Incident Response, Reporting & Liaison & Communication Flashcards

After a suspected compromise, the FSO's preliminary inquiry primarily aims to determine:

Answer: Whether loss or compromise actually occurred

A preliminary inquiry establishes the facts and whether loss, compromise, or suspected compromise occurred.

Which of these is an adverse information report trigger for a cleared employee?

Answer: Repeated unreported foreign contacts and financial problems

Adverse information, such as concerning conduct or financial issues, bearing on eligibility must be reported to the CSA.

A spillage of classified data onto an unclassified information system is first reported to:

Answer: The ISSM/ISSP and the FSO

Spillages must be isolated and reported through the ISSM/FSO to the CSA, not broadcast or ignored.

A cleared contractor wants to publish a paper that relates to a classified contract. Public release requires:

Answer: Approval from the appropriate government authority

Information pertaining to classified contracts needs government approval prior to public release.

Who must the Insider Threat Program Senior Official (ITPSO) be?

Answer: A cleared U.S. citizen employee and KMP

The ITPSO must be a cleared employee who is a senior official of the company and a KMP.

A change in a cleared company's ownership is a:

Answer: Changed condition requiring report to the CSA

Changes in ownership are reportable changed conditions affecting the facility clearance.

An employee is arrested. The FSO should treat this as:

Answer: Reportable information on a cleared employee

Arrests of cleared personnel are reportable adverse information under SEAD 3 requirements.