id	domain_code	domain_name	title	answer	note
AA-01	AA	Audit & Assurance	Audit and Assurance Policy and Procedures	Yes	Audit policy documented in `docs/canonical/30_Chain_Verifier_Auditor_Runbook.md` and `31_Pilot_Ready_Attestation.md`. Single-founder operation; written policy maintained in `docs/canonical/` and reviewed at every release. No formal annual sign-off cycle yet — planned post first paying pilot.
AA-02	AA	Audit & Assurance	Independent Assessments	No	No third-party SOC 2 / ISO 27001 / STAR Level 2 yet. Pen-test SoW drafted (`19_Pen_Test_RFP.md`); execution planned post first paying pilot.
AA-03	AA	Audit & Assurance	Risk Based Planning Assessment	Yes	Risk register maintained internally; SWOT v2 published (`01_SWOT_v2.md`). Re-reviewed every release.
AA-04	AA	Audit & Assurance	Requirements Compliance	Yes	Compliance scope mapped in `25_Pilot_Prospectus.md` and `32_Trust_Pack.md` (JFSC AML/CFT/CPF, DPJL 2018, UK GDPR-aligned).
AA-05	AA	Audit & Assurance	Audit Management Process	Partial	Internal audit only (founder-led, evidenced via hash-chained audit trail). External audit programme not yet established.
AA-06	AA	Audit & Assurance	Remediation	Yes	Issues tracked in product `issues` table with status workflow, escalation, and audit-trailed remediation. See Trust Pack §6.
AIS-01	AIS	Application & Interface Security	Application and Interface Security Policy and Procedures	Yes	SDLC + interface security policy embedded in commit / review workflow; see `docs/canonical/architecture-overview.md`.
AIS-02	AIS	Application & Interface Security	Application Security Baseline Requirements	Yes	Baseline: TypeScript strict, RLS-by-default, no service-role on user paths, signed webhooks, CSP. Enforced in code review.
AIS-03	AIS	Application & Interface Security	Application Security Metrics	Partial	Dependency-scan + lint metrics in CI; no formal monthly metrics report yet.
AIS-04	AIS	Application & Interface Security	Secure Application Design and Development	Yes	Threat modelling at architecture-change time; secure-by-default patterns documented in `architecture-overview.md`.
AIS-05	AIS	Application & Interface Security	Automated Application Security Testing	Partial	Dependency-scan automated in CI; SAST coverage limited. DAST / pen-test deferred to `19_Pen_Test_RFP.md` engagement.
AIS-06	AIS	Application & Interface Security	Automated Secure Application Deployment	Yes	Lovable-managed CI/CD; every deploy is git-tracked and reproducible; rollback by re-deploy of prior commit.
AIS-07	AIS	Application & Interface Security	Application Vulnerability Remediation	Yes	Public Vulnerability Disclosure Policy at `riskalignplatform.com/vdp` (see `28_Vulnerability_Disclosure_Policy.md`); SLAs documented.
BCR-01	BCR	Business Continuity Management & Operational Resilience	Business Continuity Management Policy and Procedures	Yes	BCP outline at `07_BCP_Outline.md`. Reviewed at every major release.
BCR-02	BCR	Business Continuity Management & Operational Resilience	Risk Assessment and Impact Analysis	Yes	BIA documented in BCP outline; RTO 8h / RPO 24h for tenant data (mirrors Trust Pack §8).
BCR-03	BCR	Business Continuity Management & Operational Resilience	Business Continuity Strategy	Yes	Strategy: rely on managed-platform multi-AZ + daily DB snapshots; founder-led incident response. See `07_BCP_Outline.md`.
BCR-04	BCR	Business Continuity Management & Operational Resilience	Business Continuity Planning	Yes	Plan documented; named successor scoped in `16_Successor_Role_Spec.md`.
BCR-05	BCR	Business Continuity Management & Operational Resilience	Documentation	Yes	All BCP/DR docs in `docs/canonical/`; published Trust Pack §7.
BCR-06	BCR	Business Continuity Management & Operational Resilience	Business Continuity Exercises	No	No live BCP exercise executed yet. Tabletop scheduled for Q3 2026 once first pilot live.
BCR-07	BCR	Business Continuity Management & Operational Resilience	Communication	Yes	Status page at `riskalignplatform.com/status`; incident communication via direct email to tenant admins.
BCR-08	BCR	Business Continuity Management & Operational Resilience	Backup	Yes	Lovable Cloud (Supabase EU) daily automated backups; point-in-time recovery enabled. See Trust Pack §2.
BCR-09	BCR	Business Continuity Management & Operational Resilience	Disaster Response Plan	Yes	DR plan documented in `07_BCP_Outline.md`; relies on managed-platform multi-AZ failover.
BCR-10	BCR	Business Continuity Management & Operational Resilience	Response Plan Exercise	No	Not yet exercised; planned alongside BCR-06.
BCR-11	BCR	Business Continuity Management & Operational Resilience	Equipment Redundancy	N/A	Managed platform (Cloudflare + Supabase EU) provides infrastructure redundancy. RiskAlign owns no physical equipment.
CCC-01	CCC	Change Control & Configuration Management	Change Management Policy and Procedures	Yes	Every change is a git commit with reviewer + deploy audit trail. Lovable-managed deploys.
CCC-02	CCC	Change Control & Configuration Management	Quality Testing	Yes	Type-check + lint + Vitest required on every change; visual QA before publish.
CCC-03	CCC	Change Control & Configuration Management	Change Management Technology	Yes	Git + Lovable CI/CD. Append-only audit-trail with SHA-256 hash chain; per-page verifier at `riskalignplatform.com/verify`. See Trust Pack §6.
CCC-04	CCC	Change Control & Configuration Management	Unauthorized Change Protection	Yes	Only the founder can deploy; MFA-enforced on Lovable account. Branch protection on `main`.
CCC-05	CCC	Change Control & Configuration Management	Change Agreements	Yes	Pilot Agreement (`05_Pilot_Agreement_Scaffold.md`) covers change-notification cadence.
CCC-06	CCC	Change Control & Configuration Management	Change Management Baseline	Yes	Baseline = current `main` branch + last deployed commit SHA; reproducible by checkout.
CCC-07	CCC	Change Control & Configuration Management	Detection of Baseline Deviation	Partial	Git tracks code drift; runtime config drift caught manually. Automated config-drift alerting deferred.
CCC-08	CCC	Change Control & Configuration Management	Exception Management	Yes	Exceptions logged as issues; require sign-off + audit-trail entry.
CCC-09	CCC	Change Control & Configuration Management	Change Restoration	Yes	Rollback by re-deploying prior commit; DB rollback via Supabase PITR. RTO < 1h.
CEK-01	CEK	Cryptography, Encryption & Key Management	Encryption and Key Management Policy and Procedures	Yes	TLS 1.2+ in transit, AES-256 at rest (Lovable Cloud managed). Key custody is sub-processor side — see Trust Pack §2/§3.
CEK-02	CEK	Cryptography, Encryption & Key Management	CEK Roles and Responsibilities	Yes	Founder owns key-lifecycle decisions; day-to-day key custody is delegated to sub-processors (Cloudflare, Supabase).
CEK-03	CEK	Cryptography, Encryption & Key Management	Data Encryption	Yes	TLS 1.2+ in transit, AES-256 at rest (Lovable Cloud managed). Key custody is sub-processor side — see Trust Pack §2/§3.
CEK-04	CEK	Cryptography, Encryption & Key Management	Encryption Algorithm	Yes	AES-256 at rest, TLS 1.2+ (incl. TLS 1.3) in transit. No proprietary crypto.
CEK-05	CEK	Cryptography, Encryption & Key Management	Encryption Change Management	Yes	Crypto changes flow through normal CCC change process; sub-processor crypto changes tracked via vendor advisories.
CEK-06	CEK	Cryptography, Encryption & Key Management	Encryption Change Cost Benefit Analysis	Yes	Documented when crypto is changed; default = use sub-processor managed crypto, which has independent CBA.
CEK-07	CEK	Cryptography, Encryption & Key Management	Encryption Risk Management	Yes	Crypto-risk reviewed at architecture-change time; logged in risk register.
CEK-08	CEK	Cryptography, Encryption & Key Management	CSC Key Management Capability	No	Bring-your-own-key not supported and not on the near-term roadmap. Customer keys are not separable from managed-platform encryption at this stage; a true BYOK answer would require application-layer envelope encryption we have not built. Tracked openly at /security/roadmap (trigger: enterprise procurement requirement).
CEK-09	CEK	Cryptography, Encryption & Key Management	Encryption and Key Management Audit	Partial	Internal review only; relies on sub-processor SOC 2 / ISO 27001 attestations.
CEK-10	CEK	Cryptography, Encryption & Key Management	Key Generation	Yes	Keys generated by sub-processors (Cloudflare, Supabase); no founder-managed long-lived keys other than API/webhook secrets.
CEK-11	CEK	Cryptography, Encryption & Key Management	Key Purpose	Yes	Each key has a single purpose (TLS cert, DB encryption, webhook HMAC, API key signing).
CEK-12	CEK	Cryptography, Encryption & Key Management	Key Rotation	Yes	Sub-processor keys rotated per their published schedule. Tenant API keys / webhook secrets rotatable on demand via `/admin/api-keys`.
CEK-13	CEK	Cryptography, Encryption & Key Management	Key Revocation	Yes	API keys revocable instantly via operator UI; HTTP 401 returned on next call.
CEK-14	CEK	Cryptography, Encryption & Key Management	Key Destruction	Yes	Revoked keys are deleted, not just disabled; sub-processor key destruction per their procedures.
CEK-15	CEK	Cryptography, Encryption & Key Management	Key Activation	Yes	API keys active on creation; sub-processor keys per their lifecycle.
CEK-16	CEK	Cryptography, Encryption & Key Management	Key Suspension	Yes	API keys can be disabled (suspended) before deletion via operator UI.
CEK-17	CEK	Cryptography, Encryption & Key Management	Key Deactivation	Yes	Deactivation is identical to revocation for API keys; sub-processor lifecycle per their controls.
CEK-18	CEK	Cryptography, Encryption & Key Management	Key Archival	N/A	RiskAlign-issued keys are not archived (no need: re-issue is one click). Sub-processor practice per their controls.
CEK-19	CEK	Cryptography, Encryption & Key Management	Key Compromise	Yes	Suspected compromise → revoke + re-issue + audit-trail entry + tenant-admin notification.
CEK-20	CEK	Cryptography, Encryption & Key Management	Key Recovery	N/A	Tenant API keys cannot be recovered after revocation; sub-processor key recovery per their controls.
CEK-21	CEK	Cryptography, Encryption & Key Management	Key Inventory Management	Yes	Active keys listed at `/admin/api-keys` per tenant; webhook secrets at `/admin/regulator-endpoints`.
DCS-01	DCS	Datacenter Security	Off-Site Equipment Disposal Policy and Procedures	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-02	DCS	Datacenter Security	Off-Site Transfer Authorization Policy and Procedures	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-03	DCS	Datacenter Security	Secure Area Policy and Procedures	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-04	DCS	Datacenter Security	Secure Media Transportation Policy and Procedures	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-05	DCS	Datacenter Security	Assets Classification	Yes	Logical asset classification (data classification at table level, sensitivity tagged via `data_classification` column). Physical-asset classification N/A.
DCS-06	DCS	Datacenter Security	Assets Cataloguing and Tracking	Yes	Logical asset inventory in `data-model-map.md` and `architecture-overview.md`. Physical assets N/A.
DCS-07	DCS	Datacenter Security	Controlled Access Points	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-08	DCS	Datacenter Security	Equipment Identification	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-09	DCS	Datacenter Security	Secure Area Authorization	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-10	DCS	Datacenter Security	Surveillance System	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-11	DCS	Datacenter Security	Unauthorized Access Response Training	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-12	DCS	Datacenter Security	Cabling Security	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-13	DCS	Datacenter Security	Environmental Systems	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-14	DCS	Datacenter Security	Secure Utilities	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DCS-15	DCS	Datacenter Security	Equipment Location	N/A	N/A — RiskAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.
DSP-01	DSP	Data Security & Privacy Lifecycle Management	Security and Privacy Policy and Procedures	Yes	Published privacy notice + DPIA template (`06_DPIA_Template.md`); JOIC-registered controller/processor (No. 103914).
DSP-02	DSP	Data Security & Privacy Lifecycle Management	Secure Disposal	Yes	Tenant deletion = hard delete + audit-trail entry. Backups expire per `15_Data_Retention_and_Deletion.md`.
DSP-03	DSP	Data Security & Privacy Lifecycle Management	Data Inventory	Yes	Full data inventory in `data-model-map.md`; per-table sensitivity tagging.
DSP-04	DSP	Data Security & Privacy Lifecycle Management	Data Classification	Yes	`data_classification` column on tenant rows; `live_PROHIBITED` on pilot/sandbox tenants until uplift.
DSP-05	DSP	Data Security & Privacy Lifecycle Management	Data Flow Documentation	Yes	Data flow diagram + sub-processor map in `architecture-overview.md` and `14_Sub_Processor_List.md`.
DSP-06	DSP	Data Security & Privacy Lifecycle Management	Data Ownership and Stewardship	Yes	Tenant = data owner; RiskAlign = processor for tenant data, controller for account data. Documented in Pilot Agreement §3.
DSP-07	DSP	Data Security & Privacy Lifecycle Management	Data Protection by Design and Default	Yes	RLS-by-default on every table; tenant isolation enforced at query layer.
DSP-08	DSP	Data Security & Privacy Lifecycle Management	Data Privacy by Design and Default	Yes	Minimum-necessary data collection; no special-category data accepted (enforced via upload guards).
DSP-09	DSP	Data Security & Privacy Lifecycle Management	Data Protection Impact Assessment	Yes	DPIA template provided to every tenant (`06_DPIA_Template.md`); founder DPIA performed at architecture-change time.
DSP-10	DSP	Data Security & Privacy Lifecycle Management	Sensitive Data Transfer	Yes	All transfers TLS 1.2+; EU-only sub-processors for data path.
DSP-11	DSP	Data Security & Privacy Lifecycle Management	Personal Data Access, Reversal, Rectification and Deletion	Yes	Operator UI supports DSAR / rectification / erasure; export at `/admin/data-export`.
DSP-12	DSP	Data Security & Privacy Lifecycle Management	Limitation of Purpose in Personal Data Processing	Yes	Documented in Pilot Agreement §3; tenant data not used for product improvement without explicit consent.
DSP-13	DSP	Data Security & Privacy Lifecycle Management	Personal Data Sub-processing	Yes	Public sub-processor list at `riskalignplatform.com/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.
DSP-14	DSP	Data Security & Privacy Lifecycle Management	Disclosure of Data Sub-processors	Yes	Public sub-processor list at `riskalignplatform.com/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.
DSP-15	DSP	Data Security & Privacy Lifecycle Management	Limitation of Production Data Use	Yes	Production data never used in dev/test; pilot/sandbox tenants flagged with `live_PROHIBITED` and enforce upload guards.
DSP-16	DSP	Data Security & Privacy Lifecycle Management	Data Retention and Deletion	Yes	Published policy at `15_Data_Retention_and_Deletion.md`; tenant-level retention overrideable per Pilot Agreement.
DSP-17	DSP	Data Security & Privacy Lifecycle Management	Sensitive Data Protection	Yes	No special-category data accepted; enforced by upload guards + onboarding checklist.
DSP-18	DSP	Data Security & Privacy Lifecycle Management	Disclosure Notification	Yes	Breach-notification SLA: 24h to tenant + JOIC per DPJL 2018; documented in BCP outline and Pilot Agreement §8.
DSP-19	DSP	Data Security & Privacy Lifecycle Management	Data Location	Yes	All tenant data resides in EU (Lovable Cloud EU region). Cloudflare edge does not persist tenant data.
GRC-01	GRC	Governance, Risk & Compliance	Governance Program Policy and Procedures	Yes	Governance documented in `docs/canonical/` (Trust Pack, Sub-processor list, BCP, DPIA, Retention, VDP, AI-use disclosure).
GRC-02	GRC	Governance, Risk & Compliance	Risk Management Program	Yes	Internal risk register + SWOT (`01_SWOT_v2.md`); reviewed every release.
GRC-03	GRC	Governance, Risk & Compliance	Organizational Policy Reviews	Yes	Canonical docs reviewed at every release; review log in `.lovable/handover/`.
GRC-04	GRC	Governance, Risk & Compliance	Policy Exception Process	Yes	Exceptions logged in `issues` with sign-off + audit-trail; documented in Pilot Agreement §6.
GRC-05	GRC	Governance, Risk & Compliance	Information Security Program	Yes	Trust Pack (`32_Trust_Pack.md`) is the published programme summary.
GRC-06	GRC	Governance, Risk & Compliance	Governance Responsibility Model	Yes	Founder is accountable owner; successor role scoped in `16_Successor_Role_Spec.md`.
GRC-07	GRC	Governance, Risk & Compliance	Information System Regulatory Mapping	Yes	Regulatory mapping per `25_Pilot_Prospectus.md` (JFSC AML/CFT/CPF, DPJL 2018) and the in-product Compass methodology.
GRC-08	GRC	Governance, Risk & Compliance	Special Interest Groups	Yes	Founder participates in CSA / FCA / JFSC discussion channels; subscribes to ENISA + NCSC advisories.
HRS-01	HRS	Human Resources Security	Background Screening Policy and Procedures	N/A	N/A — single founder; no employees. Will adopt policy at first hire.
HRS-02	HRS	Human Resources Security	Acceptable Use of Technology Policy and Procedures	Yes	Acceptable-use embedded in founder operating procedure; will formalise at first hire.
HRS-03	HRS	Human Resources Security	Clean Desk Policy and Procedures	Yes	Founder operates browser-only; no printed customer data; locked workspace when away.
HRS-04	HRS	Human Resources Security	Remote and Home Working Policy and Procedures	Yes	Single home-office; disk-encrypted laptop; MFA on every privileged account.
HRS-05	HRS	Human Resources Security	Asset returns	N/A	N/A — no employees / no issued assets.
HRS-06	HRS	Human Resources Security	Employment Termination	N/A	N/A — no employees yet.
HRS-07	HRS	Human Resources Security	Employment Agreement Process	N/A	N/A — no employees yet.
HRS-08	HRS	Human Resources Security	Employment Agreement Content	N/A	N/A — no employees yet. Sub-processor contracts cover equivalent obligations.
HRS-09	HRS	Human Resources Security	Personnel Roles and Responsibilities	Yes	Founder role + successor role spec in `16_Successor_Role_Spec.md`. Second-operator brief in `17_Second_Operator_Brief.md`.
HRS-10	HRS	Human Resources Security	Non-Disclosure Agreements	Yes	Mutual NDA template available; signed with every pilot prospect before sharing diligence pack.
HRS-11	HRS	Human Resources Security	Security Awareness Training	Yes	Founder maintains CPD; will formalise programme at first hire.
HRS-12	HRS	Human Resources Security	Personal and Sensitive Data Awareness and Training	Yes	Founder DPO-equivalent; maintains data-protection CPD.
HRS-13	HRS	Human Resources Security	Compliance User Responsibility	Yes	Tenant user responsibilities documented in Pilot Agreement §4 and the in-product onboarding checklist.
IAM-01	IAM	Identity & Access Management	Identity and Access Management Policy and Procedures	Yes	Row-level security on every tenant table; least-privilege role model (admin / cco / mlro / board / user). See Trust Pack §4.
IAM-02	IAM	Identity & Access Management	Strong Password Policy and Procedures	Yes	Supabase Auth password policy: min 12 chars, breach-list check via HIBP, no max length.
IAM-03	IAM	Identity & Access Management	Identity Inventory	Yes	All identities in `auth.users` + `public.tenant_users`; operator review at `/admin/tenant-users`.
IAM-04	IAM	Identity & Access Management	Separation of Duties	Yes	Maker-checker workflow on regulatory adoption; admin / cco / mlro / board roles separated. Row-level security on every tenant table; least-privilege role model (admin / cco / mlro / board / user). See Trust Pack §4.
IAM-05	IAM	Identity & Access Management	Least Privilege	Yes	Row-level security on every tenant table; least-privilege role model (admin / cco / mlro / board / user). See Trust Pack §4.
IAM-06	IAM	Identity & Access Management	User Access Provisioning	Yes	Tenant-admin invites + named roles; audit-trailed.
IAM-07	IAM	Identity & Access Management	User Access Changes and Revocation	Yes	Role changes + offboarding via `/admin/tenant-users`; immediate effect; audit-trailed.
IAM-08	IAM	Identity & Access Management	User Access Review	Yes	Quarterly access review prompt on `/admin/tenant-users`; results captured in audit trail.
IAM-09	IAM	Identity & Access Management	Segregation of Privileged Access Roles	Yes	`sandbox_admin` (founder cross-tenant) is separate from per-tenant `admin`.
IAM-10	IAM	Identity & Access Management	Management of Privileged Access Roles	Yes	Privileged roles grant logged in `user_roles` + audit-trailed; manual approval required.
IAM-11	IAM	Identity & Access Management	CSCs Approval for Agreed Privileged Access Roles	Yes	Founder cross-tenant access is documented in Pilot Agreement §5; tenant can revoke at any time.
IAM-12	IAM	Identity & Access Management	Safeguard Logs Integrity	Yes	Append-only audit-trail with SHA-256 hash chain; per-page verifier at `riskalignplatform.com/verify`. See Trust Pack §6.
IAM-13	IAM	Identity & Access Management	Uniquely Identifiable Users	Yes	Every action stamped with `auth.uid()` + tenant; no shared accounts.
IAM-14	IAM	Identity & Access Management	Strong Authentication	Yes	MFA-enforced for founder accounts (RiskAlign). MFA-enforced for tenant admins on roadmap (queued).
IAM-15	IAM	Identity & Access Management	Passwords Management	Yes	Supabase Auth; bcrypt-hashed; reset via verified email; no plaintext storage.
IAM-16	IAM	Identity & Access Management	Authorization Mechanisms	Yes	RLS + has_role() security-definer functions; documented in `architecture-overview.md`.
IPY-01	IPY	Interoperability & Portability	Interoperability and Portability Policy and Procedures	Yes	Documented data-export commitment in Pilot Agreement §9.
IPY-02	IPY	Interoperability & Portability	Application Interface Availability	Yes	Public REST API v1 at `/api/public/v1/*`; contract PDF in `public/downloads/canonical/public-api-contract.pdf`.
IPY-03	IPY	Interoperability & Portability	Secure Interoperability and Portability Management	Yes	API authenticated with bearer tokens; webhooks signed HMAC-SHA256.
IPY-04	IPY	Interoperability & Portability	Data Portability Contractual Obligations	Yes	Pilot Agreement §9 commits to CSV/JSON export of all tenant data on request, format documented in `public-api-contract.md`.
IVS-01	IVS	Infrastructure & Virtualization Security	Infrastructure and Virtualization Security Policy and Procedures	Yes	Infrastructure offloaded to Cloudflare Workers + Lovable Cloud (Supabase EU). RiskAlign-side policy in `architecture-overview.md`.
IVS-02	IVS	Infrastructure & Virtualization Security	Capacity and Resource Planning	Yes	Managed-platform auto-scale (Cloudflare Workers, Supabase). Capacity review at every architecture change.
IVS-03	IVS	Infrastructure & Virtualization Security	Network Security	Yes	Cloudflare WAF + DDoS protection; TLS-only ingress; egress to known sub-processors only.
IVS-04	IVS	Infrastructure & Virtualization Security	OS Hardening and Base Controls	N/A	N/A — no host OS managed by RiskAlign. Workers + managed Postgres.
IVS-05	IVS	Infrastructure & Virtualization Security	Production and Non-Production Environments	Yes	Separate Lovable preview + published environments; pilot/sandbox tenants flagged `live_PROHIBITED`.
IVS-06	IVS	Infrastructure & Virtualization Security	Segmentation and Segregation	Yes	Multi-tenant logical segregation via RLS; no shared schema for tenant data without `tenant_id` scoping.
IVS-07	IVS	Infrastructure & Virtualization Security	Migration to Cloud Environments	N/A	N/A — cloud-native since inception; no on-prem migration.
IVS-08	IVS	Infrastructure & Virtualization Security	Network Architecture Documentation	Yes	Documented in `architecture-overview.md` and `data-model-map.md`.
IVS-09	IVS	Infrastructure & Virtualization Security	Network Defense	Yes	Cloudflare WAF + bot mitigation; Sentry alerting on server errors; rate-limiting on `/api/public/*`.
LOG-01	LOG	Logging & Monitoring	Logging and Monitoring Policy and Procedures	Yes	Logging policy: every state-changing action audit-trailed; security events to Sentry. Append-only audit-trail with SHA-256 hash chain; per-page verifier at `riskalignplatform.com/verify`. See Trust Pack §6.
LOG-02	LOG	Logging & Monitoring	Audit Logs Protection	Yes	Append-only + SHA-256 hash chain (sealed). Tampering detectable at `/verify`.
LOG-03	LOG	Logging & Monitoring	Security Monitoring and Alerting	Yes	Sentry (browser + server); founder receives alert on errors and suspicious patterns.
LOG-04	LOG	Logging & Monitoring	Audit Logs Access and Accountability	Yes	Audit-trail read scoped by RLS to tenant admins + sandbox_admin; every read is itself audit-trailed for privileged roles.
LOG-05	LOG	Logging & Monitoring	Audit Logs Monitoring and Response	Yes	Founder reviews critical audit events daily; alerts via Sentry.
LOG-06	LOG	Logging & Monitoring	Clock Synchronization	Yes	All timestamps from managed-platform NTP (Cloudflare, Supabase). UTC stored, UI localises.
LOG-07	LOG	Logging & Monitoring	Logging Scope	Yes	Audit scope: auth events, role changes, data CRUD, exports, adoptions, escalations, attestation pack composition, key issuance/revocation.
LOG-08	LOG	Logging & Monitoring	Log Records	Yes	Per-event record: actor (`auth.uid()`), tenant, entity, action, timestamp, prior-hash, current-hash.
LOG-09	LOG	Logging & Monitoring	Log Protection	Yes	Append-only audit-trail with SHA-256 hash chain; per-page verifier at `riskalignplatform.com/verify`. See Trust Pack §6.
LOG-10	LOG	Logging & Monitoring	Encryption Monitoring and Reporting	Partial	TLS health monitored by Cloudflare; at-rest encryption status reported by Supabase. No internal crypto-monitoring dashboard yet.
LOG-11	LOG	Logging & Monitoring	Transaction/Activity Logging	Yes	Append-only audit-trail with SHA-256 hash chain; per-page verifier at `riskalignplatform.com/verify`. See Trust Pack §6.
LOG-12	LOG	Logging & Monitoring	Access Control Logs	Yes	Role grants/revocations + auth events captured in audit trail + Supabase Auth logs.
LOG-13	LOG	Logging & Monitoring	Failures and Anomalies Reporting	Yes	Sentry captures errors; weekly review by founder; high-severity alerts immediate.
SEF-01	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Security Incident Management Policy and Procedures	Yes	Documented in BCP outline; 24h tenant notification SLA per Pilot Agreement §8.
SEF-02	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Service Management Policy and Procedures	Yes	Status page + incident comms via direct tenant-admin email.
SEF-03	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Incident Response Plans	Yes	IR plan in `07_BCP_Outline.md`; founder = on-call; successor role spec in `16_Successor_Role_Spec.md`.
SEF-04	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Incident Response Testing	No	Not yet tested live. Tabletop exercise scheduled Q3 2026.
SEF-05	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Incident Response Metrics	Partial	Sentry MTTA/MTTR available; formal monthly metric report deferred.
SEF-06	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Event Triage Processes	Yes	Sentry severity → founder triage within 1 business hour during working hours.
SEF-07	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Security Breach Notification	Yes	DPJL 2018 / UK GDPR-aligned: 72h to JOIC, 24h to tenants. Documented in Pilot Agreement §8.
SEF-08	SEF	Security Incident Management, E-Discovery & Cloud Forensics	Points of Contact Maintenance	Yes	Security contact published at `riskalignplatform.com/vdp` and `riskalignplatform.com/trust`; tenant emergency contact captured at onboarding.
STA-01	STA	Supply Chain Management, Transparency & Accountability	SSRM Policy and Procedures	Yes	Shared-responsibility model documented in Trust Pack §3 and `architecture-overview.md`.
STA-02	STA	Supply Chain Management, Transparency & Accountability	SSRM Supply Chain	Yes	Public sub-processor list at `riskalignplatform.com/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.
STA-03	STA	Supply Chain Management, Transparency & Accountability	SSRM Guidance	Yes	Pilot Agreement §3 + Trust Pack §3 spell out what RiskAlign vs the tenant is responsible for.
STA-04	STA	Supply Chain Management, Transparency & Accountability	SSRM Control Ownership	Yes	RACI documented in Trust Pack §3.
STA-05	STA	Supply Chain Management, Transparency & Accountability	SSRM Documentation Review	Yes	Reviewed at every release + every sub-processor change.
STA-06	STA	Supply Chain Management, Transparency & Accountability	SSRM Control Implementation	Yes	Controls implemented per Trust Pack §4-§7; evidence in `docs/canonical/`.
STA-07	STA	Supply Chain Management, Transparency & Accountability	Supply Chain Inventory	Yes	Public sub-processor list at `riskalignplatform.com/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.
STA-08	STA	Supply Chain Management, Transparency & Accountability	Supply Chain Risk Management	Yes	Sub-processor risk reviewed before onboarding; certifications + region + SLAs captured in `14_Sub_Processor_List.md`.
STA-09	STA	Supply Chain Management, Transparency & Accountability	Primary Service and Contractual Agreement	Yes	Pilot Agreement scaffold at `05_Pilot_Agreement_Scaffold.md`.
STA-10	STA	Supply Chain Management, Transparency & Accountability	Supply Chain Agreement Review	Yes	Sub-processor contracts reviewed at renewal; security addenda in place where required.
STA-11	STA	Supply Chain Management, Transparency & Accountability	Internal Compliance Testing	Partial	Internal self-assessment (this document). External testing per AA-02.
STA-12	STA	Supply Chain Management, Transparency & Accountability	Supply Chain Service Agreement Compliance	Yes	Sub-processor SLAs monitored via status pages + Sentry.
STA-13	STA	Supply Chain Management, Transparency & Accountability	Supply Chain Governance Review	Yes	Sub-processor list reviewed quarterly; changes notified 30 days in advance per Pilot Agreement §7.
STA-14	STA	Supply Chain Management, Transparency & Accountability	Supply Chain Data Security Assessment	Yes	Sub-processor security posture captured in `14_Sub_Processor_List.md`; only EU-region processors on data path.
TVM-01	TVM	Threat & Vulnerability Management	Threat and Vulnerability Management Policy and Procedures	Yes	Public VDP at `riskalignplatform.com/vdp`; remediation SLAs documented in `28_Vulnerability_Disclosure_Policy.md`.
TVM-02	TVM	Threat & Vulnerability Management	Malware Protection Policy and Procedures	N/A	N/A — no host OS managed by RiskAlign; no user-uploaded executables; sub-processor anti-malware applies.
TVM-03	TVM	Threat & Vulnerability Management	Vulnerability Remediation Schedule	Yes	Critical: 7 days; High: 30 days; Medium: 90 days; Low: best-effort. Per `28_Vulnerability_Disclosure_Policy.md`.
TVM-04	TVM	Threat & Vulnerability Management	Detection Updates	Yes	Dependency-vulnerability scan in CI; managed-platform patching by sub-processors.
TVM-05	TVM	Threat & Vulnerability Management	External Library Vulnerabilities	Yes	Dependency-scan on every build (npm audit + Lovable dependency scanner).
TVM-06	TVM	Threat & Vulnerability Management	Penetration Testing	Partial	Continuous automated security scanning via Aikido (SAST, SCA, secrets, IaC, surface monitoring) is in place and clean of critical findings. Independent third-party human penetration test deferred until first paying pilot or named prospect request — see /security/roadmap and the engagement runbook at .lovable/pentest/runbook.md.
TVM-07	TVM	Threat & Vulnerability Management	Vulnerability Identification	Yes	Dependency scan in CI + VDP submissions + Sentry error patterns.
TVM-08	TVM	Threat & Vulnerability Management	Vulnerability Prioritization	Yes	CVSS-aligned; remediation slotted per TVM-03 schedule.
TVM-09	TVM	Threat & Vulnerability Management	Vulnerability Management Reporting	Partial	Internal reporting only; formal report cadence deferred until first paying pilot.
TVM-10	TVM	Threat & Vulnerability Management	Vulnerability Management Metrics	Partial	MTTR captured per VDP submission; broader metric reporting deferred.
UEM-01	UEM	Universal Endpoint Management	Endpoint Devices Policy and Procedures	Yes	Founder laptop only — disk encryption (FileVault), screen lock, OS auto-update, MFA on every privileged login. Limited applicability — RiskAlign has no employee fleet. Founder laptop only, with disk encryption + browser-only operator access. No MDM at this scale.
UEM-02	UEM	Universal Endpoint Management	Application and Service Approval	Yes	Founder approves all software/services in use; documented in operating procedure.
UEM-03	UEM	Universal Endpoint Management	Compatibility	Yes	Browser-only operator surface; supported in modern Chromium/Firefox/Safari.
UEM-04	UEM	Universal Endpoint Management	Endpoint Inventory	Yes	Single founder endpoint inventoried. Tenant endpoints out-of-scope (tenant-managed).
UEM-05	UEM	Universal Endpoint Management	Endpoint Management	Yes	Manual management on single founder endpoint. Limited applicability — RiskAlign has no employee fleet. Founder laptop only, with disk encryption + browser-only operator access. No MDM at this scale.
UEM-06	UEM	Universal Endpoint Management	Automatic Lock Screen	Yes	Founder laptop auto-locks after 5 min inactivity.
UEM-07	UEM	Universal Endpoint Management	Operating Systems	Yes	macOS current major release; auto-update enabled.
UEM-08	UEM	Universal Endpoint Management	Storage Encryption	Yes	FileVault enabled on founder laptop.
UEM-09	UEM	Universal Endpoint Management	Anti-Malware Detection and Prevention	Yes	macOS Gatekeeper + XProtect + System Integrity Protection.
UEM-10	UEM	Universal Endpoint Management	Software Firewall	Yes	macOS application firewall enabled.
UEM-11	UEM	Universal Endpoint Management	Data Loss Prevention	Partial	Operator surface is browser-only; no bulk export from founder endpoint. Formal DLP tooling N/A at single-founder scale.
UEM-12	UEM	Universal Endpoint Management	Remote Locate	N/A	N/A — single founder endpoint; Find My Mac enabled for personal device recovery.
UEM-13	UEM	Universal Endpoint Management	Remote Wipe	Yes	Find My Mac remote wipe enabled on founder laptop.
UEM-14	UEM	Universal Endpoint Management	Third-Party Endpoint Security Posture	N/A	N/A — no third-party endpoints provisioned by RiskAlign.