Skip to main content

Security Requirements

Implementation checklist derived from RFC-008. Each item MUST be satisfied for the target conformance profile unless marked optional.

Authentication and access control​

IDRequirementCoreEnterpriseGovernment
SEC-01TLS 1.2+ on all public endpoints✓✓✓
SEC-02Producer and consumer credentials separated✓✓✓
SEC-03Credentials scoped to entitled contexts✓✓✓
SEC-04MFA for human admin access✓✓✓
SEC-05OAuth 2.0 client credentials or API keys with rotation✓✓✓
SEC-06Privileged graph/export roles separate from lookup✓✓✓
SEC-07mTLS for federation gateways—Optional✓

Implementation notes​

  • Store API key hashes (Argon2id/bcrypt); never store plaintext after issuance.
  • Embed entitlements in signed JWT or lookup table refreshed ≤ 5 minutes.
  • Default deny in policy engine; explicit allow per tenant.

Cryptography​

IDRequirementCoreEnterpriseGovernment
SEC-10AES-256 at rest for PII databases✓✓✓
SEC-11Ed25519 or RSA-3072+ for evidence signatures✓✓✓
SEC-12JCS canonicalization before sign✓✓✓
SEC-13HSM for signing keys—Optional✓
SEC-14Hashed strong identifiers with salt✓✓✓

Application security​

IDRequirementCoreEnterpriseGovernment
SEC-20Input validation on all event fields✓✓✓
SEC-21Prohibited payload scanner (PAN, etc.)✓✓✓
SEC-22Webhook HMAC verification + replay windowOptional✓✓
SEC-23Rate limiting on search endpoints✓✓✓
SEC-24OWASP API Top 10 mitigations documented✓✓✓
SEC-25Dependency vulnerability scanning in CI✓✓✓
SEC-26Annual penetration test—✓✓

Infrastructure security​

IDRequirementCoreEnterpriseGovernment
SEC-30Database not internet-routable✓✓✓
SEC-31Network segmentation (public/internal/control)✓✓✓
SEC-32Secrets in vault/KMS, not config files✓✓✓
SEC-33WAF on lookup APIOptional✓✓
SEC-34Multi-AZ or equivalent HAOptional✓✓

Key management​

IDRequirementImplementation
SEC-40API key rotation without downtimeIssue overlapping keys; deprecate old after 30 days
SEC-41Signing key rotationPublish new kid in JWKS; overlap ≥ 7 days
SEC-42Compromise responseRevoke within 1 hour; incident per RFC-007

Logging and monitoring​

IDRequirement
SEC-50Security events to SIEM (Enterprise+)
SEC-51Alert on auth failure spikes
SEC-52Alert on bulk search patterns
SEC-53Logs exclude secrets and full PAN

Threat-specific controls​

Subject enumeration​

  • Per-tenant search rate limits
  • Increasing delay on repeated ambiguous searches
  • CAPTCHA or step-up auth for high-volume consumers (optional)

Evidence forgery​

  • All reports include signed manifest
  • Verification endpoint independent of consumer auth
  • PRL for revoked manifests

Cross-tenant leakage​

  • tenant_id on every row and query filter
  • Integration tests that attempt cross-tenant read (must fail)

Security documentation deliverables​

For certification, prepare:

  1. Control matrix — SEC IDs mapped to implementation
  2. Network diagram — zones and data flows
  3. Key management SOP — rotation and compromise
  4. Pen test summary — findings and remediation (Enterprise+)
  5. SBOM — software bill of materials for core services