Security, Credentials & Access Governance

Policy POL-SEC-01

Maintained by CultureOS

This policy establishes mandatory operational protocols for identity verification, credential security, and role-based access control across all Foundation services.

Foundation security governance frameworks and infrastructure baselines are configured, deployed, and managed by CultureOS. CultureOS is an AI-native practice helping cultural institutions modernize digital infrastructure, archives, and research workflows responsibly.

Identity & Role Hierarchy

Access privileges across all digital infrastructure are strictly delineated into two functional tiers:

Tier	Role Title	Permitted Scope
Tier 1	System Administrator	Infrastructure deployment, database management, user provisioning, audit inspection, Caddy routing
Tier 2	Institutional Member	Standard usage within ToFF Digital Archive (listen) and Institutional Signing Framework (sign)

Credential Safety Requirements

1. Password Entropy: Passwords must contain a minimum of 16 characters generated via cryptographically secure random entropy or institutional password vaults.
2. Account Disablement: When personnel transition off board or committee assignments, administrative personnel must immediately revoke system access and invalidate active sessions.
3. Multi-Factor Authentication (MFA): Where supported by the underlying engine, MFA is strictly mandatory for all administrative roles.

Infrastructure Access (Tier 1)

1. SSH Authentication: Direct host management on the Oracle VM (150.136.89.198) is restricted exclusively to authorized public-key cryptography (ed25519). Password-based root logins are permanently disabled at the kernel firewall level.
2. Reverse Proxy Configuration: All domain routing is governed via declarative Caddy configuration (/opt/isf/Caddyfile), with automated TLS key generation. Direct port exposure to the public internet is prohibited.
3. Backup Integrity: Automated backup snapshots must be regularly verified via dry-run restoration procedures.