What does ICD 704 address?

• A. Personnel Security Standards
• B. Incident Response
• C. Physical Security
• D. Data Encryption

Answer: (A)

ICD 704 addresses personnel security standards. It covers how people who access government information or systems are screened, cleared, and managed over time. This includes appropriate background investigations for the level of access, enforcing need-to-know, and controls tied to the user's role. It also encompasses ongoing monitoring and periodic reinvestigations, as well as procedures for onboarding, reassignment, termination, and addressing security violations. In short, it’s about ensuring trusted individuals are in the right roles and kept under appropriate scrutiny to protect sensitive resources.

This topic is distinct from incident response (how to detect and handle security incidents), physical security (protecting facilities and hardware), and data encryption (protecting data itself through cryptography).