IC Oversight & Authorities — 2026-05-29

DCSA Unable to Cover Required Security Assessments for Contractors Holding Classified Information

BLUFDCSA's inspection shortfall is unlikely to narrow by the end of fiscal year 2026, as compounding violation backlogs will outpace any workforce gains DOD can resource under current authorities.

A GAO report published April 24 found DCSA completed just over 4,600 security reviews in fiscal year 2025, less than 40 percent of required inspections across approximately 12,500 cleared contractor facilities and 5,500 specified IT systems 12. Those reviews surfaced 815 security violations, nearly 60 percent classified as data spills onto unclassified systems, and left 1,032 vulnerabilities open as of September 2025 13. Joe Kirschbaum, GAO's director for defense capabilities and management issues, told Federal News Network on May 27 that each missed assessment cycle correlates with one and a half to two times the violation accumulation when a facility is eventually reviewed 2. GAO issued four recommendations covering analytic tools, workforce assessment, and end-user engagement in the replacement IT system; DOD concurred with all four 13.

Analysis
DCSA completing 55 percent of required assessments by the close of fiscal year 2026 is unlikely. The binding constraint is staffing: 329 field operators cannot cover 12,500 cleared facilities and 5,500 IT systems on the required cycle without authorized hiring, and DOD's concurrence with all four GAO recommendations appropriates nothing. Each missed cycle compounds violations at 1.5 to 2 times the expected rate, a figure Kirschbaum confirmed in independent testimony not in the written report, meaning the backlog grows faster than linear recovery can close. Moderate confidence, grounded in primary GAO data corroborated by independent director testimony. Risk may concentrate in consistently inspected facilities rather than spread uniformly across unreviewed ones. Whether defense appropriators fund an emergency DCSA workforce supplement in FY2027 deliberations turns on whether the gap proves structural.
4 sources
  1. Industrial Security: Improved Risk Management and Stakeholder Engagement Needed to Help DOD Address Mission Gaps - U.S. Government Accountability Office
  2. DoD system to protect classified information held by contractors is under strain - Federal News Network
  3. GAO Flags Gaps in DCSA Industrial Security Oversight - ExecutiveGov
  4. GAO flags hundreds of classified contractor security violations - Federal News Network

View in full brief →

UNCLASSIFIED // OPEN SOURCE