Security Incidents Involving Classified Information

Security Incidents Involving Classified Information — Six Incident Types

Foundation

Found Classified Material

Anyone finding classified material out of proper control must:

Take custody of the material
Safeguard the material
Immediately notify their commander, supervisor, or security manager

Reference

DoDM5200.01V3 Reference

The terms associated with security incidents are formally defined in DoDM5200.01V3_DAFMAN16-1404V3, *DoD Information Security Program: Protection of Classified Information*.

Six Security Incident Types

6 Security Incident Types.

Infraction
Violation
Compromise
Loss
Data Spills
Information in the Public Media

Infraction

Infraction Definition

An infraction is a security incident involving failure to comply with requirements which:

CANNOT reasonably be expected to result in the loss of classified records
Does NOT result in the suspected or actual compromise of classified information

Infraction Nature

An infraction may be:

Unintentional
Inadvertent

Infraction Status

While it does NOT constitute a security violation, if left uncorrected, can lead to security violations or compromises.

Infraction Action

It requires an INQUIRY to facilitate immediate corrective action but does NOT require an in-depth investigation.

Violation

Violation Definition

Violations are security incidents that indicate knowing, willful, and negligent for security regulations, and result in, or could be expected to result in:

The loss of classified records
The compromise of classified information

Violation Action

Security violations require an inquiry and/or investigation.

Compromise

Compromise Definition

A compromise is a security incident (more specifically, a violation) in which there is an unauthorized disclosure of classified information.

Disclosure Recipient

Compromise Disclosure

Disclosure to a person(s) who does NOT have:

A valid clearance
Authorized access
A need to know

Loss

Loss Definition

A loss occurs when records containing classified information cannot be physically located or accounted for.

Loss Example

This could include classified records/equipment is discovered missing during an audit and which cannot be immediately located.

Data Spills

Data Spills Definition

Classified data spills occur when classified data is introduced:

Onto an unclassified information system
To an information system with a lower level of classification
To a system not accredited to process data of that restrictive category

Data Spill Treatment

Although it is possible that no unauthorized disclosure occurred, classified data spills are considered and handled as a possible compromise of classified information involving information systems, networks, and computer equipment until the inquiry determines whether an unauthorized disclosure did or did not occur.

Information in the Public Media

Public Media Foundation

If classified information appears in the public media, including on public Internet sites, or if approached by a representative of the media, DoD personnel shall be careful NOT to make any statement or comment that confirms the accuracy of or verifies the information requiring protection.

Public Media Action

Report the matter as instructed by the appropriate DoD Component guidance, but:

- Do NOT discuss it with anyone who does not have an appropriate security clearance and need to know