22 U.S.C. § 4833: Serious Security Incident investigation process

A United States mission shall submit an initial report of a Serious Security Incident not later than 3 days after such incident occurs, whenever feasible, at which time an investigation of the incident shall be initiated. The Secretary shall notify the Committee on Foreign Relations of the Senate, the Committee on Foreign Affairs of the House of Representatives, the majority and minority leaders of the Senate, and the Speaker and minority leader of the House of Representatives not later than 8 days after a possible Serious Security Incident has been identified by the Department. Such notification shall include a preliminary description of the incident, of an incident described in paragraph (1), including any known individuals involved, when and where the incident took place, and the next steps in the investigation. an assessment of what occurred, who perpetrated or is suspected of having perpetrated the Serious Security Incident, and whether applicable security procedures were followed; in the event the Serious Security Incident involved a United States diplomatic compound, motorcade, residence, or other facility, an assessment of whether adequate security countermeasures were in effect based on a known threat at the time of the incident; if the incident involved an individual or group of officers, employees, or family members under Chief of Mission security responsibility conducting approved operations or movements outside the United States mission, an assessment of whether proper security briefings and procedures were in place and whether weighing of risk of the operation or movement took place; and an assessment of whether the failure of any officials or employees to follow procedures or perform their duties contributed to the security incident. The investigative team assembled pursuant to paragraph (3) shall consist of individuals from the Diplomatic Security Service who shall provide an independent examination of the facts surrounding the incident and what occurred. The Secretary, or the Secretary’s designee, shall review the makeup of the investigative team for a conflict, appearance of conflict, or lack of independence that could undermine the results of the investigation and may remove or replace any members of the team to avoid such an outcome. a detailed description of the matters set forth in subparagraphs (A) through (D) of subsection (a)(2), including all related findings; a complete and accurate account of the casualties, injuries, and damage resulting from the incident; and a review of security procedures and directives in place at the time of the incident. The investigative team investigating a Serious Security Incident shall adopt such procedures with respect to confidentiality as determined necessary, including procedures relating to the conduct of closed proceedings or the submission and use of evidence in camera, to ensure in particular the protection of classified information relating to national defense, foreign policy, or intelligence matters. The Director of National Intelligence shall establish the level of protection required for intelligence information and for information relating to intelligence personnel included in the report required under subsection (b). The Security Review Committee shall determine the level of classification of the final report prepared pursuant to section 4834(b) of this title , and shall incorporate the same confidentiality measures in such report to the maximum extent practicable.