How should DEOCS be aligned with DoD privacy and information assurance policies?

• A. Ensure compliance with DoD privacy frameworks, data handling standards, and IA controls; obtain approvals and training.
• B. Ignore privacy to speed results.
• C. Share raw data publicly.
• D. Use only one vendor.

Answer: (A)

Protecting respondent privacy and meeting information assurance requirements are essential when conducting DEOCS. Aligning the survey with DoD privacy and IA policies means treating it as a privacy-sensitive activity and applying the full DoD protections from planning through result reporting. This includes following the DoD Privacy Program: collecting only what’s necessary, using data for legitimate purposes, limiting retention, and safeguarding PII. It also means applying data handling standards for how PII is stored, transmitted, and disposed of—such as secure systems, encryption in transit and at rest, strict access controls, and clear data ownership and stewardship.

Information assurance controls provide the technical safeguards: authenticated access, least-privilege permissions, strong credentials, regular audit trails, timely patching and configuration management, and incident response readiness. Before the survey begins, you secure the necessary approvals and governance, define roles and responsibilities, and ensure those administering and analyzing the DEOCS are trained on privacy requirements, data handling procedures, and security incident reporting. This approach protects individuals’ information, keeps the process compliant with DoD rules, and maintains data integrity and security throughout the survey lifecycle. Sharing raw data publicly or relying on a single vendor would not meet these protections.