What constitutes a security violation that must be reported?

• A. The loss, compromise, or suspected compromise of classified information.
• B. Only confirmed compromises of classified information.
• C. Any misplacement of unclassified information.
• D. Failure to update account passwords within 90 days.

Answer: (A)

Any loss, compromise, or suspected compromise of classified information triggers a required report. This means you don’t have to wait for a confirmed breach—the word “suspected” is enough to initiate the reporting process so the security team can contain and investigate promptly. The focus here is protecting classified materials, so incidents involving unclassified information or routine password issues aren’t treated the same way. Misplacing unclassified information isn’t a reportable security violation under this rule, and while not updating passwords is a bad practice, it isn’t by itself a reportable incident.