IR-9: Information Spillage Response

Control Family:

Incident Response

CSF v1.1 References:

PF v1.0 References:


  • Low


  • Moderate


  • High


  • Privacy


Previous Version:

Info icon.

Incorporates the following control from the previous version of the control set: IR-9(1): Responsible Personnel.

Control Statement

Respond to information spills by:

  1. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills;
  2. Identifying the specific information involved in the system contamination;
  3. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
  4. Isolating the contaminated system or system component;
  5. Eradicating the information from the contaminated system or component;
  6. Identifying other systems or system components that may have been subsequently contaminated; and
  7. Performing the following additional actions: [Assignment: organization-defined actions].

Supplemental Guidance

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Control Enhancements

IR-9(2): Training


(Not part of any baseline)

Provide information spillage response training [Assignment: organization-defined frequency].

IR-9(3): Post-spill Operations


(Not part of any baseline)

Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: organization-defined procedures].

IR-9(4): Exposure to Unauthorized Personnel


(Not part of any baseline)

Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls].