Compliance and CDC cloud access [EPIC - Closeout]

derekadombek commented 4 weeks ago

This can be our epic level ticket

~~Start how Okta/SSO is being used with SimpleReport.~~
[ ] Document the entirety of the current DevOps work that has been done and also how to use them.
[ ] Automating a cron to destroy our environments especially for the demo envs
[x] Remove unneeded resource groups, creds and keep just dev and demo
[ ] Add a firewall to our App Gateway [Stretch Goal]
~~Use NAT Gateway for outbound traffic~~
Put in for a CDC cloud consultation and get recommended advice by other colleagues that have done so in the past(Are we for sure wanting to go this route? because once we're leaving we will need to go through the cloud account removal process as well probably. Also do we have approval to do this from our CDC stakeholders?) Maybe ask whoever is consulting with us if they feel comfortable about even creating an account for us, knowing we will be gone in 2 months.
Meet with SimpleReport and other knowledgeable folks on compliance related advice, in particular, SOC2 certs and possibly HIPAA related concerns. If we're hosted under the CDC do we need to worry about have SOC2 and HIPAA compliance?

bora-skylight commented 3 days ago

@marycrawford @derekadombek @bora-skylight Connect on what we want to prioritize from this ticket and close out

marycrawford commented 1 day ago

@bora-skylight, @derekadombek and I modified this epic to the items we want to prioritize. Let us know your thoughts.

CDCgov / ReportVision