SECURITY POLICY PROJECT

Project Part 1: United States Compliance Laws

Student Name’

Institution Affiliation

Date

Project Part 1: United States Compliance Laws

Introduction

The Department of Defense (DoD) is in charge of protecting the United States from any potential dangers, and to accomplish this goal, robust IT security regulations and processes are required. The DoD depends on a network of IT service providers to offer the required technological services, and these providers are required to follow stringent security rules, standards, and controls that comply with DoD requirements (U.S. DoD, 2022). As a security expert working at Blue Stripe Tech, it is essential to have a grasp of the compliance rules that apply to the United States Department of Defense to develop security policies that are compliant with DoD standards for the IT infrastructure of the firm.

DOD-specific Requirements

The DoD has strict requirements for information systems and networks which process, store, and transfer confidential data. These requirements are detailed in numerous DoD directives and instructions (U.S DoD, 2019). One such requirement for a firm’s Information Technology (IT) infrastructure is the “Risk Management Framework” (RMF) for DoD IT. This framework offers a methodical and organized approach to the management of hazards connected to the operation and usage of DoD IT (U.S DoD, 2022). It covers all IT the DoD uses, including national security tools, calls for security controls, and constant monitoring. Another DoD-specific requirement for a firm's IT infrastructure is the Department of Defense Information Security Program. This program is responsible for establishing guidelines and processes for the protection of classified and regulated unclassified information within the information systems of the DoD. It comprises standards for the security of personnel, as well as needs for physical security and technology security (Carril & Duggan, 2020). A third requirement is the “Department of Defense Internet Services and Internet-Based Capabilities”. This directive lays out guidelines for how DoD internet services and web-based tools should be used, along with standards for the safety of networks, user authentication, and incident reporting.

U.S. Compliance Laws

Besides the DoD-specific requirements, Blue Stripe Tech is required to abide by any applicable U.S. compliance laws. One pertinent law is the Health Insurance Portability and Accountability Act (HIPAA). This law mandates uniform requirements for protecting electronic medical records and neccesitates covered firms to take administrative, physical, and technological measures to maintain the privacy, safety, and accessibility of this data (Yimam & Fernandez, 2018). In addition, the law requires covered entities to execute these safeguards in accordance with the law. Another law is the Federal Information Security Modernization Act (FISMA). FISMA mandates that all federal agencies create and implement comprehensive information security plans to ensure the privacy, integrity, and accessibility of data and computer systems (Yimam & Fernandez, 2018). The third U.S. compliance law that may affect the firm is the Sarbanes-Oxley Act (SOX). This law mandates that publicly traded corporations implement control mechanisms over their accounting practices to ensure the accuracy and reliability of their accounting records. If a company is traded on a public market and offers information technology services to the Department of Defense, then the company may be required to comply with SOX requirements. Lastly, another U.S. compliance law that may impact the firm is the Defense Federal Acquisition Regulation Supplement (DFARS). The DFARS details the rules contractors must follow when purchasing products and services for the Department of Defense (Yimam & Fernandez, 2018). Information security, data privacy, and logistics are only a few of the many topics addressed by these rules.

Conclusion

In conclusion, to provide information technology services to the AFCSC, Blue Stripe Tech must comply not only with the requirements specific to the DOD but also with compliance laws specific to the United States.

References

Carril, R., & Duggan, M. (2020). The impact of industry consolidation on Government Procurement: Evidence from Department of Defense Contracting. Journal of Public Economics, p. 184, 104141. https://doi.org/10.1016/j.jpubeco.2020.104141

U.S DOD. (2019). Online Information Management and Electronic Messaging. https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20Room/Personnel_Related/22-F-0350_DODI_8170.01-_Online_Information_Management_and_Electronic_Messaging_2Jan2019_CH-1_24Aug2021.pdf

U.S DOD. (2022). Risk Management Framework (RMF) for DoD Information Technology (IT) https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf

Yimam, D., & Fernandez, E. B. (2018). A survey of compliance issues in cloud computing. Journal of Internet Services and Applications, 7(1). https://doi.org/10.1186/s13174-016-0046-8