The Defense Department plans to use continuous evaluation as the cornerstone of its plan to transfer 75 percent of the current security clearance workload from the Office of Personnel Management and National Background Investigations Bureau (NBIB). But, the Government Accountability Office warns that the Pentagon is about to delve into murky territory.
Meanwhile, other agencies are leery to dive headfirst into continuous evaluation, and they’re looking for more guidance on the program and its potential risks.
But with an average wait time of more than 200 days for a reinvestigation, DoD sees no other choice but to phase out the periodic review in favor of continuous evaluation. From the Pentagon’s perspective, a more consistent check into their clearance holders will force employees and contractors to change their behavior and self-report life changes once their enrolled in a continuous evaluation program.
Other agencies, however, are more concerned about the additional time and expense continuous evaluation will add to their vetting efforts.
Insight by Carahsoft: Learn from IT experts as they outline the significant impacts cloud and 5G have on implementing zero trust architecture in this exclusive executive briefing.
“While executive branch agencies have different views about potential changes to the periodic reinvestigation process, officials from five of the seven executive branch agencies we spoke with identified the potential expenditure of increased resources, such as workload and costs, as a risk associated with the implementation of continuous evaluation,” GAO wrote in a recent report. “Specifically, all five agencies stated that continuous evaluation will increase their workloads — and therefore costs — if no other changes are made to the personnel security process.”
For example, NBIB, which currently processes about 95 percent of all federal security clearances, said continuous evaluation will increase their workload and costs. The program would add another layer to the investigative process itself.
For the State Department, a complete reliance on continuous evaluation means it would miss out on checking relevant state and local law enforcement records that aren’t yet automated. Typically, those records checks are a critical part of a periodic reinvestigation.
Both the Homeland Security and Justice departments agreed with State’s concerns. They, along with NBIB, said they hoped the Office of the Director of National Intelligence would eventually identify and offer up new ideas to make the security clearance and periodic reinvestigation processes more efficient.
The Pentagon is also looking for more efficiencies in the periodic reinvestigation process. It’s that frustration, along with the governmentwide backlog of 695,000 pending investigative matters, that’s prompting DoD to take back its own security clearance process starting in 2018.
“DoD officials also noted that if changes are not made to the periodic reinvestigation process, the investigation backlog will persist, because continuous evaluation alerts will continue to add to the investigative workload,” GAO wrote.
Meanwhile, agencies are still looking for more clarity and guidance on continuous evaluation from ODNI, which serves as the Security Executive Agent and oversees and sets standards for the continuous evaluation program.
Both the DoD and the State Department have started their own continuous evaluation pilots. DoD has been working on its pilot for more than decade and began tests of automated records check capabilities as early as 2002, GAO said.
ODNI is also developing its own continuous evaluation program, which executive branch agencies can opt in to use once it’s fully functional by fall 2018. But several agencies told GAO they’re unclear how they’re supposed to plan for the launch of this system.
“While some agencies, such as DoD and State — both of which have established continuous evaluation programs in advance of implementation across the executive branch — have developed concepts of operations or standard operating procedures for continuous evaluation, all seven agencies we spoke with stately that they are waiting for additional information from ODNI before completing their implementation plans.”
Six out of seven agencies GAO spoke with said they struggled to estimate the cost of implementing continuous evaluation, and several organizations said they were still waiting on more information from the ODNI before they could predict continuous evaluation expenses.
And according to GAO, ODNI’s continuous evaluation plan lacks some key components.
“ODNI officials managing the continuous evaluation program stated that they have not developed a project management plan for the implementation of continuous evaluation, to include an implementation schedule, because they are still in the planning stage,” GAO said. “However, ODNI has already started to implement the program. Without a plan that, among other things, identifies reasonable milestones for the future phases of implementation, ODNI does not have a schedule against which it can track its progress or to which it is accountable.”
In addition, the ODNI doesn’t have plans to monitor and measure how well its continuous evaluation program is performing across government, GAO said.
ODNI told GAO it had plans to send out continuous evaluation requirements in fiscal 2018. And Bill Evanina, director of the ODNI’s National Counterintelligence and Security Center, said in an interview with Federal News Radio that agencies would have more guidance on applying continuous evaluation soon. His office has developed a community-wide directive on the topic, which the Office of Management and Budget is currently reviewing.
The ODNI has had a tortured history with continuous evaluation over the past seven years. It’s missed some milestones and delayed others, and GAO specifically criticized the agency for not making continuous evaluation a leadership priority.
Civilian agencies, however, have been slow to embrace the continuous evaluation concept themselves, and legal, technical, financial and cultural barriers, largely, have stymied their efforts to continuously vet their clearance holders.
The ODNI disagreed with many of GAO’s recommendations and argued the conclusions “appear to focus on the growing pains from the inception of the program rather than portraying the significant progress achieved in coordination with executive branch CE stakeholders since these engagements began in November 2016,” the agency wrote in its response to GAO.