SECURITY POLICY

Cybersecurity, Information Protection & Institutional Security Governance Framework

The Shaker Foundation for American Service Heroes is committed to maintaining the highest standards of institutional security, cybersecurity resilience, information protection, and operational safeguarding across all governance, administrative, digital, financial, and programmatic environments.

Security is recognized as a foundational governance function essential to protecting institutional integrity, operational continuity, public trust, and mission-critical assets.

This Security Policy establishes a comprehensive governance framework for preventing, detecting, responding to, and recovering from security threats, vulnerabilities, breaches, or malicious activities affecting the Foundation’s systems, infrastructure, personnel, or data assets.

The Foundation maintains a zero-tolerance policy toward unauthorized access, malicious intrusion, sabotage, security circumvention, or misuse of protected institutional resources.

The Foundation governs institutional security under the following binding principles:

3.1 Confidentiality Protection

Protected information shall only be accessible to authorized individuals for approved institutional purposes.

3.2 Integrity Assurance

Systems, records, and data must remain protected from unauthorized alteration, corruption, manipulation, or destruction.

3.3 Availability and Operational Continuity

Critical systems and institutional resources must remain available, resilient, and recoverable during adverse events.

3.4 Least Privilege Access

Access rights shall be restricted to the minimum level necessary for authorized responsibilities.

3.5 Defense-in-Depth

Security shall be implemented through layered administrative, technical, procedural, and governance controls.

The Foundation maintains a layered security control framework including:

4.1 Administrative Controls

Policies, governance procedures, role definitions, and compliance obligations.

4.2 Technical Controls

Authentication systems, encryption, monitoring systems, endpoint protection, and access restrictions.

4.3 Operational Controls

Incident response procedures, access reviews, backup procedures, and recovery mechanisms.

4.4 Physical Security Controls

Protection of devices, facilities, documentation, and restricted-access environments.

These controls collectively reduce exposure to security threats and institutional vulnerabilities.

Access to institutional systems is governed by strict access control protocols.

Security requirements include:

Unauthorized access attempts constitute a serious security violation.

The Foundation operates continuous security monitoring designed to identify:

Security events are logged, reviewed, and risk-classified according to severity and institutional impact.

Continuous monitoring is essential for early threat detection and rapid response.

The Foundation applies continuous risk-based security assessment to identify and remediate vulnerabilities.

Security risk categories include:

Identified vulnerabilities are prioritized according to severity, exploitability, and potential institutional impact.

Any vendor, contractor, or external service provider with access to institutional systems or data must maintain security standards aligned with Foundation requirements.

Third-party security obligations may include:

Third-party access remains subject to governance oversight and periodic review.

Human error remains one of the most significant security risks.

The Foundation therefore requires ongoing security awareness initiatives covering:

Security awareness is treated as a continuous institutional responsibility.

Security governance is continuously reviewed through:

Security controls must remain auditable, measurable, and continuously enforceable.

This Security Policy is continuously reviewed and strengthened based on:

The Foundation maintains a permanent commitment to strengthening institutional security maturity.

The Shaker Foundation for American Service Heroes affirms that institutional security is fundamental to governance legitimacy, operational resilience, public trust, and long-term mission protection.

This Security Policy ensures that all institutional systems, assets, and information resources operate under rigorous security controls, continuous monitoring, and internationally aligned protection standards.