You must report any systemic weaknesses and anomalies.

• A. True
• B. False
• C. Only if requested by a supervisor
• D. Only if it involves SCI

Answer: (A)

Reporting systemic weaknesses and anomalies is a responsibility that supports proactive risk management and continuous security improvement. Systemic weaknesses are patterns of vulnerabilities across processes, systems, or people, while anomalies are deviations from normal operations that could signal a security issue. By reporting them, you enable timely investigation and remediation, strengthening protection of sensitive information and operations. This reporting should happen through established channels whenever observed, not only when a supervisor asks or only if it involves SCI. That’s why this statement is correct.