As to the security aspects... Indeed, the U.S. Department of Defense can be a little ... how shall I say this... BLOODY FREAKIN' PARANOID about security. But if you (a) have your database behind a good firewall and (b) host that database BE on something with heftier security than Access (admittedly, not that hard), then the DoD will bless you. Or at least not curse you.
I had my own departmental databases to run that we used for monthly activity report generation having to do with security patching. Size-wise, that was 1400+ servers on 60+ projects with 30+ new patches per month applied by 20+ administrators and 10+ specialty engineers (for the VMWare systems). We figured we were tracking actions above 1/2 million events per year for which we had to keep records going back a minimum of 8 months on the low-end systems and a year for stuff that had higher security requirements. After that we could ARCHIVE - not delete - the records.
But sometimes I consulted on a BUMED (that's the U.S. Navy Bureau of Medicine) system used to track military people as they interacted with various and sundry military medical facilities. Wasn't my project but sometimes I had to step in. Needless to say, if that project was even ALLOWED to use Access, then the DoD thought that the Access FE and SQL Server BE were good enough for Privacy Act and HIPAA compliance.