The policy governs the complete lifecycle of infrastructure dependency management, from discovery and classification through monitoring, resilience planning, and incident response. It provides formal oversight of cloud platforms, authentication systems, electronic health records (EHRs), network infrastructure, and data pipelines, while enforcing controls against Shadow IT and unauthorized technologies.

Using a tiered risk model, Thriveworks classifies infrastructure to prioritize security and continuity measures based on system criticality. Tier 1 systems—including identity providers and security telemetry pipelines—undergo real-time monitoring, geo-redundant failover, and strict access controls. We monitor these dependencies through platforms like Datadog, Tanium, and SentinelOne, with additional visibility from Freshservice, CloudCraft, and SumoLogic.

Following the NIST Cybersecurity Framework (CSF) and HIPAA requirements, this policy helps Thriveworks mitigate operational and cybersecurity risks. It protects the confidentiality, integrity, and availability of electronic protected health information (ePHI), maintains compliance, and strengthens digital resilience and operational continuity.

The procedures defined in this policy are essential for:

This policy applies to all Thriveworks personnel—including employees, contractors, and authorized third-party service providers—who interact with or manage the organization's cyber infrastructure and dependencies. It covers the systems, services, platforms, and technologies that support Thriveworks' digital operations, focusing on components essential for cybersecurity, operational continuity, and regulatory compliance.

The scope of this policy includes:

This section establishes a common vocabulary for terms used throughout the Critical Infrastructure & Dependencies Policy to ensure consistency and clarity across the Thriveworks organization.

Critical infrastructure and dependencies are identified through several key lenses. From a business perspective, we evaluate systems that could disrupt healthcare services, patient data access, or regulatory obligations, such as EHR and IAM systems. Security considerations focus on components affecting confidentiality, integrity, and availability, including identity providers and network gateways. We also assess operational dependencies like DNS and authentication layers, as well as compliance requirements for HIPAA-protected workflows and breach detection mechanisms. Special attention is given to potential Single Points of Failure (SPOFs) and systems lacking proper redundancy.

Our identification process combines multiple approaches, including Business Impact Analyses, security risk assessments, and close collaboration with department leads. We regularly conduct inventory audits of cloud assets and third-party tools, while mapping dependencies during vendor onboarding and project planning. This process is supported by key tools like Freshservice CMDB for asset tracking, Datadog and CloudCraft for infrastructure visualization, and detailed logical diagrams showing cross-service relationships.

All infrastructure and dependencies are recorded in a centralized repository, capturing essential details such as system classification, primary functions, dependencies, hosting information, and security requirements. This documentation extends to our external dependencies, which include critical platforms such as:

These platforms are integral to our production workflows and undergo rigorous monitoring and compliance reviews.

To effectively manage risk and operational resilience, Thriveworks classifies infrastructure dependencies based on their criticality to business operations, security posture, and regulatory compliance. This classification guides prioritized monitoring, incident response planning, business continuity, and resource allocation.

Dependencies are categorized into four tiers.

Classification decisions stem from business impact analyses (BIAs), regulatory requirements—especially regarding HIPAA and ePHI—system integration depth, and operational necessity. Recovery expectations such as RTO/RPO and vendor SLA commitments also factor into the assessment.

System owners propose classification levels during onboarding or major system changes. IT Security reviews and validates these classifications to ensure alignment with organizational risk tolerance. The CMDB and CloudCraft diagrams use tier-based tagging for clear visibility and filtering.

Classifications undergo quarterly reviews alongside infrastructure risk audits. Additional reviews occur after significant events like system upgrades, vendor changes, or post-incident analyses. When outages reveal misclassified dependencies or cascade failures, classifications receive immediate reassessment. The system owner, security team, and infrastructure team coordinate reclassifications, updating all documentation, diagrams, and monitoring dashboards accordingly.

To ensure the availability, integrity, and security of Thriveworks' critical infrastructure and dependencies, this section outlines baseline control requirements for implementation across the ecosystem. These controls mitigate operational disruptions, reduce cybersecurity risk, and maintain compliance with HIPAA and the NIST Cybersecurity Framework.

Thriveworks categorizes data into the following classes:

System owners are responsible for assigning initial data classification during onboarding or major architectural changes. IT Security validates classification against intended use cases and verifies enforcement of relevant controls.

This section documents the formal mapping between Thriveworks’ Critical Infrastructure & Dependencies Policy and the NIST Cybersecurity Framework (CSF) version 2.0. It serves as a compliance reference that demonstrates how Thriveworks' infrastructure governance and dependency management practices align with NIST’s cybersecurity functions and subcategories.

Purpose of this matrix: The primary objective of this matrix is to support internal and external audits, enable regulatory readiness, and demonstrate that Thriveworks’ dependency management practices satisfy requirements outlined in HIPAA, HITRUST, and the NIST CSF. By linking operational, architectural, and security practices to specific CSF subcategories, Thriveworks reinforces its evidence base for compliance, risk mitigation, and continuity assurance.

Why this matters: As healthcare delivery increasingly depends on cloud infrastructure, third-party SaaS platforms, and interconnected digital services, robust dependency management becomes essential. Mapping this policy to NIST CSF 2.0 provides measurable assurance that Thriveworks' critical infrastructure is resilient, observable, and governed by policy-aligned controls. It also facilitates gap identification and continuous improvement across system monitoring, incident recovery, and risk oversight.

The scope of this SOP covers identity enforcement, posture validation, network segmentation, session monitoring, incident response, and configuration governance across the compliance boundary defined — Thriveworks ZTNA infrastructure.