JM 3-15.160
The DOSM is responsible for immediately reporting to EOUSA any situation that: (1) involves possible or actual injury to employees, (2) results in loss of, or damage to, Government assets; or (3) affects or threatens the ability of a USAO to operate. Examples of reportable incidents include: threats to a USAO or its employees, regardless of whether the threat is related to the employees’ official duties; office break-ins; theft or loss of Government property; and discovery of computer viruses.
Security Incident Reports are submitted to report all other types of security-related incidents (e.g., bomb threats which do not directly involve a USAO, thefts of personal or Government property, disclosure of sensitive or classified information to unauthorized individuals, and discovery of computer viruses).
[updated February 2018]