Security Frameworks We Comply With – Kbthree

MARS is a mental health screening platform built for schools and other organizations. It screens for suicide risk, depression symptoms and anxiety symptoms. Because that data is sensitive, the platform is built against three security frameworks — the NIST Cybersecurity Framework, CIS Controls v8 and GESS — and complies with FERPA, HIPAA, COPPA, CSPC and California Department of Education requirements.

🧭

The three frameworks describe the same platform from three angles. The controls themselves are listed once below; each framework section then shows how they map.

🔐 Security controls in practice

Access control and authentication

Every user has a unique login — no guest or shared accounts.

Two-factor authentication is required for all staff accounts, meeting HIPAA requirements.

Role-based access control grants only the permissions a job requires.

Access is revoked immediately when an employee leaves, and permissions are reviewed regularly against current responsibilities.

Browser extensions are restricted to trusted ones on company devices.

Encryption

In transit — all communication uses TLS 1.2 or TLS 1.3.

At rest — sensitive data, including login credentials and screening results, is AES-256 encrypted.

Network and monitoring

Cloudflare provides DDoS protection, a web application firewall, bot filtering, enforced HTTPS and CDN delivery.

SolarWinds aggregates logs from all critical components for search, analysis and real-time threat detection.

Sentry reports application errors and exceptions as they happen. Together with Cloudflare and SolarWinds this covers network, log and application-level events, and alerts reach designated personnel by email and mobile notification.

Email is protected by DMARC, DKIM and SPF policies and strict filtering.

Data protection and anonymization

Screening data is stored encrypted, and access is limited to authorized personnel within the organization.

Same-day check-in results are stored encrypted.

Hotjar is used for session recordings and heatmaps to improve usability; it captures no personal data.

Backup, retention and recovery

Incremental snapshots allow full database recovery down to the minute, with a documented disaster recovery plan.

Screening data, credentials and login history are retained for six years, then securely deleted.

System access logs and API request logs are retained for six years to support compliance audits and security investigations.

Incident response and risk management

Anomalies trigger automated alerts to security personnel.

Designated personnel manage incidents through investigation and mitigation.

Affected parties, including participating organizations and compliance authorities, are notified as regulations require.

Every incident ends in a post-incident review whose lessons feed back into the controls.

Security risk assessments are carried out quarterly.

Secure development and testing

Development and staging environments never contain real data — automated scripts replace it with generated placeholders.

Internal penetration tests are performed quarterly, and findings feed directly into defenses and policy.

Automated vulnerability scans run monthly, with automated patching for known issues.

Secure coding practices and regular security assessments apply to all application work, and patches are tested in staging before production.

Vendors and third parties

Every third-party vendor passes a formal security assessment before integration.

External services such as GRAX and Hotjar are audited annually, with continuous monitoring of their security posture.

Contracts require adherence to FERPA and HIPAA.

GRAX protects Salesforce data specifically: enterprise-grade protection, strict access controls, true data ownership, full backups, historical search for audits.

Training

All employees complete mandatory security training covering phishing, password practice and social engineering.

Partner organizations receive regular training and materials to maintain the same standards.

Asset management

A detailed inventory covers servers, workstations and cloud resources.

Application allow-listing ensures only approved software runs, with automatic updates and patch management.

Secure configuration guidelines are enforced across all IT assets, with regular compliance scans.

Employees work on pre-configured laptops with endpoint security installed.

NIST Cybersecurity Framework

The NIST CSF organizes security into five functions. Our controls map to them as follows.

1. Identify

Continuous cybersecurity risk assessments identify vulnerabilities and threats.

Asset management keeps all software and hardware accounted for and updated.

Role-based access control keeps permissions tied to job responsibilities.

2. Protect

Encryption of all PHI and same-day check-in reports, in transit and at rest.

Two-factor authentication required for all staff accounts.

Screening data stored encrypted, with access limited to authorized personnel.

Pre-configured secure workstations, and no guest access anywhere in the system.

3. Detect

Cloudflare DDoS protection, web application firewall and bot filtering.

SolarWinds log aggregation and Sentry application-error reporting, with real-time alerting.

4. Respond

A structured incident response plan covering identification, containment and remediation.

Automated alerts to the security team on any detected anomaly.

Ongoing security training for partner organizations.

5. Recover

Incremental snapshot backups supporting recovery to the minute, minimizing downtime.

Production data is never used in development or testing.

CIS Controls v8

CIS Controls v8 defines 18 prioritized safeguards. All 18 are covered:

Inventory and control of enterprise assets — full inventory of servers, workstations and cloud resources, with controlled and monitored device access.

Inventory and control of software assets — application allow-listing, automatic updates and patch management.

Data protection — screening data and backups encrypted, access restricted by role.

Secure configuration — configuration guidelines enforced across all assets, with regular compliance scans.

Account management — unique login per user, role-based access control.

Access control management — two-factor authentication, immediate revocation on departure, restricted browser extensions.

Continuous vulnerability management — monthly automated scanning and patching.

Audit log management — all system events logged, stored securely, analyzed for suspicious activity, retained six years; SolarWinds provides centralized analysis.

Email and web browser protections — Cloudflare security suite, plus DMARC, DKIM and SPF policies.

Malware defenses — endpoint security and antivirus on all company laptops.

Data recovery — incremental snapshots with recovery to the minute and a disaster recovery plan.

Network infrastructure management — firewalls and network access controls; secure VPNs for remote access.

Network monitoring and defense — Cloudflare, SolarWinds and Sentry alerting, with real-time notification to designated personnel.

Security awareness and skills training — mandatory training for all employees.

Service provider management — annual audits of external services, contractual FERPA and HIPAA obligations, ongoing posture monitoring.

Application software security — secure coding practices and regular assessments.

Incident response and management — structured plan, reviewed incident reports.

Penetration testing — internal penetration tests performed quarterly, with findings feeding back into defenses.

GESS — Global Education Security Standard

GESS is a voluntary security standard for educational data, published by the Student Data Privacy Consortium with an accompanying self-assessment. MARS is aligned to it across these areas:

Secure authentication and access control.

Encryption for data in transit and at rest.

Proactive vulnerability assessment and risk management.

Continuous security monitoring and rapid incident response.

Least-privilege access and secure API integrations.

Detailed logging and auditing of user access, role changes, API requests and system modifications.

Regular access control reviews against the principle of least privilege.

A documented data retention and deletion policy — six years, then secure deletion.

Formal security assessment of every third-party vendor before integration, and annual audits after.

Secure development practice, with no real data in test or development systems.

Mandatory security training for employees and partners.

🛡️

Together, these frameworks and the controls behind them give MARS a documented, auditable security posture — protecting sensitive student data while meeting the regulations that govern it.