Personnel Clearance Tracking: DISS vs. Spreadsheets vs. Software

If you've been running a cleared facility for more than a few months, you already know DISS doesn't handle most of what you're responsible for. This isn't news to you. You've built your own tracking system out of necessity: probably a spreadsheet, maybe a shared drive full of training certificates, possibly a calendar with reminder alerts that you set up yourself.

This isn't going to tell you something you don't know. What it might do is help you think through whether your current approach still makes sense as your company grows — or help you explain to leadership why "we already have DISS" isn't actually an answer to the compliance tracking question.

If you're brand new to facility clearances and genuinely thought DISS handled everything, welcome to reality. Let's start with what DISS actually does.

What DISS Actually Tracks

DISS (Defense Information System for Security) replaced JPAS in 2021 and serves as the authoritative source for personnel security information across DoD. Through the Joint Verification System (JVS), you can verify:

• Clearance eligibility level (Secret, Top Secret, etc.)
• Investigation status and completion dates
• Continuous Evaluation enrollment
• Access determinations
• Visit authorization requests

That's it. That's the list.

Notice what's missing? Training. DISS doesn't track whether your employees have completed their annual security refresher. It doesn't know if someone's insider threat training expired three months ago. It has no idea when you last conducted an initial security briefing for a new hire.

And here's the thing: 32 CFR 117.12 requires you to maintain records of security training. Initial briefings. Annual refreshers every 12 months. Insider threat training annually. Derivative classification training every two years if applicable. You're required to retain records of the date of the most recent training and the type of training provided to employees.

DISS doesn't help you with any of that.

The DISS Gap Problem

Let's be specific about what DISS doesn't do:

• Training compliance: No field for "date of last annual refresher," no alerts for expirations, no tracking of SF-312 execution dates or debriefing completion.
• DD254 management: Your contract security classification specifications live somewhere else. DISS won't remind you when a DD254 expires or needs revision.
• Self-inspection tracking: Your annual self-inspection per 117.6(b)? DISS doesn't care. You need your own system for tracking findings and remediation.
• Foreign travel: SEAD 3 requires pre-travel briefings and post-travel debriefs. DISS captures some reporting, but the pre/post documentation is on you.
• Policy acknowledgments: When you update security procedures and need everyone to acknowledge them, DISS isn't the tool.

So you have a government system that's the authoritative source for clearance status, but it covers maybe 30% of what you're actually responsible for as an FSO. The other 70% is on you to figure out.

Enter the Spreadsheet

This is where most small contractors start. You build a spreadsheet. It has columns for employee names, clearance levels, investigation dates, training completions, and maybe some notes. You update it when you remember. You check it before DCSA shows up.

Here's the truth: for a facility with under 10 cleared personnel, a well-maintained spreadsheet can work.

At that scale, you know everyone. You remember what's due.

A spreadsheet at this size has some real advantages:

• It's free. You already have Excel or Google Sheets.
• It's flexible. Add columns, change formats, track whatever you want.
• You control it. No subscription, no vendor, no learning curve.
• You can show it to DCSA. Print it out, hand it over, done.

When Spreadsheets Break Down

The spreadsheet model has a failure point, and it's not a single headcount number. It's a combination of factors:

• Growth without process change. You hired more people and kept the same manual system.
• The founder gets busy. Updates slip by weeks, then you stop trusting the data.
• Things slip through the cracks. Someone's annual training expires or a reinvestigation comes due and you miss it.
• Audit prep becomes painful. The spreadsheet isn't enough — you still need the underlying documentation.

The spreadsheet didn't cause these problems. But it didn't prevent them either. It's a static document that requires a human to check it, update it, and act on what it says. When that human gets overloaded, the system fails.

The Efficiency Problem

We've seen this pattern dozens of times: a company grows from 10 to 25 cleared employees, FSO duties take more time, and someone suggests hiring a dedicated security person. Company hires a full-time FSO at $70–90K plus benefits.

And now you have a full-time employee doing a job that doesn't require full-time effort. A facility with 25 cleared personnel often has 15–25 hours of monthly FSO work. That's not a full-time job, but it's too much for the founder to carry as a side responsibility.

This is the classic inefficiency of the "hire someone" solution: you're paying full-time wages for part-time work.

What Software Actually Solves

Good FCL compliance software doesn't replace DISS. It fills the gaps that DISS leaves open.

• Automated alerts. Training expiring soon? The system tells you and tells the employee.
• Training tracking that DISS doesn't do. Initial briefing dates, annual refresher completions, insider threat training, derivative classification training.
• Audit-ready documentation. When DCSA asks, you run a report — not a scavenger hunt.
• Employee self-service. Employees can view status, upload documentation, and complete acknowledgments.
• DISS integration. Pull clearance data so you're not retyping investigation dates into a spreadsheet.

The real value isn't any one feature. It's that the system actively prevents things from falling through the cracks.

Making the Right Choice

So which approach is right for you? It depends.

Spreadsheet makes sense if:

• You have fewer than 10 cleared personnel
• You can dedicate 1–2 hours weekly to FSO duties
• Your compliance needs are straightforward
• You're disciplined about updates
• You're comfortable with manual-tracking risk

Software makes sense if:

• You have 10+ cleared personnel or are growing toward that
• FSO duties are competing with your actual job
• You've already had something slip
• You want audit prep to take minutes, not hours
• You want to avoid hiring full-time for part-time work

Software plus AFSO services makes sense if:

• You don't want to deal with any of this
• You need expert judgment for incident response or DCSA prep
• You want efficiency plus experienced support
• You'd rather pay for support than train yourself on 32 CFR 117

The Hidden Cost of "Free"

The spreadsheet is free in the way doing your own oil changes is free: the materials cost almost nothing, but your time has value.

When you're spending 3 hours prepping for a DCSA review that software could prep in 20 minutes, that's not free. When you're chasing down training certificates instead of working a proposal, that's not free. When you're lying awake wondering if you missed a reinvestigation date, that's definitely not free.

What This Means for You

If you're tracking personnel security with a spreadsheet and it's working, keep doing that. Don't let anyone (including us) tell you to buy software you don't need.

But if you're growing, or things are slipping, or you're spending way too much time on compliance busywork, take a hard look at your options. The gap between what DISS provides and what you're responsible for is real. How you fill that gap is up to you — just be honest about the costs.