Security Policy

Policy review date: 21 February 2021

Omnibond operates and stores production systems in approved cloud services adhering to NIST.SP.800-171r2 infrastructure requirements. Systems containing customer CUI are secured as outlined below and in compliance with FAR 52.204-21.

Access Control

• Limit system access to authorized users, processes, and devices.
• Limit access to permitted transactions and functions.
• Control CUI flow per approved authorizations.
• Separate duties and employ least privilege for accounts and roles.
• Prevent non-privileged users from executing privileged functions; capture in audit logs.
• Limit unsuccessful logon attempts; use session lock and automatic session termination.
• Monitor and control remote access; employ cryptography for remote sessions.
• Authorize wireless access; protect with authentication and encryption.
• Control mobile device connections; encrypt CUI on mobile platforms.

Awareness and Training

• Ensure personnel are aware of security risks and applicable policies.
• Train personnel for assigned information security duties.
• Provide security awareness training on insider threat indicators.

Audit and Accountability

• Create and retain audit logs; centralize through cloud logging (30+ day retention for CUI systems).
• Ensure user actions are uniquely traceable.
• Alert on audit logging failures; protect audit information from unauthorized access.
• Synchronize system clocks with an authoritative source.

Configuration Management

• Maintain baseline configurations and inventories throughout system lifecycles.
• Track, review, and approve changes; analyze security impact prior to implementation.
• Employ least functionality; restrict nonessential programs, ports, and services.
• Control and monitor user-installed software through change management.

Identification and Authentication

• Identify and authenticate users, processes, and devices before granting access.
• Use multifactor authentication for privileged and network access accounts.
• Enforce password complexity; prohibit reuse; store only cryptographically-protected passwords.

Incident Response

• Maintain incident-handling capability: preparation, detection, analysis, containment, recovery.
• Track, document, and report incidents to designated officials.
• Test incident response capability periodically.

Maintenance, Media Protection, and Personnel Security

• Perform maintenance through change management; sanitize equipment removed for off-site maintenance.
• Protect, mark, and control media containing CUI; sanitize before disposal.
• Screen individuals before authorizing access; protect systems during terminations and transfers.

Physical Protection and Risk Assessment

• Limit physical access; escort visitors; maintain physical access audit logs.
• Periodically assess risk; scan for vulnerabilities; remediate per risk assessments.

Systems and Communications Protection

• Monitor and protect communications at external and internal boundaries.
• Separate user and management functionality; deny network traffic by default.
• Employ FIPS-validated cryptography for CUI; protect CUI at rest and in transit.

System and Information Integrity

• Identify, report, and correct flaws timely; provide malicious code protection.
• Monitor security alerts; perform periodic and real-time scans.
• Monitor systems to detect attacks and unauthorized use.

Asset Management

• All computational assets maintained through the business office with inventory tracking.
• Company and customer assets returned within 24 hours of resignation or termination.

Employee Acceptable Use

Employees, consultants, and visitors will not: share network access; access another user's account; use resources for unauthorized private profit; impede legitimate use; send junk mail; violate laws; publish threatening or infringing content; or advocate violence.

Technology Disaster Recovery

Production assets reside in the cloud. Images of critical instances are maintained in different regions with configuration options for disaster recovery.

See also our Acceptable Use Policy. Security questions: infosec@omnibond.com