As part of these new controls, posts and headquarters units should establish written policies and procedures covering all entities involved in the vetting process at posts, including documentation and record retention policies specifying what documentation is needed and where and how long vetting files should be maintained.