Information security policy
The top-level statement of how First Six protects the confidentiality, integrity, and availability of the student personal, welfare, and crisis data it processes for universities — and the umbrella over a governed suite of area policies with named owners and review cadences.
What this policy commits us to
- No cross-tenant access to student data, and no standing First Six access to identifiable student records — the only path is a consented, time-boxed, redacted, dual-audited break-glass grant.
- The welfare and crisis pathway is a safety-critical availability objective: it is always available, and its alerts always fire or leave a record.
- Data stays in the Australian region at rest; cross-border processing is minimised and disclosed.
- Risk is managed openly through a living risk register that is shared with procurement, rather than hiding gaps.
- The program is self-assessed today, with an improvement path toward independent attestation stated plainly — including the single-operator reality.
Controls mapped to this policy
Mapping controls to the policy is how we check adherence. A green dot marks a control that is operating and traceable to evidence; an amber dot marks one that is documented and scheduled but has not run yet.
- HTTP security headers, CSP, and CSRF protectionApplications
- SSRF-guarded server-side fetchApplications
- Internal penetration testingApplications
- Encryption in transitData
- Encryption at restData
- Australian data residency, disclosed cross-border flowsData
- Network security and rate limitingCloud infrastructure
- Secrets management and rotation calendarCloud infrastructure
- Managed capacity and autoscalingCloud infrastructure
- Founder accountability for securityPeople
- First-hire people-controls activation planPeople
- Founder endpoint hardeningPeople
- Governed information security policy suiteBusiness operations
- Living, procurement-shared risk registerBusiness operations
- Incident response and breach notificationBusiness operations
- Annual tabletop incident exerciseBusiness operations
- Vulnerability disclosure channelCustomers
Standards mappings
Through its controls, this policy maps to the following standards and frameworks. Each entry states our real relationship with the standard.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.8.26Application security requirements
- A.8.23Web filtering
- A.8.29Security testing in development and acceptance
- A.5.14Information transfer
- A.8.24Use of cryptography
- 9.1Monitoring, measurement, analysis, evaluation
- A.8.20Networks security
- A.8.21Security of network services
- A.8.6Capacity management
- A.5.2Information security roles and responsibilities
- A.6.1–A.6.6Screening, terms, awareness, and offboarding for personnel
- A.8.1User endpoint devices
- A.6.7Remote working
- A.5.1Policies for information security
- 6.1Actions to address risks and opportunities
- 8.2Information security risk assessment
- A.5.24Incident management planning
- A.5.26Response to incidents
- A.6.8Information security event reporting
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC3Risk assessment
HECVAT (Higher Education Community Vendor Assessment Toolkit)Higher educationSelf-assessed
A full HECVAT answer pack is maintained and kept current for university procurement, deliberately honest about gaps (no SOC 2 or ISO attestation, no independent penetration test, PITR not enabled). It is a vendor self-assessment, not an externally validated response, backed by a full internal HECVAT-aligned self-audit.
- Pen testingThird-party penetration testing — answered honestly: not independently, yet
Australian Privacy Act 1988 (APPs, incl. the NDB scheme)PrivacyApplicable law
The primary legal regime. APP 8 drives the residency objective and every disclosed cross-border flow, APP 11 drives retention and erasure, and the Notifiable Data Breaches scheme's assessment clock is built into the incident runbook with OAIC contacts documented. The privacy policy, terms, and DPA template are counsel-reviewed and approved.
- APP 8Cross-border disclosure of personal information
- NDBNotifiable Data Breaches scheme
GDPR (EU General Data Protection Regulation)PrivacyApplicable law
Applies via international students. The 72-hour breach path is in the incident runbook, Article 28 processor terms sit in the counsel-approved DPA, Article 17 erasure maps to the student's own hard-delete cascade (with the audit-trail carve-out disclosed rather than hidden), and Article 22-equivalent disclosure covers automated crisis detection.
- Art. 33Notification of a breach to the supervisory authority
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.