|
I and few of my fellow employees were asking if it was okay to put FOUO (NSA issued) documents on SharePoint. The main justification was that its password protected (which is correct). But its a hosted site so we don't have ultimate control over the server. Thoughts? |
|||||
|
|
Ask your security officer, or your contact/security officer at the NSA (the originator). (When it comes to handling of classified or FOUO material, you probably should not be following security advice from the Internet anyway...) The cynic part of me says: FOUO means that the information isn't very sensitive; the primary sensitivity of it is that disclosure of the information to the public could be embarassing to some government employee. (If disclosure actually posed a danger to national security, it would be classified Secret or higher, not marked FOUO. The primary purpose of FOUO is to make sure the public doesn't read about it in the newspapers.) Embarassing a powerful government employee can be a career-limiting move. So, your primary concern should be to your own job security. Think about this from a CYA perspective: what do you need to do, to make sure you won't be blamed if the information gets leaked? The standard way to CYA is to make it someone else's decision. Find someone else who is responsible for making these decisions, ask them what they want done, document what they told you, and then do what they told you, whatever it is. That way, you can't be blamed: you were just following instructions, it's someone else's fault. |
||||
|
|
You can argue that since you can't get to the sharepoint without entering a password, that it is effectively password protected. NSA used to mark the employee newsletter FOUO and circulate it to employee's families. Very loose control of FOUO. There is precious little regulatory support for FOUO or CUI, and what there is differs greatly between Agencies. Less than a month after election the President quashed the effort to reform CUI and nothing has happened since then. @DW's answer is effectively correct. Check with the information owner and the system owner. Determine what their policies are, because they're probably much more useful and effective than the internet. |
|||
|
|
In this case they gave us the clear for sharepoint. |
|||
|
|
