This subpart sets forth procedures for the receipt, storage, accountability, and transmission of classified information at the Office of Management and Budget. It is issued under the authority of Executive Order 12958, (60 FR 19825, 3 CFR, 1995 Comp., P.333), as implemented by Information Security Oversight Office Directive No 1 (32 CFR part 2001), and is applicable to all OMB employees.

The effective direction by supervisors and the alert performance of duty by employees will do much to ensure the adequate security of classified information in the possession of OMB offices. Each employee has a responsibility to protect and account for all classified information that he/she knows of within his/her area of responsibility. Such information will be made available only to those persons who have an official need to know and who have been granted the appropriate security clearance. Particular care must be taken not to discuss classified information over unprotected communications circuits (to include intercom and closed-circuit TV), at non-official functions, or at any time that it might be revealed to unauthorized persons. Classified information may only be entered into computer systems meeting the appropriate security criteria.

(a) EOP Security Officer. In cooperation with the Associate Director (or Assistant Director) for Administration, the EOP Security Officer supervises the administration of this section. Specifically, he/she:

(1) Promotes the correct understanding of this section and insures that initial and annual briefings about security procedures are given to all new employees.

(2) Provides for periodic inspections of office areas and reviews of produced documents to ensure full compliance with OMB regulations and procedures.

(3) Takes prompt action to investigate alleged violations of security, and recommends appropriate administrative action with respect to violators.

(4) Supervises the annual inventories of Top Secret material.

(5) Ensures that containers used to store classified material meet the appropriate security standards and that combinations to security containers are changed as required.

(b) Heads of Offices. The head of each division or office is responsible for the administration of this section in his/her area. These responsibilities include:

(1) The appointment of accountability control clerks as prescribed in § 1312.26.

(2) The maintenance of the prescribed control and accountability records for classified information within the office.

(3) Establishing internal procedures to ensure that classified material is properly safeguarded at all times.

Classified information may be made available to a person only when the possessor of the information establishes that the person has a valid “need to know” and the access is essential to the accomplishment of official government duties. The proposed recipient is eligible to receive classified information only after he/she has been granted a security clearance by the EOP Security Officer. Cover sheets will be used to protect classified documents from inadvertent disclosure while in use. An SF-703 will be used for Top Secret material; an SF-704 for Secret material, and an SF-705 for Confidential material. The cover sheet should be removed prior to placing the document in the files.

(a) The requirements of Section 4.2(a)(3) of Executive Order 12958 may be waived for persons who are engaged in historical research projects, or who previously have occupied policy-making positions to which they were appointed by the President. Waivers may be granted only if the Associate Director (or Assistant Director) for Administration, in cooperation with the EOP Security Officer:

(1) Determines in writing that access is consistent with the interest of national security;

(2) Takes appropriate steps to protect classified information from unauthorized disclosure or compromise, and ensures that the information is safeguarded in a manner consistent with the order; and

(3) Limits the access granted to former Presidential appointees to items that the person originated, reviewed, signed, or received while serving as a Presidential appointee.

(b) In the instances described in paragraph (a) of this section, the Associate Director (or Assistant Director) for Administration, in cooperation with the EOP Security Officer, will make a determination as to the trustworthiness of the requestor and will obtain written agreement from the requestor to safeguard the information to which access is given. He/She will also obtain written consent to the review by OMB of notes and manuscripts for the purpose of determining that no classified information is contained therein. Upon the completion of these steps, the material to be researched will be reviewed by the division/office of primary interest to ensure that access is granted only to material over which OMB has classification jurisdiction.

All classified material in the possession of OMB will be stored in a GSA-approved container or in vault-type rooms approved for Top Secret storage. Under the direction of the EOP Security Officer, combinations to safes used in the storage of classified material will be changed when the equipment is placed in use, whenever a person knowing the combination no longer requires access to it, whenever the combination has been subjected to possible compromise, whenever the equipment is taken out of service, or at least once a year. Knowledge of combinations will be limited to the minimum number of persons necessary, and records of combinations will be assigned a classification no lower than the highest level of classified information stored in the equipment concerned. An SF-700, Security Container Information, will be used in recording safe combinations. Standard Form-702, Security Container check sheet, will be posted to each safe and will be used to record opening, closing, and checking the container whenever it is used.

Classified material will be accounted for by the office having custody of the material. OMB Form 87, Classified Document Control, will be used to establish accountability controls on all Secret material received or produced within OMB offices. No accountability controls are prescribed for Confidential material, but offices desiring to control and account for such material should use the procedures applicable to Secret material. Information classified by another agency shall not be disclosed without that agency's authorization.

(a) Accountability Control Clerks. Each division or office head will appoint one person as the Accountability Control Clerk (ACC). The ACC will be the focal point for the receipt, routing, accountability, dispatch, and declassification downgrading or destruction of all classified material in the possession of the office.

(b) OMB Form 87. One copy of OMB Form 87 will be attached to the document, and one copy retained in the accountability control file for each active document within the area of responsibility of the ACC. Downgrading or destruction actions, or other actions removing the document from the responsibility of the ACC will be recorded on the OMB Form 87, and the form filed in an inactive file. Inactive control forms will be cut off annually, held for two additional years, then destroyed.

(c) Working papers and drafts. Working papers and drafts of classified documents will be protected according to their security classification, but will not be subject to accountability control unless they are forwarded outside of OMB.

(d) Typewriter ribbons. Typewriter ribbons, cassettes, and other devices used in the production of classified material will be removed from the machine after each use and protected as classified material not subject to controls. Destruction of such materials will be as prescribed in § 1312.29.

(e) Reproduction. Classified material will be reproduced only as required unless prohibited by the originator for the conduct of business and reproduced copies are subject to the same controls as are the original documents. Top Secret material will be reproduced only with the written permission of the originating agency.

The EOP Security Officer serves as the Top Secret Control Officer (TSCO) for OMB. He will be assisted by the Alternate TSCOs in each division/office Holding Top Secret material. The ATSCOs will be responsible for the accountability and custodianship of Top Secret material within their divisions/offices. The provisions of this section do not apply to special intelligence material, which will be processed as prescribed by the controlling agency.

(a) Procedures. All Top Secret material produced or received in OMB will be taken to the appropriate ATSCO for receipting, establishment of custodianship, issuance to the appropriate action officer, and, as appropriate, obtaining a receipt. Top Secret material in the custody of the TSCO or ATSCO will normally be segregated from other classified material and will be stored in a safe under his or her control. Such material will be returned to the appropriate ATSCO by action officers as soon as action is completed. OMB Form 87 will be used to establish custody, record distribution, routing, receipting and destruction of Top Secret material. Top Secret Access Record and Cover Sheet (Standard Form 703) will be attached to each Top Secret document while it is in the possession of OMB.

(b) Inventory. The Associate Director (or Assistant Director) for Administration will notify each appropriate OMB office to conduct an inventory of its Top Secret material by May 1 each year. The head of each office will notify the EOP Security Officer when the inventory has been satisfactorily completed. Each Top Secret item will be examined to determine whether it can be downgraded or declassified, and the inventory will be adjusted accordingly. Discrepancies in the inventory, indicating loss or possible compromise, will be thoroughly investigated by the EOP Security Officer or by the Federal Bureau of Investigation, as appropriate. Each ATSCO will retain his/her division's inventory in accordance with the security procedures set forth in this regulation.

Prior to the transmission of classified material to offices outside OMB, such material will be enclosed in opaque inner and outer covers or envelopes. The inner cover will be sealed and marked with the classification, and the address of the sender and of the addressee. The receipt for the document, OMB Form 87, (not required for Confidential material) will be attached to or placed within the inner envelope to be signed by the recipient and returned to the sender. Receipts will identify the sender, the addressee, and the document, and will contain no classified information. The outer cover or envelope will be sealed and addressed with no identification of its contents.

(a) Transmittal of Top Secret material. The transmittal of Top Secret material shall be by personnel specifically designated by the EOP Security Officer, or by Department of State diplomatic pouch, by a messenger-courier system specifically created for that purpose. Alternatively, it shall be taken to the White House Situation Room for transmission over secure communications circuits.

(b) Transmittal of Secret material. The transmittal of Secret material shall be as follows:

(1) Within and between the fifty States, the District of Columbia, and Puerto Rico: Use one of the authorized means for Top Secret material, or transmit by U.S. Postal Service express or registered mail.

(2) Other Areas. Use the same means authorized for Top Secret, or transmit by U.S. registered mail through Military Postal Service facilities.

(c) Transmittal of Confidential material. As identified in paragraphs (a) and (b) of this section, or transmit by U.S. Postal Service Certified, first class, or express mail service within and between the fifty States, the District of Columbia, and Puerto Rico.

(d) Transmittal between OMB offices and within the EOP complex. Classified material will normally be hand carried within and between offices in the Executive Office of the President complex by cleared OMB employees. Documents so carried must be protected by the appropriate cover sheet or outer envelope. Top Secret material will always be hand carried in this manner. Secret and Confidential material may be transmitted between offices in the EOP complex by preparing the material as indicated above (double envelope) and forwarding it by special messenger service provided by the messenger center. The messenger shall be advised that the material is classified. Receipts shall be obtained if Top Secret or Secret material is being transmitted outside of OMB. Classified material will never be transmitted in the Standard Messenger Envelope (SF Form 65), or by the Mail Stop system.

The destruction of classified material will be accomplished under the direction of the TSCO or the appropriate ATSCO, who will assure that proper accountability records are kept. Classified official record material will be processed to the Information Systems and Technology, Records Management Office, Office of Administration, NEOB Room 5208, in accordance with OMB Manual Section 540. Classified nonrecord material will be destroyed as soon as it becomes excess to the needs of the office. The following destruction methods are authorized:

(a) Shredding. Using the equipment approved for that purpose within OMB offices. Shredders will not accommodate typewriter ribbons or cassettes. Shredding is the only authorized means of Destroying Top Secret material.

(b) Burn bag. Classified documents, cassettes, ribbons, and other materials at the Secret level or below, not suitable for shredding, may be destroyed by using burn bags, which can be obtained from the supply store. They will be disposed of as follows:

(1) OEOB. Unless on an approved list for pick-up of burn bags, all other burn bags should be delivered to Room 096, OEOB between 8:00 a.m. and 4:30 p.m. Burn bags are not to be left in hallways.

(2) NEOB. Hours for delivery of burn bag materials to the NEOB Loading Dock Shredder Room are Monday through Friday from 8:00 a.m. to 9:30 a.m.; 10:00 a.m. to 11:00 a.m.; 11:45 a.m. to 1:30 p.m. and 2:00 p.m. to 3:30 p.m. The phone number of the Shredder Room is 395-1593. In the event the Shredder Room is not manned, do not leave burn bags outside the Shredder Room as the security of that material may be compromised.

(3) Responsibility for the security of the burn bag remains with the OMB office until it is handed over to the authorized representative at the shredder room. Accountability records will be adjusted after the burn bags have been delivered. Destruction actions will be recorded on OMB Form 87 by the division TSCO or by the appropriate ATSCO at the time the destruction is accomplished or at the time the burn bag is delivered to the U.D. Officer.

(c) Technical guidance. Technical guidance concerning appropriate methods, equipment, and standards for destruction of electronic classified media, processing equipment components and the like, may be obtained by submitting all pertinent information to NSA/CSS Directorate for Information Systems Security, Ft. Meade, Maryland 20755. Specifications concerning appropriate equipment and standards for destruction of other storage media may be obtained from the General Services Administration.

Any person who has knowledge of the loss or possible compromise of classified information shall immediately secure the material and then report the circumstances to the EOP Security Officer. The EOP Security Officer will immediately initiate an inquiry to determine the circumstances surrounding the loss or compromise for the purpose of taking corrective measures and/or instituting appropriate administrative, disciplinary, or legal action. The agency originating the information shall be notified of the loss or compromise so that the necessary damage assessment can be made.

(a) A security violation notice is issued by the United States Secret Service when an office/division fails to properly secure classified information. Upon discovery of an alleged security violation, the USSS implements their standard procedures which include the following actions:

(1) Preparation of a Record of Security Violation form;

(2) When a document is left on a desk or other unsecured area, the officer will remove the classified document(s) and deliver to the Uniformed Division's Control Center; and

(3) Where the alleged violation involves an open safe, the officer will remove one file bearing the highest classification level, annotate it with his or her name, badge number, date and time, and return the document to the safe, which will then be secured. A description of the document will be identified in the Record of Security Violations and a copy of the violation will be left in the safe.

(b) Office of record. The EOP Security Office shall serve as the primary office of record for OMB security violations. Reports of violations will remain in the responsible individual's security file until one year after the individual departs the Executive Office of the President, at which time all violation reports will be destroyed.

(c) Compliance. All Office of Management and Budget employees will comply with this section. Additionally, personnel on detail or temporary duty will comply with this section, however, their parent agencies will be provided with a copy of any security violation incurred during their period of service to OMB.

(d) Responsibilities for processing security violations—(1) EOP Security Officer. The EOP Security Officer shall provide OMB with assistance regarding Agency security violations. Upon receipt of a Record of Security Violation alleging a security violation, the EOP Security Officer shall:

(i) Prepare a memorandum to the immediate supervisor of the office/division responsible for the violation requesting that an inquiry be made into the incident. Attached to the memorandum will be a copy of the Record of Security Violation form. The receiving office/division will prepare a written report within five working days of its receipt of the Security Officer's memorandum.

(ii) Provide any assistance needed for the inquiry conducted by the office/division involved in the alleged violation.

(iii) Upon receipt of the report of inquiry from the responsible office/division, the EOP Security Officer will:

(A) Consult with the OMB Associate Director (or Assistant Director) for Administration and the General Counsel;

(B) Determine if a damage assessment report is required. A damage assessment will be made by the agency originating the classified information, and will be prepared after it has been determined that the information was accessed without authorization; and

(C) Forward the report with a recommendation to the OMB General Counsel.

(2) Immediate supervisors. Upon receipt of the EOP Security Officer's security violation memorandum, the immediate supervisor will make an inquiry into the alleged incident, and send a written report of inquiry to the EOP Security Officer. The inquiry should determine, and the related report should identify, at a minimum:

(i) Whether an actual security violation occurred;

(ii) The identity of the person(s) responsible; and

(iii) The probability of unauthorized access.

(3) Deputy Associate Directors (or the equivalent) will:

(i) Review and concur or comment on the written report; and

(ii) In conjunction with the immediate supervisor, determine what action will be taken to prevent, within their area of responsibility, a recurrence of the circumstances giving rise to the violation.

(e) Staff penalties for OMB security violations. When assessing penalties in accordance with this section, only those violations occurring within the calendar year (beginning January 1) will be considered. However, reports of all previous violations remain in the security files. These are the standard violation penalties that will be imposed. At the discretion of the Director or his designee, greater or lesser penalties may be imposed based upon the circumstances giving rise to the violation, the immediate supervisor's report of inquiry, and the investigation and findings of the EOP Security Officer and/or the OMB Associate Director (or Assistant Director) for Administration.

(1) First violation:

(i) Written notification of the violation will be filed in the responsible individual's security file; and

(ii) The EOP Security Officer and/or the Associate Director (or Assistant Director) for Administration will consult with the respective immediate supervisor, and the responsible individual will be advised of the penalties that may be applied should a second violation occur.

(2) Second violation:

(i) Written notification of the violation will be filed in the responsible individual's security file;

(ii) The EOP Security Officer and/or the Associate Director (or Assistant Director) for Administration will consult with the respective Deputy Associate Director (or the equivalent) and immediate supervisor and the responsible individual who will be advised of the penalties that may be applied should a third violation occur; and

(iii) A letter of Warning will be placed in the Disciplinary Action file maintained by the Office of Administration, Human Resources Management Division.

(3) Third violation:

(i) Written notification of the violation will be filed in the responsible individual's security file;

(ii) The EOP Security Officer and/or the Associate Director (or Assistant Director) for Administration will consult with the OMB Deputy Director, General Counsel, the respective Deputy Associate Director (or equivalent), and the immediate supervisor and the responsible individual who will be advised of the penalties that may be applied should a fourth violation occur; and

(iii) A Letter of Reprimand will be placed in the Disciplinary Action file maintained by the OA/HRMD.

(4) Fourth violation:

(i) Written notification of the violation will be filed in the responsible individual's security file;

(ii) The EOP Security Officer and/or the Associate Director (or Assistant Director) for Administration will consult with the OMB Director, Deputy Director, General Counsel, the respective Deputy Associate Director (or the equivalent), and immediate supervisor;

(iii) The responsible individual may receive a suspension without pay for a period not to exceed 14 days; and

(iv) The responsible individual will be advised that future violations could result in the denial of access to classified material or other adverse actions as may be appropriate, including dismissal.