Identity & access
- RBAC / ABAC
- Least privilege
- MFA
- Privileged access
Product assurance
Security controls
Proposed controls need an owner, scope and evidence before being labelled implemented.
Five control domains
Channel & network
- mTLS
- Firewall
- Segmentation
- Endpoint identity
Data & keys
- Encryption in transit & at rest
- Key lifecycle
- Data-domain separation
- Biometric template access
Operations
- Monitoring / SIEM
- Backup / DR
- Incident response
- Change control
Secure development
- Source code review (Code Review)
- SAST / DAST testing
- Dependency vulnerability scanning (SCA)
- Penetration testing & remediation (Pentest)
When may a control be published as implemented?
- 01Define scope
- 02Inspect configuration
- 03Test
- 04Independent review
- 05Scoped publication