DEPARTMENT OF THE ARMY
XXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXX

OFFICE SYMBOL                                                                                      Date

MEMORANDUM FOR SEE DISTRIBUTION

SUBJECT:  Information Security Standard Operating Procedure

1.	Purpose.  To provide guidance to commanders, staff, and other leaders on Information Security policies and procedures within the unit.

2.	Reference.  AR 380-5, Department of the Army Information Security Program.

3.	Safeguarding.

a.	All Soldiers, civilians, and contractors are responsible for safeguarding classified information for which they have been given access.  Any holder of classified information is considered to be the custodian of the material.  Custodians will provide protection and control of classified information at all times and must follow procedures to ensure that unauthorized persons do not gain access to classified information by sight, sound, or other means.

b.	Classified information will not be discussed with, or in the presence of, unauthorized persons.  Prior to granting other personnel access to classified information, their security clearance level, access, and need-to-know will be verified.  Unit Security Managers will develop procedures to ensure that only properly cleared individuals with a valid need-to-know are granted access to classified information within their unit.  Unit Security Managers will maintain a current Security Clearance Access Roster (SCAR) of all unit personnel.  This roster will contain at a minimum: name, rank, DOD ID, date and level of clearance authorized, date/type of investigation completed, and level of access granted.

c.	Classified material removed from storage containers must be kept under the constant surveillance and control of authorized and properly cleared individuals.  This requirement also applies to classified computer hard drives and any other type of classified media.  Classified documents will be covered with appropriate cover sheets when not stored inside a GSA-approved security container.  Cover sheets are used to prevent classified information from being viewed by unauthorized or uncleared individuals. Electronic media will be marked with classification stickers or other identifying markings.

d.	Classified information and material may only be transported by a recognized courier with appropriate written documentation.  

4.	Non-Disclosure Agreement.

a.	Prior to granting access to classified information, all DA personnel are required to sign a Classified Information Non-Disclosure Agreement (NDA), Standard Form (SF) 312.  The Unit Security Manager will ensure that all unit personnel who require access to classified information have executed and signed an NDA before allowing them access to classified information.

b.	If an individual has previously executed an NDA, the Unit Security Manager will maintain a copy of the NDA in the unit security files. If a previously executed NDA cannot be located, the Unit Security Manager will execute a new NDA, before granting the individual access to classified information. 

c.	The Unit Security Manager will maintain copies of executed NDAs for all cleared personnel assigned to the agency, until reassignment, transfer, or separation from federal- employment or service. Upon transfer to a new organization, this copy will be forwarded to the gaining organization’s security manager.

5.	Classification and Declassification Management

a.	There are two recognized means to classify information: Original Classification and Derivative Classification.  

(1)	Original classification is the initial decision made by an Original Classification Authority (OCA) that information could be expected to cause damage to national security if subjected to unauthorized disclosure.  The OCA is the official designated by the Secretary of the Army (SECARMY) to originally classify information up to the level designated.  OCAs are designated by position, not by name.

(2)	Derivative Classification is the act of extracting, paraphrasing, re-stating, or regenerating in a new form, information that has already been classified, and marking the material indicating · its classification. This typically takes the form of OPORDs and FRAGOs.  If the derivative document is taken from a classified original document, the derivative document must be appropriately marked showing all sources and the overall level of classification. If only one classified paragraph is carried to the derivative document, the entire document must be marked to the highest level of information contained therein.

b.	Classification management is the process of reporting to higher the total number of original and derivative classification decisions made during the Fiscal Year (reported by quarter). Included in this report are the total number of original classified electronic messages (email) sent.  This information is to be submitted to the higher G2, NLT five (5) days after the end of the sampling period.

c.	Units should be aware that in some cases, unclassified information can become classified when compiled with a series of statements or information on a specific topic.  In all cases, the Security Classification Guide should be consulted to ensure that classified information is not shared inadvertently.

6.	Marking Classified Information

a.	All classified material must be marked IAW its highest level of classification using the appropriate label.

b.	All documents are required to have the four markings below:

(1)	Classification level markings

(2)	Portion markings

(3)	Classification authority

(4)	Declassification instructions and ''Notional" Classified information during Military Exercises.

c.	Classification markings will be placed on the front cover, index/title page, first page, interior pages, blank pages, and back cover.  Portion markings will be for each subject, title, paragraph and subparagraph.  The full classification line must be conspicuously placed at both the top and bottom of each page, in capital letters and in English.

d.	Classification Authority ("CLASSIFIED BY..." or "DERIVED FROM ..." line). This is the identification of the originating agency responsible for classifying the document. It should include the name of the actual classifier and position.

e.	The reason for classification will be placed beneath the "CLASSIFIED BY" line. Classification may be applied to information that falls into one of the seven categories as specified in section 1.5 of Executive Order 12958, as amended, "Classified National Security Information."

7.	Media Marking

a.	Mark or label classified media according to the highest level of classification of data within the media.  

b.	Computers and Information Systems:  All computers (hard drives) used to process classified information must be properly secured in a GSA-approved container and accounted for at the close of every duty day or in an authorized and secured open-storage facility.

c.	Printers must also be properly marked to indicate the level of information used. Printers used to process classified information must be secured in a GSA-approved container when not physically in use or when a cleared person is not present.

8.	Accountability and Control

a.	Accountability of classified information and material in the office work environment can be accomplished by controlling access, storage, handling, and proper marking of classified information.  The following are tools to assist in the accountability of classified information:

(1)	Ensure that every person with access to classified information has a current security clearance and a valid need-to-know.

(2)	Physical security plays a major role in the accountability and control of classified information.  Using GSA-approved containers, locks, and access control along with properly completed access documents (SF 702) makes the process easier but not fool-proof.  Compromising combinations and passwords can defeat the best physical security measures.

(3)	Technical measures such as computer logs, Intrusion Detection Systems (IDS), and secure communications can assist security managers and commanders in maintaining accountability and control.

(4)	Administrative measures are those control measures taken when technical, physical, and personnel control measures are insufficient to deter and detect access by unauthorized persons.

b.	A custodian is anyone who has possession, knowledge, or is charged with the protection of classified information.

9.	Storage and Physical Security

a.	"SECRET" and "CONFIDENTIAL” material will be stored in a GSA-approved security container or GSA-approved vault. Collateral "TOP SECRET" material will be stored within a GSA-approved vault protected by IDS.

b.	Standard Form 700, Security Container Information, will be maintained for each vault and container used to store classified. 

(1)	Part 1 of the SF 700 will be posted on the inside of the lock drawer of the security container, or on the inside of the vault door.

(2)	Parts 2 and 2A of the SF 700 will be marked with the highest level of classification of material to be stored within the container.

(3)	Further, part 2A will be detached from the document and inserted into the envelope portion of the form. This document is required to be stored at the next level command.

c.	Security container locks are required to be changed:

(1)	When first placed into use.

(2)	When personnel knowing the combination no longer require access.

(3)	When the combination has been subject to possible compromise.

(4)	At least annually.

(5)	When taken out of service (combination is reset to factory standard, 50-25-50).

d.	The top of all security containers are to be kept clear at all times so that classified material is not mixed in with other, unclassified materials. The only items to be stored on top of such containers are:

(1)	SF 702, Security Container Check Sheet.

(2)	OPEN / SECURED magnetic signs.

e.	Containers will not be marked with the level of classification contained within. Unit Security Managers will ensure that lock combinations are given only to those personnel with a specific need-to-know and appropriate clearance/access.

f.	Storage of classified information is not permitted in personal residences, on or off the military installation. Only in extreme and exceptional conditions can waivers to this policy be granted.

g.	The Secretary of the Army is the only approving authority for removal and storage of TOP SECRET information outside of approved US Government facilities.

h.	. Construction standards for vaults and secure rooms are listed and outlined in AR 380-5, Chapter 7.

10.	End of Day Security Checks

a.	Unit Security Managers will establish a system of security checks at the end of each workday. These checks will include all areas within the unit that are used to access, process, or store classified information. All unit members and employees will be specifically made aware of the requirement to secure all classified material to include SIPR lock boxes, containers, vaults, electronic media, etc.

b.	SF 701, Activity Security Checklist, will be used to record daily end of day security checks.  If needed, the unit security manager will prepare written appointments or rosters designating specific individuals, by name, responsible for conducting end of day security checks. End of day security checks do not relieve individuals of their responsibility to protect and secure classified material in their custody.

c.	End-of-day security checks will minimally include:

(1)	All security containers are properly locked and checked, and that SF 702 has been annotated and initialed.  If a security container is still in use at the time the end-of-day security check is performed, it is the responsibility of the individual assigned the security container to ensure that the security container is locked and checked before departing the office.

(2)	Check desktops and other surfaces to ensure they are free of classified material.

(3)	Check wastebaskets to ensure that they do not contain any classified material.

(4)	Check printers to ensure no classified document has been left laying out unprotected.

(5)	Ensure all hard drives have been properly secured in an approved security container.

(6)	Other safety and security related items deemed necessary by the Commander or unit security manager such as windows closed, coffee pots turned off, etc.

11.	Open Storage Areas / Secure Rooms

a.	Open storage of classified information will only be authorized when necessary for mission accomplishment or when the volume or size of the classified information prohibits storage in GSA approved security containers.  

b.	Entry and exit of secure areas will be controlled.  Inspections will be conducted on all personnel and equipment entering and exiting all controlled secure areas.

12.	Classified Meetings and Conferences

a.	All classified meetings and conferences will be accomplished in secure areas whenever possible. When secure areas are not available, the sponsoring unit security manager will ensure the following functions are performed, at a minimum:

(1)	Guards will be posted at all accessible entry points and cleared to the same level as the information being presented.

(2)	Cellular phones, cameras, and other electronic devices are not authorized to be present when classified information is being discussed or otherwise displayed.

(3)	Guards will have a valid Security Clearance Access Roster (SCAR) containing a list of all appropriately cleared individuals expected to attend the meeting.

(4)	If visitors arrive that are not listed on the SCAR, guards should confirm the person's need-to-know with the conference holder. A valid clearance does not mean automatic access to classified briefings and material ; a valid need-to-know must be verified.

(5)	Classified conversations must not be heard outside of the conference area, or else sound attenuation protection must be taken. This means that guards or other protective means are taken to secure the area from unauthorized people listening to the briefing.

b.	Classified meetings will not be held at locations other than US Government installations or cleared contractor facilities, without prior approval.

c.	Any classified meeting involving non-US government associations or foreign
h

 participation, require prior coordination with the Foreign Disclosure Representative.

13.	Transmission and Transportation

a.	The ideal method for transmitting classified is by sending through an approved secure network. Use of this method of transmission reduces the risk of unintentional disclosure and loss since all information stays within a secure network. 

b.	Couriers. When classified cannot be transmitted using an approved secure network, appropriately cleared personnel may be authorized to escort or hand carry between locations.  All personnel identified as Couriers will be appropriately cleared to the level of the material to be carried. 

(1)	Personnel designated by their commander to hand carry classified  within the boundaries of the installation will be issued a DD Form 2501, Courier Authorization, by the higher security manager. 

(2)	The unit security manager may issue the courier card up to the SECRET collateral level only. Under no circumstances will collateral TOP SECRET courier cards be issued without the consent of the Division Security Manager. Exceptions can be made for collateral TOP SECRET when the material is COMSEC in nature.  These exceptions must be coordinate through the higher security manager.

(3)	The Unit Security Manager is responsible for ensuring the designated courier has:

(a)	The proper clearance and access for the information to be carried.

(b)	Has been briefed of his/her responsibilities as a courier of US classified information and has signed the courier responsibility briefing.

(c)	Has in his/her possession a signed the DD Form 2501, Courier Card.

(4)	The Unit Security Manager will ensure that all associated documents are kept on file. 

(5)	When classified is required to be removed from the installation to another geographic location, courier orders must be issued.  The same basic procedures will be executed for courier orders as with the issuance of courier cards.  A courier responsibility brief and courier request form are required which will be reviewed and signed by the higher security manager when:

(a)	The travel is within the Continental United States (CONUS).

(b)	Material to be carried is at the SECRET collateral level or below.

(6)	Courier order requests will be forwarded to higher and then sent to the Division Security Manager (G2) for review and signature when travel is Outside the Continental United States (OCONUS) to include Canada.

c.	When classified is to be mailed, the following procedures will be followed:

(1)	The classified material will be enclosed in two opaque, sealed envelopes, wrapping, or containers durable enough to protect the material from accidental exposure and to ease in the detection of tampering.

(2)	The outer envelope will be addressed to an official US Government activity or cleared contractor.  It will indicate the complete return address of the sender and will not be addressed to a specific person. No classification markings will be used on the outer envelope.

(3)	The inner envelope will be marked with the complete address of the sender, the complete address of the recipient, and will have the level of classification clearly marked indicating the contents contained within. The inner envelope may be addressed to a specific person.

(4)	DA F01m 3964, Classified Document Accountability Record, will be included in all shipments of classified material.

(5)	AR 380-5, outlines the various authorized means of mailing classified material through the US Postal System and other US carriers authorized to ship classified information.

14.	Destruction

a.	Classified information must be destroyed by approved means as indicated in NSA/CSS EPL 04-02-H, NSA Evaluated Products List for Optical Media Destruction Devices.

b.	All classified information identified to be destroyed must be protected until destruction occurs.  This means that courier cards must accompany those personnel designated to destroy the material.  Additionally, those personnel accompanying the material will maintain 100 percent accountability of the material until completely destroyed.

15.	Education and Training

a.	The Unit Security Manager is responsible for ensuring that all assigned personnel within their respective unit(s) receive initial security orientations, annual security refresher briefings, security termination briefings, and other security related training.

b.	Security Managers must ensure that documentation of training is maintained on record for all assigned unit members. 

c.	The Unit Security Manager will ensure that all assigned personnel traveling outside the US and its territories receive an Area of Responsibility (AOR) threat update for the country visited within two months of travel. Threat updates can be obtained through the US Department of State and other official resources.

16.	Unauthorized Disclosure of Classified Information

a.	A security incident can be, but is not limited to:

(1)	Dissemination of classified information over an unclassified network, to include printing classified information to an unclassified printer.

(2)	Loss or failure to properly account for classified information.

(3)	Admission of an unauthorized or uncleared person into a secure classified area.

(4)	Disclosing classified information to uncleared personnel.

(5)	Failure to maintain control of a secure area.

b.	Proactive measures must be taken by everyone to ensure that classified information is not released to unauthorized persons, networks, and systems. It is the unit security manager's responsibility to ensure that good security practices exist within their unit(s).  This can be executed by getting key leaders involved in the security awareness process whenever possible and by proactively checking their unit areas for potentially problematic practices.

c.	Unauthorized disclosure should be reported to the unit security manager and higher security manager immediately. 

17.	Foreign Disclosure

a.	Foreign Disclosure is the conveying of classified and controlled unclassified information to an authorized representative of a foreign government.  Disclosure may be accomplished through oral, visual, or documentary media.  It is the process of sharing information from government to government which is essential to the successful execution of the Foreign Disclosure Program.

b.	Each unit is required to have two (2) trained Foreign Disclosure Representatives (FDR) per staff section down to the Battalion level.  FDRs serve as the subject matter expert (SME) for their respective unit/section regarding Foreign Disclosure policies and procedures.

c.	The disclosure of authorized classified information to any foreign national is to be strictly controlled. 

18.	Reproduction

a.	Classified information will be reproduced only when absolutely necessary for mission accomplishment, or when specifically required by other statutes, directives, or regulations.  Reproduced copies of classified information will be protected and controlled in the same manner as the original classified document.

b.	All requests for classified reproduction capabilities will be routed through the Division G-2 and G-6.  Unit Security Manager will identify reproduction equipment located within their unit authorized for the reproduction of classified information as follows:

c.	Reproduction of TOP SECRET information will be strictly controlled and is not authorized without the prior consent of the originator.

d.	Reproduction of SECRET and CONFIDENTIAL information which requires continuous control and accountability, or has special dissemination or reproduction limitations, will not be reproduced without the review and approval of the Unit Security Manager or other agency designated individual.  

19.	Controlled Unclassified Information (CUI)

a.	Controlled Unclassified Information must also be protected.  While the information need not be protected in the same manner as classified information it must still be protected from unauthorized disclosure.

b.	All CUI shall be protected as follows:

(1)	During working hours.  Reasonable steps should be taken to protect the information from unauthorized persons.   Such steps include use of appropriate cover sheets, secured in a desk drawer or filing cabinet when not physically in use.

(2)	After duty hours. Information should be locked in desks or filing cabinets when not in use.

20.	Threat Awareness and Reporting Program.

a.	The following information is provided as an overview to TARP training:

(1)	Training is required annually for all military and civilian employees.

(2)	Training must be conducted by a Counterintelligence Special Agent.  Documentation indicating training accomplishment must be maintained and presented during Command Inspections.

b.	As stated above with Annual Security Training, documentation of TARP training conducted will be uploaded into the system for future retrieval.  This information will be verified and inspected during Command Inspections and Staff Assistance Visits.

	FIRST M. LAST
 	XXX, XX
	Commanding

DISTRIBUTION: