Which of the following sets correctly lists the three COMSEC incident categories?

• A. Cryptographic, Personnel, Physical
• B. Cryptographic, Operational, Physical
• C. Cryptographic, Personal, Physical
• D. Cryptographic, Personnel, Administrative

Answer: (A)

Three COMSEC incident categories cover the main risk areas for compromising cryptographic materials. Cryptographic incidents involve any compromise of keys, algorithms, or crypto equipment; Personnel incidents arise from security breaches or improper handling by people with access to sensitive crypto; Physical incidents involve loss, theft, or damage to crypto materials or their secure containers. That makes the set Cryptographic, Personnel, Physical the correct one, because it aligns with the standard domains used for reporting and guiding response. The other options mix in terms that don’t represent official categories—Operational describes how crypto is used rather than an incident type, Administrative isn’t a recognized category, and Personal is a misspelling of Personnel. Knowing these three categories helps you classify incidents correctly and apply appropriate mitigations.