The Executive Branch Has Not Issued Clearly Defined Policy Guidance for Determining When a Federal Civilian Position Needs a Security Clearance

The DNI, in the capacity as Security Executive Agent responsible for  developing uniform and consistent policies related to the security  clearance process, has expressed intent to issue guidance relating to  national security positions. OPM Has Developed a Tool to Help Agencies Determine the Proper Sensitivity Level for Most Federal Positions, but the Tool Lacks Input from the DNI

To assist with position designation, the Director of OPM—the Executive  Agent for Suitability—has developed a process that includes a position  designation system and corresponding automated tool to guide agencies  in determining the proper sensitivity level for the majority of federal   This tool—namely, the Position Designation of National  positions.Security and Public Trust Positions—enables a user to evaluate a  position’s national security and suitability requirements so as to determine  a position’s sensitivity and risk levels, which in turn dictate the type of  background investigation that will be required for the individual who will  occupy that position. More  recently, after the implementation of the tool, in an April 2012 audit of a  DOD agency, OPM assessed the sensitivity levels of 39 positions, and  OPM’s designations differed from the agency’s designations in 26 of  those positions. The Executive Branch Does Not Have a Consistent Process for Reviewing and Validating Existing Security Clearance Requirements for Civilian Positions

According to Executive Order 12968, the number of employees that each  agency determines is eligible for access to classified information shall be  kept to the minimum required, and, subject to certain exceptions, eligibility  shall be requested or granted only on the basis of a demonstrated,  foreseeable need for access. Additionally, Executive Order 12968 states  that access to classified information shall be terminated when an  employee no longer has a need for access, and that requesting or  approving eligibility for access in excess of the actual requirements is  prohibited. Also, Executive Order 13467 authorizes the DNI to issue  guidelines or instructions to the heads of agencies regarding, among  other things, uniformity in determining eligibility for access to classified  information. During our review of several DHS and DOD components, we found that  officials were aware of the need to keep the number of security  clearances to a minimum but were not always subject to a requirement to  review and validate the security clearance needs of existing positions on  a periodic basis. The fiscal year 2012 base price for a top secret clearance  investigation conducted by OPM is $4,005 and the periodic  reinvestigation is $2,711, while the base price of an investigation for a  secret clearance is $260. Agencies employ varying practices because the DNI has not established  a requirement that executive branch agencies consistently review and  revise or validate existing position designations on a recurring basis. Without a requirement to  consistently review, revise, or validate existing security clearance position  designations, executive branch agencies—such as DHS and DOD—may  be hiring and budgeting for both initial and periodic security clearance  investigations using position descriptions and security clearance  requirements that no longer reflect national security needs. Finally, since  reviews are not being done consistently, DHS and DOD and other  executive branch agencies cannot have reasonable assurances that they  are keeping to a minimum the number of positions that require security  clearances on the basis of a demonstrated and foreseeable need for  access. Without collaborative input from both OPM  and DNI in future revisions to the tool, executive branch agencies will  continue to risk making security clearance determinations that are  inconsistent or at improper levels. Finally, while Executive Order 12968  says that clearances should, subject to certain exceptions, be granted  only on the basis of a demonstrated need for access and kept to a  minimum, the DNI has not issued guidance that requires agencies to  review and revise or validate their existing federal civilian position  designations. While ODNI concurred with our first recommendation—that the DNI, in  coordination with the Director of OPM and other executive branch  agencies as appropriate, issue clearly defined policy and procedures for  federal agencies to follow when determining whether federal civilian  positions require a security clearance—OPM stated that it is not clear to  OPM that it has a significant role in prescribing the policy and procedures  for federal agencies to follow when determining if a federal civilian  position requires a security clearance. We are also sending copies to the Director of  National Intelligence, the Director of the Office of Personnel Management,  the Secretary of Homeland Security, the Secretary of Defense, and the  Office of Management and Budget. To determine the extent to which the executive branch has established  policies and procedures for agencies to review and revise or validate  existing federal civilian position security clearance requirements, we  interviewed knowledgeable officials from the federal agencies and  selected components in table 1. DOD commonly employs this practice and, in some  cases, the individual ultimately never requires access to classified  information.
Why GAO Did This Study

Security clearances allow personnel access to classified information that, through unauthorized disclosure, can, in some cases, cause exceptionally grave damage to U.S. national security. In 2011, the DNI reported that over 4.8 million federal government and contractor employees held or were eligible for a clearance. To safeguard classified data and manage costs, agencies need an effective process to determine whether civilian positions require a clearance. GAO was asked to examine the extent to which the executive branch has established policies and procedures for agencies to use when (1) first determining if federal civilian positions require a security clearance and (2) reviewing and revising or validating existing federal civilian position security clearance requirements. GAO reviewed executive orders and the Code of Federal Regulations and met with officials from ODNI and OPM because of their Directors assigned roles as Security and Suitability executive agents, as well as DHS and DOD based on the volume of clearances they process.

What GAO Found

The Director of National Intelligence (DNI), as Security Executive Agent, has not provided agencies clearly defined policy and procedures to consistently determine if a position requires a security clearance. Executive Order 13467 assigns DNI responsibility for, among other things, developing uniform and consistent policies to determine eligibility for access to classified information, and gives the DNI authority to issue guidance to agency heads to ensure uniformity in processes relating to those determinations. In the absence of this guidance, agencies are using an Office of Personnel Management (OPM) tool that OPM designed to determine the sensitivity and risk levels of civilian positions which, in turn, inform the type of investigation needed. OPM audits, however, found inconsistency in these position designations, and some agencies described problems in implementing OPMs tool. In an April 2012 audit, OPM reviewed the sensitivity levels of 39 positions in an agency within the Department of Defense (DOD) and reached different conclusions than the agency for 26 of them. Problems exist, in part, because OPM and the Office of the Director of National Intelligence (ODNI) did not collaborate on the development of the position designation tool, and because their roles for suitabilityconsideration of character and conduct for federal employmentand security clearance reform are still evolving. Without guidance from the DNI, and without collaboration between the DNI and OPM in future revisions to the tool, executive branch agencies will continue to risk making security clearance determinations that are inconsistent or at improper levels.
The DNI also has not established guidance to require agencies to review and revise or validate existing federal civilian position designations. Executive Order 12968 says each agency shall request or grant clearance determinations, subject to certain exceptions, based on a demonstrated need for access, and keep to a minimum the number of employees that it determines are eligible for access to classified information. The order also states that access to classified information shall be terminated when an employee no longer has a need for access, and prohibits agencies from requesting or approving eligibility in excess of actual requirements for access. During this review of Department of Homeland Security (DHS) and DOD components, GAO found that agency officials were aware of the need to keep the number of security clearances to a minimum, but were not always required to conduct periodic reviews and validations of the security clearance needs of existing positions. Overdesignating positions results in significant cost implications, given that the fiscal year 2012 base price for a top secret clearance investigation conducted by OPM is $4,005, while the base price of a secret clearance is $260. Conversely, underdesignating positions could lead to security risks. GAO found that the agencies follow varying practices because the DNI has not established guidance that requires executive branch agencies to review and revise or validate position designations on a recurring basis. Without such a requirement, executive branch agencies may be hiring and budgeting for initial and periodic security clearance investigations using position descriptions and security clearance requirements that no longer reflect national security needs. Further, since reviews are not done consistently, DHS and DOD and other executive branch agencies cannot have assurances that they are keeping the number of positions that require security clearances to a minimum.

What GAO Recommends

GAO recommends that the DNI issue clearly defined policy for agencies to follow when determining if federal civilian positions require a security clearance, and that the DNI and Director of OPM collaborate to revise the existing position designation tool. GAO further recommends that the DNI issue guidance to require agencies to periodically review and revise or validate the designation of their existing federal civilian positions. ODNI and OPM concurred, although OPM raised concerns with which GAO disagrees and addresses in the report.