Tech R Us is a rapidly growing IT services provider that has recently won a large contract with the US Department of Defense (DoD). This contract is a high-priority, high-visibility project, and Tech R Us will be required to meet all DoD security standards in order to deliver its services.

This document provides a set of DoD-approved security policies, standards, and control descriptions for Tech R Us’ IT infrastructure. These policies, standards, and controls are designed to protect DoD data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Policies

1. Access Control

• All access to DoD systems and data must be controlled.
• Access must be granted on a need-to-know basis.
• Access must be revoked when no longer needed.

2. Awareness and Training

• All personnel working on DoD projects must be aware of DoD security policies and procedures.
• Personnel must be trained on how to protect DoD data and systems.
• Training must be provided on a regular basis.

3. Audit and Accountability

• All access to DoD systems and data must be audited.
• Audit logs must be reviewed on a regular basis to detect suspicious activity.
• Personnel must be held accountable for their actions.

4. Configuration Management

• All DoD systems and data must be properly configured.
• Changes to DoD systems and data must be controlled and documented.
• Systems and data must be configured in accordance with DoD security standards.

5. Contingency Planning

• Tech R Us must have a contingency plan in place to respond to security incidents.
• The contingency plan must be tested on a regular basis.

6. Incident Response

• Tech R Us must have an incident response plan in place to respond to security incidents.
• The incident response plan must be tested on a regular basis.
• Tech R Us must report all security incidents to DoD in a timely manner.

7. Information Security

• Tech R Us must protect DoD data from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Tech R Us must implement security controls to protect DoD data, including encryption, access control, and physical security.

8. Maintenance

• Tech R Us must maintain its DoD systems and data in a secure manner.
• Tech R Us must apply security patches and updates to DoD systems on a timely basis.
• Tech R Us must perform regular security audits of its DoD systems and data.

9. Media Protection

• Tech R Us must protect DoD media from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Tech R Us must implement security controls to protect DoD media, including encryption, access control, and physical security.

10. Personnel Security

• Tech R Us must screen all personnel working on DoD projects.
• Tech R Us must conduct background checks on all personnel working on DoD projects.
• Tech R Us must terminate the employment of any personnel who violate DoD security policies or procedures.

11. Physical Security

• Tech R Us must protect its DoD systems and data from unauthorized physical access.
• Tech R Us must implement physical security controls, such as access control systems, surveillance systems, and intrusion detection systems.

12. Risk Management

• Tech R Us must identify, assess, and manage the risks to its DoD systems and data.
• Tech R Us must implement security controls to mitigate the risks to its DoD systems and data.
• Tech R Us must monitor the risks to its DoD systems and data on a regular basis.

13. System Security

• Tech R Us must protect its DoD systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Tech R Us must implement security controls to protect its DoD systems, including access control, intrusion detection, and intrusion prevention.

14. Transmission Security

• Tech R Us must protect DoD data in transit from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Tech R Us must implement security controls to protect DoD data in transit, such as encryption and authentication.

Standards

The following standards are applicable to all DoD systems and data:

• Risk Management Framework (RMF)
• National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)
• DoD Information Security Program (DISP)
• DoD Instruction 8500.01E: Information Assurance (IA) Program

Control Descriptions

The following control descriptions are applicable to all DoD systems and data:

• Access Control: All access to DoD systems and data must be controlled. Access must be granted on a need-to-know basis. Access must be revoked when no longer needed.
• Awareness and Training: