Pia

10 U.S.C. 7013, Secretary of the Army; 10 U.S.C. 9013, Secretary of the Air Force; 29 CFR,
Part 1960, Basic Program Elements for Federal Employee OSHA and Related Matters;
Army Regulation 215-8/AFI 34-211(I), Army and Air Force Exchange Service Operations;
Title 29 CFR, Part 1960, Basic Program Elements for Federal Employee OSHA and
Related Matters; Federal Claims Collection Act of 1966 (Pub.L. 89-508, as amended);
Debt Collection Act of 1982 (Pub.L. 97-365, as amended), as codified in 31 U.S.C. §3711,
Collection and Compromise; 31 CFR 285.11, Administrative Wage Garnishment; E.O.
12196, Occupational Safety and Health Programs for Federal Employees; DoD Instruction
1330.21, Armed Services Exchange Regulations; DoD 7000.14-R, Department of Defense
Financial Management Regulation Volume 13, Nonappropriated Funds Policy and
Volume 16, Department of Defense Debt Management; Army Regulation 27-20, Chapter
4, Legal Service Claims; Air Force Instruction 51-501 implementing Air Force Policy
Memorandum AFPD51-5, Section A, Administrative Claims; and E.O. 9397 (SSN), as
amended.

The Exchange has reviewed the safeguards established for the system to ensure they are
compliant with DoD requirements. Data leakage of information is low. The highest level of
security controls and system were implemented and accessed against the Center for Internet
Security (CIS) Configuration Baselines. Configuration scans are conducted monthly to
monitor compliance. Information is secured buildings and behind controlled areas accessible
only to employees with a right-to-know who have been screened, cleared for access, and have
a role-based position for which places them in an arrangement that requires servicing,
reviewing, or updating the records.