SCI refers to classified information concerning or derived from intelligence sources, methods, or analytical processes requiring exclusive handling within formal access control systems established by the Director of Central Intelligence. The Central Intelligence Agency (CIA) is responsible for adjudicating and granting all EOP requests for SCI access. According to the EOP Security Office, between January 1993 and May 1998, the CIA granted about 840 EOP employees access to SCI. Executive Order 12958, Classified National Security Information, prescribes a uniform system for classifying, safeguarding, and declassifying national security information and requires agency heads to promulgate procedures to ensure that the policies established by the order ensure that classified material is properly safeguarded, and establish and maintain a security self-inspection program of their classified activities. The order also gives the Director, Information Security Oversight Office (an organization under the National Archives and Records Administration), the authority to conduct on-site security inspections of EOP’s and other executive branch agencies’ classified programs. Office of Management and Budget Circular Number A-123, Management Accountability and Control, emphasizes the importance of having clearly documented and readily available procedures as a means to ensure that programs achieve their intended results. Director of Central Intelligence Directive 1/14, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information, lays out the governmentwide eligibility standards and procedures for access to SCI by all U.S. citizens, including government civilian and military personnel, contractors, and employees of contractors. The directive requires (1) the employing agency to determine that the individual has a need to know; (2) the cognizant Senior Official of the Intelligence Community to review the individual’s background investigation and reach a favorable suitability determination; and (3) the individual, once approved by the Senior Official of the Intelligence Community for SCI access, to sign a SCI nondisclosure agreement.Additional guidance concerning SCI eligibility is contained in Executive Order 12968, the U.S. Security Policy Board investigative standards and adjudicative guidelines implementing Executive Order 12968, and Director of Central Intelligence Directive 1/19. Governmentwide standards and procedures for safeguarding SCI material are contained in Director of Central Intelligence Directive 1/19, Security Policy for Sensitive Compartmented Information and Security Policy Manual. The EOP Security Office is part of the Office of Administration. The Director of the Office of Administration reports to the Assistant to the President for Management and Administration. The EOP Security Officer is responsible for formulating and directing the execution of security policy, reviewing and evaluating EOP security programs, and conducting security indoctrinations and debriefings for agencies of the EOP. Additionally, each of the nine EOP offices we reviewed has a security officer who is responsible for that specific office’s security program. As discussed with your office, we reviewed EOP procedures but did not verify whether the procedures were followed in granting SCI access to EOP employees, review EOP physical security practices for safeguarding classified material, conduct classified document control and accountability inspections, or perform other control tests of classified material over which the EOP has custody. (See pp. 8 and 9 for a description of our scope and methodology.) The EOP Security Officer told us that, for the period January 1993 until June 1996, (1) he could not find any EOP-wide procedures for acquiring access to SCI for the White House Office, the Office of Policy Development, the Office of the Vice President, the National Security Council, and the President’s Foreign Intelligence Advisory Board for which the former White House Security Office provided security support and (2) there were no EOP-wide procedures for acquiring access to SCI for the Office of Science and Technology Policy, the Office of the United States Trade Representative, the Office of National Drug Control Policy, and the Office of Administration for which the EOP Security Office provides security support. He added that there had been no written procedures for acquiring SCI access within the EOP since he became the EOP Security Officer in 1986. In contrast, we noted that two of the nine EOP offices we reviewed issued office-specific procedures that make reference to acquiring access to SCI—the Office of Science and Technology Policy in July 1996 and the Office of the Vice President in February 1997. According to the EOP Security Officer, draft EOP-wide written procedures for acquiring access to SCI were completed in June 1996 at the time the White House and EOP Security Offices merged. These draft procedures, entitled Security Procedures for the EOP Security Office, were not finalized until March 1998. While the procedures discuss the issuance of EOP building passes, they do not describe in detail the procedures EOP offices must follow to acquire SCI access; the roles and responsibilities of the EOP Security Office, security staffs of the individual EOP offices, and the CIA and others in the process; or the forms and essential documentation required before the CIA can adjudicate a request for SCI access. Moreover, the procedures do not address the practices that National Security Council security personnel follow to acquire SCI access for their personnel. For example, unlike the process for acquiring SCI access in the other eight EOP offices we reviewed, National Security Council security personnel (rather than the personnel in the EOP Security Office) conduct the employee pre-employment security interview; deal directly with the CIA to request SCI access; and, once the CIA approves an employee for access, conduct the SCI security indoctrination and oversee the individual’s signing of the SCI nondisclosure agreement. Director of Central Intelligence Directives 1/14 and 1/19 require that access to SCI be controlled under the strictest application of the need-to-know principle and in accordance with applicable personnel security standards and procedures. In exceptional cases, the Senior Official of the Intelligence Community or his designee (the CIA in the case of EOP employees) may, when it is in the national interest, authorize an individual access to SCI prior to completion of the individual’s security background investigation. At least since July 1996, according to the National Security Council’s security officer, his office has granted temporary SCI access to government employees and individuals from private industry and academia—before completion of the individual’s security background investigation and without notifying the CIA. He added, however, that this practice has occurred only on rare occasions to meet urgent needs. He said that this practice was also followed prior to July 1996 but that no records exist documenting the number of instances and the parties the National Security Council may have granted temporary SCI access to prior to this date. CIA officials responsible for adjudicating and granting EOP requests for SCI access told us that the CIA did not know about the National Security Council’s practice of granting temporary SCI access until our review. A senior EOP official told us that from July 1996 through July 1998, the National Security Council security officer granted 35 temporary SCI clearances. This official also added that, after recent consultations with the CIA, the National Security Council decided in August 1998 to refer temporary SCI clearance determinations to the CIA. The EOP-wide security procedures issued in March 1998 do not set forth security practices EOP offices are to follow in safeguarding classified information. In contrast, the Office of Science and Technology Policy and the Office of the Vice President had issued office-specific security procedures that deal with safeguarding SCI material. The Office of Science and Technology Policy procedures, issued in July 1996, were very comprehensive. They require that new employees be thoroughly briefed on their security responsibilities, advise staff on their responsibilities for implementing the security aspects of Executive Order 12958, and provide staff specific guidance on document accountability and other safeguard practices involving classified information. The remaining seven EOP offices that did not have office-specific procedures for safeguarding SCI and other classified information stated that they rely on Director of Central Intelligence Directive 1/19 for direction on such matters. Executive Order 12958 requires the head of agencies that handle classified information to establish and maintain a security self-inspection program. The order contains guidelines (which agency security personnel may use in conducting such inspections) on reviewing relevant security directives and classified material access and control records and procedures, monitoring agency adherence to established safeguard standards, assessing compliance with controls for access to classified information, verifying whether agency special access programs provide for the conduct of internal oversight, and assessing whether controls to prevent unauthorized access to classified information are effective. Neither the EOP Security Office nor the security staff of the nine EOP offices we reviewed have conducted security self-inspections as described in the order. EOP officials pointed out that security personnel routinely conduct daily desk, safe, and other security checks to ensure that SCI and other classified information is properly safeguarded. These same officials also emphasized the importance and security value in having within each EOP office experienced security staff responsible for safeguarding classified information. While these EOP security practices are important, the security self-inspection program as described in Executive Order 12958 provides for a review of security procedures and an assessment of security controls beyond EOP daily security practices. Executive Order 12958 gives the Director, Information Security Oversight Office, authority to conduct on-site reviews of each agency’s classified programs. The Director of the Information Security Oversight Office said his office has never conducted an on-site security inspection of EOP classified programs. He cited a lack of sufficient personnel as the reason for not doing so and added that primary responsibility for oversight should rest internally with the EOP and other government agencies having custody of classified material. The Director’s concern with having adequate inspection staff and his view on the primacy of internal oversight do not diminish the need for an objective and systematic examination of EOP classified programs by an independent party. An independent assessment of EOP security practices by the Information Security Oversight Office could have brought to light the security concerns raised in this report.