One sentence starts the clock when DCSA notifies you. The contractor “will immediately deny access to classified information to any employee when notified of a denial, revocation, or suspension of eligibility regardless of the contractor employee’s location,” per 32 CFR 117.10(a)(2)(ii) (7-1-25 edition). It says nothing about pay, employment or reassignment. Everything past the access cut is your decision.

What does the regulation actually require of you?

Cut access, notify the customer if the person sits at a USG facility, debrief, correct the DISS record, change the combinations that employee knew, keep reporting adverse information.

The sequence in 117.10(a)(2) is short: the Cognizant Security Agency tells you eligibility has been denied, suspended or revoked; you deny access wherever the employee sits, and notify the GCA if performance is at a government facility. For most of industry the CSA is DoD, acting through DCSA. Section 117.12(l) then requires a debriefing.

Two further duties fire on the same event. Section 117.10(a)(3) requires you to “annotate and maintain the accuracy of” the employee’s record in the CSA’s system of record, a DISS act separate from the debrief note in your file. And 117.15(c)(4) routes you to 32 CFR 2001.43(c), which changes combinations “[w]henever a person knowing the combination no longer requires access to it unless other sufficient controls exist to prevent access to the lock.” Pulling access is that moment, and an access-and-report checklist alone leaves the vault and container combinations live.

The reporting duty is the underestimated one. Under 117.8(c)(1), “the termination of employment of an employee does not negate the requirement to submit this report,” and the separation is itself reportable. Citing Becker v. Philco, the same section shields a hesitant FSO: a contractor “may not be liable for defamation” for required communications. That covers the mandated report, not what a manager tells the team.

Is an alert the same thing as a suspension?

No, and the difference decides whether you backfill. An alert is an unvalidated record-check hit. A suspension is interim. Only a final adverse decision moves the case into the hearing machinery.

DCSA’s description of continuous vetting puts the validity check first: “when DCSA receives an alert, it assesses whether the alert is valid and worthy of further investigation.” Outcomes include “working with the cleared individual to mitigate potential issues, or in some cases suspending or revoking clearances.” Nobody publishes how often an alert becomes an adverse action, and you may never learn of one.

Do not read the notice as a finding of near-treason. It arrives under 117.10(a)(2)(i), which states no standard. The imminent-threat sentence employers quote, 32 CFR 155.6(d), grants one authority to the ASD(C3I) with DoD General Counsel concurrence, and 155.6(e) preserves other officials’ powers. DoDM 5200.02 para. 9.4.a routes NISP contractor personnel to DoDD 5220.6 and Volume 2 of DoDM 5220.22 rather than to the DoD CAF; 9.4.b sets the bar for suspending access at information raising “a serious question as to the individuals’ ability or intent to protect national security information,” and gives the Director, DSS (now DCSA) that authority over NISP contractor employees. A delinquent debt or an arrest can clear it.

Part 155 covers less than employers assume. Section 155.2 applies only to cases DISCO forwards to DOHA, does not reach a clearance withdrawn for lack of need or “for administrative reasons that are without prejudice,” and “[d]oes not apply to cases for access to sensitive compartmented information or a special access program.” SCI due process runs on DoDI 5210.45 and Intelligence Community Policy Guidance 704.3; special access programs run under their own DoD channel. Neither carries the Part 155 deadlines, the expedite clause or the reapplication bar. Due process ripens at revocation: SEAD 4 attaches the Executive Order 12968 Part 5 proceedings to a decision “to deny or revoke,” not to a suspension, and sec. 5.2(c) creates “no procedural or substantive rights.” Their side of it: a suspension under continuous vetting. Three postures follow: an alert leaves the seat filled; a suspension empties it for an unpublished stretch, so bridge rather than replace; a revocation or final denial you fill for good.

What are you forbidden to do with the flagged employee?

Do not circulate the SF-86 inside the company, do not adjudicate the case yourself, and do not file a report built on rumor.

Section 117.10(d) directs the reviewer to “not share information from the employee’s SF 86 within the entity” and requires written notice that the review is for adequacy and completeness only. Forwarding it to a program lead to plan the backfill is what it forbids. Read the scope narrowly: it governs the SF-86, not every paper in the file. Adjudication is not yours either; 117.10(a)(1) leaves you only the question whether access is essential to the contract. And “contractors will not make reports based on rumor or innuendo.”

Then the trap, a mis-trigger rather than a prohibition. Section 117.8(e) requires a “graduated scale of administrative and disciplinary actions,” but it applies “in the event of employee security violations or negligence in the handling of classified information.” An alert about a debt, an arrest or a treatment episode is not one. Nothing there tells you to discipline anyone, and nothing there stops you.

Who pays for the idle seat?

You do. Nothing in the rule set creates a right to pay, paid leave or reassignment, and nothing requires you to terminate the person.

The federal analogy does not hold. 5 U.S.C. 7532(a) lets an agency head suspend a federal employee “without pay” for national security reasons, but 5 U.S.C. 7531 defines “agency” for that subchapter as a named list including Defense, not the government at large. It does not reach contractors, and even where it applies the default is unpaid.

The nearest money remedy runs to the individual. Appendix A to Part 155 lets a claimant petition “under oath or affirmation” for lost earnings, attaching the favorable clearance decision, on clear and convincing evidence that the action caused the loss and “was due to gross negligence of the Department of Defense.” Item 43 requires the claim to be filed “within 1 year after the date the security clearance is granted.” Recovery is capped at the earnings differential, counsel’s fees excluded. Nothing reimburses the contractor for the seat.

Does the seat have to empty at all?

Not always. Since February 2024 DCSA has granted conditional eligibility to NISP contractors specifically to route cases away from due process and into monitoring.

The DCSA announcement of June 4, 2024 is blunt: conditionals divert “national security cases from due process to monitoring provided by the… Continuous Vetting (CV) program.” That is policy in operation, not a guarantee in any case. SEAD 4 Appendix C defines a Condition as eligibility continued “despite the presence of issue information that can be partially but not completely mitigated,” with measures such as monitoring or access restrictions. The employee may return to the contract, not to every compartment.

Self-reporting helps: SEAD 4 Appendix A lists it among six things an adjudicator weighs, though it assigns no weights. What staff owe is three stacked layers, not two tiers, and the skipped one is universal. SEAD 3 Section F binds every holder at every level: file an itinerary for unofficial foreign travel and “receive approval prior to the foreign travel,” reporting deviations and unplanned Canada or Mexico day trips within five business days of return; report unofficial contact with a suspected foreign intelligence entity and association with foreign nationals involving “bonds of affection, personal obligation, or intimate contact”; and flag eight categories of concern about other covered individuals. DoD-cognizance contractors have been on that clock since 2022 (32 CFR 117.1(b)(3)). Section G adds, for Secret and Confidential, foreign citizenship and passport applications, attempted elicitation, media contacts seeking classified information, arrests, debt over 120 days delinquent, and alcohol- and drug-related treatment. Section H, for Top Secret, is written “[i]n addition to the reporting requirements in Section F,” not to Section G, and adds foreign business, bank accounts, property, voting, foreign adoptions, a foreign roommate past 30 calendar days, cohabitants, marriage, and asset infusions of $10,000 or greater. Failing to report is itself grounds for “revocation of national security eligibility.”

How long will the employee be gone?

Nobody publishes that. What exists is throughput for new investigations, a different pipeline, plus one DoD threshold.

The FY2026 Q2 Trusted Workforce 2.0 report has DCSA processing investigations in an average of 44 days for Secret-level and 57 days for Top Secret-level cases, the fastest since FY2012 Q3. Two caveats: those are initial investigations, not the resolution of a flag, and the “fastest 90 percent” standard excludes the slowest tenth by construction. A move to a 100-percent standard “will decrease reported timeliness.”

The adjacent column governs when a replacement gets badged. End-to-end timeliness in FY2026 Q1, the last quarter reported as actual, was 92 days for Moderate Risk and 205 days for High Risk against targets of 40 and 75, on that same flattering basis. The FY2026 Q2 points, 85 and 148, are a dotted projection captioned “ODNI reporting is a quarter behind.”

One famous timing lever is weak. Section 155.6(d) requires Appendix A proceedings to be expedited only “whenever an applicant’s security clearance has been suspended pursuant to this section,” meaning by the ASD(C3I) with General Counsel concurrence, and Appendix A does not start until DOHA has the case and a Statement of Reasons issues. The usable one is DoDM 5200.02 para. 9.4.i: suspensions “exceeding 180 days must be closely monitored and managed by the adjudication facility concerned,” and OUSD(I&S) tracks how many do.

The employee’s own clocks are short, and both are receipt deadlines with different triggers. An answer to a Statement of Reasons “must be received by the DOHA within 20 days from receipt of the SOR”; a late answer lets DOHA discontinue the case and direct revocation. A notice of appeal must be filed “within 15 days after the date of the Administrative Judge’s clearance decision,” so that clock starts on the decision date, not the day the envelope is opened. Our piece on time-to-billing on a cleared hire runs it from the hiring side.

What changed in 2026?

The DCSA news release of May 19, 2026, superseding guidance from August 2022, states that periodic reinvestigations “will no longer be required” and that all individuals “must now submit an updated Personnel Vetting Questionnaire (PVQ or SF-86 eApp and releases) every five years, regardless of their eligibility level,” timed off the PVQ Date in DISS. A calendar keyed to investigation anniversaries is keyed to the wrong field. Meanwhile 32 CFR 117.3 still calls continuous evaluation a process that “supplements, but does not replace” periodic reinvestigations. Adverse information now surfaces “three years faster for Top Secret clearance holders and seven years faster for Secret clearance holders,” per the January 2025 transition report.

How do you backfill, and when is a job board the wrong tool?

The rule caps the clearance requests you may submit, not the cleared people you already employ.

Section 117.10(a)(5) limits clearance requests “to the minimum number of employees and consultants necessary” and says they “will not be used to establish a cache of cleared employees.” Note what that reaches: submissions, not headcount. Nothing forbids retaining staff who already hold eligibility, which is why buying a vendor’s cleared bench is lawful while pre-clearing your own spares is not. Under 117.10(h) an eligibility determination resting on an investigation of adequate scope “will provide the basis for a new eligibility determination,” used without further investigation absent significant unadjudicated derogatory information. That is why an already-cleared crossover badges fast, the mechanics of a recompete rebadge.

We run a cleared job board, so take this as our judgment against our own product. A posting works for volume Secret and TS-without-poly reqs, where the population is deep enough for inbound and you can wait for a crossover instead of paying a placement fee. For a TS/SCI full-scope-polygraph seat due inside three weeks it loses to a staffing firm’s pre-vetted bench: that pool is too small for inbound to reach, and no posting surfaces people who are not looking. See what a cleared hire really costs and where to post cleared jobs.

One option gets forgotten, and it carries four conditions, not two. Where eligibility survives and no current requirement for access exists, 117.10(i) lets you administratively terminate access and later restore it without further investigation, but only “based on CSA guidance,” and only while the employee stayed in continuous employment, remains eligible, “has a current investigation of a scope that meets or exceeds that necessary for the access required and no new derogatory information is known.” That last clause is load-bearing here. Reporting continues “even when access to classified information has been administratively terminated,” and none of it undoes a CSA suspension.

Frequently Asked Questions

Does a continuous vetting alert mean my employee’s clearance is suspended?

No. DCSA first assesses whether the alert is valid, and its published description lists mitigation with the individual as an outcome. Your access-denial duty begins when the CSA notifies you, not when a database pings.

Must I fire an employee whose clearance is suspended?

Nothing in the NISPOM rule, SEAD 3, SEAD 4, EO 12968 or Part 155 requires termination, and nothing forbids it. Weigh one cost first: in the DOHA program a final denial or revocation bars reapplication for one year from the initial unfavorable decision, only an employer can file it, and a refusal to reconsider adds a further year.

Do we have to keep paying a suspended cleared employee?

No federal source creates or forbids a pay entitlement during suspension. The federal-employee statute, 5 U.S.C. 7532, does not reach contractors, and its own rule is unpaid. Treat it as an employment decision and check your state’s wage rules.

Can I tell the program manager why the employee was pulled?

Not from the SF-86. Section 117.10(d) bars sharing that form inside the entity or using it beyond checking its adequacy and completeness. No rule located here scripts what else you may say. Tell them the person is off classified work.

The practical read

Treat the notification as two problems in one email. The compliance one is finishable in an afternoon: deny access, notify the GCA, debrief, fix DISS, change the combinations, keep reporting. The business one is unspecified by any regulation and yours alone. This is what the rules say, not legal or HR advice.

Plan against the direction rather than the numbers. Investigation throughput is at its best since 2012 while end-to-end time runs more than twice target, and periodic reinvestigations ended in May 2026. No source publishes how many industry clearances get flagged, so plan on timing, not volume. Brief all three reporting layers before the first alert lands.