Patriot Field Rations, Inc.

Patriot Field Rations, Inc. maintains a risk-based access control program to ensure that only authorized individuals are granted access to information systems and data commensurate with their job responsibilities. Access to systems that store or process Controlled Unclassified Information (CUI) is explicitly limited to users whose roles require such access.

User accounts are provisioned based on HR-approved roles and are granted least-privilege access to domain, application, and data resources. All access requests must be documented via an approved access request form and authorized by the user’s manager and the system owner.

Access to CUI systems (including RationSpec, the Engineering File Server, and the GovCloud Collaboration Suite CUI library) requires multifactor authentication (MFA), strong passwords, and alignment with defined access control groups. Administrative access is restricted to designated IT personnel and is reviewed at least quarterly.

When personnel change roles or leave the company, HR notifies IT within one business day. IT disables or adjusts accounts in line with the updated role. Periodic access reviews are conducted semi-annually to verify that all users have appropriate access rights.

Patriot Field Rations, Inc. maintains a formal Incident Response Plan (IRP) covering all systems in scope for CMMC Level 2. The plan defines clear phases of incident handling: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.

The Cybersecurity & Compliance team serves as the core incident response team (IRT), supported by IT infrastructure, application owners, HR, Legal, and Communications as needed. All employees are required to promptly report suspected security incidents to the Service Desk or Security Operations Center (SOC).

For systems containing CUI, incident responders must assess potential loss of confidentiality, integrity, or availability and, when warranted, initiate notifications to affected stakeholders and government points of contact in accordance with contract requirements. Significant incidents are documented in an incident record that captures root cause, impact, response actions, and corrective actions.

The IRP is reviewed at least annually and after major incidents. Tabletop exercises are conducted at least once per year to validate the plan and train staff in their roles and responsibilities.

Patriot Field Rations, Inc. enforces a formal configuration management policy to ensure that systems are deployed, maintained, and modified in a controlled manner. All in-scope servers, workstations, and network devices must adhere to approved configuration baselines aligned with company standards and applicable industry benchmarks.

Proposed changes to production systems are documented in change requests that describe the business justification, technical approach, risk assessment, testing plan, and back-out plan. Normal changes are reviewed and approved by the Change Advisory Board (CAB), which includes representatives from IT, Cybersecurity & Compliance, and affected business units.

Emergency changes are permitted when necessary to address critical vulnerabilities or system outages but must be documented and reviewed retrospectively at the next CAB meeting. Unapproved or undocumented changes to in-scope systems are prohibited.

Configuration baselines and system inventories are reviewed periodically to verify that deployed systems match approved configurations, and deviations are either remediated or formally documented as exceptions.

Patriot Field Rations, Inc. requires security-relevant events from in-scope systems to be logged, protected, and regularly reviewed. Critical infrastructure components, domain controllers, servers hosting CUI, and perimeter security devices are configured to forward logs to the centralized LogWatch SIEM platform.

Logged events include user authentication attempts, administrative actions, configuration changes, access to sensitive data repositories, and security alerts generated by endpoint and network protection tools. Log data is retained for a minimum of 12 months, with at least 90 days readily available online for analysis.

The Cybersecurity & Compliance team reviews SIEM alerts daily and produces a summary of notable events on at least a weekly basis. Higher-risk alerts, such as repeated failed logins or anomalous login locations for privileged accounts, are investigated promptly according to the Incident Response Plan.

Systems that cannot currently forward logs to the SIEM must store logs locally with appropriate protections and retention. These gaps are tracked as part of the POA&M until fully addressed.

Patriot Field Rations, Inc. recognizes that suppliers and logistics partners play a critical role in securely delivering rations to government customers. The Vendor & Supply Chain Security Policy sets minimum security requirements for third parties that process, store, or transmit the company’s data, including CUI related to contracts, specifications, and shipments.

Suppliers handling CUI or providing critical IT or logistics services must complete a security assessment questionnaire and provide evidence of appropriate controls, such as multi-factor authentication, patch management, and incident response capabilities. Where applicable, contracts must include clauses requiring adherence to CMMC requirements and prompt notification of security incidents.

Vendor risk is assessed based on the sensitivity of shared data and the criticality of services. High-risk suppliers are reviewed at least annually. Unresolved high-risk findings may result in mitigation plans, contractual remedies, or consideration of alternate suppliers.

Information sharing with suppliers is limited to the minimum necessary to fulfill contractual obligations, and the use of unauthorized cloud services or consumer-grade collaboration tools for CUI is prohibited.