MCO 5239.2B - Marine Corps Cybersecurity

Scope

MCO 5239.2B establishes the Marine Corps Cybersecurity Program. The order sets policy for protecting Marine Corps information systems, networks, and data from cyber threats. It assigns responsibilities to commanders, information system owners, information system security officers (ISSOs), and users. Key areas include access control, role-based access, privileged user management, need-to-know validation, data encryption, incident reporting, and system account management.

Audience

Unit commanders use this order for cybersecurity policy authority. ISSOs and Marine Information Systems Security Officers (MISSOs) use it for system access provisioning and account management. S-1 admin specialists use it for managing access to personnel systems (MCTFS, UD-MIPS, MOL, RAPIDS) including role validation, quarterly access reviews, and privileged certifier account management. The unit security manager applies it for need-to-know validation and access control.

Content scope

Portal-cited chapters. Chapter 4 sets the need-to-know and role-based access requirements. Chapter 5 sets the incident reporting procedures. Across the order, the program covers access control, privileged user management, data encryption, account management, and audit documentation.

Operative content

• Role-based access control. Chapter 4 sets need-to-know and role-based access requirements. Access to any system must align with the Marine's billet and duty requirements. The security manager validates access against role and need-to-know.
• Privileged user management. Privileged certifier accounts (e.g., unit diary certifiers in MCTFS) require a privileged access agreement signed by the S-1 officer before MISSO activates the certifier role. Marines holding privileged accounts must complete required training before activation.
• Access provisioning workflow. The S-1 officer signs access requests. The unit security manager validates need-to-know. MISSO activates accounts after the signed agreement and training confirmation are on file.
• Quarterly access review. System accounts require quarterly review for currency and continued need. The S-1 chief signs the quarterly reconciliation.
• Encryption requirement. PII must be encrypted in transit (email, file transfer) and at rest (file shares, removable media).
• Incident reporting. Suspected cyber incidents are routed to the unit cybersecurity officer for reporting up the chain per Chapter 5 procedures.
• System log documentation. Units maintain a system log recording outages, access anomalies, and account actions for audit purposes.

Connection to higher policy

• DODI 8500.01 Cybersecurity. Parent DoD framework for information systems security.
• SECNAVINST 5239.3C Department of the Navy Cybersecurity Policy. SECNAV-level policy above this order.
• Privacy Act of 1974 and DoD 5400.11-R. PII handling framework behind the encryption and access rules.

Connection to Marine Corps doctrine and lower policy

• MCO P1070.12K Individual Records Administration Manual. Records management policy for the personnel systems this order's access rules protect.
• MCTFS, UD-MIPS, MOL, and RAPIDS. Personnel systems whose account provisioning, certifier authorization, and quarterly reviews run under this order.
• Portal admin systems-management pages, covering account provisioning and SAAR-N processing, privileged certifier account authorization, MISSO support case routing, quarterly account review and audit, MOL administrator permissions, and account closure at detach, cite this order. The commander oversight matrix also cites it.

Note on Portal Citation Correction

Portal content pages in the admin systems-management section previously cited this order as "MCO 5239.2C." MCO 5239.2C does not exist. The correct document number is MCO 5239.2B. All citations corrected to reference MCO 5239.2B.

Status

Current. MCPEL article 900514. Published by the Commandant of the Marine Corps. DC I (formerly DC C4) sponsors the order. Applicable to the Marine Corps Total Force. Supersedes MCO 5239.2A.