Joseph Tonon, a former acting assistant secretary of defense, is taking the reins at the Defense Counterintelligence and Security Agency.
A new director at the Defense Counterintelligence and Security Agency will take on DCSA’s longstanding challenge to modernize the federal government’s background investigations system.
DCSA announced this week that Joseph Tonon has been selected as director of DCSA. Tonon replaces Justin Overbaugh, the deputy under secretary of defense for intelligence and security who had also been serving as acting director of DCSA since last November. DCSA’s previous permanent director, David Cattler, retired last September.
Tonon most recently worked for Amazon Web Services. But he’s no stranger to DoD. During the first Trump administration, he served as special assistant to the deputy secretary of defense and as the acting assistant secretary of defense for special operations and low intensity conflict.
He also served on the secretary of the Navy’s staff. During that time, DCSA said Tonon “led a successful effort to prevent the loss of critical data and technology,” an effort that he helped expand across DoD as part of the Protecting Critical Technology Task Force.
The task force, formally established in October 2018, addressed how foreign adversaries were stealing sensitive but often unclassified data from defense contractors, universities and other organizations to glean information about critical U.S. military technologies.
That experience will be especially relevant at DCSA, which conducts background investigations on tens of thousands of federal employees and contractors to determine whether they’ll receive a security clearance and access to classified information.
DCSA’s remit also includes oversight of security across more than 10,000 cleared businesses and 12,500 classified contractor facilities.
A recent Government Accountability Office audit found DCSA uncovered hundreds of security violations across the cleared defense industry last year. Furthermore, GAO found DCSA has only had enough resources dedicated to industrial security in recent years to conduct oversight at 25-30% of classified contractor facilities on an annual basis.
Much of DCSA’s focus over the last five years has been on delivering the National Background Investigation Services (NBIS) program. The IT system is core to an effort dubbed “Trusted Workforce 2.0” to modernize the federal government’s personnel vetting system, including background checks.
But NBIS is years behind schedule and hundreds of millions of dollars over budget. DCSA and other agencies continue to rely on legacy IT systems to manage background investigations and other data on security clearance holders.
DoD paused the NBIS program in 2024 amid the program delays and cost overruns. The department and new DCSA leadership then revamped the NBIS program plan and roadmap. DoD also shifted oversight of the NBIS program to the under secretary of defense for acquisition and sustainment, in addition to creating a new NBIS Requirements Governance Board.
The continued development and deployment of NBIS will be “a key priority” for Tonon, DCSA said in a news release.
Congress will also be watching the progress of NBIS under Tonon closely.
In testimony before the House Oversight and Government Reform Committee’s Subcommittee on Government Operations earlier this year, Overbaugh told lawmakers that DCSA will deploy core NBIS shared services by the end of 2027. That includes the new Personnel Vetting Questionnaire, “enhanced data repositories, and background investigation functionalities,” Overbaugh told lawmakers.
“By the end of 2028, DCSA will operationalize the end-to-end TW 2.0 model, enabling all agencies to use modernized vetting workflows, streamlined onboarding, and risk-based continuous vetting,” Overbaugh said. “Legacy investigative products, standard forms, and systems are scheduled to sunset, culminating in a unified federal vetting ecosystem.”
Tonon will likely be focused on addressing lingering risks in the NBIS program plan. GAO told lawmakers at the February hearing that the schedule to deliver the $4.6 billion program is “still not reliable.”
Overbaugh said at the hearing that DCSA would finalize a “business operationalization synchronization schedule” by April to address some of the risks identified by GAO. He added that DoD would share the schedule with lawmakers.
“We will, and we must get our hands around a detailed schedule that enables the agency itself to hold itself accountable and for our oversight partners to hold us accountable,” Overbaugh said. “That is nonnegotiable. We will achieve that in the coming months.”
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
