CCAIR
CCAIR Student Guide · Part 8 of 8

Working in government or defense: security clearances

This page is for students considering government agencies or defense contractors, where many cybersecurity jobs require a security clearance. You cannot apply for one yourself, but the choices you make as a student shape how the process goes.

Last verified: October 2026 · Reviewed by Dr. Benjamin M. Ampel, Director of CCAIR

General information, not legal advice. Rules differ by agency and change over time. For your own situation, ask the hiring agency's security office or a qualified attorney.

How the process works

  1. A job offer. The employer or agency sponsors your clearance after a tentative offer.
  2. The questionnaire. You complete the SF-86 (Questionnaire for National Security Positions) in NBIS eApp, the Defense Counterintelligence and Security Agency (DCSA) system[1]. The government is replacing the SF-86 with the Personnel Vetting Questionnaire (PVQ), with use in all vetting cases targeted for September 2027[2].
  3. The investigation. In the third quarter of fiscal year 2026, initial investigations took about 57 days for Secret and 82 days for Top Secret, counting all cases. The full process, including the decision, took about 82 and 146 days[2].
  4. Adjudication. An adjudicator applies the 13 guidelines in Security Executive Agent Directive 4 (SEAD 4). The review weighs the whole person, including how serious, frequent and recent any conduct was, your age at the time and evidence of rehabilitation. Any doubt is resolved in favor of national security[3].
  5. Extra steps and continuous vetting. Some agencies add a polygraph[4], and the National Security Agency (NSA) adds a psychological assessment[5]. Once cleared, you are enrolled in continuous vetting, which has replaced periodic reinvestigations[2][6].

Ask the hiring office whether you can start work before the final decision. For federal applications, see Get hired.

The 13 adjudicative guidelines

SEAD 4 lists 13 guidelines, labeled A to M. They run from allegiance to the United States, foreign influence and personal conduct through financial considerations, drug involvement, criminal conduct and use of information technology[3].

Guideline M matters for cybersecurity students: unauthorized access to systems is a security concern even when it starts as curiosity. Practice only on platforms and systems you have permission to use.

What to do now

  • Tell the truth. Knowingly false statements on the form are a felony under 18 U.S.C. 1001, with up to five years in prison[7][8]. Honesty falls under Guideline E[3].
  • Stop using marijuana before you apply. Marijuana use remains a federal matter for clearances. Guidance from the Office of the Director of National Intelligence (ODNI) says past use is relevant but not determinative. It expects applicants to stop once they sign the SF-86, and it treats CBD products with more than 0.3% THC as marijuana[9]. An April 2026 rule moved only FDA-approved marijuana products and state-licensed medical marijuana to Schedule III[10]. We found no change to clearance guidance after it.
  • Keep finances current. The SF-86 asks about debts more than 120 days delinquent and about taxes not filed or paid in the last seven years[8]. Bring any defaulted student loan back into good standing before you apply.
  • Keep records as you go. The table below lists what the SF-86 asks for[8].
What the SF-86 asks you to list
RecordHow far back
Addresses10 years, no gaps
Employers10 years
Schools10 years
Foreign travel7 years
Close or continuing foreign contacts7 years
Three references (not relatives)Together know you 7 years

Related Pathway Finder roles

Each role guide covers the work, the realistic first job, starter certifications and free practice.

Sources

We checked each source in October 2026. Rules, prices and dates change, so confirm them on the source before you act.

  1. [1] Defense Counterintelligence and Security Agency. Industrial Security Letter 2024-02: e-QIP to NBIS eApp.
  2. [2] Performance Accountability Council. Trusted Workforce 2.0 quarterly progress report, FY2026 Q3.
  3. [3] ODNI (copy hosted by the Department of Energy). Security Executive Agent Directive 4: National Security Adjudicative Guidelines.
  4. [4] ODNI. ICPG 704.6, Conduct of Polygraph Examinations for Personnel Security Vetting.
  5. [5] IntelligenceCareers.gov. NSA suitability process.
  6. [6] Defense Counterintelligence and Security Agency. DCSA updates NISP contractor continuous vetting process.
  7. [7] Legal Information Institute. 18 U.S. Code 1001.
  8. [8] OPM. Standard Form 86, Questionnaire for National Security Positions.
  9. [9] ODNI. Security Executive Agent clarifying guidance concerning marijuana (December 21, 2021).
  10. [10] Federal Register. Rescheduling of FDA-approved products (April 28, 2026).

Last verified: October 2026. Written for students by the Center for CyberAI Research (CCAIR) at Georgia State University. Found an outdated fact? Tell us through the contact page.