What is the proper course of action if SCI is lost or stolen?

• A. Immediately report to the FSO, preserve evidence, implement incident response, and cooperate with investigations.
• B. Review the incident at the end of the day.
• C. Post a notice in the break room.
• D. Ignore and continue working.

Answer: (A)

When SCI is lost or stolen, the immediate priority is to activate the incident response and get the right people involved without delay. Reporting right away to the Facility Security Officer ensures the incident is escalated to the correct security authorities and that the proper containment steps and notifications are started promptly. Preserving evidence and maintaining a clear chain of custody are crucial because they enable an accurate investigation, help determine exactly what information might have been exposed, and support any required disciplinary or corrective actions. Cooperating with investigations ensures you provide all relevant details and follow through with the procedures that protect others and reduce risk, while also helping the organization learn how to prevent a recurrence.

Delaying reporting, attempting to handle it informally, or publicly posting notices would undermine containment, expose others to risk, and violate security policy. Ignoring the incident is not an option because it could allow further compromise and impede a legitimate response.