1. Purpose and Scope
Northwind Health (sample) is a healthcare SaaS provider that processes protected health information (PHI) and customer personally identifiable information (PII) through its cloud-based platform. The purpose of this Information Security Policy is to establish the overarching framework, principles, and management commitment for protecting the confidentiality, integrity, and availability of all information assets owned, managed, or processed by Northwind Health (sample). This policy sets the foundation for the organization's information security management system (ISMS) and provides direction for subordinate standards, procedures, and controls.
This policy applies to all employees, contractors, consultants, temporary staff, interns, and third-party service providers who access, use, manage, or support Northwind Health (sample) information systems and data. It covers all information assets regardless of form, electronic, paper, or verbal, including data stored or processed in cloud environments (AWS), collaboration platforms (Google Workspace, Slack), version control systems (GitHub), CI/CD pipelines (GitHub Actions), endpoint devices managed through Kandji, and all other systems supporting business operations.
Northwind Health (sample) operates under a remote-first work model with a primary office location in Austin, Texas. All personnel, whether working from the Austin office or remotely, are required to comply with this policy and all subordinate information security standards and procedures. This policy aligns with the AICPA Trust Services Criteria, specifically the Security, Availability, Confidentiality, and Privacy categories, and serves as a cornerstone artifact for the organization's SOC 2 Type II examination (CC1.1, CC1.2, CC1.3). The policy was effective during the entire SOC 2 examination period of October 16, 2025 through October 15, 2026.
2. Information Security Objectives
Northwind Health (sample) is committed to embedding security into its culture, products, and operations. The organization has established the following high-level information security objectives to guide its security program:
- Protect PHI and PII: Safeguard all protected health information and personally identifiable information from unauthorized access, disclosure, alteration, and destruction, consistent with applicable regulatory obligations and customer contractual commitments (C1.1, C1.2).
- Maintain Availability and Resilience: Ensure that platform services remain available to customers in accordance with defined service level targets, with service disruptions logged, investigated, and remediated through established incident management processes (A1.1, CC7.2).
- Prevent and Detect Threats: Implement layered preventive and detective controls, including identity and access management, encryption, logging, and monitoring through Datadog, to reduce the likelihood and impact of malicious activity, human error, and system failures (CC6.1, CC6.2, CC7.3).
- Embed Security by Design: Integrate security considerations into the full software development lifecycle, including design, coding, testing, and deployment phases managed through GitHub and GitHub Actions (CC8.1, CC7.1).
- Enable Continuous Improvement: Maintain a living security program that is regularly reviewed, tested, and updated to respond to the evolving threat landscape, changes in technology, and evolving regulatory requirements (CC2.2, CC4.1).
These objectives are measured through key performance indicators including, but not limited to: mean time to detect and respond to security incidents, percentage of employees completing required security training, number of unresolved high-severity findings from internal and external assessments, and uptime percentage against committed service level objectives (CC4.1, CC7.2).