WASHINGTON – Federal charges against 25-year-old Reality Leigh Winner, a contract employee for the National Security Agency who had access to sensitive documents, beg the question: What does it take to get a security clearance?

Security clearances aren’t that rare, according to an October report by the non-partisan Congressional Research Service.

The government trusted about 4.3 million people with various levels of security clearance as of October 2015, according to the Office of the Director of National Intelligence. These included nearly 2.9 million people at the “confidential” or “secret” level and nearly 1.4 million at the “top secret” level.

Even at the lowest level – confidential clearance – unauthorized disclosure of the information would “cause damage to the national security.” A secret clearance means disclosure would cause "serious damage.”

And top secret means disclosure would cause "exceptionally grave damage.”

Winner, arrested on Saturday by the FBI at her home in Augusta, Ga., allegedly provided a top-secret NSA document for a story, published Monday in The Intercept, about Russian interference with U.S. elections. Winner, a contractor with Pluribus International Corp. who previously served in the Air Force, has held a top secret security clearance since at least February.

In general, security clearances are granted only to citizens whose work requires access to classified materials. The background check must confirm the worker is trustworthy, honest, reliable and is free from conflicting allegiances or the potential for coercion, according to the CRS report.

Even if an employee gets security clearance, it isn’t a guaranteed ticket to see secret documents. Federal workers or private contractors are granted clearances after their agency conducts a background investigation.

RELATED | Augusta woman arrested for allegedly leaking top secret document

MORE | Who is Reality Leigh Winner? Accused leaker held top secret clearance

"Only those persons who have a bona fide need-to-know and who possess a personnel security clearance at the same or higher level as the classified information to be disclosed may have access to classified information," according to Pentagon statement on clearances.

Security clearances aren’t mandated for the president, vice president, members of Congress, Supreme Court justices or other constitutional officers

Security clearances don't expire, particularly if a worker continues to deal with secret information. The Pentagon typically conducts a renewal investigation of people with top-secret clearances every five years, for secret every 10 years, and for confidential every 15 years.

"Generally speaking, a personnel security clearance remains in effect as long as the individual remains continuously employed by the cleared contractor and can reasonably be expected to require access to classified information." according to a Pentagon statement on clearances. "To preclude excessive clearances, the Facility Security Officer should continually review the number of employees with the personnel security clearances and reduce the number of clearances whenever possible."

Lawmakers, security experts and government officials have often raised concerns about how clearances are reviewed and granted.

RELATED | Accused NSA leaker Reality Leigh Winner left easily followed trail, FBI says

In 2013, former Defense Secretary Chuck Hagel ordered a review of how the military reviews clearances for troops and civilian employees after a Navy contractor, Aaron Alexis, shot 12 civilians to death at the Washington Navy Yard office complex before he was killed by police. Alexis had held a security clearance since 2008, after he enlisted in the Navy Reserve. That clearance gave him access to the Washington Navy Yard.

The Senate approved a bill last year from Democratic Sens. Claire McCaskill of Missouri and Jon Tester of Montana that sought to improve the quality of background checks and directed the president to review which positions and contracts require a security clearance at least every five years.

The lawmakers sponsored the bill, which didn't get a vote in the House, because USIS — the company that conducted background investigations for Alexis and for Edward Snowden, the former contractor who leaked government secrets — also had a contract to oversee the quality of background checks, including its own.

“We’ve seen far too many lapses in our background check system that undermine our national security and compromise our country’s secrets and secure facilities,” McCaskill said after the Senate vote in November.