Cybersecurity Guide

How to Get a Security Clearance

Last updated:

Written by Steven Bowcut

With over 30 years of experience in the security industry, Steven Bowcut is a skilled editor, writer, and consultant.

In this guide

Quick answer

How to get a security clearance?
You normally need a job, assignment, or contract position that requires federal national-security vetting. The hiring agency, military organization, or qualifying employer starts the process; you generally cannot self-sponsor or buy a clearance.

National-security applicants commonly complete the SF-86 through NBIS eApp, then undergo investigation and adjudication. A favorable eligibility decision still does not give automatic access to every classified item | you also need the correct level, need-to-know, and any required access authorization.

At a glance

QuestionShort answer
Main levels?Confidential, Secret, Top Secret.
Self-sponsor?Generally no.
Current DCSA applicant system?NBIS eApp. e-QIP is legacy for current case initiation.
Main national-security form?SF-86 remains current while the consolidated PVQ rolls out.
Public Trust a clearance?No.
SCI/SAP higher levels?No. They use additional access controls and authorization.
Do clearances still renew every 5/10/15 years?Do not use that legacy rule as the modern model. Continuous Vetting and current questionnaire-update requirements now matter.

What is a security clearance?

A federal security clearance is a favorable national-security eligibility determination associated with access to classified information at an authorized level. Eligibility is not the same as actual access. A person also needs a legitimate need-to-know and must complete required security documentation or program access steps.

The background investigation is the fact-finding stage. Adjudication is the decision stage. SCI and SAP access are additional controls layered on top of ordinary eligibility, not new classification levels.

Can you apply for a security clearance yourself?

Usually no. A federal agency, military service, or qualifying cleared employer initiates the case because a position or assignment requires it. For cleared contractors, DCSA guidance permits certain accepted candidates to begin processing before employment after a written employment commitment, but the government still makes the eligibility decision.

Security clearance levels

LevelDamage standard if information is improperly disclosedKey point
ConfidentialDamage to national security.Lowest of the three classification levels.
SecretSerious damage to national security.Common in many defense and national-security roles.
Top SecretExceptionally grave damage to national security.Highest ordinary U.S. classification level.

NACLC and SSBI are legacy investigation names. DCSA still publishes Tier 3 and Tier 5 mappings during the current transition, but Trusted Workforce 2.0 is moving the government from the legacy five-tier framework to a three-tier model.

Is TS/SCI a separate clearance?

No. SCI is specially controlled national-intelligence information. A person needs appropriate underlying eligibility, need-to-know, and authorization for the relevant compartment. SAPs likewise add special protections beyond ordinary classification-level access.

Public Trust vs. security clearance

TopicSecurity clearance / national security eligibilityPublic Trust
PurposeClassified access and/or covered sensitive national-security duties.Trustworthiness for moderate- or high-risk duties affecting government integrity or public trust.
Classified accessCan support classified access if need-to-know and other requirements are met.Does not provide classified access by itself.
Common formSF-86 under the current legacy form framework; PVQ rollout is underway.Commonly SF-85P.

How to get a security clearance

  1. Get selected for a job, assignment, or contract position that requires national-security vetting.
  2. The authorized agency, military organization, or employer/security office initiates the case.
  3. Complete the required questionnaire, commonly the SF-86 in NBIS eApp, and sign releases.
  4. Submit fingerprints and any required supporting documents.
  5. An authorized investigative service provider conducts the background investigation.
  6. An adjudicator evaluates the record under current standards. A temporary or interim determination may be possible in some cases, but it is not guaranteed.
  7. If final eligibility is favorable, the organization verifies level and need-to-know before classified access.
  8. After onboarding, follow security briefings, reporting requirements, and Continuous Vetting rules.

SF-86 and NBIS eApp

NBIS eApp replaced e-QIP for current DCSA customer-agency background-investigation initiation. DCSA announced full required customer-agency transition in December 2024. The SF-86 remains a current national-security questionnaire, while the consolidated Personnel Vetting Questionnaire is being introduced gradually under Trusted Workforce 2.0.

As of FY2026 Q3, the PVQ was not yet universal. Applicants should follow the live instructions from their sponsoring organization rather than assuming every agency uses the same interface or form version.

What investigators review

The scope depends on the position and case, but the process can include |

  • identity, citizenship, residence, education, and employment verification;
  • fingerprints and law-enforcement or court checks;
  • financial records or credit information where applicable;
  • foreign travel, contacts, activities, or interests;
  • interviews with the applicant and knowledgeable people;
  • records or facts relevant to the national adjudicative guidelines.

Not every applicant receives identical investigative coverage. Complete forms, correct fingerprints, and accurate information can prevent avoidable initiation delays.

How long does the process take?

There is no universal clearance timeline. In the FY2026 Q3 federal report, DCSA averaged 57 days for 100% of initial moderate-risk investigations and 82 days for 100% of initial high-risk investigations.

Those are investigation-phase figures, not end-to-end promises. The government-wide end-to-end process includes initiation, investigation, and adjudication and can take longer.

Federal reporting methodology also changed in FY2026 to emphasize all cases instead of only the fastest 90%, and GAO has raised data-reliability concerns about prior government-wide clearance metrics. Use current published figures as planning benchmarks, not personal deadlines.

What can affect eligibility?

SEAD 4 uses a whole-person evaluation. Adjudicators consider both the concern and the mitigating facts, including seriousness, circumstances, recency, frequency, rehabilitation, candor, and vulnerability to pressure or coercion.

The guideline categories are allegiance, foreign influence, foreign preference, sexual behavior, personal conduct, financial considerations, alcohol consumption, drug involvement and substance misuse, psychological conditions, criminal conduct, handling protected information, outside activities, and use of information technology.

These are categories for evaluation, not automatic-disqualification labels.

Common clearance myths

ClaimAccurate?Current federal guidance
“Any debt or bankruptcy disqualifies you.”No.Financial issues are evaluated in context, including cause, pattern, resolution, and mitigation.
“Mental-health treatment ruins your chances.”No.Treatment by itself is not a negative inference; DCSA says seeking needed care can reflect good judgment.
“Foreign relatives or dual citizenship automatically prevent a clearance.”No.Foreign ties are evaluated for actual influence, conflict, vulnerability, and candor. Dual citizenship by itself is not disqualifying under SEAD 4.
“State-legal marijuana is irrelevant to a federal clearance.”No.Federal law and federal personnel-security guidance still apply. Past use is evaluated under the whole-person standard.
“Every clearance requires a polygraph.”No.Some agencies and programs require one, but it is not universal.
“Public Trust is a clearance.”No.Public Trust is a separate trust/risk determination and does not provide classified access.
“Clearances renew every 5/10/15 years.”Outdated.Continuous Vetting and current questionnaire-update requirements replaced the old schedule as the main modern framework for covered national-security populations.

After clearance eligibility is granted

Final eligibility does not automatically open every classified system. Before access, the organization confirms the appropriate level and need-to-know. Covered personnel may sign the SF-312, receive security briefings, and complete SCI, SAP, or other program read-ins where required.

Temporary or interim eligibility is different from final eligibility. It is provisional, discretionary, can be withdrawn, and may not be reciprocal at another organization.

Continuous Vetting and self-reporting

Continuous vetting uses automated record checks and time- or event-driven activity to help agencies identify relevant changes after the initial vetting decision.

The national security population is already covered by modern CV capabilities, while government-wide Trusted Workforce 2.0 implementation continues for other populations and new investigative products. DCSA reported that it sunset legacy periodic-reinvestigation products at the end of June 2026, with limited exceptions.

For NISP contractor national-security personnel, DCSA now requires a five-year updated PVQ or SF-86 eApp submission rather than a periodic reinvestigation. That specific five-year rule should not be treated as universal for every federal agency.

Covered personnel also have self-reporting obligations under SEAD 3 and agency implementing rules. When in doubt, use the security office or FSO identified by your organization.

Changing jobs and reciprocity

A prior favorable clearance decision can often be accepted by another federal organization under reciprocity or transfer-of-trust rules, but new access is not automatic.

The gaining organization verifies current eligibility, level, need-to-know, and any special requirements. SCI, SAP, polygraph, agency-specific requirements, new adverse information, or other policy exceptions can require additional processing.

Avoid relying on a blanket “two-year reactivation” rule. Current status, affiliation, Continuous Vetting enrollment, repository records, and the receiving agency’s rules control the next step.

Cybersecurity careers and security clearances

Clearances are common in some federal cyber, defense-contracting, intelligence, aerospace, military cyber, and classified-system roles.

Titles can include security analyst, security engineer, incident responder, system administrator, security architect, digital-forensics specialist, penetration tester, cloud-security engineer, and information-system security roles.

The mission and classified-access requirement, not the generic title, determine whether a clearance is needed.

On USAJOBS, check the “Security clearance” field and the background/security section of each announcement. For contractor roles, look for wording such as “must be able to obtain” versus “active clearance required.”

This guide provides general educational information about U.S. federal personnel vetting. It is not legal advice, a promise of eligibility, or a substitute for instructions from the hiring agency, military service, security office, Facility Security Officer, or other authorized federal security official.

Agency procedures and personnel-vetting systems can change, and agency-specific requirements control when they differ from general guidance.

Frequently asked questions

Can I get a security clearance without a job?

Usually no. An authorized federal need tied to a job, assignment, or contract normally starts the process.

Can I pay for my own clearance?

No. A private payment cannot substitute for federal sponsorship, investigation, and adjudication.

What are the main levels?

Confidential, Secret, and Top Secret.

Is Public Trust a security clearance?

No.

Is TS/SCI a separate clearance level?

No. SCI is an additional controlled-access category, not a fourth classification level.

How long does it take?

It varies. Current federal metrics must be read by phase and population; they are not personal guarantees.

Do clearances expire?

Not under the old simple 5/10/15-year model. Continuous Vetting, affiliation, need, and current update requirements matter.

Does debt automatically disqualify me?

No. It is evaluated under the whole-person standard.

Does mental-health treatment automatically hurt eligibility?

No. Seeking appropriate care is not, by itself, a negative security inference.

Is a polygraph always required?

No. Some agencies and programs require one.

Do I need U.S. citizenship?

Ordinary personnel clearances generally require citizenship. Narrow Limited Access Authorizations for some non-U.S. citizens are not equivalent to ordinary clearance eligibility.

What happens when I change employers?

The gaining organization checks reciprocity or transfer-of-trust rules, current status, and any additional program requirements before granting access.

References