One sentence in a Defense Counterintelligence and Security Agency policy answers what your hiring team keeps asking. Appendix B, item 9 of the DISS Account Management Policy, version 2.0: “Industry companies are authorized to verify prospective employees’ eligibility for access to classified information in DISS prior to an offer of employment being extended.” The next sentence never travels with it. “However, they may not use DISS for recruiting purposes.”

One disclosure belongs at the top. That policy promises to be “reviewed at least annually,” yet its revision history stops at version 2.0, 24 June 2021. DCSA still linked it from the DISS Resources page in the 2 July 2026 archive: the rule you follow today is five years old and unreissued.

Which system holds the answer, and what does the rule call it?

The Defense Information System for Security, through its Joint Verification System. The NISPOM rule never addresses verifying a job candidate at all.

The phrase “CSA-designated database” appears five times in part 117, never in a hiring context: twice at 117.16(a)(4) for a visitor’s clearance, once at 117.17(a)(2)(i) for a subcontractor’s entity eligibility, twice for NATO and CNWDI records. 32 CFR 117.5(d) names the system only to assign it OMB Control Number 0704-0573, and still describes JPAS in the present tense though JPAS stopped being the system of record on 31 March 2021. The pre-offer look-up rests on one authority, and it is not the CFR.

Who inside your company is allowed to run the query?

A named individual your company nominates and DCSA provisions. That can be a human resources manager. The FSO-only rule most employers believe in is not in the policy.

Section 2 describes JVS as “primarily used by security officers (SO) and facility security officers (FSO), component adjudicators, and human resource managers.” Appendix A lists Human Resource Manager among its JVS roles, and DCSA’s role-combination table lets it sit alongside Account Manager, the role the SSN job aid names as running the look-up. The gate is the person and the permission, not the department: a holder must be a U.S. citizen with “a completed Tier 3 or higher investigation with a favorable adjudication,” provisioned individually, never as a “company, office, or shared account.”

Permissions narrow it again. On DCSA’s seven-column matrix, “View Non-SCI Access” is mandatory for two roles, Security Officer and Security Manager; Human Resource Manager gets read-only subject information. The question is not whether a recruiting-side person may hold an account, but which permissions it carries and whether need-to-know is met on this candidate. Appendix A warns that its matrix describes a 2021 interface.

Where is the line between verifying and recruiting?

Item 9 authorizes a look-up on a named candidate before an offer. The preamble above it is narrower, item 10 shuts one workaround, and item 11 hands you a duty.

The Appendix B preamble says DISS records must be “used only for authorized purposes,” then sets the general limit: “Contractors may only use their DISS accounts to manage the access records of their employees and consultants, and to verify the access levels and affiliations … of incoming visitors who require access to classified information.” Two purposes; item 9 adds a third. Item 9 is the specific rule, the preamble the general one, and neither, on our reading, reaches someone who has not applied to you. That is our reading, not a rule: DCSA defines neither “prospective employee” nor “recruiting purposes” anywhere in the policy.

Item 10 closes the next door: “DISS is not a classified system. Defense Counterintelligence and Security Agency (DCSA) will not grant a facility security clearance (FCL) for the sole purpose of allowing a company or its employees to gain access to DISS.” The FCL you hold makes the look-up legitimate, not secret.

Item 11 is the one nobody quotes, and it binds the reader: “Anyone that becomes aware of a DISS user violation of these procedures shall immediately report the nature of the violation, the names of the responsible parties, and a description of remedial action taken, to the servicing DCSA industrial security representative.”

The misuse list opens “Misuses of DISS include, but are not limited to.” A catch-all, so you may not argue a practice is fine because it is absent. Thirteen items follow, among them “printing or taking screenshots of DISS data,” “querying the DISS application for information you have no need to know,” and “allowing others to view data on the DISS screen that do not have the proper authorization.” That last one turns on authorization, whatever the job title, not on recruiters as a class. The consequences are discretionary throughout: a violation “may lead DCSA to … document the incident on the DISS subject record of the violator(s), or may exclude culpable companies or persons,” with referral for “administrative, civil or criminal sanctions.” May, not will.

Two rules govern what you do next. 32 CFR 117.10(a)(5) says eligibility requests “will not be used to establish a cache of cleared employees,” which restricts submitting people for investigation, not looking them up. (a)(7) is the harder one: “Contractors will not submit requests for determination of eligibility … for individuals who are not their employees or consultants; nor will they submit requests for employees of subcontractors.” A verification you liked is not a sponsorship you may file. Crossover recruiting sits inside both.

Why can’t the candidate pull their own record and show you?

Because DCSA does not authorize an FSO to hand the record to its subject. The policy names two conditions, not one, and its address is five years stale.

Section 5.2 says DISS “does not include giving out the records to the subject of record for their personal use without a proper Privacy Act request or authorization from the record owner.” Two conditions; the second is usually quoted away. The file holds adjudication and incident information, some from a third-party agency that must review before disclosure, so “DCSA does not authorize the direct disclosure of records by a security manager or FSO to the subject of record.”

Do not use the Quantico address in that 2021 policy. DCSA’s current instruction routes a clearance-record request to the FOI and Privacy Office for Adjudications and Vetting Service, by DCSA Form 335 or in writing to [email protected], and requires full name, date and place of birth, full social security number, a description of the records, an address, and “an original, notarized statement or an unsworn declaration in accordance with 28 U.S.C. 1746.” A plain signed letter comes back for more information. On status rather than records, DCSA’s advice is shorter: “contact their Security Manager or Facility Security Officer.”

The paragraph’s last sentence explains the design: “Service schools requiring clearance verification can either request access themselves or have the user agency provide the subject’s clearance verification.” The record moves security office to security office, never to the candidate.

What does the look-up not settle?

SCI, and eligibility that expires.

SCI is the granting authority’s call rather than DISS’s, under 32 CFR 117.10(a)(8); the two databases are not interchangeable. And temporary eligibility, formerly interim, “shall not exceed one year unless approved by the applicable CSA in the system of record,” while 117.10(l)(6) adds that its withdrawal “is not a denial, termination, or revocation of eligibility … and may not be appealed.” An interim determination can evaporate without a hearing.

What is actually owed to you on reciprocity, and when?

Nothing, in the strict sense. Every duty in the directive runs to agencies, the exceptions are seven rather than two, and the text creates no enforceable right.

SEAD 7, effective 9 November 2018, applies “to any executive branch agency, authorized investigative agency, and any authorized adjudicative agency.” A cleared contractor is none of those. It directs agencies, not you, to review “Scattered Castles, the Joint Personnel Adjudication System … or successor databases”; JPAS appears because the directive predates its retirement, and the successor is DISS.

All seven exceptions, since quoting a subset is how this gets misused: new adjudicatively relevant information since the last investigation; an investigation over seven years old; an adjudication recorded with an exception under SEAD 4; a Bond Amendment disqualifier where the person needs SCI, SAP or restricted data; extra requirements approved by the Security Executive Agent; eligibility granted on a temporary, limited or one-time basis; eligibility currently denied, revoked or suspended. Three carry tails that reopen the door. Seven years: agencies “may accept background investigations more than seven years old on a case-by-case basis,” then “shall immediately initiate a reinvestigation.” Recorded exception: “Agencies may accept national security eligibility adjudications recorded with an exception based on their own risk assessment.” Denial: the year that follows is advisory (“should remain ineligible”), and footnote 3 narrows it further, without which your team reads a routine debrief as a revocation: “this does not include an administrative termination due to a change of need-to-know, a departure from a sensitive position, or the individual is no longer affiliated with the U.S. Government.” Most people sitting without current access live in that footnote. Where none of the seven applies, only the Security Executive Agent may disallow reciprocity.

The provision likeliest to be quoted at you must be read whole, at its own scope. E.7 opens: “Agencies shall accept an active national security determination and may not request updated security information for a covered individual who currently has access to classified information … for the following purposes: interagency visits, coordination, information exchange, or other official activities.” The second sentence takes the hiring case back out: “This does not apply to temporary (interim) eligibility determinations, when taking security sponsorship over the covered individual, or to joint duty, detailee, task force, or similar assignments.” Both bind agencies, not you: when your hire is sponsored afresh, the receiving agency is not the one E.7 tells to stop asking.

Two clocks, two starting events. SEAD 7 requires reciprocity determinations “within five business days of receipt by the agency’s personnel security program,” and the next sentence gives the basis: “processing for employment, suitability, or fitness requirements is considered outside the scope … and will not be counted.” Separately, 117.10(f) allows a pre-employment submission after a written commitment and a written acceptance, and requires the commitment to “indicate employment will commence within 45 days of the employee being granted eligibility.” The obligation is on the document you issue; the 45 days run from the grant, not the offer. Neither clock is a time to start, and SEAD 7 adds its honesty clause: it “does not … create any right … enforceable by a party against the United States.” Plan the sponsorship path that way.

When is a job board the wrong tool for this?

Whenever the question is verification. We run ClearedJobs.NET, and a profile on our board is a self-reported claim, like one on any board, aggregator or network. No job board verifies a clearance, and none can. DCSA forbids using DISS for recruiting: the systems that verify and the systems that source are separate by design.

Three channels beat us. A cleared staffing agency already employing the candidate holds the owning and servicing relationship in DISS and answers about its own people with no external check. A government customer’s security office resolves an SCI question no contractor reaches on JWICS. A referral from an incumbent on the same contract carries a verification path a board never will. None of this is legal advice; citizenship and Privacy Act questions go to counsel.

The migration to NBIS will change the account, the roles and the screen; in the 16 July 2026 snapshot of DCSA’s NBIS page, industry onboarding was still running. The rule underneath never depended on the interface: verification is an act by a named, provisioned account holder, on a named candidate, for a real requirement. So before your next cleared req opens, find out who holds a provisioned account and what permissions it carries. If that is one person, you have a single point of failure, and nothing stops you nominating a second.

Frequently Asked Questions

Can we ask a candidate about their clearance in a posting or an interview?

Nothing in this research answers it. 32 CFR part 117 governs contractors handling classified information; it does not regulate interview questions, job advertisements or applicant tracking fields. The one statutory constraint is 8 U.S.C. 1324b, on national-origin and citizenship-status discrimination. Its (a)(2) exceptions are three: employers with three or fewer employees; national-origin discrimination covered by section 703 of the Civil Rights Act of 1964; and citizenship-status discrimination “otherwise required in order to comply with law, regulation, or executive order, or required by Federal, State, or local government contract,” or which the Attorney General finds essential to doing business with government. That third is conditional, not blanket. Nor does the list end there: (a)(4) permits preferring “an individual who is a citizen or national of the United States over another individual who is an alien if the two individuals are equally qualified.” Take specifics to counsel.

Is a screenshot of a DISS record acceptable proof?

No, and accepting one implicates whoever made it. “Printing or taking screenshots of DISS data” is on DCSA’s misuse list. A candidate offering an image of their record is offering evidence of a misuse, and Appendix B item 11 obliges anyone aware of one to report it immediately, with names, to the servicing DCSA industrial security representative.

Can our FSO check Scattered Castles for an SCI candidate?

Generally no, and we label that our inference rather than a published prohibition. ICPG 704.5, dated 25 February 2020, puts Scattered Castles on JWICS and addresses IC elements and entities designated to determine SCI eligibility, saying nothing about contractors. What would prove us wrong: an employer whose people sit under a government sponsor with a JWICS-connected special security office.

Once verification comes back clean, when can the person start?

A different question, and this article carries no processing-time figure. The two published clocks start from different events: 45 days from the grant of eligibility, which the written commitment must state, and five business days from receipt by an agency’s personnel security program. Neither is a start date. Verification gives the record’s state; the sponsorship path gives you the calendar.