Security Governance & Risk Management

1. Purpose and Scope

This page describes how BE EASY ENTERPRISES LLC, a Service-Disabled Veteran-Owned Small Business, governs information security for its own business systems and for the services it delivers to federal customers. Our program is sized for a small business and is intended to be proportionate, auditable, and aligned with the frameworks federal customers use. It is not a certification or attestation (see Compliance Status).

2. Accountability and Oversight

Executive leadership owns the security program, approves security policy, and is accountable for risk acceptance decisions. Security responsibilities are assigned by role, and security objectives are reviewed alongside business and contract objectives so that cost, schedule, and risk are weighed together. Leadership reports security posture and material risks to customers as contracts require.

3. Policy Framework

Our governance documents follow a simple hierarchy:

• Policies set management intent (for example access control, acceptable use, incident response, third-party risk).
• Standards state the minimum technical and procedural requirements that implement each policy.
• Procedures and playbooks describe how work is performed and how incidents are handled.
• Documents carry an owner and a review date, are reviewed at least annually and after material changes, and exceptions are recorded with an expiry.

4. Risk Management

We manage risk using the NIST Risk Management Framework (NIST SP 800-37) and risk-assessment guidance in NIST SP 800-30, with ISO 31000 principles informing how we communicate risk to leadership.

• Risk register: risks are recorded with an owner, likelihood and impact rating, treatment decision (mitigate, transfer, accept, avoid), and target date.
• Assessment cadence: risks are reassessed on a regular schedule and when systems, vendors, or threats change materially.
• Reporting: a short set of risk metrics (open high risks, aging of remediation items, exceptions) is reviewed by leadership.
• AI risk: when AI is used in our services or internal work, we consider bias, inaccuracy, model transparency, data security, and model vulnerabilities, guided by the NIST AI Risk Management Framework.

5. Compliance, Audit, and Assurance

We map applicable obligations (contract clauses, federal regulations, and customer requirements) to controls, assess control effectiveness, and track gaps to closure in a plan of action and milestones (POA&M). Where a contract requires an independent assessment, we support it and treat findings as inputs to the risk register.

6. Security Metrics

Illustrative measures we use to judge whether controls work:

• Multi-factor authentication coverage for accounts that support it
• Time to remediate critical and high vulnerabilities
• Security awareness training completion
• Open POA&M items and their age
• Incident-response exercises completed and lessons tracked to closure
• Third-party reviews completed against plan

7. Shared Responsibility for This Website

This website is a static site. The table shows who is responsible for what, so visitors and reviewers can see the trust boundaries.

8. Ethics and Conduct

We expect ethical conduct from everyone who works on our behalf: honesty in representations to customers, protection of customer and government information, avoidance of conflicts of interest, and prompt reporting of suspected violations. We do not describe our compliance posture beyond what we can support with evidence.

9. Workforce Security and Awareness

Personnel receive security awareness training on joining and periodically afterward, including current social-engineering techniques such as phishing, voice or video impersonation (deepfakes), and AI-assisted pretexting. Access follows least privilege and need-to-know, and is removed promptly when roles change or end.

10. Contact

Questions about our security program: security@beeasyenterprises.com.