Procedures for the SEcurity Review Committee (SRC)
procedures
(CT:ARB-5; 04-06-2026)
(Office of Origin: M/EX)
12 FAH-12 H-011 General
(CT:ARB-5; 04-06-2026)
General provisions, roles and responsibilities, and applicable definitions for the Security Review Committee are detailed in 12 FAM 030.
12 FAH-12 H-012 Incident review process
(CT:ARB-5; 04-06-2026)
12 FAH-12 H-012.1 Required Reporting of a Potential Serious Security Incident (SSI)
(CT:ARB-5; 04-06-2026)
a. Post shall submit an initial report of a potential serious security incident not later than three days after the incident occurs, or whenever feasible.
(1) Post leadership (COM, DCM, Principal Officer) and/or RSO of each diplomatic post, as well as those of a mission with an affected constituent post, is responsible for notifying State Operations and the Diplomatic Security Command Center (DSCC) of a potential SSI; and
(2) In practice, initial notification is typically made through the RSO following procedures outlined in 12 FAM 425.
b. After initial notification, an official cable must be sent as soon as possible, but no later than three days after an incident. The cable may be classified if necessary.
c. All reporting must include:
(1) Time and date of the event(s);
(2) Description of the event(s) with locations;
(3) Description of injuries/casualties without protected information;
(4) Description of damage to property(ies); and/or
(5) Description of intelligence activities in the case of a serious breach of security involving intelligence activities of a foreign government.
d. Any updated information, changes to the initial notification, or other pertinent information, must be communicated as soon as practicable.
12 FAH-12 H-012.2 Actions Upon Report of a Potential SSI
(CT:ARB-5; 04-06-2026)
DSCC and/or State Operations must notify the DS SRC Coordinator upon receipt of an incident report that reasonably may be categorized as an SSI, or updates to a previous report of an SSI. The DS SRC Coordinator can be notified at DS_SRC_Notification@state.gov or DS_SRC_Notification@state.sgov.gov
12 FAH-12 H-012.3 ASSESSMENT OF POTENTIAL ssi
(CT:ARB-5; 04-06-2026)
a. Upon receipt of a report of a potential SSI, the DS SRC coordinator in DS/MGT/PPD will notify M/EX. DS, M/EX, and L will then consult on an expedited basis to determine whether the reported incident potentially meets the statutory criteria of an SSI.
b. Subsequently, DS, M/EX, and L will coordinate an action memo from M/EX to the Secretary, when also seeking formation of an SRC, or to the Under Secretary for Management (M) that either recommends the formation of a SIT or describes the basis for finding that the reported incident does not potentially meet the criteria for an SSI. If there is a lack of consensus amongst DS, M/EX, and L, on whether the reported incident potentially meets the criteria for an SSI, M/EX will describe the divergent views when seeking a decision from M on whether to form a Security Investigative Team (SIT).
c. The Secretary and M retain the authority to make independent determination.
d. This process will be completed on an expedited basis to ensure the decisionmaker has the opportunity to direct the formation of a SIT within 10 days of the potential SSI as described in 12 FAH-12 H-012.1.
e. Within eight days of identifying a potential SSI, the Department shall notify the Committee on Foreign Relations of the Senate; the Select Committee on Intelligence of the Senate; the Committee on Appropriations of the Senate; the Committee on Foreign Affairs of the House of Representatives; the Permanent Select Committee on Intelligence of the House of Representatives; and the Committee on Appropriations of the House of Representatives. M/EX will coordinate with L and H on drafting the appropriate notification package which must include: a preliminary description of the incident, including any known individuals involved, when and where the incident took place, and the next steps in the investigation.
12 FAH-12 H-012.4 Formation of Security investigation Team (SIT)
(CT:ARB-5; 04-06-2026)
a. When the Secretary or M directs the formation of a SIT, the DS A/S will assemble the proposed team according to the following process:
(1) The DS SRC Coordinator will coordinate with DS/TIA/PII to identify DS personnel for the SIT;
(2) The SIT may include members from any directorate but normally will be led by the supervisory special agent from DS/TIA/PII assigned to the team;
(3) The DS A/S will review the proposed makeup of the SIT for any conflict, appearance of conflict, or lack of independence ensuring the SIT members:
(a) Do not have conflicts of interest or the appearance of conflicts;
(b) Are independent of the matter and persons they are to investigate;
(c) Have appropriate investigative backgrounds, or are serving as technical subject matter experts; and
(d) Have sufficient rank and experience to conduct such investigation.
b. DS will submit an action memo to M to approve the composition of the proposed SIT. When seeking M approval for the proposed SIT, DS will submit assignment history and other relevant background on the individuals who will form the SIT, and will document the process for reviewing conflict, appearance of conflict, or lack of independence. M endeavors to respond to DS's recommendation for the SIT composition within five business days of notification.
c. While the SIT will be comprised of DSS special agents, the team may need additional experts in the course of the investigation. As such, the SIT lead may require augmentation from other DS directorates and offices in support of the investigation (e.g., an expert on local guard forces from DS/IP/OPO). Should the SIT require consultation with an expert from another bureau (e.g., MED or OBO), the SIT will coordinate directly with the affected bureau to make its request, and in cases where a bureau is not responsive seek assistance from M to approve the required support. The SIT may modify the composition of the SIT, as necessary, with notification to M of any changes.
d. Consistent with standard procedures and as appropriate, DS will notify the Department of Justice or other investigative entities of any decision to establish a SIT as soon as possible after such a decision is made.
12 FAH-12 H-012.5 SIT Conduct of investigation
(CT:ARB-5; 04-06-2026)
a. To ensure the quality of the investigation, DS will follow the investigative procedures outlined in 12 FAH-4 Investigations Handbook, the SRC statute’s requirements, and best practices for maintaining independence when the subject of the investigation may involve policies, practices, and employees of the Department.
b. Upon M's approval of the SIT's composition, the SIT will immediately begin its independent, administrative investigation of the incident.
c. Consistent with the statute, the SIT must assess:
(1) What occurred;
(2) Who perpetrated or is suspected of having perpetrated the SSI;
(3) Whether applicable security procedures were followed;
(4) Whether adequate security countermeasures were in effect based on a known threat at the time of the incident in the event the potential SSI involved a U.S. diplomatic compound, motorcade, residence, or other facility;
(5) Whether proper security briefings and procedures were in place and whether weighing of risk of the operation or movement took place if the incident involved an individual or group of officers, employees, or family members under COM security responsibility conducting approved operations or movements outside the U.S. mission; and
(6) Whether any officials or employees failed to follow procedures or perform their duties and if so, whether this contributed to the security incident.
d. During the course of an investigation, the SIT may:
(1) Conduct voluntary interviews with U.S. employees, eligible family members, or contract personnel, or with authorization from the L/M, require an employee to participate in a compelled interview to respond orally and/or in writing to material and relevant questions related to their official duties and/or matters within SIT’s investigative mandate;
(2) Require employees to produce and/or grant access to official records and related documents or material;
(3) Require employees to produce and/or grant access to USG property, including communications equipment;
(4) Require employees to appear at a location designated by the SIT, in connection with an official inquiry;
(5) Direct employees to maintain the confidentiality (through use of Form DS-7678) of any information possessed or coming to the attention of the employee concerning the investigation, consistent with the provisions of the DS-7686; and
(6) Administer an oath and take sworn testimony during the course of an investigation as authorized under 5 U.S.C. 303.
e. Not later than 90 days after the occurrence of the potential SSI, the SIT will prepare and submit the Report of Investigation (ROI), through the DS SRC coordinator, to the SRC Secretariat that includes, at a minimum, the following elements:
(1) A detailed description of the matters set forth in subchapters 12 FAH-12 H-012.1(c), including all related findings;
(2) A complete and accurate account of the casualties, injuries, and damage resulting from the incident;
(3) A review of security procedures and directives in place at the time of the incident; and
(4) A finding of whether or not the SIT finds reasonable cause to believe any individual described in subchapter 12 FAH-12 H-012.1 has breached the duty of that individual or finds lesser failures on the part of an individual in the performance of his or her duties related to the incident.
f. To protect the independence of the investigation, the ROI will not be subject to regular DS clearance procedures but must be a finished written report that meets DS investigative standards.
g. During the investigation, the SIT Lead will keep the DS SRC coordinator apprised of the progress of investigation, including at a minimum, the estimated completion of the ROI.
12 FAH-12 H-012.6 SIT Factual findings prior to the SRC
(CT:ARB-5; 04-06-2026)
a. No later than 45 days after the incident occurs, or sooner if feasible, the SIT will provide preliminary findings to the SRC Secretariat for the SRC representatives' review. When appropriate, the SRC Secretariat may convene the SRC representatives-in support of the standing SRC members-to review the preliminary findings of the SIT and recommend one of the following courses of action:
(1) If there is a factual basis that the incident did not meet the statutory criteria for an SSI, DS, M/EX, L, and the appropriate regional bureau may recommend in the form of an Action Memo (AM) from the SRC chair to the Secretary that an SRC need not be convened and provide the factual basis for this recommendation. The standing SRC members must provide consensus on this recommendation;
(2) If additional information is required to address the statutory requirements and to ensure a thorough examination by the SIT in order to make an informed recommendation to the Secretary about whether to recommend the formation of an SRC for the incident, M/EX, as standing chair of the SRC, may recommend in an AM to the Secretary approval of an extension of 60-days to convene an SRC; and
(3) If there is a factual basis that the incident clearly meets the statutory criteria for an SSI (if not assessed upon initial reporting), M/EX, as the standing chair of the SRC, may recommend in an AM to the Secretary that an SRC be convened and the proposed membership of the SRC be based on the particular facts as described in the AM, including any appropriate participation by the assistant secretary-level representative from any involved USG department or agency. The Secretary retains the authority to direct chairmanship or membership of a particular SRC.
12 FAH-12 H-013 Convening a security review committee (SRC)
(CT:ARB-5; 04-06-2026)
12 FAH-12 H-013.1 Determination by the Secretary of State
(CT:ARB-5; 04-06-2026)
a. In any case of a serious security incident involving loss of life, serious injury, or significant destruction of property at, or related to, a USG diplomatic mission abroad, and in any case of a serious breach of security involving intelligence activities of a foreign government directed at a USG mission abroad, the Secretary shall convene a SRC.
b. The Secretary is not required to convene an SRC when the following statutory exceptions are met:
(1) If the Secretary determines that the incident involves only causes unrelated to security, such as when the security at issue is outside of the scope of the Secretary’s security responsibilities (2 FAH-2 H-116);
(2) If operational control of overseas security functions has been delegated to another agency (2 FAH-2 H-116);
(3) If the incident is a cybersecurity incident and is covered by other review mechanisms;
(4) In the case of an SSI that involves any facility, installation, or personnel of the Department of Defense with respect to which the Secretary has delegated operational control of overseas security functions to the Secretary of Defense; or
(5) If the SSI occurs in any countries identified in law for which the Secretary need not convene an SRC in the event of an SSI. For these countries, the Department must notify Congress of the decision and must conduct an inquiry under standard DS procedures.
c. The SRC is required to submit a written report to the Secretary detailing what occurred and addressing statutorily required determinations. See 12 FAH-12 H-013.3 Deliberations Phase.
d. The Secretary must submit the SRC's report to Congress not later than 90 days after receiving the report.
12 FAH-12 H-013.2 Steps following a Determination by the Secretary of State
(CT:ARB-5; 04-06-2026)
a. The Secretary shall convene an SRC following a determination in accordance with 12 FAH-12 H-013.1
b. The Secretary shall convene the SRC no later than 60 days after a potential SSI occurs or 60 days after the Department first becomes aware of such an incident, whichever is earlier. The 60-day period for convening an SRC may be extended for one additional 60-day period if the Secretary determines that the additional period is necessary.
c. Whenever the Secretary convenes an SRC, the Secretary shall promptly inform the chair and ranking member of: the Committee on Foreign Relations of the Senate; the Select Committee on Intelligence of the Senate; the Committee on Appropriations of the Senate; the Committee on Foreign Affairs of the House of Representatives; the Permanent Select Committee on Intelligence of the House of Representatives; and the Committee on Appropriations of the House of Representatives. M/EX will coordinate with L and H on drafting the appropriate Congressional notification.
d. The Secretary retains the authority to direct that a public board of inquiry be convened to investigate any security incident if the incident is of such magnitude or significance that an internal process is deemed insufficient to understand and investigate the incident. An SRC may recommend at any time that the Secretary convene such a follow-up public board of inquiry in the course of its work. As required by statute, all materials gathered during the procedures covering the initial reporting, the SIT, and an SRC shall be provided to any related board of inquiry convened by the Secretary. The participation and conduct of any such public board inquiry is at the discretion of the Secretary.
12 FAH-12 H-013.3 SRC procedures
(CT:ARB-5; 04-06-2026)
a. Upon receipt of the ROI prepared in accordance with 12 FAH-12 H-012.5 (c) and (e), the SRC chair will convene the SRC members convened by the Secretary in accordance with the procedures in 12 FAH-12 H-013.1 and commence review of the potential SSI. In the event the written ROI is not finalized and the SRC is prepared to begin its work, an SRC may request the SIT provide an oral briefing describing its preliminary assessments in advance of the submission of the ROI.
b. The SRC chair will be responsible for leading the SRC review and deliberations in accordance with the procedures set out in this section.
c. The SRC Secretariat and the SRC representatives will participate in the review and deliberations phases described below. The SRC Secretariat will circulate preliminary and/or written ROI and other necessary materials and generally support the standing SRC members in completing their required review, deliberations, and reporting.
d. The SRC will rely on the SRC Secretariat to convene the SRC representatives in support of the SRC members.
Review Phase:
a. The SRC gathers a full accounting of what happened by taking the following steps:
(1) review the ROI;
(2) review any other evidence, relevant reporting, and relevant information related to the serious security incident; and
(3) examine the facts and circumstances surrounding the potential SSI;
b. During this phase the SRC may pose questions consistent with the statute and in order to gather a full accounting of what happened to the SIT and any experts invited to attend the SRC meeting.
c. During this phase, the SRC may request the SIT undertake further investigative work, seek information from Department employees, request reporting, review other law enforcement investigative work as appropriate within the scope and authorities of the SRC.
Deliberations Phase:
a. Once an SRC is satisfied that it has gathered a full accounting of what happened, it will begin its deliberations phase. The deliberations phase is limited to participation by the SRC members, representatives, L, and the SRC Secretariat. The SIT will not participate in the deliberations phase, but an SRC may seek additional information from the SIT, as necessary.
b. The SRC chair will lead the SRC panel in its deliberations, ensuring that each SRC meets the statutory requirement to provide a full accounting of what occurred and make the required determinations:
(1) whether the incident was security related and constituted an SSI;
(2) if the incident involved a diplomatic compound, motorcade, residence, or other mission facility:
(a) Whether the security systems, security countermeasures, and security procedures operated as intended; and
(a) Whether such systems worked to materially mitigate the attack or were found to be inadequate to mitigate the threat and attack.
(3) Whether a valid process was followed in evaluating the requested operation and weighing the risk of the operation, which determination shall not seek to assign accountability for the incident unless the SRC determines that an official breached his or her duty if the incident involved an individual or group of officers conducting an approved operation outside the mission;
(4) The impact of intelligence and information availability, and whether the mission was aware of the general operating threat environment or any specific threat intelligence or information and took that into account in ongoing and specific operations; and
(5) Any other facts and circumstances that may be relevant to the appropriate security management of United States missions abroad.
c. Once these determinations have been made, the SRC chair will lead the SRC in discussing and finalizing any recommendations they will propose in their written report to the Secretary.
d. The SRC chair also will ensure the SRC undertakes its required review of any finding(s) by the SIT affirming a reasonable cause(s) to believe any individual breached the duty of that individual or finds a lesser failure on the party of an individual in the performance of his or her duties related to the incident. If the SRC finds reasonable cause to support the SIT's finding, it must report it to the Secretary for appropriate action.
Report Drafting Phase:
a. The SRC Secretariat will prepare in coordination with the SRC representatives and L a draft SRC written report as described in 12 FAH‑12 H-013.3 Deliberations Phase to reflect the determinations and recommendations made by the SRC during their deliberations.
b. The SRC Secretariat will share the draft written report with the SRC members and their representatives, as well as L. To protect the integrity of the SRC's deliberations, the report will not be further disseminated during the drafting process.
c. This phase may be completed without further in person meetings. The SRC chair will reconvene the panel for further discussion should an SRC member request the panel meet to discuss any element of the draft report.
d. The SRC will consult with L on any legal questions to ensure the report meets the requirements of the SRC statute.
12 FAH-12 H-013.4 WRITTEN REPORT TO THE SECRETARY
(CT:ARB-5; 04-06-2026)
a. Not later than 60 days after receiving the ROI, the SRC will submit to the Secretary a written report that includes the statutorily required determinations described in 12 FAH-12 H-013.3 Deliberations Phase and any related recommendations. The report will be submitted to the Secretary on behalf of the SRC by the SRC chair.
b. To ensure the integrity and independence of the SRC's review and that the statutory timelines are met, the SRC's submission of its written report to the Secretary will not be subject to standard clearance procedures with the exceptions of D, P, S/P, and C clearances.
d. Not later than 90 days after receiving the SRC’s report, the Secretary must submit the SRC’s report to the Committee on Foreign Relations of the Senate; the Select Committee on Intelligence of the Senate; the Committee on Appropriations of the Senate; the Committee on Foreign Affairs of the House of Representatives; the Permanent Select Committee on Intelligence of the House of Representatives; and the Committee on Appropriations of the House of Representatives. M/EX will coordinate with L and H on drafting the appropriate transmission package.
12 FAH-12 H-014 Implementation of SRC Recommendations
(CT:ARB-5; 04-06-2026)
a. After the Secretary completes a review of the SRC report to Congress, the Secretary's staff will direct the Executive Secretariat Staff (the Line) to:
(1) Task the appropriate bureaus with a Note to the Secretary for a ‑status update of the implementation of any recommendations within 120 days; and
(2) M/EX shall be listed as mandatory clearance.
b. Standing SRC members, if needed, may meet at least annually to review the SRC reports from the past 12 months and review all recommendations and flag unresolved recommendations for Line ‑follow-up. Additionally, the standing SRC members may discuss any trends or persistent gaps in security systems, countermeasures, and procedures and risk management processes. As appropriate, M/EX and DS may disseminate an ALDAC cable flagging any issues of global concern and highlighting best practices for bureau or mission consideration.