football/docs/SECURITY-BASELINES.md

Football Secure Access System - Security Baselines and Hardening Guide

Document Information

• System Name: Football Secure Access System
• Classification: Controlled Unclassified Information (CUI)
• Version: 1.0
• Effective Date: 2024-01-13
• Review Date: 2025-01-13

---

Table of Contents

1. Introduction
2. Security Baseline Overview
3. Initial Hardening Procedures
4. Baseline Verification
5. Ongoing Hardening Activities
6. Baseline Maintenance
7. Compliance Verification
8. Troubleshooting

---

1. Introduction

1.1 Purpose

This guide establishes security baselines for the Football Secure Access System and provides procedures for verifying and maintaining compliance with those baselines.

1.2 Scope

This guide applies to:

• All Football Secure Access System deployments
• All system administrators
• All security assessments and audits
• All compliance verification activities

1.3 Baseline Principles

1.3.1 Security by Default: All systems are built with security as the default configuration

1.3.2 Least Functionality: Only necessary components and services are installed

1.3.3 Defense in Depth: Multiple layers of security controls are implemented

1.3.4 Compliance by Design: All configurations meet regulatory requirements

1.4 Applicable Standards

• CIS Debian 13 Benchmark (Version 3.0.0)
• CMMC Level 3 (Department of Defense)
• FedRAMP Moderate (Federal Risk and Authorization Management Program)
• NIST SP 800-53 (Security and Privacy Controls)
• NIST SP 800-171 (Protecting Controlled Unclassified Information)

---

2. Security Baseline Overview

2.1 System Architecture Baseline

Hardware Configuration:

• UEFI Secure Boot: ENABLED
• TPM 2.0: PRESENT (if available)
• Physical ports: DISABLED (except for local administration)
• Removable media: DISABLED

Software Configuration:

• Operating System: Debian 13 (Trixie)
• Kernel: Latest security-patched version
• Packages: Minimal set (see packages.list)
• Services: Only required services enabled

Network Configuration:

• Physical Interface (eth0): WireGuard endpoint only
• Virtual Interface (wg0): All traffic through VPN
• Remote Access: DISABLED (no SSH, no other remote services)
• Firewall: Strict (WireGuard-only)
• DNS: Via VPN (10.100.0.1)

2.2 Security Control Baselines

2.2.1 Kernel Parameters (sysctl)

net.ipv4.ip_forward = 0                    # IP forwarding disabled
net.ipv4.conf.all.send_redirects = 0       # No ICMP redirects
net.ipv4.conf.all.accept_source_route = 0  # No source routing
net.ipv4.conf.all.accept_redirects = 0     # No ICMP redirects
net.ipv4.conf.all.rp_filter = 1            # Reverse path filtering
net.ipv4.tcp_syncookies = 1                # SYN cookies enabled
net.ipv4.conf.all.log_martians = 1         # Log martian packets
net.ipv4.icmp_echo_ignore_broadcasts = 1     # No ICMP broadcast response
kernel.sysrq = 0                            # SysRq disabled
kernel.randomize_va_space = 2                # ASLR enabled
fs.protected_hardlinks = 1                     # Hard link protection
fs.protected_symlinks = 1                    # Symlink protection
kernel.yama.ptrace_scope = 1                  # Ptrace restrictions

Verification:

sysctl -a | grep -E "ip_forward|send_redirects|accept_source_route|accept_redirects|rp_filter|tcp_syncookies|log_martians|echo_ignore_broadcasts|sysrq|randomize_va_space|protected_hardlinks|protected_symlinks|ptrace_scope"

2.2.2 Firewall Rules (iptables)

Chain Policies:

• INPUT: DROP
• FORWARD: DROP
• OUTPUT: DROP

Allowed Traffic:

# Loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# WireGuard on eth0 (only to endpoint)
iptables -A OUTPUT -o eth0 -d <WG_ENDPOINT_IP> -p udp --dport <WG_ENDPOINT_PORT> -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -s <WG_ENDPOINT_IP> -p udp --sport <WG_ENDPOINT_PORT> -m state --state ESTABLISHED -j ACCEPT

# DHCP on eth0
iptables -A OUTPUT -o eth0 -p udp --dport 67 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p udp --sport 67 -m state --state ESTABLISHED -j ACCEPT

# All traffic through WireGuard
iptables -A INPUT -i wg0 -j ACCEPT
iptables -A OUTPUT -o wg0 -j ACCEPT

Verification:

iptables -L -n -v
# Verify:
# - Chain policies are DROP
# - Only WireGuard endpoint allowed on eth0
# - DHCP allowed on eth0
# - All traffic allowed on wg0

2.2.3 Authentication and Passwords

Password Policy (pwquality.conf):

minlen = 14                     # Minimum length
lcredit = -1                    # At least 1 lowercase
ucredit = -1                    # At least 1 uppercase
dcredit = -1                    # At least 1 digit
ocredit = -1                    # At least 1 special character
difok = 3                       # Minimum 3 character changes
maxclassrepeat = 3               # Max 3 consecutive same class
maxrepeat = 3                    # Max 3 consecutive same character
enforce_for_root                # Enforce for root too

Login Configuration (login.defs):

PASS_MAX_DAYS 90                 # Password expires in 90 days
PASS_MIN_DAYS 1                 # Minimum 1 day between changes
PASS_WARN_AGE 7                 # Warn 7 days before expiration
LOGIN_RETRIES 5                 # Lock after 5 failed attempts
LOGIN_TIMEOUT 60                # 60 second timeout
UMASK 077                       # Secure umask
ENCRYPT_METHOD SHA512            # SHA512 password hashing

Account Lockout (faillock.conf):

deny = 5                        # Lock after 5 failed attempts
unlock_time = 900                # Unlock after 15 minutes
even_deny_root                  # Lock root too
root_unlock_time = 900            # Root unlock after 15 minutes

Verification:

# Check password policy
grep -E "minlen|lcredit|ucredit|dcredit|ocredit" /etc/security/pwquality.conf

# Check login.defs
grep -E "PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_WARN_AGE|UMASK|ENCRYPT_METHOD" /etc/login.defs

# Check account lockout
grep -E "deny|unlock_time" /etc/security/faillock.conf

2.2.4 Audit Rules (auditd)

Key Audit Rules:

# Monitor system calls
-w /usr/bin/sudo -p x -k privileged_cmd
-w /usr/bin/su -p x -k privileged_cmd
-w /usr/bin/passwd -p x -k privileged_cmd

# Monitor file access
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity

# Monitor configuration changes
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity

# Monitor cron jobs
-w /etc/crontab -p wa -k cron
-w /etc/cron.hourly/ -p wa -k cron
-w /etc/cron.daily/ -p wa -k cron
-w /etc/cron.weekly/ -p wa -k cron
-w /etc/cron.monthly/ -p wa -k cron
-w /var/spool/cron/ -p wa -k cron

# Monitor time changes
-w /etc/localtime -p wa -k time-change
-w /etc/timezone -p wa -k time-change

# Monitor network changes
-w /etc/hosts -p wa -k system-locale
-w /etc/network/ -p wa -k system-locale
-w /etc/wireguard/ -p wa -k system-locale

Verification:

# List loaded audit rules
auditctl -l

# Verify auditd is running
systemctl status auditd

2.2.5 Service Baselines

Required Services (ENABLED):

auditd                   # System auditing
rsyslog                   # System logging
wg-quick@wg0             # WireGuard VPN
cron                      # Job scheduling
systemd-logind            # Session management

Prohibited Services (DISABLED/MASKED):

ssh                       # Remote access (PROHIBITED)
sshd                      # Remote access daemon (PROHIBITED)
telnet                    # Remote access (PROHIBITED)
rsh                       # Remote access (PROHIBITED)
bluetooth                  # Wireless (PROHIBITED)
cups                      # Printing server (not needed)
nfs-common                # Network filesystem (PROHIBITED)
samba                     # File sharing (PROHIBITED)

Verification:

# List enabled services
systemctl list-unit-files | grep enabled

# Verify SSH is masked
systemctl status ssh
systemctl status sshd

# Verify Bluetooth is disabled
systemctl status bluetooth

2.2.6 File Permission Baselines

Critical File Permissions:

/etc/passwd             644 root:root
/etc/shadow             640 root:shadow
/etc/group              644 root:root
/etc/gshadow            640 root:shadow
/etc/sudoers           440 root:root
/etc/ssh/              600 root:root
/etc/ssh/sshd_config  600 root:root
/root                  700 root:root
/home/user             750 user:user

Directory Permissions:

/var/log               755 root:root
/var/log/audit        750 root:root
/etc                  755 root:root
/etc/security          700 root:root
/etc/sudoers.d       750 root:root

Verification:

# Check critical file permissions
stat -c "%a %U:%G %n" /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/sudoers

2.2.7 File Integrity Monitoring (AIDE)

AIDE Configuration:

Database: /var/lib/aide/aide.db
Scan frequency: Daily (via systemd timer)
Monitored directories:
  - /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin
  - /lib, /lib64, /usr/lib, /usr/local/lib
  - /etc (except volatile files)
  - /boot
  - /lib/modules

Verification:

# Check AIDE configuration
cat /etc/aide.conf

# Check AIDE database exists
ls -la /var/lib/aide/

# Check AIDE timer is enabled
systemctl status aide-check.timer

2.2.8 Logging Baselines

Log Retention:

/var/log/audit/         365 days
/var/log/               365 days
/var/log/security/      365 days
/var/log/sudo/         365 days
/var/log/firewall/      90 days
/var/log/wireguard/     90 days

Log Format:

• System logs: rsyslog (RFC 5424 format)
• Audit logs: auditd (binary format)
• Sudo logs: Plain text with timestamp

Verification:

# Check logrotate configuration
cat /etc/logrotate.d/cis-logs

# Verify log files exist
ls -la /var/log/audit/ /var/log/security/ /var/log/sudo/

# Verify rsyslog configuration
cat /etc/rsyslog.d/50-cis-logging.conf

---

3. Initial Hardening Procedures

3.1 Pre-Installation Checklist

Before deploying Football system:

• WireGuard keys generated and securely stored
• WireGuard endpoint IP and port confirmed
• UEFI Secure Boot enabled on target hardware
• Target hardware verified for Debian 13 compatibility
• Physical access controls verified
• Deployment authorization obtained

3.2 Build Process

The build script (build.sh) automatically applies all hardening:

1. Bootstrap minimal Debian 13

   • Uses debootstrap with minbase variant
   • Installs only required packages

2. Apply chroot overlay

   • Copies all configuration files
   • Implements all security baselines

3. Configure WireGuard

   • Generates WireGuard configuration from keys
   • Sets proper file permissions (600)

4. Run hardening script (harden.sh)

   • Disables remote access services
   • Configures strict firewall
   • Applies kernel parameters
   • Configures audit rules
   • Enables security services

5. Create bootable image

   • Sets up GPT partition table
   • Configures UEFI boot
   • Installs GRUB with password protection
   • Generates final images

3.3 Post-Installation Verification

After deployment, verify:

Step 1: Basic System Check

# Verify Debian 13
cat /etc/debian_version  # Should be "trixie/sid"

# Check kernel version
uname -r

# Verify boot mode
[ -d /sys/firmware/efi ] && echo "UEFI boot" || echo "Legacy boot"

Step 2: Verify WireGuard

# Check WireGuard status
sudo wg show

# Verify WireGuard interface
ip link show wg0

# Check WireGuard connection
ping 10.100.0.1  # Ping VPN server

Step 3: Verify Firewall

# Check firewall rules
sudo iptables -L -n -v

# Verify policies
sudo iptables -L | grep "Chain"
# Should show: Chain INPUT (policy DROP), Chain FORWARD (policy DROP), Chain OUTPUT (policy DROP)

Step 4: Verify Services

# Check critical services
systemctl status auditd rsyslog cron wg-quick@wg0

# Verify SSH is not running
systemctl status ssh sshd
# Should show: "masked" or "inactive"

Step 5: Verify Security Controls

# Verify kernel parameters
sudo sysctl -a | grep -E "ip_forward|tcp_syncookies|randomize_va_space"

# Verify password policy
grep -E "minlen|lcredit|ucredit" /etc/security/pwquality.conf

# Verify audit rules
sudo auditctl -l | head -20

# Verify AIDE
ls -la /var/lib/aide/aide.db

# Verify log files
ls -la /var/log/audit/ /var/log/security/

Step 6: Run Compliance Tests

# Run automated compliance verification
./tests/verify-compliance.sh

# Run full compliance test suite
./tests/compliance-test.sh

---

4. Baseline Verification

4.1 Automated Verification

Run the automated compliance verification script:

cd /home/charles/Projects/football
./tests/verify-compliance.sh

Expected Output:

================================================
Automated Compliance Verification
================================================

Verifying CIS Debian 13 Benchmark Implementation...
Verifying CMMC Level 3 Implementation...
Verifying FedRAMP Moderate Implementation...

[INFO] Checking prerequisites...

[PASS] Section 1: Filesystems Configuration
[PASS] Section 3: Network Configuration
[PASS] Section 4: Logging and Auditing
[PASS] Section 5: Access Control
...

================================================
COMPLIANCE VERIFICATION SUMMARY
================================================

Total Controls Verified: 150
Compliant: 145
Partially Compliant: 5
Non-Compliant: 0

Compliance Percentage: 96%

✓ SYSTEM COMPLIANT

The system meets compliance requirements for:
  ✓ CIS Debian 13 Benchmark
  ✓ CMMC Level 3
  ✓ FedRAMP Moderate
  ✓ NIST SP 800-171
  ✓ NIST SP 800-53 Moderate

4.2 Manual Verification Checklist

Complete this checklist after each deployment or significant change:

System Configuration:

• Debian 13 (trixie) installed
• Kernel is latest security-patched version
• UEFI boot enabled
• Secure Boot enabled (if supported)

Network Configuration:

• WireGuard configured with correct endpoint
• WireGuard interface (wg0) is UP
• Can ping VPN server (10.100.0.1)
• Firewall rules are correct
• All firewall policies are DROP
• No inbound services running

Security Controls:

• SSH is masked
• Telnet is not installed
• Bluetooth is disabled
• Wireless is disabled
• Auditd is running
• Rsyslog is running
• AIDE is configured
• AppArmor is enabled

Kernel Parameters:

• IP forwarding disabled
• Source routing disabled
• ICMP redirects disabled
• SYN cookies enabled
• ASLR enabled
• Core dumps disabled

Authentication:

• Password policy configured (14 char min, complexity)
• Password aging configured (90 days max)
• Account lockout configured (5 attempts)
• Umask set to 077
• SHA512 password hashing enabled

File Permissions:

• /etc/passwd: 644
• /etc/shadow: 640
• /etc/sudoers: 440
• /root: 700
• /home/user: 750

Audit and Logging:

• Audit rules loaded
• Audit logs being generated
• Security logs being generated
• Sudo logs being generated
• Log rotation configured
• Log retention meets requirements (365 days)

Compliance Tests:

• verify-compliance.sh passed
• compliance-test.sh passed
• All critical tests passed
• Compliance percentage >= 95%

---

5. Ongoing Hardening Activities

5.1 Daily Activities

Automated (via systemd timers):

• AIDE file integrity check runs daily
• Log rotation occurs automatically
• System log review for critical events

Manual:

• Review audit logs for critical security events
• Check WireGuard tunnel status
• Verify system is responding normally

5.2 Weekly Activities

Manual:

• Review failed login attempts
• Review administrative actions (sudo logs)
• Review security event alerts
• Check for security updates
• Verify audit logs are being generated

5.3 Monthly Activities

Manual:

• Review all audit logs
• Verify file integrity check results
• Check for unauthorized configuration changes
• Review system performance
• Verify security services are running
• Update security documentation if changes made

5.4 Quarterly Activities

Manual:

• Run full compliance test suite (compliance-test.sh)
• Review and update security baselines
• Conduct security assessment
• Review access controls
• Audit user accounts and access rights
• Review and update incident response procedures

5.5 Annual Activities

Manual:

• Conduct full security audit
• Review and update all security policies
• Conduct penetration testing
• Review and update incident response procedures
• Conduct security awareness training
• Review and update compliance documentation
• Re-authorize system (if required by organization)

---

6. Baseline Maintenance

6.1 Updating Baselines

When to update baselines:

• Security patches are applied
• System configuration changes
• New security requirements are identified
• Compliance standards are updated
• Security assessments recommend changes

Update Process:

1. Document need for baseline change
2. Obtain approval for change
3. Test change in non-production environment
4. Implement change in production
5. Verify compliance after change
6. Update baseline documentation
7. Update relevant policies and procedures

6.2 Re-Baselining After Changes

After any significant change:

1. Run AIDE database update

   sudo aide --init
   sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
   

2. Re-run compliance verification

   ./tests/verify-compliance.sh
   ./tests/compliance-test.sh
   

3. Update documentation

   • Update SECURITY-BASELINES.md
   • Update COMPLIANCE.md
   • Update relevant policies

4. Document change

   • Create change record
   • Include reason, impact, and test results
   • Store in change management system

6.3 Rollback Procedures

If baseline change causes issues:

1. Identify the problem

   • What is not working correctly
   • What security control is affected
   • What is the impact on operations

2. Assess rollback options

   • Can the change be reverted?
   • Is there a backup of previous configuration?
   • What is the risk of rollback?

3. Execute rollback

   • Restore previous configuration
   • Revert to previous AIDE database
   • Re-verify compliance

4. Document rollback

   • What was rolled back
   • Why it was rolled back
   • What was learned

---

7. Compliance Verification

7.1 CIS Debian 13 Benchmark Verification

Score Required: >= 90% (171/190 controls)

Verification Method:

# Run compliance test suite
./tests/compliance-test.sh | grep "CIS Benchmark"

Key CIS Controls to Verify:

• 1.1.1: Unused filesystems disabled
• 1.1.3: /tmp configured
• 3.1.1: IP forwarding disabled
• 3.2.8: TCP SYN cookies enabled
• 4.1.2: Audit records stored
• 5.2.1: SSH server not installed
• 5.4.1.1: Password creation requirements
• 5.4.2: Password hashing algorithm
• 6.1.1: System accounts secured

7.2 CMMC Level 3 Verification

Required: All 176 practices implemented

Verification Method:

# Run compliance test suite
./tests/compliance-test.sh | grep "CMMC"

Key CMMC Domains to Verify:

• AC (Access Control): All practices
• AU (Audit and Accountability): All practices
• CM (Configuration Management): All practices
• SC (System and Communications Protection): All practices
• SI (System and Information Integrity): All practices

7.3 FedRAMP Moderate Verification

Required: All 325 controls implemented

Verification Method:

# Run compliance test suite
./tests/compliance-test.sh | grep "FedRAMP"

Key FedRAMP Controls to Verify:

• AC-2: Account Management
• AU-2: Audit Events
• AU-6: Audit Review
• CM-2: Baseline Configuration
• SC-8: Transmission Confidentiality
• SI-7: Software and Firmware Integrity

7.4 Continuous Compliance Monitoring

Automated Monitoring:

• AIDE checks: Daily
• Audit rule validation: Daily
• Service status checks: Daily
• Firewall rule verification: Daily
• Kernel parameter verification: Weekly

Reporting:

• Daily: Critical security events
• Weekly: Security event summary
• Monthly: Compliance status report
• Quarterly: Full compliance review
• Annually: Comprehensive audit

---

8. Troubleshooting

8.1 Common Issues and Solutions

Issue 1: WireGuard Tunnel Not Connecting

Symptoms:

• Cannot ping VPN server (10.100.0.1)
• wg show shows interface down
• No traffic through wg0

Diagnosis:

# Check WireGuard status
sudo wg show

# Check WireGuard logs
sudo journalctl -u wg-quick@wg0

# Check network connectivity to endpoint
ping <WG_ENDPOINT_IP>

Solutions:

1. Verify endpoint IP and port are correct
2. Verify WireGuard keys are correct
3. Check firewall allows WireGuard traffic
4. Verify endpoint is accessible
5. Restart WireGuard service

   sudo systemctl restart wg-quick@wg0
   

Issue 2: Firewall Blocking Legitimate Traffic

Symptoms:

• Cannot access resources through VPN
• Connection timeouts
• Firewall drops shown in logs

Diagnosis:

# Check firewall rules
sudo iptables -L -n -v

# Check firewall logs
sudo tail -f /var/log/firewall.log

Solutions:

1. Verify WireGuard interface is UP
2. Check firewall rules include wg0 ACCEPT
3. Verify firewall policies are correct
4. Reload firewall rules

   sudo systemctl restart block-remote-access
   

Issue 3: Auditd Not Logging

Symptoms:

• No audit logs in /var/log/audit/
• auditctl shows no rules loaded
• Security events not captured

Diagnosis:

# Check auditd status
sudo systemctl status auditd

# Check audit rules
sudo auditctl -l

# Check audit logs
sudo tail -f /var/log/audit/audit.log

Solutions:

1. Restart auditd service

   sudo systemctl restart auditd
   

2. Reload audit rules

   sudo augenrules --load
   

3. Verify audit configuration

   cat /etc/audit/rules.d/cis-audit.rules
   

Issue 4: AIDE Check Fails

Symptoms:

• AIDE check reports many changes
• Unable to determine if changes are legitimate
• System appears compromised

Diagnosis:

# Run AIDE check
sudo aide --check

# Compare with expected changes
# (review system updates, configuration changes, etc.)

Solutions:

1. Identify legitimate changes (updates, config changes)
2. Verify no unauthorized changes
3. Update AIDE database if changes are legitimate

   sudo aide --init
   sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
   

4. If unauthorized changes found, follow incident response procedures

Issue 5: System Won't Boot

Symptoms:

• System hangs during boot
• UEFI boot menu not accessible
• GRUB error

Diagnosis:

# Check from UEFI shell or recovery media
# Review boot logs

Solutions:

1. Try booting from recovery image
2. Check GRUB configuration
3. Reinstall GRUB if needed
4. Verify UEFI Secure Boot settings
5. Contact system vendor if hardware issue suspected

8.2 Getting Help

Resources:

• Documentation: /usr/share/doc/compliance/
• Security Team: security@knel.org
• Infrastructure Team: infra@knel.org
• Compliance Officer: compliance@knel.org

Before requesting help:

1. Gather system information:

   uname -a
   cat /etc/debian_version
   ls -la /etc/security/
   

2. Gather diagnostic information:

   sudo systemctl status auditd rsyslog wg-quick@wg0
   sudo iptables -L -n -v
   sudo auditctl -l
   

3. Check logs:

   sudo journalctl -xe
   sudo tail -50 /var/log/audit/audit.log
   

4. Try basic troubleshooting steps from above
5. Document what you've already tried

---

Appendix A: Quick Reference Commands

System Status Commands

# System information
uname -a
cat /etc/os-release
cat /etc/debian_version

# Service status
systemctl status auditd rsyslog wg-quick@wg0
systemctl list-unit-files | grep enabled

# Network status
ip link show
ip addr show
sudo wg show
ping 10.100.0.1

Security Verification Commands

# Firewall
sudo iptables -L -n -v
sudo iptables-save | cat

# Kernel parameters
sudo sysctl -a | grep -E "ip_forward|tcp_syncookies|randomize_va_space"

# Audit
sudo auditctl -l
sudo systemctl status auditd

# File permissions
stat -c "%a %U:%G %n" /etc/passwd /etc/shadow /etc/sudoers

# Password policy
cat /etc/security/pwquality.conf
cat /etc/login.defs

Compliance Test Commands

# Automated verification
./tests/verify-compliance.sh

# Full compliance test suite
./tests/compliance-test.sh

# AIDE check
sudo aide --check

# Audit rule verification
sudo auditctl -l | wc -l

---

Related Documents

• Security Policy (docs/SECURITY-POLICY.md)
• Incident Response Procedures (docs/INCIDENT-RESPONSE.md)
• Compliance Mapping (COMPLIANCE.md)
• README.md (project documentation)
• QUICKSTART.md (build and deployment guide)

---

Document Control

• Owner: Security Team
• Approver: CISO
• Next Review: 2025-01-13
• Classification: CUI
• Version: 1.0
• Effective Date: 2024-01-13

---

End of Document