Security violations are required to be reported, but infractions are not required to be reported.

• A. True
• B. False
• C. Not applicable
• D. Not sure

Answer: (B)

Reporting obligations in SCI cover any action or lapse that could compromise security, not just clear-cut violations. In security programs, both security violations and infractions of procedures or policies related to safeguarding classified material must be reported to the appropriate security authority. The idea is to capture all behavior or events that raise risk, so investigations can determine root causes and corrective actions can be taken. Prompt reporting helps prevent recurrence and protects the integrity of the information environment. For example, leaving a classified document unattended or inadvertently sharing information with an unauthorized person are both issues that should be reported. Because infractions can create vulnerabilities just as outright violations can, the statement is not correct.