Incident Response, Reporting & Liaison & Communication Flashcards

The final report on a classified information loss should include:

Answer: Corrective actions taken to prevent recurrence

The final report details root cause, responsible parties and corrective action.

An unsolicited email from an unknown foreign entity requests detailed product specs for a defense program. This is:

Answer: A potential suspicious contact to report

Unsolicited requests for protected information are indicators of possible collection attempts and are reportable.

Which of these is NOT typically a change reportable by the FSO under changed condition reporting?

Answer: Change of the cafeteria vendor

Cafeteria vendors do not affect facility clearance; KMP, FOCI and name changes do.

Why should an FSO build relationships with local FBI and DCSA counterintelligence personnel?

Answer: To obtain threat information and have quick channels for reporting

Liaison supports threat awareness and timely reporting of incidents.

Employees question whether to report a concern about a coworker. The FSO should emphasize that reporting is:

Answer: An obligation that supports national security

Cleared personnel have a duty to report concerning behavior and security issues.

Where should the FSO document the record of security incidents and reports?

Answer: Company security files kept for review

Incident reports and actions should be documented and retained for DCSA review.

If a cleared employee terminates employment, the FSO should:

Answer: Update DISS and debrief the employee

Terminating employees get a security debriefing and the FSO updates the system of record.