18 Attachment C - SSI Policies and Procedures Handbook.pdf

SSI Policies & Procedures Handbook Attachment to TSA MD 2810.1 Version 3.1

SSI Program Current as of April 15, 2024

SSI Policies & Procedures Handbook

Document Change History

Version Date Description

1 23 April 2012 Draft Baseline Release - Note: This revised policy superseded all SSI Program office policies and procedures dated September 29, 2006 and August 7, 2007.

2.0 4 November 2015

This revised policy supersedes Version 1 of the SSI Policies & Procedures Handbook. Updated links to SSI Program resources;

expanded guidance on SSI Challenge and Appeals Process (Subsection 3.8); inclusion of guidance on transmitting images in Good software (Subsection 5.2.3); added guidance on Video Teleconferencing (Subsection 5.2.8); updated guidance on encrypting files using Adobe® Acrobat® Professional, Microsoft® Office®, and WinZip® (Subsection 5.3.3); included provision for sharing/disclosing SSI with those receiving classified information (Subsection 6.1); added guidance Disclosure of SSI to AFGE and Personal Representatives (Subsections 6.1 and 6.3); included expanded guidance on delegation of authority for disclosure of SSI to Congress (Subsection 6.4); added guidance State Open Records Requests (Subsection 6.6); removed reference to SSI Site Assistance Visits (Subsection 9.7); added decision process for Determining SSI Release to Foreign Governments (Appendix 8); added instructions for new and certified SSI Coordinators (Appendix 9 & 10); added instructions for applying Watermarking to files (Appendix 11); added instructions for Formal Appeal Justification (Appendix 12).

3.0 15 July 2022

This revised policy supersedes Version 2 of the SSI Policies & Procedures Handbook. This Handbook has substantive edits throughout. Notable updates include, but are not limited to, updated links to SSI Program resources; requirement to transcribe audio material in Requesting an SSI Assessment or SSI Review from the SSI Program (Subsection 3.5); expanded guidance on portion marking in Marking SSI (Section 4.0) including updates to Table 1, SSI Marking Guidance for Records & Media, expanded guidance on Safeguarding SSI (Section 5.0) including extensive edits to TSA Shared Network Resources, updates to Encrypting SSI in Transmission and Storage, and a new section on SSI Handling during Telework and Remote Work;

expanded guidance on Disclosure of SSI (Section 6.0) including

3.0 (cont.)

updates to Determining Covered Persons with a Need to Know (Subsection 6.1), Non-Disclosure Agreements (Subsection 6.2), Congress and Government Oversight (e.g., GAO, OIG) (Subsection 6.4), and a new section on Vetting for Access to SSI (Subsection 6.9); updated guidance in Destruction of SSI (Section 7.0); updated guidance on SSI Training Programs (Section 8.0);

removed SSI Coordinator Designation Instructions (formerly Appendix 2), instructions for new and certified SSI Coordinators (formerly Appendix 9 & 10), and Formal Appeal Justification (formerly Appendix 12) since this information is available on iShare; updated Appendix 6 & 7 ( SSI Threshold Analysis and SSI Impact Assessment) to streamline and clarify the documents;

removed Determining SSI Release to Foreign Governments (formerly Appendix 8) since this is a matter of internal standard operating procedure. Of particular note, this Handbook update provides options for marking SSI in encrypted emails.

Certificate-based encryption is currently available in email if the user publishes their own certificates. This will be further enabled by future projects to encrypt and mark SSI in email.

3.1 15 April 2024

This revised policy supersedes Version 3 of the SSI Policies & Procedures Handbook. Notable updates include the modification of 3.8.2 on the formal appeals process to add that the decision of the Administrator is only reviewable by a US Court of Appeals, updates to section 5.2.2.3 (including Table 2:

SSI Posting Guidance for SharePoint) to reflect changes in handling on Share Point, the addition of External TSA Password policy in Section 5.3.2., renumerating Sections 5.3.3 through 5.3.6, and adding references to External TSA Password, where applicable. Removed references to iShare and Skype throughout as these platforms have been disabled. Removed reference to Technical Standard 21 , General Telephony as this standard has been archived. Updated Section 11 to clarify that SSI systems are those which SSI is processed, stored, or transmitted. This update includes updates to new SharePoint links throughout.

EFFECTIVE DATE AND IMPLEMENTATION: These changes are effective immediately upon signature.

LARRY A

SMITH

Digitally signed by LARRY A

SMITH

Date: 2024.05.10 15:08:47 -04'00'

Larry A. Smith

Assistant Administrator Security and Administrative Services

05/10/2024

Date

Page of 6 3 7

Table of Contents

1.0 Introduction

2.0 Definitions………

3.0 Identifying SSI …

3.1 Creating SSI Identification Guidance

3.2 Using SSI Identification Guidance

3.3 Conducting SSI Assessments

3.4 Conducting SSI Reviews

3.5 Requesting an SSI Assessment or SSI Review from the SSI Program

3.6 Requesting an SSI Review of Classified Material from the SSI Program

3.7 Identifying Maritime SSI

3.8 SSI Challenge and Appeals Process

3.8.1 SSI Challenge and Informal Appeals Process

3.8.2 Formal SSI Appeals Process

3.8.3 Formal SSI Appeals Schedule

3.8.4 Final SSI Appeals

4.0 Marking SSI

4.1 Marking Records & Media Containing SSI

4.2 SSI in Presentations and Briefings

5.0 Safeguarding SSI

5.1 General Protection of SSI

5.2 Protecting SSI in Transmission & Storage

5.2.1 The Internet

5.2.2 TSA Shared Network Resources: Shared Drives, Systems & TSA Intranet

5.2.2.1 Shared Drives and OneDrive

5.2.2.2 TSA Systems and Applications

5.2.2.3 TSA Intranet (e.g., Teams, SharePoint)

5.2.2.4 Teleconferencing and Webinar Applications

5.2.3 Encrypting SSI in Transmission and Storage

5.2.4 Electronic Devices

5.2.5 Scanners, Copiers & Printers

5.2.6 Faxes

5.2.7 Telephone

5.2.8 Packaging & Delivering SSI

5.2.9 SSI Handling during Telework and Remote Work

5.2.10 Removing SSI from the Workplace (Traveling with SSI)

5.3 Passwords

5.3.1 Standard TSA Password

5.3.2 External TSA Password

5.3.3 Creating Passwords to Encrypt SSI

5.3.4 Methods for Applying Encryption to SSI

5.3.5 Transmitting SSI Passwords

5.3.6 SSI Password Incidents

6.0 Disclosure of SSI

6.1 Determining Covered Persons with a Need to Know

6.2 Non-Disclosure Agreements

6.3 Disclosure of SSI to AFGE and Personal Representatives

6.4 Congress and Government Oversight (e.g., GAO, OIG)

6.4.1 SSI Disclosure to Congress

6.4.2 SSI Disclosure to GAO

6.4.3 SSI Disclosure to OIG

6.5 Freedom of Information Act (FOIA) Requests

6.6 State Open Records Requests

6.7 Enforcement Proceedings

6.8 Other Conditional Disclosures

6.9 Vetting for Access to SSI

6.9.1 Vetting Requirements by Role

6.9.2 Processing SSI Security Threat Assessment (SSI STA) Requests

7.0 Destruction of SSI

8.0 SSI Training Programs

9.0 SSI Awareness Programs

9.1 SSI Coordinators

9.2 SSI BOLOs and Stakeholder Alerts

9.3 SSI Conference Calls

9.4 SSI Awareness Week

9.5 SSI SharePoint Page & Internet Page

9.6 Self-Inspection Program

10.0 SSI Incidents

10.1 Identifying SSI Incidents

10.2 SSI Incident Response & Resolution

10.2.1 Discovery & Initial Notification

10.2.2 Immediate Evaluation & Follow-Up Notification

10.2.3 Early Mitigation

10.2.4 Incident Closure

10.2.5 Long-Term Risk Mitigation

10.2.6 Incident Investigation

10.3 SSI Password Incident Response & Resolution

10.4 Penalties for Mishandling or Unauthorized Disclosure of SSI

11.0 Determining SSI Systems

12.0 Protection Requirements for SSI Systems & Other Secure Sites

13.0 SSI Policy Exceptions

Appendices

Appendix 1: SSI Program Initial Decision Flow Chart Appendix 2: Determining Need to Know Flow Chart Appendix 3: Instructions for Watermarking Files Appendix 4: SSI Incident Response Flow Chart Appendix 5: SSI Incident Reporting Instructions Appendix 6: SSI Threshold Analysis Appendix 7: SSI Impact Assessment

Addendum

Addendum 1: Appendix 4: SSI Incident Response Flow Chart

1.0 Introduction

Welcome to the Sensitive Security Information (SSI) Policies and Procedures (P&P) Handbook. This Handbook expands on the SSI Regulation (49 C.F.R. Part 1520, Protection of SSI); DHS MD 11056.1, Sensitive Security Information; DHS MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information; and TSA MD 2810.1, SSI Program.

What is SSI?

SSI is a category of sensitive information (i.e., sensitive but unclassified [SBU] or controlled unclassified information [CUI]) that must be protected because it is information that, if publicly released, would be detrimental to the security of transportation.1

1 Under 49 C.F.R. § 1520.5(a), the SSI Regulation also provides other reasons for protecting information as SSI beyond that the release of the information would be detrimental to the security of transportation. TSA, however, primarily uses the criterion of “detrimental to the security of transportation” when determining whether information is SSI.

In other words, SSI is information that could be used to bypass or defeat transportation security measures. Armed with SSI, our adversaries will be empowered.

(For detailed categories of SSI, see the SSI Regulation, 49 C.F.R. § 1520.5(b)(1) through (16)).2

2 All future “§” references refer to sections in the SSI Regulation, 49 C.F.R. Part 1520.

For additional guidance on how to identify SSI, see the SSI Program office Identification Guides.

Purpose This Handbook contains policies and procedures on how to properly identify, mark, handle, protect, disclose, and destroy SSI. This Handbook covers many media that may contain SSI, including hard copy (paper), soft copy (electronic), magnetic, CDs and DVDs, video, and other types of media (written and spoken). If a topic of interest is not covered in this Handbook, contact the SSI Program office at SSI@tsa.dhs.gov for consideration of inclusion in future SSI P&P Handbook updates or in the SSI Program office Frequently Asked Questions (FAQ).

During periods of national emergency or exigent circumstances, the Transportation Security Administration (TSA) Administrator or SSI Program Chief may determine that certain requirements of this Handbook should be temporarily suspended.3

3 Even if SSI Program office policies or procedures are temporarily suspended, other TSA program offices (e.g., Information Technology’s Information Assurance and Cybersecurity Division [IAD]) may have policies that still need to be followed.

Even during national emergency or exigent circumstances, however, all covered persons are still required to take reasonable measures to protect

SSI.

Who Should Use This Handbook?

All persons permanently or temporarily assigned, attached, detailed to, employed by, or under contract with TSA (including interns and foreign nationals) must follow the guidance in this Handbook and are hereafter referred to generally as “personnel,” unless otherwise specified. While this Handbook was specifically designed for TSA Personnel, it may also serve as a model for use by other DHS components.

This Handbook may also be used as a collection of best practices for non-Department of Homeland Security (DHS) persons who handle SSI. These persons include transportation stakeholders (i.e., regulated entities such as air carriers); other Federal agencies; state, local, and tribal governments; and other covered persons as defined in 49 C.F.R. § 1520.7. For consideration of sharing this Handbook outside of DHS, contact the SSI Program office directly at SSI@tsa.dhs.gov for a determination on a case-by-case basis.

https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/49%20CFR%20Part%201520.pdf https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/DHS%20MD%2011056.1,%20SSI.pdf https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/DHS%20MD%2011056.1,%20SSI.pdf https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/DHS%20MD%2011042.1,%20Safeguarding%20SBU.pdf https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/DHS%20MD%2011042.1,%20Safeguarding%20SBU.pdf https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/TSA%20MD%202810.1,%20Sensitive%20Security%20Information%20(SSI)%20Program.pdf https://ustsa.sharepoint.com/sites/offices/SitePages/sas/ssi-references-and-resources.aspx mailto:ssi@dhs.gov mailto:SSI@dhs.gov

2.0 Definitions (In alphabetical order)

Authorized Redactor TSA employee who has completed the mandatory TSA Redaction Training and, therefore, authorized to redact documents and/or perform quality assurance reviews on documents redacted by another Authorized Redactor at TSA.

Coordinators

SSI Coordinator A TSA employee who has been appointed by the Deputy Administrator, an Assistant Administrator or equivalent (e.g., Chief of Staff, the Chief Counsel [CC]), a Federal Security Director (FSD), or a Supervisory Air Marshal in Charge (SAC) to be a point of contact for their office and to liaise between their office and the SSI Program office.

Certified SSI Coordinator An SSI Coordinator who has (1) completed the required modules of Advanced SSI Training, (2) passed the SSI Certification Exam, and (3) properly maintained their certification status by completing Continuing Education in SSI (CESSI) Training on an annual basis.

Covered Persons As defined in the SSI Regulation at § 1520.7, an individual or entity that has transportation security or transportation security-related responsibilities to include, but not limited to, (1) anyone who is permanently or temporarily assigned, attached, detailed to, employed by, or under contract with DHS,

(2) regulated parties, Federal, State, Local and tribal government employees, contractors, and grantees, as well as TSA stakeholders and industry partners; (3) Committees of Congress; (4) other persons with a need to know as defined in § 1520.11; and (5) persons receiving SSI pursuant to other conditional disclosures.

Destroy The process of making a record (see below) unreadable and unrecoverable.

Disclose The act of providing access to a record containing SSI to covered person(s) with a need to know or others who are authorized in writing by the TSA Administrator or designee to have access to SSI.

Identifying SSI

Determination A decision made by the TSA Administrator (also known as the Administrator of the Transportation Security Administration) or designee to identify whether or not information, which has not previously been evaluated for SSI content, is SSI.

Identification Guides SSI Program office-issued guidance, created in coordination with subject matter experts (SMEs), to help authorized redactors or other personnel identify SSI pursuant to § 1520.5(b).

Loss of SSI Designation Information loses its SSI designation when the TSA Administrator, or designee, determines in writing pursuant to § 1520.5(c) that the information once protected as SSI under § 1520.5(b) no longer is detrimental to transportation security.

Redaction (R) To obscure or prevent portions of a record containing SSI from being viewed and accessed.

Adobe® Acrobat® Professional is TSA’s standard software tool for electronic document redaction. Redaction of hard copy documents must follow the procedures described in Section 7(B) of TSA MD 2800.21, Document Redaction.

SSI Advanced Application Guide Guidance developed by the SSI Program office designed to assist in conducting an SSI Assessment to determine whether a record contains SSI, as well assist SSI Program Analysts conduct SSI Reviews.

SSI Assessment An evaluation of whether a record contains SSI.

SSI Review An evaluation of a record by the SSI Program office to identify and mark SSI within the record and cite the specific subsection(s) of 49 C.F.R. § 1520.5(b) that justifies the determination.

Visual Redaction (VR) The process of visually identifying SSI in a record, usually by means of highlighting or boxing-in the SSI. This process does not actually remove or obscure the data within the record, as with a redaction, but it allows for the accurate application of redactions to a document in the future.

Incidents

Password Incident When either (1) a password created to encrypt SSI is inappropriately shared with covered persons in a manner not in accordance with this TSA SSI P&P Handbook; or (2) the Standard TSA Password is shared inappropriately with persons not within DHS.

SSI Incident The verified or suspected loss, breach, or unauthorized disclosure of SSI to non-covered persons;

the unauthorized disclosure of SSI to covered persons who do not have a need to know the information; or the non-compliance with the TSA SSI Policies & Procedures Handbook in the handling of a record containing SSI.

Marking Applying the SSI protective marking (SSI header) and distribution limitation statement (SSI footer) to materials containing SSI in accordance with the SSI Regulation at § 1520.13. Some circumstances may require variations in marking as further detailed in Section 4.0 Marking SSI of this Handbook.

Need to Know Generally, a person or entity has a need to know SSI when access to the SSI is necessary to carry out transportation security activities or to perform official duties as defined in the SSI Regulation at §

1520.11. For specific SSI, the TSA Administrator, or designee, may make a finding that only specific persons or classes of persons have a need to know.

Protect Taking both required and reasonable steps, as defined in the SSI Regulation at § 1520.9 and this TSA SSI P&P Handbook, to safeguard a record containing SSI and prevent disclosure to non-covered persons or persons without a need to know.

Record Any means by which information is preserved, irrespective of format, including a book, paper, drawing, map, recording, tape, film, photograph, machine-readable material, and information stored in any electronic format. The term record, for the purposes of SSI protection, also includes any draft, proposed, or recommended change to any record.

Release Provide access to a record without expectation of continued protection. Note: This term is often seen used as if it is interchangeable with “disclose.” However, the two terms are distinct and the use must be evaluated carefully to ensure proper protection of SSI.

Sensitive Security Information As defined in the SSI Regulation at § 1520.5, SSI is information obtained or developed in the conduct of security activities, including research and development, the public disclosure4

4 Authorizing legislation for Sensitive Security Information (SSI) uses the term “disclosure” to describe the unauthorized release of SSI. Use of the term “disclosure” in this definition should not be confused with TSA’s use of disclose/disclosure in policy where it is used to describe authorized information sharing.

of which DHS/TSA has determined would, among other things, be detrimental to the security of transportation.

Share See Disclose.

SSI Impact Assessment (SSIIA) A document prepared by a program office or system owner (SO) in conjunction with the SSI Program office and the Information Technology’s (IT) Information Assurance and Cyber Security Division (IAD) to assess the security in place to protect SSI and resultant risk associated for an IT system. This document may also be used by other non-TSA systems or other secure sites not requiring Security Authorization (SA) to document alternate acceptable protection in lieu of standard SSI policies and procedures.

SSI System Any system that processes, stores, or transmits SSI information. A system's SSI status shall be reflected in its SSI Threshold Analysis (SSITA) document and is subject to DHS Directive 4300A, DHS Sensitive Systems Policy.

SSI Threshold Analysis (SSITA) A document prepared by a program office or system owner (SO) in conjunction with the SSI Program office and Information Technology’s (IT) Information Assurance and Cybersecurity Division (IAD) to determine if an IT system processes, transmits, or stores SSI. This document is produced as part of the

Security Authorization (SA) process. This document shall also be used for emerging and standing security programs and initiatives to determine whether it may be appropriate to develop an SSI Identification Guide for the program in coordination with the SSI Program office.

SSI Training SSI Awareness Training Training on SSI developed or endorsed by the SSI Program office to educate covered persons about the principles of identifying, marking, safeguarding, disclosing, and destroying SSI offered either through mandatory training for TSA Personnel or through customized training provided as needed.

Advanced SSI Training TSA training on SSI developed and provided by the SSI Program office that provides a higher-level of guidance on SSI identification. Completion of all specified advanced SSI training modules is required before an appointed SSI Coordinator or other federal personnel may take the SSI Certification Exam.

SSI Certification Exam An exam provided to federal personnel who have completed all required modules of Advanced SSI Training. Federal personnel who pass the exam achieve the status of “SSI Certified.”

CESSI

Continuing Education in SSI training. Certified SSI Coordinators and others who have passed the SSI Certification Exam must complete CESSI requirements annually to maintain SSI Certification.

SSI Certified Any person who has (1) completed the required modules of Advanced SSI Training, (2) passed the SSI Certification Exam, and (3) properly maintained their certification status by completing CESSI training on an annual basis (See also Certified SSI Coordinator).

Standard TSA Password A password generated by the SSI Program office which may be used by TSA personnel to encrypt SSI.

This password may be obtained through the designated SSI Coordinator or the SSI Password Finder App on Salesforce.

Subject Matter Expert (SME) A person who has expert-level knowledge and information about specific transportation security matters who can assist in determining whether specific program-related information is SSI.

TSA Personnel Persons permanently or temporarily assigned, attached, detailed to, employed by, or under contract with TSA (including interns and foreign nationals).

3.0 Identifying SSI

3.1 Creating SSI Identification Guidance

As the arbiter of what is SSI, the SSI Program office issues SSI Identification (ID) Guides on precisely what information is and is not SSI within a specific subject area and defines which subsections of the SSI Regulation apply. All SSI ID Guides are developed in collaboration with SMEs, updated periodically as information and programs change, and reviewed for accuracy on a 3-year cycle.

An SSI ID Guide is generally created after repeated requests to review or make SSI determinations on a particular subject matter. Certain new programs or agency efforts have SSI implications, that require the development of an SSI ID Guide at the outset of the program. Furthermore, the development or revision of a TSA Security Classification Guide (SCG) often prompts the creation of, or amendments to, a corresponding SSI ID Guide.

After a subject area is identified as appropriate for an SSI ID Guide, the SSI Program office works through the SSI Coordinator network to identify appropriate SMEs for the subject area. SMEs help identify what information about the program or subject matter should be protected as SSI. Note: In order to have accurate SSI ID Guides, full participation and prompt communication from the relevant program office SSI Coordinator(s) and designated SMEs are necessary. If offices are not responsive within 30 days of last contact, the SSI Program will continue to publish guidance to the best of its judgment.

The SSI Program office then determines if the information suggested for protection meets the standard for being “detrimental” to transportation security and falls within the scope of one or more of the 16 categories of the SSI Regulation. Information not covered in §§ 1520.5(b)(1) through (15) or in an existing (16) determination is considered for a new (16) determination.5

5 “(16) determination” refers to the authority provided by the regulation to designate any information not otherwise described in §§ 1520.5(b)(1) through (15) that TSA determines should be protected as SSI under 49 U.S.C. 114(r). A (16) determination creates a new category of SSI information.

See Appendix 1: SSI Program Initial Decision Flow Chart for additional information about how the SSI Program office conducts initial determinations on what may be protected as SSI under the SSI Regulation.

3.2 Using SSI Identification Guidance

SSI ID Guides are resources for personnel to recognize whether information requires protection as SSI.

The SSI ID Guides are designed for use both by persons with great familiarity with the SSI Regulation and SSI ID Guides and by persons with little familiarity with either.

All personnel are responsible for using SSI Program office-issued SSI ID Guides to recognize if the material they are handling may contain SSI. Note: To verify the content does not contain SSI before posting to the Internet or releasing to a non-covered person, see Subsections 3.3 Conducting SSI Assessments and 5.2.1 The Internet.

Personnel with questions about whether information is SSI should first determine whether a relevant SSI ID Guide exists and verify whether the information is or is not SSI. If the information does not appear to be SSI, personnel shall consult with their SSI Coordinator for verification through an SSI Assessment.

Personnel shall also refer to the SSI ID Guides to determine whether to mark and protect a record as SSI, when they are reviewing a record for SSI content, or when they have come into possession of a record https://ustsa.sharepoint.com/sites/offices/SitePages/sas/ssi-references-and-resources.aspx that they believe is not properly marked. Within the SSI Program office, SSI ID Guides assist in conducting SSI Assessments and SSI Reviews and serve as one authority for SSI determinations.

SSI ID Guides are intended for DHS-wide distribution. For consideration of sharing the SSI ID Guides beyond DHS, contact the SSI Program office directly at SSI@tsa.dhs.gov for a determination on a case-by-case basis.

3.3 Conducting SSI Assessments

An SSI Assessment is an evaluation of whether a record contains SSI. All TSA personnel should evaluate a record as it is being created to identify whether it contains SSI and ensure proper SSI markings are applied, if necessary. If there is uncertainty as to whether or not a record contains SSI, or an individual believes SSI markings should be removed, the record must undergo an official SSI Assessment. An official SSI Assessment of a record may only be completed by Certified SSI Coordinators or the SSI Program office. SSI Assessments must be completed using the appropriate SSI ID Guide(s) (see Subsection 3.2 Using SSI Identification Guidance for more information). If an SSI Coordinator cannot confidently complete an SSI Assessment or if there is insufficient current guidance available in an SSI ID Guide, the record must be submitted to the SSI Program for its assessment.

In no case should information be assessed as SSI to:

• Conceal a violation of law, inefficiency, or administrative error; or

• Prevent embarrassment to any person, organization, or agency.

If there is not enough information available in the SSI Regulation, the SSI Advanced Application Guide, and the SSI ID Guides to make a confident SSI Assessment, personnel shall contact the SSI Program office at SSI@tsa.dhs.gov for additional assistance and to provide recommendations for possible SSI ID Guide updates.

3.4 Conducting SSI Reviews

An SSI Review is an evaluation of a record to specifically identify and mark the SSI within the record.

Only TSA employees assigned to the SSI Program office may conduct final SSI Reviews.6

6 The SSI Regulation, at 49 CFR part 1520.9(a)(3), requires stakeholders to refer requests by other persons for SSI to TSA, or the applicable DHS component or agency. In order for SSI to be redacted from stakeholder records, submit these requests to the SSI Program for review and redaction by following instructions in Subsection 3.5, Requesting an SSI Assessment or SSI Review from the SSI Program.

A final SSI Review conducted by the SSI Program office is required before redactions of SSI may be applied by an Authorized Redactor.

The SSI Program office conducts a three-level review process to prevent the over-protection or improper release of SSI. If redactions are applied to the record, an independent reviewer conducts a quality assurance check for the security of the electronic redactions after the final review is completed.

Certified SSI Coordinators are authorized to conduct the first-level SSI Review for CESSI credit (See Subsection 8.0, SSI Training Programs, for more information on the CESSI Program) and must send their review findings to the SSI Program office for the second- and final-level reviews, and a quality assurance check.

Personnel conducting an SSI Review must abide by the following general principles:

mailto:SSI@tsa.dhs.gov https://ustsa.sharepoint.com/sites/offices/SitePages/sas/ssi-references-and-resources.aspx https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/SSI%20Advanced%20Application%20Guide.pdf mailto:SSI@tsa.dhs.gov

• Protect SSI on the merits of the particular information being reviewed, regardless of the requester of the information or the purpose of release.

• Release as much information publicly as possible without compromising transportation security.

The following factors must be considered:

- Operational Use to Adversaries: Would the information help them bypass or defeat transportation security measures or identify specific targets to plan or execute attacks?

- Level of Detail: More detailed information is generally more useful and more likely to be SSI.

- Public Availability: Has the Government released the information publicly in an official statement or document?

Note: Some partially-compromised (publicly or unofficially released) open source information may remain SSI because of its operational use to adversaries.

- Obviousness: Obvious or intuitive information is generally not protected as SSI unless its operational use to adversaries dictates otherwise.

- Age of the Record: This factor may be overridden by the SSI reviewer’s assessment of the current security implications (e.g., superseded, inactive screening procedures may still be SSI if they match or reflect current procedures) or potential future use of historical procedures.

• Redact the smallest possible portion of the record (word, phrase, or sentence) necessary to protect SSI, unless the entire document, page, or paragraph is SSI. Do not simply redact entire documents, pages, or paragraphs unless it is necessary (1) to prevent an inference of the redacted information, or (2) to prevent a cumulative SSI effect where the non-redacted portions of a document, when read in total, legitimately constitute SSI.

• Strive for consistency in SSI redactions (e.g., if information was redacted or released in a record previously reviewed for SSI, that information should be similarly or identically redacted or released in a record being currently reviewed, unless changes in SSI identification guidance, security measures, technology, or other factors make it necessary to redact the record differently).

• Protect SSI even when it is contained within a record not properly marked as SSI.

• Release in full (RIF) a record marked as SSI if it contains no SSI, unless other information protections (e.g., Privacy Act information) apply. Note: The SSI Program does not review a record for any other sensitive information except SSI.

In no case should information be identified as SSI to:

• Conceal a violation of law, inefficiency, or administrative error; or

• Prevent embarrassment to any person, organization, or agency.

See Appendix 1: SSI Program Initial Decision Flow Chart for additional information on how the SSI Program office conducts initial determinations on what may be protected under the SSI Regulation.

3.5 Requesting an SSI Assessment or SSI Review from the SSI Program Personnel shall use the following guidance to request the SSI Program office conduct an SSI Assessment or an SSI Review of material:

• Submit the SSI Review Request through the SSI App on Salesforce.

IMPORTANT: Do not include Classified National Security Information (CNSI) in the request (e.g., do not include titles containing classified information)!

• Requests for assessment or review of audio material over 15-minutes in length must be transcribed prior to submission to the SSI Program.

Follow Job Aid: SSI Review Submissions in SSI App to accurately submit a request to include contact information, intended use of the document, and justification for any requests for expedited review, if needed prior to the standard 10-day (i.e., 10 business days) processing time.

3.6 Requesting an SSI Review of Classified Material from the SSI Program Personnel shall use the following guidance to submit requests for the SSI Program office to review classified material7

7 Requester acknowledges that an SSI review of classified material is not a declassification review and SSI may or may not overlap with classified information. If a declassification occurs after the SSI review, SSI may still remain in the document; therefore, the requester is encouraged to undertake a declassification review of the material before submitting it to the SSI Program office for SSI Review.

for the presence of SSI (See also Subsection 3.5, Requesting an SSI Assessment or SSI Review from the SSI Program). This type of review typically occurs when the classified material is being considered for declassification; it may also occur to ensure appropriate marking within the classified document.

The requester must prepare the material to be reviewed as follows:

• Ensure the classified material is properly marked;

• Provide two (2) paper copies for an assessment or four (4) paper copies for an SSI Review of the material being requested for review; put the copies into a folder; and attach the appropriate classified cover sheet to the folder.

• If more than one document is being requested for review, clearly write at the top of the file the document number (e.g., Document 1) for tracking purposes.

- For Confidential and Secret material: Hand-deliver the copies to the SSI Program.

WARNING: Follow all required CNSI handling requirements. Do NOT leave the folder on a desk. You must coordinate a secure hand-off with an SSI Program analyst.

- For Top Secret material: Contact the SSI Program office for an alternate process;

Alternately, to provide an electronic record for review, contact the SSI Program for assistance.

The SSI Program office begins processing the request once the requestor follows the SSI Review submission process in Salesforce. Follow the SSI Review Submissions in SSI App Job Aid to accurately submit a request to include contact information, intended use of the document, and justification for any requests for expedited review, if needed prior to the standard 10-day (i.e., 10 business days) processing time. Note: For classified reviews, include an unclassified name for the review and upload a blank place-holder file indicating the document number for each document. For FOIA requests, include the FOIA request number.

https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/SSI%20Review%20Submissions%20in%20SSI%20App.pdf https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/SSI%20Review%20Submissions%20in%20SSI%20App.pdf

After review, the SSI Program office analyst provides the Visual Redaction (VR) or Redaction (R) and arranges a time for pick-up with the requester.

3.7 Identifying Maritime SSI

For issues related to maritime SSI, contact the SSI Program office at SSI@tsa.dhs.gov. The SSI Program office consults with the United States Coast Guard (USCG) SSI Program Manager for resolution of the issue and notifies the requester of the result of discussions with the USCG SSI Program Manager.

Requests for foreign disclosure of maritime-related SSI must be coordinated through the SSI Program office for ultimate approval by the USCG SSI Program Manager.

3.8 SSI Challenge and Appeals Process

Any authorized recipient of SSI who believes the information has been improperly or erroneously marked as either SSI or not SSI (hereafter referred to as “challenger”) is encouraged to challenge the marking. An appeal to the decision made by the recipient of the challenge may be filed with the TSA SSI Program office. Challenges may be made either informally or formally.8

8 DHS MD 11056.1, Sensitive Security Information, VI.F Challenging SSI.

Any decision to remove an SSI marking must be coordinated with the office which either applied the SSI marking or is programmatically responsible for the information (hereafter referred to as “information holder or owner”) and/or the SSI Program office before the information may no longer be protected as SSI. All information under challenge or appeal will be protected as SSI until the process is complete.

3.8.1 SSI Challenge and Informal Appeals Process

Most questions regarding the appropriate marking for the information in question may be resolved through a challenge or informal appeal process. If a requestor has a question seeking clarification that does not rise to a difference of opinion or a need to change a marking on a file, the question may be answered and noted within the comments section of the review.

• Challenges may be made directly by the challenger to the information holder or owner, who must then reevaluate the marking against the criteria in the SSI Regulation, at § 1520.5(b)(1) through (15) and implementing guidance published or approved by the SSI Program Chief available on .9

9 When uncertain whether information constitutes SSI, handle it as if it does and password-protect the attachment.

Offices are encouraged to include their SSI Coordinator in the discussion, if in need of assistance.

• Challenges may also be resolved by submitting the document in question to the SSI Program office for SSI Assessment or Review using the process documented in Subsection 3.5, Requesting an SSI Assessment or SSI Review from the SSI Program.

• The information holder or owner may request formal resolution, requiring the challenger to submit written justifications for change in marking using the process for formal appeals detailed in Subsection 3.8.2, Formal SSI Appeals Process.

• An informal appeal of SSI Program markings must be made directly to the SSI Program office (SSI@tsa.dhs.gov).

mailto:SSI@dhs.gov

• Individuals submitting a challenge or appeal must not be subject to retribution for bringing such actions. Anonymity may be requested from any of the reviewers, and the reviewers must honor a challenger’s request for anonymity and fully consider and appropriately process the challenge.

3.8.2 Formal SSI Appeals Process

Formal SSI Appeals to an SSI determination may be made to the SSI Program. The following process outlines the steps an individual must take to initiate a formal appeal:

• Individuals shall submit formal SSI Appeals through the SSI App on Salesforce following the instructions found in the Submitting SSI Appeals Job Aid. For personnel submitting appeals from outside of TSA, they may submit the appeal in writing to the SSI Program office (SSI@tsa.dhs.gov). Formal appeal submissions should contain the word “Appeal” and the official review number in the subject line. For personnel submitting through Salesforce, these steps will be completed automatically as the individual follows the appeal instructions.

• Attached to the appeal submission, the challenger must include a Formal Appeal Justification as a reference file, identifying the specific information at issue and the justification or rationale for the protection or release of that information. Rationales must be based upon the criteria in the SSI Regulation, at § 1520.5(b) implementing guidance published or approved by the SSI Program Chief available on SharePoint. The challenger may include documentation that speak to issues relevant to challenged information (i.e., reports indicating the sensitivity of the matter or level of public availability of the information).

• A senior SSI Program analyst (i.e. with final review authority) will review the appeal documentation and solicit any necessary clarification or supporting documentation from the challenger within five (5) business days of initial receipt. The SSI Program will then provide the information holder or owner with a copy of the appeal documents.

• The information holder or owner must provide the SSI Program with a response denoting the justification or rationale for the protection or release of that information. Rationales must be based upon the criteria in the SSI Regulation, at § 1520.5(b)(1) through (15) or in the (16) determination, implementing guidance published or approved by the SSI Program Chief available on SharePoint. The challenger may include documentation that speaks to issues relevant to challenged information (i.e., reports indicating the sensitivity of the matter or level of public availability of the information). The response must be sent to the SSI Program within five (5) business days of receipt of the appeal documents.

• After receipt of the information holder or owner’s response the SSI Program may solicit additional responses or comment from the parties. The SSI Program may provide preliminary opinions and attempt to obtain concurrence from all parties before issuing a final determination.

• The SSI Program Chief will evaluate the information gathered through the formal appeals process, including the rationale and justification provided, and will provide the final decision to both parties within five (5) business days after receipt of the information holder or owner’s appeal response.

• Formal appeals originating outside of TSA should be submitted to the respective DHS component SSI Program Manager (hereafter referred to as “component manager”). Formal appeals of component managers’ decisions, including intra-component challenges, are made to the TSA SSI Program as detailed herein.

https://ustsa.sharepoint.com/sites/offices/Shared%20Documents/sas-ssi/Submitting%20SSI%20Appeals.pdf?isSPOFile=1&OR=Teams-HL&CT=1707504604554&clickparams=eyJBcHBOYW1lIjoiVGVhbXMtRGVza3RvcCIsIkFwcFZlcnNpb24iOiIyNy8yMzExMzAyNjIwMiIsIkhhc0ZlZGVyYXRlZFVzZXIiOmZhbHNlfQ%3D%3D%22 mailto:SSI@tsa.dhs.gov https://ustsa.sharepoint.com/sites/offices/SitePages/sas/ssi-references-and-resources.aspx

• Formal appeal of the SSI Program Chief decisions may be appealed to the TSA Administrator.

• The final decision of the TSA Administrator is exclusively reviewable by a United States Court of Appeals pursuant to 49 U.S.C. § 46110. (The D.C. Circuit or the Circuit in which a person resides).

3.8.3 Formal SSI Appeals Schedule

The following table provides a target schedule for handling appeals in order to address formal appeals in a timely manner. Challengers, information owners and the SSI Program shall strive to meet the following schedule when responding to SSI formal appeals.

FORMAL APPEALS PROCESS AND SCHEDULE

Day Action

Zero SSI Office Receives Appeal Document

1 - 5 SSI Program may solicit additional information or clarifications from requestor.

5 Appeal Documents Provided To Information Holder Or Owner

6-10 SSI Program may solicit additional information or clarification from information holder or owner.

10 Holder or Owner Delivers Appeal Response to the SSI Program

11-15 SSI Program will consolidate commentary, provide initial determination to both parties, attempt to obtain concurrence on initial determination, and/or solicit additional input from both parties.

15 SSI Program Provides Formal Appeal Decision To Both Parties

3.8.4 Final SSI Appeals

A further appeal of the decision made by the SSI Program Chief may be made to the TSA Administrator through the Executive Secretariat process. The SSI Program Chief will submit to the Administrator the documentation developed during the Formal Appeal and any additional documentation developed by the SSI Program or submitted by the requestor. The decision of the TSA Administrator constitutes final agency action and is exclusively reviewable by a United States Court of Appeals10

10 The D.C. Circuit or the Circuit in which the appellant resides.

pursuant to 49 U.S.C. § 46110.

4.0 Marking SSI

The creator of the record as well as any authorized holder of the information is responsible for appropriately marking SSI. Personnel who receive a record containing SSI that is not properly marked must apply the SSI header and footer, and inform the creator and/or sender that the header and footer were missing. If unable to determine the creator/sender, personnel should contact their SSI Coordinator for assistance. Personnel disclosing SSI to covered persons who have a need to know must verify that the records containing SSI have the appropriate header and footer.

If a document is marked as SSI and has been assessed by a certified SSI Coordinator or the SSI Program to have been incorrectly marked as SSI, the header and footer may be removed or struck through.

Struck-through SSI markings indicates the document does not contain SSI.

TSA encourages personnel handling SSI, both in paper and electronic form, to use the SSI Cover Sheet (DHS Form 11054) in addition to the header and footer required by the SSI Regulation as detailed below (See also Subsection 4.1, Marking Records & Media Containing SSI).11

11 See also DHS MD 11056.1 for instruction on marking SSI for delivery to Congress.

This language is mandated by the SSI Regulation and may not be changed.

Header: SENSITIVE SECURITY INFORMATION Footer: WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know”, as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation.

Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 U.S.C. 552 and 49 CFR parts 15 and 1520.

Subjects, titles, paragraphs, charts, and similar portions need not be portion marked unless (1) the record contains other types of information that requires portion marking, e.g., classified information or other sensitive information; or (2) the information is to be transmitted outside of DHS to Congress.

All SSI records submitted by TSA/DHS to Congress must be portion-marked. Portion markings must be reviewed by the SSI Program prior to dissemination. The parenthetical abbreviation (SSI) shall be used.

Personnel shall abide by the following when marking SSI contained in classified records:

• The SSI marking is conveyed in the portion mark.

• The SSI information must be identified in the source reference citations as endnotes keyed to the relevant SSI information in the document.

• If the document does not include source reference citations, the SSI portions must be segregated from all non-SSI portions.

• Apply SSI portion markings as (U//SSI) next to each paragraph/picture/area pertaining to SSI;

• Instead of the SSI header, add “SSI” to the end of the classification banner at the top and bottom of the page; and

• Apply the SSI footer to the bottom of the front page above the overall classification marking.

In no case should information be marked as SSI to:

• Conceal a violation of law, inefficiency, or administrative error; or

• Prevent embarrassment to any person, organization, or agency.

4.1 Marking Records & Media Containing SSI

SSI markings shall be applied to different types of records and media as defined below. Personnel are also encouraged to use the SSI Cover Sheet (DHS Form 11054) on all documents and binders or folders containing SSI records. See also Marking Templates and Appendix 3: Instructions for Watermarking Files.

Table 1: SSI Marking Guidance for Records & Media Type of Record Marking

Emails

Encrypted emails containing SSI in the body of the email must be marked with the SSI header and footer; alternately, an email may begin with the marking (SSI) at the top or use tagging options, if available.

Attachments containing SSI must comply with SSI marking guidance and encryption requirements (See also Subsection 5.3.4, Methods for Applying Encryption to SSI for encryption requirements in email).

Documents (e.g., Word, PDF) Use header and footer on every page and on any covers.

Forms

Forms which are SSI must comply with the SSI marking guidance for “Documents.” As appropriate, a disclaimer may also be added during form creation underneath the header that states “When filled out, this record contains SSI” or “When filled out, this record may contain SSI.”

Presentations (e.g., PowerPoint)

Use both header and footer on first and last slides; use header only on all other slides (See Subsection 4.2, SSI in Presentations and Briefings).

Spreadsheets (e.g., Excel) Use header and footer (or image of footer) on every page.

Databases (e.g., Access) Output reports for databases producing SSI material must comply with the SSI marking guidance for “Documents.”

Messaging Systems (e.g., Teams)

Portion mark SSI sent in messaging systems with (SSI) at the start of the SSI text; attachments containing SSI sent through chat must comply with the SSI marking guidance for that record type.

Charts, Maps, and Images Place the header and footer wherever they can be readily seen.

Video and Audio Recordings If practical, record protection requirements audibly (See Subsection 4.2, SSI in Presentations and Briefings) and/or show header and footer visually at the beginning and end of the recording.

CDs, DVDs, and Other Media Apply header on media using labels or a permanent marker; apply header and footer on outside case, jacket, or sleeve.

Mobile Electronic Media (e.g., USB Flash Drives)

No external marking, but…