As previously mentioned, DOD and DHS grant the most security  clearances. OPM Has Developed a Tool to Help Agencies Determine the Proper Sensitivity Level for Most Federal Positions; However the Tool Was Not Developed with Input from the DNI

In the absence of clearly defined guidance to help ensure that executive  branch agencies use appropriate and consistent criteria when  determining if positions require a personnel security clearance, agencies  are using an OPM-designed tool to determine the sensitivity and risk  levels of civilian positions which, in turn, inform the type of investigation  needed. The determination to grant a clearance is based on whether a  position requires access to classified information and, if access is  required, the responsible official will designate the position to require a  clearance. Office of the Director of National Intelligence (ODNI) officials told us that  they believe OPM’s tool is useful for determining a position’s sensitivity  level. Accordingly, we  found in July 2012 that the Director of OPM and the DNI had not fully  collaborated in executing their respective roles in the process for  determining position designations. More recently, after the implementation of the tool, in an April 2012 audit  of a DOD agency, OPM assessed the sensitivity levels of 39 positions,  and OPM’s designations differed from the agency’s designations in 26 of  those positions. Because we found that the executive branch had not provided clear  guidance for the designation of national security positions, we  recommended that the DNI, in coordination with the Director of OPM and  other executive branch agencies as appropriate, issue clearly defined  policy and procedures for federal agencies to follow when determining if  federal civilian positions require a security clearance. Subsequently, ODNI and OPM drafted the  proposed regulation, published it in the Federal Register on May 28,  2013, and obtained public comment on the regulation through June 27,  2013. In reviewing the proposed regulation, we found that it would, if finalized in  its current form, meet the intent of our recommendation to issue clearly  defined policy and procedures for federal agencies to follow when  determining if federal civilian positions require a security clearance. Further, we also recommended in 2012 that once clear policy and  procedures for position designation are issued, the DNI and the Director  of OPM should collaborate in their respective roles as Executive Agents  to revise the position designation tool to reflect that guidance. However, we reported in 2012 that the DNI had not issued policies and  procedures for agencies to periodically review and revise or validate the  existing clearance requirements for their federal civilian positions to  ensure that clearances are 1) kept to a minimum and 2) reserved only for  those positions with security clearance requirements that are in  accordance with the national security needs of the time. During our 2012 review of several DOD and DHS components, we found  that officials were aware of the requirement to keep the number of  security clearances to a minimum but were not always subject to a  standard requirement to review and validate the security clearance needs  of existing positions on a periodic basis. The federal government  spent over $1 billion to conduct background investigations in fiscal year  2011. Without a requirement to  consistently review, revise, or validate existing security clearance position  designations, executive branch agencies—such as DOD and DHS—may  be hiring and budgeting for both initial and periodic security clearance  investigations using position descriptions and security clearance  requirements that do not reflect national security needs. Finally, since  reviews are not being done consistently, DOD, DHS, and other executive  branch agencies cannot have reasonable assurance that they are  keeping to a minimum the number of positions that require security  clearances on the basis of a demonstrated and foreseeable need for  access. Therefore, we recommended in July 2012 that the DNI, in coordination  with the Director of OPM and other executive branch agencies as  appropriate, issue guidance to require executive branch agencies to  periodically review and revise or validate the designation of all federal  civilian positions. ODNI and OPM are currently in the process of finalizing revisions to the  position designation federal regulation. As part of our ongoing processes  to routinely monitor the status of agency actions to address our prior  recommendations, we note that the proposed regulation would newly  require agencies to conduct a one-time reassessment of position  designations within 24 months of the final regulation’s effective date,  which is an important step towards ensuring that the current designations  of national security positions are accurate. GAO-12-800.
Why GAO Did This Study

Personnel security clearances allow individuals access to classified information that, through unauthorized disclosure, can in some cases cause exceptionally grave damage to U.S. national security. A sound requirements process to determine whether a national security position requires access to classified information is needed to safeguard classified data and manage costs. The DNI reported that more than 4.9 million federal government and contractor employees held or were eligible to hold a security clearance in 2012. GAO has reported that the federal government spent over $1 billion to conduct background investigations (in support of security clearances and suitability determinations--the consideration of character and conduct for federal employment) in fiscal year 2011.
This testimony addresses policies and procedures executive branch agencies use when (1) first determining whether federal civilian positions require a security clearance and (2) periodically reviewing and revising or validating existing federal civilian position security clearance requirements. This testimony is based on a July 2012 GAO report (GAO-12-800), in which GAO (1) reviewed relevant federal guidance and processes, (2) examined agency personnel security clearance policies, (3) obtained and analyzed an OPM tool used for position designation, and (4) met with officials from ODNI and OPM because of their Directors' assigned roles as Security and Suitability Executive Agents. Because DOD and DHS grant the most security clearances, that report focused on the security clearance requirements of federal civilian positions within those agencies.

What GAO Found

In July 2012, GAO reported that the Director of National Intelligence (DNI), as Security Executive Agent, had not provided executive branch agencies clearly defined policy and procedures to consistently determine if a position requires a personnel security clearance. Absent this guidance, agencies are using an Office of Personnel Management (OPM) position designation tool to determine the sensitivity and risk levels of civilian positions which, in turn, inform the type of investigation needed. OPM audits, however, found inconsistency in these position designations, and some agencies described problems implementing OPM's tool. For example, in an April 2012 audit OPM assessed the sensitivity levels of 39 positions, and its designations differed from the agency in 26 positions. Problems exist, in part, because OPM and the Office of the Director of National Intelligence (ODNI) did not collaborate on the development of this tool, and because their respective roles for suitability and security clearance reform are still evolving. As a result, to help determine the proper designation, GAO recommended that the DNI, in coordination with the Director of OPM, issue clearly defined policy and procedures for federal agencies to follow when determining if federal civilian positions require a security clearance. The DNI concurred with this recommendation. In May 2013, the DNI and OPM jointly drafted a proposed revision to the federal regulation on position designation which, if finalized in its current form, would provide additional requirements and examples of position duties at each sensitivity level. GAO also recommended that once those policies and procedures are in place, the DNI and the Director of OPM, in their roles as Executive Agents, collaborate to revise the position designation tool to reflect the new guidance. ODNI and OPM concurred with this recommendation and recently told GAO that they are revising the tool.
GAO also reported in July 2012 that the DNI had not established guidance to require agencies to periodically review and revise or validate existing federal civilian position designations. GAO reported that Department of Defense (DOD) and Department of Homeland Security (DHS) component officials were aware of the requirement to keep the number of security clearances to a minimum, but were not always required to conduct periodic reviews and validations of the security clearance needs of existing positions. GAO found that without such a requirement, executive branch agencies may be hiring and budgeting for initial and periodic security clearance investigations using position descriptions and security clearance requirements that do not reflect current national security needs. Further, since reviews are not done consistently, executive branch agencies cannot have assurances that they are keeping the number of positions that require security clearances to a minimum. Therefore, GAO recommended in July 2012 that the DNI, in coordination with the Director of OPM, issue guidance to require executive branch agencies to periodically review and revise or validate the designation of all federal civilian positions. As of October 2013, ODNI and OPM are finalizing revisions to the federal regulation on position designation. While the proposed regulation requires agencies to conduct a one-time reassessment of position designation within 24 months of the final rule's effective date, it does not require a periodic reassessment of positions' need for access to classified information. GAO continues to believe that periodic reassessment is important.