Last Updated: October 8, 2026 Reading Time: 8 min

More than 4 million people are enrolled in continuous vetting, by OPM's June 2026 count of the national security program, and enrollment of other positions is still underway. An alert is an automated hit from an ongoing record check: a court filing, a credit change, a border crossing. GAO describes continuous vetting as record checks that "provides alerts that prompt further investigation." An alert is a lead, not a decision. What happens after it, which rights attach and when, and why reporting first is the strongest thing you can do, all come from the executive orders, statute, and regulations below.

Frequently Asked Questions

What is a continuous vetting alert?

An automated hit from an ongoing record check, such as an arrest record, a credit change, or a border crossing. DoD's vetting records system lists "continuous vetting adverse information flags" among the records it keeps. GAO says an alert prompts further investigation; it is not a decision.

What records does continuous vetting check?

Under 5 U.S.C. § 11001(b), agencies draw on criminal and civil court records, financial and creditworthiness information, public and commercial sources including social media, and terrorist or criminal watch lists. DoD's records notice adds credit reports and the countries and dates of U.S. border crossings.

Am I in continuous vetting if I do not have a clearance?

Possibly. OPM's June 2026 suitability rule says continuous vetting requirements already exist under 5 C.F.R. part 731 and that enrollment of the federal workforce, including non-sensitive positions, was still underway.

Will I be told when an alert fires?

The rules we reviewed do not require that you be told about the alert itself. Under 5 U.S.C. § 11001(c)(2), the agency must take "appropriate action" when a check finds relevant information. The formal rights in EO 12968 § 5.2 begin at a denial or revocation of eligibility.

Does self-reporting help?

It can. The 1998 DoD regulation at 32 C.F.R. § 147.2(e), which SEAD 4 now supersedes and whose current text this article did not review, told adjudicators weighing a concern about someone already cleared to consider whether the person "voluntarily reported the information" and "was truthful and complete in responding to questions." Current DoD guidance warns that a failure to report can itself start an adverse eligibility action, and that a report alone does not mean a negative outcome.

What do I have to self-report?

DoD's SEAD 3 guidance lists unofficial foreign travel and foreign contacts, foreign citizenship or a foreign passport, criminal activity, alcohol or drug treatment, bankruptcy and other financial issues, financial anomalies, foreign bank accounts, and marriage or a foreign-national roommate. Under 5 U.S.C. § 11001(c)(3), your agency must tell you what you have to report, and the deadlines are in SEAD 3 and your agency's implementing guidance.

Can my clearance be suspended because of an alert?

Access can be suspended pending final adjudication. The 1998 guidelines listed that as one of the things adjudicators decide when a concern arises about a cleared person. For contractor cases under 32 C.F.R. part 155, § 155.6(d) allows suspension pending the final decision only when there is a reasonable basis to conclude that continued access poses an imminent threat to the national interest, with the concurrence of DoD's General Counsel.

What rights do I have if my clearance is revoked?

Under EO 12968 § 5.2, a federal employee gets as comprehensive a written explanation as national security interests and other applicable law permit, the documents behind it within 30 days of a request to the extent FOIA or the Privacy Act would release them, the right to counsel at their own expense, a written reply, an appeal to a panel of at least three members with two from outside the security field, and a personal appearance. The order also says the section "creates no procedural or substantive rights," and agency heads may depart from it on national-security grounds.

I am a contractor. Is my process different?

Usually. In the Defense industrial clearance process, 32 C.F.R. § 155.4(c) gives a contractor employee notice of the specific reasons, a chance to respond, notice of the right to a hearing with cross-examination of adverse witnesses, and counsel. That is the DOHA process under Executive Order 10865, which EO 12968 leaves in place even though it counts contractor personnel as employees. Part 155 does not cover SCI or special access program cases, which follow the applicable agency's procedures.

Can a continuous vetting finding cost me my job even if I keep my clearance?

It can open a separate suitability track. OPM's rule effective July 30, 2026 says information found through continuous vetting can lead to a suitability action against a current competitive-service or career SES employee, and 5 C.F.R. § 731.101(d) makes that determination distinct from clearance eligibility. Appeals of suitability actions filed on or after September 2, 2026 go to OPM, not MSPB.

What the Checks Pull

Executive Order 13467, as amended in 2017, defines continuous vetting as "reviewing the background of a covered individual at any time" to decide whether that person "continues to meet applicable requirements." Holding a clearance means agreeing to it: EO 12968 § 3.5 makes every cleared employee "subject to continuous evaluation" under standards the Director of National Intelligence sets.

The data streams are in statute. Under 5 U.S.C. § 11001(b), the enhanced personnel security program integrates "government, publicly available, and commercial data sources, consumer reporting agencies, social media" and checks for criminal or civil proceedings, financial information "including the credit worthiness" of the individual, and data on terrorist or criminal watch lists. DoD's Personnel Vetting Records System notice lists the record types it keeps: criminal history, credit reports, financial and real-estate information, public electronic information, "continuous vetting adverse information flags," and "countries and dates of arrival and departure for U.S. border crossings." It also takes "submissions of adverse personnel information," the human-filed incident reports that are a separate input from an automated alert.

Section 11001(c)(1) sets a floor of automated checks "not less than 2 times every 5 years." The actual cadence is set by Executive Agent standards and is continuous in practice.

The Alert Lifecycle, Step by Step

1. The check runs against those streams.

2. An alert fires. DoD stores it as an adverse-information flag, and GAO describes it as a prompt for further investigation, not a decision.

3. The agency acts. Section 11001(c)(2) says the agency "shall take appropriate action if a review ... finds relevant information." That can mean closing the alert, asking you about it, opening an inquiry, or suspending access while the question is resolved. No primary source we reviewed describes what a security officer may ask at that stage, so this article does not.

4. Adjudication under the whole-person standard. Under the 1998 regulation at 32 C.F.R. § 147.2(a), adjudicators weighed the nature and seriousness of the conduct, the circumstances, its frequency and recency, your age and maturity at the time, whether it was voluntary, "the presence or absence of rehabilitation," the motivation, the potential for pressure or coercion, and the likelihood of recurrence. Section 147.2(b) set the tie-breaker: "any doubt" about whether access is clearly consistent with national security "will be resolved in favor of the national security." Current decisions run under SEAD 4, the government-wide adjudicative guidelines; its text was not reviewed for this article, and the factors quoted here come from the 1998 regulation at 32 C.F.R. § 147.2.

5. If eligibility is denied or revoked, the formal rights begin. Federal employees generally use EO 12968 § 5.2. Contractors in the Defense industrial clearance process generally use 32 C.F.R. part 155; SCI and special access program cases follow their own procedures. Our clearance suspended or revoked guide covers the appeal stage, the MSPB limits under Egan, and pay and FEHB during a suspension.

6. A second track can open. For competitive-service and career SES employees, the same information can lead to a suitability action. That track has its own rules, its own appeal, and since September 2, 2026, its own forum.

Why Reporting First Is the Lever

Section 147.2(e) of the 1998 regulation, which SEAD 4 now supersedes for current adjudications, was written for exactly the continuous-vetting situation: a person who already holds access when a concern surfaces. It told adjudicators to consider whether the person "voluntarily reported the information," "was truthful and complete in responding to questions," and whether access "should have his or her access temporarily suspended pending final adjudication of the information." Those are factors, not guarantees.

The other side of the ledger is in DoD's SEAD 3 guidance: "an adverse national security eligibility action may be initiated against the covered individual who failed to report." The same guidance adds, "Just because something is reported, doesn't mean it will lead to something negative." Under 5 U.S.C. § 11001(c)(3), your agency is required to tell you what you must report. Ask your security office for its written list, and keep a copy of every report you file. Reporting duties run both ways: EO 12968 § 6.2(b) says employees are "encouraged and expected" to report information that raises doubts about a coworker's continued eligibility.

Alert Type to First Step

FedTools built this table from the data streams named in law and DoD's records notice, the self-report categories in DoD's SEAD 3 guidance, and the procedural rules above. Deadlines and dollar thresholds are deliberately left out; they are in SEAD 3 and your agency's implementing guidance.

Alert type Data source the check draws on What you should already have self-reported Typical first step after the alert
Arrest or criminal charge Criminal history records; criminal or civil proceedings Criminal activity Further investigation; the agency must take appropriate action; access may be suspended pending adjudication
Watch-list match Terrorist or criminal watch lists A watch-list match is external data; report any underlying reportable conduct under your agency's guidance Further investigation; DoD may share with insider-threat and counterintelligence officials
Credit or financial derogatory Consumer reporting agencies; creditworthiness data; credit reports Bankruptcy or financial issues Further investigation; current DoD guidance treats a failure to report as grounds for adverse action
Unusual financial activity or wealth Financial and real-estate information Financial anomalies; DoD says unexplained affluence is reportable Further investigation and adjudication
Foreign travel Border-crossing countries and dates Unofficial foreign travel Further investigation; under DoD guidance an unreported trip is itself a reporting failure
Foreign ties Public and commercial data; financial records Foreign citizenship or passport; foreign bank accounts; foreign property Further investigation; a failure to report can start an adverse action
Public-record or online information Publicly available electronic information; social media Media contact; personal conduct Further investigation; under the 1998 regulation, doubt was resolved for national security
Human incident report Adverse information submitted by a security officer or contractor Whatever the underlying event is; contractors may not report on rumor Suspension pending decision is possible; denial or revocation triggers the formal rights

Employees and Contractors Get Different Rights

For a federal employee whose eligibility is denied or revoked, EO 12968 § 5.2(a) lists the procedure: "as comprehensive and detailed a written explanation of the basis for that conclusion as the national security interests of the United States and other applicable law permit"; the documents, "within 30 days, upon request and to the extent the documents would be provided if requested under the Freedom of Information Act" or the Privacy Act; notice of "their right to be represented by counsel or other representative at their own expense"; a written reply; an appeal to "a high level panel, appointed by the agency head," of "at least three members, two of whom shall be selected from outside the security field"; and "an opportunity to appear personally." Two limits sit in the same section. Paragraph (c) says it "creates no procedural or substantive rights," and the agency head may withhold a step by certifying that it would damage national security.

Contractors are handled differently, though EO 12968 does not exclude them: its definition of "employee" includes an agency's industrial or commercial contractors, and the order's general provisions leave the denial and revocation procedures of Executive Order 10865 in place. For contractors in the Defense industrial clearance process, 32 C.F.R. part 155 implements those procedures; it does not cover SCI or special access program cases. Under 32 C.F.R. § 155.4(c), a final unfavorable decision cannot be made without "notice of specific reasons for the proposed action," an opportunity to respond, "notice of the right to a hearing and the opportunity to cross-examine persons" who provided adverse information, and counsel. Under § 155.6(d), a contractor's clearance may be suspended pending the final decision only when there is a reasonable basis to conclude that continued access "poses an imminent threat to the national interest," and only with the concurrence of DoD's General Counsel; whether an alert supplies that reasonable basis is decided case by case. Contractors also carry a reporting duty of their own: 32 C.F.R. § 117.8(c) requires the company to report adverse information about cleared employees and bars reports "based on rumor or innuendo."

The Second Track: Suitability

OPM's Suitability and Fitness rule, published June 30, 2026 and effective July 30, says the changes "apply equally to applicants for employment and current Federal employees" and describes what happens "when continuous vetting uncovers information that results in a determination" of unsuitability. Under 5 C.F.R. § 731.101(d), a suitability determination is "distinct from" a determination of eligibility for access to classified information. The two tracks can run on the same facts with different outcomes.

The appeal moved too. OPM's Suitability Action Appeals rule, effective September 2, 2026, says OPM "will replace the Merit Systems Protection Board (MSPB) as the adjudicative agency for such appeals," and that appeals filed with MSPB before that date are unaffected. Our September 2 appeal-rights guide and the suitability rule checklist cover that track.

Sources