AR 25-2 — Army Cybersecurity
AR 25-2 governs the Army Cybersecurity Program, including cybersecurity policies, responsibilities, risk management, and protection of information technology.
- Publication number: AR 25-2
- Title: ARMY CYBERSECURITY
- Date: 04/04/2019
- Proponent: CIO
- Status: ACTIVE
View AR 25-2 on armypubs.army.mil
Related publications
- ARMY DIR 2020-11
- PAM 25-2-1
- PAM 25-2-11
- PAM 25-2-12
- PAM 25-2-13
- PAM 25-2-14
- PAM 25-2-16
- PAM 25-2-17
- PAM 25-2-18
- PAM 25-2-2
- PAM 25-2-3
- PAM 25-2-6
- PAM 25-2-7
- PAM 25-2-8
- PAM 25-2-9
AR 25-2 addresses cybersecurity governance, risk management, access control, information protection, teleworking, monitoring, incident response, and compliance. It requires authorization, authentication, security controls, vulnerability management, and adherence to applicable Department of Defense and Army policies.
Topics covered
- Army Cybersecurity Program
- Cybersecurity governance
- Cybersecurity risk management
- Information technology protection
- Access control
- Teleworking security
- Incident response and reporting
- Compliance reporting requirements
Questions and answers
Is compliance with AR 25-2 mandatory?
Compliance with this regulation and the supporting DA pamphlets is mandatory. (paragraph 1-8)
What must Army organizations do before operating information technology?
Ensure that IT has been granted authorization to operate (ATO) by the assigned authorizing official (AO). (paragraph 6)
Can privately owned IT be used for remote privileged access to DOD systems?
Remote privileged access to DOD systems using privately owned IT is prohibited. (paragraph 4-25)
What privacy should users expect when using Army IT?
Any use of Army IT is made with the understanding that users will have no expectations as to the privacy or confidentiality of any electronic communication, including minor incidental personal uses. (paragraph 4-26)
Can the Army monitor electronic communications on Army IT?
The Army reserves and will exercise the right to access, intercept, inspect, record, and disclose any and all electronic communications on Army IT, including minor incidental personal uses, at any time, with or without notice to anyone, unless prohibited by law or privilege. (paragraph 4-26)