Business continuity and wind-down policy
What happens to an institution's data and service if First Six the company cannot continue — insolvency, founder incapacity, acquisition, or a voluntary wind-down. Honest about the solo-operator continuity risk.
What this policy commits us to
- Data is portable by construction: standard Postgres rows and storage objects in an Australian region, exportable at any time, with no proprietary lock-in.
- No silent lights-out: any wind-down comes with written notice and a defined export-and-deletion window (default 90 days' notice plus a 30-day export window; final numbers in the DPA).
- On acquisition, data may transfer only under materially equivalent terms, with prior notice and the right to exit instead.
- Student data is held under processor terms and is not a saleable asset in insolvency.
- Open gaps named: a signed escrow agreement and a second named operator with break-glass access.
Controls mapped to this policy
Mapping controls to the policy is how we check adherence. A green dot marks a control that is operating and traceable to evidence; an amber dot marks one that is documented and scheduled but has not run yet.
Standards mappings
Through its controls, this policy maps to the following standards and frameworks. Each entry states our real relationship with the standard.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.8.13Information backup
- A.5.30ICT readiness for business continuity
- A.5.29Security during disruption
- A.5.22Monitoring and review of supplier services
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC7.4Incident response and recovery
HECVAT (Higher Education Community Vendor Assessment Toolkit)Higher educationSelf-assessed
A full HECVAT answer pack is maintained and kept current for university procurement, deliberately honest about gaps (no SOC 2 or ISO attestation, no independent penetration test, PITR not enabled). It is a vendor self-assessment, not an externally validated response, backed by a full internal HECVAT-aligned self-audit.
- ExitVendor viability and data exit
- BCPBackup and restore capability
- ViabilityVendor viability
Australian Privacy Act 1988 (APPs, incl. the NDB scheme)PrivacyApplicable law
The primary legal regime. APP 8 drives the residency objective and every disclosed cross-border flow, APP 11 drives retention and erasure, and the Notifiable Data Breaches scheme's assessment clock is built into the incident runbook with OAIC contacts documented. The privacy policy, terms, and DPA template are counsel-reviewed and approved.
- APP 11.2Destruction and de-identification
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.