CONTROL DOMAIN
Identity Security
Authentication, identity assurance, account lifecycle and privileged access.
SECURITY & RESILIENCESERVICE REFERENCE
Security claims are scoped controls, not adjectives.
Each public security statement must disclose whether it is a design control, implemented control, tested control, certified control, external control or planned control.
12 SECURITY DOMAINS
Security follows the service trust chain end to end.
Deployment-specific controls are not represented as universally implemented unless evidence exists.
CONTROL DOMAIN
Access Control
RBAC, ABAC, purpose, mandate and field-level disclosure.
CONTROL DOMAIN
API Security
OAuth/OIDC profiles, token validation, replay controls, idempotency and rate limiting where implemented.
CONTROL DOMAIN
Connector Security
Credential isolation, transport protection, allowlisting, retry and reconciliation.
CONTROL DOMAIN
Data Security
Classification, encryption, retention, backup and residency controls by deployment.
CONTROL DOMAIN
Cryptographic Trust
CA, TSA, eSeal, HSM/KMS, certificate status and trusted-time dependencies.
CONTROL DOMAIN
Device Security
Certificate lifecycle, hardware-bound keys, attestation and runtime appraisal.
CONTROL DOMAIN
Tenant Security
Tenant isolation, organisation boundary and privileged administration.
CONTROL DOMAIN
Application Security
Secure SDLC, SAST/DAST, dependency/SBOM and vulnerability processes as implemented.
CONTROL DOMAIN
Operations Security
Logging, SIEM/SOC integration, alerting and incident response by deployment.
CONTROL DOMAIN
Business Continuity
HA, backup, recovery, RPO/RTO and DR evidence when contractually defined.
CONTROL DOMAIN
Supply-chain Security
Third-party dependencies, connector/provider risk and evidence boundaries.
CLAIM GOVERNANCE
Architecture is not certification.
Use evidence and explicit control status before publishing security claims.
DESIGN CONTROL
Defined by reference architecture.
IMPLEMENTED CONTROL
Implemented in a defined environment and version.
TESTED CONTROL
Supported by repeatable test evidence.
CERTIFIED CONTROL
Covered by an independent certificate with explicit scope.