	Background

In August 2004, the President issued HSPD-12, which directed the  Department of Commerce to develop a new standard for secure and  reliable forms of ID for federal employees and contractors to enable  a common standard across the federal government by February 27,  2005. DOD Personnel Security Clearance Program Has Been Designated as a GAO High-Risk Area

Military servicemembers, federal workers, and industry personnel  must obtain security clearances to gain access to classified  information. While the eight agencies we reviewed had generally taken  steps to complete background checks on most of their employees  and contractors and establish basic infrastructure, such as  purchasing card readers, none of the agencies met OMB’s goal of  issuing PIV cards by October 27, 2007, to all employees and  contractor personnel who had been with the agency for 15 years or  less. In addition, for the limited number of cards that had been  issued, agencies generally had not been using the electronic  authentication capabilities on the cards. Until OMB  revises its approach to focus on the full use of card capabilities,  HSPD-12’s objective of increasing the quality and security of ID and  credentialing practices across the federal government may not be  fully achieved. OMB’s Focus on Near-Term Card Issuance Hindered Progress in Achieving the HSPD-12 Objectives

A key contributing factor to why agencies had made limited  progress is that OMB—which is tasked with ensuring that federal  agencies implement HSPD-12—had emphasized the issuance of the  cards, rather than the full use of the cards’ capabilities. Furthermore,  despite the cost of the cards and associated infrastructure, OMB had  not treated the implementation of HSPD-12 as a major new  investment and had not ensured that agencies have guidance to  ensure consistent and appropriate implementation of electronic  authentication capabilities across agencies. While OMB had established milestones for near-term card issuance,  it had not established milestones to require agencies to develop  detailed plans for making the best use of the electronic  authentication capabilities of PIV cards. Long-standing Challenges Exist in DOD’s Personnel Security Clearance Program

In our previous reports, we have also documented a variety of  problems present in DOD’s personnel security clearance program. Some of the problems that we noted in our 2007 high-risk report  included delays in processing clearance applications and problems  with incomplete investigative and adjudicative reports to determine  clearance eligibility. Delays in the clearance process continue to  increase costs and risk to national security, such as when new  industry employees are not able to begin work promptly and  employees with outdated clearances have access to classified  documents. While  DOD continues to face challenges in timeliness and quality in the  personnel security clearance process, high-level governmentwide  attention has been focused on improving the security clearance  process. As we noted in February 2008, delays in the security clearance  process continue to increase costs and risk to national security. DOD and the Rest of the Government Provide Limited Information on How to Ensure the Quality of  Clearance Products and Procedures  As we reported in February 2008, DOD and the rest of the federal  government provide limited information to one another on how they  individually ensure the quality of clearance products and  procedures. However, the DOD report did not  include any of those measures. In closing, OMB, GSA, and NIST have made significant progress in  laying the foundation for implementation of HSPD-12.
Why GAO Did This Study

In an effort to increase the quality and security of federal identification (ID) practices, the President issued Homeland Security Presidential Directive 12 (HSPD-12) in August 2004. This directive requires the establishment of a governmentwide standard for secure and reliable forms of ID. GAO was asked to testify on its report, being released today, assessing the progress selected agencies have made in implementing HSPD-12. For this report, GAO selected eight agencies with a range of experience in implementing ID systems and analyzed actions these agencies had taken. GAO was also asked to summarize challenges in the DOD personnel security clearance process. This overview is based on past work including reviews of clearance-related documents. Military servicemembers, federal workers, and industry personnel must obtain security clearances to gain access to classified information. Long-standing delays in processing applications for these clearances led GAO to designate the Department of Defense's (DOD) program as a high-risk area in 2005. In its report on HSPD-12, GAO made recommendations to the Office of Management and Budget (OMB), to, among other things, set realistic milestones for implementing the electronic authentication capabilities. GAO has also made recommendations to OMB and DOD to improve the security clearance process.

What GAO Found

Much work had been accomplished to lay the foundations for implementation of HSPD-12--a major governmentwide undertaking. However, none of the eight agencies GAO reviewed--the Departments of Agriculture, Commerce, Homeland Security, Housing and Urban Development, the Interior, and Labor; the Nuclear Regulatory Commission; and the National Aeronautics and Space Administration--met OMB's goal of issuing ID cards by October 27, 2007, to all employees and contractor personnel who had been with the agency for 15 years or less. In addition, for the limited number of cards that had been issued, most agencies had not been using the electronic authentication capabilities on the cards and had not developed implementation plans for those capabilities. A key contributing factor for this limited progress is that OMB had emphasized issuance of the cards, rather than full use of the cards' capabilities. Furthermore, agencies anticipated having to make substantial financial investments to implement HSPD-12, since ID cards are considerably more expensive than traditional ID cards. However, OMB had not considered HSPD-12 implementation to be a major new investment and thus had not required agencies to prepare detailed plans regarding how, when, and the extent to which they would implement the electronic authentication mechanisms available through the cards. Until OMB revises its approach to focus on the full use of the capabilities of the new ID cards, HSPD-12's objectives of increasing the quality and security of ID and credentialing practices across the federal government may not be fully achieved. Regarding personnel security clearances, GAO's past reports have documented problems in DOD's program including delays in processing clearance applications and problems with the quality of clearance related reports. Delays in the clearance process continue to increase costs and risk to national security, such as when new DOD industry employees are not able to begin work promptly and employees with outdated clearances have access to classified documents. Moreover, DOD and the rest of the federal government provide limited information to one another on how they individually ensure the quality of clearance products and procedures. While DOD continues to face challenges in timeliness and quality in the personnel security clearance process, high-level government attention has been focused on improving the clearance process.