Attachment I - SSI Quick Reference Guide.pdf

Sensitive Security Information

Recognizing SSI SSI is information about transportation security activities. The following information constitutes SSI (as delineated in 49 CFR part 1520):

Security programs and contingency plans

Security directives

Information circulars

Performance specifications

Vulnerability assessments

Security inspections or investigative information

Threat information

Security measures

Security screening information

Security training materials

Identifying information of certain transportation security personnel

Critical infrastructure asset information

Systems security information

Confidential business information

Research and development

Other information as determined in writing by the TSA Administrator

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

The SSI Office TSA’s Sensitive Security Information (SSI) Office:

Develops SSI guidance, policies, and procedures to help others appropriately recognize and handle SSI.

Analyzes and reviews records for SSI content.

Trains TSA employees, clients, and stakeholders in identifying, handling, marking, sharing, storing, transmitting, and destroying SSI.

Coordinates with stakeholders, other governmental agencies, and Congress on SSI-related issues.

Provides guidance on and updates to the SSI regulation and other regulations relating to SSI.

For more information, contact us:

The SSI Office

Phone: (571) 227-3513 Fax: (571) 227-2945

SSI@dhs.gov

Safely Sharing Information

SSI Quick Reference Guide www.tsa.gov

Sensitive Security Information

[TEXT]

WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 USC 552 and 49 CFR parts 15 and 1520.

Sensitive Security Information

[TEXT]

WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 USC 552 and 49 CFR parts 15 and 1520.

What is SSI?

Sensitive Security Information (SSI) is information that, if publicly released, would be detrimental to transportation security.

Although SSI is not classified information, there are specific procedures for recognizing, marking, protecting, safely sharing, and destroying SSI.

Marking SSI Even when only a small portion of a document contains SSI, every page of the document must be marked with the SSI header and footer shown below.

Sensitive Security Information

[TEXT]

WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 USC 552 and 49 CFR parts 15 and 1520.

Handling SSI Do make sure all SSI is properly marked.

Do protect SSI according to the SSI regulation and report any unauthorized disclosures to your SSI Coordinator.

Do lock up all notes, draft documents, electronic media, and other material containing

SSI.

Do turn off or lock your computer whenever you leave your desk to ensure that no SSI is compromised.

Do password-protect SSI as an attachment to an email. Do not include the password in the body of the email with the attachment.

Do personally hand deliver SSI to the intended recipient—never leave SSI unattended in the recipient’s work space.

Do destroy all SSI in your possession when no longer needed.

Do immediately report any suspected SSI security violation, or poor security practices to your SSI Coordinator.

Do be conscious of your surroundings when discussing SSI. Protect verbal communications with the same heightened awareness that you would apply to SSI on paper or email.

Do use encrypted portable devices or password-protect SSI on electronic media.

Do mail SSI through the U.S. Postal Service, or use other delivery services such as FedEx or UPS. Always wrap SSI in an unmarked opaque envelope, package, or carton.

Don’t leave SSI unattended. Leave it in a locked drawer or locked file cabinet.

Don’t post SSI on any Internet or Intranet web site without prior approval.

Don’t take SSI home, whether on paper or in electronic format, without permission from your supervisor(s).

Don’t share SSI with individuals who do not have a need to know.

Don’t discuss SSI on cordless or cellular phones unless absolutely necessary because these phones can be easily intercepted.

Don’t put SSI in the body of an email—send it as a password-protected attachment.

Destroying SSI Shred with a cross-cut shredder.

Cut manually in less than ½-inch squares.

Where available, place SSI in designated and clearly marked SSI bins.

Safely Sharing Information

Sensitive Security Information Office www.tsa.gov