Events that must be reported by contractors and cleared employees include suspected loss or compromise of classified information and problems affecting its safeguarding. You do not need to prove that someone read a misdirected message before notifying security. Use the designated incident channel, protect people, and follow authorized instructions without starting your own investigation.

Which events must be reported to your security office?

Possible classified loss, exposure, mishandling, or suspicious access warrants prompt security attention through local procedures. The NISPOM reporting rule includes suspected compromise, not only confirmed disclosure. Describe what happened; let authorized security personnel determine the incident category and required organizational reports.

Under 32 CFR 117.8(a)(1), contractors and their cleared employees report events affecting safeguarding and events indicating that classified information has been, or is suspected to be, lost or compromised. The contractor establishes internal reporting procedures to the facility security officer (FSO).

A missing classified item, a message sent through an unsuitable system, an unsecured classified discussion, or an apparent attempt to obtain unauthorized access can each require attention. These examples describe reasons to contact security. They do not establish that every event has the same classification, cause, or consequence.

Your responsibilities as a cleared professional include recognizing when a workplace concern needs a different route from an ordinary personal self-report. A possible information exposure belongs with the designated incident contacts, even if it also raises a personnel security question.

What comes first when exposure may still be happening?

Protect people and use the immediate actions your training and local procedures authorize. Notify the designated security contact without waiting to reconstruct everything. For a system event, follow the approved incident plan rather than guessing whether disconnecting, powering off, or leaving equipment running is appropriate.

If there is an immediate threat to people, use the site’s emergency procedures. For an information exposure, an authorized protective step might involve stopping an unsecured discussion or preventing additional unauthorized viewing. The right action depends on your role and the circumstances; avoid taking control of a scene you are not trained to manage.

Report a continuing exposure clearly. “The discussion is still occurring in an unsecured area” gives responders different information from “I overheard a discussion earlier.” If you cannot safely take the trained protective step, tell the designated contact what remains exposed and where.

The CDSE Security Incident Job Aid, updated June 15, 2026, directs incident response personnel to contain spillage without waiting for a classification decision or procedure approval. That instruction supports timely authorized response. It does not turn every employee into an incident commander or authorize improvised cleanup.

Why should you avoid copying, deleting, or exploring the material?

Unplanned handling can spread the information or disturb what responders need to assess. Unless your authorized procedures or responders direct otherwise, leave copying, message retrieval, searches, and cleanup to the assigned personnel. A report can identify where information is located without reproducing it.

Forwarding an attachment to a colleague “for confirmation” creates another transmission. Taking a photograph on a personal device creates another copy. Opening related folders to find out whether the problem is widespread expands your activity beyond the event you already observed.

Deleting a message or emptying a folder is also a response action, not a neutral way to undo an error. The job aid’s employee-training recommendations include ensuring information is not deleted before a complete investigation. Tell responders what you already did so they can account for it.

The contractor’s information-system program must include spill assessment, reporting, isolation, containment, sanitization, and recovery procedures under 32 CFR 117.18(b)(2). Follow those procedures within your assigned role. A generic online cleanup tip is insufficient direction for a classified incident.

Whom should you notify, and through which channel?

Use your employer’s designated security incident contact, including the FSO and system-security channel when applicable. At a government or another contractor’s site, follow the host-site reporting instructions as well. Make the initial notification through an approved route that can safely receive the information.

Learn the contacts before an incident occurs. Keep the approved office and after-hours route accessible in the form your workplace permits. A supervisor can help reach security, but an ordinary management message should not be assumed to complete the required security notification.

For contractor employees, 32 CFR 117.8(a)(2) places internal reporting procedures with the contractor and identifies the FSO as the recipient of pertinent employee information. The explanation of the FSO’s role at a cleared contractor can help you understand why security coordinates the response.

Keep the channel appropriate to the content. Under 32 CFR 117.15(a)(1), contractors must ensure cleared personnel understand the prohibition on unsecured classified discussions. Your incident report should not create a fresh disclosure through an ordinary phone call or email.

If unsure how to pass the details, notify the designated contact that you have a possible incident and need an approved reporting method. Avoid placing suspected classified content into a general help-desk ticket. Provide location and contact information at an appropriate level so the responders can reach you.

What facts should your initial account contain?

Give the people, event, location, and time you directly observed, along with any action you already took. Separate observation from inference and identify unknowns. You can provide a useful notification without a full timeline, a list of every affected device, or an explanation of intent.

“I saw a message with classified markings in an unclassified mailbox” is an observation. “Everyone in the organization has read it” is a scope claim you may be unable to support. Report the mailbox or system through the approved route and leave broader access analysis to responders.

If your times are approximate, say so. If you saw a name but did not verify the person, describe that limitation. An accurate gap is more useful than an invented detail that later becomes part of the incident history.

How should you preserve devices, messages, and locations?

Follow the incident team’s instructions and the immediate preservation steps covered by your training. Avoid altering the affected material to create a cleaner account. Ask how to record your observations and where any written statement should be stored or transmitted.

Preservation does not necessarily mean personally collecting everything. Moving a device, transferring a file, or carrying paper to a different room can change both the scene and the handling risk. Tell security where the material is and follow the approved safeguarding instructions.

If you already forwarded, deleted, moved, or opened something, include that action in your account. Do not attempt another unsupervised action to disguise or reverse it. Responders need the actual sequence to assess the affected information and systems.

Protect the report as well. The current job aid cautions that details about a spill can themselves make reporting information classified. An unclassified personal notebook should not become a private repository of the affected content, names of sensitive programs, or technical details copied from the event.

Who determines classification, scope, and responsibility?

The authorized security response process determines those issues. Employees provide observations and cooperate with directed follow-up. Interviews, classification validation, access-log review, and responsibility findings belong to designated personnel with the authority and access needed to perform them.

Under 32 CFR 117.8(d)(1), the contractor initiates a preliminary inquiry immediately upon receiving a classified security violation report, including validation of classification. That requirement binds the contractor. It does not mean the observing employee must finish an inquiry before contacting the FSO.

Interviewing coworkers yourself can mix your observations with other accounts. Searching accounts or testing permissions may create additional unauthorized activity. Even if you have technical privileges, confirm whether incident investigation is part of your assigned role before using them to explore the event.

Keep blame out of the initial notification. Describe who did what when you know it directly, and distinguish that from assumptions about motive. The response team can request a statement or interview through the proper process.

What happens after your first report?

Remain available, follow preservation and access instructions, and send corrections through the designated route. Security handles the required organizational reports and any investigation. Ask whom to contact if you remember a new fact or if an instructed protective measure cannot be maintained.

Under 32 CFR 117.8(d)(2), a preliminary inquiry confirming loss, compromise, or suspected compromise triggers a prompt contractor initial report unless the cognizant security agency directs otherwise. The final-report provisions address the completed investigation. The overview of NISPOM requirements provides context for that employer process.

Your own reporting should not wait for the contractor’s agency-reporting stage. Nor should you assume that prompt reporting guarantees a particular personnel or disciplinary outcome. Your immediate task is accurate notification and cooperation with the authorized response.

Frequently Asked Questions

Must I prove someone saw the classified information?

No. Suspected compromise is within the reporting framework. Notify the designated security contact with your observations and unknowns so the authorized response can assess possible exposure.

Should I forward the message to my FSO as evidence?

Use the approved incident channel and ask how to identify or provide the affected message. Avoid independently forwarding suspected classified material, especially across systems with different handling permissions.

Should I shut down the computer immediately?

Follow the immediate steps in your training and approved incident plan, or the designated responders’ directions. System handling depends on the incident and preservation needs. Avoid improvising power or network changes.

What should I confirm after notifying security?

Confirm who is handling the report, what you must safeguard or stop using, and which approved route to use for additional facts. Record those instructions only as your workplace permits.