03.15.01 Policy and Procedures

This policy establishes the framework for the development, documentation, dissemination, review, and maintenance of organizational policies and procedures necessary to safeguard CU. This policy applies to all organizational personnel and roles with access to, or responsible for the handling of, CUI.

• A.03.15.01.ODP[01]: the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined.
• A.03.15.01.a[01]: policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
• A.03.15.01.a[02]: policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
• A.03.15.01.a[03]: procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
• A.03.15.01.a[04]: procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
• A.03.15.01.b[01]: policies and procedures are reviewed <A.03.15.01.ODP[01]: frequency>.
• A.03.15.01.b[02]: policies and procedures are updated <A.03.15.01.ODP[01]: frequency>.