eTrepid GRC Roles & Workforce Trust Baseline
Governing Standard: NIST SP 800-171 3.9 (Personnel Security) / CMMC Level 2
1. Overview and Trust Baseline
The effectiveness of eTrepid's security and compliance posture depends upon the integrity, competence, and screening of our workforce. This standard defines the screening criteria, qualification baselines, and formal governance roles enforced across our organization.
2. Workforce Screening & Trust Qualifications
All eTrepid personnel with administrative, engineering, or compliance responsibilities undergo rigorous pre-employment vetting:
3. Governance and Security Role Definitions
flowchart TD
CEO["Executive Leadership / CEO"] --> CISO["Chief Information Security Officer (CISO)"]
CEO --> GRC["GRC & Compliance Director"]
CISO --> SOC["SOC Operations Director & ThreatKrusher SOC Engineers"]
CISO --> ENG["DevSecOps & Systems Engineering"]
GRC --> AUD["CMMC Practice Lead & Assessment Analysts"]
| Role Title | Governance Responsibilities | Minimum Qualifications |
|---|---|---|
| CISO | Executive ownership of corporate security policies, risk management, and incident response command. | CISSP / CISM; 10+ years defense IT security leadership. |
| GRC Director | Oversees CMMC, DFARS, and federal compliance advisory services; manages client audit defense. | CISA / CRISC; formally trained in CMMC Level 2 methodologies. |
| ThreatKrusher SOC Analyst | 24/7 telemetry monitoring, threat hunting, alert triage, and emergency host containment. | Sec+ / CySA+ / CEH; US Citizen; 24/7 rotational clearance. |
| Solutions Architect | Designs sovereign cloud enclaves (GCC High, Azure Gov) and Zero Trust network boundaries. | Microsoft Certified Cybersecurity Architect Expert / AWS Security. |
| FSO | Manages facility security clearances, visitor logs, and federal reporting compliance. | Formally trained Facility Security Officer (FSO). |