§ 159a.45 - Investigation.

If it is determined that further investigation is warranted, such investigation will include the following:

(a) Identification of the source, date, and circumstances of the compromise.

(b) Complete description and classification of each item of classified information compromised;

(c) A thorough search for the classified information;

(d) Identification of any person or procedure responsible for the compromise. Any person so identified shall be apprised of the nature and circumstances of the compromise and be provided an opportunity to reply to the violation charged. If such person does not choose to make a statement, this fact shall be included in the report of investigation;

(e) An analysis and statement of the known or probable damage to the national security that has resulted or may result (See § 159a.15(k)), and the cause of the loss or compromise; or a statement that compromise did not occur or that there is minimal risk of damage to the national security;

(f) An assessment of the possible advantage to foreign powers resulting from the compromise; and

(g) A compilation of the data in paragraphs (a) through (f) of this section, in a report to the authority ordering the investigation to include an assessment of appropriate corrective, administrative, disciplinary, or legal actions. (Also see § 159a.100).