Evidence & Trial Practice Flashcards

An FSO finds a classified safe unlocked after hours with no one present. What is the first priority?

Answer: Secure the material and preserve the scene, then report

Protecting the material and preserving the scene comes before any inquiry or notification delays.

What is the main purpose of a preliminary inquiry into a security incident?

Answer: Determine whether loss, compromise, or suspected compromise occurred

The inquiry establishes the facts needed to decide whether classified information was compromised.

Which form records the opening and closing of a security container, serving as evidence of access?

Answer: SF 702

SF 702 is the Security Container Check Sheet documenting each opening and closing.

Why should the FSO avoid altering or discarding SF 702 and visitor logs during an incident?

Answer: They are evidence that may be needed to establish who had access

Access records help reconstruct timeline and personnel involved, so they must be preserved.

A witness statement collected during an inquiry should primarily be:

Answer: Factual, firsthand, signed, and dated

Firsthand, signed, dated statements are the most reliable documentation.

In an incident report, the FSO should distinguish between:

Answer: Verified facts and opinions or assumptions

Separating facts from speculation keeps the report accurate and credible.

Who normally receives the initial report of loss, compromise, or suspected compromise of classified information from a cleared contractor?

Answer: The cognizant security agency (DCSA)

NISPOM requires reporting such events to the CSA, and contractors also notify the GCA as applicable.