Classified data spills, explained

A data spill, which the official glossary calls spillage, is a security incident in which classified information or Controlled Unclassified Information (CUI) is transferred onto an information system not authorized to store or process it. That wording is from Committee on National Security Systems Instruction (CNSSI) 4009, in its 2022 edition, as the National Institute of Standards and Technology (NIST) glossary reproduces it. For the Department of Defense (DoD), DoD Manual (DoDM) 5200.01, Volume 3, dated February 24, 2012 and incorporating Change 3 of July 28, 2020, sets the handling rules. The manual treats every classified spill as a possible compromise until an inquiry decides whether an unauthorized disclosure occurred.

What makes it a spill

Enclosure 7, paragraph 5 of the manual names three cases. Classified data is introduced onto an unclassified system, onto a system at a lower classification level, or onto a system not accredited to process data of that restrictive category. The test is the receiving system's authorization. Whether anyone read the data does not decide it.

Paragraph 13 of the same enclosure gives an example of the third case. Sensitive Compartmented Information (SCI) must be processed on a system accredited for SCI, such as the Joint Worldwide Intelligence Communications System (JWICS). The Secret Internet Protocol Router Network (SIPRNET) is not accredited for SCI. Any transfer of SCI to SIPRNET is therefore a spill from a higher to a lower security domain, even when the data is marked SECRET//SI.

Other wording points the same way. NIST Special Publication (SP) 800-53, Revision 5, says in control IR-9 that spills occur when information thought to be one classification or impact level is sent to a system and later found to be higher. Enclosure 6 of the manual adds that classified information sent over communications circuits not approved for it, including e-mail and data links, is considered subjected to compromise. The manual names e-mail, in the body or an attachment, as the most common way spills occur.

Who must be told

The rule is immediate reporting. Under 32 CFR 2001.48, the government-wide directive under Executive Order 13526, anyone who knows classified information has been or may have been lost, compromised, or disclosed must report it at once to a designated official. DoDM 5200.01 Volume 3 sets the same duty for DoD civilians, military members, and contractor employees working with classified material under a contract. They report to the head of the local activity and the activity security manager, or to the next level up if those officials may be involved.

For spills, the manual summarizes Committee on National Security Systems (CNSS) Policy 18 of June 2006. A spill must be reported immediately to, at a minimum:

• The original classification authority (OCA)
• The information owner or originator
• The information assurance manager (IAM)
• The activity security manager
• The responsible computer incident response center

Some incidents go higher. The manual has the Director of Security in the Office of the Under Secretary of Defense for Intelligence and Security notified of cases such as a violation involving espionage, an unauthorized disclosure in the public media, or a disclosure that involves large amounts of classified information.

How a contaminated system is handled

CNSS Policy 18, as the manual describes it, requires two further steps right away. The spill is isolated and contained, to limit damage and preserve evidence. The information owner verifies that the data is classified and sees that an assessment is done. Until remediation is executed and verified, all affected media is considered classified at the level of the spilled information.

The manual's further guidance:

• Contaminated workstations, servers, and backup systems are isolated quickly to stop the spread.
• Remediation procedures must be developed, approved, and tested in advance.
• Backup servers, tape systems, and off-site storage mostly run nightly or in periods of low use, so early identification of where the data went avoids recontamination.
• For Secret and below, overwriting and sanitization allow media to return to service. No approved overwriting or sanitization exists for Top Secret, Special Access Program (SAP), or SCI media short of physical destruction, though such media may stay in use if reclassified at the higher level.

NIST control IR-9 lists matching steps: assign responders, identify the information, alert through a channel not tied to the spill, isolate the system, eradicate the information, and find other systems that were contaminated. CNSS Instruction 1001 of February 2008 supplies investigation questions and remediation options.

Who leads the response

The activity security manager has the overall lead and makes sure the steps for an unauthorized disclosure are met, such as inquiry, notification, investigation, and damage assessment. The manual has this done in close coordination with the information technology and information assurance staff, who operate the networks and hold the technical knowledge. The manual says information about a spill must be protected from disclosure. Communications about it go to those involved over secure means where possible, and remediation teams must be cleared to the level of the spilled information. Spills to personally owned devices are reported to security officials immediately.

Cleared contractors also answer to 32 CFR 117.8. A contractor reports any loss, compromise, or suspected compromise to its cognizant security agency (CSA), one of five agencies, DoD among them, that 32 CFR 117.3 names. The contractor begins a preliminary inquiry immediately, files an initial report if the inquiry confirms a loss, compromise, or suspected compromise, and files a final report after the investigation.

What to check

• Is the receiving system authorized or accredited for the classification and category of the data? If not, the transfer is a spill whether or not anyone read it.
• Was the spill reported at once, over secure means, to the parties CNSS Policy 18 names?
• Have backup servers, tape systems, and off-site copies been traced?
• Is affected media treated as classified at the spilled level until remediation is verified?
• For Top Secret, SAP, or SCI media, does the plan call for destruction or reclassification, since no approved overwrite exists?
• For a cleared contractor, did the preliminary inquiry, initial report, and final report reach the CSA?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1Spillage (glossary entry, source CNSSI 4009-2022) · NIST Computer Security Resource Center
2. 2DoD Manual 5200.01, Volume 3, DoD Information Security Program: Protection of Classified Information (February 24, 2012, incorporating Change 3, July 28, 2020) · Office of the Under Secretary of Defense for Intelligence and Security
3. 3NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations · National Institute of Standards and Technology
4. 432 CFR 2001.48 Loss, possible compromise or unauthorized disclosure · Electronic Code of Federal Regulations (Information Security Oversight Office)
5. 532 CFR 117.3 Acronyms and Definitions · Electronic Code of Federal Regulations (National Industrial Security Program Operating Manual)
6. 632 CFR 117.8 Reporting requirements · Electronic Code of Federal Regulations (National Industrial Security Program Operating Manual)

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.