{ "system-security-plan": { "uuid": "6b2c4d8e-9f1a-4b3c-8d5e-7f9a0b1c2d3e", "metadata": { "title": "Aegix Tiaki System Security Plan", "published": "2026-04-21T00:00:00Z", "last-modified": "2026-06-16T00:00:00Z", "version": "0.2.1", "oscal-version": "1.1.2", "parties": [ { "uuid": "2d7a9e42-5f8c-4c11-8b6a-1e0a3d5b4c77", "type": "organization", "name": "Aegix Safety Platform", "short-name": "Aegix" } ], "responsible-parties": [ { "role-id": "system-owner", "party-uuids": [ "2d7a9e42-5f8c-4c11-8b6a-1e0a3d5b4c77" ] } ], "remarks": "Initial draft \u2014 v0.1.0. Implementation statements derived from ADRs 091, 094, 098, 099 and the ADR 099 implementation tracker. Subsequent refreshes regenerate on protected-branch merge via .github/workflows/ci-oscal-generate.yml. Authoritative source of structured evidence for FedRAMP 20X continuous-authorization posture and SOC 2 auditor inquiries." }, "import-profile": { "href": "../profiles/fedramp-20x-moderate-profile.json" }, "system-characteristics": { "system-ids": [ { "identifier-type": "https://ietf.org/rfc/rfc4122", "id": "tiaki-prod" } ], "system-name": "Aegix Tiaki Safety Platform", "system-name-short": "Tiaki", "description": "Aegix Tiaki is a K-12 school safety platform comprising a Django + Channels (ASGI) backend, React web clients (AIM + SMS), Electron desktop wrapper (Beacon), iOS/Android native apps, and ~30 AWS Lambda services. Deployed on DuploCloud-managed EKS. Stores Restricted-Student-Record-PII per the data-classification taxonomy in ADR 099 \u00a73.", "security-sensitivity-level": "moderate", "system-information": { "information-types": [ { "uuid": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "title": "Student Records (FERPA-regulated)", "description": "Student identifiers, school affiliation, incident records, safety-drill participation, parent/guardian contact. FERPA Education Records. CCPA/CPRA sensitive PI when collected from California residents.", "confidentiality-impact": { "base": "fips-199-moderate" }, "integrity-impact": { "base": "fips-199-moderate" }, "availability-impact": { "base": "fips-199-moderate" } }, { "uuid": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "title": "Staff Authentication + Authorization", "description": "JWT tokens (SimpleJWT), session metadata, device-binding claims, permissions_version.", "confidentiality-impact": { "base": "fips-199-moderate" }, "integrity-impact": { "base": "fips-199-moderate" }, "availability-impact": { "base": "fips-199-moderate" } }, { "uuid": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f", "title": "Real-time Alert + Incident Telemetry", "description": "WebSocket messages (api/v2/ws/), alert state, incident lifecycle, location telemetry, CAP alert generation.", "confidentiality-impact": { "base": "fips-199-moderate" }, "integrity-impact": { "base": "fips-199-moderate" }, "availability-impact": { "base": "fips-199-moderate" } } ] }, "security-impact-level": { "security-objective-confidentiality": "fips-199-moderate", "security-objective-integrity": "fips-199-moderate", "security-objective-availability": "fips-199-moderate" }, "status": { "state": "operational" }, "authorization-boundary": { "description": "Authorization boundary covers: (1) Django backend + Celery workers running on EKS under DuploCloud; (2) all AWS Lambda services under apps/aws/service/; (3) the Aegix-hosted React bundles (AIM, SMS, Beacon-web). Out of scope: customer-owned SSO IdPs, customer device fleets (mobile apps authenticated via OAuth/OIDC are in scope for the transport + storage-at-rest boundary only), third-party CDN/edge providers." } }, "system-implementation": { "users": [ { "uuid": "f5a6b7c8-d9e0-4f1a-8b2c-3d4e5f6a7b8c", "title": "School Staff (teachers, admins, SROs)", "role-ids": [ "customer" ] }, { "uuid": "a6b7c8d9-e0f1-4a2b-8c3d-4e5f6a7b8c9d", "title": "Aegix Security Engineering", "role-ids": [ "security-engineering" ] } ], "components": [ { "uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "type": "software", "title": "Django Backend (aegix-aim-backend)", "description": "Django 4.x + Channels (ASGI) via Gunicorn + UvicornWorkerNoHeader. Single WebSocket consumer (EverythingConsumer at api/v2/ws/) serves all clients.", "status": { "state": "operational" } }, { "uuid": "c8d9e0f1-a2b3-4c4d-8e5f-6a7b8c9d0e1f", "type": "service", "title": "AWS Lambda Services", "description": "~30 Lambdas under apps/aws/service/{api,events,scheduled,provider}/. Node 20 + Python 3.12. All run with AWS_USE_FIPS_ENDPOINT=true per ADR 098.", "status": { "state": "operational" } }, { "uuid": "d9e0f1a2-b3c4-4d5e-8f6a-7b8c9d0e1f2a", "type": "software", "title": "React Web Clients", "description": "aegix-aim-react (AIM), aegix-sms-react (SMS), aegix-aim-desktop (Beacon-web). Chakra UI v3. GPC header propagation via axios interceptor per AAS-990.", "status": { "state": "operational" } }, { "uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "type": "service", "title": "DuploCloud Platform", "description": "EKS + networking + IAM boundaries. Inherited controls per doc/compliance/compliance-stack-layers.md \u00a71.", "status": { "state": "operational" } } ] }, "control-implementation": { "description": "Each implemented-requirement links the control to its implementation statement (derived from the authoritative ADR or runbook) and the evidence location. See doc/compliance/compliance-stack-layers.md for the ownership map.", "implemented-requirements": [ { "uuid": "11111111-1111-4111-8111-111111111111", "control-id": "ac-3", "statements": [ { "statement-id": "ac-3_smt", "uuid": "11111112-1111-4111-8111-111111111112", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "11111113-1111-4111-8111-111111111113", "description": "Access enforcement is implemented in Django via DRF permission classes + custom AlertType opt-in system per ADR 100. Safe-default resource reads require explicit admin opt-in (e.g., AlertType ?include_system=true gated by schools.change_alerttype). SimpleJWT with permissions_version claim drives JWT-level authorization (AAS-776)." } ] } ] }, { "uuid": "22222222-2222-4222-8222-222222222222", "control-id": "ac-4", "statements": [ { "statement-id": "ac-4_smt", "uuid": "22222223-2222-4222-8222-222222222223", "by-components": [ { "component-uuid": "d9e0f1a2-b3c4-4d5e-8f6a-7b8c9d0e1f2a", "uuid": "22222224-2222-4222-8222-222222222224", "description": "Information flow control between isolated zones (tiaki / tiaki-trust / tiaki-intel) is enforced per ADR 091 module boundaries, extended in ADR 099 \u00a73 with data-tier depConstraints in @nx/enforce-module-boundaries. Lower-tier Nx projects cannot import higher-tier types; enforced at lint time on every PR via tools/scripts/sync-tier-tags.mjs + ci-data-classification.yml (AP-259)." } ] } ] }, { "uuid": "33333333-3333-4333-8333-333333333333", "control-id": "ac-6", "statements": [ { "statement-id": "ac-6_smt", "uuid": "33333334-3333-4333-8333-333333333334", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "33333335-3333-4333-8333-333333333335", "description": "Least privilege is implemented via ADR 098 \u00a72 three-tier credential lifecycle: Tier 1 eliminates standing credentials via workload identity (IRSA for Lambdas, K8s ServiceAccounts for Django pods). Tier 2 narrows Secrets Manager secrets to scoped IAM roles with automated rotation. AP-249 audit verified zero stale long-lived AWS_ACCESS_KEY_ID/SECRET pairs in active workflows (ABE-41, AAA-428 scheduled for deletion)." } ] } ] }, { "uuid": "44444444-4444-4444-8444-444444444444", "control-id": "ac-20", "statements": [ { "statement-id": "ac-20_smt", "uuid": "44444445-4444-4444-8444-444444444445", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "44444446-4444-4444-8444-444444444446", "description": "External connections are governed by the FERPA school-official designation runbook (doc/compliance/runbooks/ferpa-school-official-designation.md). Customer contracts must include school-official language before Aegix accesses Education Records. Vendor/sub-processor DPAs tracked in doc/compliance/pia-register.md." } ] } ] }, { "uuid": "55555555-5555-4555-8555-555555555555", "control-id": "au-2", "statements": [ { "statement-id": "au-2_smt", "uuid": "55555556-5555-4555-8555-555555555556", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "55555557-5555-4555-8555-555555555557", "description": "Event logging covers: (1) Sentry for application-level exceptions + performance traces; (2) CloudWatch Logs for Lambda + Django structured logs; (3) CloudTrail at platform level (DuploCloud-managed); (4) FERPA disclosure log per doc/compliance/runbooks/ferpa-disclosure-log.md. Retention per AU-11: 7 years on compliance-artifacts bucket (deployed \u2014 Object Lock COMPLIANCE, 7-year retention, AAS-1303 / ADR 099 Layer 5)." } ] } ] }, { "uuid": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d", "control-id": "au-6", "props": [ { "name": "implementation-status", "value": "implemented" } ], "statements": [ { "statement-id": "au-6_smt", "uuid": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8e", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8f", "description": "Audit review/analysis/reporting is automated (AAS-1305, was Partial). Two complementary surfaces feed a single Security Hub review console: (1) the ADR-099 Conformance Pack routes infrastructure/cloud-posture Config findings into Security Hub; (2) server.apps.audit_review (Celery beat, weekly) reviews the application-level audit trail \u2014 the four append-only Django models UserLoginActivity, PlatformLog, AlertLog, ReleaseLog \u2014 for anomalies (failed-login clusters per IP reusing the realtime 3+/10min alert + 10+ IP-block thresholds, outsized student-release volume by a single actor, and multi-guardian double-releases). Notable application-audit anomalies are pushed into Security Hub as ASFF custom findings via securityhub:BatchImportFindings (no parallel review console), and a weekly anomaly report is emailed to Security Engineering (AUDIT_REVIEW_REPORT_RECIPIENTS). Complements GuardDuty + the login-anomaly path rather than duplicating them." } ] } ] }, { "uuid": "66666666-6666-4666-8666-666666666666", "control-id": "au-9", "props": [ { "name": "implementation-status", "value": "implemented" } ], "statements": [ { "statement-id": "au-9_smt", "uuid": "66666667-6666-4666-8666-666666666667", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "66666668-6666-4666-8666-666666666668", "description": "Audit log integrity protected via CloudTrail \u2192 S3 with KMS SSE (inherited from DuploCloud platform). Write-once, tamper-resistant retention is implemented: the compliance-artifacts S3 bucket is deployed with Object Lock COMPLIANCE mode (AAS-1303, ADR 099 Layer 5), which prevents deletion or overwrite of anchored audit evidence by any principal \u2014 including root \u2014 for the duration of the retention period. Audit-evidence objects (Merkle roots per AU-10, retention evidence per AU-11) are thereby protected against modification at rest." } ] } ] }, { "uuid": "6a000000-0000-4000-8000-00000000a010", "control-id": "au-10", "statements": [ { "statement-id": "au-10_smt", "uuid": "6a000000-0000-4000-8000-00000000a011", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "6a000000-0000-4000-8000-00000000a012", "description": "Implemented and enforcing in production (verified 2026-06-16; AAS-1306 + AAS-1396 + prod wiring AAS-1397, ADR-125). The four append-only audit models each carry an independent per-DB HMAC-SHA-256 hash-chain: each row signs prev_hash + canonical(row), so altering any row's signed contents breaks its HMAC and every subsequent link. ReleaseLog (reunification chain-of-custody, default DB) is the pilot; UserLoginActivity (default), AlertLog + PlatformLog (tuhi) each have their own chain (no cross-DB chain is possible across the default/tuhi split). Periodic SHA-256 Merkle roots over each chain \u2014 plus an optional combined daily root \u2014 are anchored to the compliance-artifacts S3 bucket (Object Lock COMPLIANCE, 7-year retention, AAS-1303), giving an immutable external trust anchor. HMAC key from AWS Secrets Manager (tiaki_audit-integrity_hmac-key); algorithms are ADR-098 \u00a71 approved (HMAC-SHA-256 / SHA-256 only; no MD5/SHA-1). Verification: `manage.py verify_audit_integrity` (exits non-zero on any tamper; --check-anchors cross-checks the live root against the anchored root). Production enforcement status (AAS-1397, verified 2026-06-16): enforcing on live records. AUDIT_INTEGRITY_ENABLED, the daily Merkle-anchor schedule (anchor_audit_merkle_roots, 05:29 UTC), the hourly verify schedule (scheduled_verify_audit_integrity, :47), and quarterly key rotation are all enabled in the prod tenant; the HMAC key is provisioned in Secrets Manager and COMPLIANCE_ARTIFACTS_BUCKET is bound to the prod Object Lock bucket (duploservices-prod-compliance-artifacts-654654167155). All four chains verify clean (verify_audit_integrity -> 0 breaks), a freshly-written login row chains and verifies correctly, and Merkle roots for all four chains plus the combined daily root are anchored to the Object Lock bucket; the audit-integrity-breaks-prod CloudWatch alarm guards the chains continuously (OK as of 2026-06-16). Coverage is forward-only by design \u2014 rows predating enablement remain unchained (verify excludes them; not a tamper signal), a defensible posture for a newly-activated control. The AU-9/AU-11 WORM-retention layer is deployed and enforcing in production independently. Runbook: doc/compliance/runbooks/audit-integrity-verification.md." } ] } ] }, { "uuid": "77777777-7777-4777-8777-777777777777", "control-id": "au-11", "props": [ { "name": "implementation-status", "value": "implemented" } ], "statements": [ { "statement-id": "au-11_smt", "uuid": "77777778-7777-4777-8777-777777777778", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "77777779-7777-4777-8777-777777777779", "description": "7-year retention on compliance evidence per IA-5(1)(h) + AU-11 is implemented. The compliance-artifacts S3 bucket is deployed (AAS-1303, ADR 099 Layer 5) with Object Lock COMPLIANCE mode and a 7-year (2557-day) default retention period, so anchored audit and compliance evidence is retained \u2014 and cannot be deleted or shortened \u2014 for the full retention window. The application-level audit trail is sourced from the four append-only Django models (UserLoginActivity, PlatformLog, AlertLog, ReleaseLog), whose periodic Merkle roots are anchored into this WORM bucket per AU-10." } ] } ] }, { "uuid": "88888888-8888-4888-8888-888888888888", "control-id": "ca-2", "statements": [ { "statement-id": "ca-2_smt", "uuid": "88888889-8888-4888-8888-888888888889", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "8888888a-8888-4888-8888-88888888888a", "description": "Control assessments driven by SOC 2 Type II per ADR 094 (zone-scoped boundary). ADR 099 Layer 4 OSCAL generation produces this SSP + monthly assessment-results. Semgrep (tools/semgrep/aegix-compliance.yml) + compliance-lint hook provide continuous source-code assessment." } ] } ] }, { "uuid": "99999999-9999-4999-8999-999999999999", "control-id": "ca-7", "statements": [ { "statement-id": "ca-7_smt", "uuid": "9999999a-9999-4999-8999-99999999999a", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "9999999b-9999-4999-8999-99999999999b", "description": "Continuous monitoring via the ADR 099 Layer 5 CloudWatch compliance-posture dashboard (infra/cloudwatch/dashboards/compliance-posture.json; the prior Steampipe+Grafana design was superseded by ADR-099-A). AWS-resource panels consume Security Hub findings (NIST 800-53r5, FSBP, FedRAMP, AWS Config managed + Aegix Conformance Pack custom rules). Monthly OSCAL assessment-results publication satisfies the FedRAMP 20X continuous-authorization cadence." } ] } ] }, { "uuid": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "control-id": "cm-3", "statements": [ { "statement-id": "cm-3_smt", "uuid": "aaaaaaab-aaaa-4aaa-8aaa-aaaaaaaaaaab", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "aaaaaaac-aaaa-4aaa-8aaa-aaaaaaaaaaac", "description": "Configuration change control enforced via: (1) ADRs for architectural decisions (doc/adr/); (2) PR-based merges with block-bad-git hook preventing squash/rebase; (3) Semgrep + compliance-lint at commit time; (4) ci-data-classification.yml gating every project.json change." } ] } ] }, { "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000001", "control-id": "cp-2", "statements": [ { "statement-id": "cp-2_smt", "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000002", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000003", "description": "Contingency plan documented in `doc/compliance/policies/customer-portal/bcdr-plan.md`. Quantified targets: RTO = 4 hours for critical services (alert dispatch, messaging, check-in, reporting); RPO = 1 hour. Four-phase recovery sequencing ensures the safety-critical alerting path is restored first, non-critical reporting last. Plan is reviewed annually and tested semi-annually; test results logged to the compliance-artifacts bucket (deployed \u2014 Object Lock COMPLIANCE, AAS-1303 / ADR 099 Layer 5). Roles + responsibilities assigned to Platform Engineering on-call + Security on-call." } ] } ] }, { "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000004", "control-id": "cp-9", "statements": [ { "statement-id": "cp-9_smt", "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000005", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000006", "description": "System backup: RDS PostgreSQL automated point-in-time recovery (7-day retention for daily snapshots, 35-day for continuous transaction logs) via DuploCloud-managed RDS. DynamoDB point-in-time recovery enabled on student-record tables + FERPA disclosure log + notification-delivery records. S3 versioning enabled on media and audit buckets. Cross-region replication on audit bucket to us-west-2 for regional isolation. All backup storage KMS-encrypted with customer-managed keys. Backup restoration tested quarterly; results logged." } ] } ] }, { "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000007", "control-id": "cp-10", "statements": [ { "statement-id": "cp-10_smt", "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000008", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "cccc0000-cccc-4ccc-8ccc-cccc00000009", "description": "System recovery: EKS workloads restart automatically via Kubernetes restart policies + DuploCloud-managed replica sets. Django backend achieves zero-downtime rolling restart per ADR 037; WebSocket drain via ShutdownCoordinator (close code 4010) preserves client connections per ADR 049. Region-failover procedure in bcdr-plan.md \u00a75: primary region us-east-1; failover to us-west-2 within RTO target. Quarterly failover drill recorded; most-recent-drill date surfaced on CloudWatch compliance-posture dashboard (Layer 5, deployed per ADR-099-A)." } ] } ] }, { "uuid": "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", "control-id": "ia-2", "statements": [ { "statement-id": "ia-2_smt", "uuid": "bbbbbbbc-bbbb-4bbb-8bbb-bbbbbbbbbbbc", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "bbbbbbbd-bbbb-4bbb-8bbb-bbbbbbbbbbbd", "description": "Staff identification + authentication via SimpleJWT (AAS-776). SSO via OAuth/OIDC with customer IdPs. MFA enforced at IdP level for privileged roles. JWT includes permissions_version claim driving server-side permission revalidation." } ] } ] }, { "uuid": "cccccccc-cccc-4ccc-8ccc-cccccccccccc", "control-id": "ia-5", "statements": [ { "statement-id": "ia-5_smt", "uuid": "cccccccd-cccc-4ccc-8ccc-ccccccccccccd", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "ccccccce-cccc-4ccc-8ccc-cccccccccccce", "description": "Authenticator management per ADR 098 \u00a72 three-tier credential lifecycle. Tier 1: eliminate via WIF/IRSA/KMS. Tier 2: automated Secrets Manager rotation (30/90 day). Tier 3: manual-with-policy (annual + event-driven, Secrets Manager tagged). Passwords (when used) hashed with PBKDF2 per ADR 098 \u00a71 approved list \u2014 bcrypt/scrypt/argon2 explicitly disallowed." } ] } ] }, { "uuid": "dddddddd-dddd-4ddd-8ddd-dddddddddddd", "control-id": "ir-4", "statements": [ { "statement-id": "ir-4_smt", "uuid": "dddddddE-dddd-4ddd-8ddd-dddddddddddE", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "dddddddf-dddd-4ddd-8ddd-ddddddddddDF", "description": "Incident handling procedure in doc/compliance/runbooks/privacy-incident.md. Covers detection, containment, regulatory notification (FERPA + state privacy laws per doc/compliance/state-privacy-deltas.md), customer notification, post-incident review. Severity escalation per on-call runbook." } ] } ] }, { "uuid": "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee", "control-id": "mp-4", "statements": [ { "statement-id": "mp-4_smt", "uuid": "eeeeeeef-eeee-4eee-8eee-eeeeeeeeeeef", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "eeeeeef0-eeee-4eee-8eee-eeeeeef0eef0", "description": "Media storage at rest encrypted with KMS-managed keys (SSE on all S3 buckets, RDS, DynamoDB). S3 ServerSideEncryption enforced in provider Lambdas (e.g., apps/aws/service/provider/cleartouch-announce). Approved algorithm set per ADR 098 \u00a71 (AES-GCM/CBC/CTR, SHA-2, RSA \u22652048)." } ] } ] }, { "uuid": "ffffffff-ffff-4fff-8fff-ffffffffffff", "control-id": "pm-14", "statements": [ { "statement-id": "pm-14_smt", "uuid": "ffffffff-ffff-4fff-8fff-ffffffffffff", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "fffffff0-ffff-4fff-8fff-ffffffff0fff", "description": "Testing, training, monitoring of security controls centralized in ADR 099 (this system). Layer 1 CLAUDE.md preambles (9 repos) ensure every engineer inherits compliance context. Layer 2 hooks (compliance-lint, block-bad-commands, prompt-context, session-edit-recorder) enforce at commit time. Layer 3 skills (compliance-review, secret-lifecycle, crypto-review, data-classification, oscal-export, privacy-review) provide operational procedures. Layer 4 CI (Semgrep, cosign, SBOM, Conformance Pack). Layer 5 CloudWatch compliance-posture dashboard + monthly OSCAL publication." } ] } ] }, { "uuid": "10101010-1010-4010-8010-101010101010", "control-id": "sa-8", "statements": [ { "statement-id": "sa-8_smt", "uuid": "10101011-1010-4010-8010-101010101011", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "10101012-1010-4010-8010-101010101012", "description": "Security + privacy engineering principles codified in ADR 091 (isolated service standard), ADR 098 (FIPS + credential tiers), ADR 099 \u00a73 (5-tier data taxonomy). Every new project.json requires dataClassification per tools/scripts/check-data-classification.mjs." } ] } ] }, { "uuid": "20202020-2020-4020-8020-202020202020", "control-id": "sa-11", "statements": [ { "statement-id": "sa-11_smt", "uuid": "20202021-2020-4020-8020-202020202021", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "20202022-2020-4020-8020-202020202022", "description": "Developer testing: Semgrep (12 rules, NIST control citations) at CI time via ci-compliance-semgrep.yml. ERROR-level rules block merge; WARNING-level surface in SARIF upload to GitHub code scanning. Complements existing unit/integration/E2E suites." } ] } ] }, { "uuid": "30303030-3030-4030-8030-303030303030", "control-id": "sc-7", "statements": [ { "statement-id": "sc-7_smt", "uuid": "30303031-3030-4030-8030-303030303031", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "30303032-3030-4030-8030-303030303032", "description": "Boundary protection: DuploCloud-managed ALBs with TLS 1.2+ enforcement. WAF rules at ingress. Isolated service standard per ADR 091 segregates tiaki / tiaki-trust / tiaki-intel at both network and module-boundary layers. Security Hub surfaces boundary-check findings via NIST 800-53r5 + AWS FSBP managed rules." } ] } ] }, { "uuid": "40404040-4040-4040-8040-404040404040", "control-id": "sc-8", "statements": [ { "statement-id": "sc-8_smt", "uuid": "40404041-4040-4040-8040-404040404041", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "40404042-4040-4040-8040-404040404042", "description": "Transmission confidentiality + integrity via TLS 1.2+ on all HTTP(S) + WebSocket endpoints per ADR 098 \u00a71. rejectUnauthorized:false, verify_ssl=0, CERT_NONE, NSAllowsArbitraryLoads, cleartextTrafficPermitted='true' explicitly disallowed. Enforced at commit time by compliance-lint hook + at CI time by tools/semgrep/aegix-compliance.yml. Redis connections use TLS via server/settings.py rediss:// scheme." } ] } ] }, { "uuid": "50505050-5050-4050-8050-505050505050", "control-id": "sc-12", "statements": [ { "statement-id": "sc-12_smt", "uuid": "50505051-5050-4050-8050-505050505051", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "50505052-5050-4050-8050-505050505052", "description": "Cryptographic key establishment + management via AWS KMS (FIPS 140-3 Level 3 HSMs). Automatic annual rotation on customer-managed keys. Key usage audited via CloudTrail. AWS_USE_FIPS_ENDPOINT=true enforced on all Lambdas + Django via env var injection in .docker/Dockerfile.base + _deploy-lambda-template.yml + _deploy-python-lambda-template.yml." } ] } ] }, { "uuid": "60606060-6060-4060-8060-606060606060", "control-id": "sc-13", "statements": [ { "statement-id": "sc-13_smt", "uuid": "60606061-6060-4060-8060-606060606061", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "60606062-6060-4060-8060-606060606062", "description": "Cryptographic protection via FIPS 140-3 approved algorithm list per ADR 098 \u00a71. Approved: AES-GCM/CBC/CTR, SHA-2/SHA-3, HMAC-SHA-2, RSA \u22652048 with PSS/OAEP, ECDSA P-256/384/521, Ed25519, PBKDF2/HKDF. Disallowed: MD5, SHA-1 signatures, DES/3DES, RC4, bcrypt/scrypt/argon2 for passwords, ChaCha20-Poly1305, Curve25519 X25519. Enforced by compliance-lint hook (AP-250) + Semgrep (AP-269)." } ] } ] }, { "uuid": "70707070-7070-4070-8070-707070707070", "control-id": "sc-28", "statements": [ { "statement-id": "sc-28_smt", "uuid": "70707071-7070-4070-8070-707070707071", "by-components": [ { "component-uuid": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "uuid": "70707072-7070-4070-8070-707070707072", "description": "Protection of information at rest via KMS-managed SSE on S3 + RDS + DynamoDB + EBS. Approved algorithms only per ADR 098 \u00a71. Conformance Pack rule `s3-bucket-aegix-kms-encrypted` enforces customer-managed KMS on Restricted-tier buckets." } ] } ] }, { "uuid": "80808080-8080-4080-8080-808080808080", "control-id": "sc-32", "statements": [ { "statement-id": "sc-32_smt", "uuid": "80808081-8080-4080-8080-808080808081", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "80808082-8080-4080-8080-808080808082", "description": "System partitioning via ADR 091 isolated-zone model (tiaki / tiaki-trust / tiaki-intel). Data-tier taxonomy per ADR 099 \u00a73 ensures Restricted-Student-Record-PII does not flow into Confidential or Internal zones. Enforced at build time via @nx/enforce-module-boundaries tier depConstraints." } ] } ] }, { "uuid": "90909090-9090-4090-8090-909090909090", "control-id": "si-2", "statements": [ { "statement-id": "si-2_smt", "uuid": "90909091-9090-4090-8090-909090909091", "by-components": [ { "component-uuid": "c8d9e0f1-a2b3-4c4d-8e5f-6a7b8c9d0e1f", "uuid": "90909092-9090-4090-8090-909090909092", "description": "Flaw remediation: Dependabot for npm + Python packages. AWS Inspector for Lambda runtime + container image scanning (surfaced via Security Hub). Sentry for runtime exception triage. Dependabot compliance-lens auto-triage is ADR 099 L4 open item." } ] } ] }, { "uuid": "a0a0a0a0-a0a0-4a0a-8a0a-a0a0a0a0a0a0", "control-id": "sr-3", "statements": [ { "statement-id": "sr-3_smt", "uuid": "a0a0a0a1-a0a0-4a0a-8a0a-a0a0a0a0a0a1", "by-components": [ { "component-uuid": "c8d9e0f1-a2b3-4c4d-8e5f-6a7b8c9d0e1f", "uuid": "a0a0a0a2-a0a0-4a0a-8a0a-a0a0a0a0a0a2", "description": "Supply chain controls: cosign keyless signing (Sigstore) on every Lambda zip + every backend container image per AP-265 (_deploy-lambda-template.yml, _deploy-python-lambda-template.yml) and AP-270 (deploy-services-python-tiaki.yml). CycloneDX SBOMs generated per artifact (@cyclonedx/cdxgen for Node, cyclonedx-py for Python, syft for containers). Tamper-evident provenance via the Sigstore transparency log." } ] } ] }, { "uuid": "b0b0b0b0-b0b0-4b0b-8b0b-b0b0b0b0b0b0", "control-id": "sr-10", "statements": [ { "statement-id": "sr-10_smt", "uuid": "b0b0b0b1-b0b0-4b0b-8b0b-b0b0b0b0b0b1", "by-components": [ { "component-uuid": "c8d9e0f1-a2b3-4c4d-8e5f-6a7b8c9d0e1f", "uuid": "b0b0b0b2-b0b0-4b0b-8b0b-b0b0b0b0b0b2", "description": "Every backend deploy generates a CycloneDX SBOM and signs it with cosign (AP-270); Lambda artifacts are signed with SBOMs generated per build (AP-265). Cross-deploy SBOM comparison is not yet implemented: a per-release SBOM diff on prod promotion, with the diff stored beside the release bundle, is planned under AP-755 (AP-762 / AP-767)." } ] } ] }, { "uuid": "a5d50000-0000-4a00-8a00-000000000001", "control-id": "au-5", "statements": [ { "statement-id": "au-5_smt", "uuid": "a5d50000-0000-4a00-8a00-000000000002", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "a5d50000-0000-4a00-8a00-000000000003", "description": "Audit logging process failures are handled fail-loud: the audit write pipeline (apps/core/audit_pipeline.py, AAS-1304) re-raises on a write failure rather than silently swallowing it and emits an AuditWriteFailures CloudWatch metric for alerting. Combined with the AU-10 per-DB HMAC-SHA-256 hash-chain (ADR-125), a failed or tampered audit write is detectable rather than lost. Deployed and enforcing in production (verified 2026-06-16)." } ] } ] }, { "uuid": "ac200000-0000-4a00-8a00-000000000001", "control-id": "ac-2", "statements": [ { "statement-id": "ac-2_smt", "uuid": "ac200000-0000-4a00-8a00-000000000002", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "ac200000-0000-4a00-8a00-000000000003", "description": "Account lifecycle is managed via customer SSO/IdP with SCIM provisioning and deprovisioning; just-in-time provisioning maps IdP claims to roles under a least-privilege default-deny model (new users start with zero permissions). Account changes propagate immediately through the permissions_version JWT claim driving server-side cache invalidation (AAS-776); SCIM deprovisioning or an is_active/permission change invalidates active sessions. Periodic account-review automation is in progress (FedRAMP gap AC-2)." } ] } ] }, { "uuid": "ac700000-0000-4a00-8a00-000000000001", "control-id": "ac-7", "statements": [ { "statement-id": "ac-7_smt", "uuid": "ac700000-0000-4a00-8a00-000000000002", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "ac700000-0000-4a00-8a00-000000000003", "description": "Unsuccessful logon attempts are rate-limited and escalated: 3+ failed authentication attempts within 10 minutes trigger an alert; 10+ failed attempts trigger an automatic IP block; authentication endpoints are throttled at 30/min (SC-5, AAS-831). Real-time root-account-activity alerts are configured. These controls bound credential-stuffing and brute-force without operator action." } ] } ] }, { "uuid": "5a500000-0000-4a00-8a00-000000000001", "control-id": "ra-5", "statements": [ { "statement-id": "ra-5_smt", "uuid": "5a500000-0000-4a00-8a00-000000000002", "by-components": [ { "component-uuid": "b7c8d9e0-f1a2-4b3c-8d4e-5f6a7b8c9d0e", "uuid": "5a500000-0000-4a00-8a00-000000000003", "description": "Continuous vulnerability monitoring runs across the SDLC (ADR 099 Layer 4): GitHub Dependabot (dependency CVEs), AWS Inspector (runtime/container/host CVEs), and Semgrep + CodeQL SAST on every pull request. Findings aggregate into AWS Security Hub against the NIST 800-53 r5 standard. Remediation is tracked via SI-2 flaw-remediation (Dependabot auto-PRs + the ADR-098/099 classifier gate)." } ] } ] } ] }, "back-matter": { "resources": [ { "uuid": "e8f9c72a-4a6b-4f91-b2d3-9c8e7f1a5b42", "title": "ADR 091 \u2014 Isolated Service Standard", "rlinks": [ { "href": "../../../adr/091-isolated-service-standard.md" } ] }, { "uuid": "b1c3d5e7-9f0a-4b2c-8d4e-6f8a0b1c2d3e", "title": "ADR 094 \u2014 SOC 2 Over Legal Separation", "rlinks": [ { "href": "../../../adr/094-soc2-over-legal-separation.md" } ] }, { "uuid": "c2d4e6f8-a0b1-4c3d-9e5f-7a8b9c0d1e2f", "title": "ADR 098 \u2014 FIPS 140-3 Remediation", "rlinks": [ { "href": "../../../adr/098-fips-140-3-remediation.md" } ] }, { "uuid": "d3e5f7a9-b1c2-4d4e-8f6a-0b1c2d3e4f5a", "title": "ADR 099 \u2014 Compliance Automation Architecture", "rlinks": [ { "href": "../../../adr/099-compliance-automation-architecture.md" } ] }, { "uuid": "f4a5b6c7-d8e9-4f0a-8b1c-2d3e4f5a6b7c", "title": "ADR 099 Implementation Tracker", "rlinks": [ { "href": "../../../adr/099-compliance-automation-architecture-implementation.md" } ] }, { "uuid": "a5b6c7d8-e9f0-4a1b-8c2d-3e4f5a6b7c8d", "title": "Compliance Stack Layers \u2014 ownership map", "rlinks": [ { "href": "../../compliance-stack-layers.md" } ] }, { "uuid": "b6c7d8e9-f0a1-4b2c-8d3e-4f5a6b7c8d9e", "title": "PIA Register", "rlinks": [ { "href": "../../pia-register.md" } ] }, { "uuid": "c7d8e9f0-a1b2-4c3d-8e4f-5a6b7c8d9e0f", "title": "State Privacy Deltas (VA/CO/CT/UT/TX/OR) + K-12 supplement (NY/IL/NJ/NH)", "rlinks": [ { "href": "../../state-privacy-deltas.md" } ] }, { "uuid": "d8e9f0a1-b2c3-4d4e-8f5a-6b7c8d9e0f1a", "title": "Aegix BCDR Plan (RTO=4h / RPO=1h)", "description": "Evidence source for CP-2, CP-9, CP-10 implementation statements.", "rlinks": [ { "href": "../../policies/customer-portal/bcdr-plan.md" } ] }, { "uuid": "e9f0a1b2-c3d4-4e5f-8a6b-7c8d9e0f1a2b", "title": "SDPC v3 Coverage Matrix", "rlinks": [ { "href": "../../sdpc-v3-coverage-matrix.md" } ] }, { "uuid": "f0a1b2c3-d4e5-4f6a-8b7c-8d9e0f1a2b3c", "title": "NIST CSF v1.1 Crosswalk", "rlinks": [ { "href": "../../nist-csf-crosswalk.md" } ] }, { "uuid": "a1b2c3d4-e5f6-4a7b-8c8d-9e0f1a2b3c4d", "title": "FERPA Student-Record-PII Data Flow", "rlinks": [ { "href": "../../ferpa-data-flow.md" } ] } ] } } }