Compliance and CDC cloud access [EPIC - Closeout]

[derekadombek]

This can be our epic level ticket

• Start how Okta/SSO is being used with SimpleReport.
• Document the entirety of the current DevOps work that has been done and also how to use them. #456
• GHA to destroy our environments #455
• Make deploying to demo environment less manual #460
• Remove unneeded resource groups, creds and keep just dev and demo
• Update App Gateway with Indendent Network and Add WAF/Firewall Protections #463 [Stretch Goal]
• Use NAT Gateway for outbound traffic
• Put in for a CDC cloud consultation and get recommended advice by other colleagues that have done so in the past(Are we for sure wanting to go this route? because once we're leaving we will need to go through the cloud account removal process as well probably. Also do we have approval to do this from our CDC stakeholders?) Maybe ask whoever is consulting with us if they feel comfortable about even creating an account for us, knowing we will be gone in 2 months.
• Meet with SimpleReport and other knowledgeable folks on compliance related advice, in particular, SOC2 certs and possibly HIPAA related concerns. If we're hosted under the CDC do we need to worry about have SOC2 and HIPAA compliance?

[bora-skylight]

@marycrawford @derekadombek @bora-skylight Connect on what we want to prioritize from this ticket and close out

[marycrawford]

@bora-skylight, @derekadombek and I modified this epic to the items we want to prioritize. Let us know your thoughts.

[bora-skylight]

Thank you @marycrawford and @derekadombek! Also appreciate you all creating the separate prioritized tickets!