Security Program — Index

Policies, plans and proposals written in September 2026 for university vendor security reviews (the UTHealth Houston HECVAT-Lite questionnaire, UT Southwestern, TX-RAMP). Every document starts as draft. The Status column below is a snapshot; each document’s own frontmatter is authoritative, and the admin docs site shows it as a badge.

Approving a document

npm run docs:approve -- docs/admin/security-program/policies/incident-response-plan.md
npm run docs:approve -- docs/admin/security-program/policies/*.md --date 2026-10-01
npm run docs:approve -- <file> --draft        # back to draft
npm run docs:admin:deploy                     # rebuild + publish admin-docs.gevell.com
npm run docs:customer -- <file> --for "UTHealth Houston" --out ~/Desktop   # customer PDF

Sharing with a customer

Never send the Markdown or an admin-site link. Export a customer PDF of an approved document with npm run docs:customer. The export drops the “Actions required” section, anything wrapped in <!-- internal --> … <!-- /internal -->, and the frontmatter. It refuses drafts, and refuses if repo paths, internal addresses, placeholders, action ids or issue numbers would reach the customer. When you write internal-only detail (to-dos, file paths, status notes, names), wrap it in the internal markers.

Approval sets status: approved, approved, approved_by and updated, and fills the policy’s “Effective date”. Each policy ends with the actions required before it is true — resolve or accept those before approving.

Policies and plans (policies/)

Document	UTHealth question	Status
Business Continuity Plan	Q31	approved 2026-09-23
Disaster Recovery Plan	Q32	approved 2026-09-23
Incident Response Plan	Q82	approved 2026-09-23
Information Security Policy	Q89	approved 2026-09-23
Media Handling and Data Disposal Policy	Q70	approved 2026-09-23
Personnel Onboarding and Offboarding Policy	Q30	approved 2026-09-23
Vulnerability and Patch Management Policy	Q64	approved 2026-09-23

Proposals and research (proposals/)

Document	UTHealth question	Status
Gevell PDF Accessibility Roadmap	Q39	approved 2026-09-23
IDS/IPS and Threat Monitoring (HECVAT)	Q79–80	draft
Staff Access MFA Plan	Q46–47	draft
SAML Attribute Mapping — Per-Tenant Configurable Claims	Q56	approved 2026-09-23
Tenant Audit Log — Institution-Visible Security Events	Q57	approved 2026-09-23
TX-RAMP Certification Path	Q96	draft
Cloudflare WAF Rule Set for gevell.com (Pro)	Q49	approved 2026-09-23

Assessments and testing (assessments/)

Document	UTHealth question	Status
Attack Surface Review	Q62–63	draft
Penetration Test Runbook	Q63	draft