Back to top

Report a Security Incident

SCEC Destruction Security Incident Report

Security Incidents - an obligation to report!

In the rare occurence that a security incident occurs with a destruction service, you must report the security incident. This reporting process is not driven to punish a destruction company, but rather, to identify the key problem and prevent it from happening again. A destruction company is expected to destroy classified material accordance with the endorsement criteria requirements - failure to do so, may result in a breach, a suspension, or revocation of their endorsement. SCEC does not pursue a security incident further if the wrong service has been ordered.

You may also report, in writing, any positive or negative feedback with a PSPF endorsed destruction company.

Security Incidents - what should you do?

A destruction company should immediately contact the government agency when a security incident has occurred or is occurring. A government agency should determine the next best course of action to secure their classified material. Such a decision must be put in writing with the destruction company as this may be used as evidence in an investigation.
 
The government agency must report any security incidents to SCEC within five days of the incident. Government agencies are responsible for conducting their own security investigation into the security incident—SCEC will assess a destruction company’s non-compliance with the PSPF endorsement criteria.
SCEC may support, or require information from, the security investigation.
 
Examples of a security incident include:
  • transportation vehicle left unattended for more than 15 minutes;
  • classified material stored overnight at the facility;
  • inappropriate destruction equipment used (ie wrong screen size) for level of classification;
  • theft, loss or compromise of classified material;
  • the handling of information by personnel who have not met the security checking requirements; and
  • any other issue relating to a breach of security
 
A security incident report form must be completed with as much detail as possible - name(s), date, time, location etc are essential pieces of information.

Please submit any security incidents using the SCEC Destruction Security Incident Report form or email us at scec@scec.gov.au