IR-9

IR-9 INFORMATION SPILLAGE RESPONSE

Overview

Number	Title	Impact	Priority	Subject Area
IR-9	Information Spillage Response		P0	Incident Response

Instructions
The organization responds to information spills by: IR-9a. Identifying the specific information involved in the information system contamination; IR-9b. Alerting Assignment: organization-defined personnel or roles of the information spill using a method of communication not associated with the spill; IR-9c. Isolating the contaminated information system or system component; IR-9d. Eradicating the information from the contaminated information system or component; IR-9e. Identifying other information systems or system components that may have been subsequently contaminated; and IR-9f. Performing other Assignment: organization-defined actions.

Instructions

The organization responds to information spills by:

IR-9a.

Identifying the specific information involved in the information system contamination;

IR-9b.

Alerting Assignment: organization-defined personnel or roles of the information spill using a method of communication not associated with the spill;

IR-9c.

Isolating the contaminated information system or system component;

IR-9d.

Eradicating the information from the contaminated information system or component;

IR-9e.

Identifying other information systems or system components that may have been subsequently contaminated; and

IR-9f.

Performing other Assignment: organization-defined actions.

Guidance
Information spillage refers to instances where either classified or sensitive information is inadvertently placed on information systems that are not authorized to process such information. Such information spills often occur when information that is initially thought to be of lower sensitivity is transmitted to an information system and then is subsequently determined to be of higher sensitivity. At that point, corrective action is required. The nature of the organizational response is generally based upon the degree of sensitivity of the spilled information (e.g., security category or classification level), the security capabilities of the information system, the specific nature of contaminated storage media, and the access authorizations (e.g., security clearances) of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Guidance

Information spillage refers to instances where either classified or sensitive information is inadvertently placed on information systems that are not authorized to process such information. Such information spills often occur when information that is initially thought to be of lower sensitivity is transmitted to an information system and then is subsequently determined to be of higher sensitivity. At that point, corrective action is required. The nature of the organizational response is generally based upon the degree of sensitivity of the spilled information (e.g., security category or classification level), the security capabilities of the information system, the specific nature of contaminated storage media, and the access authorizations (e.g., security clearances) of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Enhancements

IR-9 (1) Responsible Personnel

The organization assigns Assignment: organization-defined personnel or roles with responsibility for responding to information spills.

IR-9 (2) Training

The organization provides information spillage response training Assignment: organization-defined frequency.

IR-9 (3) Post-Spill Operations

Correction actions for information systems contaminated due to information spillages may be very time-consuming. During those periods, personnel may not have access to the contaminated systems, which may potentially affect their ability to conduct organizational business.

The organization implements Assignment: organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.

IR-9 (4) Exposure To Unauthorized Personnel

Security safeguards include, for example, making personnel exposed to spilled information aware of the federal laws, directives, policies, and/or regulations regarding the information and the restrictions imposed based on exposure to such information.

The organization employs Assignment: organization-defined security safeguards for personnel exposed to information not within assigned access authorizations.