Which scenario defines electronic spillage?

• A. Data is transferred securely within the same network
• B. When data is placed on an IT system possessing insufficient information security control to protect the data at the required classification
• C. Data is stored offline without encryption
• D. Data is backed up off-site

Answer: (B)

Electronic spillage happens when data that requires protection at a certain classification is placed on an IT system that cannot provide those protections. In this scenario, the data is moved to a system that does not have the necessary information security controls to safeguard it at that classification, creating a risk of unauthorized access or disclosure. The concept hinges on a mismatch between the data’s protection requirements and the system’s security capabilities, which is exactly what this situation describes. The other scenarios don’t involve processing or storing the data on a system that lacks proper controls, so they don’t meet the condition that defines spillage.