8
8
8
8
The IAEA defines sensitive information as, ‘information, the unauthorized disclosure (or modification, alteration, destruction or denial of use) of which could compromise nuclear security or otherwise assist in the carrying out of a malicious act against a nuclear facility, organization or transport’.
The IAEA recommends that sensitive information should be held on a ‘need to know’ and ‘need to hold’ basis, with information security given the same priority as physical security. This also applies to computer systems and networks, where access should be classified and access restricted to those who need to know.
However, it remains the responsibility of the competent authorities in each State to define its understanding of ‘sensitive information’, and for each organisation within that state to define its specific policies. Not all organisations will have a ‘clear desk’ policy, although adopting and enforcing such policies is an indicator of effective nuclear security culture. Other good management behaviours include adopting a visible security policy, providing staff with clear roles and responsibilities, and implementing information security.
In general, organisations holding nuclear and radiological material should be aware of insider threats. Vetting approval is only as good as the day it was given as numerous pressures may arise during the course of employment. As such, it is important to maintain appropriate checks on personnel – in the form of ‘aftercare’ – and implement information security, even within secure access areas.
Further Reading:
