⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Public overview of eTrepid corporate information security governance, defense-in-depth controls, and risk management.
eTrepid Corporate Information Security Policy (Public Overview)
Governing Standard: NIST SP 800-171 Rev 2 / ISO/IEC 27001:2022
1. Governance Purpose and Authority
eTrepid Inc. maintains an integrated Information Security Management System (ISMS) designed to protect corporate information assets, customer enclaves, and Controlled Unclassified Information (CUI). This Public Overview summarizes the foundational security principles, management commitments, and operational control domains enforced across our organization.
Note: Proprietary network diagrams, specific internal IP allocations, and tool configuration parameters are excluded from this public document to maintain operational security.
2. Core Security Control Domains
flowchart TD
subgraph ISMS ["eTrepid Security Policy Framework"]
AC["Access Control & Identity (FIDO2 MFA)"]
CM["Configuration & Change Management"]
IR["Incident Response & 24/7 SOC Triage"]
CP["Cryptography & Boundary Defense"]
BC["Business Continuity & Air-Gapped DR"]
end
2.1 Access Control and Identity Governance
Zero Trust Baseline: Access to corporate networks, development workspaces, and client enclaves is governed by strict identity verification, device health evaluation, and least-privilege principles.
Phishing-Resistant MFA: Multi-factor authentication utilizing FIDO2 hardware tokens or cryptographic authenticator apps is mandatory for all employee accounts. Legacy SMS/voice MFA is prohibited.
2.2 System & Communications Protection
Cryptographic Standards: All data in transit across public or untrusted networks is encrypted using TLS 1.3 with FIPS 140-2/3 validated cryptographic algorithms. Data at rest across all endpoints and cloud stores is encrypted using AES-256.
Perimeter Defense: Boundary protection is enforced via next-generation firewalls, automated intrusion prevention (IPS), and Zero Trust Network Access (ZTNA) brokers.
2.3 Threat Detection, Logging, and Incident Response
Continuous Telemetry: Managed endpoints and cloud enclaves forward operational telemetry to the ThreatKrusher 24/7 Security Operations Center (SOC) for real-time correlation and automated behavioral analysis.
Centralized Audit Retention: System logs are collected centrally in write-once, tamper-evident stores with retention meeting federal audit baselines.
2.4 Vulnerability & Patch Management
Continuous Scanning: Internal and external assets undergo automated vulnerability scanning weekly. Critical and high vulnerabilities are remediated within expedited SLA windows.
Controlled Change Management: Production systems adhere to formal change control protocols requiring review, automated linting, testing, and approval before deployment.
3. Human Trust and Training
All eTrepid employees undergo comprehensive pre-employment screening, criminal background checks, and identity verification. Employees participate in mandatory security awareness training upon hire and quarterly thereafter, complemented by periodic phishing simulations.
