>NSA/CSS is developing a tool to automate submission of mission compliance incident reports across the NSA/CSS enterprise. The [REDACTED] will become the Agency's central tool for reporting potential mission compliance incidents and will provide a streamlined management process, a central repository, and metrics data to support root cause identification and trend analysis.
I'm rather surprised they've been in existence for this long but apparently do not yet have a centralized way of submitting and tracking misuse and leakage incidents. Even small organizations dealing with data that's not nearly as sensitive usually have systems in place to do this.
I interpreted this to mean they don't even seem to have a centralized internal incident response team at all? Or if so, perhaps a very small one. It almost sounds like they're just relying on managers and analysts to report incidents to their Office of the Inspector General by "good faith".
It's possible I'm wrong and they do have an existing system for this, but it's just mostly restricted to pen and paper instead of a database.
Either way, that doesn't sound like a good thing to me. An organization like the NSA should have some of the strictest oversight and compliance requirements imaginable, not this ad hoc "whoops one of my subordinates emailed TS data to some random people, sorry about that" via a phone call.