NIST 800-53 REV 5 • INCIDENT RESPONSE
IR-9 — Information Spillage Response
Respond to information spills by: Assigning {{ insert: param, ir-09_odp.01 }} with responsibility for responding to information spills; Identifying the specific information involved in the system contamination; Alerting {{ insert: param, ir-09_odp.02 }} of the information spill using a method of communication not associated with the spill; Isolating the contaminated system or system component; Eradicating the information from the contaminated system or component; Identifying other systems or system components that may have been subsequently contaminated; and Performing the following additional actions: {{ insert: param, ir-09_odp.03 }}.
Supplemental Guidance
Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
Practitioner Notes
Information spillage — when classified or controlled data ends up on a system not authorized to handle it — requires a specific response process. This is especially critical for defense contractors handling CUI or classified information.
Example 1: Create a spillage response procedure that covers: identifying the data involved, isolating affected systems, determining the scope of exposure, sanitizing or destroying affected media, and notifying the data owner. For CUI spills, follow your organization's CUI marking and handling guide.
Example 2: If someone emails a document containing CUI to a personal email account, your procedure should include: immediately recalling the email (if possible via Exchange admin center), confirming deletion from the recipient's mailbox, documenting the incident, and reporting it to your security officer. Use Microsoft Purview DLP policies to prevent future occurrences.