Information Security Policy

Draft Information Security Policy covering access control, encryption in transit/at rest (via hosting providers), secret management, MFA for privileged staff, vulnerability response, and secure development practices.

Operational controls are implemented in MedCentre OS through RLS, audit logs, private storage, and session management.