What should you do with classified information during an emergency?
For any company that holds a Facility Clearance (FCL) and is thus approved to access classified information, having a Facility Security Officer (FSO) who knows how to protect that material during emergencies is essential. Companies that hold or store classified information are known as possessing facilities. All are required to have an Emergency Action Plan (EAP), as outlined in 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM).
Some emergencies provide FSOs with more time to enact EAPs than others. Regardless of the situation, FSOs must act quickly when an emergency strikes to safeguard classified information without risking human life.
It falls on the FSO to execute an EAP, which covers possible emergency situations and is typically about 20 pages long. EAPs differ from one possessing facility to another, depending on which emergencies are more likely in a company’s location. Posting a one-page version of the EAP alongside a list of important contacts—including gas, electric, water and telephone companies, as well as the local fire department—can be a helpful reminder of what needs to be done for others cleared to access classified material. The EAP document and contact list should be placed beside the GSA-approved safe, near GSA shredders and by the facility’s main doorways.
Putting an EAP in motion requires strong document control. Ideally, all classified material will be locked in the facility’s safe before an evacuation. If that’s not possible, material outside the safe should be destroyed or, in the worst-case scenario, evacuated. In all cases, the FSO or their appointee should be the last to leave the facility and lock it. The FSO must keep their contract’s government agency, known as the Cognizant Security Agency (CSA), updated as the possessing facility’s emergency response unfolds.
How FSOs Can Plan for Anticipated Weather Emergencies
Some weather emergencies, such as blizzards, hurricanes and floods, can provide a day or two of warning before an office closure becomes necessary. With these weather events, there’s often time for you to ensure proper document control by locking all classified material in the facility’s safe before your facility closes. For water-prone areas, it’s best to have waterproof boxes or bags within the safe to prevent water damage to classified documents, computers and hard drives.
How FSOs Should Respond to Unexpected Environmental Emergencies
Other environmental emergencies unravel quickly. For incidents like tornadoes, earthquakes, wildfires and building fires, you must decide whether you have time to lock up classified information or need to destroy it instead.
In the event of a building fire, you should try to extinguish or control the blaze until firefighters arrive, if it’s safe to do so. If flames block access to the facility’s safe before all classified information is safely stored inside, you must destroy the material by shredding documents and smashing or melting computers and hard drives.
When there’s not enough time to lock up classified information or destroy it completely, you must evacuate the material in pre-designated locked bags, which possessing facilities should already have on hand. Depending on your company’s size, at least two people—usually you and your assistant—will be appointed to transport evacuated classified information. Having at least two people in charge of evacuated material is important for accountability, in case you are later called to testify about how the material was handled.
Once the classified information has been locked up, destroyed or evacuated, you must immediately contact your facility’s CSA, which will provide instruction on what your next steps should be. If evacuated, classified information cannot be quickly returned to your possessing facility, the CSA may send representatives to retrieve it from you or destroy it.
Steps for FSOs to Take During Evacuations Prompted by Civil Unrest
Some facility evacuations are necessitated by human actions, such as bomb threats or riots. Speed is key when a company is facing a bomb threat. In this scenario, you must lock up or destroy classified material as quickly as possible before leaving your facility.
During an uprising or riot, you must make sure all classified information is inside the locked SCIF. Every company with an FCL needs an intrusion detection system, and if the system alerts you to a breach, you’ll need to coordinate a “fire watch” with cleared employees standing guard in six-hour shifts until the situation is resolved.
Facilities will need to plan for a multitude of scenarios, including ones that aren’t likely to occur. It’s best to be overprepared when it comes to EAPs, so have plans for scenarios like natural disasters that may be less likely in your area. For example, many facilities in Texas would have needed an EAP for the ice storms in 2021, and this may not have been seen as a highly likely event prior to that.
In an emergency, it’s easiest to respond when there’s already a plan in place. Having an EAP is essential, but so too is ensuring the routine practice of proper document control. For any FSO with questions about how to create or execute an EAP, Adamo’s FSO support services can help make sure you are taking all the necessary precautions.
