IT Security Policy

Password Management

All passwords must be a minimum of 14 characters and include uppercase, lowercase, numbers, and special characters.

Passwords must be changed every 90 days; reuse of the last 12 passwords is prohibited.

Multi-factor authentication (MFA) is mandatory for all user accounts accessing company systems.

Passwords must never be shared, written down, or stored in unencrypted files.

All privileged account passwords must be stored in the company-approved password manager; no exceptions.

Device Security

All company-issued laptops and workstations must have full disk encryption enabled using BitLocker or FileVault.

Screens must automatically lock after 5 minutes of inactivity on all company devices.

All company devices must be enrolled in the Mobile Device Management (MDM) system before being used to access company data.

Personal devices must not be used to access, process, or store Confidential company data without explicit IT Security approval and MDM enrollment.

Network Access

Remote access to company systems requires a company-approved VPN connection at all times.

Wi-Fi networks used to transmit company data must use WPA3 encryption; use of open or WPA2 networks for company work is prohibited.

Production network segments must be segregated from development and corporate networks using firewall rules and VLANs.

Network access logs must be retained for a minimum of 12 months and reviewed monthly for unauthorized access attempts.

Incident Reporting

All suspected security incidents must be reported to the IT Security team within 1 hour of discovery.

The IT Security team must open a formal incident log within 2 hours of any reported incident.

Severity 1 incidents (active breach, ransomware, data exfiltration) must be escalated to the CISO within 4 hours.

All security incidents must have a completed Post-Incident Review document within 5 business days of containment.

Patch Management

Critical severity patches (CVSS 9.0+) must be applied to all affected systems within 24 hours of release.

High severity patches (CVSS 7.0–8.9) must be applied within 7 calendar days of release.

All other patches must be applied within 30 calendar days; systems with outstanding patches beyond SLA must be reported to the CISO monthly.

Access Control

All system access must follow the principle of least privilege; users must be granted only the minimum access required to perform their role.

Access permissions must be reviewed and revalidated on a quarterly basis by the relevant system owner.

All user access must be revoked within 1 hour of employee termination or role change.

Privileged access (administrator rights) requires manager approval, documented business justification, and full audit logging.

Service account credentials must be rotated at least annually and must not be shared between systems or users.

Systems storing PHI must implement role-based access control with automatic session timeout after 15 minutes of inactivity.

All FDA Part 11 systems must maintain immutable audit trails capturing user ID, timestamp, action, and reason for change.

Critical System Inventory

Security Control Mapping — HIPAA Safeguards

Related: HIPAA Assessment PDF · Privacy Policy — PHI Section

2025 Vulnerability Remediation Summary