Procedural Rules for the Assessment of Civil Penalties for Classified Information Security Violations