gao-Personnel Vetting - DOD Needs a Reliable Schedule and Cost Estimate for the National Background Investigation Services Program-此为英文文档

GAO-23-105670

UnitedStatesGovernmentAccountabilityOffice

ReporttoCongressionalCommittees

August2023

PERSONNEL

VETTING

DODNeedsa

ReliableSchedule

andCostEstimatefortheNationalBackgroundInvestigationServicesProgram

UnitedStatesGovernmentAccountabilityOffice

August2023

PERSONNELVETTING

DODNeedsaReliableScheduleandCostEstimate

fortheNationalBackgroundInvestigationServicesProgram

WhatGAOFound

TheDepartmentofDefense(DOD),throughitsDefenseCounterintelligenceandSecurityAgency(DCSA),conductspersonnelvettingforthemajorityofthefederalworkforce.Since2016,DODhasdeliveredsomecapabilitiesthroughanewinformationtechnologysystem—theNationalBackgroundInvestigationServices(NBIS)system—intendedtosupportallphasesofpersonnelvetting.NBISsystemcapabilities,oncefullydeployed,shouldenableuserstocompleteelectronicforms,manageinvestigations,recorddecisions,andmore.However,DODlacksareliablescheduleandcostestimateforNBIS.

ExtenttoWhichtheNationalBackgroundInvestigationServicesScheduleandCostEstimate

MeetsBestPractices

DCSAhasdeployedsomeNBISsystemcapabilities,suchasaneApplication,tocollectthenecessarydatatobeginabackgroundinvestigation.However,NBISwasoriginallyslatedtobefullyoperationalin2019.In2020,DCSArevisedNBISprogrammilestones,butitcontinuestofacedelays.DCSAnowprojectsthatlegacysystemswillbedecommissionedbytheendof2024.In2021,GAOrecommendedthatDCSAdevelopareliableschedule,whichDCSAhasnotdone.ThelackofprogressinaddressingscheduleweaknessescouldfurtherdelayNBISimplementationandtheplannedreplacementoflegacysystems.Moreover,GAOfoundtheNBISprogram’scostestimatefrom2022isnotreliable,meaningthatDCSAmaybeunabletoaccuratelyprojectNBIScosts.GiventhatDODhasspentoverahalfabilliondollarsonNBISsince2016,areliablecostestimatewouldhelpensurethatitiscollectingthedatanecessarytomatchNBISrequirementstoitsbudgetandreducerisksofcostoverrunsthatmayhindertheprogram’sprogress.

DCSAhasidentifiedstakeholdersfortheNBISprogram—including115federalagenciesandaround13,000industryorganizations—andhasworkedwiththemwhiledevelopingNBIS.FederalandindustrystakeholdersthatrespondedtoGAO’ssurveyweregenerallysatisfiedwithDCSA’sengagement,initialtraining,andopportunitiestoprovidefeedback.Forexample,around92percentofrespondentssaidtheyhadengagedwiththeNBISteam.However,somestakeholdersnotedconcernswithtransitioningtheirrespectiveorganizationstouseNBISandthestatusoftheNBISsystemitself.AnalyzingGAO’ssurveyresultscouldhelpDCSAidentifyareaswhereitcanenhanceitseffortstomeetstakeholderneeds.

Highlightsof

GAO-23-105670

,areporttocongressionalcommittees

WhyGAODidThisStudy

U.S.governmentpersonnelvettingprocesses,suchasbackgroundinvestigations,relyoninformationtechnologysystemstoprocessandvalidatedataonmillionsoffederalemployeesandcontractorpersonnel.In2016,DODassumedresponsibilityfordevelopingnewsystemsfollowinga2015cybersecurityincidentthatcompromiseddatafromOfficeofPersonnelManagementsystems.DODisdevelopingtheNBISsystemtoreplacethoselegacysystems.

HouseReport117-118,accompanyingabillfortheNationalDefenseAuthorizationActforFiscalYear2022,includesaprovisionforGAOtoevaluatetheNBISprogram.GAOassessed(1)thestatusofNBISsystemdevelopment,andthereliabilityofthescheduleandcostestimatefortheNBISprogram;and(2)theextenttowhichDCSAisengagingstakeholdersinthedevelopmentofNBISsystemrequirementsandcapabilities.

GAOreviewedbudgetdocumentation,assessedDCSA’sscheduleandcostestimateforNBISagainstGAObestpractices,andsurveyedfederalandindustrysecuritypersonnelat71organizations,withan86percentresponserate.

WhatGAORecommends

CongressshouldconsiderrequiringDODtodevelopareliableNBISprogramscheduleandcostestimatebasedonGAObestpractices.GAOalsorecommendsthatDODassessanduseGAO’ssurveyresultstoimproveengagementwithstakeholders.DODconcurredwithGAO'srecommendation.

View

GAO-23-105670

.Formoreinformation,contactAlissaH.Czyzat(202)512-3058or

czyza@

andMarisolCruzCain,(202)512-5017or

cruzcainm@.

Pagei

GAO-23-105670PersonnelVetting

Contents

Letter

1

Background3

DODHasDevelopedSomeNBISSystemCapabilities,butLacks

aReliableScheduleandCostEstimatefortheNBISProgram9

StakeholdersReportedBeingGenerallySatisfiedwithNBIS

SystemDevelopment,butIdentifiedSomeConcerns20

Conclusions30

MatterforCongressionalConsideration30

RecommendationforExecutiveAction31

AgencyComments31

AppendixI

ScopeandMethodology34

AppendixII

AssessmentofDCSA’sIntegratedMasterScheduleforNBIS

ComparedwithBestPractices38

AppendixIII

AssessmentofDCSA’sCostEstimateforNBISComparedwith

BestPractices40

AppendixIV

AssessmentofDCSA’sImplementationofAgileBestPracticesfor

StakeholderEngagement42

AppendixV

SurveyResultsofNBISFederalandIndustryOnboarded

Stakeholders43

AppendixVI

ResultsofNBISFederalandIndustryOnboardedStakeholders’Open-

EndedSurveyResponses55

AppendixVIICommentsfromtheDepartmentofDefense57

Pageii

GAO-23-105670PersonnelVetting

AppendixVIIIGAOContactsandStaffAcknowledgments59

RelatedGAOProducts

60

Tables

Table1:GAOAssessmentoftheNationalBackground

InvestigationServices(NBIS)ProgramScheduleagainst

CharacteristicsofaReliableSchedule14

Table2:AssessmentoftheDefenseCounterintelligenceand

SecurityAgency’s(DCSA)CostEstimatefortheNational

BackgroundInvestigationServices(NBIS)Program

ComparedwithBestPractices18

Table3:AssessmentoftheDefenseCounterintelligenceand

SecurityAgency’s(DCSA)ScheduleFilesfortheNational

BackgroundInvestigationServices(NBIS)Program

ComparedwithBestPractices38

Table4:AssessmentoftheDefenseCounterintelligenceand

SecurityAgency’s(DCSA)CostEstimatefortheNational

BackgroundInvestigationServices(NBIS)Program

ComparedwithBestPractices40

Table5:AssessmentoftheNationalBackgroundInvestigation

Services(NBIS)Program’sAgileAdoptionComparedwith

BestPractices,asofFebruary202342

Table6:ResultsofGAOAnalysisofExternalNational

BackgroundInvestigationServices(NBIS)Stakeholder

Open-EndedSurveyResponses56

Figures

Figure1:TimelineofInformationTechnology(IT)-RelatedEvents

forBackgroundInvestigationProcesses,2015–2024,as

ofFebruary20236

Figure2:PlannedNationalBackgroundInvestigationServices

(NBIS)SystemCapabilitiesforPersonnelVetting7

Figure3:NationalBackgroundInvestigationServices(NBIS)

SystemDevelopmentMilestonesbyPersonnelVetting

PhaseasofFebruary202312

Pageiii

GAO-23-105670PersonnelVetting

Figure4:NationalBackgroundInvestigationServices(NBIS)

ProgramOversight,ProgramManagement,and

StakeholderOrganizations20

Figure5:GAOSurveyResultsonNationalBackground

InvestigationServices(NBIS)StakeholderSatisfaction

withQualityofDefenseCounterintelligenceandSecurity

Agency(DCSA)Communication23

Figure6:GAOSurveyResultsonNationalBackground

InvestigationServices(NBIS)StakeholderSatisfaction

withFrequencyofDefenseCounterintelligenceand

SecurityAgency(DCSA)Communication24

Figure7:GAOSurveyResultsonNationalBackground

InvestigationServices(NBIS)StakeholderSatisfaction

withNBISeApplication(eApp)Training26

Figure8:GAOSurveyResultsonNationalBackground

InvestigationServices(NBIS)StakeholderPreparedness

LevelsforTrainingonFutureNBISSystemCapabilities27

Pageiv

GAO-23-105670PersonnelVetting

Abbreviations

DCSA

DefenseCounterintelligenceandSecurityAgency

DOD

DepartmentofDefense

IT

informationtechnology

NBIS

NationalBackgroundInvestigationServices

ODNI

OfficeoftheDirectorofNationalIntelligence

OMB

OfficeofManagementandBudget

OPM

OfficeofPersonnelManagement

PAC

PerformanceAccountabilityCouncil

ThisisaworkoftheU.S.governmentandisnotsubjecttocopyrightprotectionintheUnitedStates.ThepublishedproductmaybereproducedanddistributedinitsentiretywithoutfurtherpermissionfromGAO.However,becausethisworkmaycontaincopyrightedimagesorothermaterial,permissionfromthecopyrightholdermaybenecessaryifyouwishtoreproducethismaterialseparately.

441GSt.N.W.

Washington,DC20548

Page1

GAO-23-105670PersonnelVetting

Letter

August17,2023

CongressionalCommittees

Personnelvettingprocessescanhelpdeterminethetrustworthinessofthefederalgovernment’sworkforce;minimizeriskstothenationfrompersonnelnotbeingsuitableforgovernmentemployment;andpreventunauthorizeddisclosureofclassifiedinformationthatcouldcausedamagetoU.S.nationalsecurity.

1

TheDepartmentofDefense’s(DOD)DefenseCounterintelligenceandSecurityAgency(DCSA)conductspersonnelvettingoperations,includingbackgroundinvestigations,adjudications,continuousvetting,andinsiderthreatanalysis,forthemajorityofthefederalworkforce.Specifically,DCSAconducts95percentofallbackgroundinvestigationsforover100agencies.

In2016,thePresidentassignedDODtheresponsibilityfordevelopingandoperatinginformationtechnology(IT)systemsforpersonnelvettingprocesses.

2

Thisfolloweda2015cybersecurityincidentthatcompromisedOfficeofPersonnelManagement(OPM)systemscontainingdataonover21millionfederalemployeesandcontractorpersonnel.DODsetuptheNationalBackgroundInvestigationServices(NBIS)programandstarteddevelopingtheNBISsysteminlate2016.

3

1SeeFederalPersonnelVettingCoreDoctrine,86Fed.Reg.2,705(Jan.13,2021);Exec.OrderNo.13,526,ClassifiedNationalSecurityInformation,§1.2,75Fed.Reg.707,707-08(Dec.29,2009).

2Specifically,in2016,ExecutiveOrderNo.13,467,asamendedthroughExecutiveOrderNo.13,741,assignedDODtheroleofdesigning,developing,deploying,operating,securing,defending,andcontinuouslyupdatingandmodernizingpersonnelvettingITsystemsthatsupportallbackgroundinvestigationprocessesthathadbeenconductedbytheNationalBackgroundInvestigationsBureauwithintheOfficeofPersonnelManagement.Exec.OrderNo.13,467,ReformingProcessesRelatedtoSuitabilityforGovernmentEmployment,FitnessforContractorEmployees,andEligibilityforAccesstoClassifiedNationalSecurityInformation,§2.4(b)(June30,2008),asamendedbyExec.OrderNo.13,741,AmendingExecutiveOrder13467ToEstablishtheRolesandResponsibilitiesoftheNationalBackgroundInvestigationsBureauandRelatedMatters,§1(f),81Fed.Reg.68,289,68,290(Sept.29,2016).

3Theterm“NBISprogram”referstotheNBISProgramManagementOfficeanditsmanagementoftheprogramasawhole,includingrelatedsubprojectssuchasacquisition,engineering,training,cybersecurity,etc.Inthisreport,weusetheterm“NBISsystem”torefertothesetofsub-systemsandassociatedcapabilitiesthatisthefocusofthesoftwaredevelopmenteffort.

Letter

Page2

GAO-23-105670PersonnelVetting

InJanuary2018,weplacedthegovernment-widepersonnelsecurityclearanceprocessonGAO’sHigh-RiskListduetofactorsthatincludeddelaysincompletingthesecurityclearanceprocess,alackofmeasurestodeterminethequalityofinvestigations,andissueswiththeITsystemssupportingtheprocess.

4

In2019,DODestablishedDCSAanditsubsequentlyassumedresponsibilityfordevelopingtheNBISsystemandreplacinglegacyOPMsystems.In2021,wereportedthatDODdidnothaveareliablescheduletohelpmanageNBISandrecommended,amongotherthings,thatDODrevisetheNBISscheduletofullymeetthecharacteristicsofareliableschedule.

5

HouseReport117-118,accompanyingabillfortheNationalDefenseAuthorizationActforFiscalYear2022,includesaprovisionforustoevaluatetheNBISprogram.

6

Inthisreview,weassess(1)thestatusofNBISsystemdevelopment,andthereliabilityofthescheduleandcostestimatefortheNBISprogram;and(2)theextenttowhichDCSAisengagingstakeholdersinthedevelopmentofNBISsystemrequirementsandcapabilities.WeareconductingaseparatereviewofNBIScybersecuritythatweexpecttocompleteinfiscalyear2024.

Toaddressourfirstobjective,wereviewedDCSAdocumentationonthestatusofNBISsystemdevelopmentandevaluatedDCSA’sscheduleandcostestimatefortheNBISprogramagainstbestpracticesinGAO’sScheduleAssessmentGuideandGAO’sCostEstimatingandAssessmentGuide.

7

TheseguidesandtheirrespectivebestpracticesarealsoreferencedinGAO’sAgileAssessmentGuide,whichweused

4Wefoundthatthegovernment-widepersonnelsecurityclearanceprocesscontinuestofacechallengesinthetimelyprocessingofclearances,challengesmeasuringthequalityofinvestigations,andchallengeswithITsystems.Wehavemadenumerousrecommendationstoaddressthesechallenges.Formoreinformationonourpreviousrecommendations,seeGAO,High-RiskSeries:EffortsMadetoAchieveProgressNeedtoBeMaintainedandExpandedtoFullyAddressAllAreas,

GAO-23-106203

(Washington,D.C.:Apr.20,2023).

5GAO,PersonnelVetting:ActionsNeededtoImplementReforms,AddressChallenges,andImprovePlanning,

GAO-22-104093

(Washington,D.C.:Dec.9,2021).DODconcurredwiththerecommendationsdirectedtoitfromthisreport,includingrevisingtheNBISscheduletomeetbestpractices.

6H.R.Rep.No.117-118,at220-21(2021).

7GAO,ScheduleAssessmentGuide:BestPracticesforProjectSchedules,

GAO-16-89G

(Washington,D.C.:Dec.2015);andGAO,CostEstimatingandAssessmentGuide:BestPracticesforDevelopingandManagingProgramCosts,

GAO-20-195G

(Washington,D.C.:Mar.2020).

Letter

Page3

GAO-23-105670PersonnelVetting

becauseAgileisanapproachtosoftwaredevelopmentthatNBISprogramofficialsstatedthattheyfollow.

8

WealsodiscussedthereliabilityoftheNBISprogram’sscheduleandcostestimatewithNBISprogramofficialsatDCSA.

Foroursecondobjective,wesurveyed71organizations—59federalagenciesand12industryorganizations—abouttheirexperienceswiththedevelopmentandimplementationoftheNBISsystem.WeadministeredthesurveyfromOctober26,2022,toNovember23,2022.Wereceivedresponsesfrom51of59federalagenciesand10of12industryorganizations—an86percentresponserate.WealsoevaluatedDCSAstakeholderengagementbycomparingNBISprogramsoftwaredevelopmentdocumentationagainstourbestpracticesforAgileadoptionandimplementation.

9

AmoredetaileddescriptionofourscopeandmethodologyisinappendixI.

WeconductedthisperformanceauditfromJanuary2022toAugust2023inaccordancewithgenerallyacceptedgovernmentauditingstandards.Thosestandardsrequirethatweplanandperformtheaudittoobtainsufficient,appropriateevidencetoprovideareasonablebasisforourfindingsandconclusionsbasedonourauditobjectives.Webelievethattheevidenceobtainedprovidesareasonablebasisforourfindingsandconclusionsbasedonourauditobjectives.

Background

PersonnelVettingand

TrustedWorkforce2.0

Personnelvettingistheprocessbywhichindividualsundergoinvestigation,evaluation,andadjudication.Thisprocessdetermineswhethertheyare,andremainovertime,eligibletoaccessclassifiedinformationortoholdasensitiveposition;suitableorfitforfederalemploymentortoperformworkfororonbehalfofthegovernmentas

8GAO,AgileAssessmentGuide:BestPracticesforAgileAdoptionandImplementation,

GAO-20-590G

(Washington,D.C.:Sept.28,2020).Agilemethodologyisanapproachtosoftwaredevelopmentinwhichsoftwareisdevelopedincrementallyandiscontinuouslyevaluatedforfunctionality,quality,andcustomersatisfaction.Theprocessstartswithstrategy,followedbyrequirementsmanagement,andthenuserstories.Agilecanreducetherisksoffundingaprogramthatfailsorproducesoutdatedtechnology.Agileprograms

shouldalsomaintainreliableschedulesandcostestimates.

9GAO-20-590G

.

Letter

Page4

GAO-23-105670PersonnelVetting

contractoremployees;oreligibleforaccesstoagencysystemsorfacilities.

TheSecurity,Suitability,andCredentialingPerformanceAccountabilityCouncil(PAC)isresponsibleforgovernment-wideimplementationofreformstopersonnelvetting.

10

ThePAChasfourprincipalmembers:theDeputyDirectorforManagementoftheOfficeofManagementandBudget(OMB);theDirectorofNationalIntelligence(DNI);theDirectorofOPM;andtheUnderSecretaryofDefenseforIntelligenceandSecurity.

ThePACPrincipalsannouncedinMarch2018agovernment-wideinitiativetofundamentallyoverhaulthefederalpersonnelvettingprocessthroughaseriesofpolicyandproceduralreformscalledTrustedWorkforce2.0.Theinitiativeaimstoreducethetimerequiredtobringnewhiresonboard,enablemobilityofthefederalworkforce,andimproveinsightintoworkforcebehaviorswhilemitigatingrisk.ThePACPrincipalsdividedimplementationofthisinitiativeintotwophases:(1)reduceandeliminatethebacklogofbackgroundinvestigationsconductedbyDCSA;and(2)establishanewgovernment-wideapproachtopersonnelvetting.

Aswereportedin2021,thePAChasmadeprogressinimplementingbothphases.

11

Thisincludesrequiringfederalagenciestoadoptcontinuousvettingintwointerimphases—TrustedWorkforce1.25and1.5,asdescribedinguidancein2020and2021.

12

In2022,thePACissuedotherkeyTrustedWorkforce2.0policies,includingupdatedinvestigativestandardsthatalsoaddresscontinuousvetting.

13

10ThePACwasestablishedinJune2008byExecutiveOrder13,467.SeeExec.OrderNo.13,467,§2.2(c),(d),73Fed.Reg.38,103,38,105(June30,2008).

1

1GAO-22-104093

.AccordingtoPACdocumentation,DCSAhaseliminateditsbacklogandmaintaineditstargetinventorysincethethirdquarteroffiscalyear2021.

12SeeDNIandDirector,OPMMemorandum,TransformingFederalPersonnelVetting:MeasurestoExpediteReformandFurtherReducetheFederalGovernment’sBackgroundInvestigationInventory(Feb.3,2020);DNIandDirector,OPMMemorandum,TransformingFederalPersonnelVetting:ContinuousVettingandOtherMeasurestoExpediteReformandTransitiontoTrustedWorkforce2.0(Jan.15,2021).Continuousvettinginvolvesreviewingthebackgroundofacoveredindividualatanytimetodeterminewhetherthatindividualcontinuestomeetapplicablerequirementsandallowsforthereplacementoftraditional,time-basedperiodicreinvestigations.

13DNIandDirector,OPMMemorandum,FederalPersonnelVettingInvestigativeStandards(May17,2022).

Letter

Page5

GAO-23-105670PersonnelVetting

DCSAandBackground

InvestigationServices

AccordingtoanofficialfromthePACProgramManagementOffice,themostimportantfactorinimplementingTrustedWorkforce2.0isDCSA’sdevelopmentofsupportingITsystemsliketheNBISsystem.Followingthe2015OPMcybersecurityincidentthatcompromiseddataonmillionsoffederalemployeesandcontractors,DODdirectedtheDefenseInformationSystemsAgency(DISA)toleadtheacquisitionofanewITsystemtoreplaceallOPMlegacyITsystemssupportingbackgroundinvestigationprocesses.In2016,DISAestablishedtheNBISProgramManagementOfficeand,accordingtoDOD,awardedtheinitialothertransactionagreement(acontractingmechanism)in2018todeveloptheNBISsystem.

14

In2019,DODthenestablishedDCSAtoassumeresponsibilityfromOPMforconductingbackgroundinvestigationoperationsformostexecutivebranchagencies.

15

DODsubsequentlytransferredtheNBISProgramManagementOfficefromDISAtoDCSAonOctober1,2020.DCSAalsotookovertheownershipandmaintenanceofOPMlegacysystemsonthatdate.DCSAisnowthefederalgovernment’sprimaryinvestigativeserviceproviderandconductsmorethan95percentofthegovernment’sbackgroundinvestigations.

16

Figure1belowshowsatimelineofIT-relatedeventsforbackgroundinvestigationssince2015.

14Othertransactionagreementsareagreementsotherthanprocurementcontracts,cooperativeagreements,andgrantswhicharenotsubjecttocertainfederallawsandregulations.DISAstateditusedanothertransactionagreementforNBISdevelopmenttoacquireleading-edgetechnologiesbytappingintoanon-traditionaldefensecontractorbaseandtoengageindustryforabroadrangeofresearchandprototypingactivities.

15SeeExec.OrderNo.13,869,TransferringResponsibilityforBackgroundInvestigationstotheDepartmentofDefense,84Fed.Reg.18,125(Apr.24,2019)(amendingExecutiveOrderNo.13,467).Section925oftheNationalDefenseAuthorizationActforFiscalYear2018generallyresultedinthetransferofbackgroundinvestigationsfromOPMtoDODforDODpersonnel.SeePub.L.No.115-91,§925(a)-(d)(2017).Inadditiontoimplementingsection925,ExecutiveOrder13,869transferredresponsibilitytoDCSAforconductingnationalsecuritybackgroundinvestigationsformostotherexecutivebranchagencies.Itfurtherfacilitatedthedelegationofresponsibilityforsuitabilityandfitnessbackgroundinvestigationsformostnon-DODagenciesfromOPMtoDCSA.SeeExec.OrderNo.13,869,§§1,2(amendingsection2.6ofExecutiveOrderNo.13,467).

16WhileDCSAconducts95percentofthegovernment’sbackgroundinvestigations,someexecutivebranchagencieshavetheauthoritytoconductallorsomeoftheirowninvestigations,accordingtoODNI.SuchagenciesincludetheCentralIntelligenceAgency,theFederalBureauofInvestigation,andtheStateDepartment,aswellassomeDODcomponentsincludingtheNationalSecurityAgency.AccordingtoOPMofficials,OPMalsodelegatestoDCSAandseveralotheragenciestheauthoritytoconducttheirownsuitability,fitness,andcredentialinginvestigations.

Letter

Page6

GAO-23-105670PersonnelVetting

Figure1:TimelineofInformationTechnology(IT)-RelatedEventsforBackgroundInvestigationProcesses,2015–2024,asofFebruary2023

NBISSystemPlanned

Capabilities

TheNBISsystem’scapabilities,oncefullydeployed,willincludearangeofsoftwaretoolsanddatarepositoriestoenablepersonnelvetting.Thisincludesthecompletionofelectronicformsbyindividualswhoaresubjecttopersonnelvetting,investigationmanagement,subjectmanagement,therecordingofbackgroundinvestigationadjudicationdecisions,continuousvetting,andotherprocessesrelatedtomanagingthebackgroundinvestigationre