----------------------------------------- ------------------------------------------- ------------------
  ![](media/image1.png){width="0.84375in"   **NASA Integrated Services Network\         Effective Date:
  height="0.78125in"}                       Policy Document**                           05/27/2008\
                                                                                        Expiration Date:
                                                                                        xx/xx/xxxx

  ----------------------------------------- ------------------------------------------- ------------------

**COMPLIANCE IS MANDATORY**

Top of Form

Bottom of Form

**Sensitive But Unclassified (SBU) Information Management**

**1.0 General**

1.1. NISN generates, receives, disseminates, and maintains an enormous
amount of information, much of which is of an unclassified/non-sensitive
nature with few restrictions on its use and dissemination.

1.2. Nothing in this document limits the protection afforded any
information by other provisions of law, including the exemptions to the
Freedom of Information Act, the Privacy Act of 1974, and the National
Security Act of 1947.

1.3. This document establishes a uniform process whereby NISN Sensitive
But Unclassified (SBU) information is identified and properly managed to
ensure disclosure to unauthorized persons is effectively prohibited.
This document does not supersede Agency policy. This document is
intended to compliment Agency policy and in the event a conflict is
encountered, the latest version of the Agency policy (NPR1600.1) will
have authority and must be followed.

1.4. SBU is always the property of the United States Government.
Individuals who remove SBU may be subject to disciplinary action up to
and including prosecution under Title 18 and Title 50 USC and other
applicable laws.

**2.0 Security Classification Reviews for NISN Projects**

2.1. Pursuant to NPR 7120.5B, 1.4.3.a.(b); 2.1.g.(3); 2.1.1.2;
2.1.1.3.k; et al., projects must conduct formal security reviews that,
in addition to personnel, physical, and information technology security,
shall include reviews for traditional information classification
security needs. Security reviews shall be undertaken to determine if
information used or produced as part of a project, meets the
requirements for designation as Sensitive But Unclassified (SBU)
controlled information. NISN Project managers will:

a\. Complete NASA Form 1733**,** "Information and Technology
Classification and/or Sensitivity Level Determination Checklist.\"

b\. Include the Form 1733 as permanent project documentation and in any
procurement related documentation.

2.2. If information surrounding or concerning the project is considered
to be SBU, the information shall be managed as prescribed in section 3.0
of this document.

**3.0 Sensitive But Unclassified (SBU) Controlled Information**

The Computer Security Act of 1987, Public Law 100-235, defines
\"sensitive information\" as \"any information, the loss, misuse, or
unauthorized access to or modification of which could adversely affect
the national interest or the conduct of Federal programs, or the privacy
to which individuals are entitled under Section 552a of Title 5, United
States Code (the Privacy Act) but which has not been specifically
authorized under criteria established by an executive order or an act of
Congress to be kept secret in the interest of national defense or
foreign policy.\"

3.1. With the exception of certain types of information protected by
statute, standard criteria and terminology defining the types of
information warranting designation as \"sensitive information\" does not
exist within the Federal government. Such designations are left to the
discretion of each individual agency. Therefore, NASA has determined
that official information and material of a Sensitive But Unclassified
(SBU) nature that does not contain national security information (and
therefore cannot be classified) shall be protected against inappropriate
disclosure by designating and handling such information as SBU in
accordance with the procedures set forth in NPR 1600.1.

3.2. Information, regardless of its form (digital, hard-copy, magnetic
tape, etc.), the release of which could cause harm to a person\'s
privacy or welfare, adversely impact economic or industrial
institutions, or compromise operations essential to the safeguarding of
NISN interests is designated as SBU to control or restrict its access.
Information designated as SBU shall be afforded appropriate protection
sufficient to safeguard it from unauthorized disclosure.

3.3. Within NASA and the Federal Government, such information had
previously been designated \"FOR OFFICIAL USE ONLY.\" This designation
was changed at NASA to \"Administratively Controlled Information\" for
clarity and to more accurately describe the status of information to be
protected. However, recent efforts to apply consistent terminology
across multiple federal agencies have prompted NASA to change the
designation to \"Sensitive but Unclassified.\" Therefore the caveat
\"SENSITIVE BUT UNCLASSIFIED (SBU)\" will be used to identify SBU
information within the NASA community when that information is not
otherwise specifically described and governed by statute or regulation.
The use of caveats other than SBU will be governed by the statutes and
regulations issued for the applicable category of information.

**4.0 Identification of SBU Information**

The failure to sufficiently identify information that requires
protection from disclosure may result in increased risk to life or
mission essential assets, damage to official relationships, monetary or
other loss to individuals or firms, or embarrassment to NASA.

4.1. The originator of information, or the official approving its
dissemination, must review the information for possible designation as
SBU prior to its use. In general, information to be designated as SBU
falls into one of the three categories described below. The criteria of
at least one of the following subparagraphs must be met to designate the
information as SBU:

a\. Information originated within or furnished to NISN that falls under
one or more of the exemption criteria of the Freedom of Information Act
(5 U.S.C. Â§552). However, designating information as SBU does not
represent that the information has been determined to be exempt from
disclosure under FOIA. Requests under FOIA, for information designated
as SBU, will be reviewed and processed in the same manner as any other
FOIA request.

b\. Information exempt or restricted from disclosure by statute,
regulation, contract, or agreement. The following are examples of such
information.

\(1\) Information subject to export control under the International
Traffic in Arms Regulations (ITAR) or the Export Administration
Regulations (EAR).

\(2\) Information disclosing a new invention in which the Federal
Government owns or may own a right, title, or interest (i.e. NISN
funded/developed software/applications code).

\(3\) Proprietary information of others provided to NASA under a
nondisclosure or confidentiality agreement.

\(4\) Source selection and bid and proposal information.

\(5\) Small Business Innovative Research Data, Limited Rights Data, and
Restricted Computer Software received in performance of NASA contracts.

\(6\) Information developed by NASA under a Space Act agreement and
subject to section 303(b) of the Space Act (42 U.S.C. 2454(b)).

\(7\) Information concerning or relating to private entity trade secrets
or confidential commercial or financial information received by NISN.

\(8\) Information subject to the Privacy Act of 1974 (5 U.S.C. Â§552a).

c\. Information that is determined by a designated NASA official to be
unusually sensitive. The following are examples of such information.

\(1\) Pre-decisional materials such as Agency/NISN policy not yet
publicly released, pending reorganization plans, or sensitive travel
itineraries.

\(2\) Center maps and/or plain text documents describing
locations/directions (e.g., latitude, longitude, depth, etc.) of
underground utility conduits (e.g., sewers, gas, data, communications,
etc.).

\(3\) NISN Drawings and specifications that identify existing or
proposed security measures for Network infrastructure or other key
resources.

\(4\) Emergency contingency or continuity of operations plans that
provide detailed information regarding emergency response processes and
procedures that, if publicized, could give a potential adversary vital
information with which to thwart or compromise emergency response
efforts.

\(5\) Sensitive scientific and technical information (STI) (See NPD
2200.1 and NPR 2200.2 for requirements for documentation, approval, and
dissemination of NASA STI).

\(6\) Information that could result in physical risk to personnel. The
following are examples of such information.

-   Locations of personnel coupled with the physical protections of the
    facility or the criticality of the work being performed at said
    facility

-   Any physical vulnerabilities of facilities where personnel are
    assigned

-   Service/circuit termination facilities

\(7\) NASA information technology (IT) internal systems data revealing
infrastructure used for servers, desktops, and networks; applications
name, version and release; switching, router, and gateway information;
interconnections and access methods; mission or business use/need. The
following are examples of such information.

-   Systems inventories

-   Enterprise architecture models

-   IP address associated with a device, location or service it supports

-   Vendor circuit numbers associated with a location/facility or
    service/customer it supports

-   Device network name (DNS lookup vulnerability)

-   Internal operating system of network devices, desktops or
    workstations (allows targeting of specific OS vulnerabilities)

-   Applications/versions used for network management and control

\(8\) NISN Systems security data revealing the security posture of the
system. For example, threat assessments, system security plans,
contingency plans, risk management plans, Business Impact Analysis
studies, and Certification and Accreditation documentation.

\(9\) Reviews or reports illustrating or disclosing facility
infrastructure or security vulnerabilities, whether to persons, systems,
or facilities.

\(10\) Information that could constitute an indicator of NISN
intentions, capabilities, operations, or activities that the loss,
misuse, or unauthorized access to or modification of which could
threaten NISN operations. The following are examples of such
information.

-   Budgetary information

-   Activity schedules that divulge services affected, locations
    involved, point of contact information, and/or details of the
    infrastructure involved (HW/SW)

-   Project management information such as implementation details,
    schedules, impact assessments, coordination efforts, detailed design
    information

-   Teleconferencing information/arrangements when sensitive information
    may be discussed

    -   Agenda, Schedule, meet-me numbers with access codes, etc.

-   Outage notifications that divulge specific details pertaining to the
    degree/severity of services impacted, type and location of the
    outage, and infrastructure involved

-   Mission Freeze Exemption Requests that divulge detailed descriptions
    of the work to be performed, impact assessments, points of contact,
    etc.

\(11\) Developing or current technology, the release of which could
hinder the objectives of NISN, compromise a technological advantage or
countermeasure, cause a denial of service, or provide an adversary with
sufficient information to clone, counterfeit, or circumvent a process or
system. The following are examples of such information.

-   Detailed information pertaining to how NISN has/plans to
    integrate/implement technology

    -   IPv6, IP Address Management, 10gig, Firewalls, Intrusion
        Detection Systems, Routers, Servers, Network Management
        Systems/Applications, etc.

4.2. Information identified in paragraphs a. and b. below that has
designation and protection criteria established by other statutes,
regulations, NASA directives, etc., shall be protected and marked in
accordance with those applicable directives.

a\. Information or material that may already have individual, officially
designated identification, protection, or management requirements (e.g.,
FAR, FOUO, Export Control, FOIA, STI), and/or established markings on
the sheet(s) will be controlled in accordance with their respective
requirements. However, for the purpose of uniformity and consistency,
physical protection and disclosure requirements established for the
broader spectrum of SBU will still apply.

b\. Information exempted from disclosure by treaty, statute (e.g.,
Export Administration Regulations (EAR), International Traffic in Arms
Regulation (ITAR), and Section 303(b) of the Space Act), or other
agreements.

4.3. Other government agencies and international organizations may use
different terminology to identify sensitive information, such as
\"Limited Official Use (LOU),\" and \"Official Use Only (OUO).\" In most
instances the safeguarding requirements for this type of information are
equivalent to SBU. However, other agencies and international
organizations may have additional requirements concerning the
safeguarding of sensitive information. Follow the safeguarding guidance
provided by the other agency or organization. Should there be no such
guidance, the information will be safeguarded in accordance with the
requirements for SBU as provided in this document. Should the additional
guidance be less restrictive than in this document, the information will
be safeguarded in accordance with the requirements for SBU as provided
in this document.

4.4. Information shall not be marked or designated as SBU if it does not
meet the criteria in paragraph 4.1.

4.5. New material derived from documents marked SBU shall carry forward
the control marking from the source documents.

4.6. Marking for SBU

Information designated as SBU will be sufficiently marked so that
persons having access to it are aware of its sensitivity and protection
requirements. The lack of SBU markings on information known by the
holder to be SBU does not relieve the holder from safeguarding
responsibilities. Where the SBU marking is not present on information
known by the holder to be SBU, the holder of the information will
protect it as SBU. Information protected by statute or regulation will
be marked in accordance with the applicable guidance for that type of
information. Information marked in accordance with such guidance need
not be additionally marked SBU. Information designated SBU will be
marked as follows:

a\. Prominently mark the top and bottom of the front cover, first page,
title page, back cover and each individual page containing SBU
information with the caveat \"**SENSITIVE BUT UNCLASSIFIED (SBU)**.\"

b\. Materials containing specific types of SBU information may be
further marked with the applicable caveat, e.g., \"LAW ENFORCEMENT
SENSITIVE,\" in order to alert the reader of the type of information
conveyed. Where the sensitivity of the information warrants additional
access and dissemination restrictions, the originator may cite
additional access and dissemination restrictions. For example:

***WARNING:** This document is SENSITIVE BUT UNCLASSIFIED (SBU). It is
to be controlled, stored, handled, transmitted, distributed, and
disposed* of *in accordance with NASA policy relating to SBU
information. This information shall not be distributed beyond the
original addressees without prior authorization* of *the originator.*

c\. SBU information being transmitted to recipients outside of NASA, for
example, other federal agencies, state or local officials, NASA
contractors, etc., shall include the following additional notice:

***WARNING:** This document is SENSITIVE BUT UNCLASSIFIED (SBU). It
contains information that may be exempt from public release under the
Freedom of Information Act* (5 *U.S.C.* 552) or other applicable laws or
restricted from disclosure based on NASA policy. *It is to be
controlled, stored, handled, transmitted, distributed, and disposed of
in accordance with NASA policy relating to SBU information and is not to
be released to the public or other personnel who do not have* a *valid
\"need-to-know\" without prior approval of an authorized NASA official
(see NPR 1600.1).*

d\. Computer storage media, i.e., disks, tapes, removable drives, memory
sticks, etc. containing SBU information will be marked \"**SENSITIVE BUT
UNCLASSIFIED**.\"

e\. Portions of a classified document, i.e., subjects, titles,
paragraphs, and subparagraphs that contain only SBU information will be
marked with the abbreviation (SBU).

f\. Individual portion markings on a document that contains no other
designation are not required.

**5.0 Responsibilities**

5.1 NISN representatives designating information or materials as SBU and
those receiving materials so marked shall be responsible for properly
safeguarding the information contained therein. These individuals will:

a\. Comply with the safeguarding requirements for SBU information as
outlined in this document.

b\. Participate in formal classroom or computer based training sessions
presented to communicate the requirements for safeguarding SBU and other
sensitive information and the penalties that could result in
unauthorized disclosure of SBU information.

c\. Keep the number of copies of SBU information to a minimum.

5.2. NISN Project Management will:

a\. Ensure that an adequate level of education and awareness is
established and maintained to emphasize safeguarding and preventing
unauthorized disclosure of SBU information.

b\. Ensure that an adequate level of education and awareness is
established and maintained to emphasize that disclosing SBU information
without proper authority could result in administrative or disciplinary
action, fines and/or imprisonment.

c\. Take appropriate corrective actions, to include administrative or
disciplinary action as appropriate, when unauthorized disclosures of SBU
information occur.

5.3. Decontrol Provisions. Officers and employees designating
information or materials as SBU shall be held responsible for their
continued review and the prompt removal of such designations and
restrictive markings when the necessity no longer exists. Authority to
decontrol such material and any copies is limited to the official who
initially designated the material as SBU, a successor or superior, or an
official of an office having primary interest in the material. The
following procedures apply:

a\. The control status of any information or material designated as SBU
shall be reviewed upon request by an individual or individuals to whom
disclosure has been restricted. Such material shall be decontrolled and
disclosed unless the office of origin or the office of primary interest
determines, within a reasonable period of time after the request and
after consultation with legal counsel, that the information must remain
protected against disclosure. The existence of an SBU marking does not
necessarily make information exempt from disclosure. A determination
that information is exempt from disclosure must be based on the
applicability of some legal authority. Consultation with the Office of
the General Counsel at Headquarters or Center Office of Chief Counsel is
required.

b\. The restrictive marking on information designated as SBU shall be
immediately removed when the need for protection no longer exists,
(e.g., imminent public release, transfer to records archives,
implementation of organization plan, or conclusion of sensitive travel).

5.4. Storage, Access, Disclosure, Protection, Transmittal, and
Destruction of SBU. The minimum requirements for storage, access,
protection, transmittal, and destruction of SBU information is provided
in section 5.7 through 5.12, respectively. However, some types of SBU
information may be more sensitive than others and thus warrant
additional safeguarding measures beyond the minimum requirements
established in this document. For example, certain types of information
may be considered extremely sensitive based on the consequences of an
unauthorized release. Such consequences could be increased risk to life
or mission essential assets, damage to official relationships, or
embarrassment to NASA. Additional control requirements may be added as
necessary to afford appropriate protection to such information. NASA
employees, contractors, and detailees must use sound judgment coupled
with an evaluation of the risks, vulnerabilities, and the potential
damage to personnel or property as the basis for determining the need
for safeguards in excess of the minimum requirements and protect the
information accordingly.

5.5. Storage. Employees who handle information or material designated
SBU shall ensure the proper safeguarding of such information by limiting
its access to authorized persons only and by storing it in cabinets,
desks, or other containers, or securing it within an individual office
area when not in use. Access to SBU information is on a \"need to Know\"
basis.

a\. When unattended, SBU information will, at a minimum, be stored in a
locked file cabinet, locked desk drawer, a locked overhead storage
compartment such as a systems furniture credenza, or similar locked
compartment. SBU information can also be stored in a room or area that
has sufficient physical access control measures to afford adequate
protection and prevent unauthorized access by members of the public,
visitors, or other persons without a need-to-know, such as a locked
room, or an area where access is controlled by a guard, cipher lock, or
card reader.

b\. SBU information will not be stored in the same container used for
the storage of classified information unless there is a correlation
between the information. When SBU information is stored in the same
container used for the storage of classified materials, they will be
segregated from the classified materials to the extent possible, i.e.
separate folders, separate drawers, etc.

c\. NISN IT systems that store SBU information are certified and
accredited for operation in accordance with federal and NASA standards.
Consult the NPR 2810.1, Security Information Technology, for more
detailed information.

d\. Laptop computers and other media containing SBU information will be
stored and protected to prevent loss, theft, unauthorized access and
unauthorized disclosure. Storage and control will be in accordance with
the latest version of NPR 2810.1.

5.6. Access and Disclosure. SBU information of which NASA or a NASA
contractor is the originator may be disclosed to any Federal Government
employee or contractor who has a demonstrated \"need-to-know\" in
connection with official duties. When NASA is not the originating
agency, SBU information may be disclosed only with authorization from
the originating or designated action agency. Whenever SBU information is
disclosed, the recipient must be made aware of the following
restrictions on access and disclosure:

a\. In no case shall SBU information be disclosed - orally, visually, or
electronically - unless the disclosure is clearly in accordance with
existing law and Agency regulations or policy directives and is in the
best interest of NASA.

b\. Access to SBU information is based on \"need-to-know\" as determined
by the holder of the information. When discussing with or transferring
SBU information to another individual(s), the holder of the information
must ensure that the individual with whom the discussion is to be held
or the information is to be transferred has a valid need-to-know, and
that precautions are taken to prevent unauthorized individuals from
overhearing the conversation, or from observing or otherwise obtaining
the information. Where there is uncertainty as to a person\'s
need-to-know, the holder of the information will request dissemination
instructions from his/her next-level supervisor or the information\'s
originator.

c\. A security clearance is not required for access to SBU information.

d\. SBU information may be shared with other agencies, federal, state,
tribal, or local government and law enforcement officials, provided a
specific need-to-know has been established and the information is shared
in furtherance of a coordinated and official governmental activity.
Where SBU information is requested by an official of another agency and
there is no coordinated or other official governmental activity, a
written request will be made from the requesting agency to the
applicable NASA program office providing the name(s) of personnel for
whom access is requested, the specific information to which access is
requested, and basis for need-to-know. The NASA program office shall
then determine if it is appropriate to release the information to the
other agency official.

e\. When NASA is not the originating agency, further dissemination of
SBU information by the holder of the information may be made only with
authorization from the originating or designated action agency. When
information requested or to be discussed originated with another agency,
the holder of the information must comply with that originating
agency\'s policy concerning third party discussion and dissemination.

f\. The holder of the SBU information will comply with any access and
dissemination restrictions cited on the material, provided with the
material, or verbally communicated by the originator. Sensitive
information protected by statute or regulation, i.e., Privacy Act,
Critical Infrastructure Information, etc., will be controlled and
disseminated in accordance with applicable guidance for that type of
information. Where no guidance is provided, handle SBU information in
accordance with the requirements of this document.

g\. NISN IT Systems containing SBU shall be appropriately protected from
unauthorized access. Access shall be granted only after the requisite
security investigation for system access has been accomplished. In
addition, access provisions for FIPS 199 Security Categories shall apply
(reference the SSP for the specific system to be accessed for the FIPS
199 category that applies).

h\. When discussing SBU information over a telephone, the use of an
encrypted phone (such as, but not limited to Secure Telephone Equipment)
is encouraged, but not required.

5.7. Protection. When materials marked SBU are prepared for hard copy
dissemination or forwarded to any locations/persons (within or outside a
NASA Center), they must be protected using NASA Form 1686, \"**SENSITIVE
BUT UNCLASSIFIED**\" (SBU) cover sheet. Users shall check appropriate
boxes on the form to signify what type of SBU information is contained
in the document.

a\. When removed from an authorized storage location and persons without
a need-to-know are present, or where casual observation would reveal SBU
information to unauthorized persons, a SBU cover sheet (NASA Form 1686)
will be used to prevent unauthorized or inadvertent disclosure.

b\. When disclosing, disseminating, or transmitting SBU information, a
SBU cover sheet, (NASA Form 1686), should be placed on top of the
transmittal letter, memorandum, or material.

c\. When receiving SBU equivalent information from another government
agency, handle in accordance with the guidance provided by the other
government agency. Where no guidance is provided, handle in accordance
with the requirements of this document.

5.8. Transmittal. Transmission of SBU information may be made via first
class mail, courier, encrypted electronic transmission, or secure fax to
known recipients. All hard copy transmissions of SBU information require
a SBU cover sheet (NASA Form 1686) be transmitted with the information.
Additionally, the holder of the SBU information will comply with any
access, dissemination, and transmittal restrictions cited on the
material, provided with the material, or verbally communicated by the
originator.

a\. Transmission of hard copy SBU information within the U.S. and its
Territories:

\(1\) Material containing SBU information will be placed in a single
opaque envelope or container and sufficiently sealed to prevent
inadvertent opening and to show evidence of tampering. The envelope or
container will bear the complete name and address of the sender and
addressee, to include program office and the name of the intended
recipient (if known).

\(2\) Material containing SBU information may be mailed by U.S. Postal
Service First Class Mail or an accountable commercial delivery service
such as Federal Express or United Parcel Service.

\(3\) Material containing SBU information may be entered into an
inter-office mail system provided it is afforded sufficient protection
to prevent unauthorized access, e.g., sealed envelope. This would apply
to inter-office mail between offsite contractor facilities as well.

b\. Transmission of hard copy SBU information to Overseas Offices: When
an overseas office is serviced by a military postal facility, i.e.,
APO/FPO, SBU may be transmitted directly to the office via the military
postal facility. Where the overseas office is not serviced by a military
postal facility, the SBU information will be sent through the Department
of State, Diplomatic Courier.

c\. Electronic Transmission.

\(1\) Transmittal via fax. The use of a secure fax machine is highly
encouraged. However, unless otherwise restricted by the originator, SBU
information may be sent via non-secure fax. Where a non-secure fax is
used, the sender will coordinate with the recipient to ensure that the
SBU information faxed will not be left unattended or subjected to
possible unauthorized disclosure on the receiving end.

\(2\) Electronic Transmission

\(i\) SBU information transmitted via email, FTP, web, etc., should be
protected by encryption or transmitted within secure communications
systems. If it is not possible to transmit SBU via appropriately
encrypted channels, the information can be included as a password
protected attachment with the password provided under separate cover.
Recipients of SBU information will comply with any email or other
electronic transmission restrictions imposed by the originator.

\(ii\) SBU information shall not be sent to or from personal/ISP email
accounts that are not used or approved by the COTR in the course of
conducting NASA business.

\(3\) NASA Internet/Intranet

\(i\) SBU information will not be posted on the NISN public website or
any other public website.

\(ii\) SBU information may be posted on the NASA Intranet or other
government controlled or sponsored protected encrypted data networks.
However, the official authorized to post the information should be aware
that access to the information is open to all personnel who have been
granted access to that particular site. The official must determine the
nature of the information is such that need-to-know applies to all such
personnel; the benefits of posting the information outweigh the risk of
potential compromise; the information posted is prominently marked as
SENSITIVE BUT UNCLASSIFIED; and information posted does not violate any
provisions of the Privacy Act or other applicable laws.

5.9. Destruction. SBU information or material that cannot be
decontrolled or which is no longer needed shall be removed from IT
systems, shredded, burned, or destroyed in other similar methods that
preclude unauthorized disclosure. Destruction may be accomplished by:

a\. \"Hard Copy\" materials will be destroyed by shredding, burning,
pulping, pulverizing, such as to assure destruction beyond recognition
and reconstruction. After destruction, materials may be disposed of with
normal waste.

b\. Paper products containing SBU information will not be disposed of in
regular trash or recycling receptacles unless the materials have first
been destroyed as specified above.

c\. Electronic storage media shall be sanitized appropriately by
overwriting or degaussing, or non-recoverable encrypted deletion.
Contact NISN IT security personnel (Mission and Mission Support) for
additional guidance.

5.10. Disposal of IT Systems Containing SBU. Refer to NPR 2810.1 for
procedural requirements regarding clearing of hard drives, blackberries,
personal digital assistant (PDA\'s), and other storage mediums, prior to
disposal or recycling.

5.11. Incident Reporting. The loss, compromise, suspected compromise, or
unauthorized disclosure of SBU information will be reported. Incidents
involving SBU in NISN IT systems will be reported to the Center IT
Security Manager in accordance with IT incident reporting requirements
in NPR 2810.1.

5.12. Suspicious or inappropriate requests for information by any means,
e.g., email or verbal, shall be report to the NASA Center Chief of
Security.

5.13. Additional notifications to appropriate NASA management personnel,
e.g., line management, depending on the need to know and based on the
nature of the compromise, will be made without delay when the disclosure
or compromise could result in physical harm to an individual(s) or the
compromise of planned activities or on-going operations.

5.14. Administrative Violations and Sanctions. All NASA employees, as
well as non-employees, who have access to SBU are individually
responsible for complying with the provisions of this document and may
be subject to administrative sanctions if they disclose information
designated SBU without proper authorization.

5.14.1. Sanctions include, but are not limited to warning notice,
admonition, reprimand, suspension without pay, forfeiture of pay,
removal, and/or discharge.

5.14.2. Such sanctions may be imposed, as appropriate, upon any person
determined to be responsible for a violation of disclosure restrictions
in accordance with applicable law and regulations, regardless of office
or level of employment.