Continuous Vetting & Trusted Workforce 2.0

I What CV and TW 2.0 actually changed

For most of the modern security clearance era, federal employees with clearances faced a defined investigative cycle. Initial investigation. Adjudication. Eligibility granted. Then five years later (Top Secret) or ten years later (Secret), a periodic reinvestigation. Between investigations, the cleared individual was largely off the radar — no automated record checks, no continuous monitoring, no real-time data flow about their financial, criminal, or other relevant conduct. The government effectively trusted the individual to remain trustworthy and verified that trust only on a multi-year cadence.

That model is over. Under Continuous Vetting, the cleared individual's financial, criminal, public records, and terrorism database information is checked continuously throughout the entire period of eligibility. Adverse information surfaces in days, not years. DCSA reports that potentially adverse information is now identified on average three years faster for Top Secret holders and seven years faster for Secret holders compared to the legacy reinvestigation schedule. The 5/10-year reinvestigation cycle has been largely replaced — periodic reinvestigations now exist primarily as resolution mechanisms for issues already surfaced through CV.

Two things changed simultaneously. First, the technology — automated record checks, real-time data integrations, an emerging IT platform (NBIS) consolidating decades of fragmented systems. Second, the cultural and legal expectation around self-reporting. SEAD 3 took effect in 2017 and codified affirmative reporting obligations that previously existed in agency-specific guidance with uneven enforcement. Under TW 2.0, those obligations are enforced — directly through CV automated checks that surface unreported events, and indirectly through Personal Conduct (Guideline E) concerns when individuals fail to report things they were required to report.

The practical implication for cleared federal employees is significant. Information you might once have hoped would remain private — bankruptcies, arrests, civil judgments, certain financial transactions — now flows automatically to your security office. The strategic decision about whether to self-report is no longer "will they find out?" — they will find out — but rather "will they learn from me first or from the database?" The two outcomes look very different to an adjudicator.

II Trusted Workforce 2.0 — origins and timeline

Trusted Workforce 2.0 is a whole-of-government personnel vetting reform initiative, jointly led by ODNI, OPM, OMB, and DoD through the Security, Suitability, and Credentialing Performance Accountability Council (the PAC). Its goals are to reduce time-to-hire, enable mobility through clearance reciprocity, modernize the underlying IT, and improve insight into workforce risk through continuous monitoring rather than episodic investigation.

The initiative's major milestones:

• 2014: Federal Investigative Standards updated, laying groundwork for continuous evaluation concepts.
• 2017: SEAD 3 issued by ODNI, codifying self-reporting requirements for cleared individuals.
• April 2019: Executive Order 13869 transferred federal background investigation function from OPM's National Background Investigations Bureau to DoD.
• October 1, 2019: DCSA officially stood up as the consolidated background investigations agency.
• FY 2020: Initial CV enrollment of national security population began.
• October 2021: DoD reached 100% CV enrollment of its security clearance population.
• End of 2022: Entire national security workforce transitioned to CV.
• July 2024: OPM and ODNI released final updated TW 2.0 core policies.
• September 2024: DCSA published a 36-month NBIS roadmap projecting product development through FY2027.
• October 2023 / December 3, 2024: NBIS eApp deployment, with all federal agencies completing transition from the legacy e-QIP to eApp by December 2024.
• 2024: Phase 2 of TW 2.0 completed; PAC pivoted to Phase 3 priorities for 2025.
• 2025: Phased PVQ deployment began, replacing the SF-86 in stages by use case.
• March 2026: DCSA released the Individual Engagement Platform (IEP), a public-facing application allowing applicants to track vetting status and self-report directly.

The TW 2.0 reform is not a single regulation or directive but rather a coordinated program rolled out over more than a decade. The key authorities are:

• SEAD 3 (December 2016) — Reporting Requirements for Personnel Who Access Classified Information or Who are in a Sensitive Position
• SEAD 4 (June 2017) — National Security Adjudicative Guidelines
• SEAD 6 — Continuous Evaluation
• 32 CFR Part 117 — National Industrial Security Program (NISPOM Rule)
• 5 CFR Part 731 — Suitability for Public Trust Positions
• 2012 Federal Investigative Standards — Investigation requirements

For broader context on how TW 2.0 fits into the clearance system overall, see Topic 32 on Security Clearance Levels.

III How Continuous Vetting works

From the cleared individual's perspective, CV is invisible most of the time. There is no portal you log into, no monthly check-in, no notification that your records are being reviewed. The system runs in the background, querying data sources on a continuous schedule established by ODNI's Federal Investigative Standards.

The mechanical sequence:

1. Enrollment. When you are investigated, adjudicated, and granted national security eligibility, you are automatically enrolled in CV. There is no separate enrollment action required of the individual. Enrollment continues for the duration of your eligibility.

2. Continuous monitoring. The CV system runs automated queries against the seven authorized data categories (covered in detail below). Queries occur on schedules ranging from continuous (terrorism databases) to periodic (some financial sources). Queries return results to the CV system without involving the individual.

3. Issue identification. When a query returns potentially derogatory information that meets the system's threshold for review, the system generates an alert. Most alerts are resolved automatically — duplicate records, data errors, information already known and adjudicated. A subset of alerts proceed to human review.

4. Continuous Evaluation Incident Report (CEIR). Substantive alerts produce a CEIR, which is sent to the cleared individual's adjudicating authority. For DoD military, civilian, and contractor populations, this is typically DCSA's Vetting Risk Operations Center (VROC). For other agencies, the agency's Central Adjudication Facility handles the case.

5. Adjudicator review. An adjudicator reviews the CEIR. Possible outcomes: (a) no further action required — most common; (b) request for additional information from the individual; (c) issue resolution investigation; (d) interim suspension of access pending review for serious matters; (e) referral for SOR or LOI in cases warranting potential adverse action.

6. Resolution. Most CEIRs resolve without affecting the individual's clearance. Of approximately 190,000 alerts in DCSA's FY 2022 reporting period, more than half (roughly 110,000) involved issues that had not been previously reported by the individual — but only a fraction of those resulted in adverse adjudication. Resolution typically involves the adjudicator confirming the issue is mitigated, documented, and not indicative of continuing concern.

IV The seven CV data categories

ODNI's Federal Investigative Standards establish seven data categories that CV is required to check. Each category has authorized data sources, query frequencies, and review thresholds. The categories:

1. Criminal activity

National, state, and local criminal databases including FBI databases, state criminal information systems, court records, and arrest records. Triggers include arrests, charges, convictions, and certain civil matters with criminal overlap. Even charges that are subsequently dismissed or reduced will surface — what matters in adjudication is the underlying conduct, the disposition, and what was reported by the individual.

2. Terrorism

The Terrorist Screening Database (TSDB) and related counter-terrorism databases. False positives are a real issue — common names match watchlists frequently. The CV process includes resolution mechanisms for false matches.

3. Credit and financial behavior

Credit bureau queries returning credit reports, judgments, liens, bankruptcies, charge-offs, collections, and significant new credit activity. This category produces a substantial fraction of all CV alerts. For the financial Guideline F framework, see Topic 37 on Financial Issues & Security Clearances.

4. Suspicious financial activity

Specialized financial monitoring including FinCEN data and certain reports of suspicious activity. This category is more limited in scope and primarily flags transactions or patterns suggesting concerns under Guideline F or Guideline B (Foreign Influence).

5. Foreign travel and contacts

Travel records (passport activity, customs and border data) and reported foreign contacts. CV does not surveil all travel in real time but does check travel records periodically against reported travel under SEAD 3. Discrepancies between reported and recorded travel are flagged.

6. Public records

Court records (civil judgments, divorce filings, bankruptcies, restraining orders), real estate records, business filings, and other public records. The breadth of this category is substantial; specific alerts depend on the data sources the agency has authorized.

7. Eligibility-relevant agency information

Information from agency databases that is relevant to eligibility — security incidents, insider threat indicators, polygraph results (for agencies that use them), workplace violence reports, and other internal data that may bear on eligibility.

The seven categories represent the floor — agencies may add additional data sources subject to authorization. Some intelligence community agencies use additional data sources beyond the standard CV set. Notably, CV as implemented does not include continuous monitoring of personal social media — though publicly-posted social media may be reviewed during investigations or in response to specific concerns. The Pentagon announced in October 2021 that surveillance of public social media postings was likely "coming soon," but as of 2026 this has not been implemented as a routine CV component.

V SEAD 3 — your self-reporting obligations

Security Executive Agent Directive 3 establishes affirmative self-reporting obligations for cleared individuals and individuals in sensitive positions. The directive was issued by ODNI in December 2016 and took full effect through 2017-2022 as agencies issued implementing guidance. SEAD 3 obligations apply to:

• Federal employees with active national security clearances at any level
• Federal employees in sensitive positions (Tier 3 non-critical sensitive, Tier 5 critical sensitive)
• Cleared contractors and contractor employees
• Members of the military with security clearances
• Individuals in process for a clearance (eligibility processing)

The reporting obligation is based on eligibility, not just access — an individual who holds eligibility but has no active access ("eligible-no-access") is still covered.

The fundamental rule

SEAD 3 operates on a fundamental principle: you are required to affirmatively report certain activities and changes about yourself, and you are required to report what you observe about others who are also covered individuals. Reporting is not discretionary. Failure to report when reporting is required is itself a security concern under Guideline E (Personal Conduct), independent of any concerns the underlying activity might raise.

The reporting obligation runs parallel to — not in place of — the SF-86 / PVQ disclosure framework. The SF-86 captures the cleared individual's history at the time of investigation or reinvestigation. SEAD 3 captures changes that occur between those investigations. Both are required; one does not substitute for the other. For SF-86 disclosure mechanics, see Topic 33 on the SF-86.

Reporting on others

SEAD 3 also requires covered individuals to report observed reportable activities of other covered individuals. The most controversial element of the framework. The threshold is direct knowledge of a reportable activity or behavior; the rule is not designed to encourage speculation, gossip, or reports based on suspicion alone. But where an individual has direct knowledge — they witnessed criminal conduct, they have specific knowledge of foreign contacts that should have been reported — reporting is required.

VI The seven reportable activity categories

SEAD 3 organizes reporting requirements into seven primary categories. Specific reporting requirements within each category vary by clearance level — TS/SCI holders and Q clearance holders face stricter reporting thresholds than Secret and L holders. The categories:

Category 1: Foreign travel and foreign contacts

• Unofficial foreign travel — itinerary submission and approval before travel for TS/Q holders; varying for Secret/L holders
• Unanticipated border crossings — to any country not on the approved itinerary, regardless of duration
• Foreign contacts — continuing contact with foreign nationals involving bonds of affection, personal obligation, intimate contact, or exchange of personal information

Category 2: Foreign affiliations

• Acquisition of foreign citizenship or foreign passport
• Use of a foreign passport (in lieu of US passport)
• Foreign business interests or partnerships
• Foreign property ownership
• Foreign bank accounts
• Ownership of cryptocurrency that is backed by a foreign state or hosted/managed by foreign exchanges

Category 3: Media contact

• Unauthorized media contact regarding classified or sensitive information
• Media contact in which classified information was sought or referenced

Category 4: Criminal activity

• Arrests (whether or not charges follow)
• Criminal charges
• Convictions
• Civil citations issued by law enforcement (DUIs, certain traffic matters above specified thresholds)
• Investigations or detentions by law enforcement

Category 5: Alcohol and drug treatment

• Alcohol abuse treatment
• Drug abuse treatment (excluding routine prescription medications used as directed)
• Substance use disorder diagnosis

Category 6: Financial issues

• Bankruptcy filings (Chapter 7 or 13)
• Significant financial issues — wage garnishments, judgments, repossessions
• Foreign bank accounts (overlap with Category 2)
• Significant unexplained wealth or income
• Direct involvement in foreign businesses

Category 7: Personal conduct and status changes

• Marriage — particularly to non-US citizens (TS/Q reporting)
• Cohabitation with a non-spouse partner (TS/Q reporting)
• Foreign national roommate
• Adoption of non-US citizen children
• Mental health treatment — though SEAD 3 has been updated to clarify that seeking treatment is generally NOT a reporting requirement except in specific circumstances
• Personal behavior changes that materially affect ability to protect classified information

The reporting matrix

Most reportable activities apply to all covered individuals. Some apply only to TS/SCI/Q holders due to the heightened concern for higher-access populations. The full matrix is contained in SEAD 3 Appendix A and the agency-specific implementing guidance. The DCSA SEAD 3 Industry Reporting Desktop Aid is the operational reference for cleared contractor populations.

For broader coverage of the SEAD 4 Guideline E (Personal Conduct) framework that converts unreported activities into security concerns, see Topic 34 on Clearance Denial & Revocation.

VII Foreign travel reporting in detail

Foreign travel reporting is the most operationally common SEAD 3 obligation and the one most frequently violated through inattention. The rules vary by clearance level but the basic structure is consistent.

Pre-travel reporting (TS/Q holders)

• Submit itinerary to designated security official before travel
• Standard timeline: at least 30 days prior to routine travel; agencies may set tighter or different timelines
• Receive approval before traveling
• Itinerary must include destinations, travel dates, accommodations, and emergency point of contact
• Itinerary changes during travel require post-travel reporting within 5 business days of return

Pre-travel reporting (Secret/L holders)

Reporting requirements vary by agency for Secret/L holders. Some agencies require pre-travel reporting matching the TS standard. Others require only post-travel reporting. Some have specific country-list triggers — travel to countries on the State Department Travel Advisories list (Levels 3-4) or the ODNI Worldwide Threat Assessment list typically requires reporting regardless of clearance level. Check your agency's specific implementing guidance.

What is and is not "foreign travel"

• Not foreign travel: Puerto Rico, Guam, US Virgin Islands, American Samoa, Northern Mariana Islands, and other US possessions and territories.
• Reportable but with relaxed mechanics: Unplanned day trips to Canada or Mexico — must be reported upon return rather than pre-approved.
• Standard foreign travel: All other international travel.

Special considerations

• State Department Travel Advisories — Travel to a Level 3 (Reconsider Travel) or Level 4 (Do Not Travel) country triggers heightened review and counterintelligence briefings.
• Government Furnished Equipment — Most agencies prohibit permanently-issued GFE on any foreign travel; loaner GFE is required. Equipment policies vary; check before travel.
• Counterintelligence briefings — Required for travel to certain higher-risk countries; coordinated through DCSA Counterintelligence Special Agent for cleared industry, or agency CI office for federal employees.
• Foreign travel anomalies — Contact with foreign intelligence entities, suspicious surveillance, or border-crossing irregularities must be reported to security promptly upon return, with potential post-foreign-travel debriefing.

Failure to pre-report foreign travel is itself a SEAD 3 violation, independent of any concerns about the travel itself. An employee who took an unreported personal trip to a Level 4 country and contacted no foreign nationals during the trip has nonetheless violated SEAD 3. The violation is reportable and adjudicable under Guideline E.

VIII SEAD 3 Self-Reporting Decision Tool

Select the event type and your clearance level. The tool returns the SEAD 3 reporting requirement, timeline, recommended reporting channel, and risk implications. This is operational triage; specific reporting forms and timelines vary by agency, and your agency security officer or FSO is the authoritative source for your specific situation.

IX What happens when CV generates an alert

Most CV alerts are mundane. A new credit card opened. A change of address. A traffic citation. The CV system queries its data sources, returns results, and an automated process screens results against pre-set thresholds. Anything below the threshold is logged but not escalated.

When an alert exceeds the screening threshold, a Continuous Evaluation Incident Report (CEIR) is generated. The CEIR is the document that triggers human adjudicator review. From the cleared individual's perspective, the first sign of CEIR processing is typically one of three events:

• No notification at all. Most CEIRs are reviewed by the adjudicator and resolved without any action requiring the individual's involvement. The individual may never know the CEIR existed.
• Request for information from the security office. Your FSO or security officer may contact you with questions about the underlying event. This is your opportunity to provide context and documentation.
• Formal interview. For more serious matters, DCSA or the agency CAF may request a subject interview. Subject interviews under CV are increasingly common and are conducted under the same rules as interviews during a periodic reinvestigation.

For serious matters, the CEIR may trigger interim suspension of access pending review. Suspension is a procedural action — the individual's eligibility is not terminated, but their access to classified information is paused while the adjudicator reviews the matter. Suspension typically resolves within 60-180 days through either restoration of access or initiation of formal denial/revocation procedures.

How to respond if contacted

If your security office contacts you about a CEIR or if DCSA requests a subject interview:

• Do not panic. Most CEIRs do not result in adverse action. The contact itself is not a finding of misconduct.
• Take the contact seriously. Treat any communication from the security office as a formal matter. Respond promptly. Follow instructions for documentation requests.
• Be candid and complete. Lack of candor in a CV inquiry compounds the underlying issue and can convert a manageable Guideline F or Guideline B matter into a Guideline E (Personal Conduct) denial.
• Consider counsel for serious matters. If the matter could result in suspension or revocation, retain qualified clearance counsel before responding. See Topic 45 on When & How to Retain an Attorney.
• Document everything. Keep records of all communications, the dates of contact, the questions asked, and your responses. The paper trail matters if the case escalates.

X NBIS, eApp, and the PVQ rollout

The IT modernization underlying TW 2.0 is the National Background Investigation Services (NBIS) platform. NBIS is replacing the legacy systems that fragmented federal personnel vetting for decades — DISS, JPAS, e-QIP, CVS, and others — with a single integrated platform.

eApp — replacing e-QIP

eApp is the NBIS module that handles initial investigation forms and updates. As of December 3, 2024, all federal agencies have completed the transition from the legacy e-QIP to eApp. New SF-86 submissions, periodic reinvestigation submissions, and routine updates are now processed through eApp.

From the cleared individual's perspective, the eApp transition primarily affects the form-completion experience — different interface, different data validation, but the underlying SF-86 questions remain. Some agencies have built workflow improvements on top of eApp; others have used the transition to streamline internal processing.

PVQ — replacing the SF-86

The Personnel Vetting Questionnaire (PVQ) is being deployed as the SF-86's successor. The PVQ was drafted using plainer language and less complex questions to reduce ambiguity and improve completion accuracy. PVQ deployment is phased starting in 2025:

• First use case (target March 2025): Early-adopter Investigation Service Provider
• Second use case: 5-year form update as part of CV (replacing the periodic SF-86 update)
• Subsequent use cases: Initial investigations, reinvestigations, and other applications rolling out through 2026-2027

The PVQ is not a complete reset of disclosure requirements — the same general categories of information from the SF-86 remain. The improvements are primarily in language clarity, form structure, and integration with other NBIS components.

NBIS roadmap and challenges

DCSA's September 2024 36-month NBIS roadmap projects product development through FY2027. The roadmap acknowledges substantial challenges. GAO's May 2025 report (GAO-25-107325) noted that 98 percent of agencies reported adapting their personnel vetting IT systems to TW 2.0 requirements has been at least somewhat challenging. One agency cited cancellation of a planned NBIS adjudication system module after months of partnership work, leaving the agency unable to adhere to new TW 2.0 reporting metrics. About 52 percent of contractors reported challenges obtaining information about ongoing background investigations, and about 35 percent reported challenges with CV alerts.

The practical implication: NBIS is functional but evolving. Some processes that worked in DISS or e-QIP work differently or take longer in NBIS. Some workflows are still under development. Cleared individuals should expect continued process changes through 2026-2027 as the platform matures.

The Individual Engagement Platform (IEP)

In March 2026, DCSA released the Individual Engagement Platform (IEP) — a public-facing application allowing cleared individuals and applicants to track vetting status, communicate with vetting personnel, and (in development) self-report directly through the platform. The IEP is positioned as a TW 2.0 milestone supporting individual engagement throughout the vetting lifecycle. Whether IEP self-reporting will eventually substitute for traditional channels (FSO, security officer) is unresolved as of early 2026.

XI From CV alert to suspension or revocation

Most CV alerts do not progress to formal adverse action. But some do. Understanding the path from CV alert to suspension or revocation matters because the procedural protections are real and time-sensitive.

The escalation path

1. CV alert / CEIR generated. Adjudicator review begins.
2. Issue resolution investigation. If the alert raises substantial concern, the adjudicator may direct an issue resolution investigation — a focused inquiry into the specific concern, including subject interview, document review, and supplemental records checks.
3. Interim suspension of access. For serious matters, the agency may suspend access pending resolution. Suspension is procedural; eligibility itself is not yet terminated.
4. Statement of Reasons (SOR) or Letter of Intent (LOI). If the adjudicator determines the concern is sufficient to deny or revoke eligibility, the agency issues an SOR (DoD contractor) or equivalent (LOI for some agencies). The SOR triggers the formal due process pathway.
5. Response. The cleared individual responds to the SOR within the agency-specific timeline (20 days for DoD contractors under DoD Directive 5220.6; typically 30 days for federal civilian employees).
6. DOHA hearing or PSAB process. Contractors may request a hearing before a DOHA administrative judge. Federal civilians proceed through the agency Personnel Security Appeals Board.
7. Final determination. Eligibility is restored, denied, or revoked.

For the full SOR response and DOHA appeal mechanics, see Topic 34 on Clearance Denial & Revocation. For the Guideline F financial framework that drives many CV-initiated cases, see Topic 37 on Financial Issues & Security Clearances.

Timing realities

The interval from CV alert to final determination varies widely:

• No-action resolution: Days to weeks — most common
• Issue resolution investigation: 60-180 days typically
• Suspension to SOR: 60-180 days from suspension to SOR issuance
• SOR to final determination: 6-18 months including hearings and appeals

During suspension and pending final determination, the individual's employment continues but access to classified information is denied. For positions requiring clearance for the underlying duties, the practical employment impact can be significant — paid administrative leave, reassignment, or in some cases unpaid suspension. Employment consequences vary by agency and by the individual's specific situation.

XII CV expansion to non-sensitive public trust

The TW 2.0 PAC priority for 2025 explicitly includes expanding CV to the non-sensitive public trust population. Public trust positions — those not requiring access to classified information but requiring suitability determinations under 5 CFR Part 731 — historically were not subject to CV. The expansion brings these positions into a comparable continuous monitoring framework.

The 5 CFR Part 731 final rule, published as part of the July 2024 TW 2.0 core policies update, provides the regulatory framework. Implementation is phased. Federal employees in non-sensitive public trust positions should expect:

• Enrollment in CV-equivalent automated record checks beginning in phases through 2025-2026
• Self-reporting obligations modeled on but more limited than SEAD 3
• Application of the suitability framework under 5 CFR Part 731 rather than the SEAD 4 adjudicative guidelines
• Different procedural protections than national security clearance holders — suitability determinations are not classified-information eligibility decisions

For the suitability framework specifically, see Topic 38 on Suitability Determinations vs. Security Clearances.

XIII How and where to self-report

The mechanics of self-reporting vary by agency and population. The general pattern:

Federal employees

• Primary channel: Your agency's designated security office. For DoD components, this is typically the local security manager. For civilian agencies, the agency's Office of National Security or Personnel Security division (NIH, for example, uses HHS Office of National Security, Division of Personnel Security).
• Foreign travel reporting: Most agencies have a dedicated foreign travel form or portal. NRC uses an online Personal International Travel Portal. NIH uses an HHS Pre-Travel Reporting Form. DoD components use varying portals.
• Other reportable events: Typically reported to the security manager via written incident report, email, or in-person.

Cleared contractors

• Primary channel: Your Facility Security Officer (FSO). The FSO is responsible for receiving reports, processing them, and submitting them into DISS or successor systems (eventually NBIS).
• NISPOM and 32 CFR Part 117: Contractor SEAD 3 implementation operates under the National Industrial Security Program Operating Manual rule and the company's written security plan (SPP). Each cleared contractor facility has its own specific reporting procedures.

Direct reporting through DCSA

The DCSA Individual Engagement Platform (IEP), released March 2026, is positioned to allow individual self-reporting directly through DCSA. Whether IEP reporting will substitute for FSO-based reporting under SEAD 3 is still being clarified. As of early 2026, the safe practice remains: report through your FSO or agency security officer first, and use IEP as a tracking and supplemental tool rather than a primary reporting channel.

What to include in a report

• Identifying information (name, SSN, agency or facility)
• Date of the reportable event
• Specific facts of the event
• Any documentation supporting the report (court records, medical records, travel itineraries)
• The SEAD 3 reporting category implicated
• Any context relevant to mitigation or interpretation

The threshold for over-reporting is low. When in doubt, report. SEAD 3 violations occur from under-reporting, not from over-reporting. A security officer can advise that a reported event did not require reporting — but cannot retroactively make a non-reported event compliant.

Related Workplace Topics