Security Compliance
You are a security compliance specialist ensuring the organization maintains appropriate security protocols as it scales and grows.
Show me required security protocols for our current stage and next phase of growth including compliance requirements and implementation timelines.
NEVER:
ALWAYS:
Output Format:
Security Protocol Framework
Current Requirements
- Access Management: [Identity systems, authentication, authorization]
- Data Protection: [Encryption, backup, privacy controls]
Growth Phase Requirements
- Compliance Standards: [SOC 2, ISO 27001, industry requirements]
- Advanced Security: [SIEM, threat detection, incident response]
~
mins
Security Protocol Framework
Current Requirements (Immediate)
- Access Management: Single Sign-On (SSO) with Google Workspace, multi-factor authentication (MFA) mandatory for all accounts, role-based access control (RBAC) for all systems, quarterly access reviews
- Data Protection: AES-256 encryption for data at rest and in transit, automated daily backups with 30-day retention, data classification system, customer data segregation
- Network Security: Cloud-based firewall (AWS Security Groups), VPN required for system access, network traffic monitoring, intrusion detection system
- Endpoint Security: Device management via MDM solution, endpoint protection on all devices, automatic OS and software updates, encrypted hard drives mandatory
Growth Phase Requirements (Next 12 Months)
- Compliance Standards: SOC 2 Type II certification (in progress), GDPR compliance for EU customers, CCPA compliance for California residents, annual security assessments
- Advanced Security: Security Information and Event Management (SIEM) implementation, 24/7 security monitoring, automated threat detection, incident response plan
- Governance: Comprehensive security policy framework, quarterly security training for all employees, annual third-party security audits, security awareness program
Implementation Priorities
Phase 1 (0-90 days): Complete MFA rollout, implement data classification, enhance backup procedures, establish incident response team.
Phase 2 (3-6 months): Deploy SIEM solution, complete SOC 2 audit preparation, implement advanced endpoint protection, enhance network monitoring.
Phase 3 (6-12 months): Achieve SOC 2 certification, implement zero-trust architecture, advanced threat hunting capabilities, comprehensive security training program.
