The nine reporting categories for the agency information security program are:
Personnel security
Physical security
Classification management
Declassification
Protection and maintenance for classified information systems
Operations security and technical surveillance countermeasures
Professional education, training, and awareness
Security management, oversight, and planning
Unique items