The United States has a secrets problem. Not because classified information no longer deserves protection, but because the systems responsible for safeguarding it are increasingly strained.
That’s one of the central messages in the Information Security Oversight Office’s (ISOO) Fiscal Year 2025 Annual Report to the President, dated September 30, 2026.
The report paints a picture of a federal information security enterprise struggling with workforce shortages, inconsistent policies, outdated processes, and growing technological demands. It also highlights opportunities to modernize how the government classifies, safeguards, shares, and eventually declassifies sensitive information.
But perhaps the most important message comes directly from ISOO Director Michael D. Thomas, who makes a compelling case that the government doesn’t need to choose between protecting secrets and sharing information.
“The United States still needs its secrets today as much as it ever has. The challenge currently before us is not deciding between protection and access or finding a ‘balance’ between secrecy and transparency. It is, instead, the obligation to build a government capable of managing each with greater precision, discipline, and speed.”
It’s an important distinction, particularly for the Americans whose work supports national security and the defense industrial base. The cleared workforce exists because some information must remain protected. Intelligence sources and methods, military capabilities, sensitive technologies, and operational plans aren’t simply government records. They’re national security assets, and their unauthorized disclosure can have serious consequences.
But protecting that information requires more than a security clearance. It requires trained personnel, effective policies, modern technology, and an information security infrastructure that can keep pace with the missions it supports.
ISOO’s report makes clear that there’s work to be done on all four fronts.
1. The Security Workforce Is Shrinking While the Mission Keeps Growing
Agencies reported 1,113 full-time-equivalent employees primarily assigned to declassification activities in FY 2025, compared with 1,384 in FY 2024. That’s a nearly 20% decline in a single year and a 40% decline since FY 2021.
Meanwhile, the government ended FY 2025 with 11,627 mandatory declassification review requests unresolved for more than a year. That’s a significant improvement from FY 2022, when the backlog reached 22,861 requests, and FY 2023, when it stood at 22,159. Focused agency processing efforts reduced the backlog by nearly half in FY 2024, and those gains largely held in FY 2025.
The progress deserves recognition. It also raises an important question: How does the government sustain those improvements when the workforce responsible for reviewing classified records continues to shrink? One of the answers the report outlines is new agency initiatives to apply Super Intelligence to the declassification dilemma.
But workforce needs aren’t just with declassification decisions. ISOO conducted six agency inspections during FY 2025 and found significant staffing shortages at four of them. At the Environmental Protection Agency and Department of Transportation, small security teams were responsible for classified information, industrial security, physical security, and Controlled Unclassified Information (CUI).
Sound familiar?
For Facility Security Officers (FSOs) and security professionals across the defense industrial base, this is an increasingly recognizable problem. Security teams are responsible for an expanding portfolio of requirements, from personnel security and insider threat programs to CUI, cybersecurity coordination, and increasingly complex information management.
The challenge isn’t simply finding enough people. It’s finding qualified professionals who understand how security requirements translate into operational decisions. And those professionals must be considered essential to mission success, not simply easy to cut overhead.
2. Thousands of Security Violations Highlight the Importance of Getting Protection Right
For FY 2025, ISOO changed its reporting methodology to capture actual incident counts rather than simply asking agencies whether violations had occurred. The result: 13 federal agencies reported 6,314 individual security violations.
The Department of Defense accounted for 5,850 of those violations, followed by the Department of Energy with 207, the Office of the Director of National Intelligence with 122, and the Department of Homeland Security with 104.
The numbers are notable, but they require context.
The new reporting methodology means the figures can’t be used to establish a year-over-year increase in violations. And the report doesn’t establish that each violation resulted in an unauthorized disclosure or compromise of classified information.
What the data does demonstrate is the importance of consistently tracking security incidents and understanding where programs may need improvement. The update represents a significant and welcome step toward transparency in incident reporting. Because if it’s not tracked, it’s rarely addressed.
3. More Than a Third of Federal Agencies Still Lack a Completed CUI Policy
For security professionals and government contractors navigating CUI requirements, the report contains another significant finding. Just 63% of surveyed federal agencies indicated they had a CUI policy in place. The remaining 37% did not. Among the organizations identified as lacking completed policies were the CIA, Department of State, Department of Health and Human Services, and Office of Personnel Management.
ISOO cited several reasons for the gaps, including limited staffing and financial resources, insufficient senior leadership authority to finalize policies, and policies that remained in draft form.
The implications for industry are significant.
Government contractors have spent years trying to understand and implement CUI requirements, including the cybersecurity and information handling obligations associated with federal contracts. Yet the agencies responsible for implementing those requirements aren’t uniformly meeting their own policy benchmarks.
For FSOs, compliance teams, and contractors navigating CMMC requirements, the takeaway is clear: CUI remains a government-wide work in progress.
4. AI Could Help Modernize Classification, but It Won’t Replace Security Professionals
One of the report’s more encouraging themes is the government’s growing adoption of super intelligence and advanced automation to support classification and declassification. Several agencies are already exploring or deploying technologies to assist with document review, classification decisions, and information management.
The Department of State is using machine-assisted review to support classification and declassification processes. The Office of the Director of National Intelligence is using technology to compare documents against security classification guides, while the CIA is applying tools to identify duplicative information and verify classification accuracy.
The Department of Energy also launched its Advanced Computer Tools for Identifying Classified Information (ACTICI) program in FY 2025. These applications are particularly relevant because classification and declassification involve enormous amounts of document review, repetitive analysis, and comparison against established guidance.
5. Security Clearance Spending Is Up, but Better Metrics Are Still Needed
The report also provides a look at federal spending on security clearance investigations and reinvestigations.
Agencies reported more than $1.19 billion in expenditures for FY 2025, compared with just over $983 million in FY 2024, an increase of more than 20%. But ISOO cautions that historical reporting in this category has been inconsistent, making it difficult to draw reliable conclusions about spending trends.
For example, reported expenditures fell from approximately $1.5 billion in FY 2021 to $300 million in FY 2023 before rebounding sharply over the following two years.
Those fluctuations make it difficult to determine how much of the change reflects actual investigation costs, reporting practices, or broader program changes.
Protecting Secrets Is a Workforce Mission
The broader takeaway from ISOO’s report isn’t that the government should classify less information simply for the sake of transparency. It’s that the government needs to become better at identifying what truly requires protection, safeguarding it effectively, and ensuring that authorized personnel can access the information they need to accomplish the mission.
It requires security professionals who understand classification policy, industrial security, insider threat programs, and the operational realities of national security work. And it requires government and industry leaders willing to invest in the infrastructure, technology, and training that make effective information security possible.
As the national security workforce evolves, information security needs to evolve with it.
Thomas’s message is an important reminder that secrecy and transparency aren’t opposing objectives. They’re both responsibilities of a government entrusted with protecting national security information. The United States still needs its secrets. It also needs a skilled workforce capable of protecting them, and policies and processes that are consistent and clear.
And if the ISOO report makes one thing clear, it’s that the future of national security depends on getting both right.
