Security clearances are required for access to certain national security information, which is classified at one of three levels: top secret, secret, or confidential. The level of classification denotes the degree of protection required for information and the amount of damage that unauthorized disclosure could reasonably cause to national security. Executive Order 10450, which was originally issued in 1953, makes the heads of departments or agencies responsible for establishing and maintaining effective programs for ensuring that civilian employment and retention is clearly consistent with the interests of the national security. Agency heads are also responsible for designating positions within their respective agencies as sensitive if the occupant of that position could, by virtue of the nature of the position, bring about a material adverse effect on national security. In addition, Executive Order 12968, issued in 1995, is relevant to position designation because the order also makes the heads of agencies—including executive branch agencies and the military departments—responsible for establishing and maintaining an effective program to ensure that access to classified information by each employee is clearly consistent with the interests of national security. This order also states that, subject to certain exceptions, eligibility for access to classified information shall only be requested and granted on the basis of a demonstrated, foreseeable need for access. Further, part 732 of Title 5 of the Code of Federal Regulations provides requirements and procedures for the designation of national security positions, which include positions that (1) involve activities of the government that are concerned with the protection of the nation from foreign aggression or espionage, and (2) require regular use of or access to classified national security information. In addition, part 732 states that most federal government positions that could bring about, by virtue of the nature of the position, a material adverse effect on national security must be designated as a sensitive position and require a sensitivity level designation. The sensitivity level designation determines the type of background investigation required, with positions designated at a greater sensitivity level requiring a more extensive background investigation. Part 732 establishes three sensitivity levels—special-sensitive, critical-sensitive, and noncritical-sensitive— which are described in figure 1. According to OPM, positions that an agency designates as special-sensitive and critical-sensitive require a background investigation that typically results in a top secret clearance. Noncritical-sensitive positions typically require an investigation that supports a secret or confidential clearance. OPM also defines non- sensitive positions that do not have a national security element, but still require a designation of risk for suitability purposes. That risk level determines the type of investigation required for those positions. Those investigations include aspects of an individual’s character or conduct that may have an effect on the integrity or efficiency of his or her service. The personnel security clearance process begins when a human resources or security professional determines a position’s level of sensitivity, which includes consideration of whether or not a position requires access to classified information and, if required, the level of access. DHS and DOD follow a general process for determining whether a federal civilian position requires access to classified information, which informs whether a position requires a security clearance. This process is described in figure 1 below and is based on our review of the corresponding guidance and testimonial evidence gathered during interviews with DHS and DOD officials. In addition, a more thorough description of DHS and DOD component-level policies appears in appendix II. The personnel security clearance process is further described in appendix III. The increased demand for personnel with security clearances following the events of September 11, 2001, led GAO and others to identify delays and incomplete documentation in the security clearance process. In light of these concerns, Congress passed the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), which set objectives and established requirements for improving the clearance process, including improving the timeliness of the clearance process, achieving interagency reciprocity, establishing an integrated database to track investigative and adjudicative information, and evaluating available technology for investigations and adjudications. Executive Order 13467 calls for investigations of suitability and security to be aligned using consistent standards, to the extent practicable. predecessor that continues to focus on the reform effort—detailing reform-related plans, including a February 2010 strategic framework that established goals, performance measures, roles and responsibilities, and proposed metrics for determining the quality of security clearance investigations and adjudications. Those reports contained a reform plan that outlined a new seven-step process for end-to-end suitability and security clearance reform, see figure 2 below. According to ODNI officials, the first step—to “validate need,”—focuses on ensuring that the sensitivity level of positions is designated appropriately on the basis of mission needs, among other things. Separate from, but related to, security clearances are determinations of suitability that the executive branch uses to ensure individuals are suitable, based on character and conduct, for federal employment in their agency or position. Suitability requirements sometimes overlap with national security requirements. For example, the Department of Justice checks suitability to ensure that applicants for jobs with the Drug Enforcement Agency have never used illegal drugs. In addition, Health and Human Services checks the suitability of applicants for jobs working with children. Similarly, the Intelligence Community requires polygraph evaluations, among other things, to determine suitability for most intelligence positions. OPM was involved in many aspects of the suitability investigation process under Part 731 of Title 5 of the Code of Federal Regulations, prior to the issuance of Executive Order 13467 and, as the Suitability Executive Agent, the Director continues to be responsible for developing and implementing uniform and consistent policies and procedures to ensure the effective, efficient, and timely completion of background investigations and adjudications relating to determinations of suitability. In contrast, the DNI was assigned a new role. Executive Order 13467 states that the DNI, as the Security Executive Agent, is responsible for, among other things, developing uniform and consistent policies and procedures to ensure the effective, efficient, and timely completion of background investigations and adjudications relating to determinations of eligibility for access to classified information or eligibility to hold a sensitive position. In addition to these responsibilities, the Executive Order also provides the DNI the authority to issue guidelines and instructions to the heads of agencies to ensure appropriate uniformity, centralization, efficiency, effectiveness, and timeliness in processes relating to determinations by agencies of eligibility for access to classified information or eligibility to hold a sensitive position. The order also states that the Performance Accountability Council is responsible for ensuring that the Executive Agents align their respective processes. Finally, the order states that agency heads should implement any policy or procedure developed by either the Performance Accountability Council or Executive Agents under the order. The DNI, in the capacity as Security Executive Agent responsible for developing uniform and consistent policies related to the security clearance process, has expressed intent to issue guidance relating to national security positions. However, the DNI has not provided agencies with clearly defined policy through regulation or other guidance to help ensure that executive branch agencies use appropriate and consistent criteria when determining if positions require a security clearance. Instead, executive branch agencies are using a position designation tool developed by OPM. This tool is designed to determine the sensitivity level of civilian positions which, in turn, informs the type of background investigation needed if a clearance is warranted. The DNI, however, did not have a role in its development even though the two Executive Agents are to align their respective processes. As a result, agency officials we met expressed mixed views on the effectiveness of the tool for national security positions. According to Executive Order 13467, issued in June 2008, the DNI, as the Security Executive Agent, is responsible for developing uniform and consistent policies and procedures for determinations of eligibility for access to classified information or to hold a sensitive position. Further, the executive order states that agency heads shall assist the Performance Accountability Council and Executive Agents in carrying out any function under the order, which includes implementing any policies or procedures developed pursuant to the order. Although agency heads retain the flexibility to make determinations regarding which positions in their agency require a security clearance, the DNI is well positioned, by virtue of its role as the Security Executive Agent, to provide guidance to help align the process from agency to agency. The DNI, however, has not provided agencies with clearly defined policy or instructions. To assist with position designation, the Director of OPM—the Executive Agent for Suitability—has developed a process that includes a position designation system and corresponding automated tool to guide agencies in determining the proper sensitivity level for the majority of federal This tool—namely, the Position Designation of National positions.Security and Public Trust Positions—enables a user to evaluate a position’s national security and suitability requirements so as to determine a position’s sensitivity and risk levels, which in turn dictate the type of background investigation that will be required for the individual who will occupy that position. In most agencies outside the Intelligence Community, OPM conducts the background investigations for both suitability and security clearance purposes. The tool does not directly determine whether a position requires a clearance, but rather helps determine the sensitivity level of the position. The determination to grant a clearance is based on whether a position requires access to classified information or other relevant factors, and, if access is required, the responsible official will designate the position to require a clearance. OPM developed the position designation system and automated tool for multiple reasons. First, OPM determined through a 2007 initiative that its existing regulations and guidance for position designation were complex and difficult to apply, resulting in inconsistent designations. As a result of a recommendation from the initiative, OPM created a simplified position designation process in 2008. Additionally, OPM officials noted that the tool is to support the goals of the security and suitability reform efforts, which require proper designation of national security and suitability positions. OPM first introduced the automated tool in November 2008, and issued an update of the tool in 2010. In August 2010, OPM issued guidance (1) recommending all agencies that request OPM background investigations use the tool and (2) requiring agencies to use the tool for all positions in the competitive service, positions in the excepted service where the incumbent can be noncompetitively converted to the competitive service, and career appointments in the Senior Executive Service. Both DHS and DOD components use the tool. A DHS instruction requires personnel to designate all DHS positions by using OPM’s position sensitivity designation guidance, which is the basis of the tool. In addition, DOD issued guidance in September 2011 requiring its personnel to use OPM’s tool to determine the proper position sensitivity designation for new or vacant positions, including the establishment and reclassification of positions. ODNI officials told us that they believe OPM’s tool is useful for determining a position’s sensitivity level. However, despite the DNI’s responsibility for policy related to ensuring uniformity in the security clearance process, ODNI officials noted that the DNI did not have input into recent revisions of OPM’s position designation tool. DHS Management Instruction 121-01-007, Department of Homeland Security Personnel Suitability and Security Program (June 2009). the DNI as Executive Agents are still evolving, although Executive Order 13467 defines responsibilities for each Executive Agent. Accordingly, we found that the Director of OPM and the DNI have not fully collaborated in executing their respective roles in the process for determining position designations. For example, OPM has had long-standing responsibility for establishing standards with respect to suitability for most federal government positions. Accordingly, the sections of the tool to be used for evaluating a position’s suitability risk level are significantly more detailed than the sections designed to aid in designating the national security sensitivity level of the position. While most of OPM’s position designation system, which is the basis of the tool, is devoted to suitability issues, only two pages are devoted to national security issues, despite the reference to national security in its title. Moreover, OPM did not seek to collaborate with the DNI when updating the tool in 2010. Similarly, in 2010, OPM initiated revisions to the part of the Code of Federal Regulations that According to OPM and ODNI pertain to national security positions.officials, the revision is expected to clarify the standards for designating whether federal positions are national security sensitive, which will help agencies more accurately assess the sensitivity of a position. The sensitivity level includes consideration of whether a position is eligible for access to classified information and the level of access. Further, the revision is currently expected to update the definition of national security positions to include positions that could have a material impact on national security, but might not clearly fall within the current definition in part 732 of Title 5 of the Code of Federal Regulations. For example, such positions include those with duties that involve the protection of borders, ports, and critical infrastructure, as well as those with responsibilities related to public safety, law enforcement, and the protection of government information systems. During our review, human capital and security officials from DHS and DOD and the selected components affirmed that they were using the existing tool to determine the sensitivity level required by a position. However, in the absence of clearly defined policy from the DNI and the lack of collaborative input into the tool’s design, officials explained that they sometimes had difficulty in using the tool to designate the sensitivity level of national security positions. OPM regularly conducts audits of its executive branch customer agency personnel security and suitability programs, which include a review of position designation to assess the agencies’ alignment with OPM’s position designation guidance. In the audit reports we obtained, OPM found examples of inconsistency between agency position designation and OPM guidance, both before and after the implementation of OPM’s tool. For instance, prior to the implementation of the tool, in a 2006 audit of an executive branch agency, OPM found that its sensitivity designations differed from the agency’s designation in 13 of 23 positions. Specifically, OPM concluded that 11 positions were underdesignated, 1 position was overdesignated, and 1 position was adjusted. More recently, after the implementation of the tool, in an April 2012 audit of a DOD agency, OPM assessed the sensitivity levels of 39 positions, and OPM’s designations differed from the agency’s designations in 26 of those positions. In the April 2012 report, the DOD agency agreed with OPM’s recommendations related to position designation, and the audit report confirmed that the agency had submitted evidence of corrective action in response to the position designation recommendations. OPM provided us with the results of 10 audits that it had conducted between 2005 and 2012, and 9 of those audit reports reflected inconsistencies between OPM position designation guidance and determinations of position sensitivity conducted by the agency. OPM officials noted, however, that they do not have the authority to direct agencies to make different designations because Executive Order 10450 provides agency heads with the ultimate responsibility for designating which positions are sensitive positions. As of May 2012, the Naval Audit Service is currently finalizing its own internal audit on its top secret requirements determination process for civilian positions. While the results were not complete at the time of our review, officials explained to us that they began this audit to validate their top secret requirements and ensure that they have effective internal controls over their designation process. DHS and DOD officials expressed varying opinions regarding the tool. For instance, some of the officials we met raised concerns regarding the guidance provided through the tool and expressed that they had difficulty implementing it. Specifically, officials from DHS’s U.S. Immigration and Customs Enforcement stated that the use of the tool occasionally resulted in inconsistency, such as over- or underdesignating a position, and expressed a need for additional clear, easily interpreted guidance on designating national security positions. DOD officials stated that they have had difficulty implementing the tool because it focuses more on suitability than security, and the national security aspects of DOD’s positions are of more concern to them than the suitability aspects. Further, an official from DOD’s Office of the Under Secretary of Defense for Personnel and Readiness stated that the tool and DOD policy do not always align and that the tool does not cover the requirements for some DOD positions. For example, DOD’s implementing guidance on using the tool states that terms differ between DOD’s personnel security policy and the tool, and the tool might suggest different position sensitivity levels than DOD policy requires. Also, officials from the Air Force Personnel Security Office told us that they had challenges using the tool to classify civilian positions, including difficulty in linking the tool with Air Force practices for position designation. Moreover, an Air Force official stated a concern that the definition for national security positions is broadly written and could be considered to include all federal positions. Further, individuals responsible for making position designation determinations can easily reach different conclusions. For instance, officials from DHS’s U.S. Immigration and Customs Enforcement stated that the tool is not necessarily intuitive and users of the tool need to understand its nuances in order to avoid overdesignating a position. Conversely, officials from the U.S. Coast Guard stated that they found the tool to be intuitive, and that it helps to ensure consistency in designation. Finally, officials from the Transportation Security Administration noted that the tool is user friendly and provides consistency for managers. Recently, we have seen indications that the Executive Agents are working to align their respective processes. According to OPM’s website, OPM has conferred with the Office of Management and Budget (OMB) concerning the possibility of reissuing pertinent sections of the Code of Federal Regulations jointly with ODNI, with a targeted issuance before the end of the 2012 calendar year. ODNI officials also stated their intention to work with OPM on the revision effort. ODNI officials further acknowledged that they are collaborating with OPM to reach agreement on their respective roles as Executive Agents. Our prior work has found that two or more agencies with related goals can benefit from enhancing their collaboration in various areas to achieve common outcomes. According to Executive Order 12968, the number of employees that each agency determines is eligible for access to classified information shall be kept to the minimum required, and, subject to certain exceptions, eligibility shall be requested or granted only on the basis of a demonstrated, foreseeable need for access. Additionally, Executive Order 12968 states that access to classified information shall be terminated when an employee no longer has a need for access, and that requesting or approving eligibility for access in excess of the actual requirements is prohibited. Also, Executive Order 13467 authorizes the DNI to issue guidelines or instructions to the heads of agencies regarding, among other things, uniformity in determining eligibility for access to classified information. However, the DNI has not issued policies and procedures for agencies to review and revise or validate the existing clearance requirements for their federal civilian positions to ensure that clearances are kept to a minimum and reserved only for those positions with security clearance requirements that are in accordance with the national security needs of the time. As previously noted, OPM published a December 2010 notice in the Federal Register of a proposed revision to the Code of Federal Regulations to clarify the policy for designating national security positions. Again, as we previously noted, OPM’s website states that OPM has conferred with OMB concerning the possibility of reissuing pertinent sections of the Code of Federal Regulations jointly with ODNI. One feature of the proposed revision would require all federal agencies to conduct a onetime review of position descriptions and requirements over a period of 2 years to ensure that all positions are properly designated using the revision’s updated definition for national security positions. Position descriptions not only identify the major duties and responsibilities of the position, but they also play a critical role in recruitment, training, and performance management, among other things. While position descriptions may change, so can the national security environment as previously observed. During our review of several DHS and DOD components, we found that officials were aware of the need to keep the number of security clearances to a minimum but were not always subject to a requirement to review and validate the security clearance needs of existing positions on a periodic basis. We found, instead, that agencies’ policies provide for a variety of practices for reviewing the clearance needs of federal civilian positions. According to DHS guidance, supervisors are responsible for ensuring that (1) position designations are updated when a position undergoes major changes (e.g., changes in missions and functions, job responsibilities, work assignments, legislation, or classification standards), and (2) position security designations are assigned as new positions are created. Some components have additional requirements to review position designation more regularly to cover positions other than those newly created or vacant. For example, U.S. Coast Guard guidance states that hiring officials and supervisors should review position descriptions even when there is no vacancy and, as appropriate, either revise or review them. According to officials in U.S. Immigration and Customs Enforcement, supervisors are supposed to review position descriptions annually during the performance review process to ensure that the duties and responsibilities on the position description are up-to-date and accurate. However, officials stated that U.S. Immigration and Customs Enforcement does not have policies or requirements in place to ensure any particular level of detail in that review. DOD’s personnel security regulation and other guidancecomponents with criteria to consider when determining whether a position is sensitive or requires access to classified information, and some of the components also have developed their own guidance. provides DOD An Air Force Instruction requires commanders to review all military and civilian position designations annually to ensure proper level of access to classified information. The Army issued a memorandum in 2006 that required an immediate review of position sensitivity designations for all Army civilian positions by the end of the calendar year and requires subsequent reviews biennially. That memorandum further states that if a review warrants a change in position sensitivity affecting an individual’s access to classified information, then access should be administratively adjusted and the periodic reinvestigation submitted accordingly. However, officials explained that improper position sensitivity designations continue to occur in the Army because they have a limited number of personnel in the security office relative to workload, and they only spot check clearance requests to ensure that they match the level of clearance required. Officials from DOD’s Washington Headquarters Services told us that they have an informal practice of reviewing position descriptions and security designations for vacant or new positions, but they do not have a schedule for conducting periodic reviews of personnel security designations for already-filled positions. These various policies notwithstanding, agency officials told us that they are implemented inconsistently. Some of the components we met were in the process of conducting a onetime review of position designation during our review. For example, Transportation Security Administration officials stated that they reevaluated all of their position descriptions over the last 2 years because the agency determined that the re-evaluation of its position designations would improve operational efficiency by ensuring that positions were appropriately designated by using OPM’s updated position designation tool. Further, those officials told us that they review position descriptions as positions become vacant or are created. Between fiscal years 2010 and 2011, while the Transportation Security Administration’s overall workforce increased from 61,586 to 66,023, the number of investigations for top secret clearances decreased from 1,483 to 1,127. In March 2011, the Naval Audit Service begin an audit of its top secret requirements determination process for civilian positions at selected activities to verify that civilian top secret clearances are based on valid requirements and that effective internal controls over the top secret requirements determination process are in place. According to a Navy official, the results of the audit were still undergoing the Navy’s internal review process as of May 2012. There is a cost to conducting background investigations, and a potential for dollar savings when overdesignated positions are identified. DHS and DOD officials acknowledged to us that overdesignating a position can result in expenses for unnecessary investigations. When a position is overdesignated, additional resources are unnecessarily spent conducting the investigation and adjudication of a background investigation that exceeds agency requirements. As stated earlier in this report, the investigative workload for a top secret clearance is about 20-times greater than that of a secret clearance because it must be periodically reinvestigated twice as often as secret clearance investigations (every 5 years versus every 10 years) and requires 10 times as many investigative staff hours. The fiscal year 2012 base price for a top secret clearance investigation conducted by OPM is $4,005 and the periodic reinvestigation is $2,711, while the base price of an investigation for a secret clearance is $260. Further, the base price of a Moderate Risk Background Investigation—most commonly used by DHS, according to officials—is $752. However, we did not find policies in which position designation reviews were linked to the position holders’ periodic reinvestigations. In contrast, underdesignating a position carries security risks, such as the potential release of classified information or the placement of a person in a position for which they have not been properly cleared. Agencies employ varying practices because the DNI has not established a requirement that executive branch agencies consistently review and revise or validate existing position designations on a recurring basis. Such a recurring basis could include reviewing position designations during the periodic reinvestigation process. Without a requirement to consistently review, revise, or validate existing security clearance position designations, executive branch agencies—such as DHS and DOD—may be hiring and budgeting for both initial and periodic security clearance investigations using position descriptions and security clearance requirements that no longer reflect national security needs. Finally, since reviews are not being done consistently, DHS and DOD and other executive branch agencies cannot have reasonable assurances that they are keeping to a minimum the number of positions that require security clearances on the basis of a demonstrated and foreseeable need for access. Executive Order 13467, issued in June 2008, established a Suitability and Security Clearance Performance Accountability Council and appointed the DNI as the Security Executive Agent and the Director of OPM as the Suitability Executive Agent. However, while the order gives the Executive Agents the authority to issue policy, the DNI has not provided executive branch agencies with clearly defined policy and procedures for determining whether federal civilian positions require a security clearance. Until the DNI articulates such policy and procedures, executive branch agencies, such as DHS and DOD, will not have a foundation on which to build consistent and uniform policies. Further, Executive Order 13467 indicates that executive branch policies and procedures relating to, among other things, suitability and eligibility for access to classified information shall be aligned using consistent standards to the extent possible. However, OPM updated its position designation tool in 2010 without input from the DNI. Without collaborative input from both OPM and DNI in future revisions to the tool, executive branch agencies will continue to risk making security clearance determinations that are inconsistent or at improper levels. Finally, while Executive Order 12968 says that clearances should, subject to certain exceptions, be granted only on the basis of a demonstrated need for access and kept to a minimum, the DNI has not issued guidance that requires agencies to review and revise or validate their existing federal civilian position designations. Until the DNI does so, DHS and DOD, along with other executive branch agencies, cannot have reasonable assurances that all security clearance designations are correct, which could compromise national security if positions are underdesignated, or create unnecessary and costly investigative coverage if positions are overdesignated. We recommend that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue clearly defined policy and procedures for federal agencies to follow when determining if federal civilian positions require a security clearance. In addition, we recommend that, once the policy and procedures are issued, the DNI and the Director of OPM collaborate in their respective roles as Executive Agents to revise the position designation tool to reflect that guidance. Finally, we recommend that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue guidance to require executive branch agencies to periodically review and revise or validate the designation of all federal civilian positions. We provided a draft of this report to ODNI, OPM, DHS, and DOD for comment. Written comments from ODNI, OPM, and DHS are reprinted in their entirety in appendices IV, V, and VI respectively. Technical comments were provided separately by ODNI, OPM, and DHS, and were incorporated as appropriate. DOD concurred with the report without written comment. We also provided a draft of the report to OMB for information purposes. In commenting on this report, ODNI stated that the report is a fair assessment of existing executive branch policies for determining security clearance requirements for federal civilian positions. The DNI has a lead or collaborative role in our recommendations, and ODNI concurred with all three. First, ODNI concurred with our recommendation that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue clearly defined policy and procedures for federal agencies to follow when determining if federal civilian positions require a security clearance. ODNI agreed that executive branch agencies require simplified and uniform policy guidance to assist in determining appropriate sensitivity designations, and cited steps it is taking in coordination with OPM, DOD, and OMB. Specifically, ODNI acknowledged its work with OMB and OPM to jointly issue revisions to part 732 of Title 5 of the Code of Federal Regulations by the end of 2012. Second, ODNI concurred with our recommendation that, once the policy and procedures are issued, the DNI coordinate with the Director of OPM to revise the position designation tool to reflect that guidance. ODNI stated that it plans to work with OPM and other executive branch agencies through the Security Executive Agent Advisory Committee to develop a position designation tool that provides detailed descriptions of the types of positions where the occupant could bring about a material adverse impact to national security due to the duties and responsibilities of the position. ODNI stated its belief that a tool that provides agencies with detailed descriptions of this type will bring about greater uniformity across the government in agency position designations. Third, ODNI concurred with our recommendation that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue guidance to require executive branch agencies to periodically review and revise or validate the designation of all federal civilian positions. ODNI agreed with our assessment that the duties and responsibilities of federal positions may be subject to change, and stated that it plans to work with OPM and other executive branch agencies through the Security Executive Agent Advisory Committee to ensure that position designation policies and procedures include a provision for periodic reviews. While ODNI recognized that the emphasis of this report is on civilian positions that require access to classified information, it wished to emphasize that the DNI’s role as Security Executive Agent under Executive Order 13467 applies to all sensitive positions, and that positions that require access to classified information are a subset of all sensitive positions. ODNI stated that any guidance issued by the Security Executive Agent will cover all sensitive positions and associated investigative standards and adjudicative guidelines. OPM also commented on all three of the recommendations in this report in its written comments. OPM concurred with our second recommendation, which is addressed more directly to OPM, that its Director collaborate with the DNI in their respective roles as executive agents to revise the position designation tool to reflect updated federal position designation guidance. OPM stated that it committed to doing so in a February 2010 strategic framework document which was executed by officials within OMB, OPM, DOD, and ODNI. OPM also acknowledged that any revisions to the tool need to await final action with respect to proposed position designation regulations, which is consistent with our recommendation. In addition, OPM summarized executive orders that describe its authority. OPM also supported our third recommendation that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue guidance to require executive branch agencies to periodically review and revise or validate the designation of all federal civilian positions. OPM stated that it would be pleased to work with the DNI on guidance concerning periodic reviews of existing designations. While ODNI concurred with our first recommendation—that the DNI, in coordination with the Director of OPM and other executive branch agencies as appropriate, issue clearly defined policy and procedures for federal agencies to follow when determining whether federal civilian positions require a security clearance—OPM stated that it is not clear to OPM that it has a significant role in prescribing the policy and procedures for federal agencies to follow when determining if a federal civilian position requires a security clearance. The basis for OPM’s statement is Executive Order 12968 (as amended by Executive Order 13467), which gives agency heads the ultimate responsibility to grant or deny security clearances, subject to investigative standards and adjudicative guidelines prescribed by the DNI. In this report, we acknowledge that authority to grant or deny a security clearance resides with agency heads under Executive Order 12968. However, as we also state in our report, Executive Order 13467 provides the DNI the authority to issue guidelines and instructions to the heads of agencies to ensure appropriate uniformity, centralization, efficiency, effectiveness, and timeliness in processes relating to determinations by agencies of eligibility for access to classified information or eligibility to hold a sensitive position. Further, as we state in our report, this Executive Order established a Suitability and Security Clearance Performance Accountability Council to be the government-wide governance structure responsible for driving implementation and overseeing security and suitability reform efforts. This order appointed the DNI as the Security Executive Agent and the Director of OPM as the Suitability Executive Agent, and calls for investigations of suitability and security to be aligned using consistent standards, to the extent practicable. Therefore, we continue to believe that additional guidance from the Security Executive Agent—the DNI—would help align processes across multiple executive branch agencies, and note that ODNI agreed with this assessment. Further, we included OPM in our recommendation as a consulting agency in its role as the Suitability Executive Agent and because, according to OPM, it is the investigative service provider for much of the executive branch. Finally, we recommended that the DNI work with other agencies as necessary in an acknowledgement of the joint nature of reform effort and its oversight structure through the Performance Accountability Council. OPM’s response to this report discussed other points for consideration, which are summarized below. Relationship between the existing position designation tool and security clearances: OPM stated in its comments that one of the premises upon which this report is based is not accurate. Specifically, OPM asserted that we repeatedly posited that agencies must perform the national security designation in order to know whether the occupant will require a security clearance when, in fact, whether the occupant of a particular position will need access to classified information or eligibility for such access (i.e. a security clearance) is one of the factors that help determine whether a position is sensitive. Accordingly, OPM wrote that there is no basis for GAO to conclude that OPM’s position designation tool affects how agencies determine whether the occupant of a position requires access to classified information or eligibility for such access. We state in our report that to assist with position designation, the Director of OPM has developed a process that includes a position designation system and corresponding tool. We continue by stating that the tool does not directly determine whether a position requires a clearance, but rather helps determine the sensitivity of the position, which informs the type of investigation needed. We believe that these statements are consistent with OPM’s explanations and, therefore, do not believe that one of the premises upon which this report is based is inaccurate. However, we have reviewed and made revisions to other statements in our final report to ensure consistency with this point. Additional need for guidance to support the position designation tool: OPM noted that it provided us with copies of audits that OPM had performed on agencies that employ competitive service civilian personnel, where it observed inconsistencies in agency application of the tool. In its comments, OPM cited several reasons why this might happen. We believe this is consistent with our findings that OPM found examples of inconsistency between agency position designation and OPM guidance, and also that officials from executive branch departments expressed varying opinions to us regarding the tool. In response to other discussion in our report about the tool, OPM stated that its proposed revision to part 732 of Title 5 of the Code of Federal Regulations was intended to establish a basis for more detailed guidance. We also note, as previously discussed, that OPM concurred with our recommendation to collaborate with the DNI to revise the tool. In its written comments, DHS noted GAO’s positive acknowledgement of DHS’ efforts to ensure that only those who need a security clearance are authorized one. Although the report does not contain any recommendations specifically directed to DHS, the Department stated that it remains committed to being an active member of the government- wide Suitability and Security Clearance Performance Accountability Council. We are sending copies of this report to the House Committee on Homeland Security. We are also sending copies to the Director of National Intelligence, the Director of the Office of Personnel Management, the Secretary of Homeland Security, the Secretary of Defense, and the Office of Management and Budget. This report will also be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VII. This report reviewed government policies and practices for identifying federal civilian positions that require security clearances, and analyzed whether a uniform, consistent, and effective security clearance requirements determination process is in place. Our work focused on the Office of the Director of National Intelligence (ODNI), on the basis of its role to develop personnel security clearance policy and guidance for the federal government. Further, the scope of our work focused more specifically on the security clearance requirements of federal civilian positions from selected components within the Department of Homeland Security (DHS) and the Department of Defense (DOD), because of the volume of clearances that these two agencies process. Within DHS, selected components include the U.S. Coast Guard, U.S. Immigration and Customs Enforcement, and the Transportation Security Administration. Within DOD, selected components include the headquarters level elements of the Departments of the Army, the Navy, the Air Force, and the Washington Headquarters Services. We also included the Office of Personnel Management (OPM) in our review on the basis of its role implementing security clearance reform and as the primary investigative service provider of the federal government. See table 1 for a complete list of the agencies and departments interviewed for our review. To determine the extent to which the executive branch has established policies and procedures for agencies to use when first determining whether federal civilian positions require a security clearance, we interviewed key federal officials from the above mentioned federal agencies and selected components, as well as OPM and ODNI. We reviewed relevant Executive Orders including 10450, 12968, and 13467, Joint Reform Team reports, OPM and ODNI audits, and part 732 of Title 5 of the Code of Federal Regulations. We also reviewed OPM’s proposed revision to the Code of Federal Regulations, which aims to clarify the policy for designating national security positions that was published in the Federal Register in December 2010. We obtained and analyzed personnel security clearance policies within DHS, DOD, and the selected components within these departments to identify the extent to which they have outlined processes for individuals responsible for determining if federal civilian positions require a security clearance. In addition, we obtained and analyzed OPM’s position designation system and tool because agencies we visited use the tool in the position designation process. To determine the extent to which the executive branch has established policies and procedures for agencies to review and revise or validate existing federal civilian position security clearance requirements, we interviewed knowledgeable officials from the federal agencies and selected components in table 1. We reviewed part 732 of Title 5 of the Code of Federal Regulations to identify the extent to which it delineates processes and responsibilities for federal agencies to review and revise or validate whether federal civilian positions require a security clearance. We also analyzed DHS’s and DOD’s personnel security policies, and the applicable policies of selected components within these departments to identify the extent to which each department and selected component has established processes for reviewing, revising, and validating existing federal civilian position security clearance requirements. We conducted this performance audit from July 2011 through July 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our objectives. The Department of Homeland Security (DHS), the Department of Defense (DOD), and their respective components have developed policies and procedures that relate to position designation. Both DHS and DOD policies provide criteria, in addition to those outlined in the Office of Personnel Management’s (OPM) tool, for position designating officials to use in determining the sensitivity level of the position. Table 2 below provides a descriptive comparison of DHS- and DOD-specific position designation guidance. DHS’s management instruction regarding the personnel security and suitability program (DHS Management Instruction 121-01-007) defines sensitivity levels and instructs the DHS components to follow OPM’s position sensitivity designation guidance when determining the proper sensitivity level for civilian positions. Further, the supervising official with sufficient knowledge of duty assignments is responsible for collaborating with Human Resources and assigning position sensitivity designations and then those designations are subject to final approval by the component’s respective Personnel Security Office. Immigration and Customs Enforcement: In addition to DHS’s management directive, Immigration and Customs Enforcement officials confirmed that they are using OPM’s position sensitivity designation guidance and position designation tool to ensure that their civilian positions have the proper sensitivity level. According to these officials, the Immigration and Customs Enforcement’s Office of Professional Responsibility and Office of Human Capital work with the program offices to establish and validate position security designations. Transportation Security Administration: In addition to DHS’s management directive, the Transportation Security Administration developed informal guidance on the position designation process and uses OPM’s position designation tool to determine the sensitivity level for its positions. The Transportation Security Administration Personnel Security Section requires the manager to confirm that access to classified information is required to perform the duties of the position. In addition, the Transportation Security Administration’s Personnel Security Section does a final review of all position and risk designations. U.S. Coast Guard: According to U.S. Coast Guard officials, the U.S. Coast Guard follows the criteria for position designation laid out in the Commandant of the Coast Guard Instruction 5520.12C, Personnel Security and Suitability Program. In addition, those officials indicated that the U.S. Coast Guard uses OPM’s position designation tool for determining the sensitivity level for civilian positions. As part of a standard hiring practice, supervisors engage Human Resources with a request for personnel action. This initiates the prerecruitment phase of the process where the need of the position is validated, the position description is reviewed and updated, the job analysis is confirmed, and the recruitment strategy is executed. provide the DOD’s personnel security regulation and other guidanceDOD components with detailed criteria to consider when determining whether a position requires access to classified information. Although DOD’s policy is also under revision, the current policy incorporates OPM’s definitions for critical-sensitive and noncritical sensitive positions. Further, DOD’s regulation specifically states that personnel security clearances shall not normally be issued: to persons in nonsensitive positions; to persons whose regular duties do not require authorized access to classified information; for ease of movement of persons within a restricted area whose duties do not require access to classified information; to persons who may only have inadvertent access to sensitive information or areas, such as guards, emergency service personnel, firefighters, doctors, nurses, police, ambulance drivers, or similar personnel; to persons working in shipyards whose duties do not require access to classified information; to persons who can be prevented from accessing classified information by being escorted by cleared personnel; to food service personnel, vendors and similar commercial sales or service personnel whose duties do not require access to classified information; to maintenance or cleaning personnel who may only have inadvertent access to classified information unless such access cannot be reasonably prevented; to persons who perform maintenance on office equipment, computers, typewriters, and similar equipment who can be denied classified access by physical security measures; to perimeter security personnel who have no access to classified information; and to drivers, chauffeurs and food service personnel. In addition, DOD’s Under Secretary of Defense for Personnel and Readiness issued a memorandum requiring the use of OPM’s position designation system and tool to determine the sensitivity level for civilian positions. Further, some of the DOD components that we visited have developed policies that extend beyond the DOD personnel security policy. Army: Army officials affirmed that they use OPM’s position designation tool to determine the sensitivity level of all civilian positions. In addition, Army Regulation 380-67 defines sensitive positions and gives heads of DOD components or their designees authority, subject to certain conditions, to delegate the designation of position sensitivity within their chain of command. Further, a 2006 Army memorandum called for sensitivity reviews of all Army civilian positions every 2 years, at a minimum. Navy: According to officials, the Department of the Navy follows guidance in the Secretary of the Navy Regulation M-5510.30 along with DOD’s personnel security regulation, which requires designators to set the clearance level for civilian personnel according to the risk the position poses. According to a Navy personnel security official, Human Resources offices and local commands have been revalidating positions according to the needs of the command in response to a 2011 memorandum from the Assistant Secretary of the Navy for Manpower and Reserve Affairs. According to Navy officials, Human Resources offices used the position designation tool provided by OPM to determine the sensitivity level for all civilian positions. Air Force: The Air Force uses Air Force Instruction 31-501 coupled with the DOD 5200.2-R to implement its personnel security program. According to the instruction, commanders with position designation authority determine the security sensitivity of civilian positions. Each position is coded with the appropriate security access requirement and identified in the unit manning document and the Defense Civilian Personnel Data System. If the security access requirement code requires a change, the unit commander submits an authorization change request to the servicing security activity. The commander also conducts an annual review of positions to determine the accuracy of position coding and adjust coding if necessary. Air Force officials confirmed that they are using OPM’s Position Designation System and Tool to determine the proper sensitivity level for all civilian positions. Also, according to Air Force officials, in situations where a commander wants to upgrade a particular position, it must be reviewed and approved by a 3-star general. Washington Headquarters Services: Washington Headquarters Services oversees position designation for certain DOD headquarters activities and defense agencies. According to Washington Headquarters Services officials, these agencies and activities follow DOD’s personnel security regulation for position designation and use OPM’s position designation system and tool in accordance with DOD policy. Since 1997, federal agencies have followed a common set of personnel security investigative standards and adjudicative guidelines for determining whether federal workers and others are eligible to receive security clearances. Once an applicant is selected for a position that requires a security clearance, government agencies rely on a multiphased personnel security clearance process that includes the application submission phase, investigation phase, and adjudication phase, among others. Different departments and agencies may have slightly different security clearance processes—the steps outlined below are intended to be illustrative of a typical process. The application submission phase. A security officer from an executive branch agency (1) requests an investigation of an individual requiring a clearance; (2) forwards a personnel security questionnaire (Standard Form 86) using the Office of Personnel Management’s (OPM) e-QIP system or a paper copy of the Standard Form 86 to the individual to complete; (3) reviews the completed questionnaire; and (4) sends the questionnaire and supporting documentation, such as fingerprints and signed waivers, to OPM or the investigation service provider. The investigation phase. Federal investigative standards and OPM’s internal guidance are typically used to conduct and document the investigation of the applicant. The scope of information gathered in an investigation depends on the level of clearance needed and whether the investigation is for an initial clearance or a reinvestigation for a clearance renewal. For example, in an investigation for a top secret clearance, investigators gather additional information through more time-consuming efforts, such as traveling to conduct in-person interviews to corroborate information about an applicant’s employment and education. After the investigation is complete, the resulting investigative report is provided to the agency. The adjudication phase. Adjudicators from an agency use the information from the investigative report to determine whether an applicant is eligible for a security clearance. To make clearance eligibility decisions, the adjudication guidelines specify that adjudicators consider 13 specific areas that elicit information about (1) conduct that could raise security concerns and (2) factors that could allay those security concerns and permit granting a clearance. In addition, once the background investigation and adjudication for a security clearance are complete, the requesting agency determines whether the individual is eligible for access to classified information. However, often the security clearance—either at the secret or top secret level—does not become effective until an individual needs to work with classified information. At that point, the individual would sign a nondisclosure agreement and receive a briefing in order for the clearance to become effective. DOD commonly employs this practice and, in some cases, the individual ultimately never requires access to classified information. Therefore, not all security clearance investigations result in an active security clearance. Finally, once an individual is in a position that requires access to classified national security information, that individual is reinvestigated periodically at intervals that are dependent on the level of security clearance. For example, top secret clearanceholders are reinvestigated every 5 years, and secret clearanceholders are reinvestigated every 10 years. In addition to the contact named above, David Moser (Assistant Director), Sara Cradic, Cynthia Grant, Nicole Harris, Jeffrey Heit, Kimberly Mayo, Richard Powelson, Jason Wildhagen, Michael Willems, and Elizabeth Wood made key contributions to this report. Personnel Security Clearances: Continuing Leadership and Attention Can Enhance Momentum Gained from Reform Effort. GAO-12-815T. Washington, D.C.: June 21, 2012. Background Investigations: Office of Personnel Management Needs to Improve Transparency of Its Pricing and Seek Cost Savings. GAO-12-197. Washington, D.C.: February 28, 2012. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. Personnel Security Clearances: Overall Progress Has Been Made to Reform the Governmentwide Security Clearance Process. GAO-11-232T. Washington, D.C.: December 1, 2010. Personnel Security Clearances: Progress Has Been Made to Improve Timeliness but Continued Oversight Is Needed to Sustain Momentum. GAO-11-65. Washington, D.C.: November 19, 2010. DOD Personnel Security Clearance Reform: Preliminary Observations on Timeliness and Quality. GAO-11-185T. Washington, D.C.: November 16, 2010. Privacy: OPM Should Better Monitor Implementation of Privacy-Related Policies and Procedures for Background Investigations. GAO-10-849. Washington, D.C.: September 7, 2010. Personnel Security Clearances: An Outcome-Focused Strategy and Comprehensive Reporting of Timeliness and Quality Would Provide Greater Visibility over the Clearance Process. GAO-10-117T. Washington, D.C.: October 1, 2009. Personnel Security Clearances: Progress Has Been Made to Reduce Delays but Further Actions Are Needed to Enhance Quality and Sustain Reform Efforts. GAO-09-684T. Washington, D.C.: September 15, 2009. Personnel Security Clearances: An Outcome-Focused Strategy Is Needed to Guide Implementation of the Reformed Clearance Process. GAO-09-488. Washington, D.C.: May 19, 2009. DOD Personnel Clearances: Comprehensive Timeliness Reporting, Complete Clearance Documentation, and Quality Measures Are Needed to Further Improve the Clearance Process. GAO-09-400. Washington, D.C.: May 19, 2009. High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 22, 2009. DOD Personnel Clearances: Preliminary Observations about Timeliness and Quality. GAO-09-261R. Washington, D.C.: December 19, 2008. Personnel Security Clearances: Preliminary Observations on Joint Reform Efforts to Improve the Governmentwide Clearance Eligibility Process. GAO-08-1050T. Washington, D.C.: July 30, 2008. Personnel Clearances: Questions for the Record Regarding Security Clearance Reform. GAO-08-965R. Washington, D.C.: July 14, 2008. Personnel Clearances: Key Factors for Reforming the Security Clearance Process. GAO-08-776T. Washington, D.C.: May 22, 2008. Employee Security: Implementation of Identification Cards and DOD’s Personnel Security Clearance Program Need Improvement. GAO-08-551T. Washington, D.C.: April 9, 2008. DOD Personnel Clearances: Questions for the Record Related to the Quality and Timeliness of Clearances. GAO-08-580R. Washington D.C.: March 25, 2008. DOD Personnel Clearances: DOD Faces Multiple Challenges in Its Efforts to Improve Clearance Processes for Industry Personnel. GAO-08-470T. Washington, D.C.: February 12, 2008. Personnel Clearances: Key Factors to Consider in Efforts to Reform Security Clearance Processes. GAO-08-352T. Washington, D.C.: February 27, 2008. DOD Personnel Clearances: Improved Annual Reporting Would Enable More Informed Congressional Oversight. GAO-08-350. Washington, D.C.: February 13, 2008. DOD Personnel Clearances: Delays and Inadequate Documentation Found for Industry Personnel. GAO-07-842T. Washington, D.C.: May 17, 2007. High Risk Series: An Update. GAO-07-310. Washington, D.C.: January 2007. DOD Personnel Clearances: Additional OMB Actions Are Needed to Improve the Security Clearance Process. GAO-06-1070. Washington, D.C.: September 28, 2006. DOD Personnel Clearances: Questions and Answers for the Record Following the Second in a Series of Hearings on Fixing the Security Clearance Process. GAO-06-693R. Washington, D.C.: June 14, 2006. DOD Personnel Clearances: New Concerns Slow Processing of Clearances for Industry Personnel. GAO-06-748T. Washington, D.C.: May 17, 2006. DOD Personnel Clearances: Funding Challenges and Other Impediments Slow Clearances for Industry Personnel. GAO-06-747T. Washington, D.C.: May 17, 2006. Questions for the Record Related to DOD’s Personnel Security Clearance Program and the Government Plan for Improving the Clearance Process. GAO-06-323R. Washington, D.C.: January 17, 2006. DOD Personnel Clearances: Government Plan Addresses Some Long- standing Problems with DOD’s Program, But Concerns Remain. GAO-06-233T. Washington, D.C.: November 9, 2005. DOD Personnel Clearances: Some Progress Has Been Made but Hurdles Remain to Overcome the Challenges That Led to GAO’s High-Risk Designation. GAO-05-842T. Washington, D.C.: June 28, 2005. High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 2005.

Summary: Security clearances allow personnel access to classified information that, through unauthorized disclosure, can, in some cases, cause exceptionally grave damage to U.S. national security. In 2011, the DNI reported that over 4.8 million federal government and contractor employees held or were eligible for a clearance. To safeguard classified data and manage costs, agencies need an effective process to determine whether civilian positions require a clearance. GAO was asked to examine the extent to which the executive branch has established policies and procedures for agencies to use when (1) first determining if federal civilian positions require a security clearance and (2) reviewing and revising or validating existing federal civilian position security clearance requirements. GAO reviewed executive orders and the Code of Federal Regulations and met with officials from ODNI and OPM because of their Directors assigned roles as Security and Suitability executive agents, as well as DHS and DOD based on the volume of clearances they process. The Director of National Intelligence (DNI), as Security Executive Agent, has not provided agencies clearly defined policy and procedures to consistently determine if a position requires a security clearance. Executive Order 13467 assigns DNI responsibility for, among other things, developing uniform and consistent policies to determine eligibility for access to classified information, and gives the DNI authority to issue guidance to agency heads to ensure uniformity in processes relating to those determinations. In the absence of this guidance, agencies are using an Office of Personnel Management (OPM) tool that OPM designed to determine the sensitivity and risk levels of civilian positions which, in turn, inform the type of investigation needed. OPM audits, however, found inconsistency in these position designations, and some agencies described problems in implementing OPMs tool. In an April 2012 audit, OPM reviewed the sensitivity levels of 39 positions in an agency within the Department of Defense (DOD) and reached different conclusions than the agency for 26 of them. Problems exist, in part, because OPM and the Office of the Director of National Intelligence (ODNI) did not collaborate on the development of the position designation tool, and because their roles for suitabilityconsideration of character and conduct for federal employmentand security clearance reform are still evolving. Without guidance from the DNI, and without collaboration between the DNI and OPM in future revisions to the tool, executive branch agencies will continue to risk making security clearance determinations that are inconsistent or at improper levels. The DNI also has not established guidance to require agencies to review and revise or validate existing federal civilian position designations. Executive Order 12968 says each agency shall request or grant clearance determinations, subject to certain exceptions, based on a demonstrated need for access, and keep to a minimum the number of employees that it determines are eligible for access to classified information. The order also states that access to classified information shall be terminated when an employee no longer has a need for access, and prohibits agencies from requesting or approving eligibility in excess of actual requirements for access. During this review of Department of Homeland Security (DHS) and DOD components, GAO found that agency officials were aware of the need to keep the number of security clearances to a minimum, but were not always required to conduct periodic reviews and validations of the security clearance needs of existing positions. Overdesignating positions results in significant cost implications, given that the fiscal year 2012 base price for a top secret clearance investigation conducted by OPM is $4,005, while the base price of a secret clearance is $260. Conversely, underdesignating positions could lead to security risks. GAO found that the agencies follow varying practices because the DNI has not established guidance that requires executive branch agencies to review and revise or validate position designations on a recurring basis. Without such a requirement, executive branch agencies may be hiring and budgeting for initial and periodic security clearance investigations using position descriptions and security clearance requirements that no longer reflect national security needs. Further, since reviews are not done consistently, DHS and DOD and other executive branch agencies cannot have assurances that they are keeping the number of positions that require security clearances to a minimum. GAO recommends that the DNI issue clearly defined policy for agencies to follow when determining if federal civilian positions require a security clearance, and that the DNI and Director of OPM collaborate to revise the existing position designation tool. GAO further recommends that the DNI issue guidance to require agencies to periodically review and revise or validate the designation of their existing federal civilian positions. ODNI and OPM concurred, although OPM raised concerns with which GAO disagrees and addresses in the report.