---

id: "IR-09" title: "Information Spillage Response" family: "IR" family_name: "Incident Response" sort_id: "ir-09" priority: "P2" implementation_level: "organization" enhancements: - ir-9.1 - ir-9.2 - ir-9.3 - ir-9.4

---

Statement

Respond to information spills by:

Assigning {{ insert: param, ir-09_odp.01 }} with responsibility for responding to information spills;

Identifying the specific information involved in the system contamination;

Alerting {{ insert: param, ir-09_odp.02 }} of the information spill using a method of communication not associated with the spill;

Isolating the contaminated system or system component;

Eradicating the information from the contaminated system or component;

Identifying other systems or system components that may have been subsequently contaminated; and

Performing the following additional actions: {{ insert: param, ir-09_odp.03 }}.

Guidance

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Assessment Objective: {{ insert: param, ir-09_odp.01 }} is/are assigned the responsibility to respond to information spills;

Assessment Objective: the specific information involved in the system contamination is identified in response to information spills;

Assessment Objective: {{ insert: param, ir-09_odp.02 }} is/are alerted of the information spill using a method of communication not associated with the spill;

Assessment Objective: the contaminated system or system component is isolated in response to information spills;

Assessment Objective: the information is eradicated from the contaminated system or component in response to information spills;

Assessment Objective: other systems or system components that may have been subsequently contaminated are identified in response to information spills;

Assessment Objective: {{ insert: param, ir-09_odp.03 }} are performed in response to information spills.

Incident response policy

procedures addressing information spillage

incident response plan

system security plan

records of information spillage alerts/notifications

list of personnel who should receive alerts of information spillage

list of actions to be performed regarding information spillage

other relevant documents or records

Organizational personnel with incident response responsibilities

organizational personnel with information security responsibilities

Organizational processes for information spillage response

mechanisms supporting and/or implementing information spillage response actions and related communications