Approach
Security & Trust
Security by default, privacy by design. Chain-of-custody and auditability baked in.
Posture
Governance & Controls
- Least privilege, role-based access, SSO + MFA
- Separation of duties & environment segregation
- Security change control & peer review
- Logging, tamper-evident audit trails, time sync
Evidence Handling
- Hashing on capture where applicable; append-only notes
- Case segregation; need-to-know distribution
- PII minimization & structured redaction workflow
- Disclosure-ready documentation
Data Classification & Handling
| Class | Examples | Storage & Access | Retention |
|---|---|---|---|
| Restricted | Active case evidence, legal-privileged notes, sensitive PII | Encrypted at rest; restricted RBAC; no 3rd-party sharing without DPA | Case lifecycle + client policy; secure destruction w/ log |
| Sensitive | Operational plans, internal playbooks, client contact data | Encrypted at rest; staff-only access by role | Business need; periodic review |
| Internal | Process docs, non-confidential reports | Team access; monitored | Standard policy |
| Public | Marketing, published insights | Public repositories | N/A |
PII minimizationDLP guardrailsSecure deletion
Identity & Access Management
- SSO + MFA required; hardware keys for admins where feasible
- Just-in-Time (JIT) elevation for sensitive operations
- Quarterly access reviews; immediate off-boarding
- Service accounts scoped; rotated secrets
Encryption & Keys
- TLS in transit; strong encryption at rest
- Managed KMS; key rotation; split duties
- Backups encrypted; restore tests
Monitoring & Incident Response
Logging & Detection
- Centralized logs with retention aligned to legal policy
- Alerting on anomalous access & data exfil patterns
- Time sync; tamper-resistant storage
IR Playbooks
- Defined severities & response owners
- Evidence preservation & forensics workflow
- Client notification path; post-incident review
Tabletop drillsBreach comms
Vendors, Privacy & Compliance
Third-Party Risk
- DPA / confidentiality clauses; regional data residency on request
- Security posture reviewed prior to onboarding; periodic re-check
- Data minimization & purpose limitation
Standards Alignment
- Controls mapped to recognized frameworks (e.g., SOC 2 principles, ISO 27001 domains, NIST CSF)
- Discovery-ready artifacts (provenance, access logs, retention)
- Client-specific requirements honored by agreement
Physical Security & OPSEC
- Secure facilities & device hardening (disk encryption, auto-lock, patch policy)
- Clean desk; restricted printing; secure disposal
- Phishing & social-engineering drills; need-to-know comms