How do you tailor security controls for a system operating in a classified or highly secure environment with no direct internet access?