Attachment 4 - 825.7G Information Security Program.pdf

ORIGINATING OFFICE

Security Services

EFFECTIVE DATE

January 10, 2025

GPO Directive 825.7G January 10, 2025

Information Security Program

1. Purpose. To state and establish the policy governing the protection of Classified National

Security Information, and other sensitive information.

2. Scope. This Directive applies to all GPO employees, contractors, tenants, and visitors.

3. Cancellation. This Directive supersedes GPO Directive 825.7F, Subject: Information

Security Program, dated June 5, 2019.

4. References.

a. Department of Defense (DoD) Manual 5200.01, Information Security Program, Vol 1, 2, 3, 4;

b. DoD Manual 5200.02, Personnel Security Program;

c. Executive Order (E.O.) No. 12958, Classified National Security Information;

d. Presidential Memorandum for the Heads of Executive Departments and Agencies, Designation and Sharing of Controlled Unclassified Information (CUI); and

e. The DoD/GPO Security Agreement of February 20, 1981.

5. Background. The goal of the Information Security Program is to protect classified and sensitive information efficiently and effectively by encouraging and advocating the use of risk management principles; focusing on identifying and protecting only information that requires protection; integrating security procedures into GPO’s business processes so they become transparent; and ensuring everyone understands their security roles and responsibilities.

6. Definitions.

a. Access. The ability and opportunity to obtain knowledge of classified or sensitive information.

b. Classified National Security Information (Or “Classified Information”). Information that has been determined pursuant to E.O. No. 12958 or any predecessor order to require protection against unauthorized disclosure and is marked to indicate its classified status when in documentary form.

c. Controlled Unclassified Information (CUI). In addition to classified information, certain types of unclassified information also require application of access and distribution controls for a variety of reasons. CUI does not meet the standards for classification under E.O. No. 12958 but is pertinent to the national security interests of the United

States. Under law or policy, CUI requires protection from unauthorized disclosure, using special handling safeguards or prescribed limits on dissemination. CUI markings may

825.7G

01/10/2025 inform, but do not control the decision of whether to disclose or release the information to the public, such as in response to a request made pursuant to the Freedom of

Information Act (FOIA). NOTE: Sensitive but Unclassified, an older designation is still in use, as well as other designations preferred by specific agencies. The National Archives and Records Administration (NARA) is in the process of setting one common standard for all government agencies. If a document is received that has markings that appear to require additional protection, please contact Security Services.

d. Communications Security (COMSEC). The protection resulting from all measures designed to deny unauthorized persons information of value that might be derived from the possession and study of telecommunications and to ensure the authenticity of such communications. COMSEC includes cryptosecurity, emission security, transmission security, and physical security of COMSEC material and information.

Within GPO, COMSEC, due to its specialized nature, is handled by a dedicated person within IT Security, and is governed by directives of IT Security.

e. Compromise. An unauthorized disclosure of classified information.

f. Damage to the National Security. Harm to the national defense or foreign relations of the

United States from the unauthorized disclosure of information.

g. Controlled Unclassified Information (CUI)/Law Enforcement Sensitive (LES). This document is provided for law enforcement officers, security personnel, antiterrorism officers, and intelligence personnel for their information and use. Further dissemination should be limited to a minimum, consistent with the purpose of supporting effective law enforcement and security of installation personnel, equipment, and facilities. This document shall not be furnished to the media or agency personnel outside of law enforcement.

h. Information. Any knowledge which can be communicated or documentary material, regardless of its physical form or characteristics, that is owned by, produced by or for, or is under the control of the United States Government. “Control” means the authority of the agency which originates information, or its successor in function, to regulate access to the information.

i. Information Security. The system of policies, procedures, and requirements established under the authority of E.O. No. 12958 to protect information that, if subjected to unauthorized disclosure, could reasonably be expected to cause damage to the national security. The term also applies to policies, procedures and requirements established to protect controlled unclassified information (CUI), which may be withheld from release to the public in accordance with statue, regulation, or policy.

j. Information Technology (IT). An assembly of computer hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information.

k. Infraction. Any knowing, willful, or negligent action contrary to the requirements of E.O.

No. 12958 or its implementing directives, including this Directive that does not comprise a “violation,” as defined in paragraph 6.s. below.

l. Integrity. The state that exists when information is unchanged from its source and has not been accidentally or intentionally modified, altered, or destroyed. Integrity in the

Information Assurance (IA) environment addresses the logical correctness, completeness, and reliability of the operating system, and the system hardware, software and data. In a formal security mode, integrity is interpreted more narrowly to mean protection against unauthorized modification or destruction of data or information.

Although IA is under the purview of IT Security, each person must ensure they are using

IT resources in a manner to ensure integrity of classified information.

m. Material. Any product or substance on or in which information is embodied.

n. Need-To-Know. A determination made by an authorized holder of classified information that a prospective recipient requires access to specific classified information to perform or assist in a lawful and authorized governmental function.

o. Original Classification. An initial determination that information requires, in the interest of national security, protection against unauthorized disclosure.

p. Original Classification Authority (OCA). An individual authorized in writing, either by the

President, Agency Heads, or other officials designated by the President, to originally classify information.

q. Security Clearance. A determination that a person is eligible under the standards of DoD

5200.2-R for access to classified information.

r. Unauthorized Disclosure. A communication or physical transfer of classified information to an unauthorized recipient.

s. Violation.

(1) Any knowing, willful, or negligent action that could reasonably be expected to result in an unauthorized disclosure of classified information; or

(2) Any knowing, willful, or negligent action to classify or continue the classification of information contrary to the requirements of E.O. No. 12958, or its implementing directives; and

(3) Any knowing, willful, or negligent action to create or continue a special access program contrary to the requirements of E.O. No. 12958, or any subsequent amendments.

t. Other definitions not addressed herein may be located within DoD 5200.1-Vol 1, 2, 3, 4, or any subsequent amendments.

7. Procedures. As provided by the original classification authority and DoD 5200.1-Vol 1, 2, 3, 4 or any subsequent amendments, GPO will follow the appropriate instructions to identify, protect, print, destroy, declassify, or mark classified information and material. Protecting information is critical to GPO’s mission accomplishment.

a. On receipt of any classified information, whether a printing job or for other GPO purposes, GPO Physical Security Branch (PSB) must be notified.

b. PSB does not need to know the contents of the information unless they have a need to know. However, PSB needs to know the classification level, where it will be stored, the anticipated date it will no longer be needed at GPO, and whether or not it will be returned to whomever sent it or destroyed.

c. Upon the publication of this Directive, all business units must comply with the Directive and must advise PSB if they possess classified information.

8. Program Management. The strength of the Information Security Program is in its infrastructure. The infrastructure is important because it facilitates effective communication of our security policies and procedures to those performing GPO’s mission. With the support of supervisors at all levels, this is accomplished predominantly through the PSB, which plays an integral role in ensuring personnel know and understand their role in protecting classified information against unauthorized disclosure.

The GPO Information Security Program will be administered pursuant to the DoD/GPO

Security Agreement dated February 20, 1981, and in accordance with DoD Manual 5200.01

Vol 1, 2, 3, 4, and this Directive.

9. Program Reviews (PR). A PR is a security review to ensure all business units (BUs) that receive, store, or work with classified information do so pursuant to this Directive. The PSB will conduct PRs on an annual basis. EXCEPTION: An extension to 18 months may be granted by the Chief Security Officer (CSO), for BUs that have demonstrated highly effective, discrepancy free programs during the previous PR.

10. Security Declassification Guides. A security declassification guide is the written record of an original classification decision and appropriate declassification instructions and should be issued as early as practical in the life cycle of the classified system, plan, program, or project. NOTE: GPO will not normally exercise declassification authority.

11. Marking. GPO personnel will not derivatively classify information concerning printing jobs.

In the rare event, it is necessary to derivatively classify documents not received as part of a printing job, the person possessing the document must contact PSB for instructions.

Material other than ordinary paper documents, e.g., email transmitted over a secure network, must have the same information either marked on it or made immediately available to holders by other means.

a. Required Markings. Classified documents are required to have the following markings:

(1) The overall classification of the document.

(2) The agency, office of origin, and date of the document.

(3) The office or source document that classified the information.

b. CUI falls within the following safeguarding procedures and dissemination controls (when warranted for secure product) and indicated by the following corresponding marking:

“Controlled Enhanced with Specified Dissemination.” The information requires safeguarding measures more stringent than those normally required since the inadvertent or unauthorized disclosure would create risk of substantial harm. Material contains additional instructions on what dissemination is permitted. Note: Secure within a locked desk, file cabinet, or security container. Only disseminate to specified Federal

Government agencies/personnel.

c. Recipients of CUI that is marked incorrectly will immediately inform the originator.

12. Working Papers. Working papers are documents and material accumulated or created in the preparation of finished documents and material. Working papers containing classified information will be:

a. Dated when created.

b. Marked with the highest classification of any information contained in the document and annotated “WORKING PAPER.”

c. Destroyed when no longer needed.

d. Protected in accordance with the assigned classification.

e. Marked in the same manner as a finished document at the same classification level when transmitted outside the facility, or if retained for more than 180 days from the original creation date.

13. Marking Special Types of Materials. When classified information is contained in IT media, audiovisual media, hardware and equipment, or other media not commonly thought of as documents, the provisions of paragraph 12 above must be met in a way that is appropriate to the type of material. The main concern is that holders and users of the material are clearly warned of the presence of classified information needing protection. The information provided by other markings required by this section must also be made available, either on the item or in documentation that accompanies it, or in properly marked containers.

Standard Form (SF) Labels. If not marked otherwise, IT storage media and other items covered by this section must be marked with the following labels:

a. SF 706 – TOP SECRET

b. SF 707 – SECRET

c. SF 708 – CONFIDENTIAL

14. Safeguarding. GPO employees are responsible, both personally and officially, for safeguarding classified information for which they have access. Collecting, obtaining, recording, or removing, for any unauthorized use whatsoever, of any CUI or classified information, is strictly prohibited.

15. Standards for Storage Equipment. General Services Administration (GSA)-approved security containers must have a label stating “General Services Administration Approved

Security Container” affixed to the front of the container, usually on the control or top drawer.

If the label is missing or if the container’s integrity is in question, the container will not be used to store classified material until it is inspected by a GSA-certified inspector.

16. Storage of Classified Information. BU directors must ensure all combination locks on

GSA-approved security containers and doors meet Federal Specification FF-L-2740.

a. Due to operational necessity or the size and nature of some classified materials, it may be necessary to construct secure rooms for storage because GSA-approved containers or vaults are unsuitable or impractical. Secure rooms must be approved by Security

Services and be constructed in accordance with DoD 5200.1 Vol 3, Appendix to

Enclosure 3. Access to secure rooms must be controlled to preclude unauthorized access. Access will be limited to authorized persons who have an appropriate security clearance and a need-to-know for the classified material/information within the area.

Individuals without the appropriate level of clearance and/or need-to-know will not be authorized access. The nature of the classified material typically stored within a secure room or vault may preclude the use of cover sheets. NOTE: BU managing directors must provide PSB with an approved Entry Authority List for Secure Rooms at least annually.

b. Storage areas for bulky material containing Secret or Confidential information may have access openings secured by GSA-approved changeable combination padlocks (Federal

Specification FF-P-110 series).

PSB will recertify all Secure Rooms on an annual basis.

c. In the event of an emergency, ensure all classified information is properly stored, time permitting. Never endanger lives; remember life over property.

17. Equipment Designations and Combinations. Use SF 700, Security Container

Information, for each vault, secure room, door, and security container, to record the location of the door or container, and the names, home addresses, and home telephone numbers of the individuals who are to be contacted if the door or container is found open and unattended. Applying classification marking to SF 700, Part 1, is not required when separated from Parts 2 and 2a.

a. Affix Part 1 of the form to the vault or secure door or to the inside of the locking drawer of the security container. Post SF 700 to each individual locking drawer of a security container with more than one locking drawer if they have different access requirements.

b. The SF 700 contains Privacy Act information and must be safeguarded from casual view, but anyone who finds the facility unsecured must be readily identifiable.

c. When SF 700, Part 2, is used to record a security container combination, it must be:

(1) Marked with the highest classification level of material stored in the security container; and,

(2) Stored in a security container other than the one for which it is being used at PSB container.

18. Removal of Classified Storage Equipment. Storage containers which may have been used to store classified information will be inspected by properly cleared personnel before removal from protected areas or unauthorized persons are allowed access to them. The inspection should ensure no classified information remains within the equipment.

19. Repair of Damaged Security Containers. Locksmiths or technicians must be GSA certified and either have a favorable National Agency Check or must be continuously escorted while they are repairing security containers.

20. Granting Access to Classified Information. Personnel who have authorized possession, knowledge, or control of classified information grant individuals access to classified information when required for mission essential needs and when the individual has the appropriate clearance eligibility according to GPO Directive 825.2D, Subject: Personnel

Security Directive, dated December 7, 2020, or its supersedure, and DoD Manual 5200.02, Personnel Security Program; has signed an SF 312, Classified Information Nondisclosure

Agreement (NDA); and has a need to know the information.

No person may have access to classified information unless that person has been determined to be trustworthy and access is essential to the accomplishment of a lawful and authorized Government purpose.

21. Care During Work Hours. Classified material removed from storage will be kept under constant surveillance of authorized personnel. Classified document cover sheets (SF ’s 703-

TS, 704-S, and 705-C) will be placed on classified documents not in secure storage.

a. Use the SF 702, Security Container Check Sheet, to record each opening and closing for all GSA-approved security containers, vaults, and approved secure storage rooms.

b. Classified work will be completed free of disruption and contamination by unclassified work. A clean desk is mandatory; this will prevent inadvertent mixing of documents, thereby causing a security incident.

c. Classified information/material will never be left unattended when not located in a designated “Open Storage” Secure Room.

22. End-of-Day Security Checks. Each BU which processes or stores classified information will conduct an end-of-day security check to ensure classified material is stored appropriately. Personnel conducting these checks will do so at the close of each working day and record them on the SF 701, Security Activity Checklist, when security containers are present, even if the container was not opened that day. In addition, SF 701 and 702 will be annotated to reflect after-hours, weekend, and holiday activity. SF 701 and 702 will be maintained for a period of three (3) months after use. NOTE: Authorized Secure Rooms will be checked after hours on a daily basis by Security Services personnel; checks will be annotated on the SF 702.

a. Activities which are continuously staffed will establish local procedures to provide for daily security checks. Those daily security checks will be documented on the SF 701.

b. All security containers will be listed on the SF 701 for end-of-day security checks.

23. Classified Meetings and Conferences. Classified information at meetings and conferences, or portions or sessions of meetings, conferences, etc., during which classified information is to be disseminated will be limited to appropriately cleared rooms and personnel.

24. Information Processing Equipment.

a. Machines with Copying Capability. For copiers and facsimile machines or any machines with copying capability (i.e., BU copying machines), employees must consult with

Information Technology and Security (IT&S) personnel to determine if the machines are authorized for copying classified documents; and if so, determine if they retain any latent images when copying classified documents and how to clear them when they do. In addition, equipment used for classified processing will be designated as such in writing by IT&S. Contact IT&S for guidance to clear latent images when copying classified documents.

b. Protect information system equipment or removable hard disk drives and the information system media and store according to the highest security classification processed by the system.

c. Classified telephone conversations will be discussed over secure communications circuits approved for transmission of information at the specific level of classification.

When discussing classified information on the telephone, the ability of others in the area to overhear what is being said must be considered.

25. Reproduction of Classified Information. Classified information will only be reproduced to the extent required by operational needs.

It must be derivatively marked and derivatively marked documents must be destroyed after they are no longer needed. If they are needed past a single use, they must be stored based on their classified level.

26. Classified Print Jobs. Classified print jobs are procured, and PSB must be notified immediately. PSB will follow the necessary protocols to ensure all material is properly maintained.

27. Disposition and Destruction of Classified Information. No shredders purchased from an approved product list which produce a crosscut shred size of ½” x 1/32” or smaller, may continue to be used for destruction of collateral information after October 1, 2008.

Replacement shredders for destruction of classified information must be purchased from the

National Security Agency (NSA)-approved Equipment Product List. Obtain information on approved destruction devices from the NSA Information Assurance website which is located at (http://www.nsa.gov/ia/government/mdg.cfm). This list is For Official Use Only (FOUO) and is updated quarterly on the restricted NSA site. Classified media destruction will take place in accordance with DoD requirements. Questions concerning classified information should be addressed to psbinfosec@gpo.gov.

28. Transportation of Classified Information. Classified information will be transported by verified, properly cleared personnel in accordance with DoD 5200.1 Vol 3, Enclosure 4, (Information) Change 2.

a. Classified information will be properly wrapped as noted in this Directive, or as stated in paragraph 29 (Wrapping Classified Information) below.

b. Couriers will maintain possession of Courier Letters which authorize the transport for its duration.

29. Wrapping Classified Information. Classified information will be wrapped as follows:

a. Use appropriate cover sheet.

b. Prepare GPO classified document receipt.

mailto:psbinfosec@gpo.gov

c. Place covered document in opaque envelope (inner envelope).

(1) Use reinforced tape in a manner to divulge tampering; and

(2) Stamp appropriate classification markings (front and back).

d. Place envelope into another opaque envelope (outer envelope).

(1) Use reinforced tape in a manner to divulge tampering; and

(2) Use no classification markings.

30. Mailing Classified Information. When mailing classified information, use the above instructions for wrapping.

a. Place return and mailing address on outer envelope (do not use personal names).

b. Top Secret information will not be mailed.

31. Security Awareness Training and Education (SATE). Effective SATE is a cornerstone of the Information Security Program. All GPO employees need SATE whether they have access to classified information or not. All GPO employees are individually responsible for protecting the national interests of the United States. All security infractions and/or violations must be immediately reported, circumstances examined and those responsible held accountable, and appropriate corrective action taken. BU Directors are responsible for ensuring personnel are knowledgeable and understand their responsibility to protect information and resources deemed vital to national security.

a. Security Services will provide SATE to employees, tenants, and contractors, on a continuous basis. Various training methods will be used to administer training, such as classroom instruction, one-on-one, and computer based. Security Services will maintain a cadre of trained professional career security personnel to administer, implement, and measure the program’s effectiveness.

(1) All GPO employees who are cleared for access to classified information must be provided an initial orientation to the Information Security Program before being allowed access to classified information. This initial orientation is intended to produce a basic understanding of the nature of classified information and the importance of its protection to the national security, inform employees of their responsibility to play a role in the security program, and provide them enough information to ensure proper protection of classified information in their possession.

(2) Uncleared employees must be provided with a brief explanation of the nature and importance of classified information and actions they should take if they discover classified information unsecured, note an apparent security vulnerability, or believe they are contacted by an intelligence collector.

b. SATE must be ongoing rather than a periodic influence on individual security performance. Periodic briefings, training sessions, and other formal presentations will be supplemented with other information and promotional efforts to ensure maintenance of continuous awareness and performance quality.

c. As a minimum, employees will receive annual refresher training which reinforces the policies, principles, and procedures covered in initial and specialized training. Refresher training will also address the threat and the techniques employed by foreign intelligence activities attempting to obtain classified and CUI and advise personnel of penalties for engaging in espionage activities. NOTE: PSB will provide annual refresher training on classified and CUI.

d. Termination briefings will be provided to all cleared employees who retire or leave GPO.

The briefing will emphasize their continued responsibility to:

(1) Protect classified information to which they had access;

(2) Provide instructions for reporting any unauthorized attempt to gain access to such information;

(3) Advise employees of the prohibition against retaining material when leaving the organization; and

(4) Remind them of the potential civil and criminal penalties for failure to fulfill their continuing security responsibilities.

32. Actual or Potential Compromise of Classified Information. The compromise of classified information can present a threat to the national security. Once a compromise is known to have occurred, the seriousness of damage to U.S. interests must be determined and appropriate measures taken to negate or minimize the adverse effect of such compromise. When possible, action also should be taken to regain custody of documents or materials which were compromised. In all cases, appropriate action must be taken to identify the source and reason for the actual or potential compromise and remedial action to be taken to prevent recurrence. In addition, all such incidents must be reported to the Chief

Security Officer, Security Services, immediately upon discovery.

a. Security incidents pertain to any security violation or infraction as defined in E.O. No.

12958, as amended. Security incidents may be categorized as:

(1) Security Violation. Any knowing, willful, or negligent action which could reasonably be expected to result in an unauthorized disclosure of classified information.

(2) Security Infraction. Any knowing, willful, or negligent action contrary to the requirements of E.O. No. 12958, as amended that is not a security violation.

b. A compromise of classified information occurs when unauthorized individuals gain access to classified information. Unauthorized individuals include those individuals with the appropriate security clearance, but do not have a valid need-to-know.

c. A potential compromise of classified information is when an investigating official concludes that a compromise of classified information has more than likely occurred as a result of a security incident.

33. Reporting and Notifications. Personnel who learn of a security incident must immediately report it to their supervisor, who will in-turn report the incident to the CSO, immediately.

After assigning a case number beginning with calendar year, and sequential number for tracking purposes, the PSB will coordinate with the BU to ensure the CSO has been briefed on the incident. The PSB will brief the CSO if the supervisor is unable to do so or when the incident is reported directly to the PSB.

34. Preliminary Inquiries. An informal inquiry is conducted to determine if classified information has been lost or compromised so that a damage assessment can be completed, and the appropriate corrective action can be taken.

a. The PSB will appoint an inquiry official to conduct a preliminary inquiry. See Attachment

1 for a sample appointment memorandum.

b. The preliminary inquiry will determine if classified material was compromised, the extent of the compromise, and the circumstances surrounding the compromise.

c. A preliminary inquiry report will be completed using the sample report format in

Attachment 2 and submitted to the Chief, Physical Security Branch. The Chief, PSB, will provide concurrence/non-concurrence with the report and forward it to the CSO, for action.

Reports must be completed within ten (10) business days of appointment.

d. The report from the preliminary inquiry will be sufficient to resolve the security incident if:

(1) The inquiry determines loss or compromise of classified information did not occur;

(2) The inquiry determines loss or compromise of classified information did occur, but there is no indication of significant security weaknesses; or

(3) The appointing official determines that no additional information will be obtained by conducting a formal investigation.

e. If the report from the preliminary inquiry is not sufficient to resolve the security incident, the appointing authority initiates a formal investigation. If the inquiry is closed out as a compromise or potential compromise, the appointing authority notifies the OCA to perform a damage assessment.

35. Damage Assessment. A damage assessment is an analysis to determine the effect of a compromise of classified information on national security. It will be initiated by the OCA upon notification of a potential or actual compromise to verify and reevaluate the information involved. Damage assessment reports will be classified and marked according to the classification guidance provided on the information being addressed in the reports. The

OCA must:

a. Verify the classification and duration of classification initially assigned to the information.

If the OCA determines the information should be declassified, the reporting activity will be notified.

b. Set up damage assessment controls and procedures.

c. Provide a copy of the damage assessment to the inquiry or investigating official.

36. Formal Investigations. A formal investigation is conducted when a known compromise occurs. A formal investigation is a detailed examination of evidence to determine the extent and seriousness of the compromise of classified information. The formal investigation will reinstate the responsibility for any disregard (deliberate or inadvertent) of governing directives which led to the security incident.

37. PSB Inquiry Responsibilities. The PSB will:

a. Provide technical guidance and review of preliminary inquiry reports.

b. Monitor the status of security incidents.

c. Ensure inquiry report is completed within ten (10) business days from appointment.

38. Violation of Policy. Violations of this policy will be dealt with in accordance with GPO

Directive 655.4D, Subject: Corrective Actions, dated February 1, 2021, or its supersedure.

39. Inquiries. Inquiries regarding this Directive should be directed to the Chief Security Officer, Security Services, on (202) 512-1103.

40. Effective Date. This Directive is effective upon issuance.

HUGH NATHANIAL HALPERN

Director

ATTACHMENT 1

MEMORANDUM

Subject: Appointment of Inquiry Official

Date:

Reply to Attention of:

To: Chief Security Officer

1. You are appointed to conduct a preliminary inquiry into security incident (number).

The incident involves (provide a short summary).

2. The purpose of this inquiry is to determine whether a compromise occurred and to categorize this security incident as either a security violation or a security infraction.

You are authorized to interview those persons necessary to complete your findings.

You are further authorized access to records and files pertinent to this inquiry. Your records indicate that you have a (Secret, Top Secret, etc.) security clearance. Should you determine this incident involved access to program information for which you are not authorized access, advise the PSB immediately.

3. Contact (name and phone number of the PSB) for a briefing on your responsibilities, conduct of, and limitations of this inquiry. Your written report will be forwarded through the PSB to me within 10 business days from the date of your appointment. As a minimum, your report must contain the following:

a. A statement that a compromise or potential compromise did or did not occur.

b. Category of the security incident.

c. Cause factors and responsible person(s).

d. Recommended corrective actions needed to preclude a similar incident.

4. Notify me immediately on (phone number) if you determine a compromise has occurred. You are required to obtain technical assistance from the PSB and General Counsel during the course of this inquiry whenever necessary.

Signature Block of Appointing Official

U . S . G O V E R N M E N T P U B L I S H I N G O F F I C E

America In fo rmed

732 N orth C ap itol S tree t, NW | Wash ington , D C 20401 -0001 www.g po.g ov I fac eboo k.co m/us gpo I tw i t te r .co m/us gpo I in stag ram. com/ usgp o

ATTACHMENT 2

MEMORANDUM

Subject: Preliminary Inquiry of Security Incident Number _____

Date:

Reply to Attention of:

To: Chief Security Officer

Authority: A preliminary inquiry was conducted (date) under the authority of the attached memorandum.

Matters investigated: The basis for this inquiry was (provide a short summary of the security incident including the date it occurred, the classification of information involved, and the document control number if specific documents were involved).

Personnel Interviewed: (list all personnel interviewed, position title, office symbol, and security clearance).

Facts: (list specific details answering who, what, why, where, and when questions concerning the security incident).

Conclusions: As a result of the investigation into the circumstances surrounding the security incident, interviews, and personal observations, it is concluded that: (list specific conclusions reached based on the facts and if a compromise or potential compromise did or did not occur). If a damage assessment is or has been done, provide the point of contact along with: (the status of the assessment if it hasn’t been completed; or, describe the outcome if it has been completed; or, provide a copy of the completed assessment report).

Recommendations: (list corrective actions needed to preclude a similar incident; the category of the incident; damage assessment; if the incident is a compromise, potential compromise or no compromise; and, if this inquiry should be closed without further investigation or with a recommendation for a formal investigation).

Signature Block of Inquiry Official

Attachment:

Appointment of Inquiry Official Memo, (date)