Identity & access
RBAC / ABACMFALeast privilegePrivileged access
Product assurance
Security controls
Proposed controls need an owner, scope and evidence before being labelled implemented.
Five control domains
Channel & network
mTLSSegmentationFirewallEndpoint identity
Data & keys
Encryption in transit / at restKey lifecycleDomain separationTemplate access
Operations
Monitoring / SIEMIncident responseBackup / DRChange control
Secure development
Code reviewSAST / DASTDependency scanningPentest / remediation
When may a control be published as implemented?
- 01Define scope
- 02Inspect configuration
- 03Test
- 04Independent review
- 05Scoped publication