Security Policy

Our Commitment to Security

At Triden Group, security isn't just what we do for our clients—it's how we operate. As a leading cybersecurity consulting firm serving healthcare, financial services, and government organizations, we hold ourselves to the highest standards of data protection, operational security, and compliance.

We understand that when you trust us with your sensitive information, you need confidence that we've implemented the same rigorous controls we recommend to our clients. This page outlines our security program, certifications, and commitment to protecting your data.

Certifications & Standards

Security Framework

Our comprehensive security program addresses all five SOC 2 Trust Services Criteria and follows industry best practices:

Data Protection & Encryption

Encryption Standards

• Data at Rest: AES-256 encryption for all stored data
• Data in Transit: TLS 1.3 for all network communications
• Email Communications: Encrypted email gateway for sensitive communications
• Backup Encryption: All backups encrypted with separate key management

Data Handling

• Client data segregated by logical boundaries with restricted access
• Data Loss Prevention (DLP) tools monitor for unauthorized data movement
• Secure file sharing portal for client deliverables
• Documented data retention and secure disposal procedures
• Regular data inventory and classification reviews

Access Control & Identity Management

Authentication & Authorization

• Multi-factor authentication (MFA) required for all users
• Single sign-on (SSO) implementation reducing password sprawl
• Role-based access control (RBAC) with least privilege principles
• Privileged Access Management (PAM) for administrative accounts
• Just-in-time (JIT) access provisioning for elevated permissions

Access Reviews & Monitoring

• Quarterly access reviews by system owners
• Monthly access log reviews for critical systems
• Automated alerting for suspicious access patterns
• Immediate access revocation upon employee termination
• Session recording for privileged administrative access

Security Operations

Continuous Monitoring

• Security Information and Event Management (SIEM) with 24/7 monitoring
• Endpoint Detection and Response (EDR) on all company devices
• Vulnerability scanning on weekly cadence
• Automated security alerting with defined escalation procedures
• Threat intelligence integration for proactive defense

Testing & Assessment

• Annual third-party penetration testing
• Quarterly vulnerability assessments
• Monthly phishing simulations with targeted training
• Annual social engineering assessments
• Regular red team / purple team exercises

Employee Security

Hiring & Background

• Comprehensive background checks for all employees
• Non-disclosure agreements (NDAs) signed before access to systems
• Security-focused onboarding program
• Clear desk and clean screen policies

Training & Awareness

• Security awareness training for all employees annually
• Specialized training for roles with elevated access
• Monthly security bulletins and threat briefings
• Quarterly phishing simulations with remedial training
• Security champions program across departments

Remote Work Security

• VPN required for all remote access
• Company-issued and managed laptops
• Full disk encryption on all endpoints
• Network Access Control (NAC) enforcing device compliance
• Home network security guidance provided

Vendor & Third-Party Risk Management

• Vendor security assessments for all critical suppliers
• SOC 2 Type II reports required from high-risk vendors
• Contracts include comprehensive security requirements
• Limited vendor access with least privilege principles
• Quarterly vendor access reviews and recertification
• Separate network segmentation for vendor access

Business Continuity & Disaster Recovery

Continuity Planning

• Documented Business Continuity Plan (BCP) with defined recovery objectives
• Recovery Time Objective (RTO) of 4 hours for critical systems
• Recovery Point Objective (RPO) of 24 hours for data restoration
• Alternative work locations identified and tested
• Cross-training and succession planning for key roles

Backup & Recovery

• Daily automated backups of all critical systems and data
• Immutable backup copies stored offline (air-gapped)
• 3-2-1 backup strategy (3 copies, 2 media types, 1 offsite)
• Monthly backup restoration testing
• 30-day backup retention with separate encryption keys

Testing & Validation

• Annual full-scale disaster recovery test
• Quarterly tabletop exercises
• Post-test documentation and improvement plans

Compliance & Governance

Governance Structure

• Designated Chief Information Security Officer (CISO)
• Appointed Data Protection Officer for privacy matters
• Quarterly management security reviews
• Board-level reporting on security posture
• Risk management program with formal risk register

Policy Framework

• Comprehensive information security policy suite
• Annual policy reviews and updates
• Employee acknowledgment of policies required
• Documented procedures for key security processes

Audit & Assessment

• Annual SOC 2 Type II audits by independent auditors
• Quarterly internal security assessments
• Regular compliance reviews for HIPAA, GDPR, CCPA
• Continuous control monitoring and evidence collection

Infrastructure Security

Cloud Security

• Cloud Security Posture Management (CSPM) tools deployed
• Infrastructure as Code (IaC) with security scanning
• Cloud Access Security Broker (CASB) monitoring
• Monthly cloud configuration reviews
• Least privilege IAM policies across cloud platforms

Network Security

• Network segmentation with firewall controls
• Intrusion Detection/Prevention Systems (IDS/IPS)
• Web Application Firewall (WAF) for internet-facing applications
• Secure VPN access with MFA for remote connections
• Network traffic analysis and anomaly detection

Reporting a Security Concern

We take security vulnerabilities seriously and appreciate responsible disclosure. If you believe you've discovered a security issue with our systems or services: