DCSA Oversees Nearly All U.S. Classified Contracts. It Reviewed 38% of the Facilities It Was Required To.

The Defense Counterintelligence and Security Agency administers the Department of Defense's share of the National Industrial Security Program — the system that decides whether a private contractor is trusted to hold classified U.S. government information, and checks on it afterward.▸ DCSA is responsible for an estimated 90 to 95 percent of all U.S. classified contracts government-wide, according to a GAO report released in April 2026. The Pentagon's own budget documents put $162.8 million behind that mission in fiscal 2025. In the last year GAO could line a requirement up against a result, DCSA completed 3,618 of the 9,611 facility security reviews the National Industrial Security Program Operating Manual said it owed — a little over a third.

DCSA's Operation & Maintenance budget for fiscal 2025 — the pot that funds its headquarters directorates, not the separate revolving fund that pays for background-investigation casework — was enacted at $904.5 million.▸ Industrial Security, the directorate responsible for reviewing cleared contractor facilities, got 18 percent of it. Personnel Security Investigations for Industry, which processes background-check billing for industry clearance holders, got more than twice as much.

That comparison actually understates the imbalance.▸ DCSA's much larger personnel-vetting mission — background investigations for security clearances across more than 100 federal agencies — is funded mostly through a separate Working Capital Fund that doesn't appear in this table at all. DCSA officials told GAO the agency dedicates roughly $1.2 billion to $1.3 billion a year to personnel vetting, eight to nine times the industrial security mission's FY2025 total, and that "funding dedicated to the industrial security mission had remained relatively flat" for years even as the rest of the agency grew.

Industrial security funding did eventually move.▸ DCSA's own reporting to GAO shows mission expenditures — a broader figure than the O&M line above, since it folds in R&D costs for a system replacement — climbing 49 percent over five years, with almost all of that growth landing in the last two.

Staffing moved too, but late and unevenly: DCSA held its industrial security workforce roughly flat at 394 to 412 people from FY2021 through FY2024, then added 76 positions in a single year — a 19 percent jump to 479 in FY2025.▸ Forty-two of those 76 new hires went to headquarters to staff a new statutory entity-vetting requirement, not to the four regional field offices that actually conduct facility reviews; field staff rose by a smaller 36 positions, from 293 to 329.

None of that growth has closed the coverage gap GAO came to measure.▸ In fiscal 2023 — the most recent year the agency's own data lets GAO pair a requirement against a result — 9,611 of DCSA's 12,519 cleared contractor facilities were due a security review under the Pentagon's baseline inspection-frequency policy. DCSA completed 3,618.

That 37.6 percent lines up with two other numbers in the record.▸ GAO's own report summary describes DCSA as conducting "less than 40% of its required inspections of contractor facilities." And in a June 2023 internal memo to its Pentagon overseers, DCSA's director wrote that the agency was "resourced to conduct required NISP oversight of only about 25-30 percent of the cleared industrial base" — and proposed adding 230 field reviewers, among other positions, to close the gap. As of September 2025, per GAO, the Pentagon's intelligence and security office had implemented none of DCSA's proposed investment options, telling GAO the request showed "limited policy requirements or linkage to the industrial security mission."

The reviews DCSA did complete found real problems: 815 security violations open at some point in fiscal 2025 (most of them classified data spilling onto unclassified systems) and 1,032 open security vulnerabilities as of that September, concentrated in review procedures, staff training, and access-control recordkeeping.▸ DCSA closed 576 of the 815 violations, about 71 percent, by the time GAO finished its review. GAO made four recommendations to the Pentagon to fix how it manages industrial-security risk and coordinates with the agency; the Department of Defense concurred with all four but, per GAO, specified an implementation plan for only three.

Figures for facility reviews required vs. completed, personnel counts, and security violations/vulnerabilities are drawn from GAO-26-107861 (April 2026) and are the most recent DCSA has reported in that paired form; FY2025 O&M budget figures are drawn separately from DCSA's FY2026 Budget Estimates. The two documents measure "industrial security spending" on slightly different bases — one an appropriation line, the other a broader reported-expenditure figure — which is why the FY2025 totals in this piece ($162.8M and $163.2M) are close but not identical.