Scope and principles
Security is implemented through controls around identity, access, network transport, logging and operational response, with a defined owner for each control.
Core information
Security is implemented through controls around identity, access, network transport, logging and operational response, with a defined owner for each control.
Operating model
Controls are part of the service path and should produce evidence that can be checked during an investigation or review.
Rights and requests
Security requests should identify the relevant service, control, event or identifier without exposing unnecessary sensitive information.
Review checklist
- Identify which security control applies to the request path.
- Check the control owner and available evidence of enforcement.
- Record the event, time and technical context needed for a safe review.