DSS Responsibilities

DSS is responsible for administering the National Industrial Security  Program on behalf of the Department of Defense and, by mutual  agreement, 32 other federal departments and agencies. There are multiple reasons  why a contractor may need access to classified government information. In 2005, we made eight  recommendations about DSS’s oversight of contractors under foreign  influence. As of April 2018, 13 of 16 of the recommendations have  been implemented. DSS Upgraded Capabilities for the National Industrial Security Program but Faces Challenges Monitoring Contractors Streamlined Clearance Processes

Since 2005, when we last reviewed how DSS administered the National  Industrial Security Program, it has streamlined its facility clearance  process in order to make it more efficient. In 2004 and 2005, we reported that DSS did not collect and analyze data  on contractors operating in the National Industrial Security Program. 2. Challenges Remain

Despite upgrading its capabilities, DSS officials indicated that they face  resource constraints, such as an inability to manage workloads and  complete training necessary to stay informed on current threats and  technologies. DSS officials said  that their limited staff carry heavy workloads and, according to DSS’s  most recent biennial report to Congress, were unable to conduct  security reviews at about 60 percent of cleared facilities in fiscal year  2016. DSS Has Not Determined How It Will Collaborate with Stakeholders As It Pilots a New Approach

In 2017, DSS announced its plans to transition to a new approach to  monitoring cleared facilities in order to address emerging threats to  classified information. DSS has reported that the United  States is facing the most significant foreign intelligence threat it has ever  encountered and adversaries are attacking cleared facilities at  unprecedented rates. See table 1  for more information about the monitoring approaches. GAO’s Federal Internal Control Standards  establish the need to coordinate with stakeholders and clearly define  roles and responsibilities, among other things. In addition, our leading  practices for interagency collaboration state that successful collaborative  working relationships require organizations to agree on roles and  responsibilities and identify the resources necessary to accomplish  objectives. For example, GAO found it is unclear how DSS will  determine what resources it needs as it has not identified the necessary  roles and responsibilities. Government intelligence community. Other government agencies. In response, in 2017, DSS launched a new approach (DSS  in Transition) to change how it oversees contractors with access to  classified information. As DSS pilots the new approach, it will need to  work with government contracting activities, the intelligence community,  other agencies, and cleared contractors to determine their roles and  responsibilities in protecting classified information at every facility in the  program. Until DSS identifies roles  and responsibilities and determines how it will collaborate with  stakeholders for the pilot, it will be difficult to assess whether the new  approach is effective in protecting classified information. Recommendation for Executive Action

We are making one recommendation to the Director of the Defense  Security Service:  Determine how it will collaborate with stakeholders as it pilots a new  approach to overseeing contractors with cleared facilities (DSS in  Transition), including identifying roles and responsibilities and the related  resources needed.
Why GAO Did This Study

Industrial security addresses the information systems, personnel, and physical security of facilities and their cleared employees who have access to or handle classified information. The National Industrial Security Program was established in 1993 to safeguard federal government classified information that may be or has been released to contractors, among others. GAO last reported on this program in 2005 and the Department of Defense has since implemented 13 of the 16 related recommendations.
GAO was asked to examine how DSS administers the program. This report assesses to what extent DSS: 1) changed how it administers the program since GAO's last report; and 2) addressed challenges as it pilots a new approach to monitoring contractors with access to classified information.
GAO reviewed guidance and regulations since 2005, including the program's operating manual. GAO analyzed data from DSS's electronic databases and also selected a non-generalizable sample of contractor facilities based on clearance level, geographic location, and type of agreement to address foreign influence. We also reviewed documents and interviewed relevant government and contractor officials.

What GAO Found

The Defense Security Service (DSS) has upgraded its capabilities but also faces challenges in administering the National Industrial Security Program, which applies to all executive branch departments and agencies, and was established to safeguard federal government classified information that current or prospective contractors may access. Since we last reported on this program in 2005, DSS has:
streamlined facility clearance and monitoring processes, and
strengthened the process for identifying contractors with potential foreign influence.
However, under its current approach, DSS officials indicated that they face resource constraints, such as an inability to manage workloads and complete training necessary to stay informed on current threats and technologies. In its most recent report to Congress, DSS stated that it was unable to conduct security reviews at about 60 percent of cleared facilities in fiscal year 2016. Further, DSS recently declared that the United States is facing the most significant foreign intelligence threat it has ever encountered. As a result, in 2017, DSS announced plans to transition to a new monitoring approach to address emerging threats at facilities in the program. For a comparison of the current and new approaches, see below.
DSS has not addressed immediate challenges that are critical to piloting this new approach. For example, GAO found it is unclear how DSS will determine what resources it needs as it has not identified roles and responsibilities. Moreover, DSS has not established how it will collaborate with stakeholders—government contracting activities, the government intelligence community, other government agencies, and contractors—under the new approach. Federal Internal Control Standards establish the importance of coordinating with stakeholders, including clearly defining roles and responsibilities. In addition, GAO's leading practices for interagency collaboration state that it is important for organizations to identify the resources necessary to accomplish objectives. Until DSS identifies roles and responsibilities and determines how it will collaborate with stakeholders for the piloting effort, it will be difficult to assess whether the new approach is effective in protecting classified information.

What GAO Recommends

GAO recommends DSS determine how it will collaborate with stakeholders, including identifying roles and responsibilities and related resources, as it pilots a new approach. DSS concurred with the recommendation.