Your security clearance does not give you approved access to all classified information. It gives you access only to:
Information at the same or lower level of classification as the level of the clearance granted; AND that you have a "need-to-know" in order to perform your work.
Need-to-know is one of the most fundamental security principles. The practice of need-to-know limits the damage that can be done by a trusted insider who goes bad. Failures in implementing the need-to-know principle have contributed greatly to the damage caused by a number of recent espionage cases.
Need-to-know imposes a dual responsibility on you and all other authorized holders of classified information:
When doing your job, you are expected to limit your requests for information to that which you have a genuine need-to-know. Under some circumstances, you may be expected to explain and justify your need-to-know when asking others for information.
Conversely, you are expected to ensure that anyone to whom you give classified information has a legitimate need to know that information. You are obliged to ask the other person for sufficient information to enable you to make an informed decision about their need-to-know, and the other person is obliged to justify their need-to-know.
You are expected to refrain from discussing classified information in hallways, cafeterias, elevators, rest rooms or smoking areas where the discussion may be overheard by persons who do not have a need-to-know the subject of conversation.
You are also obliged to report to your security office any co-worker who repeatedly violates the need-to-know principle.
Need-to-know is difficult to implement as it conflicts with our natural desire to be friendly and helpful. It also requires a level of personal responsibility that many of us find difficult to accept. The importance of limiting sensitive information to those who have a need to know is underscored, however, every time a trusted insider is found to have betrayed that trust.
Here are some specific circumstances when you need to be particularly careful:
An individual from another organization may contact you and ask for information about your classified project. Even though you have reason to believe this person has the appropriate clearance, you are also obliged to confirm the individual’s need-to-know before providing information. If you have any doubt, consult your supervisor or security officer.
Difficult situations sometimes arise when talking with friends who used to be assigned to the same classified program where you are now working. The fact that a colleague formerly had a need-to-know about this program does not mean he or she may have access to the information. There is no "need" to keep up to date on sensitive developments after being transferred to a different assignment.
The need-to-know principle also applies to placing classified information on computer networks. Before doing so, make sure it is appropriate for this information to be seen by all persons with access to the system. Although every individual gaining access to a particular computer network is cleared for the clearance level of that system, they may not have a need to know all of the information posted on the system.
