What are the rules for using portable non-secure devices near SCI?

• A. Personal devices may be used for SCI if protected by a password
• B. SCI may be accessed on non-secure devices if offline
• C. You may store SCI on personal devices if you have encryption
• D. Do not bring SCI onto non-secure devices or networks; avoid storing SCI on personal devices; use approved devices in secure locations

Answer: (D)

The main idea is that SCI must be kept off portable non-secure devices and networks. Do not bring SCI onto personal devices or use them in non-secure networks; only approved devices in secure locations should handle SCI.

This is because non-secure devices and networks lack the layered protections required for SCI. They can be lost or stolen, infected with malware, or breached, leading to potential disclosure. Relying on a password on a personal device does not provide the necessary safeguards, and there’s no guarantee the device remains in a controlled, monitored environment. Accessing SCI offline on a non-secure device still carries the risk that data could be exposed or recovered later, and ownership of the device isn’t under your program’s security controls. Storing SCI on personal devices with encryption similarly bypasses the program’s approved storage and handling channels, introducing unmanaged risk.

Using approved devices in secure locations ensures proper authorization, encryption to government standards, and the ability to enforce need-to-know, compartmented access, and necessary monitoring and controls.