FSO Cheat Sheet 2026

The 30 highest-yield FSO facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In the context of Facility Security Officer Certification, what does the principle of least privilege mean? → Users should only have the minimum access rights necessary to perform their job functions
2. Who must authorize a contractor information system before it processes classified information? → The Cognizant Security Authority (DCSA) via its Authorizing Official
3. Which role is the contractor's senior management representative accountable for the overall security program? → Senior Management Official (SMO)
4. How often must cleared employees receive security refresher training? → Annually
5. Which situation requires an adverse information report to DCSA? → Cleared employee arrested for a serious offense or showing concerning behaviors
6. Zoning ordinances primarily regulate: → How land and buildings may be used within a jurisdiction
7. Which best describes the scope of Contract Law & Commercial Transactions in professional practice? → A comprehensive area covering both theoretical foundations and practical applications
8. Which law criminalizes gathering, transmitting, or losing defense information with intent or reason to believe it could injure the U.S.? → Espionage Act, 18 U.S.C. 793
9. Which form is used to record each opening and closing of a security container? → SF 702
10. What common challenge do professionals face when applying Civil Procedure & Litigation principles? → Balancing theoretical best practices with practical constraints and real-world conditions
11. A security officer detains a suspect without legal justification. The most likely tort claim is: → False imprisonment
12. Which of the following must employees report under security executive agent requirements for cleared personnel? → Foreign travel and certain foreign contacts
13. How long is a Confidential clearance typically valid before a periodic reinvestigation is required? → 10 years
14. Which factor is most important in prioritizing identified vulnerabilities? → Risk—likelihood and impact on classified information
15. Which form is a Classified Information Nondisclosure Agreement that cleared employees sign before access? → SF-312
16. How soon must a loss, compromise, or suspected compromise of classified information be reported? → Immediately
17. What is the primary role of a Facility Security Officer (FSO)? → To oversee and maintain the security program
18. What is the first step in an incident response plan? → Identify and report the incident
19. In the context of Facility Security Officer Certification, what does the principle of least privilege mean? → Users should only have the minimum access rights necessary to perform their job functions
20. What is the FIRST step in an incident response process according to Facility Security Officer Certification best practices? → Detection and identification of the security incident
21. Under the 'eggshell plaintiff' rule, a defendant: → Takes the plaintiff as found and is liable for the full extent of harm
22. Why is VM sprawl a security concern? → Unmanaged or forgotten VMs may go unpatched and unmonitored
23. A cleared employee is contacted by a foreign national seeking unusual technical information. What is the correct response? → Report it as a suspicious contact
24. Before a newly installed classified system may process classified information, what must occur? → It must receive authorization from the Authorizing Official (DCSA)
25. Which technology isolates applications by sharing the host OS kernel instead of running a full guest OS for each workload? → Containers
26. In O'Connor v. Ortega, the Court addressed searches of a public employee's workplace and applied which standard? → Reasonableness under the circumstances, for work-related or investigatory searches
27. What is the correct approach to patient communication for a FSO professional? → Use clear, simple language and verify patient understanding
28. Which of the following is a recommended practice for removable media used on classified systems? → Treat and mark media at the highest classification of data it has held
29. When is it acceptable to share CUI with someone outside your organization? → When there is a lawful government purpose and the recipient is authorized
30. An FSO learns an employee may have mishandled classified material but fears embarrassing a longtime colleague. What is the FSO's professional obligation? → Report the matter and conduct the required inquiry regardless of personal relationships