Failure to properly downgrade information to a lower classification level is an example of a security infraction.

Failure to properly downgrade information to a lower classification level is an example of a security infraction.

• A. Not specified
• B. Sometimes
• C. True
• D. False

Answer: (D)

The main idea is how information handling and classification controls work. Downgrading information from a higher to a lower classification level is a controlled process that must follow policy and authorization. A security infraction usually means a breach of security policy that directly enables unauthorized access or disclosure. Failing to downgrade properly is a lapse in applying the right classification handling, an administrative/control failure, rather than an act that by itself constitutes an unauthorized release or deliberate policy breach. It represents a policy/controls failure that creates risk, but not an intrinsic security infraction. If the improper downgrade actually leads to disclosure to the wrong people, that would be a separate incident, but the act of failing to downgrade correctly in itself isn’t, by definition, a security infraction.

The main idea is how information handling and classification controls work. Downgrading information from a higher to a lower classification level is a controlled process that must follow policy and authorization. A security infraction usually means a breach of security policy that directly enables unauthorized access or disclosure. Failing to downgrade properly is a lapse in applying the right classification handling, an administrative/control failure, rather than an act that by itself constitutes an unauthorized release or deliberate policy breach. It represents a policy/controls failure that creates risk, but not an intrinsic security infraction. If the improper downgrade actually leads to disclosure to the wrong people, that would be a separate incident, but the act of failing to downgrade correctly in itself isn’t, by definition, a security infraction.