What to Report to the OIG Hotline
You should report to the NSA OIG Hotline information that you believe to be evidence of violation of law, regulation, or policy; mismanagement; gross waste of funds; abuse of authority; a serious threat to health or safety; or retaliation for reporting the same. You don't need to know the specific rule or policy that may have been violated, and you will be protected from reprisal as long as you reasonably believe that the information you are reporting falls under one of these categories, even if that ultimately proves not to be the case.
What Not to Report to the OIG Hotline
Things that are not appropriate for a Hotline complaint include: difference of opinion over office operations, strategy, or policy; personal disagreements; or mere speculation. If the information you wish to report is classified, do not report it through the unclassified website, but instead contact the NSA OIG to make appropriate arrangements.
Whistleblower Protection Page