Phishing and social engineering policy
Most attacks on a company this size do not break cryptography; they ask a person to open the door. This policy says what stops that here, and it is written around the fact that First Six is one person, so the usual control (a colleague noticing the request is strange) does not exist and the technical controls compensate for its absence rather than decorating it.
What this policy commits us to
- There is no First Six password to phish: sign-in is federated to your identity provider, so we store no password and have no reset flow to abuse.
- No First Six email ever asks for a password, a code, or payment details, so the rule we can teach your students is absolute rather than nuanced.
- Our sending domain is authenticated with SPF, DKIM and DMARC, verified passing end to end, so a message forging our name can be junked by your gateway.
- Pretexting us for a student record achieves nothing: First Six holds no standing access to identifiable records, and the only cross-tenant path is a grant that only you can open, time-boxed and audited on both sides.
- We will not run simulated phishing against your staff or your students. Testing people who did not consent, on a platform they associate with welfare support, costs more trust than the exercise could teach.
- The gaps are named: no simulation has been run yet, no formal training exists with one person, and adversary-in-the-middle against your own identity provider is outside our control.
Controls mapped to this policy
Mapping controls to the policy is how we check adherence. A green dot marks a control that is operating and traceable to evidence; an amber dot marks one that is documented and scheduled but has not run yet.
- SSO-only authenticationIdentity and access control
- Server-side session revocationIdentity and access control
- No standing provider access (break-glass only)Identity and access control
- Secrets management and rotation calendarCloud infrastructure
- Secret scanningCloud infrastructure
- Sensitive-record read auditingMonitoring
- Sending-domain authentication (SPF, DKIM, DMARC)Monitoring
- Staff anomaly detectionMonitoring
Standards mappings
Through its controls, this policy maps to the following standards and frameworks. Each entry states our real relationship with the standard.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.5.16Identity management
- A.5.17Authentication information
- A.8.5Secure authentication
- A.5.18Access rights
- A.8.2Privileged access rights
- A.8.24Use of cryptography
- A.8.15Logging
- A.5.14Information transfer
- A.8.16Monitoring activities
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC6.1Logical access security
- CC6.6Boundary protection
HECVAT (Higher Education Community Vendor Assessment Toolkit)Higher educationSelf-assessed
A full HECVAT answer pack is maintained and kept current for university procurement, deliberately honest about gaps (no SOC 2 or ISO attestation, no independent penetration test, PITR not enabled). It is a vendor self-assessment, not an externally validated response, backed by a full internal HECVAT-aligned self-audit.
- AuditAudited access to institutional data
FERPA (US Family Educational Rights and Privacy Act)PrivacyAligned
For US-institution contexts, the platform addresses FERPA expectations through verifiable controls — tenant isolation, the append-only audit log behind record-access accountability, erasure, and a breach-notification path — rather than asserting a compliance label. The position is self-assessed as partial, with the audit-trail erasure carve-out disclosed as a live residual. A control you can verify is worth more than a label.
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.