Sending-domain authentication (SPF, DKIM, DMARC)
The domain First Six sends student and staff mail from publishes SPF, DKIM and DMARC records, so a message forging our name can be recognised and junked by a university's own mail gateway. This matters more here than for most senders: the product deliberately teaches first-year students to expect and act on email from us, which makes impersonating us both attractive and effective. Verified end to end on 27 July 2026, with all three showing PASS in the headers of a real delivered message. Stated honestly: the DMARC ENFORCEMENT level is not yet recorded, and a policy of none publishes a signal nobody acts on, so confirming the level and monitoring the aggregate reports is an open action (R252).
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.5.14Information transfer
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC6.6Boundary protection
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.