Information Technology and Data Security in Administration
Information Technology and Data Security in Administration
This domain tests how an administrative professional protects government information: access control, marking and handling of sensitive data, incident reporting, and acceptable use of government systems. The governing framework is FISMA, the Risk Management Framework, and DoD or agency cyber instructions.
Core rules and concepts
- Authorization to operate. Systems operate under an authorization from the authorizing official, produced through the RMF steps: categorize, select controls, implement, assess, authorize, monitor.
- Identity and access. Logical access uses the CAC or PIV credential with multifactor authentication. Credentials are never shared, and accounts are removed promptly when a person departs or changes duties.
- Marking and handling. Controlled unclassified information carries its required marking and is stored and transmitted only on approved channels. Classified material never goes on an unclassified system.
- Incidents. Suspected phishing, malware, lost devices, or classified spillage are reported immediately to the local cyber or information assurance office and the security manager - do not attempt to fix it quietly.
- Removable media. Use only government-furnished, approved media; personal drives and personal email for official business are prohibited.
- Training. Annual cyber awareness training is a condition of continued system access.
Worked example
An employee receives an email that appears to come from the commander asking for a roster of personnel with security clearance levels. Correct action: do not reply, do not forward the roster, and report the message to the cyber office using the phishing reporting button or help desk. Verify the request through a separate, known channel. The reasoning: the request combines a plausible authority figure, urgency, and sensitive data - the classic pattern of a business email compromise attempt - and the safe response is verification, not compliance.
Traps that cost marks
- Sharing a password or letting a colleague use your CAC-authenticated session.
- Forwarding CUI to a personal email account for convenience.
- Delaying incident reporting to avoid embarrassment.
- Assuming an email is genuine because the display name matches a senior official.