Structured access approvals
New privileges follow a formal approval process, apply least privilege, and require endorsement by an authorized employee.
Trust by design
Security built into every workflow.
63 safeguards
How we protect sensitive information
Our security program supports HIPAA- and PHIPA-compliant deployments through access governance, encryption, operational resilience, continuous monitoring, workforce controls, and ongoing risk management.
Access control and authorization
Sensitive-data access requests
Access to sensitive information requires a submitted, approved, and monitored request.
Infrastructure access requests
Access to sensitive infrastructure requires documented approval and ongoing oversight.
Timely access revocation
Privileges are reviewed and removed promptly when a workforce member no longer needs them.
Account inventory
Accounts on critical and high-risk services are inventoried with owners, roles, privileges, and vendor relationships, and reviewed at least annually.
Administrative MFA
Administrative access to critical systems requires multi-factor authentication unless a documented technical exception applies.
Application MFA
Externally exposed enterprise and third-party applications enforce MFA where supported, including through SSO.
Infrastructure MFA
Sensitive infrastructure requires multi-factor authentication in addition to primary credentials.
Password-policy enforcement
Technical controls and monitoring reinforce password requirements and address non-compliance.
Strong password standards
Password requirements mandate strong credentials and prevent reuse of previous passwords.
Data management and protection
Encryption at rest
Sensitive information is encrypted while stored on systems and devices.
Encryption in transit
Information is encrypted while moving across internal and external networks.
Data inventory
Data assets are cataloged across databases, file shares, and cloud storage.
Data classification
Information is labeled by classification so the appropriate access and handling safeguards can be applied.
Retention and lifecycle management
Documented requirements govern how information is retained, managed, and disposed of throughout its lifecycle.
Disaster recovery
Automated backups
Automated backups protect high-risk information and critical systems.
Continuity and recovery policy
A documented business continuity and disaster recovery policy guides response to disruptive events.
Documented data recovery
Recovery procedures address data loss, corruption, and system failure.
Recovery-plan testing
Disaster recovery plans are tested regularly and improved based on results.
Isolated recovery data
Recovery copies are separated from production to reduce the risk of accidental overwrite or corruption.
Email security
DMARC protection
DMARC policy and verification mechanisms help prevent domain spoofing and phishing.
Restricted mailbox access
Administrative access to email accounts is limited and is not delegated to unauthorized users.
Malicious-content filtering
Email controls block or quarantine malicious attachments, links, scripts, and other harmful content.
Endpoint security
Endpoint anti-malware
Anti-malware protection is deployed on laptops, workstations, and other end-user devices.
Automatic session locking
Inactive sessions lock automatically to protect unattended devices.
Device encryption
Information stored on laptops and mobile devices is encrypted against loss or theft.
Endpoint firewalls
Host firewalls are enabled and maintained on workstations and laptops.
Mobile device management
A device-management platform applies and monitors security requirements on end-user devices.
Unauthorized-software review
Unapproved software is removed or covered by a documented exception, with compliance reviewed at least monthly based on risk.
Infrastructure security
Infrastructure anti-malware
Appropriate anti-malware protection is deployed on servers and infrastructure components.
Private storage buckets
Cloud storage is not publicly exposed without a documented business justification.
Restricted public access
Firewall rules limit public access to infrastructure components.
Logged infrastructure changes
Changes to critical infrastructure are recorded for accountability, investigation, and auditability.
Continuous network updates
Network devices receive current security patches and firmware updates.
Unauthorized-asset response
Periodic asset reviews identify and address unauthorized infrastructure.
Unique database authentication
Production database access uses individual credentials or uniquely attributable keys.
Secure remote access
VPN connections provide encrypted and authenticated access over untrusted networks.
Web application firewall
A WAF helps protect applications against injection, cross-site scripting, and other application-layer attacks.
Monitoring and incident response
Sufficient log retention
Audit-log capacity supports the required retention period and historical investigation.
Audit-log management
Documented processes govern log collection, storage, protection, review, and monitoring.
Central security logging
Critical systems and applications capture security events for detection and investigation.
Breach-notification procedure
Documented procedures support detection, assessment, escalation, and required reporting of breaches.
Incident-response policy
A formal policy governs how security incidents are detected, contained, investigated, and recovered from.
Organizational security
Enterprise asset inventory
Devices and systems capable of storing or processing information are inventoried and kept current.
Asset-management policy
A documented policy governs assets throughout acquisition, use, reassignment, and disposal.
Workforce offboarding
Departing workforce members are promptly removed from relevant systems and accounts.
Workforce onboarding
New workforce members receive only the access required for their responsibilities.
Restricted physical access
Facilities, equipment, and systems are limited to authorized personnel.
Physical-security policy
Documented requirements protect facilities and physical assets.
Workforce sanctions
A sanctions policy establishes consequences for violations of security policies and procedures.
Annual security training
The workforce receives annual training on cyber threats, social engineering, authentication, and safe data handling.
Assigned security official
A designated security official oversees safeguards, policies, and incident-response responsibilities.
Vendor agreements
Vendor agreements define security responsibilities, expectations, and service commitments.
Workstation-use policy
A documented policy governs appropriate workstation use and protection against unauthorized access.
Risk management
Recurring risk assessments
Risk assessments are performed at least annually to identify threats and vulnerabilities affecting company assets.
Vendor inventory
Vendor records include services provided, contract details, and the scope of system or data access.
Vendor-management program
A documented program assesses, monitors, and manages third-party security and compliance risk.
Data-sensitivity classification
Vendors are classified according to the sensitivity of the information they handle.
Vendor-risk classification
Vendors are prioritized by risk to guide assessment depth, review frequency, and required safeguards.
Vulnerability management
Penetration-test remediation
Findings from penetration testing are tracked and remediated promptly.
Annual penetration testing
Systems, applications, and infrastructure undergo penetration testing at least every 12 months.
Vulnerability scanning
Automated scans regularly evaluate infrastructure, applications, and code repositories for known weaknesses.
Vulnerability-management policy
A documented policy defines how vulnerabilities are identified, assessed, prioritized, and remediated.