At FieldWorker, we believe that social care agencies, small and large, should have access to state-of-the-art social technology to provide quality, HIPAA-compliant care. We understand that protecting sensitive health records, personal data, and care documentation is paramount. Our platform is designed to uphold the highest standards of data security, operational resilience, and risk management across all home and community-based services.
Core Security Badges & Standards
HIPAA Compliance: Built with strict administrative, physical, and technical safeguards to protect electronic Protected Health Information (ePHI).
NIST Cybersecurity Framework (CSF) 2.0 Aligned: Governed by a rigorous risk-based lifecycle to protect corporate assets and client data against evolving threats.
Fieldworker is committed to maintaining the highest standards of data security, operational resilience, and risk management. This document provides a high-level overview of how Fieldworker implements the NIST Cybersecurity Framework (CSF) 2.0 to protect corporate assets and client data. Our security posture is engineered on top of Microsoft Azure’s secure cloud infrastructure under a Shared Responsibility Model. We cross-map our NIST outcomes to the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM / CAIQ v4) for cloud architecture transparency and the HIPAA Security Rule for the protection of electronic Protected Health Information (ePHI).
Rather than relying on a static security posture, Fieldworker utilizes the NIST CSF 2.0 risk-based lifecycle to govern, identify, protect, detect, respond to, and recover from evolving digital threats. Our alignment is demonstrated through the following core operational pillars:
Govern: Cybersecurity risk management is fully integrated into our corporate governance. Security policies, roles, and resource allocations are approved by executive leadership, and supply chain risks are actively evaluated.
Identify: We maintain dynamic inventories of enterprise assets, data flows, and systems to continuously assess and prioritize organizational risks.
Protect: Robust access controls, data encryption, staff awareness training, and infrastructure protections are actively enforced to mitigate potential security events.
Detect: Continuous monitoring systems and anomaly detection mechanisms are deployed to surface potential security incidents in real time.
Respond: Documented and regularly tested Incident Response Plans (IRPs) ensure swift containment, analysis, and communication during a security event.
Recover: Business continuity and disaster recovery strategies are maintained to minimize operational downtime and restore services reliably.
Core Function Implementations
1. Govern (GV)
Policy Oversight: Information security policies are mapped directly to CSF 2.0 categories, reviewed annually, and signed off by executive management.
Supply Chain Risk: Third-party vendors and cloud service providers must undergo formal security reviews and sign data protection agreements before onboarding.
2. Identify (ID)
Asset Management: Automated tooling maps and inventories physical hardware, cloud infrastructure, and software applications.
Risk Assessment: Vulnerability scans and risk assessments are executed regularly to identify threats to data confidentiality and integrity.
3. Protect (PR)
Access Control: Identity and Access Management (IAM) systems enforce the principle of least privilege. Multi-Factor Authentication (MFA) is mandatory for all corporate systems.
Data Security: Data is encrypted at rest using industry-standard protocols (e.g., AES-256) and in transit (e.g., TLS 1.3).
Awareness Training: All personnel complete security awareness training upon hire, supplemented by regular phishing simulations.
4. Detect (DE)
Continuous Monitoring: Network traffic, system logs, and endpoint activities are aggregated into a centralized logging platform for analysis.
Threat Detection: Automated alerts flag unauthorized access attempts, anomalous data transfers, or configuration drift.
5. Respond (RS)
Incident Response: A dedicated response team follows structured playbooks to contain, mitigate, and eradicate identified threats.
Testing: Tabletop exercises are conducted annually to validate communication protocols and technical response capabilities.
6. Recover (RC)
Resilience Strategy: Immutable backups are maintained and stored securely in isolated environments.
Restoration: Business continuity plans are routinely tested to verify that recovery time objectives (RTO) and recovery point objectives (RPO) meet business obligations.
Fieldworker performs an annual gap analysis comparing our Current Profile against an aggressive Target Profile. Remediation activities are prioritized based on risk impact and are tracked to completion to ensure our defense capabilities mature alongside the threat landscape.
Compliance & Framework Disclaimer
The security framework models and identifiers displayed on this page (including the NIST Cybersecurity Framework, Cloud Security Alliance CAIQ, and HIPAA guidelines) represent industry standards that Fieldworker actively aligns with and adopts. Use of these framework references does not imply official certification, endorsement, or sponsorship by the United States Government, the Department of Health and Human Services, or the Cloud Security Alliance. All product names, logos, and brands are property of their respective owners.
