FSOTOOLSIndustrial security / Independent resources
Open the Atlas

Holding a clearance · Continuous vetting

Continuous vetting

Your clearance used to be re-examined every five or ten years. Now records about you are checked continuously, and the reinvestigation is gone. This guide explains what is checked, who sees it, what an alert means, and the two things continuous vetting does not do for you.

What an alert means What you must still report

What changed

Two models, side by side. The second is the one you are in.

QuestionPeriodic reinvestigation (the old model)Continuous vetting (now)
When are you looked at?On a calendar: every five years for Top Secret, every ten for Secret, with a new SF-86 and a new investigation each time.All the time. Automated record checks run throughout your period of eligibility, and investigative work happens when a check raises something, not on a schedule.
Is there still a reinvestigation?Yes, that was the whole mechanism.No. DCSA ended periodic reinvestigations for NISP contractor national security personnel in its April 2026 guidance, and the government-wide program office reports DCSA retired the legacy reinvestigation products at the end of June 2026, with a few limited exceptions.
What do you still have to fill out?The SF-86 at each reinvestigation.An updated questionnaire every five years regardless of clearance level: the SF-86 in eApp today, or the new Personnel Vetting Questionnaire (PVQ) as it rolls out. The due date is keyed to the PVQ Date your FSO can see in DISS.
What did you consent to?Investigation and reinvestigation.The same signature. When you signed the SF-86 you authorized background investigations, reinvestigations and continuous evaluation. There is no separate opt-in, and declining means you cannot hold eligibility.

The rule book has not entirely caught up: 32 CFR §117.3 still defines continuous evaluation as something that “supplements, but does not replace” scheduled periodic reinvestigations. DCSA’s 2026 guidance and the Performance Accountability Council’s quarterly reports describe the model actually in use. Where they differ, you are living under the 2026 guidance.

What is checked

The Security Executive Agent prescribes seven categories of records. DoD adds its own.

Clearance eligibilityChanges to your eligibility recorded by any agency.
TerrorismGovernment terrorism-related databases.
Foreign travelTravel records. This is why unreported foreign travel surfaces even when nobody saw you leave.
Suspicious financial activityReports of unusual financial transactions.
Criminal activityArrests, charges and dispositions, increasingly through FBI Rap Back (below).
Credit reportsPulled as employment “soft inquiries”, which do not affect your credit score.
Commercial public recordsCourt filings, liens, judgments, bankruptcies and similar public data.
DoD-specific recordsDCSA also draws on agency records: insider threat program information, security incidents and what you and your company have self-reported.
Not social mediaODNI’s own answer: continuous evaluation reviews publicly available electronic information but does not include review of social media. Separate policies govern whether an agency may look at social media during an investigation, and your agency or contract may add its own rules.

Fingerprints and Rap Back

FBI Rap Back is the criminal-records part of continuous vetting. Instead of re-submitting your fingerprints at each reinvestigation, the prints you already gave are retained in the FBI’s system and continuously searched, and the agency that enrolled you is notified electronically of any arrest, disposition, warrant, sex-offender-registry entry or death notice that matches them.

DCSA brought the wider contractor workforce into Rap Back in phases starting April 1, 2026. Phase 1 enrolled people whose fingerprints DCSA has held since May 6, 2018; phase 2 uses prints the FBI has held since June 2010; phase 3 is people with no prints on file, who are the only ones asked for new fingerprints. If you are in phase 3 your FSO receives a list with your name on it and will tell you. Nobody else needs to be re-printed.

The two FBI notices you were handedBefore enrolling anyone, DCSA required every FSO to distribute the FBI Privacy Act Notice and the Noncriminal Justice Applicant’s Privacy Rights to all cleared employees and keep a record of doing so. If you never received them, ask. They explain your right to obtain and challenge your FBI record.

Who is enrolled, and when it lapses

  1. 1

    Everyone with DoD eligibility, since October 1, 2021

    DCSA announced that day that all DoD clearance holders were enrolled. Enrollment is automatic when eligibility is granted; there is nothing for you to sign beyond the questionnaire.

  2. 2

    Your status is in DISS: Enrolled, Unenrolled or Not Enrolled

    Since DISS release 14.5 (April 2, 2026) those are the three states. You cannot see DISS, but your FSO can, and “Not Enrolled” with no PVQ Date means a questionnaire is needed to enroll you.

  3. 3

    Leaving a job starts a 45-day clock

    When your company drops its DISS relationship with you, a 45-day grace period begins. If a new security office does not pick you up in that window your status becomes Unenrolled. Your eligibility itself is not affected unless there is unresolved derogatory information, and once a new employer establishes the relationship you are re-enrolled automatically, with no new SF-86 or PVQ.

  4. 4

    Staying employed without needing access keeps you enrolled

    If you keep your job but no longer need classified access, DCSA’s DISS guidance keeps you enrolled and keeps your company’s reporting duties about you in force. Only when there is no reasonable expectation of future access does the company end the relationship, and with it those duties.

What an alert is, and is not

An alert is the system saying a record changed. Everything after that is people.

  1. 1

    A record check returns a match

    DCSA first confirms the record is actually about you, then assesses whether the alert is valid and worth pursuing. Investigators are required to make reasonably exhaustive efforts to verify that discrepant information pertains to the person it was matched to.

  2. 2

    It is a lead, not a decision

    In ODNI’s words, information identified during continuous evaluation is used “for investigative lead purposes only,” and “no action will be taken based solely on information identified during the CE process without follow-up and review using established national security adjudicative guidelines.” Those guidelines are SEAD 4, the same ones used at your initial adjudication.

  3. 3

    Adjudicators look at whether you already reported it

    DCSA’s own training on alert handling describes checking, for an arrest alert, whether the person self-reported it. An event you reported first arrives at the adjudicator with your account attached. The same event found by a record check arrives without it.

  4. 4

    You hear about it only if follow-up is needed

    No official source says you are told when an alert fires, and in practice you are not. You learn of it when DCSA needs something: a request for information or an updated questionnaire through your FSO, an interview, or, if adjudicators propose to deny or revoke, a Statement of Reasons. What each of those means is on when something comes up.

How oftenThe only published figure is the Performance Accountability Council’s: for every hundred enrollees, continuous vetting identifies on average about 1.13 new actionable alerts per quarter. No agency publishes how many of those end with no action, so treat any such percentage you read elsewhere as a guess. DCSA’s stated outcomes range from working with the person to mitigate the concern to, in some cases, suspension or revocation.

What it does not do for you

It does not report for youCDSE’s job aid is blunt: covered individuals are still required to self-report life events or incidents that could affect their eligibility, and self-reporting “is preferable to an incident discovered solely” by automated checks. ODNI’s FAQ says continuous evaluation does not change the reporting requirements set by SEAD 3. Foreign travel, foreign contacts, arrests and financial trouble are yours to report, before the system finds them. See your reporting duties.
It does not keep your questionnaire currentEvery five years you complete an updated questionnaire, keyed to the PVQ Date in DISS. If DCSA cannot verify your enrollment it asks for one. Your FSO sees the date; you should know roughly when yours falls, so a request does not arrive as a surprise or get missed during a job change.

What to do about it

  1. Know your FSO and how to reach them. Every report, request and notice in this system passes through that person. If your company’s FSO is part time, find out who covers when they are not there.
  2. Report first. If something has happened that SEAD 3 or your company’s rule says to report, report it before a record check does. The event is the same either way; the context is not.
  3. Keep a copy of your last questionnaire. The five-year update starts from what you said last time, and a copy makes the update accurate instead of reconstructed.
  4. Ask when your five-year update is due. Your FSO can read the PVQ Date in DISS.
  5. Changing employers: mind the 45 days. Make sure the new security office picks up your record promptly. Unenrolled status is recoverable, but an open question at the old employer is better resolved before you leave.
  6. Check your own records. Credit reports from the three bureaus are free, and the FBI advisements explain how to request and correct your identity history summary. Errors in those records can produce alerts about things you did not do; finding them first is easier than explaining them later.

What is still changing

Trusted Workforce 2.0 is being delivered in “maturity states”. The national security workforce is in state 1.5 and the program office expects state 2.0 in FY2028. Dates below are the official milestones as of the FY2026 third-quarter report.

  • Personnel Vetting Questionnaire (PVQ): first forms collected in early 2026; several hundred by June 2026. The PVQ is to be used for all vetting scenarios by September 2027. Until then the SF-86, which OPM proposed in July 2026 to renew without change, remains in use alongside it.
  • Individual Engagement Platform: a self-service portal launched in 2026 for application status, self-reporting and the five-year update. DCSA described it to industry in October 2026 as a future capability for contractor personnel; follow your FSO’s instructions on what to use today.
  • Rap Back phase 3: lists of people without fingerprints on file reached security offices from August 2026; those people are fingerprinted as DCSA directs.
  • Everyone else: non-sensitive public trust positions are being enrolled now, the low-risk population is to be offered CV by September 2027, and the full federal population is to be enrolled by September 2028.
  • Candor from the program office: the same report rates its risk-management goal “Poor”, citing delays in continuous vetting enhancements. The system you are enrolled in is real and running, and it is also still being built.

For what DCSA told industry on October 6, 2026 about DISS, the PVQ and Rap Back, see the October 2026 operational update.

Sources

Checked . An independent guide for cleared employees, not legal advice. Your agency, company and contract may add requirements; when a briefing and this page disagree, follow the briefing and ask your security office which is current.