High-risk federal vetting cases closed in the fourth quarter of fiscal 2025 averaged 220 days start to finish. Twelve of those days were intake. Forty belonged to the adjudicator. The remaining 168, better than three-quarters of the total, were the background investigation itself. The agency that ran that investigation, and by its own count most federal adjudications as well, is the Defense Counterintelligence and Security Agency.

DCSA is the reason a cleared job offer arrives with a start date nobody will commit to, and the reason a company can hold a classified contract at all. Which of its decisions bind you, and which route elsewhere, is worth knowing precisely.

What is DCSA, and what did it replace?

DCSA is a Defense Agency created in 2019 by renaming the Defense Security Service and handing it the federal government’s background-investigation workload. It is not independent. Its Director sits under the authority, direction and control of the Under Secretary of Defense for Intelligence and Security.

Executive Order 13869, signed April 24, 2019, did the work. It directed the Secretary of Defense to rename DSS as DCSA and stated that “the DCSA shall serve as the primary Federal entity for conducting background investigations for the Federal Government.” The order set a hard date of June 24, 2019 for DCSA to take over deciding eligibility for classified access and for sensitive positions. OPM’s National Background Investigations Bureau could keep running investigations on DCSA’s behalf only until September 30, 2019.

The order was deliberate about continuity: DCSA would serve “as a continuation of the former DSS” as the primary DoD component for the National Industrial Security Program. Only April 24 and June 24 are quotable from it; the June 20, 2019 rename date in trade coverage has no primary source.

The governing directive took years to catch up. DoD Directive 5105.42 reissued and cancelled the August 3, 2010 Defense Security Service directive, but did not take effect until January 16, 2025. DCSA spent over five years under an issuance bearing its predecessor’s name, and 32 CFR 117.6(b) still cites that directive by its old DSS title.

What are DCSA’s three jobs?

Paragraph 1.2 of the 2025 directive gives DCSA exactly three missions: administer the DoD portion of the NISP, conduct security, suitability and credentialing personnel vetting with related insider-threat support, and administer DoD’s security education, training and certification program.

The scale figures need care. DCSA calls itself the largest investigative service provider in the federal government, overseeing 12,500 cleared facilities under the NISP, investigating for 95% of the federal government across 105 departments and agencies, and adjudicating 70% of the government’s adjudicative determinations. Every one comes from the agency’s own About Us page: no vintage, no methodology, no independent verification. Read from a December 30, 2025 archive capture, they are late-2025 self-description, not audited statistics.

Can DCSA revoke your employee’s clearance?

For military members and DoD civilians, yes. For cleared contractor employees, the 2025 directive gives DCSA narrower powers: grant, issue preliminary determinations, and suspend. Denial and revocation of contractor eligibility are not listed there.

The text is precise. DCSA “renders determinations, to include preliminary determinations, to grant, deny, suspend, or revoke eligibility of military, DoD civilian personnel, and personnel of other U.S. Government departments and agencies by mutual agreement,” and then, in the same sentence, “renders determinations to grant, to include preliminary determinations and suspensions of eligibility of DoD NISP contractor personnel.” Four verbs on one side of the comma. Two on the other.

That asymmetry answers the headline above. DCSA decides whether your new hire can start, through a grant or a preliminary determination, and can stop that person mid-contract through a suspension. Taking a contractor’s eligibility away permanently is a due-process matter beginning with a Statement of Reasons, not a DCSA memo. DCSA does run the appellate machinery, which the directive now calls “security review proceedings, previously known as due process and appeals.” If you are the FSO holding the file, a suspension and a revocation are not the same event and should not be reported upward as one.

How long does DCSA actually take?

Longer than the headline number. The 44-day and 57-day figures measure the investigation stage alone, and only the fastest 90% of cases. They exclude initiation at the front and adjudication at the end, which in the last quarter with a full breakout added 41 days to a moderate-risk case and 52 to a high-risk one. Quoting 44 days as “how long it takes” understates the real wait.

The only stage-by-stage breakout the government has published sits in the FY2025 Q4 edition of the Personnel Vetting Quarterly Progress Report.

Days. Source: Personnel Vetting QPR, FY2025 Q4 / FY2026 Q1, p.5. “Moderate Risk” and “High Risk” describe position sensitivity across the whole federal vetting population, including public-trust jobs with no classified access. They map only loosely onto Secret and Top Secret.

Initiation is fast. Adjudication is slow. Investigation dominates, and the report says so plainly: “While adjudications are significantly behind, the investigation process remains the greatest factor.” Since then that stage has improved sharply.

Source: Personnel Vetting QPR, FY2026 Q2, p.4, fastest-90% basis. Tier labels, not clearance levels. Both still miss their goals.

Two numbers matter more to employers than any above. Preliminary determinations, which let someone begin work before the investigation closes, were issued more than 144,000 times across thirteen agencies in 2025, saving an estimated 132 days per case. That answers when a new employee can actually start, and why the interim governs your schedule more than the final adjudication.

The second is the one you control. In FY2026 Q2, 3.4% of packages were rejected at initiation, improved from 3.9% the prior quarter, against a target of 1% by FY2028. Each rejection took an average of 12.5 days to resolve. The report names the causes: incomplete packages, missing fingerprints, incorrect investigation levels, all of them inside what your FSO submits.

Why should you distrust these numbers?

Because the government’s own auditors do. A GAO report released December 11, 2025 on the personnel-vetting metrics ODNI collects found 86% of agency timeliness data inaccurate, one-third of it off by more than 20%. The errors ran one way. GAO traced most of them to a DCSA calculation method that departed from ODNI guidance and that “systematically underestimated the time for agencies to complete each phase of the clearance process.” The 2020-2024 figures were too low.

That audit window closes before every figure above. Agencies told GAO they corrected the method for data collected from FY2025 onward, a fix GAO did not independently verify, so treat the direction of travel as real and the decimal places as decorative. Two further cautions. The historical inventory series was restated downward between the two most recent quarterly reports with no published explanation. And the “fastest 90% of cases” standard Congress set in 2004 is being revised to cover 100% of cases, a change the report admits “will decrease reported timeliness” while giving leaders a truer picture by including outliers.

What does DCSA decide about your facility?

The facility clearance, which 32 CFR Part 117 calls an entity eligibility determination, is a separate decision from any individual’s clearance. It can be broad, or limited to specific contracts, sponsoring agencies or circumstances.

The rule also settles a question employers get backwards constantly. Under 117.10(a)(1), the Cognizant Security Agency determines an employee’s eligibility for access; the contractor determines only that access is essential to a classified contract and that a need-to-know exists, and that judgment is what decides which jobs genuinely require a Secret clearance and which postings only claim to. You do not grant clearances. You establish need, and you sponsor.

Here is the precision point most explainers miss. For DoD, the Cognizant Security Agency is the Under Secretary of Defense for Intelligence and Security. DCSA is the Cognizant Security Office, the operating arm administering the NISP on behalf of DoD contracting activities and agencies holding security-services agreements with DoD. The NISPOM rule codifying this was published at 85 FR 83312 in December 2020.

What does DCSA do after the clearance is granted?

It keeps checking. DCSA leads DoD continuous vetting under SEAD 4 and SEAD 6 and adjudicates the results, replacing the old periodic reinvestigation cycle. Enrollment across the vetted population reached 74% in FY2026 Q1 and stayed flat there through Q2.

Coverage is uneven underneath that figure. The non-sensitive public trust population sits at 35% enrolled and has plateaued, several large agencies delayed by scaling problems, and the September 2025 milestone to finish it was missed outright. Legacy periodic reinvestigation requests, by contrast, have nearly vanished: 7,716 in FY2025 Q2 down to 100 in FY2026 Q2.

What continuous vetting catches deserves its caveats. Per hundred enrollees, the program identifies about 1.13 new actionable alerts per quarter, and DCSA estimates problematic behavior surfaces three years earlier for high-risk positions and seven years earlier for moderate-risk ones than under periodic reinvestigation. Both are agency estimates with no published methodology, and the alert rate is a quarterly average the source never annualizes. What the system checks, and how it differs from older continuous evaluation, is a separate question. Where the record then lives, and which database an employer queries, is another entirely.

The honest summary of FY2026 Q2 is split. The interagency council rated its “Get People to Work Faster” goal Fair, upgraded from Poor, and in the same report downgraded risk management from Fair to Poor, noting adoption has been too slow. Speed improved and coverage regressed, in one quarter.

What changes in 2026 and 2027?

The SF-86 is being retired, applicants can now check their own case status, automated adjudication keeps spreading, and the five-tier structure remains fully in force despite years of announcements otherwise.

The Personnel Vetting Questionnaire is replacing the SF-86, SF-85 and SF-85P. Initial capability deployed in April 2025; the milestone for the PVQ covering all vetting scenarios is September 2027. In FY2026 Q2 DCSA released the Individual Engagement Platform, letting applicants check case status, ending what the report calls a “black box” process. Automated adjudication of lower-risk cases, branded eVetting, has grown from 12 agencies in FY2018 to 37 in FY2026, and produced more than 102,000 favorable adjudications across 34 agencies during 2025. New rules for moderate-risk public trust cases get qualifying people to work over 20 days faster.

The stubborn one: the three-tier investigation model Trusted Workforce 2.0 has promised for years is announced policy, not current practice. As of FY2026 Q2, 100% of cases still ran under the five-tier structure, and the first investigative service provider offering the new products is anticipated in FY2026 Q3. If you have been told your next hire will be investigated under three tiers, ask which provider and which quarter.

Reported timeliness will get worse in the FY2026 Q3 report, because the standard shifts from the fastest 90% of cases to all of them. That deterioration will be a measurement change, not a performance collapse. DCSA separately expects inventory to resume falling over the summer and drop below 100,000 cases before the fiscal year ends. Neither number decides whether your candidate starts in March or July. The investigation stage does, and it sits outside your building. The 3.4% is what sits inside it: 12.5 days on average per rejected package, modest against a 168-day investigation, and the only part of the wait your FSO can prevent. For the other side of the transaction, who can sponsor you at all comes first.

Frequently Asked Questions

Is DCSA the same agency as the old Defense Security Service?

Legally, yes. Executive Order 13869 renamed DSS as DCSA and specified the new agency would serve “as a continuation of the former DSS” for National Industrial Security Program purposes. The governing DoD directive was not reissued under the new name until January 16, 2025, when it cancelled the August 3, 2010 DSS directive.

Does DCSA grant every security clearance in the federal government?

No. DCSA describes itself as investigating for 95% of the federal government across 105 departments and agencies, and adjudicating 70% of federal adjudicative determinations. Those are the agency’s own unaudited late-2025 figures. The remainder sits with agencies running their own vetting, and DoD special access programs can be carved out by the Secretary or Deputy Secretary.

Can DCSA deny a contractor employee’s security clearance?

The 2025 directive lists DCSA’s authority over cleared contractor personnel as granting eligibility, issuing preliminary determinations, and suspending. Denial and revocation appear only for military and DoD civilians. For contractor staff, an unfavorable outcome runs a due-process track starting with a Statement of Reasons.

How long does a DCSA background investigation take in 2026?

In FY2026 Q2 the investigation stage averaged 44 days for Secret-level cases and 57 for Top Secret-level on the fastest-90% standard, the quickest since FY2012. End to end, including initiation and adjudication, the last fully reported quarter (FY2025 Q4) averaged 109 days for moderate-risk positions and 220 for high-risk ones. GAO found 86% of the underlying timeliness data inaccurate in December 2025, so read these as directional.

Is DCSA the Cognizant Security Agency for the Department of Defense?

No, and the distinction matters when you write security plans. Under 32 CFR 117.6, the Under Secretary of Defense for Intelligence and Security acts as the CSA for DoD. DCSA serves as the DoD Cognizant Security Office, administering the NISP on behalf of DoD contracting activities and agencies holding security-services agreements.