A Sample Cybersecurity Policy for a Small DoD Subcontractor

Disclosure: OrangeTop Systems is a fictional company, used here as a stand-in so the policy below can be shown with concrete specifics — employee counts, contact info, response windows — rather than staying abstract. The company doesn't exist. The framework it's built on does.

Most cybersecurity policy templates you'll find online are either too generic to be useful or written, and tailored specifically for a gigantic corporation. The reality is, there are plenty of small-to-mid-sized firms that land DoD contracts. Here's what a real one might look like for a 75-person firmware company that's trying to get compliant with NIST SP 800-171 and headed toward CMMC Level 2.

A few things worth pointing out before the policy itself:

It names actual roles (CEO, IT Security Team, Programming Team, Physical Security) instead of a vague "all employees are responsible" line, because a policy nobody owns doesn't get enforced.
It sets specific numbers instead of fuzzy ones — 24-hour access revocation, 1-hour incident reporting, 72-hour DoD notification. Vague timelines are how incident response plans fall apart under pressure.
It links out to the actual CUI marking guidance — the DoD CUI Program's training resources and the National Archives CUI Marking Handbook — rather than trying to reinvent marking rules from scratch.

Here's the policy:

Cybersecurity Policy

OrangeTop Systems (OTS)
Effective Date: April 1, 2025

Introduction

This Cybersecurity Policy outlines the measures OrangeTop Systems (OTS) will implement to safeguard its information systems, intellectual property, and sensitive data, including Controlled Unclassified Information (CUI) related to U.S. Department of Defense (DoD) contracts. The policy's purpose is to ensure the confidentiality, integrity, and availability of OTS's digital and physical assets while achieving compliance with NIST SP 800-171 and preparing for Cybersecurity Maturity Model Certification (CMMC) Level 2. It applies to all 75 employees, contractors, and third parties interacting with OTS systems or facilities. This policy is critical to protect our physical business, proprietary firmware designs, and secure future DoD contracts while continuing to support the CEO's growth vision by establishing a robust security foundation.

Policy Statement

OrangeTop Systems is committed to maintaining a secure environment for its operations by protecting sensitive information and systems from unauthorized access, disclosure, or compromise. We will implement industry-standard cybersecurity practices aligned with NIST SP 800-171 to safeguard CUI and meet DoD requirements. OTS pledges to enforce strict access controls, encrypt sensitive data, monitor threats, act ethically, and respond promptly to incidents, ensuring long-term compliance and operational resilience.

Roles and Responsibilities

OrangeTop Systems has many diversified roles and positions within its organizational body. Personnel at all levels are responsible for following this security policy and any additional department-specific policies and procedures.

CEO: Must approve this policy and any annual or conditional changes, and ensure resource allocation for compliance while overseeing strategic alignment with DoD contract goals.
IT Security Team (ITST): Will implement and enforce this policy. ITST will also manage network security, device hardening, and incident response in addition to conducting audits and reporting findings to management. ITST must also work with relevant departments to determine Controlled Unclassified Information in any communications or work product in accordance with the United States Department of Defense CUI Registry guidelines.
IT Staff: Is responsible for configuring systems and deploying security tools to support employee compliance. IT staff will work closely with the ITST to achieve and maintain the highest standard of system security in accordance with the NIST SP 800-171 framework.
Management and Department Leads: Will enforce policy adherence within their department and teams. This includes incorporating security awareness reminders during monthly team meetings, ensuring training completion, and reporting incidents to ITST within policy guidelines.
Programming Team: Will secure the development environment and work closely with ITST to tag CUI in firmware/programming projects to protect CUI and corporate IP, while following all data protection protocols recommended by standards or ITST.
General Employees: Must comply with security procedures, report suspicious activity, and participate in and complete required training.
Physical Security Team: Must monitor physical premises after hours, log incidents, and escalate reports to ITST or management as needed.

Technical Policies

While individual departments will certainly need to implement specific policies and procedures, the policies outlined below serve as a universal baseline standard that all personnel and departments must follow. Any specialized policies must enhance security beyond these measures and must be approved by the department head and the ITST manager.

Data Protection

Controlled Unclassified Information (CUI)
- All employees handling CUI are required to follow the guidelines for document marking.
  - The US DOD CUI document marking guide
  - The National Archives CUI Marking Handbook
- CUI must be marked on all systems. This includes (but is not limited to) individual document marking, folder marking, email attachment marking, and marking of physical media as designated CUI.
Sensitive data, including CUI (e.g., firmware designs, DoD specifications), must be encrypted at rest using AES-256 and in transit using TLS 1.3 across all systems.
CUI must be stored only on approved, encrypted devices or cloud platforms; unapproved personal devices or services are prohibited.
Daily encrypted backups of critical data and CUI will be stored offsite (secure cloud or physical vault) and tested monthly.
Physical copies of sensitive data must be locked in secure cabinets with access logged.
Data transfers outside OTS require ITST approval and encryption.

Access Control

Access to systems and CUI is restricted to authorized personnel based on job role (least privilege principle).
All accounts require unique IDs, strong passwords (12+ characters, alphanumeric, special characters), and multi-factor authentication (MFA) for CUI access or critical systems (e.g., server, cloud storage).
Physical access to sensitive areas (server room, programming labs) requires RFID badges with role-based PINs; logs are maintained.
The facility's main network will be segmented (general staff, programming, server/admin) with no crossover to the guest Wi-Fi network.
Inactive accounts are disabled after 60 days; terminated employee/contractor access is revoked within 24 hours.

Incident Response

An Incident Response Plan will be developed and tested annually, detailing steps for breaches involving CUI.
Employees must report suspected incidents (e.g., phishing, malware, unauthorized access) to ITST within 1 hour via [email protected] or (555) 987-6543.
ITST will: (1) assess and contain the incident, (2) eradicate the threat, (3) recover systems, and (4) document findings in an incident log.
If CUI is compromised, ITST will notify the CEO and DoD authorities within 72 hours, per contract requirements.
Post-incident reviews will identify root causes and update defenses.

Compliance and Auditing

OTS will comply with NIST SP 800-171 and prepare for CMMC Level 2 self-attestation, with third-party verification planned annually.
ITST will conduct quarterly internal audits of systems, access logs, and physical security, reporting to the CEO.
Network and system logs will be retained for 180 days for compliance and incident analysis.
Non-compliance (e.g., policy violations, unencrypted CUI) may result in disciplinary action or legal consequences under DoD regulations.

Training and Awareness

All employees must complete annual cybersecurity training covering CUI handling, phishing recognition, and NIST SP 800-171 basics.
New hires receive training within 30 days; programming staff get additional sessions on secure coding and CUI recognition/marking in work product.
Monthly awareness campaigns (e.g., emails, posters) will reinforce best practices, such as reporting suspicious activity.
ITST will simulate phishing and social engineering attacks quarterly to test employee vigilance.

Policy Review and Updates

This policy will be reviewed annually (by March 31) or after significant incidents, system changes, or regulatory updates.
The IT Security Team, in consultation with the CEO, is responsible for proposing and implementing updates, though all departments are encouraged to provide input in the update process.
Revised policies will be communicated to all employees via email and the intranet site, with acknowledgment required.

The Takeaway

A policy like this isn't really about the 72-hour number or the AES-256 line item — any compliance checklist has those. What makes it actually usable is that every section names who's responsible and by when. That's the part most templates skip, and it's the part that turns a document into something people can actually be held to.

Sources

U.S. Department of Defense. CUI Program Training Resources. DoD CUI Program.
National Archives and Records Administration. CUI Marking Handbook, Version 1.1.