SFPC Security Incidents, Infractions and Violations — Questions and Answers
Question 1: What best distinguishes a security violation from a security infraction?
- A violation involves unclassified material, an infraction involves classified material
- A violation is a knowing, willful, or negligent action that could cause or does cause compromise, while an infraction is a lesser rule breach without loss or compromise (Correct answer)
- A violation is reported only to the FBI, an infraction only to the supervisor
- There is no difference; the terms are interchangeable
Correct answer: A violation is a knowing, willful, or negligent action that could cause or does cause compromise, while an infraction is a lesser rule breach without loss or compromise
Infractions are security rule failures that do not result in loss, compromise, or suspected compromise. Violations are knowing, willful, or negligent actions that could reasonably be expected to result in, or do result in, compromise of classified information.
Question 2: What is the first purpose of a preliminary inquiry after a possible loss or compromise of classified information?
- To impose disciplinary action on the responsible person
- To determine whether a loss, compromise, or suspected compromise actually occurred (Correct answer)
- To revoke the facility clearance
- To declassify the affected information
Correct answer: To determine whether a loss, compromise, or suspected compromise actually occurred
The preliminary inquiry establishes the facts quickly: whether classified information was actually lost or compromised, and the circumstances. If it finds compromise, a more formal investigation and damage assessment may follow. Discipline is a later, separate step.
Question 3: You find a classified document left unattended on a desk after hours. What should you do first?
- Leave it, since it is not your document
- Take it home to secure it overnight
- Take custody and safeguard it, then immediately report to the security office (Correct answer)
- Photograph it and email the photo to your supervisor
Correct answer: Take custody and safeguard it, then immediately report to the security office
Protect the material by keeping it under control until it can be secured, then report the discovery right away to security. Never leave it, copy it, or move it off-site. Reporting lets security begin the inquiry.
Question 4: A contractor facility discovers that classified material is missing. Under NISP rules, when must it be reported to the cognizant security agency?
- At the next annual self-inspection
- Within 90 days
- Immediately (Correct answer)
- Only if the loss is confirmed to be to a foreign entity
Correct answer: Immediately
Cleared contractors must report loss, compromise, or suspected compromise of classified information immediately to the CSA. They must not wait until a compromise is confirmed.
Question 5: What is a 'compromise' of classified information?
- Any change in the classification level
- The disclosure of classified information to a person who does not have an authorized need for access (Correct answer)
- The routine destruction of classified material
- A minor marking error on a document
Correct answer: The disclosure of classified information to a person who does not have an authorized need for access
A compromise is an unauthorized disclosure of classified information to someone who lacks the required clearance, authorization, or need to know. Marking errors alone are infractions unless they lead to unauthorized disclosure.
Question 6: Which is a typical outcome that a formal security investigation or damage assessment aims to produce?
- A new classification guide for the program
- Identification of cause, responsible parties, and corrective actions to prevent recurrence (Correct answer)
- Automatic termination of all employees in the work area
- Public release of the findings
Correct answer: Identification of cause, responsible parties, and corrective actions to prevent recurrence
Investigations establish what happened, why, who was responsible, and what corrective actions are needed. Damage assessments evaluate the harm to national security. Findings are generally controlled, not released publicly.
