U.S. Department of Justice, Information Technology Security (DOJ 2640.2F) (Nov. 26, 2008) (full-text).