Cybersecurity Policy

Baselinx PLM is committed to protecting your data through comprehensive cybersecurity policies aligned with federal standards and industry best practices.

NIST 800-171 Compliant

Our cybersecurity program is designed to meet the requirements of NIST Special Publication 800-171 for protecting Controlled Unclassified Information (CUI) in non-federal systems.

Access Control Policy

Role-based access controls (RBAC) ensure users only access data necessary for their job functions.

Multi-factor authentication (MFA) required for all users
Unique user identification and authentication
Automatic session timeout after 15 minutes of inactivity
Failed login attempt lockout after 5 attempts
Quarterly access reviews and privilege audits

Data Protection Policy

All controlled unclassified information (CUI) is protected using encryption and secure handling procedures.

AES-256 encryption for data at rest
TLS 1.3 encryption for data in transit
Data classification and labeling requirements
Secure data disposal procedures
Backup encryption and secure storage

Audit & Accountability Policy

Comprehensive audit logging tracks all system activities for security monitoring and compliance.

All user actions logged with timestamps
Audit logs retained for minimum 3 years
Real-time security event monitoring
Regular audit log reviews
Tamper-evident audit trail protection

System Security Policy

Infrastructure security controls protect against unauthorized access and cyber threats.

Firewall and intrusion detection systems
Regular vulnerability assessments
Patch management within 30 days of release
Malware protection and monitoring
Secure system configuration baselines

Personnel Security Policy

All personnel with system access undergo security screening and awareness training.

Background checks for all employees
Annual cybersecurity awareness training
Acceptable use policy acknowledgment
Immediate access revocation upon termination
Insider threat awareness program

Incident Response Policy

Established procedures for detecting, reporting, and responding to security incidents.

24/7 security incident monitoring
Incident response team and procedures
Customer notification within 72 hours of breach
Root cause analysis and remediation
Annual incident response testing

Business Continuity Policy

Disaster recovery and business continuity plans ensure service availability.

Daily automated backups
Geographically distributed backup storage
Recovery time objective (RTO) of 4 hours
Recovery point objective (RPO) of 1 hour
Annual disaster recovery testing

Third-Party Security Policy

Vendors and third parties are assessed and monitored for security compliance.

Vendor security assessments
Contractual security requirements
Ongoing vendor monitoring
Data processing agreements
Subcontractor flow-down requirements

Security Questions or Concerns?

If you have questions about our cybersecurity policies or need to report a security concern, please contact our security team.

Contact Security Team View NIST 800-171 Compliance

Policy Version 2.0 | Last Updated: February 2026