Classic Test Prep · Trust Center
Written policies
Every policy below is a real document, owned by our security coordinator, reviewed at least annually. Districts receive full copies on request; the summaries here say what each one commits us to.
Last updated November 12, 2026
Information Security Policy
Scope, roles, the security coordinator, and the control framework everything else hangs from.
Access Control Policy
Named accounts, least privilege, MFA, quarterly reviews, immediate revocation.
Incident Response Plan
Detection, triage, containment, district notification timelines, post-incident review.
Data Retention and Destruction Policy
What we keep, for how long, and how erasure and certification work.
Vendor Management Policy
How subprocessors are chosen, contracted, listed, and reviewed.
Secure Development Policy
Version control, review, automated checks, dependency updates, secrets handling.
Security Awareness and Training Policy
Who is trained, on what, and how completion is recorded.
Business Continuity and Disaster Recovery Plan
Backups, recovery objectives, annual restore test.
Risk Assessment 2026
Annual assessment of threats, likelihood, impact, and treatment.
Student Data Request Runbook
How a district or parent request for access, export, correction, or deletion is fulfilled within 3 calendar days.
Request any document: security@classictestprep.com.