Control catalog
Each control names its objective, its implementation, its owner, and the artifact that proves it works.
A control that exists only as a policy sentence cannot be audited or improved. Every entry here binds a cryptographic decision to an accountable team, a framework clause, and a concrete piece of evidence produced on a stated cadence.
Educational portfolio demonstration. These controls, owners, postures and evidence artifacts are invented for illustration, and the framework references are illustrative mappings — not an assessment, certification or statement of compliance for any organisation.
9 controls shown
Control register
Posture reflects the synthetic assurance evidence: effective, monitored with a known deviation, or an accepted gap on the roadmap.
Envelope encryption for tenant data
Objective. Confidential tenant records remain unreadable if storage media or a database snapshot is exposed.
Implementation. Per-tenant data encryption key wrapped by a regional KMS customer master key. DEKs cached in memory for 5 minutes, never persisted in plaintext.
- Algorithm / mechanism
- AES-256-GCM (DEK) / KMS-wrapped CMK
- Accountable owner
- Platform Data Services
- Framework mapping
- ISO 27001 A.8.24NIST SP 800-57PCI DSS 3.5
- Evidence artifact
- Synthetic KMS key policy export + unit test proving ciphertext rejection on tampered AAD.
Field-level encryption for regulated attributes
Objective. National ID and payment attributes are protected even from operators with database read access.
Implementation. Deterministic encryption only where equality search is required; randomized AES-GCM elsewhere. Column allow-list enforced in schema review.
- Algorithm / mechanism
- AES-256-GCM / AES-256-SIV
- Accountable owner
- Application Security
- Framework mapping
- GDPR Art. 32PCI DSS 3.4
- Evidence artifact
- Schema diff showing 3 columns pending migration off application-layer hashing.
TLS 1.3 baseline with mTLS east-west
Objective. All service-to-service traffic is authenticated and confidential inside the mesh.
Implementation. Service mesh issues short-lived workload certificates (24h) from an internal CA; TLS 1.2 permitted only on documented partner egress.
- Algorithm / mechanism
- TLS 1.3 (X25519 + AES-256-GCM), ECDSA P-256 workload certs
- Accountable owner
- Cloud Network Engineering
- Framework mapping
- NIST SP 800-52r2CIS 3.10
- Evidence artifact
- Synthetic scanner report: 18 endpoints still advertise TLS 1.2 cipher suites.
Key rotation and revocation runbook
Objective. Compromise or expiry of a key is contained without customer-visible downtime.
Implementation. Dual-version key aliases allow decrypt-with-old / encrypt-with-new. Revocation drills executed twice per year with timing evidence.
- Algorithm / mechanism
- KMS alias versioning, HSM-backed CMKs (FIPS 140-3 L3)
- Accountable owner
- Security Engineering
- Framework mapping
- NIST SP 800-57 Pt.1SOC 2 CC6.1
- Evidence artifact
- Redacted drill log: 11 minutes from revocation to full re-wrap of 4,200 synthetic DEKs.
Separation of duties on key administration
Objective. No single identity can both administer a key and read the data it protects.
Implementation. KMS key policies split kms:ScheduleKeyDeletion / kms:Decrypt across distinct roles; break-glass requires two-person approval with 8h TTL.
- Algorithm / mechanism
- Policy-based authorization (no crypto primitive)
- Accountable owner
- Identity & Access Management
- Framework mapping
- ISO 27001 A.5.3SOC 2 CC6.3
- Evidence artifact
- IAM policy simulation output for 6 synthetic principals.
Password and credential hashing standard
Objective. Credential database exposure does not yield usable passwords.
Implementation. Argon2id with per-user salt and tuned memory cost; legacy bcrypt hashes upgraded transparently at next successful login.
- Algorithm / mechanism
- Argon2id (m=64MiB, t=3, p=2)
- Accountable owner
- Identity & Access Management
- Framework mapping
- OWASP ASVS 2.4NIST SP 800-63B
- Evidence artifact
- Benchmark table showing ~250ms verify cost on reference instance size.
Artifact signing and provenance verification
Objective. Only build artifacts produced by the trusted pipeline can be deployed.
Implementation. Pipeline signs container digests; admission controller rejects unsigned or unknown-issuer images. Signing keys are non-exportable.
- Algorithm / mechanism
- ECDSA P-256 detached signatures, SHA-256 digests
- Accountable owner
- Platform Engineering
- Framework mapping
- SLSA L3NIST SSDF PO.3
- Evidence artifact
- Admission controller audit sample: 2 dry-run violations from a legacy namespace.
Webhook and message integrity
Objective. Inbound partner callbacks cannot be forged or replayed.
Implementation. HMAC-SHA-256 over raw body plus timestamp, constant-time comparison, 5-minute replay window, per-partner secret in the secret store.
- Algorithm / mechanism
- HMAC-SHA-256
- Accountable owner
- Integration Engineering
- Framework mapping
- OWASP ASVS 13.4
- Evidence artifact
- Negative test suite: 14 forged-signature cases rejected.
Post-quantum readiness inventory
Objective. Long-lived confidential data is not exposed to harvest-now-decrypt-later risk.
Implementation. Cryptographic bill of materials records every asymmetric usage, data lifetime, and migration wave; hybrid key exchange piloted on the ingress tier.
- Algorithm / mechanism
- X25519+ML-KEM hybrid (pilot), ML-DSA (evaluation)
- Accountable owner
- Security Architecture
- Framework mapping
- NIST IR 8547 (draft)CNSA 2.0
- Evidence artifact
- CBOM extract: 31 RSA-2048 usages with data lifetime beyond 2035.
How this catalog is used
The design review gate
Any new data store, external integration, or authentication path passes through a short review that resolves to catalog entries rather than opinions.
1 · Classify
What is the data, who is the adversary, and how long must the confidentiality hold? A 10-year retention answer changes the algorithm choice immediately.
2 · Map
Select the controls that already exist for that classification. If none fit, the outcome is an ADR and a catalog change — not a bespoke implementation.
3 · Evidence
Agree the artifact that will prove the control works, and who regenerates it each quarter. No artifact, no approval.