Security policies and plans for a moving company
The written rules behind your Level 2 self-assessment: one short policy for each of the 14 families, an incident response plan, and the forms you keep as evidence.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
What is inside
- 14 short policies, one per family, each rule showing the requirements it supports.
- An incident response plan: what counts, who to tell, the steps, and outside reporting, including the 72-hour report to DoD where DFARS 252.204-7012 is in your contract.
- Forms: incident log, training attendance, change log, offboarding checklist, visitor log and risk list.
- Approval page, sources and the disclaimer.
How to use it
- Replace everything in square brackets, and change any rule that does not match how you work. A policy you do not follow is worse than none.
- Have your owner approve it, tell everyone it applies to, and keep the signed copy with your evidence. Drafts and unapproved policies do not count as evidence.
- Point to each policy from your System Security Plan.
- Review it at least once a year and whenever your systems or contracts change.
Sources: NIST SP 800-171 Rev 2, 32 CFR 170.4, 32 CFR 170.24, DFARS 252.204-7012
Next: the crew training kit. It is general information, not legal or compliance advice; see the disclaimer. Back to free tools.