reformed many parts of the personnel security  clearance process, implementing certain key aspects of the 2012 Federal  Investigative Standards, including changing the frequency of periodic  reinvestigations for certain clearance holders and establishing a  continuous evaluation program, remain incomplete. In addition, the  issuance of ODNI’s draft reciprocity policy has been delayed.  2012 Federal Investigative Standards. These standards outline criteria  for conducting background investigations to determine eligibility for a  security clearance and are intended to ensure cost-effective, timely, and  efficient protection of national interests and to facilitate reciprocal  recognition of the resulting investigations. In April 2015, we reported  that executive branch agencies with responsibilities for security  clearances and suitability determinations had twice approved updated  Federal Investigative Standards to replace the 1997 Standards, but that  progress in implementing the updated standards had been limited.  Specifically, as part of the reform effort that began after the passage of  IRTPA, the Director of National Intelligence and the Acting Director of  OPM, in their roles as Security and Suitability Executive Agents, signed  new Federal Investigative Standards on December 13, 2008, and stated  that the anticipated initial deployment of the standards was to begin in the  third quarter of fiscal year 2009. However, the 2008 Federal Investigative  Standards were not implemented, according to ODNI officials, because  key terms were not clearly defined and required further clarification.

In December 2012, the Director of National Intelligence and Director of  OPM approved updated Federal Investigative Standards. Among other  things, the 2012 Federal Investigative Standards identify five investigative  tiers. According to OPM Federal Investigations Notice 16-02, tier 3  investigations are required for eligibility for access to secret and  confidential information, or for noncritical sensitive positions, or “L”  access. OPM Federal Investigations Notice 16-07 indicates that tier 5  investigations are required for eligibility for access to top secret or  Sensitive Compartmented Information, or for critical sensitive or special  sensitive positions, or “Q” access. The updated standards also changed  the frequency of periodic reinvestigations for certain clearance holders.  The Federal Investigative Standards milestone for full operating capability  is the end of fiscal year 2017. Specific details on this topic were omitted  because the information is sensitive. See figure 1 for a timeline of efforts  made since 1997 to implement updated Federal Investigative Standards.

The 2012 standards include continuous evaluation as a new requirement  for certain clearance holders. This is a key executive branch initiative to  more frequently identify and assess security-relevant information between  periodic reinvestigations. Efforts to implement a continuous evaluation  program were included in the implementation documents from the prior  reform effort following approval of the 2008 Federal Investigative  Standards, including an operational milestone for implementing a  continuous evaluation program by the fourth quarter of fiscal year 2010.  ODNI has adjusted the milestones for implementing the program and  issuing a Security Executive Agent Directive for continuous evaluation  several times. For example, in April 2015, we reported that ODNI planned  to issue a continuous evaluation policy by September 2016 and to  implement a continuous evaluation capability for certain clearance  holders by December 2016. However, in November 2017 we found that  while ODNI has taken an initial step to implement continuous evaluation  in a phased approach across the executive branch, it has not yet issued a  Security Executive Agent Directive for continuous evaluation or  determined when the future phases of implementation will occur.  According to ODNI officials, as of August 2017, this directive was  undergoing interagency coordination and would be issued upon  completion of that process. As of August 2017, continuous evaluation had  not yet been fully implemented and ODNI had not set a new milestone for  when it would occur. In November 2017, we recommended, among other  things, that the Director of National Intelligence issue a continuous  evaluation directive and develop an implementation plan. ODNI generally  concurred with those recommendations. Figure 2 provides an overview  of the adjusted executive branch milestones for issuing a continuous  evaluation policy and implementing a continuous evaluation program,  including developing a technical capability.

Reciprocity policy. In 2004, IRTPA required that all security clearance  background investigations and determinations completed by an  authorized investigative agency or authorized adjudicative agency be  accepted by all agencies, subject to certain exceptions. As reported in a  cross-agency priority goal quarterly update in fiscal year 2016, the  milestone for ODNI to issue and promulgate an updated national security  reciprocity policy was September 2016. Security clearance reciprocity is  statutorily required by IRTPA, subject to certain exceptions, and it is  currently implemented by executive orders and guidance across  executive-branch agencies. To consolidate existing reciprocity guidance,  ODNI planned to issue a comprehensive, national-level security  clearance reciprocity policy intended to resolve challenges associated  with consistent, timely reciprocity processing across the executive branch.  However, the issuance date has been postponed multiple times—the  original milestone was September 2013—and as of July 2017, ODNI had  not yet issued a reciprocity policy or identified a new milestone for its  issuance. In July 2017, ODNI officials stated that a draft reciprocity policy  was pending entry into the formal interagency coordination process and  would be issued upon completion of that process. However, ODNI  officials were unable to provide an estimated issuance date because,  according to the officials, the length of the interagency coordination  process can vary. PAC Program Management Office officials noted that  issuance delays are due, in part, to the development of related personnel  security policies, including continuous evaluation, with which the  reciprocity policy must be aligned. Figure 3 shows milestones for the  issuance of the reciprocity policy.

In November 2010, we found that although executive-branch agency  officials stated that reciprocity is regularly granted, agencies did not have  complete records on the extent to which previously granted security  clearance investigations and adjudications are honored government- wide. Further, we found that agencies lacked a standard metric for  tracking reciprocity. We recommended that the Deputy Director for  Management, OMB, in the capacity as chair of the PAC, develop  comprehensive metrics to track when reciprocity is granted and report the  findings from the expanded tracking to Congress. OMB concurred with  our recommendation. However, in April 2015, we found that executive  branch agencies still did not consistently track when reciprocity is or is not  granted, nor did they have metrics in place to measure how often  reciprocity occurs. ODNI officials stated that they planned to develop  them by 2016. Although the Director of National Intelligence had  requested Intelligence Community elements take steps to begin capturing  reciprocity data in December 2014, such baseline data needed to support  measures for reciprocity were not being collected government-wide. We  recommended, in 2015, that the Director of National Intelligence require  the development of baseline data to support measures for reciprocity.

These data would help to identify and monitor changes in reciprocity  government-wide. ODNI did not state whether it concurred with the  recommendation, and as of November 2017, it had not been  implemented.

PAC officials stated that the greatest challenge of the reform effort is the  breadth and complexity of the issues it is trying to resolve, noting that the  reform effort involves nearly every executive branch agency. In addition,  these officials stated that sometimes agencies focus on short-term high- visibility issues instead of longer-term efforts, which are needed for  systemic change. ODNI officials also noted the complexities of reforming  the personnel security clearance process and working toward a whole-of- government solution. These officials noted that the reform efforts involve  coordination among a number of agencies across the executive branch,  which is both time and resource intensive. Both PAC Program  Management Office and ODNI officials also identified limited agency  resources and competing priorities—across executive branch agencies— as additional challenges.

The PAC has taken recent steps to help address some of these  challenges to continued progress, which could facilitate the completion of  the key initiatives discussed above. For example, in its Implementation  Plan the PAC has identified approximately 50 initiatives on which it will  focus its work over the next 5 fiscal years and has aligned those activities  with its four strategic categories of initiatives—trusted workforce, modern  vetting, secure and modern mission-capable IT, and continuous  performance improvement. However, according to ODNI officials, during  their review of a draft of the Implementation Plan, they raised concerns  about the number of initiatives and highlighted the need to provide greater  prioritization of the initiatives to help better focus efforts. For example,  some agencies are assigned as a primary owner of multiple initiatives.  Specific details of the number of initiatives to which agencies are  assigned were omitted because the information is sensitive.

PAC Program Management Officials stated that, to alleviate these  concerns, they subsequently identified two to four priority initiatives within  each of the four categories to help focus agency efforts. These officials  further stated that the PAC intends to update and reissue a condensed  version of its Implementation Plan annually so that it can make revisions  as issues that affect these priorities, such as reduced budgets, occur.  These 11 priority initiatives are identified in the PAC’s Implementation  Plan which, according to PAC Program Management Office officials, the  PAC finalized and circulated to executive branch agencies in February  2017. For example, establishing a continuous evaluation capability and  strengthening and aligning guidelines for the reciprocal recognition of  existing vetting decisions are listed among the PAC’s priority initiatives.  Given the limited agency resources cited by ODNI and PAC Program  Management Office officials and other key competing efforts, such as  improving investigation timeliness, the PAC’s prioritization of initiatives  could help to refocus efforts on the most critical areas of the reform effort,  and could provide agencies with a manageable number of initiatives on  which to prioritize their efforts.

Executive Branch Has Taken Steps to Establish Government-wide Performance Measures for the Quality of Background Investigations, but It Is Unclear When This Effort Will Be Completed

Our prior work on personnel security clearances has identified concerns  about the quality of background investigations and has highlighted the  need to build quality throughout the process for almost 20 years.  Additionally, we found that executive branch reports on the personnel  security clearance process contained limited information on quality in the  process. In May 2009, we recommended, among other things, that the  Deputy Director for Management of OMB, in the capacity as Chair of the  PAC, include in an IRTPA-required report to Congress quality metrics to  provide more transparency on personnel security clearances. OMB  concurred with that recommendation. However, the 2010 report to  Congress did not include quality metrics, and the IRTPA reporting  requirement expired in 2011. Appendix III provides an overview of our  work in this area and of executive branch efforts to establish government- wide performance measures for the quality of background investigations.

According to Executive Order 13467, the PAC is to establish annual goals  and progress metrics related to security and suitability processes and  continuous performance improvement. This focus on performance  measures is consistent with our body of work on using results-oriented  management tools to help achieve desired program outcomes—derived  from our work on how to effectively implement the Government  Performance and Results Act (GPRA) and the GPRA Modernization Act of 2010. This body of work provides agencies with a framework for  effectively managing program performance to achieve desired outcomes,  including establishing performance measures. In addition, Standards for  Internal Control in the Federal Government states that management  should establish and review performance measures and monitor internal  control systems. Further, we found in previous work that interim  milestones can be used to show progress toward implementing efforts or  to make adjustments when necessary. Developing and using specific  milestones and timelines to guide and gauge progress toward achieving  an agency’s desired results informs management of the rate of progress  toward achieving goals, and whether adjustments need to be made in  order to maintain progress within given timeframes.

As of July 2017, the executive branch had taken two of three steps to  establish government-wide measures for the quality of investigations.  First, as previously discussed, ODNI and OPM issued Quality  Assessment Standards for background investigations in January 2015 to  establish standard criteria for agencies to consistently evaluate complete  investigations. The standards were developed through an interagency  effort chaired by ODNI, OPM, and DOD. These standards define  complete investigations as those in which all required components were  obtained in full and any known issues—such as criminal activity—were  resolved per the standards. DOD officials highlighted issue resolution— having enough useful information about the circumstances surrounding a  given issue to make an adjudicative determination—as a persistent  challenge with background investigations for personnel security  clearances, and as key to determining investigation quality.

Second, ODNI developed the QART, through which agencies will be able  to report on the completeness of investigations, to include whether  adjudicators considered issues identified during an investigation to have  been sufficiently resolved. According to ODNI officials, they began to  implement the QART in October 2016, and full implementation is  expected by the end of calendar year 2017.

ODNI officials stated that they are collecting sufficient data from the  QART in order to develop measures for the quality of investigations. In  ODNI’s review of a draft of this report, officials stated that it is premature  to set a milestone for completing government-wide performance  measures for the quality of investigations and that ODNI will set such a  milestone when the QART data have been fully analyzed. Specific details  on this topic were omitted because the information is sensitive. Figure 4  provides an overview of the timeline for the executive branch’s three-step  process to develop measures for the quality of investigations.

Although ODNI has developed the QART, and ODNI and OPM have  issued the Quality Assessment Standards, there are still challenges to  resolve as measures for the quality of investigations are established. For  example, DOD officials stated that they do not intend for all of their  adjudicators to use the QART, and that they have not developed an  interface between their Rapid Assessment of Incomplete Security  Evaluations system and the QART. DOD officials also stated that they  will continue to use their tool until the QART is automated for use in a  new Defense Information System for Security. If DOD investigations— which represent the majority of the background investigations conducted  by NBIB—are not captured by the QART, it is unclear how ODNI will have  sufficient data to develop government-wide measures for the quality of  investigations. Further, NBIB officials noted that if their largest customer  is not utilizing the QART, they are not positioned to receive  comprehensive feedback.

In April 2015 we recommended, among other things, that the Director of  National Intelligence, in his capacity as Security Executive Agent,  develop, implement, and report to Congress on government-wide, results- oriented performance measures for security clearance background  investigation quality. ODNI did not state whether it concurred with that  recommendation, and the recommendation has not been implemented.  We continue to believe that measures for the quality of background  investigations are needed to provide decision-makers, including OMB and  Congress, with information on the quality of personnel security clearance  background investigations, and to help ensure the quality of  investigations. Without establishing a milestone for the completion of  government-wide performance measures for the quality of investigations,  their completion may be further delayed, and executive branch agencies  will not have a schedule against which they can track progress or to  which they are accountable.

Agencies Meeting Timeliness Objectives for Initial Clearances Decreased Since Fiscal Year 2012; a Government-wide Approach Has Not Been Developed to Improve Timeliness; and Reporting Has Been Limited The Number of Executive Branch Agencies Meeting Established Timeliness Objectives for Investigations and Adjudications for Initial Secret and Top Secret Clearances Decreased from Fiscal Years 2012 through 2016

Executive branch agencies have experienced challenges in meeting  timeliness objectives for investigation and adjudication of initial personnel  security clearances, and their reporting on timeliness has been limited.  The number of executive branch agencies meeting established timeliness  objectives for both initial secret and initial top secret clearances  decreased from fiscal year 2012 through fiscal year 2016. While ODNI  has taken steps to address timeliness challenges, it has not developed a  government-wide approach to help agencies improve the timeliness of  initial personnel security clearances. In addition, the executive branch’s  reporting on timeliness has been limited, which inhibits both transparency  and oversight of the personnel security clearance process.

Our analysis of timeliness data for specific executive branch agencies  showed that the percent of agencies meeting established investigation  and adjudication timeliness objectives for initial secret and top secret  personnel security clearances decreased from fiscal year 2012 through  2016. Specifically, in fiscal year 2012, 27 percent of the agencies for  which we obtained data met investigation and adjudication objectives for  at least three of four quarters for initial secret clearances, and 59 percent  met those objectives for initial top secret clearances. By fiscal year 2016,  that decreased to 2 percent and 10 percent, respectively. IRTPA  established an objective for each authorized adjudicative agency to make  a determination on at least 90 percent of all applications for a personnel  security clearance within an average of 60 days after the date of receipt  of the completed application by an authorized investigative agency—not  longer than 40 days to complete the investigative phase, and 20 days to  complete the adjudicative phase. In assessing timeliness under these  objectives, executive branch agencies exclude the slowest 10 percent  and report on the average of the remaining 90 percent (referred to as the  fastest 90 percent). In 2012, ODNI, in coordination with interagency  participation, modified the timeliness goals for certain background  investigations and established new timeliness goals.

As part of the Insider Threat and Security Clearance Reform cross- agency priority goal, from the second quarter of fiscal year 2014 until the  fourth quarter of fiscal year 2016, the PAC reported quarterly on the  average number of days to initiate, investigate, adjudicate, and complete  the end-to-end process for initial secret and initial top secret cases for the  executive branch as a whole. It reported this information as compared  with the IRTPA-established timeliness objectives for initial secret  clearances and ODNI’s revised timeliness objectives for initial top secret  clearances. For fiscal year 2016, the PAC reported that the government- wide average for executive branch agencies:

Did not meet the 40-day investigation objective for the fastest 90  percent of initial secret clearances for any quarter. The averages  ranged from 92 days to 135 days.

Did not meet ODNI’s revised investigation objective for the fastest 90  percent of initial top secret clearances for any quarter. The averages  ranged from 168 days to 208 days.

With regard to the timeliness of investigations, our analysis of timeliness  data reported by specific executive branch agencies showed that the  percent of agencies that met timeliness objectives decreased from fiscal  year 2012 through 2016. Specifically, our analysis showed:

While 27 percent of the agencies met the 40-day IRTPA-established  investigation objective for at least three of four quarters for the fastest  90 percent of initial secret cases in fiscal year 2012, only 2 percent  met the objective for at least three of four quarters in fiscal year  2016.

While 78 percent of the agencies met ODNI’s revised investigation  objective for at least three of four quarters for the fastest 90 percent of  initial top secret cases in fiscal year 2012, only 12 percent met the  objective for at least three of four quarters in fiscal year 2016.

Across the agencies we reviewed, the average number of days to  complete the investigation phase of the fastest 90 percent of initial top  secret cases for the fourth quarter of fiscal year 2016 ranged from 26  days to 459 days.

Furthermore, our analysis showed that, for the executive branch agencies  included in our review, the time required to investigate initial personnel  security clearances increased from fiscal year 2012 through fiscal year  2016, often exceeding the investigation phase objective established by  IRTPA. In addition, we found that both agencies with delegated  authority to conduct their own investigations and those that used FIS  (now NBIB) as their investigative service provider experienced challenges  in meeting established investigation timeliness objectives. However, the  only agencies that met investigation timeliness objectives for at least  three of four quarters of fiscal year 2016—for the fastest 90 percent of  initial secret and initial top secret clearances—have delegated authority to  conduct their own investigations.

The executive branch’s challenges in meeting investigation timeliness  objectives for initial personnel security clearances have contributed to a  significant backlog of background investigations at the primary entity  responsible for background investigations, NBIB. NBIB documentation  shows that its backlog of pending investigations increased from about  190,000 in August 2014 to more than 709,000 investigations, as of  September 2017. NBIB officials stated that more than 70 percent of the  bureau’s pending background investigations had been pending for longer  than the established timeliness objectives, as of June 2017. Additional  details about NBIB’s investigation backlog and actions the bureau is  taking to address it are discussed later in this report.

With regard to the timeliness of adjudications, our analysis showed:

While 51 percent of the agencies met the 20-day adjudication  objective for at least three of four quarters for the fastest 90 percent of  initial secret cases in fiscal year 2012, only 35 percent met the  objective for at least three of four quarters in fiscal year 2016.

While 65 percent of the agencies met the 20-day adjudication  objective for at least three of four quarters for the fastest 90 percent of  initial top secret cases in fiscal year 2012, only 43 percent met the  objective for at least three of four quarters in fiscal year 2016.

Across the executive branch agencies included in our review, the  average number of days to adjudicate the fastest 90 percent of initial  top secret cases for the fourth quarter of fiscal year 2016 ranged from  3 days to 175 days.

Table 1 shows the percent of agencies meeting the investigation and  adjudication objectives for the fastest 90 percent of initial secret and initial  top secret cases for at least three of four quarters from fiscal years 2012  through 2016.

In November 2017, we reported that the percent of executive branch  agencies meeting established timeliness goals for completing periodic  reinvestigations also decreased from fiscal years 2012 through 2016.  Appendix IV provides information on executive branch agency periodic  reinvestigations from fiscal years 2012 through 2016.

ODNI Has Taken Steps to Address Timeliness Challenges but Has Not Developed a Government- wide Approach to Help Improve Timeliness

ODNI has taken steps to address challenges in meeting established  timeliness objectives, such as revising the timeliness objective for top  secret investigations in 2012; however, it has not developed a  government-wide approach to help agencies improve the timeliness of  initial personnel security clearances. ODNI officials stated that several  significant events contributed to agency challenges in meeting timeliness  objectives over the past 5 fiscal years, including a government shutdown,  the 2015 OPM data breach, a loss of OPM contractor support, and OPM’s  review of the security of its IT systems, which resulted in the temporary  suspension of the web-based platform used to complete and submit  background investigation forms. In addition, executive branch agencies  noted the increased investigative requirements stemming from the 2012  Federal Investigative Standards as a further challenge to meeting  established timeliness objectives in the future.

Standards for Internal Control in the Federal Government states that  management evaluates and, if necessary, revises defined objectives so  that they are consistent with requirements and expectations. In addition,  the standards state that management should use quality information to  achieve the entity’s objectives, including relevant data from internal and  external sources.

As previously discussed, ODNI, in coordination with interagency  participation, modified the timeliness goals for certain background  investigations and established new timeliness goals. Since then, meeting  timeliness objectives has become even more challenging due, for  example, to updated investigation standards.

However, since 2012, ODNI has not revisited the investigation or  adjudication timeliness objectives for secret and top secret clearances.  Specifically, ODNI has not conducted an evidence-based review, using  relevant data, to ensure that these objectives are appropriate, given  changes to the investigative requirements and other stated challenges. In  addition, while ODNI and interagency partners modified certain timeliness  goals in 2012, the number of executive branch agencies able to  consistently meet the revised objectives also decreased over the past 5  fiscal years. Without conducting an evidence-based review of the  investigation and adjudication timeliness objectives for both secret and  top secret clearances to ensure that they are appropriate, agencies may  experience further timeliness challenges and delays in determining  eligibility.

According to ODNI officials, they are aware of each agency that does not  meet timeliness objectives and, in the capacity as Security Executive  Agent, the Director of National Intelligence has taken steps to help these  agencies improve their timeliness. Specifically, ODNI officials stated that  the Director of National Intelligence issues annual agency performance  letters to heads of agencies when security clearance timeliness objectives  are not met. In the letters, the Director of National Intelligence requests  that the agency submit an action plan, within 60 days of the date of the  letter, identifying the factors that prevented the agency from meeting  established timeliness objectives and the actions the agency will take to  remedy those impediments. Officials stated that since the letter comes  directly from the Director, this helps to attract the maximum amount of  attention possible.

In addition to establishing the current timeliness objectives for initial  security clearances, IRTPA also established a 5-year timeframe and an  interim milestone for the executive branch to implement those objectives.  Specifically, the act required the development of a plan to reduce the  length of the personnel security clearance process, including the IRTPA- established timeliness objectives described above. The plan was to be  developed in consultation with appropriate committees of Congress and  each authorized adjudicative agency, and to take effect 5 years after the  date of enactment. Beginning no later than 2 years after the enactment  of IRTPA and ending on the date the plan took effect, authorized  adjudicative agencies were to make a determination on at least 80  percent of all applications within an average of 120 days after receipt by  an authorized investigative agency—not longer than 90 days to  investigate and 30 days to adjudicate. In November 2005, the executive  branch submitted a plan to improve the timeliness of personnel security  clearance processes government-wide. The Joint Reform Team  submitted its first reform plan to the President on April 30, 2008, which  proposed a new process for determining clearance eligibility.

Standards for Internal Control in the Federal Government establishes that  management should define objectives clearly to enable the identification  of risks and define risk tolerances. In our prior work on interagency  collaboration, we found that overarching plans can help agencies  overcome differences in missions, cultures, and ways of doing business,  and help agencies better align their activities, processes, and resources  to collaborate effectively to accomplish a commonly defined outcome.  Additionally, to help sustain and enhance collaboration among federal  agencies, we found that agencies that create a means to monitor,  evaluate, and report the results of collaborative efforts can better identify  areas for improvement. Further, we have found in previous work,  including our prior work on personnel security clearances, that interim  milestones can be used to show progress toward implementing efforts or  to make adjustments when necessary. Developing and using specific  milestones to guide and gauge progress toward achieving an agency’s  desired results informs management of the rate of progress toward  achieving goals, and whether adjustments need to be made in order to  maintain progress within given time frames.

While ODNI requests individual corrective action plans from agencies not  meeting security clearance timeliness objectives, the executive branch  has not developed a government-wide plan, with goals and interim  milestones, to meet established timeliness objectives for initial security  clearances that takes into consideration increased investigative  requirements and other stated challenges. A coordinated approach, in  addition to the ODNI-requested agency-specific plans, could help to  improve timeliness, given that: (1) both agencies that use NBIB as their  investigative service provider and those that have delegated authority to  conduct their own investigations have experienced challenges in meeting  established investigation and adjudication timeliness objectives over the  past 5 fiscal years; and (2) timeliness challenges include government- wide challenges, such as the increased requirements stemming from the  2012 Federal Investigative Standards and past challenges in relation to  OPM contractor support, as discussed above, and not just agency- specific challenges, such as staffing shortfalls. While the individual  agency action plans represent a positive step toward helping to improve  timeliness, agencies across the executive branch continue to experience  timeliness challenges. A government-wide plan would better position  ODNI to identify and address any systemic issues. Without a government- wide plan, including goals and interim milestones, for achieving timeliness  objectives for initial secret and top secret investigations and  adjudications—similar to the plan previously required by IRTPA—there  could be continued delays in determining individuals’ eligibility for access  to classified information. Ultimately, such delays may leave agencies  unable to fill critical positions that require a security clearance.

Current Timeliness Reporting Provides Limited Transparency and Oversight of the Reform Effort

Since 2011, the executive branch’s reporting on the timeliness of  personnel security clearances has provided limited transparency and  oversight of the overall reform effort. Specifically, IRTPA required the  executive branch to submit an annual report, through 2011, to the  appropriate congressional committees on the progress made toward  meeting the act’s requirements, including timeliness data and a  discussion of any impediments to the smooth and timely functioning of its  requirements. With respect to timeliness data, the act required that those  reports include the periods of time required by the authorized  investigative agencies and authorized adjudicative agencies for  conducting investigations, adjudicating cases, and granting clearances,  from date of submission to ultimate disposition and notification to the  subject and the subject’s employer.

In response to this requirement, the executive branch provided a series of  reports from 2006 through 2011 on the timeliness of executive branch  agencies’ initial investigations and periodic reinvestigations. For example,  ODNI’s IRTPA Title III Annual Report for 2010 specified the average  number of days by quarter it took for selected individual agencies to  initiate, investigate, adjudicate, and complete the end-to-end process for  the fastest 90 percent of security clearances. The report also included  average timeliness data for the executive branch as a whole.

However, since the IRTPA requirement ended in 2011, executive branch  reporting has been limited. For example, as previously discussed, the  PAC did not begin its quarterly reporting on the timeliness of executive  branch agencies’ personnel security clearances until the second quarter  of fiscal year 2014 through the Insider Threat and Security Clearance  Reform cross-agency priority goal. In addition, while these reports include  the timeliness of both initial investigations and periodic reinvestigations,  they provide the average timeliness of the executive branch as a whole  and not the timeliness of individual executive branch agencies—as was  provided under the prior IRTPA reporting—which makes it difficult to  identify specific agencies that may be experiencing challenges.

Additionally, the Intelligence Authorization Act for Fiscal Year 2010  requires the President to submit an annual report on security clearance  determinations to Congress. Among other things, the report is to include,  for the preceding fiscal year, the number of federal and contractor  employees who held a security clearance at each level and the number of  employees who were approved for a security clearance at each level, as  well as in-depth security clearance determination timeliness information  for each element of the intelligence community. However, the annual  reports that ODNI provides to the congressional intelligence committees  in response to this requirement include only limited data as compared  with reports that were completed in response to IRTPA. Specifically, the  Intelligence Authorization Act for Fiscal Year 2010 requires information on  the total amount of time for the longest and shortest determinations, and  the age of pending investigations, not average timeliness. The reports are  also limited in that they capture data for only a portion of the intelligence community. Specifically, ODNI’s 2015 Annual Report on Security  Clearance Determinations states that the report includes information for 7  of 15 elements of the intelligence community and that the other 8  elements reported that collecting the information would be a manual,  resource-intensive process that was not viable due primarily to  technology restrictions.

Standards for Internal Control in the Federal Government states that  management should externally communicate the necessary quality  information to achieve the entity’s objectives through reporting lines so  that external parties can help the entity achieve its objectives and address  related risks. In addition, our high-risk criteria for monitoring and  demonstrated progress call for agencies to report on program progress  and related risks as well as show that issues are being effectively  managed.

However, since the IRTPA annual reporting requirement ended in 2011,  the executive branch has provided limited reporting on the timeliness of  individual agencies’ initial investigations or periodic reinvestigations for  personnel security clearances. In addition, while the PAC had regularly  reported publicly on timeliness for the executive branch as a whole on a  quarterly basis, it has not provided a public quarterly status update since  the fourth quarter of fiscal year 2016. According to performance.gov, the  website through which the PAC distributes its quarterly updates, the  content—including the PAC’s quarterly updates—is undergoing an  overhaul as agencies develop updated goals and objectives for release in  February 2018 with the President’s next budget submission to  Congress. It is unclear whether the new administration will continue to  designate personnel security clearance reform as a cross-agency priority  goal. PAC Program Management Office officials stated that they continue  to track and report this information internally within the executive branch.  These officials stated that they were uncertain as to whether  performance.gov would remain a vehicle by which they would report on  the status of the reform effort, including executive branch-wide timeliness.  However, the officials also stated that it is important for the information to  be reported in order to maintain transparency and the momentum of the  reform effort.

Without transparent reporting by the executive branch on investigation  and adjudication timeliness for both initial investigations and periodic  reinvestigations, Congress will not be able to effectively execute its  oversight role and monitor individual executive branch agency progress in  meeting timeliness objectives. In addition, the absence of comprehensive  reporting on personnel security clearance timeliness limits the ability of  congressional decision makers to thoroughly evaluate and precisely  identify where and why delays exist within the process, as well as to  identify corrections as necessary. In addition, should the PAC’s quarterly  progress updates be suspended indefinitely, Congress and the public will  have limited transparency into the status of key reform effort initiatives,  which may delay the timely identification of problems, and ultimately  disrupt the momentum of the reform effort as a whole.

NBIB Has Taken Steps to Improve the Background Investigation Process but Faces Operational Challenges in Addressing the Investigation Backlog and Workforce Planning

The transition from FIS to NBIB has involved organizational changes  intended to improve the background investigation process, but the bureau  faces operational challenges in addressing the investigation backlog and  associated workforce planning. NBIB’s organizational changes include  the creation of some new departments, and DOD is now responsible for  designing, developing, and maintaining a new IT system for the bureau,  but must contend with risks posed by vulnerabilities in OPM’s legacy IT  systems, which NBIB still utilizes. As NBIB transitions, it has taken steps  to improve its oversight of background investigations contracts and  measure the completeness of background investigations; however, it  faces operational challenges in developing a plan to reduce the size of  the investigation backlog to a manageable level and in ensuring that its  overall workforce is sized and structured to meet its mission.

Establishment of NBIB Involved Organizational Changes, the Designation of Oversight Roles, and Transfer of IT Responsibilities to DOD

The transition from FIS to NBIB involved some organizational changes,  such as the creation of new departments designed to enhance  information sharing and contract oversight, among other things. NBIB  also made changes to existing departments, such as enhancing its  counterintelligence division to foster greater collaboration with the  intelligence community. In addition, NBIB is subject to oversight from  multiple entities, such as OPM, ODNI, and the PAC. Further, DOD is now  responsible for designing, developing, and maintaining a new IT system  for NBIB that can provide increased security. However, vulnerabilities in  OPM’s legacy systems pose risks to the security of the new system and  could delay its implementation.

Transition from FIS to NBIB Involved Changes to Organizational Structure

NBIB was established to replace FIS, and the transition has involved  changes to the organizational structure. In response to the results of 90- day review that were announced in January 2016, in September 2016,  Executive Order 13741 amended Executive Order 13467 to establish the  roles and responsibilities of NBIB within OPM and made the Director of  NBIB a member of the PAC. According to Executive Order 13467, as  amended, NBIB is to serve as the primary executive branch service provider for background investigations for, among other things, eligibility  for access to classified information; eligibility to hold a sensitive position;  suitability or fitness for government employment; and authorization to be  issued a federal credential for logical and physical access to federally  controlled facilities or information systems. Among other things, the  bureau is to also provide effective, efficient, and secure personnel  background investigations for the federal government.

When announcing the establishment of NBIB, in January 2016, the  administration reported the intention to create a dedicated transition team  headquartered in Washington, D.C., to develop and implement a  transition plan to: (1) stand up the bureau; (2) ensure that the transition  timeline fully aligns with business needs; (3) transition the management of  FIS IT systems to DOD; (4) migrate the existing mission, functions,  personnel, and support structure of FIS to NBIB; and (5) provide  continuity of service to customer agencies during the transition. According  to its charter, the transition team was composed of current OPM  employees, and federal employees detailed or assigned to OPM or DOD  from other executive branch agencies and departments. NBIB officials  noted that employees from across the executive branch with relevant  experience and qualifications were recruited to ensure that stakeholder  agencies’ equities were represented, and that the transition team leader  was recruited from outside of OPM and reported directly to the OPM  Director throughout the transition process.

OPM reported that NBIB became operational on October 1, 2016, but that  the complete transition will take some time. For example, the transition  plan specifies activities throughout fiscal year 2017 and into fiscal year  2018 to implement the transition from FIS to NBIB. NBIB officials said  they expect that the bureau will have migrated to the new organizational  structure substantially by mid-2018. The transition also involved some  organizational changes intended to streamline certain business  processes or more effectively manage background investigations as the  organization has continued to evolve. NBIB officials stated that the  transition team established the organizational structure by assessing essential FIS functions in coordination with key community  stakeholders—including new and external customers—through the PAC  as well as FIS personnel. The officials said that the transition team then  linked similar functions and interdependencies to establish each of the  offices. Additionally, NBIB officials stated that the 2015 90-day review  helped to determine the organizational structure because it identified a  need for a business process reengineering analysis.

Through its establishment, NBIB absorbed FIS and assumed its mission.  NBIB’s organizational structure has several changes from the structure of  FIS, to include the establishment of the following four new departments:  1.  Federal Investigative Records Enterprise. The functions of this  department include a new law enforcement and records outreach  group to improve outreach and more effectively collect information  with state and local law enforcement offices.  2.  Policy, Strategy and Business Transformation. The functions of  this department include expanding existing performance reporting to  incorporate metrics regarding effectiveness; and researching and  identifying systemic issues in workload, processes, and products to  determine where process improvement could be achieved.  3.  Contracting and Business Solutions. The functions of this  department include enhancing and consolidating administration of  NBIB contracts to provide consistent oversight.  4.  Information Technology Management Office. The functions of this  department include supporting the delivery and enhancement of  quality IT systems to NBIB in a timely and effective manner, gathering  and communicating needs and requirements for new applications, and  coordinating implementation of changes to current systems.

In addition to the creation of these new departments, NBIB also made  changes to several other departments from FIS. For example, according  to NBIB documents, the Field Operations department added a “Field  Contracts” division that is designed to oversee and monitor the contractor  workforce performing background investigations, to ensure quality and  timely products. This department also enhanced its counterintelligence  division to focus on counterintelligence and insider threat support and to  foster greater collaboration with the intelligence community. Further, NBIB  created a new financial office to oversee budgeting, pricing and funding  models, financial reporting, data accuracy, and internal controls  monitoring. Moreover, NBIB created a new Integrity Assurance,  Compliance, and Inspection division by merging the FIS Integrity  Assurance and Inspection divisions to streamline similar functions and  improve processes and efficiencies.

Executive Order 13741 provided some guidelines governing the structure  and location of NBIB. Specifically, it required that NBIB be headquartered  in or near Washington, D.C., and that NBIB have dedicated resources,  including but not limited to a senior privacy official. NBIB’s headquarters  is located in Washington, D.C., but according to NBIB officials, as of July  2017, only 48—including both occupied and vacant positions—of NBIB’s  3,260 positions, or about 1.5 percent, were located in Washington, D.C.  In addition, although the position of the senior privacy official has been  established in the NBIB organization chart, according to NBIB officials,  this position had not been filled as of July 2017. NBIB officials explained  that they work closely with OPM’s senior privacy officer, and so they  decided to prioritize filling other leadership positions within NBIB.

NBIB Subject to Oversight from OPM, ODNI, and the PAC

NBIB is subject to oversight from multiple entities, such as OPM, ODNI,  and the PAC. Executive Order 13741 provided that the bureau would be  established within OPM. NBIB officials stated that the bureau is part of  OPM and is governed in a manner consistent with its other operational  components. They also said that although the structure of NBIB is  different from that of FIS, its general relationship with OPM and its  leadership reporting chain are similar. Specifically, comparing the  organizational charts of FIS and NBIB, FIS was led by an Associate  Director who reported to the Director of OPM, while NBIB is led by a  Director who reports to the Director of OPM.

According to NBIB, the OPM Director has delegated certain authorities to  NBIB; additionally, the OPM Senior Procurement Executive delegated to  NBIB certain administrative and acquisition authorities. NBIB officials said that this makes its structure more flexible. NBIB officials said that where  support is provided from other OPM offices—such as communications,  legislative affairs, legal, procurement, security, facilities, and the office of  the Chief Information Officer—there is continual dialogue between that  office’s leadership and the staff directly supporting the bureau. The  officials also noted a variety of regular meetings, such as a weekly  meeting between the Acting Director of OPM and the NBIB Director and  Chief of Staff, attendance at daily OPM senior staff meetings, and  briefings every other month with the OPM Inspector General, among  others.

In addition, as previously discussed, as the Security Executive Agent, the  Director of National Intelligence is responsible for various matters related  to security clearance investigation oversight, programs, policies, and  processes. Executive Order 13467, as amended by Executive Orders  13741 and 13764, provides that NBIB, through the Director of OPM, is  subject to the oversight of the Security Executive Agent with respect to  the conduct of investigations for eligibility for access to classified  information or to hold a sensitive position. Similarly, Executive Order  13467, as amended, provides that NBIB is responsible for conducting  background investigations in accordance with policies, procedures,  standards, and requirements established by the Security Executive Agent  and Suitability Executive Agent. In February 2017, the Acting Director  of OPM testified that the bureau has been working closely with ODNI to  identify policy and process changes to address the investigation  backlog. NBIB officials stated that the bureau and ODNI are active  partners, and that the bureau participates in many of ODNI’s working  groups in the development of policies or processes related to personnel  security clearances. In addition, the officials said that the bureau reports  timeliness, quality, and performance metrics to ODNI on no less than a quarterly basis, and that its personnel collaborate with ODNI on reviews  of processes, such as those related to social media, continuous  evaluation, insider threat, and counterintelligence. ODNI officials told us  that in its oversight role of NBIB, ODNI collects quarterly timeliness data  and requests that agencies using NBIB as their investigative service  provider enter the investigations into the QART to assess the quality of  the investigations.

Further, Executive Order 13467, as amended by Executive Order 13741,  describes an oversight relationship between the PAC and NBIB. It  requires the PAC to hold NBIB accountable for the fulfillment of the  bureau’s responsibilities set out in the Executive Order. It further provides  that NBIB is to provide the PAC with information, to the extent permitted  by law, on matters of performance, timeliness, capacity, IT modernization,  continuous performance improvement, and other relevant aspects of  NBIB operations. PAC Program Management Office officials told us  that they worked with NBIB during the transition from FIS and answered a  lot of questions, and have helped to fill in staffing and organization holes  that were identified by the transition team.

DOD Is Building and Managing a New Security Clearance IT System for NBIB, but Security Concerns May Delay Planned Milestones for the New System

Executive Order 13467, as amended, assigns the Secretary of Defense  the role of developing and securely operating IT systems that support all  background investigation processes conducted by NBIB. According to  officials from the Office of the DOD Chief Information Officer (CIO), NBIS  will be built to NBIB specifications, and OPM will remain the owner of the  data and processes. In testimony before the House Oversight and  Government Reform Committee in February 2017, the DOD CIO  estimated that NBIS would have several “prototype” capabilities by the  end of fiscal year 2017, and an initial capability covering the full  investigative process sometime in the fourth quarter of 2018. According  to DOD officials, full capability for NBIS is scheduled for some time in  2019. However, a NBIB official noted the existence of challenges regarding the IT infrastructure and stated that it is more realistic for NBIS  to be fully operational in 2020.

According to DOD CIO officials, unexpected complications have arisen  since beginning development of NBIS. Specifically, these officials stated  that they have discovered that NBIS may require many more inter- connections to OPM legacy systems than originally planned. According to  these officials, NBIB will continue to rely on OPM legacy systems for  investigations of any complexity until NBIS becomes fully operational.

Further, according to DOD CIO officials, when the executive branch  begins to use NBIS, complex background investigations would begin in  NBIS’s electronic application, but would then need to pass through or  draw data from multiple OPM legacy systems before returning to NBIS for  adjudication. According to DOD CIO officials, since OPM has 43 back- office functions fed by various systems that are often inter-related, a  simple one-to-one system swap of NBIS for an OPM legacy system is not  feasible. DOD CIO officials stated that the project management team  building NBIS is currently working to fully understand how OPM’s various  back-office functions are tied together, and also evaluating the cyber- security risks inherent in connecting to OPM’s legacy systems. DOD CIO  officials explained that this connection, as well as logistical challenges  associated with data migration from the legacy systems to NBIS, raises  concerns about risks to NBIS. Until these risks are properly evaluated,  any connection to the legacy systems could present vulnerabilities,  according to DOD CIO officials. OPM officials disagreed, stating that  OPM and DOD already have IT connection points with the OPM legacy  systems, and that the security of OPM’s systems and data continues to  be an OPM priority.

Securing the legacy systems will be a joint effort by DOD and OPM,  according to an October 2016 Memorandum of Agreement between the  two agencies regarding the roles, responsibilities, and expectations of  each party throughout the entire lifecycle of OPM’s use of DOD’s IT  systems in support of the background investigation process. Under the  agreement, OPM will retain ownership and responsibility for the operation  and performance of all system authorization activities for OPM legacy  systems throughout their lifecycle. The agreement provides that OPM will  maintain security documentation and information and interconnection  exchange agreements, own control selection and security role  assignment processes, and perform risk executive functions. The  memorandum further states that the security of the legacy OPM IT  environment will be a joint effort between OPM and DOD, with DOD  assisting in a comprehensive security assessment of all OPM legacy IT  systems and related infrastructure on a reimbursable basis. According to  DOD CIO and NBIB officials, there is close coordination on a technical  level between the two agencies on securing the OPM legacy systems  used by NBIB. The officials said that weekly coordination meetings are  held between the two agencies, and that DOD has embedded staff at  OPM who are under the direct supervision of the OPM CIO.

Both GAO and the OPM Inspector General have raised concerns on  multiple occasions about various aspects of IT security at OPM, including  OPM legacy systems used by NBIB. For example, in August 2017, we  reported on OPM’s progress in implementing 19 recommendations made  by the United States Computer Emergency Readiness Team to bolster its  information security practices and controls in the wake of the 2015  breaches. We found that, as of May 2017, OPM had fully implemented  11 of the recommendations. For the remaining 8 recommendations,  actions for 4 were still in progress, and for the other 4, OPM indicated it  had completed actions to address them, but we noted further  improvements were needed.

We further reported that since the 2015 data breaches, which included a  compromise of OPM’s systems and files related to background  investigations for 21.5 million individuals, OPM has made progress in  improving its security to prevent, mitigate, and respond to data breaches  involving sensitive personal records and background investigations  information. However, we also found that OPM did not effectively  monitor actions taken to remediate identified weaknesses. OMB requires  agencies to create a Plan of Action and Milestones to track efforts to  remediate identified weaknesses, such as those leading to the 19  recommendations made by the United States Computer Emergency  Readiness Team. In addition, OPM’s policy requires that scheduled  completion dates be included in the plan. The policy also requires a  system’s Information System Security Officer to develop a weakness  closure package containing evidence of how an open Plan of Action and  Milestones has been remediated before the issue, or recommendation in  this case, can be closed. Although OPM has a Plan of Action and  Milestones to address the 19 recommendations, we found that it had not  validated actions taken in a timely manner or updated completion dates in  the plan. Because the United States Computer Emergency Readiness  Team recommendations are intended to improve the agency’s security  posture, we recommended that more timely validation of the effectiveness  of the actions taken is warranted. Until closure packages are created and  the evidence of such actions is validated, OPM has limited assurance that  the actions taken have effectively mitigated vulnerabilities that can  expose its systems to cybersecurity incidents.

Additionally, in May 2016 we reported on the implementation of OPM’s  information security program and the security of selected high-impact  systems. We found that OPM, one of four agencies reviewed, had  implemented numerous controls to protect selected systems, but that  access controls had not always been implemented effectively. We  reported that weaknesses also existed in patching known software  vulnerabilities and planning for contingencies, and that an underlying  reason for these weaknesses was that OPM had not fully implemented  key elements of its information security program. We recommended that  OPM fully implement key elements of its program, including addressing  shortcomings related to its security plans, training, and system testing.  According to OPM officials, the agency is taking actions to address these  recommendations. In August 2016, we issued a restricted version of our  May 2016 report that identified vulnerabilities specific to each of the two  systems we reviewed and made recommendations to resolve access  control weaknesses in those systems. In December 2016, OPM indicated its concurrence with the recommendations and provided  timeframes for implementing them. OPM officials expressed concern that  the information from our 2016 reports was now dated, stating that it no  longer reflects the current security posture at OPM, and said that they  had taken actions to address these recommendations. However, all of the  recommendations directed to OPM from the two reports remained open  as of November 2017. We had not received any documentation regarding  these actions as of November 2017 and thus could not validate the extent  that any of these recommendations have been addressed.

OPM’s Office of the Inspector General has also raised related concerns,  most recently in its October 2017 report on OPM’s security program and  practices. Overall, the OPM Inspector General found that OPM’s  cybersecurity maturity level was measured at a level 2, “Defined”,  meaning that its policies, procedures and strategy were formalized and  documented but were not consistently implemented. According to the  report, OPM has made improvements in its security assessment and  authorization program, and its previous material weakness related to  authorizations is now considered a significant deficiency for fiscal year  2017. The report noted that there are still widespread issues related to  system authorizations, primarily related to documentation inconsistencies  and incomplete or inadequate testing of the systems’ security controls. In  addition, the report identified a significant deficiency in OPM’s information  security management structure, and found that OPM was not making  substantial progress in implementing prior Inspector General  recommendations. The report noted that OPM had only closed 34 percent  of its findings issued in the past 2 years.

In addition to these IT security concerns, funding uncertainties have also  complicated the development of NBIS. The President’s fiscal year 2017  budget included $95 million for the development of the system; however,  according to DOD CIO officials, of the $95 million that was appropriated,  DOD had provided only $31 million for NBIS as of June 2017.  According to DOD CIO officials, the fiscal year 2017 continuing resolution  had complicated decisions about the funding and disbursement schedule  with consequences for planning and the apportioning of resources. A draft  funding profile covering fiscal years 2017-2023 estimates funding needs  of $175.7 million for research, development, test and evaluation, and  $709.4 million for operation and maintenance, over this 7-year period, for  a total of $885.2 million.

NBIB Has Taken Steps to Improve Operations but Faces Workforce Challenges

As NBIB transitions, it has taken steps to improve its operations but  continues to face workforce challenges that may hinder its ability to  address the backlog of investigation cases and strengthen the  background investigation process. The bureau has taken positive steps to  improve its oversight of background investigation contracts, including  changing contract oversight processes and measuring the completeness  of background investigations. However, it faces operational challenges in  developing a plan to reduce the size of the investigation backlog and in  ensuring that its overall workforce is sized and structured to address it.

OPM Has Taken Steps to Improve Oversight of Background Investigation Contracts

Contractors are responsible for about 60 percent of NBIB’s background  investigation fieldwork, according to NBIB officials. Since 2014, OPM has  taken steps to improve its oversight of contracts. NBIB officials stated that  changes were made in response to OPM Inspector General  recommendations, and that some others were made in response to  lessons learned after issues that led to the loss of OPM’s largest fieldwork  contractor in 2014. These changes included (1) having federal employees  review all background investigation reports, (2) increasing the number of  individuals responsible for monitoring contractors’ compliance with  contractually established requirements, and (3) establishing a contracting  activity within NBIB.

Since February 2014, federal employees have reviewed 100 percent of  background investigation reports produced by contractors. In contrast,  prior to February 2014, federal employees at FIS or a support contractor  would review a subset of all of the investigations before releasing them to  the respective customer agencies for adjudication. As currently  structured, NBIB officials stated that there are now about 350 federal  employees within NBIB’s Quality Oversight department who conduct  these reviews for both contractor- and federal investigator-conducted  cases to determine whether an investigation meets investigative  standards for completeness before being released to the customer  agency for adjudication.

Using an internal database, OPM reviewers identify what, if any, elements  of the investigative reports are incomplete and do not meet standards,  and they return cases to the investigators for rework as necessary. When  OPM reviewers determine that a case meets investigative standards, they  close the case and submit it to an adjudicator. Contractors are evaluated  for quality performance based on the number of times a case is returned  by OPM reviewers for rework as a percentage of the total number of  cases completed. According to NBIB data from its internal quality  database, the percentage of cases conducted by contractors requiring  rework decreased between the last quarters of fiscal years 2014 and  2016 from about 6 percent to 3.2 percent.

According to NBIB officials, in 2014, OPM established an independent  inspections branch to help the agency’s contracting officer’s  representatives (CORs) oversee the background investigation fieldwork  contracts. CORs, who are designated in writing by contracting officers,  assist in the technical monitoring or administration of a contract. Under  NBIB’s current background investigation fieldwork contracts, the COR  provides technical direction and control during contractor performance,  monitors contract progress, and determines for payment approval  purposes whether performance is acceptable with respect to content,  quality of services and materials, cost, and timeliness. NBIB officials  stated that prior to the establishment of the inspections branch, the CORs  were responsible for monitoring all aspects of contract compliance as well  as a range of administrative duties, such as tracking performance data, IT  support, and billing. Under the current NBIB structure, 16 inspectors in  the Integrity Assurance, Compliance and Inspections division focus on  contract oversight, according to NBIB officials. In addition to the  inspectors, the officials said that there are 17 CORs—one in the Integrity  Assurance, Compliance and Inspections division and 16 in the Field  Operations department.

Additionally, according to NBIB officials, FIS, NBIB’s predecessor, did not  have its own contracting division, and instead relied on OPM’s centralized  Office of Procurement Operations for contracting support. NBIB’s new  organizational structure includes a Contracting and Business Solutions  department. According to NBIB officials, they filled the new Head of  Contracting Activity position in January 2017. NBIB officials stated that  OPM established this new position and department in an effort to  strengthen the bureau’s contracting function by creating dedicated  positions more narrowly focused on overseeing the contracting function  for background investigations and support services.

NBIB Has Taken Steps to Measure Completeness of Background Investigations

NBIB has developed quality assurance processes and tools to measure  the completeness of its investigations. Specifically, NBIB has developed  an internal quality database through which federal case reviewers can  determine the completeness of investigations, in accordance with  investigative standards, that are being produced by both its federal and  contract investigators, and can rate cases as either “meets standards” or  “below standards.” Cases that are marked as “below standards” are  returned to the contractor for rework prior to being finalized and sent to  the customer for adjudication. NBIB then monitors, through its Key  Performance Indicators, the percentage of investigations that are returned  by customer agencies and that NBIB agrees require additional work. Our  prior work found that relying on agencies to provide information on  investigation quality, by itself, may not provide an accurate reflection of  the quality of background investigations. We have reported in the past  that officials from several agencies have stated that to avoid further costs  or delays, agencies often choose to perform additional steps internally to  obtain missing information, clarify or explain issues identified in  investigative reports, or gather evidence for issue resolution or  mitigation. As recently as July 2017, DOD officials stated that issue  resolution was still a concern for them. However, NBIB officials stated that  they conduct background investigations in accordance with the Federal  Investigative Standards, and that while adjudicators may want more or  different details, these are considered outside the scope of background  investigations, but can be provided on a case-by-case basis.

NBIB Leadership Has Not Developed a Plan to Reduce the Investigation Backlog

NBIB leadership has not developed a plan to reduce the size of the  investigation backlog to a manageable level. NBIB’s Key Performance  Indicators report states that a “healthy” inventory of work, representing  approximately 6 weeks of work and allowing NBIB to meet timeliness  objectives, is around 180,000 pending investigations. According to NBIB,  the backlog of pending investigations increased from about 190,000 in  August 2014, before OPM decided not to exercise subsequent option  periods for its largest investigative fieldwork contract at the time, to more  than 709,000 investigations as of September 2017, as shown in figure  5. NBIB estimated the backlog grew at an average rate of about 3,600  investigations each week from October 2016 through July 2017.

As we reported when placing DOD’s personnel security clearance  program on the high-risk list, problems related to backlogs and the  resulting delays in determining clearance eligibility and issuing initial  clearances can result in millions of dollars of additional costs to the  federal government, longer periods of time needed to complete national  security-related contracts, lost opportunity costs if prospective employees  decide to work elsewhere rather than wait to get a clearance, and  diminishing quality of the work because industrial contractors may be  performing government contracts with personnel who have the necessary  security clearances but are not the most experienced and best-qualified  personnel for the positions involved. Delays in renewing previously- issued clearances can lead to heightened risk of national security  breaches because the longer individuals hold a clearance, the more likely  they are to be working with critical information and systems.

As the backlog has grown, NBIB has taken steps to increase its capacity  to conduct background investigations by increasing its own investigator  staff as well as awarding new contracts, effective in December 2016, to  four contractors for investigation fieldwork services. NBIB officials said  that NBIB has a goal to increase its total number of investigators—federal  employees and contractors—to about 7,200 by the end of fiscal year  2017. Specifically, to help address the backlog, NBIB officials reported  that NBIB increased its authorized federal investigator workforce by  adding 400 federal investigator positions in fiscal year 2016 and 200  positions in fiscal year 2017—an increase from 1,375 to 1,975 authorized  positions. As of July 2017, NBIB had filled 1,620 of the 1,975 positions,  and 1,513 of its federal investigators were fully trained. NBIB officials  explained that they do not plan to increase the federal investigator  capacity beyond the currently approved 1,975 because they do not have  the ability to absorb more staff. According to the officials, new  investigators must be trained by experienced investigators which reduces  the amount of time the experienced investigators have to conduct  investigative work. When estimating federal investigator capacity, NBIB  assumes it will have 277 full-time equivalent vacancies at any given time  due to high attrition rates. Further, NBIB officials could not project the  federal investigator workforce past April 2018 due to high attrition rates.

Given challenges with increasing its federal investigative staff, NBIB  continues to rely on contractors to conduct the majority of investigations.  NBIB officials noted that contractors perform about 60 percent of NBIB’s  total investigative cases. OPM awarded four new investigative fieldwork  services contracts that became effective in December 2016—two to  incumbent contractors and two to new vendors. In July 2017, OPM  officials told us that the contractor and federal staff capacity they currently  possess enables them to complete a sufficient number of investigations to  prevent the number of pending investigations from increasing further.  However, they acknowledged that the four contracts and federal  investigator staff do not currently provide OPM enough capacity to reduce  the pending number of investigations to the “healthy” inventory level of  180,000 cases.

NBIB officials have conducted analyses to determine how changes in the  total number of investigators could affect the backlog over time,  accounting for current and projected investigator capacity, prior time  studies, historical data, geographic location, and other factors.  Specifically, NBIB officials assessed four scenarios, from the status quo— assuming no additional contractor or federal investigator hires—to an  aggressive contractor staffing plan beyond January 2018, but in July 2017  they determined that the aggressive plan was not feasible. The two  scenarios that NBIB identified as most feasible would not result in a  “healthy” inventory level until fiscal year 2022 at the earliest. For example,  under one scenario, each contractor would increase investigator capacity  under current staffing projections through early 2018. Assuming that the  contractors adhere to these projections, NBIB would have the capacity to  address incoming cases and begin to reduce the backlog, but the backlog  would not reach a “healthy” inventory level until sometime after fiscal year  2022. However, NBIB leadership has not determined whether the costs  and benefits of any one scenario are preferable to the costs and benefits  of the others.

Standards for Internal Control in the Federal Government establishes that  management should clearly define objectives to enable the identification  of risks and define risk tolerances. In addition, our high-risk criteria for  capacity call for agencies to ensure they have the capacity, in terms of  people and resources, to address and resolve risks. We have also  found in previous work that milestones can be used to show progress  toward implementing efforts, or to make adjustments when necessary.  Developing and using specific milestones to guide and gauge progress  toward achieving an agency’s desired results informs management of the  rate of progress toward achieving goals or whether adjustments need to  be made in order to maintain progress within given timeframes. However,  NBIB leadership has not established goals or milestones for reducing the  size of the investigation backlog, or goals for increasing total investigator  capacity—for both federal employees and contractor personnel. As a  result, the value of NBIB’s backlog analysis is limited, because it is not  part of a broader plan to address the backlog and achieve timeliness  objectives. Further, the extent to which NBIB should adjust its investigator  capacity in the future remains unclear, as the currently projected capacity  levels are not tied to any established goals or milestones to address the  backlog or achieve the timeliness objectives.

In addition to increasing investigative capacity, NBIB personnel are  attempting to decrease the backlog by making the background  investigation process more effective and efficient. To do so, NBIB  conducted a business process reengineering effort that was intended to  identify challenges in the process and their root causes. This effort  identified 57 challenges, which were divided into five main categories that  affected multiple phases of the background investigation process. NBIB  then developed five portfolios, with 21 initiatives, to address the identified  challenges. For example, one of the categories of challenges was poor  data quality at the start of the investigation, which was described as  related to issues such as no auto-validation of information, no pre- population of forms, and variable quality of submissions. NBIB developed  four initiatives related to automation and digitization to improve the quality  of this information. NBIB officials said that this business process  reengineering effort is working to reduce the investigative level of effort  across the community. Specifically, NBIB officials cited efforts that have  been implemented to reduce the number of personnel hours necessary to  complete an investigation, such as centralizing interviews and using  video-teleconferencing for overseas investigations (to decrease travel  time), automated record checks, and focused writing (to make reports  more succinct and less time-consuming to prepare). However, NBIB has  not identified how the implementation of the business process  reengineering effort will affect the backlog or the need for additional  investigators in the future.

Without a plan, including goals and milestones, for reducing the backlog,  which includes a determination of the effect of the business process  reengineering efforts on the backlog, NBIB will lack the information and a  course of action needed to effectively manage the inventory of pending  investigations it conducts on behalf of other executive branch agencies.  Further, without establishing goals for increasing total investigator  capacity—for both federal employees and contractor personnel—in  accordance with the plan for reducing the backlog, NBIB may not be  positioned to achieve the goals and milestones outlined in that plan.  Ultimately, if NBIB is unable to reduce the backlog, executive branch  agencies will continue to lack the cleared personnel needed to help  execute their respective missions, which could decrease the agencies’  overall effectiveness and efficiency, and pose risks to national security.

NBIB Has Identified Some Workforce Needs but Does Not Have a Strategic Workforce Plan

Our review of NBIB planning and workforce documents indicates that it  has taken workforce planning steps. For example, the bureau developed  a transition plan to help guide the transition from FIS to NBIB. This plan  includes a request for a personnel study for its new Contracting and  Business Solutions department to determine any needs or realignment of  resources, skills, or qualification gaps; however, the transition plan does  not mention a personnel study to address the needs of any other  departments within NBIB. NBIB officials stated that the bureau conducted  this study in early fiscal year 2017, and those results are being used to  build the Contracting and Business Solutions department. NBIB officials  said that NBIB plans to conduct a personnel study for its other  departments once there is greater clarity and direction regarding the  conduct of background investigations as a result of the plan developed by  DOD to conduct its own investigations and any subsequent direction from  Congress and the Administration. The officials stated that the personnel  study was needed for the contracting department because this work had  not been done in NBIB before and so they needed to establish a baseline  for staffing it.

As previously discussed, section 951 of the National Defense  Authorization Act for Fiscal Year 2017 required, among other things, the  Secretary of Defense to develop an implementation plan for the Defense  Security Service to conduct background investigations for certain DOD  personnel—presently conducted by OPM—after October 1, 2017.   Additionally, in November 2017, as this report was in its final stages,  Congress passed a bill for the National Defense Authorization Act for  Fiscal Year 2018, which includes a provision that, among other things,  would authorize DOD to conduct its own background investigations.  It  would also require DOD to begin carrying out the implementation plan  developed in response to section 951 by October 1, 2020. The  legislation would further require the Secretary of Defense, in consultation  with the Director of OPM, to provide for a phased transition of the conduct  of investigations from NBIB to the Defense Security Service. Moreover,  this legislation would require the Secretary of Defense to conduct a  comprehensive assessment of workforce requirements for both DOD and  NBIB as part of planning for the transfer of certain functions from OPM to  DOD.

In addition, the NBIB transition team developed a talent acquisition  strategy for the establishment of the bureau; however, this strategy was  focused solely on filling nine key leadership positions (according to NBIB  officials, four positions are senior executive service positions, and five are  general schedule grade 14 and 15 positions). As of July 2017, NBIB  officials said that six of these positions had been filled, and that another  position was in the process of being staffed. The only mention of other  positions in this strategy was a statement that once these key leadership  positions have been filled, executives should build their respective  departments consistent with mission needs and aligned with the NBIB  strategic plan, and that NBIB use current FIS leadership for field  operations, engagements and customer service, and integrity assurance.  According to NBIB officials, NBIB has 3,260 positions authorized by OPM  but had 495 vacancies as of July 1, 2017—approximately a 15 percent  vacancy rate. NBIB officials said that most positions were not affected by  the recent executive-branch hiring freeze, including investigators and  investigative assistants, because they qualified for national security  waivers; however, some positions, such as administrative support, were  not covered by the waivers.

The greatest total number of vacancies within NBIB is in its field  operations department, which as of July 2017 had almost 400 vacancies,  or a vacancy rate of about 17 percent. The Field Operations department  provides contractor oversight, including program and project managers  for fieldwork and CORs; it also includes federal investigator staff. NBIB  officials stated that their greatest challenge in filling vacancies has been  with their investigative workforce, and that as they fill their investigator  positions, they will be able to better perform their mission of delivering  completed background investigations in a timely manner due to having  greater capacity. NBIB officials told us that they plan to hire another 200  federal investigators in fiscal year 2017 to help address the backlog of  investigations; however, hiring 200 new federal investigator positions was  not listed as a step on the transition plan for the Field Operations  department, and these new investigator positions also are not included in  the planned new hires listing of personnel hiring priorities. NBIB officials  said that these new investigator positions were not included in the  transition plan because the decision to hire for these positions had  already been made and the hiring was being executed when the transition  plan was developed.

Furthermore, NBIB has developed detailed plans to hire new personnel.  NBIB’s listing of personnel hiring priorities showed that NBIB initially  planned to hire 155 new personnel. NBIB officials explained that in  developing this initial hiring plan, organizational leaders assessed OPM  legacy resources that would align with NBIB’s mission, roles and  responsibilities, and identified gaps. These officials stated that at a  leadership offsite held in December 2016, small groups identified existing  and notional resources, prioritized resource gaps for identified programs,  and briefed out their assessment of priorities. These officials said that the  offsite participants then selected the top priorities for fiscal years 2017  and 2018, and that NBIB leadership subsequently developed  individualized proposals outlining revisions and changes to personnel  requirements and organization of each of the program areas. NBIB  officials said that they subsequently refined these plans and reduced the  number of planned new hires. The officials stated that in 2017, NBIB  established a transitional hiring committee to further prioritize and select  the final NBIB personnel structure, and that through a series of meetings  in March, May, and June 2017, they refined their plans to reduce the  number of planned new positions. As of July 2017, they said that NBIB  planned to create and fill 49 new positions. According to NBIB officials, 13  of the new positions would involve an increase to the budget. Of those  49 new positions, they said that 21 had been filled as of July 2017.

In addition, NBIB uses contractor support to fill some positions in its Field  Operations, Federal Investigative Records Enterprise, and customer  service departments, but NBIB officials did not provide documentation  explaining the determinations for which tasks should be performed by  contractors versus federal employees. NBIB officials stated that they  followed a deliberative process requiring a thoughtful assessment of the  personnel resource skills and competencies required to address the new  NBIB objectives, but they could not provide any supporting  documentation to that effect.

A key principle of strategic workforce planning is determining the critical  skills and competencies needed to achieve current and future  programmatic results, such as identifying how the agency will obtain the  workforce skills and competencies that are critical to achieving its  strategic goals. In addition, OPM’s workforce planning best practices  include forecasting the optimal headcount and competencies needed to  meet the needs of the organization in the future, and a gap analysis to  identify headcount surpluses and deficiencies for current and future  demand levels. Further, OMB policy requires agencies to take actions  to ensure they have sufficient internal capability to maintain control over  functions that are core to the agency’s mission and operations.

However, NBIB officials were unable to provide us with documentation  that identified any of the gaps or explained the rationale for its  determinations about the specific number and positions of additional staff  needed. The documents they did provide appeared to be summaries of  the revisions and changes decided upon, and included detailed  information about the identified staffing requirements, such as information  about the number of positions, position titles and types, grade levels, and  hiring priority. While this information reflects detailed planning and  thought, it does not illuminate whether the quantities and types of  positions identified are the appropriate positions with the right critical skills  and competencies needed to address any gaps in the bureau’s  workforce. NBIB officials said that the hiring plans were originally  determined at the leadership offsite, where the rationale for the specific  number and positions of additional staff was discussed orally, and then  further refined at a series of meetings beginning in March 2017. The  officials told us that extensive review went into determining the rationale  for the requests for new staff, and that these requests were the subject of  robust and sometimes contentious debate, after which the requests were  voted on by senior leadership.

Although NBIB has taken some steps to develop and implement certain  strategic workforce planning elements, it has not created a  comprehensive, formal workforce plan that is focused on workforce needs  to reduce the backlog. Such a plan should include the workforce skills  and competencies that are critical to achieving NBIB’s strategic goals. As  we previously reported, the most important consideration in identifying  needed skills and competencies is that they are clearly linked to the  agency’s mission and long-term goals developed jointly with key  congressional and other stakeholders during the strategic planning  process. If an agency identifies staff needs without linking the needs to  strategic goals, or if the agency has not obtained agreement from key  stakeholders on the goals, the needs assessment may be incomplete and  premature. In addition, a strategic workforce plan could enable NBIB to  (1) develop hiring, training, staff development, succession planning,  performance management, use of flexibilities, and other human capital  strategies and tools that could be implemented with the resources that  can be reasonably expected to be available; and (2) eliminate gaps and  improve the contribution of critical skills and competencies that they have  identified between the future and current skills and competencies needed  for mission success. NBIB officials explained that a strategic workforce  plan is something they should create, but that as a new organization the  bureau was focused on other priorities, such as hiring a director, selecting  the headquarters location, addressing the backlog, and filling vacant  positions. However, after being operational for almost a year, NBIB still  lacks a comprehensive workforce plan.

While it has taken several other steps intended to strengthen the  background investigation process, without a formal strategic workforce  plan, NBIB does not know whether the identified needs in its new hires,  transition plan, and overall workforce vacancies will provide the  appropriate mix of personnel. Specifically, it does not know whether it has  the appropriate mix of federal employees and contractors, with the right  critical skills and competencies, to address any staffing gaps and better  enable the bureau to fulfill its mission. A comprehensive strategic  workforce plan that focuses on the workforce and organizational elements  needed and addresses capacity issues related to its vacancies would  better position NBIB to address its investigation backlog. Additionally, a  comprehensive strategic workforce plan would better position the bureau  to execute its roles and responsibilities related to overseeing the  background investigations for DOD and other executive branch agencies  that rely on NBIB as their investigative service provider.

The PAC has made progress in reforming the personnel security  clearance process. However, 13 years after the passage of IRTPA, it is  now at a crossroads. The backlog of background investigations totaled  over 700,000 cases as of September 2017 and while the executive  branch is taking actions to help address it, there are no indications that  the government can readily do so.

We have noted in prior work concerns about the quality of background  investigations and have emphasized the need to build quality throughout  the personnel security clearance process for nearly two decades. Even  though it has made significant attempts, the executive branch has still not  established government-wide performance measures for the quality of  background investigations to help ensure that critical security-relevant  information is identified and mitigated when granting a security clearance.  Over the past 2 years, the executive branch has taken steps toward  establishing such measures. However, ODNI, as the Security Executive  Agent, and the PAC have not prioritized setting a milestone for their  completion. Without a milestone for establishing government-wide  performance measures for the quality of investigations, their completion  may be further delayed, and executive branch agencies will not have a  schedule against which they can track progress or to which they are  accountable.

Executive branch timeliness in completing initial secret and initial top  secret clearances has declined over the past 5 years. While ODNI has  taken some steps to correct this downward trend on an agency-by- agency basis, neither ODNI nor the PAC have led a government-wide  approach to improve the timeliness of initial personnel security  clearances. While ODNI requests that agencies submit corrective action  plans when they are not meeting timeliness objectives, it has not  developed a comprehensive, government-wide plan with goals and  milestones. A government-wide plan would help position ODNI, as the  Security Executive Agent, as well as the PAC, to better identify and  address systemic issues across the executive branch that affect the  ability of agencies to meet timeliness objectives.

IRTPA also created greater transparency and oversight of the overall  reform effort by mandating annual reports to the appropriate  congressional committees on the progress made toward meeting the act’s  requirements, including reporting timeliness data. However, since the  IRTPA reporting requirement ended in 2011, executive branch reporting  has been limited, which makes it difficult to thoroughly evaluate and  precisely identify where and why delays exist within the process, as well  as to direct corrections as necessary. Without transparent reporting on  investigation and adjudication timeliness, for both initial investigations and  periodic reinvestigations, Congress will not be able to effectively execute  its oversight role and monitor individual executive branch agency  progress in meeting timeliness objectives.

The establishment of NBIB in 2016, to strengthen the background  investigation process, involved a number of organizational changes and  efforts to improve the process. While NBIB has taken steps to increase its  investigative capacity, it faces challenges in developing a comprehensive  plan, with goals and milestones, to address the investigation backlog.  Without such a plan, NBIB lacks a necessary course of action to reduce  the backlog to a manageable level. Relatedly, NBIB has not established  goals for increasing total investigator capacity. Establishing such goals, in  accordance with the plan for reducing the backlog, may better position  NBIB to achieve the goals and milestones outlined in that plan. Ultimately,  if NBIB is unable to reduce the investigation backlog, executive branch  agencies will continue to lack the cleared personnel needed to help  execute their respective missions, which poses potential risks to national  security. Demonstrated leadership from ODNI, in the capacity as the  Security Executive Agent, and the PAC, by assisting NBIB as it works to  reduce the investigation backlog could better position NBIB to reach a  manageable level of investigations.

Additionally, NBIB faces operational challenges related to workforce  planning. While the bureau has taken a number of workforce planning  steps, such as identifying specific hiring needs, it has not developed a  strategic workforce plan. As a result, it may not know whether it has  planned for the appropriate mix of personnel, with the right critical skills  and competencies, and it has experienced delays in addressing its hiring  needs. A comprehensive strategic workforce plan that focuses on the  workforce and organizational elements needed and addresses capacity  issues related to its vacancies would better position NBIB to address its  investigation backlog and strengthen the investigation process.

Congress should consider reinstating the Intelligence Reform and  Terrorism Prevention Act of 2004’s requirement for the executive branch  to report annually to appropriate committees of Congress on the amount  of time required by authorized investigative and adjudicative agencies to  conduct investigations, adjudicate cases, and grant initial personnel  security clearances. Congress should also consider adding to this  reporting requirement the amount of time required to investigate and  adjudicate periodic reinvestigations and any other information deemed  relevant, such as the status of the investigation backlog and implementing  government-wide measures for the quality of investigations or other  reform efforts. (Matter for Consideration 1)

We are making a total of six recommendations, including three to ODNI,  in coordination with the PAC, and three to NBIB. Specifically,

The Director of National Intelligence, in his capacity as Security  Executive Agent, and in coordination with the other Security,  Suitability, and Credentialing Performance Accountability Council  Principals—the Deputy Director for Management of OMB in his  capacity as Chair of the PAC, the Director of OPM, and the Under  Secretary of Defense for Intelligence—should take the following three  actions: establish a milestone for the completion of government-wide  performance measures for the quality of investigations;  (Recommendation 1)  conduct an evidence-based review of the investigation and  adjudication timeliness objectives for completing the fastest 90  percent of initial secret and initial top secret security clearances,  and take action to adjust the objectives if appropriate;  (Recommendation 2) and develop a government-wide plan, including goals and interim  milestones, to meet those timeliness objectives for initial  personnel security clearance investigations and adjudications.  (Recommendation 3)

The Director of NBIB, in coordination with the Deputy Director for  Management of OMB, in the capacity as Chair of the PAC, and the  Director of National Intelligence, in the capacity as Security Executive  Agent, should take the following two actions: develop a plan, including goals and milestones, that includes a  determination of the effect of the business process reengineering  efforts for reducing the backlog to a “healthy” inventory of work,  representing approximately 6 weeks of work; (Recommendation 4)  and establish goals for increasing total investigator capacity—federal  employees and contractor personnel—in accordance with the plan  for reducing the backlog of investigations. (Recommendation 5)

The Director of NBIB should build upon NBIB’s current workforce  planning efforts by developing and implementing a comprehensive  strategic workforce plan that focuses on what workforce and  organizational needs and changes will enable the bureau to meet the  current and future demand for its services. (Recommendation 6)

We provided a draft of this report to OMB, ODNI, OPM, DOD, the  Department of Justice, and the Department of Homeland Security for  review and comment. OMB provided its comments via email, and the  comments are summarized below. Written comments from ODNI and  OPM are reprinted in their entirety in appendixes V and VI, respectively.  OMB, ODNI, OPM, and the Department of Homeland Security provided  additional technical comments, which we incorporated in the report as  appropriate. DOD and the Department of Justice did not provide  comments. OMB and OPM concurred with the recommendations directed  to them. ODNI stated that it did not concur with the report’s conclusions  and recommendations, but did not specifically state with which  recommendations it did not concur.

In comments e-mailed to us on November 9, 2017, the Acting Deputy  Director for Management of OMB concurred with the report’s findings,  conclusions, and recommendations. The comments also stated that the  administration is committed to renewing public reporting of security  clearance timeliness, once the government-wide reform initiatives are  announced in early 2018, either as one of the administration’s cross- cutting priority goals or via another approach. While the PAC’s prior public  reporting on the status of security clearance reform efforts was beneficial  and helped to provide for transparency of the process, we believe that  security clearance timeliness information should be reported—whether  publicly or via reporting to Congress—broken out by individual executive  branch agency and not only as an executive branch-wide average, as  noted in our Matter for Congressional Consideration. As discussed in the  report, such detailed reporting could help congressional decision-makers  and OMB to thoroughly evaluate and precisely identify where and why  delays exist within the process, as well as to direct corrections as  necessary. In addition, OMB stated that the PAC is committed to ensuring  that its Implementation Plan is continually updated to reflect the current  status of reform efforts and that it incorporates any new initiatives arising  from our review.

In its written comments, ODNI stated that the report appears to draw  negative inferences from the facts and that the conclusions do not  present an accurate assessment of the current status of the personnel  security clearance process. ODNI also stated that the conclusions do not  include the significant progress ODNI has achieved in coordination with  executive branch agencies. We disagree with these statements. The  report discusses in detail the progress that the PAC—of which ODNI is a  Principal member—has made to reform the personnel security clearance  process, including the implementation of recommendations and  milestones from the 120-day and 90-day reviews, and cross-agency  priority goal updates. The report also discusses areas of progress  highlighted by ODNI officials, such as the development of seven Security  Executive Agent Directives, the issuance of Quality Assessment  Standards for background investigations, and the implementation of the  QART.

In its comments, ODNI further stated that while it generally concurred with  the factual observations in the report, it did not concur with our  recommendations. While ODNI did not specifically state with which  recommendations it disagreed, it discussed each of the three  recommendations addressed to it. In addition, ODNI stated that it did not  concur with our conclusions, and provided specific observations in the  following three areas, which lead to the three recommendations.

First, ODNI disagreed with our conclusion that it has not prioritized setting  a milestone for the completion of government-wide performance  measures for the quality of background investigations. ODNI also stated  that the report ignores significant progress that ODNI has made in this  area; specifically, the approval of Quality Assessment Standards for  background investigations and the implementation of the QART. We  disagree with ODNI’s position, as the report discusses in detail both the  Quality Assessment Standards and the QART, and identifies these as the  two steps toward the development of performance measures for the  quality of background investigations. Additionally, ODNI stated that it has  the ability to determine trends in background investigative quality from the  data collected by the QART. However, as we note in the report, DOD  background investigations—which represent the majority of the  investigations conducted by NBIB—are not captured by the QART. We  further noted that according to NBIB officials, they are not positioned to  receive comprehensive feedback if their largest customer, DOD, is not  utilizing the QART. Therefore, as we concluded in the report, it is unclear  how ODNI will have sufficient data to develop government-wide measures  for the quality of investigations since it will lack data for a significant  portion of the executive branch’s background investigations.

Regarding our recommendation that the Director of National Intelligence,  in coordination with the other PAC Principals, establish a milestone for  the completion of government-wide performance measures for the quality  of investigations, ODNI stated that it is premature to do so and that it will  set a milestone once the QART metrics discussed above have been fully  analyzed. However, in its written comments, ODNI did not state when it  anticipates the QART metrics will be fully analyzed. We recognize that  fully analyzing the QART data may take time and that initial performance  measures may be refined as ODNI collects and assesses data regarding  the quality of background investigations. However, setting a milestone— that takes into consideration the amount of time needed to analyze QART  data—will help to ensure that the analysis is completed, that initial  performance measures are developed, and that agencies will have a  greater understanding of what they are being measured against. We  identify in the report that the executive branch previously set a milestone  for the completion of government-wide performance measure for quality,  which was adjusted over time and most recently set as October 2015. We  further identify that the PAC has set milestones for the completion of  nearly 50 other initiatives in its Implementation Plan, and that in the  aftermath of the 2013 Washington Navy Yard shooting, the PAC (which  includes ODNI) issued a 120-day review report that, among other things,  recommended reporting on measures for quality. We continue to believe  that setting a milestone could help to prevent further delays to their  completion and provide the executive branch with a schedule against  which it would be accountable.

Second, ODNI did not agree with our conclusion that neither ODNI nor  the PAC have led a government-wide approach to improve timeliness of  initial personnel security clearances. In its written comments, ODNI  discusses actions it has taken to improve timeliness since the passage of  IRTPA, including resetting timeliness goals for certain clearances in 2012,  in coordination with interagency stakeholders, issuing annual  memorandums to agencies on their performance, and requesting that  agencies develop agency-specific corrective action plans. We discuss all  of these actions in the report and while we agree that they are positive  actions, the executive branch would further benefit from a more  coordinated approach. For example, even with the cited actions, the  executive branch is experiencing significant challenges related to the  timely processing of initial personnel security clearances. Specifically, as  discussed in the report, in fiscal year 2016, only 2 percent of the agencies  for which ODNI provided timeliness data met the 40-day IRTPA- established investigation objective for at least three of four quarters for  the fastest 90 percent of initial secret cases; and only 12 percent met  ODNI’s revised investigation objective for at least three of four quarters  for the fastest 90 percent of initial top secret cases. In addition, as  discussed in the report, timeliness challenges are not only an issue for  agencies that use NBIB as their investigative service provider. Agencies  with delegated authority to conduct their own investigations have also  experienced timeliness challenges over the past 5 fiscal years. Further,  the timeliness challenges cited by agencies to GAO include government- wide challenges, such as the increased investigative requirements—not  just agency-specific challenges, such as staffing shortfalls. A government- wide plan would better position ODNI to identify and address any  systemic government-wide issues.

Regarding our recommendation that the Director of National Intelligence,  in coordination with the other PAC Principals, conduct an evidence-based  review of the timeliness objectives for completing initial secret and initial  top secret security clearances, and take action to adjust the objectives if  appropriate, ODNI stated that it is premature to revise the existing  timeliness goals until NBIB’s backlog is resolved. In its written comments,  ODNI states that while timeliness has exceeded the established  standards, this is not necessarily an indication of a flaw in timeliness  goals, but an indicator of the impact of the backlog and that as such, the  current challenge in meeting timeliness should not serve as the sole basis  for modifying existing goals. Our recommendation is to conduct an  evidence-based review of the timeliness objectives, through which ODNI  could determine whether there are any issues with the timeliness goals  or, as ODNI suggests, whether the timeliness challenges are just a  reflection of the backlog. At the conclusion of that review, ODNI can  determine if it is appropriate to adjust the timeliness objectives, and take  action if necessary. We do not suggest that ODNI should immediately  revise the timeliness objectives without first determining if there is an  evidence-based need to do so. ODNI further notes that other agencies  that are not supported by NBIB are still achieving or very close to  achieving current standards. However, as discussed in the report, even  agencies with delegated authority to conduct their own investigations are  experiencing challenges meeting established timeliness objectives.

ODNI further stated in response to our recommendation that the Director  of National Intelligence will continue to assess the impact of the  implementation of the 2012 Federal Investigative Standards and modify  the timeliness goals as appropriate. Given that ODNI has not  comprehensively revisited the investigation or adjudication timeliness  objectives for initial security clearances since 2012 despite the increased  investigative requirements stemming from the implementation of the 2012  Federal Investigative Standards, we continue to believe that our  recommendation to conduct an evidence-based review, using relevant  data, is valid.

Third, ODNI disagreed with our conclusion that demonstrated leadership  from ODNI, in the capacity as the Security Executive Agent, and the PAC,  by assisting NBIB as it works to reduce the investigation backlog could  better position NBIB to reach a manageable level of investigations. ODNI  stated that it has demonstrated leadership in this area and has worked  closely as the Security Executive Agent with NBIB to reduce its  investigation backlog and noted recent efforts by the Director of National  Intelligence and the other PAC Principals to help reduce the backlog. We  believe that these recent actions, which have taken place since the  completion of our review, are positive steps that, along with our  recommendations to NBIB, could help to reduce the backlog of  background investigations. However, as discussed in the report, prior to  these recent actions, ODNI had not demonstrated the leadership  necessary to improve executive branch timeliness, as evidenced by the  decrease in the number of agencies meeting timeliness objectives from  fiscal years 2012 through 2016 and a backlog of over 700,000  investigations as of September 2017. Additionally, while the recent  actions could help to reduce the backlog, sustained demonstrated  leadership by the Director of National Intelligence and the other PAC  Principals will be crucial to maintaining and increasing momentum, and  ultimately critical to comprehensively addressing the current timeliness  challenges and reducing the investigation backlog.

Regarding our recommendation that the Director of National Intelligence  develop a government-wide plan, including goals and interim milestones,  to meet timeliness objectives for initial personnel security clearances,  ODNI stated that it has already established timeliness goals for the  security clearance process and that prior to the investigation backlog,  which was created, in part, due to a loss of OPM investigator capacity,  the executive branch met those goals. ODNI further stated that until NBIB  reduces its backlog, departments and agencies that use NBIB cannot  accurately predict budgetary requirements for the phases of the security  clearance process under their control, which complicates the  development of a government-wide plan at this time. However, as  discussed in the report, the most feasible date by which NBIB could  reduce the backlog of background investigations to a “healthy” inventory  level is fiscal year 2022 at the earliest. Given the significant timeliness  challenges that the executive branch is currently experiencing, agencies  would benefit from developing a government-wide plan now, rather than  waiting at least 5 years for the reduction of the backlog to do so. In  addition, through the development of a government-wide plan, ODNI  could help to identify additional actions to more quickly reduce the  investigation backlog. Without such a plan, continued delays in  processing clearances may leave agencies unable to fill critical positions  that require a security clearance. Ultimately, developing a government- wide plan, including goals and interim milestones, will better ensure timely  determinations of individuals’ eligibility for access to classified  information. As such, we continue to believe that the recommendation is  valid.

In its written comments, OPM concurred with the three recommendations  directed to NBIB, and described some actions it plans to take to address  them. Separate from the recommendations, OPM also provided  comments related to the discussion in the draft report regarding DOD’s  development of NBIS and the security of OPM’s IT systems and data.  Specifically, OPM expressed concerns about some of the statements by  DOD officials, stating that they were unverified opinions. We agree that  including the countering views of OPM officials could provide some  helpful context. As a result, we have added language to the report to  include OPM’s perspectives on the statements made by the DOD CIO  officials.

In addition, OPM stated that the prior GAO and OPM Inspector General  audits referenced in the IT discussion were outdated audit assessments.  We agree that some information in the draft report from the prior audits  was based on reports from 2016 or earlier in 2017, and we understand  that circumstances may have changed since those reports were issued.  Specifically, the OPM Inspector General released a new audit report in  October 2017, when this report was with the agency for comment,  regarding the state of security of OPM IT systems. Accordingly, we  replaced the discussion of the older OPM Inspector General reports in the  draft report with a discussion of the OPM Inspector General’s October  2017 report. This latest OPM Inspector General report found, among  other things, that OPM had made improvements in its security  assessment and authorization program, and its previous “material  weakness” related to authorizations has been upgraded to a “significant  deficiency” for fiscal year 2017. Overall, the OPM Inspector General  found that OPM’s cybersecurity maturity level was measured at a level 2,  “Defined”, meaning that its policies, procedures and strategy were  formalized and documented, but were not consistently implemented. We  also added language to emphasize the date of the 2016 GAO reports,  and added information about the status of the recommendations from  those two reports, because none of the recommendations directed to  OPM from the two 2016 GAO reports had been closed as implemented  as of November 2017.

OPM further stated that it has implemented critical enhancements to  strengthen the security of OPM’s networks and has improved its security  and assessment authorization process. In the draft report, we stated that  OPM has strengthened the security of its networks, and we noted that— as stated in our 2017 report—OPM has made progress in improving its  security to prevent, mitigate, and respond to data breaches involving  sensitive personal records and background investigations information.  However, as we noted our 2017 report, we also found that OPM did not  effectively monitor actions taken to remediate identified weaknesses, and  we continue to believe that discussion of the deficiencies we identified in  our prior reports is appropriate in this report.

In November 2017, after the conclusion of our audit work, Congress  passed a bill for the National Defense Authorization Act for Fiscal Year  2018. Among other things, the bill includes a provision that would  authorize DOD to conduct its own background investigations and require  DOD to begin carrying out the implementation plan required by section  951 of the National Defense Authorization Act for Fiscal Year 2017 by  October 1, 2020. It would also require the Secretary of Defense, in  consultation with the Director of OPM, to provide for a phased  transition.  While this pending legislation may affect how some  background investigations are conducted, we believe that our  recommendations remain important points on which the executive branch  should focus in order to help improve the security clearance process as  these legislative changes are implemented.

We are sending copies of this report to the appropriate congressional  committees, the Director of National Intelligence, the Secretary of  Defense, the Director of OMB, the Secretary of Homeland Security, the  Director of OPM, the Director of NBIB, the Attorney General of the United  States, the Director of the Federal Bureau of Intelligence, and the Director  of the Bureau of Alcohol, Tobacco, Firearms, and Explosives. In addition,  this report will also be available at no charge on the GAO website at  http://www.gao.gov.

If you or your members of your staff have any questions regarding this  report, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made significant  contributions to this report are listed in appendix VII.

Appendix I: Status of Prior GAO Personnel Security Clearance Recommendations to Executive Branch Agencies as of November 2017

Since May 2009, we have made 37 recommendations to appropriate  executive branch agencies—the Office of Management and Budget  (OMB), Office of Personnel Management (OPM), Office of the Director of  National Intelligence (ODNI), Department of Defense (DOD), and  Department of Homeland Security (DHS)—to improve the personnel  security clearance process. As of November 2017, these agencies had  implemented 12 of those recommendations; we closed 4 due to the  inaction of the responsible agencies; and 21 remained open. Examples of  implemented recommendations include DOD’s issuance of adjudication  guidance related to incomplete investigative reports, ODNI and OPM’s  jointly proposed chapter and part to the Code of Federal Regulations  clarifying, among other things, the position sensitivity designation of  national security positions, and DHS’s issuance of new standards for  tracking information on security clearance revocations and appeals.

The 21 recommendations that remain open as of November 2017  focused on different aspects of the personnel security clearance process.  First, in February 2012, we reported on background investigation pricing  and costs, and we found, among other things, that the Performance  Accountability Council had not provided the executive branch with  guidance on cost savings. Second, in September 2014, we reported on  the security clearance revocation processes at DHS and DOD. We found  that DHS and DOD data systems did not track complete revocation  information; there was inconsistent implementation of the requirements in  the governing executive orders by DHS, DOD, and some of their  components; and there was limited oversight over the revocation process,  among other things. Third, in April 2015, we reported on the status of  government-wide security clearance reform efforts. We found, among  other things, that limited progress had been achieved in implementing  updated Federal Investigative Standards, and that the extent to which  reciprocity is granted government-wide was unknown. Fourth, in  November 2017, we found that ODNI had taken an initial step to  implement continuous evaluation across the executive branch, but it had  not yet determined key aspects of the program; and it lacked plans for  implementing, monitoring, and measuring program performance. See  table 2 for the 21 open recommendations from these four reports as of  November 2017.

Appendix II: Overview of Selected Personnel Security Clearance Provisions in the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA)

Appendix II: Overview of Selected Personnel  Security Clearance Provisions in the  Intelligence Reform and Terrorism Prevention  Act of 2004 (IRTPA)

The 2004 enactment of IRTPA initiated a reform effort that includes goals  and requirements for improving the personnel security clearance process  government-wide. Specifically, among other things, IRTPA required that:

The President select a single entity—currently designated as the  Office of the Director of National Intelligence—to be responsible for,  among other things, the development and implementation of uniform  and consistent policies and procedures to ensure the effective,  efficient, and timely completion of security clearances.

The President, in consultation with the head of the entity above, select  a single agency—currently designated as the National Background  Investigations Bureau within the Office of Personnel Management  (OPM)—tasked with conducting, to the maximum extent practicable,  security clearance investigations of federal employees and contractor  personnel, among other things. It also required this entity to ensure  that investigations are conducted in accordance with uniform  standards and requirements.

All security clearance background investigations and determinations  completed by an authorized investigative agency or authorized  adjudicative agency be accepted by all agencies (known as  reciprocity), subject to certain exceptions.

Not later than 12 months after the date of enactment of the act, the  Director of OPM in cooperation with the heads of the entities selected  above, establish and commence operating and maintaining an  integrated, secure database of personnel security clearance  information.

The executive branch evaluate the use of available information  technology and databases to expedite investigative and adjudicative  processes and to verify standard information submitted as part of an  application for a security clearance and, not later than 1 year after  enactment, submit a report to the President and the appropriate  committees of Congress on the results of that evaluation.

The executive branch submit an annual report, through 2011, to the  appropriate congressional committees on the progress made toward  meeting IRTPA requirements, including timeliness data and a  discussion of any impediments to the smooth and timely functioning of  IRTPA requirements.

IRTPA also established specific objectives for the timeliness of security  clearance processing. Specifically, the act required the entity selected  under section 3001(b) to develop a plan to reduce the length of the  personnel security clearance process, in consultation with appropriate  committees of Congress and each authorized adjudicative agency. To the  extent practical, the plan was to require that each authorized adjudicative  agency make a determination on at least 90 percent of all applications for  a personnel security clearance within an average of 60 days after the  date of receipt of the completed application by an authorized investigative  agency—not longer than 40 days to complete the investigative phase and  20 days to complete the adjudicative phase. IRTPA required the plan to  take effect December 17, 2009.

Appendix III: GAO Work on Personnel Security Clearance Quality and Executive Branch Efforts to Establish Government-wide Measures for the Quality of Investigations

Since 1999 we have reported on issues related to investigative quality at  the Department of Defense and the Office of Personnel Management and  have issued recommendations to help ensure the personnel security  clearance reform effort results in the development of metrics to track  quality. Figure 6 provides an overview of our work in this area and  executive branch efforts to establish government-wide performance  measures for investigation quality.

Appendix IV: Timeliness of Executive Branch Periodic Reinvestigations

In November 2017, we reported on the timeliness of the executive  branch’s periodic reinvestigations for fiscal years 2012 through 2016,  among other things. Our analysis of timeliness data for select executive  branch agencies showed that the percent of agencies meeting timeliness  goals decreased from fiscal year 2012 through 2016. The timeliness  goals for periodic reinvestigations are outlined in a 2008 Joint Security  and Suitability Reform Team report to the President entitled Security and  Suitability Process Reform. Specifically, the report includes Office of  Management and Budget-issued interim government-wide processing  goals for security clearances for calendar year 2008. The calendar year  2008 government-wide goal for the fastest 90 percent of periodic  reinvestigations is the same as the goal currently in place: 15 days to  initiate a case, 150 days to conduct the investigation, and 30 days to  adjudicate—totaling 195 days to complete the end-to-end processing of  the periodic reinvestigation. Table 3 shows the percent of executive  branch agencies meeting the timeliness goals for investigating,  adjudicating, and completing the fastest 90 percent of periodic  reinvestigations for at least three of four quarters from fiscal years 2012  through 2016.

Specific details of the timeliness of initial secret and initial top secret  clearances for select individual executive branch agencies were omitted  because the information is sensitive.

Appendix V: Comments from the Office of the Director of National Intelligence

Appendix VI: Comments from the Office of Personnel Management

Appendix VII: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kimberly Seay (Assistant  Director), Nathan Tranquilli (Assistant Director), Renee S. Brown, Chris  Businsky, Molly Callaghan, Jenny Chanley, Katheryn Hubbell, Saida  Hussain, Jeffrey L. Knott, James Krustapentus, Caryn E. Kuebler,  Michael Shaughnessy, Rachel Stoiko, Paul Sturm, John Van Schaik,  Cheryl Weissman, and Jina Yu made significant contributions to this  report.

Personnel Security Clearances: Additional Actions Needed to Address  Quality, Timeliness, and Investigation Backlog. GAO-18-26SU.  Washington, D.C.: December 7, 2017 (FOUO).

Personnel Security Clearances: Additional Planning Needed to Fully  Implement and Oversee Continuous Evaluation of Clearance Holders.  GAO-18-159SU. Washington, D.C.: November 21, 2017 (FOUO).

Personnel Security Clearances: Plans Needed to Fully Implement and  Oversee Continuous Evaluation of Clearance Holders. GAO-18-117.  Washington, D.C.: November 21, 2017.

High-Risk Series: Progress on Many High-Risk Areas, While Substantial  Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15,  2017.

Personnel Security Clearances: Funding Estimates and Government- Wide Metrics Are Needed to Implement Long-Standing Reform Efforts.  GAO-15-179SU. Washington, D.C.: April 23, 2015.

Personnel Security Clearances: Additional Guidance and Oversight  Needed at DHS and DOD to Ensure Consistent Application of Revocation  Process. GAO-14-640. Washington, D. C.: September 8, 2014.

Personnel Security Clearances: Actions Needed to Ensure Quality of  Background Investigations and Resulting Decisions. GAO-14-138T.  Washington, D.C.: February 11, 2014.

Personnel Security Clearances: Actions Needed to Help Ensure Correct  Designations of National Security Positions. GAO-14-139T. Washington,  D.C.: November 20, 2013.

Personnel Security Clearances: Opportunities Exist to Improve Quality  Throughout the Process. GAO-14-186T. Washington, D.C.: November  13, 2013.

Personnel Security Clearances: Full Development and Implementation of  Metrics Needed to Measure Quality of Process. GAO-14-157T.  Washington, D.C.: October 31, 2013.

Personnel Security Clearances: Further Actions Needed to Improve the  Process and Realize Efficiencies. GAO-13-728T. Washington, D.C.: June  20, 2013.

Managing for Results: Agencies Should More Fully Develop Priority Goals  under the GPRA Modernization Act. GAO-13-174. Washington, D.C.:  April 19, 2013.

Security Clearances: Agencies Need Clearly Defined Policy for  Determining Civilian Position Requirements. GAO-12-800. Washington,  D.C.: July 12, 2012.

Personnel Security Clearances: Continuing Leadership and Attention Can  Enhance Momentum Gained from Reform Effort. GAO-12-815T.  Washington, D.C.: June 21, 2012.  2012 Annual Report: Opportunities to Reduce Duplication, Overlap and  Fragmentation, Achieve Savings, and Enhance Revenue.  GAO-12-342SP. Washington, D.C.: February 28, 2012.

Background Investigations: Office of Personnel Management Needs to  Improve Transparency of Its Pricing and Seek Cost Savings.  GAO-12-197. Washington, D.C.: February 28, 2012.

GAO’s 2011 High-Risk Series: An Update. GAO-11-394T. Washington,  D.C.: February 17, 2011.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  16, 2011.

Personnel Security Clearances: Overall Progress Has Been Made to  Reform the Governmentwide Security Clearance Process. GAO-11-232T.  Washington, D.C.: December 1, 2010.

Personnel Security Clearances: Progress Has Been Made to Improve  Timeliness but Continued Oversight Is Needed to Sustain Momentum.  GAO-11-65. Washington, D.C.: November 19, 2010.

DOD Personnel Clearances: Preliminary Observations on DOD’s  Progress on Addressing Timeliness and Quality Issues. GAO-11-185T.  Washington, D.C.: November 16, 2010.

Personnel Security Clearances: An Outcome-Focused Strategy and  Comprehensive Reporting of Timeliness and Quality Would Provide  Greater Visibility over the Clearance Process. GAO-10-117T.  Washington, D.C.: October 1, 2009.

Personnel Security Clearances: Progress Has Been Made to Reduce  Delays but Further Actions Are Needed to Enhance Quality and Sustain  Reform Efforts. GAO-09-684T. Washington, D.C.: September 15, 2009.

Personnel Security Clearances: An Outcome-Focused Strategy Is  Needed to Guide Implementation of the Reformed Clearance Process.  GAO-09-488. Washington, D.C.: May 19, 2009.

DOD Personnel Clearances: Comprehensive Timeliness Reporting,  Complete Clearance Documentation, and Quality Measures Are Needed  to Further Improve the Clearance Process. GAO-09-400. Washington,  D.C.: May 19, 2009.

High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January  2009.

Personnel Security Clearances: Preliminary Observations on Joint  Reform Efforts to Improve the Governmentwide Clearance Eligibility  Process. GAO-08-1050T. Washington, D.C.: July 30, 2008.

Personnel Clearances: Key Factors for Reforming the Security Clearance  Process. GAO-08-776T. Washington, D.C.: May 22, 2008.

Employee Security: Implementation of Identification Cards and DOD’s  Personnel Security Clearance Program Need Improvement.  GAO-08-551T. Washington, D.C.: April 9, 2008.

Personnel Clearances: Key Factors to Consider in Efforts to Reform  Security Clearance Processes. GAO-08-352T. Washington, D.C.:  February 27, 2008.

DOD Personnel Clearances: DOD Faces Multiple Challenges in Its Efforts  to Improve Clearance Processes for Industry Personnel. GAO-08-470T.  Washington, D.C.: February 13, 2008.

DOD Personnel Clearances: Improved Annual Reporting Would Enable  More Informed Congressional Oversight. GAO-08-350. Washington, D.C.:  February 13, 2008.

DOD Personnel Clearances: Delays and Inadequate Documentation  Found for Industry Personnel. GAO-07-842T. Washington, D.C.: May 17,  2007.

High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January  2007.

DOD Personnel Clearances: Additional OMB Actions Are Needed to  Improve the Security Clearance Process. GAO-06-1070. Washington,  D.C.: September 28, 2006.

DOD Personnel Clearances: New Concerns Slow Processing of  Clearances for Industry Personnel. GAO-06-748T. Washington, D.C.:  May 17, 2006.

DOD Personnel Clearances: Some Progress Has Been Made but Hurdles  Remain to Overcome the Challenges That Led to GAO’s High-Risk  Designation. GAO-05-842T. Washington, D.C.: June 28, 2005.

High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January  2005.