Unified Compliance Requirements Matrix

Version: 1.4 Created: 2025-11-08 Last Updated: 2026-06-19 Owner: ISMS Owner Classification: Public

Executive Summary

This matrix consolidates requirements from 11 major compliance standards into a unified control framework for Maelstrom AI, the organisation that builds two platforms under one ISMS — Provii (privacy-preserving age verification) and downpipes (no-custody backup and disaster recovery for the Cloudflare data layer). By identifying overlapping requirements across frameworks, we create a single evidence base that demonstrates compliance with multiple standards simultaneously. The controls apply organisation-wide across both platforms; where downpipes materially extends or changes how a control is met, a downpipes application note is added to that control.

Deduplication Results

Standards Covered

1. ISO 27001:2022 - 93 Annex A controls (baseline)
2. ISO 27701:2019 - 83 additional privacy controls
3. ISO 27566-1 (27566-1) - Age assurance framework
4. Privacy by Design - 7 foundational principles
5. UK Age Appropriate Design Code - 15 standards
6. COPPA Safe Harbor - Children’s privacy requirements
7. GDPR - Articles 5, 12-14, 25, 28, 30, 32-34
8. CCPA - California consumer privacy rights
9. NIST 800-63-3 - Digital identity assurance
10. CSA Cloud Controls Matrix v4 - Cloud security controls
11. Australian Privacy Act 1988 - 13 Australian Privacy Principles (APPs)

Control Domain Breakdown

Priority Distribution

Table of Contents

• Privacy Controls (UC-001 to UC-038)
• Security Controls (UC-039 to UC-070)
• Cryptographic Controls (UC-071 to UC-082)
• Age Verification Controls (UC-083 to UC-100)
• Data Lifecycle Controls (UC-101 to UC-122)
• Access & Identity Controls (UC-123 to UC-140)
• Development & Operations Controls (UC-141 to UC-164, UC-186)
• Business Continuity Controls (UC-165 to UC-172)
• Vendor & Supply Chain Controls (UC-173 to UC-181)
• Governance & Compliance Controls (UC-182 to UC-185)

Privacy Controls

UC-001: Data Minimisation

Domain: Privacy Description: Collect and process only the minimum personal data necessary to fulfil the specified purpose. Avoid collecting data that is not strictly required.

Standards Coverage:

• GDPR Article 5(1)(c). Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
• ISO 27701:2019 Annex A 7.2.1. PII controllers should identify and document the purpose for which PII is processed
• Privacy by Design Principle 2. Privacy as the default setting - minimal data collection
• UK Children’s Code Standard 8. Collect and retain only the minimum amount of personal data needed
• COPPA Safe Harbor. Assessment of data minimisation practices required
• CCPA. “Reasonable security procedures and practices” includes minimisation
• APP 3 (Australia): Collection must be reasonably necessary for entity’s functions
• CSA CCM DSP-02. Data minimisation practices

Implementation Type: Technical + Administrative Evidence Needed:

• Data flow diagrams showing only essential data collection
• Privacy impact assessment documenting necessity of each data element
• System architecture demonstrating zero knowledge proof design
• Code review showing no unnecessary PII captured in APIs
• Privacy policy explaining minimal data practices

Priority: Critical Current Status: ✅ Implemented - Zero knowledge architecture is designed to minimise PII on servers (IP addresses retained for up to 90 days for abuse prevention; critical security event logs retained for up to 365 days)

UC-002: Purpose Limitation

Domain: Privacy Description: Collect personal data for specified, explicit, and legitimate purposes. Do not further process data in ways incompatible with those purposes.

Standards Coverage:

• GDPR Article 5(1)(b). Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes
• ISO 27701:2019 Annex A 7.2.1. Determine and document purpose for PII processing
• Privacy by Design Principle 3. Privacy embedded into design - purpose specification
• UK Children’s Code Standard 5. Do not use children’s data in detrimental ways
• APP 6 (Australia): Use or disclosure only for primary purpose or directly related secondary purpose
• CSA CCM DSP-03. Purpose specification and limitation

Implementation Type: Administrative + Technical Evidence Needed:

• Privacy policy with explicit purpose statements
• Data processing records (GDPR Article 30)
• System configuration preventing unauthorised secondary uses
• Privacy impact assessment

Priority: Critical Current Status: ✅ Implemented - IP logs used ONLY for abuse prevention (90-day retention; critical security event logs retained for up to 365 days)

UC-003: Transparency and Notice

Domain: Privacy Description: Provide clear, accessible, age-appropriate information to users about what personal data is collected, how it’s used, who it’s shared with, and their rights.

Standards Coverage:

• GDPR Articles 12, 13, 14. Transparent information, communication and modalities for exercise of rights
• ISO 27701:2019 Annex A 7.3.1. Providing privacy notice to PII principals
• Privacy by Design Principle 6. Visibility and transparency
• UK Children’s Code Standard 4. Privacy information concise, prominent, in clear language suited to age
• COPPA Safe Harbor. Assessment of parental notice requirements
• CCPA. Right to know about personal information collection and use
• APP 5 (Australia): Notification of collection required
• NIST 800-63-3. Notice and consent requirements for identity proofing
• CSA CCM DSP-04. Transparency and notice

Implementation Type: Administrative Evidence Needed:

• Privacy policy published and easily accessible
• Age-appropriate privacy notices for minors
• Notice provided at point of collection
• Records of privacy notice versions
• User interface showing privacy information placement

Priority: Critical Current Status: 🔄 Partially Implemented - Privacy policy exists, needs age-appropriate version

UC-004: User Consent Management

Domain: Privacy Description: Obtain valid, informed, freely-given consent before processing personal data where consent is the legal basis. Provide easy withdrawal mechanisms.

Standards Coverage:

• GDPR Article 7. Conditions for consent
• ISO 27701:2019 Annex A 7.3.2. Obtaining and recording consent
• Privacy by Design Principle 7. User-centric - respect for user privacy
• UK Children’s Code Standard 13. Do not use nudge techniques to weaken privacy protections
• COPPA Safe Harbor. Verifiable parental consent mechanisms
• CCPA. Right to opt-out of sale of personal information
• APP 3 (Australia): Consent required for sensitive information
• CSA CCM DSP-05. Consent management

Implementation Type: Technical + Administrative Evidence Needed:

• Consent management system implementation
• Records of consent (date, time, scope)
• User interface for consent and withdrawal
• Age verification for parental consent (if processing children’s data)
• Audit logs of consent changes

Priority: High Current Status: 🔄 Deferred. May develop consent UI component based on verifier integration needs

UC-005: User Rights Facilitation

Domain: Privacy Description: Implement mechanisms for users to exercise their privacy rights including access, rectification, erasure, portability, and objection.

Standards Coverage:

• GDPR Articles 15-22. Data subject rights (access, rectification, erasure, restriction, portability, objection)
• ISO 27701:2019 Annex A 7.3.4. Providing mechanism to modify or withdraw consent
• ISO 27701:2019 Annex A 7.3.5. Providing mechanism for PII principals to access their PII
• CCPA. Right to know, delete, opt-out
• APP 12, 13 (Australia): Access and correction rights
• UK Children’s Code Standard 15. Provide accessible tools to exercise data protection rights
• CSA CCM DSP-06. Data subject rights management

Implementation Type: Technical + Administrative Evidence Needed:

• Email-based rights request process (privacy@maelstrom.au)
• Request handling procedures and SLAs
• Identity verification for rights requests
• Logs of rights requests and responses

Priority: Critical Current Status: ✅ Implemented. Email-based DSAR process via privacy@maelstrom.au; users hold credential data in wallet (inherent portability); automatic 90-day IP deletion (inherent erasure); critical security event logs retained for up to 365 days

UC-006: Privacy by Design and Default

Domain: Privacy Description: Integrate privacy into system design from the outset. Implement privacy-protective defaults requiring no user action.

Standards Coverage:

• GDPR Article 25. Data protection by design and by default
• ISO 27701:2019 Clause 5.2.1. Privacy by design and by default
• Privacy by Design Principle 1. Proactive not reactive; preventative not remedial
• Privacy by Design Principle 3. Privacy embedded into design
• UK Children’s Code Standard 1. Best interests of child as primary consideration
• UK Children’s Code Standard 7. Settings must be high privacy by default
• ISO 27566-1. Privacy as core principle of age assurance
• CSA CCM DSP-01. Privacy by design

Implementation Type: Technical + Administrative Evidence Needed:

• Privacy design documentation and threat models
• Default configuration settings (high privacy)
• Privacy impact assessments for new features
• Architecture reviews demonstrating privacy principles
• Developer training on privacy-by-design

Priority: Critical Current Status: ✅ Implemented - Zero knowledge proofs are privacy by design

UC-007: Privacy Impact Assessment (PIA/DPIA)

Domain: Privacy Description: Conduct privacy impact assessments for high-risk processing activities, especially those involving children or new technologies.

Standards Coverage:

• GDPR Article 35. Data Protection Impact Assessment (DPIA) required for high-risk processing
• ISO 27701:2019 Annex A 7.2.4. Undertake privacy impact assessment
• UK Children’s Code Standard 2. Undertake DPIA to assess risks to children’s rights and freedoms
• ISO 27566-1. Risk assessment for age assurance systems
• APP 1 (Australia): Privacy policy must address risk assessment

Implementation Type: Administrative Evidence Needed:

• Completed DPIA document
• Risk assessment methodology
• Mitigation measures for identified risks
• DPIA review and approval records
• DPIA updates when processing changes

Priority: High Current Status: ✅ Implemented - See Data Protection Impact Assessment

UC-008: Privacy Governance and Accountability

Domain: Privacy Description: Establish clear privacy governance structure with assigned responsibilities, documented policies, and accountability mechanisms.

Standards Coverage:

• GDPR Article 5(2). Controller accountability principle
• ISO 27701:2019 Clause 5.2.2. Privacy roles and responsibilities
• ISO 27701:2019 Annex A 7.2.2. Determining data controller and processor roles
• Privacy by Design Principle 7. Respect for user privacy - accountability
• APP 1 (Australia): Privacy policy must be clear and current
• CSA CCM GRC-01. Governance program

Implementation Type: Administrative Evidence Needed:

• Privacy policy and governance charter
• Data Protection Officer (DPO) or privacy official appointment
• Privacy committee or oversight structure
• Privacy training for staff
• Records of privacy reviews and audits

Priority: High Current Status: 🔄 Partially Implemented - Privacy Officer acts as privacy official, formal DPO not appointed

UC-009: Anonymity and Pseudonymity Support

Domain: Privacy Description: Enable users to interact with services anonymously or pseudonymously wherever practicable and lawful.

Standards Coverage:

• ISO 27701:2019 Annex A 7.2.6. Limit processing of PII elements
• Privacy by Design Principle 2. Privacy as the default - anonymity
• APP 2 (Australia): Individuals should have option to interact anonymously or using pseudonym
• ISO 27566-1. Unlinkability as privacy principle for age assurance

Implementation Type: Technical Evidence Needed:

• System design supporting anonymous/pseudonymous use
• Random identifier generation for verifications
• Unlinkability mechanisms (e.g., nullifiers without user linking)
• Privacy policy explaining anonymity options

Priority: High Current Status: ✅ Implemented - Random verification IDs, no cross-site tracking

UC-010: Cross-Border Data Transfer Safeguards

Domain: Privacy Description: Implement appropriate safeguards for international data transfers, including standard contractual clauses, adequacy decisions, or other lawful mechanisms.

Standards Coverage:

• GDPR Chapter V (Articles 44-50). Transfers of personal data to third countries
• ISO 27701:2019 Annex A 7.2.7. Cross-border transfers of PII
• APP 8 (Australia): Cross-border disclosure requires recipient compliance with APPs
• CCPA. No specific requirement but privacy policy must disclose international transfers
• CSA CCM DSP-07. Cross-border data transfers

Implementation Type: Administrative + Technical Evidence Needed:

• Data transfer impact assessments
• Standard contractual clauses (if applicable)
• List of countries where data is transferred
• Cloudflare data centre locations and data residency
• Privacy Shield / adequacy decision documentation (if applicable)

Priority: Medium Current Status: ✅ Implemented - Cloudflare global network, minimal data transferred

UC-011: Profiling and Automated Decision-Making Restrictions

Domain: Privacy Description: Restrict profiling and automated decision-making, especially for children. Provide human review options for significant automated decisions.

Standards Coverage:

• GDPR Article 22. Right not to be subject to automated decision-making
• ISO 27701:2019 Annex A 7.3.8. Providing information regarding automated decision-making
• UK Children’s Code Standard 12. Switch profiling off by default for children
• CCPA. Right to opt-out of automated decision-making (CPRA amendment)
• CSA CCM DSP-08. Automated decision-making

Implementation Type: Technical + Administrative Evidence Needed:

• Documentation of automated decisions and their logic
• Opt-out mechanisms for profiling
• Human review procedures for significant decisions
• Age-gating for profiling features
• Privacy policy disclosure of automated processing

Priority: Medium Current Status: ✅ Implemented - No profiling performed (age threshold only)

UC-012: Children’s Privacy Protections

Domain: Privacy Description: Implement enhanced privacy protections for users under 18, including age verification, parental consent mechanisms, and restrictions on data collection and sharing.

Standards Coverage:

• UK Children’s Code. All 15 standards apply
• COPPA. Parental consent for children under 13
• COPPA Safe Harbor. Assessment of children’s privacy practices
• GDPR Article 8. Consent for children’s information society services (under 16)
• ISO 27566-1. Age assurance for protecting minors
• CCPA. Restrictions on sale of minors’ data (under 16)

Implementation Type: Technical + Administrative Evidence Needed:

• Age verification mechanisms
• Parental consent flows
• Enhanced privacy defaults for children
• Data minimisation for minors
• Children’s privacy policy (age-appropriate language)

Priority: Critical Current Status: ✅ Implemented - Age verification is core function; minimal data regardless of age

UC-013: Geolocation Privacy Controls

Domain: Privacy Description: Disable geolocation tracking by default, especially for children. Provide obvious indicators when location is being tracked.

Standards Coverage:

• UK Children’s Code Standard 10. Geolocation off by default unless compelling reason
• ISO 27701:2019 Annex A 7.2.8. Location privacy controls
• Privacy by Design Principle 2. Privacy as default
• COPPA Safe Harbor. Location data considered personal information

Implementation Type: Technical Evidence Needed:

• Geolocation settings default to disabled
• User interface indicators for location tracking
• Session-based location reset (not persistent)
• Privacy policy explaining location use

Priority: Medium Current Status: ✅ Implemented - No geolocation tracking performed

UC-014: Parental Controls and Transparency

Domain: Privacy Description: If providing parental controls, inform children when they are being monitored. Provide age-appropriate information about monitoring capabilities.

Standards Coverage:

• UK Children’s Code Standard 11. Provide obvious sign to child when monitored by parent
• COPPA. Parental access to children’s information
• Privacy by Design Principle 6. Visibility and transparency

Implementation Type: Technical + Administrative Evidence Needed:

• User interface showing monitoring indicators to children
• Age-appropriate documentation about parental controls
• Privacy policy explaining parental access rights

Priority: Low Current Status: ❌ Not Applicable - No parental monitoring features (users control own wallets)

UC-015: Nudge Technique Restrictions

Domain: Privacy Description: Do not use nudge techniques or dark patterns to encourage users (especially children) to provide unnecessary personal data or weaken privacy settings.

Standards Coverage:

• UK Children’s Code Standard 13. Do not use nudge techniques to lead children to provide unnecessary data
• Privacy by Design Principle 7. User-centric - empowering users
• GDPR Article 7(4). Consent must be freely given, not influenced by detriment

Implementation Type: Technical + Administrative Evidence Needed:

• User interface design reviews
• A/B testing policies prohibiting privacy-reducing nudges
• User experience audits
• Privacy-protective design patterns

Priority: High Current Status: ✅ Implemented - Minimal UI, no manipulative patterns

UC-016: Data Sharing Restrictions

Domain: Privacy Description: Prohibit or strictly limit sharing of personal data with third parties. Require compelling reasons for any data sharing, especially for children’s data.

Standards Coverage:

• UK Children’s Code Standard 9. Do not disclose children’s data unless compelling reason
• ISO 27701:2019 Annex A 7.3.10. Providing information about PII processing to PII principals regarding third parties
• GDPR Article 5(1)(b). Purpose limitation restricts sharing
• APP 6 (Australia): Disclosure restrictions
• CCPA. Right to know about third-party disclosures and opt-out of sale

Implementation Type: Administrative + Technical Evidence Needed:

• List of third parties receiving data
• Data processing agreements with third parties
• Purpose justification for each sharing relationship
• Privacy policy disclosure of sharing practices
• User opt-out mechanisms

Priority: Critical Current Status: ✅ Implemented - No PII shared (zero knowledge architecture)

UC-017: Retention Limitation

Domain: Privacy Description: Retain personal data only as long as necessary for the specified purpose. Define and enforce retention periods with automated deletion.

Standards Coverage:

• GDPR Article 5(1)(e). Storage limitation - kept no longer than necessary
• ISO 27701:2019 Annex A 7.3.1. PII retention controls
• UK Children’s Code Standard 8. Retain only minimum amount of data
• APP 11 (Australia): Take reasonable steps to destroy or de-identify information no longer needed
• ISO 27001:2022 A.8.10. Information deletion
• CSA CCM DSP-09. Data retention

Implementation Type: Technical + Administrative Evidence Needed:

• Data retention policy with specific timeframes
• Automated deletion procedures
• Retention schedule by data type
• Logs of data deletion activities
• Exception handling for legal holds

Priority: Critical Current Status: ✅ Implemented - IP logs ~90 days; critical security events up to 365 days; ephemeral state auto-expires

UC-018: Privacy Policy and Standards Compliance

Domain: Privacy Description: Publish clear privacy policies and community standards. Uphold published commitments to ensure fair use of personal data.

Standards Coverage:

• UK Children’s Code Standard 6. Uphold published terms, policies, and community standards
• ISO 27701:2019 Annex A 7.3.1. Privacy notice requirements
• APP 1 (Australia): Clear and current privacy policy required
• CCPA. Privacy policy must disclose specific practices

Implementation Type: Administrative Evidence Needed:

• Published privacy policy
• Terms of service
• Community standards (if applicable)
• Policy version control
• Policy review and update records

Priority: Critical Current Status: ✅ Implemented - Privacy policy published at maelstrom.au/trust

UC-019: Detrimental Use Prevention

Domain: Privacy Description: Do not use personal data in ways detrimental to wellbeing, or that violate industry codes, regulations, or government advice.

Standards Coverage:

• UK Children’s Code Standard 5. Do not use children’s data in detrimental ways
• GDPR Article 5(1)(a). Lawfulness, fairness, and transparency
• ISO 27701:2019 Annex A 7.2.1. Lawful and fair processing

Implementation Type: Administrative Evidence Needed:

• Ethical use policy
• Data use review board
• Prohibited uses documentation
• Compliance with industry codes
• Incident response for misuse

Priority: High Current Status: ✅ Implemented - Minimal data collection reduces the risk of detrimental use

UC-020: Best Interests of the Child

Domain: Privacy Description: Make the best interests of children a primary consideration when designing and developing services likely to be accessed by children.

Standards Coverage:

• UK Children’s Code Standard 1. Best interests of child as primary consideration
• UN Convention on Rights of the Child Article 3. Best interests principle
• ISO 27566-1. Child protection as design consideration

Implementation Type: Administrative + Technical Evidence Needed:

• Best interests assessment framework
• Design review process considering child welfare
• Age-appropriate design patterns
• Child safety impact assessments

Priority: High Current Status: ✅ Implemented - Age verification designed to protect minors from age-restricted content

UC-021: Connected Toys and Devices Privacy

Domain: Privacy Description: For connected toys or devices, include effective tools to enable conformance with children’s privacy codes.

Standards Coverage:

• UK Children’s Code Standard 14. Connected toys must include conformance tools
• COPPA. Toys collecting personal information require parental consent

Implementation Type: Technical Evidence Needed:

• Device security features
• Parental control implementation
• Privacy by design for IoT
• Security update mechanisms

Priority: Low Current Status: ❌ Not Applicable - No hardware devices (software-only platform)

UC-022: Privacy Training and Awareness

Domain: Privacy Description: Provide privacy training to staff handling personal data. Raise awareness about privacy obligations and best practices.

Standards Coverage:

• ISO 27701:2019 Clause 5.3.2. Privacy awareness and training
• GDPR Article 39. Data Protection Officer training duties
• APP 1 (Australia): APP entities should train staff
• CSA CCM HRS-08. Security awareness and training

Implementation Type: Administrative Evidence Needed:

• Privacy training program
• Training completion records
• Training content and materials
• Annual refresher training
• Specialized training for roles handling sensitive data

Priority: High Current Status: ✅ Implemented. ISMS Owner holds CISSP, Security+, PenTest+, SecurityX; privacy obligations covered in Security Awareness Programme

UC-023: Privacy-Enhancing Technologies

Domain: Privacy Description: Implement privacy-enhancing technologies such as encryption, anonymisation, pseudonymisation, and zero knowledge proofs.

Standards Coverage:

• GDPR Article 25. Data protection by design - technical measures
• ISO 27701:2019 Annex A 7.2.6. Limiting PII processing through technical measures
• Privacy by Design Principle 3. Privacy embedded into design
• ISO 27566-1. Privacy-preserving age verification technologies
• NIST 800-63-3. Privacy-enhancing authentication mechanisms

Implementation Type: Technical Evidence Needed:

• Cryptographic implementation documentation
• Zero knowledge proof system architecture
• Anonymisation/pseudonymisation techniques
• End-to-end encryption where applicable
• Third-party security audits of privacy technologies

Priority: Critical Current Status: ✅ Implemented - zk-SNARKs (Groth16) core technology

UC-024: Data Quality and Accuracy

Domain: Privacy Description: Ensure personal data is accurate, up-to-date, and complete. Provide mechanisms for users to correct inaccurate data.

Standards Coverage:

• GDPR Article 5(1)(d). Accuracy principle
• ISO 27701:2019 Annex A 7.3.6. Correcting or amending PII
• APP 10 (Australia): Take reasonable steps to ensure data quality
• APP 13 (Australia): Correction rights
• CCPA. Right to correct inaccurate personal information

Implementation Type: Technical + Administrative Evidence Needed:

• Data validation procedures
• Data correction workflows
• User interface for updating information
• Data quality monitoring
• Audit logs of corrections

Priority: Medium Current Status: ✅ Implemented - Date of birth entered by user, validated client-side

UC-025: Sensitive Data Protections

Domain: Privacy Description: Implement enhanced protections for sensitive personal data including biometrics, health data, racial/ethnic origin, religious beliefs, and children’s data.

Standards Coverage:

• GDPR Article 9. Special categories of personal data
• ISO 27701:2019 Annex A 7.2.5. Privacy obligations for special categories
• APP 3 (Australia): Sensitive information requires consent and additional protections
• CCPA. Sensitive personal information use limitation
• COPPA. Children’s information treated as sensitive

Implementation Type: Technical + Administrative Evidence Needed:

• Sensitive data classification
• Enhanced security controls for sensitive data
• Consent mechanisms for sensitive data
• Access restrictions to sensitive data
• Encryption at rest and in transit

Priority: High Current Status: ✅ Implemented - Date of birth transmitted once during issuance for server-side Pedersen commitment computation, then immediately discarded; never transmitted during verification

UC-026: Privacy Incident Response

Domain: Privacy Description: Establish procedures to detect, report, investigate, and respond to privacy incidents and data breaches.

Standards Coverage:

• GDPR Articles 33-34. Data breach notification to authority and data subjects
• ISO 27701:2019 Annex A 7.5.1. PII breach identification and response
• APP 1 (Australia): Privacy policy must address breach response
• CCPA. Breach notification requirements
• CSA CCM SEF-04. Incident response

Implementation Type: Administrative Evidence Needed:

• Privacy incident response plan
• Breach notification procedures and templates
• 72-hour notification timeline for GDPR
• Incident detection mechanisms
• Post-incident review process

Priority: Critical Current Status: ✅ Implemented - Incident response plan includes privacy breaches

UC-027: Records of Processing Activities

Domain: Privacy Description: Maintain records of data processing activities including purposes, categories of data, recipients, retention periods, and security measures.

Standards Coverage:

• GDPR Article 30. Records of processing activities (controller and processor)
• ISO 27701:2019 Annex A 7.2.3. Determining and fulfilling data processing obligations
• ISO 27701:2019 Annex B 8.2.3. Records of processing for processors
• APP 1 (Australia): Privacy policy must document processing practices

Implementation Type: Administrative Evidence Needed:

• Record of processing activities (ROPA) document
• Data inventory and data flows
• Purpose documentation for each processing activity
• Retention periods documented
• Regular ROPA updates

Priority: High Current Status: ✅ Implemented. ROPA Records

UC-028: Privacy Rights for Complaints and Redress

Domain: Privacy Description: Provide accessible mechanisms for users to file privacy complaints and obtain redress for privacy violations.

Standards Coverage:

• UK Children’s Code Standard 15. Tools to report concerns
• ISO 27701:2019 Annex A 7.3.9. Handling requests and complaints
• GDPR Article 77. Right to lodge complaint with supervisory authority
• APP 1 (Australia): Privacy policy must explain complaint mechanisms
• COPPA Safe Harbor. Adequate means for resolving consumer complaints

Implementation Type: Administrative Evidence Needed:

• Complaint submission mechanisms
• Complaint handling procedures and SLAs
• Privacy contact information (email, form)
• Complaint tracking and resolution logs
• Escalation procedures

Priority: High Current Status: 🔄 Partially Implemented - security@maelstrom.au for privacy concerns, formal privacy complaint process needed

UC-029: Direct Marketing Restrictions

Domain: Privacy Description: Restrict use of personal data for direct marketing. Provide opt-out mechanisms and respect do-not-contact preferences.

Standards Coverage:

• GDPR Article 21. Right to object to processing including direct marketing
• ISO 27701:2019 Annex A 7.3.7. Direct marketing opt-out
• APP 7 (Australia): Direct marketing restrictions and opt-out
• UK Children’s Code. Implicit in data minimisation and purpose limitation

Implementation Type: Technical + Administrative Evidence Needed:

• Marketing preference management
• Opt-out mechanisms
• Suppression list management
• Third-party marketing restrictions
• Privacy policy disclosing marketing practices

Priority: Low Current Status: ✅ Implemented - No direct marketing performed

UC-030: Privacy for Employment and HR

Domain: Privacy Description: Implement privacy protections for employee and contractor personal data including background checks, monitoring, and HR data management.

Standards Coverage:

• GDPR Article 88. Processing employee data
• ISO 27701:2019 Annex A 7.2.9. Privacy obligations for HR processing
• APP 3 (Australia): Collection from employees must be reasonably necessary

Implementation Type: Administrative Evidence Needed:

• Employee privacy notice
• HR data retention policies
• Employee monitoring disclosures
• Background check consent forms
• Employee access to their HR data

Priority: Medium Current Status: 🔄 Partially Implemented - Employment contracts include privacy terms, formal HR privacy notice needed

UC-031: Marketing to Children Restrictions

Domain: Privacy Description: Prohibit or strictly limit marketing and advertising targeted to children. Disable behavioural advertising for minors.

Standards Coverage:

• UK Children’s Code Standard 5. Detrimental use includes exploitative marketing
• UK Children’s Code Standard 12. Profiling off by default (used for ad targeting)
• COPPA. Restrictions on marketing to children under 13
• CCPA. Sale of minors’ data restricted (under 16 requires opt-in)

Implementation Type: Technical + Administrative Evidence Needed:

• Age-gated marketing restrictions
• Prohibition on behavioural advertising for minors
• Privacy policy disclosure of advertising practices
• Third-party advertiser contracts restricting child targeting

Priority: High Current Status: ✅ Implemented - No advertising or marketing performed

UC-032: Unlinkability and Selective Disclosure

Domain: Privacy Description: Prevent linking of user activities across different contexts. Enable users to disclose only the minimum information needed for each transaction.

Standards Coverage:

• ISO 27701:2019 Annex A 7.2.6. Minimising linkability
• Privacy by Design Principle 2. Privacy as default - unlinkability
• ISO 27566-1. Unlinkability as core privacy principle
• NIST 800-63-3. Federation protocols should minimise linkability

Implementation Type: Technical Evidence Needed:

• Random identifier generation per transaction
• Nullifier architecture preventing replay without linkability
• Zero knowledge proof selective disclosure
• No cross-site tracking mechanisms
• Privacy architecture documentation

Priority: Critical Current Status: ✅ Implemented - Random verification IDs, unlinkable proofs, nullifiers

UC-033: Privacy-Preserving Analytics

Domain: Privacy Description: Implement analytics and monitoring in privacy-preserving ways. Aggregate data, minimise identifiable information in logs, and limit analytics retention.

Standards Coverage:

• GDPR Article 5(1)(c). Data minimisation applies to analytics
• ISO 27701:2019 Annex A 7.2.6. Minimise PII in analytics
• Privacy by Design Principle 2. Privacy as default
• APP 3 (Australia): Collection must be reasonably necessary

Implementation Type: Technical Evidence Needed:

• Anonymised/aggregated analytics implementation
• IP address truncation or hashing
• Analytics data retention limits
• No tracking cookies or persistent identifiers
• Privacy-preserving telemetry pipeline (Cloudflare Workers Logs shipped to Grafana Loki, hashed IPs only)

Priority: Medium Current Status: ✅ Implemented - Cloudflare Workers Logs in Grafana Loki (privacy-preserving), IP logs 90 days; critical security event logs retained for up to 365 days

UC-034: Processor Obligations and Contracts

Domain: Privacy Description: When acting as a data processor, comply with controller instructions, implement appropriate security, and assist with data subject rights and compliance obligations.

Standards Coverage:

• GDPR Article 28. Processor obligations and contracts
• ISO 27701:2019 Annex B. All processor controls
• APP 8 (Australia): Entities disclosing overseas must ensure compliance
• CCPA. Service provider contracts required

Implementation Type: Administrative Evidence Needed:

• Data processing agreements (DPAs) with customers
• Documentation of controller instructions
• Sub-processor notifications and consents
• Assistance procedures for data subject rights
• Processor security certifications

Priority: Critical Current Status: ✅ Implemented. DPA templates created; pending external legal review (P-001)

downpipes application: For the downpipes platform the processor question is largely structural: because the engine and console run in the customer’s own Cloudflare account, under the customer’s own keys, and Maelstrom holds no customer keys, data or Cloudflare tokens (no-custody), Maelstrom does not take custody of customer backup contents and introduces no further sub-processor for that data. Any processor obligations are scoped to the vendor-side control-plane and update channel, neither of which holds customer data.

UC-035: Third-Party Privacy Audits

Domain: Privacy Description: Undergo independent third-party privacy audits and certifications to demonstrate compliance and build trust.

Standards Coverage:

• ISO 27701:2019. Certifiable standard
• COPPA Safe Harbor. FTC-approved safe harbor program with independent assessments
• SOC 2. Privacy Trust Service Criteria
• Privacy by Design Principle 6. Transparency through independent verification

Implementation Type: Administrative Evidence Needed:

• Third-party audit reports
• Privacy certifications (ISO 27701, Privacy Shield, etc.)
• Safe Harbor program membership
• SOC 2 Type II report (Privacy)
• Public attestations

Priority: High Current Status: 🔄 Deferred. Future consideration after ISO 27001 achieved; no timeline set

UC-036: Privacy Shield / Adequacy Mechanisms

Domain: Privacy Description: For US-EU data transfers, implement approved transfer mechanisms such as Standard Contractual Clauses, adequacy decisions, or certified frameworks.

Standards Coverage:

• GDPR Chapter V. International data transfers
• ISO 27701:2019 Annex A 7.2.7. Cross-border transfer safeguards

Implementation Type: Administrative Evidence Needed:

• Standard Contractual Clauses (SCCs)
• Transfer impact assessment (TIA)
• Adequacy decision documentation
• Binding corporate rules (if applicable)
• Supplementary measures for non-adequate countries

Priority: Medium Current Status: ✅ Implemented. SCCs addendum drafted (Decision 2021/914, Module 2); pending legal review (P-001)

UC-037: Privacy Dispute Resolution

Domain: Privacy Description: Provide independent dispute resolution mechanisms for privacy complaints, especially for international frameworks like COPPA Safe Harbor.

Standards Coverage:

• COPPA Safe Harbor. Independent dispute resolution required
• Privacy Shield. Binding arbitration mechanisms (now invalidated)
• APP 1 (Australia): Complaint handling procedures

Implementation Type: Administrative Evidence Needed:

• Dispute resolution provider contracts
• Escalation procedures to independent review
• Arbitration mechanisms
• Documentation of dispute outcomes

Priority: Medium Current Status: ❌ Not Applicable. B2B model with contractual dispute terms; no consumer-facing dispute resolution needed

UC-038: Privacy Performance Metrics

Domain: Privacy Description: Establish and track privacy performance metrics including consent rates, rights request response times, breach incidents, and user trust measures.

Standards Coverage:

• ISO 27701:2019 Clause 6. Performance evaluation
• Privacy by Design Principle 6. Visibility and transparency
• COPPA Safe Harbor. Annual reporting of privacy metrics

Implementation Type: Administrative Evidence Needed:

• Privacy KPIs dashboard
• Consent acceptance/rejection rates
• Data subject rights request SLA compliance
• Privacy incident metrics
• User satisfaction surveys

Priority: Medium Current Status: 🔄 Deferred. Privacy metrics tracked in quarterly management review; formal dashboard may be implemented as operational volume grows

Security Controls

UC-039: Information Security Policy

Domain: Security Description: Establish, document, approve, and communicate information security policies. Review and update regularly.

Standards Coverage:

• ISO 27001:2022 A.5.1. Policies for information security
• ISO 27701:2019. Extends to privacy policies
• CSA CCM GRC-02. Information security policy
• NIST 800-63-3. Security policy requirements
• COPPA Safe Harbor. Security policies required

Implementation Type: Administrative Evidence Needed:

• Information security policy document
• Privacy policy
• Topic-specific policies (access control, cryptography, etc.)
• Management approval records
• Publication and communication evidence

Priority: Critical Current Status: ✅ Implemented - ISO 27001 ISMS

UC-040: Security Roles and Responsibilities

Domain: Security Description: Define and assign information security roles and responsibilities across the organisation. Establish accountability.

Standards Coverage:

• ISO 27001:2022 A.5.2. Information security roles and responsibilities
• ISO 27701:2019. Privacy roles and responsibilities
• CSA CCM GRC-03. Roles and responsibilities
• NIST CSF. Governance function

Implementation Type: Administrative Evidence Needed:

• Roles and responsibilities matrix
• Job descriptions with security duties
• RACI chart for security activities
• Accountability documentation

Priority: High Current Status: ✅ Implemented - Roles and Responsibilities

UC-041: Risk Assessment and Treatment

Domain: Security Description: Regularly conduct information security risk assessments. Identify, analyse, evaluate, and treat risks. Document risk treatment decisions.

Standards Coverage:

• ISO 27001:2022 Clause 6.1. Risk assessment and treatment
• ISO 27701:2019 Clause 6. Privacy risk management
• CSA CCM GRC-04. Risk management program
• NIST CSF. Risk assessment function
• UK Children’s Code Standard 2. DPIA for risks to children

Implementation Type: Administrative Evidence Needed:

• Risk assessment methodology
• Risk register
• Risk treatment plan
• Residual risk acceptance
• Annual risk reviews

Priority: Critical Current Status: ✅ Implemented - Risk Methodology and Risk Register

UC-042: Access Control Policy and Management

Domain: Security Description: Implement access control policies based on least privilege and need-to-know. Manage access rights throughout lifecycle.

Standards Coverage:

• ISO 27001:2022 A.5.9. Access control
• ISO 27001:2022 A.8.3. Information access restriction
• CSA CCM IAM-01. Access control policy
• NIST 800-63-3. Access management
• GDPR Article 32(1)(b). Ability to ensure confidentiality through access controls

Implementation Type: Technical + Administrative Evidence Needed:

• Access control policy
• Access rights matrix
• Role-based access control (RBAC) implementation
• Access provisioning and deprovisioning procedures
• Access reviews and audit logs

Priority: Critical Current Status: ✅ Implemented - Access Control Policy

UC-043: Multi-Factor Authentication (MFA)

Domain: Security Description: Require multi-factor authentication for access to critical systems, especially administrative access and remote access.

Standards Coverage:

• ISO 27001:2022 A.8.5. Secure authentication
• NIST 800-63-3 AAL2/AAL3. Multi-factor authentication requirements
• CSA CCM IAM-02. Multi-factor authentication
• GDPR Article 32. Appropriate security measures

Implementation Type: Technical Evidence Needed:

• MFA implementation (TOTP, hardware keys, biometrics)
• MFA enforcement policies
• User enrolment records
• Backup authentication methods
• MFA coverage metrics

Priority: Critical Current Status: ✅ Implemented - MFA required for GitHub, Cloudflare, email

UC-044: Encryption in Transit

Domain: Security Description: Encrypt all data in transit using strong cryptography (TLS 1.3 or equivalent). Prohibit unencrypted transmission of sensitive data.

Standards Coverage:

• ISO 27001:2022 A.8.24. Use of cryptography
• ISO 27001:2022 A.5.14. Information transfer
• GDPR Article 32(1)(a). Pseudonymisation and encryption
• NIST 800-63-3. Authenticated protected channels
• CSA CCM EKM-02. Encryption in transit
• CCPA. Encryption required for reasonable security

Implementation Type: Technical Evidence Needed:

• TLS configuration (version, cipher suites)
• TLS enforcement (HSTS headers)
• Certificate management
• No unencrypted protocols (HTTP, FTP, Telnet)
• API security with HTTPS

Priority: Critical Current Status: ✅ Implemented - TLS 1.3 everywhere, HTTPS-only

UC-045: Encryption at Rest

Domain: Security Description: Encrypt sensitive data at rest including databases, backups, and endpoint devices. Use strong encryption algorithms.

Standards Coverage:

• ISO 27001:2022 A.8.24. Use of cryptography
• GDPR Article 32(1)(a). Encryption as security measure
• NIST 800-63-3. Encrypted storage requirements
• CSA CCM EKM-01. Encryption at rest
• CCPA. Encryption for reasonable security

Implementation Type: Technical Evidence Needed:

• Full disk encryption on endpoints (FileVault, BitLocker)
• Database encryption (Cloudflare KV encryption)
• Backup encryption
• Encryption key management
• Cryptographic standards documentation

Priority: Critical Current Status: ✅ Implemented - Full disk encryption required, Cloudflare KV encrypted

UC-046: Security Monitoring and Logging

Domain: Security Description: Implement security event logging, monitoring, and alerting. Protect logs from tampering and unauthorised access.

Standards Coverage:

• ISO 27001:2022 A.8.8. Logging and monitoring
• GDPR Article 32(1)(d). Process for testing, assessing, and evaluating security
• CSA CCM LOG-01. Logging and monitoring
• NIST CSF. Detect function
• ISO 27701:2019 Annex A 7.4.7. Logging for privacy events

Implementation Type: Technical Evidence Needed:

• Log management system (Cloudflare Workers Logs shipped to Grafana Loki, KV audit logs)
• Security event definitions
• Log retention policies
• Log protection (immutability, access controls)
• Alerting rules and incident escalation

Priority: Critical Current Status: ✅ Implemented - Cloudflare Workers Logs (Grafana Loki), KV audit logs

downpipes application: downpipes runs in the customer’s own account with no standing inbound vendor path and no telemetry by default (“runs dark”). It self-monitors: a scored security posture with regression alerts, hourly canary integrity flights, and operator-paging notification rules. When support is needed, consent diagnostics provide a redaction-safe signed support bundle plus owner-minted, time-boxed, scoped, immediately-revocable read-only pull credentials — there is no standing vendor access. The vendor-operated control-plane receives only a content-free advisory beacon and holds no customer keys, data or Cloudflare tokens.

UC-047: Incident Response Plan

Domain: Security Description: Establish and maintain an incident response capability with defined procedures, roles, communication plans, and post-incident reviews.

Standards Coverage:

• ISO 27001:2022 A.5.12. Information security incident management
• GDPR Article 33. Breach notification within 72 hours
• CSA CCM SEF-03. Incident response plan
• NIST CSF. Respond function
• CCPA. Breach notification requirements

Implementation Type: Administrative Evidence Needed:

• Incident response plan document
• Incident severity classification
• Escalation procedures and contact lists
• Incident tracking and reporting
• Post-incident reviews and lessons learned

Priority: Critical Current Status: ✅ Implemented - Incident Response Plan

UC-048: Vulnerability Management

Domain: Security Description: Implement continuous vulnerability scanning, assessment, and remediation. Track and patch vulnerabilities according to risk-based prioritisation.

Standards Coverage:

• ISO 27001:2022 A.8.8. Management of technical vulnerabilities
• CSA CCM TVM-01. Vulnerability management
• NIST CSF. Identify vulnerabilities function
• GDPR Article 32. Regular testing and evaluation

Implementation Type: Technical + Administrative Evidence Needed:

• Vulnerability scanning tools (cargo audit, npm audit, GitHub Security Alerts)
• Vulnerability remediation SLAs
• Patch management procedures
• Vulnerability disclosure program
• Penetration testing reports

Priority: Critical Current Status: ✅ Implemented - GitHub Security Alerts, cargo/npm audit in CI/CD

UC-049: Secure Software Development Lifecycle (SSDLC)

Domain: Security Description: Integrate security into all phases of software development including threat modelling, secure coding, security testing, and code review.

Standards Coverage:

• ISO 27001:2022 A.8.5. Secure development
• CSA CCM AIS-01. Secure development lifecycle
• NIST CSF. Protect function
• GDPR Article 25. Security by design

Implementation Type: Technical + Administrative Evidence Needed:

• SSDLC policy and procedures
• Threat modelling for new features
• Secure coding standards
• Code review requirements
• Security testing in CI/CD

Priority: High Current Status: ✅ Implemented - Code review, CI/CD security testing, threat modelling

UC-050: Security Testing and Assessment

Domain: Security Description: Conduct regular security testing including static analysis, dynamic analysis, penetration testing, and security code review.

Standards Coverage:

• ISO 27001:2022 A.8.29. Security testing in development and acceptance
• CSA CCM AIS-02. Security testing
• NIST CSF. Detect anomalies function
• GDPR Article 32. Regular testing and evaluation

Implementation Type: Technical Evidence Needed:

• Security testing tools (CodeQL, fuzzing, property testing)
• Penetration testing schedule and reports
• Security code review records
• Automated security scanning in CI/CD
• Remediation tracking

Priority: High Current Status: ✅ Implemented - CodeQL, fuzzing, property-based testing, mutation testing

UC-051: Change Management and Control

Domain: Security Description: Implement formal change management for systems, code, and infrastructure. Review changes for security impact before deployment.

Standards Coverage:

• ISO 27001:2022 A.8.6. Change management
• CSA CCM CCC-01. Change control
• NIST CSF. Protect function
• SOC 2. Change management control

Implementation Type: Administrative + Technical Evidence Needed:

• Change management policy
• Change approval workflows
• Version control (Git)
• Deployment procedures
• Rollback capabilities

Priority: High Current Status: ✅ Implemented - Change Management, Git, CI/CD

UC-052: Business Continuity and Disaster Recovery

Domain: Security Description: Establish business continuity plans with defined RTOs and RPOs. Implement disaster recovery procedures and test regularly.

Standards Coverage:

• ISO 27001:2022 A.5.13. Business continuity
• CSA CCM BCR-01. Business continuity management
• NIST CSF. Recover function

Implementation Type: Administrative + Technical Evidence Needed:

• Business continuity plan (BCP)
• Disaster recovery plan (DRP)
• RTOs and RPOs defined
• Backup and recovery procedures
• BCP/DRP testing records

Priority: High Current Status: ✅ Implemented - Business Continuity Plan

downpipes application: For the Cloudflare data layer, recovery has no vendor lock-in. Maelstrom’s own estate is backed up by our production instance of downpipes, and the MIT offline reader restores from archive bytes plus the operator’s offline key with no Cloudflare and no vendor in the loop, built from a frozen public format specification — the same recovery path offered to customers. See Cloudflare Backup Evidence.

UC-053: Asset Management and Inventory

Domain: Security Description: Maintain inventory of information assets including hardware, software, data, and cloud services. Classify and assign ownership.

Standards Coverage:

• ISO 27001:2022 A.5.9. Inventory of information and other associated assets
• CSA CCM GRC-05. Asset management
• NIST CSF. Identify assets function

Implementation Type: Administrative Evidence Needed:

• Asset register
• Asset classification scheme
• Asset ownership assignments
• Regular asset reviews
• Decommissioning procedures

Priority: High Current Status: ✅ Implemented - Asset Register

UC-054: Supplier and Third-Party Security

Domain: Security Description: Assess and manage security risks from suppliers, vendors, and third parties. Include security requirements in contracts.

Standards Coverage:

• ISO 27001:2022 A.5.10. Supplier relationships
• CSA CCM STA-01. Supply chain management
• GDPR Article 28. Processor security requirements

Implementation Type: Administrative Evidence Needed:

• Supplier security assessment procedures
• Security requirements in vendor contracts
• Critical supplier list (Cloudflare, GitHub)
• Vendor security reviews
• Sub-processor management

Priority: High Current Status: ✅ Implemented - Supplier Management

UC-055: Physical and Environmental Security

Domain: Security Description: Protect physical facilities, equipment, and infrastructure from physical threats, environmental hazards, and unauthorised access.

Standards Coverage:

• ISO 27001:2022 A.7. Physical controls
• CSA CCM DCS-01. Datacenter security
• NIST CSF. Protect function

Implementation Type: Physical + Administrative Evidence Needed:

• Datacenter security (managed by Cloudflare/GitHub)
• Endpoint security (full disk encryption, screen locks)
• Remote work security policies
• Environmental controls (power, HVAC) - cloud provider responsibility

Priority: Medium Current Status: ✅ Implemented - Cloudflare/GitHub datacenter security, endpoint controls

UC-056: Network Security and Segmentation

Domain: Security Description: Implement network security controls including firewalls, network segmentation, intrusion detection, and DDoS protection.

Standards Coverage:

• ISO 27001:2022 A.8.20. Networks security
• ISO 27001:2022 A.8.22. Segregation of networks
• CSA CCM IVS-01. Network security
• NIST CSF. Protect function

Implementation Type: Technical Evidence Needed:

• Network architecture diagrams
• Firewall rules and policies
• Network segmentation (production vs. development)
• Intrusion detection/prevention systems
• DDoS protection (Cloudflare)

Priority: High Current Status: ✅ Implemented - Cloudflare DDoS protection, WAF, environment segregation

UC-057: Endpoint Security

Domain: Security Description: Secure endpoint devices (workstations, laptops, mobile) with antivirus, full disk encryption, secure configuration, and patch management.

Standards Coverage:

• ISO 27001:2022 A.8.1. User endpoint devices
• CSA CCM UEM-01. Universal endpoint management
• NIST CSF. Protect function

Implementation Type: Technical + Administrative Evidence Needed:

• Endpoint security policy (acceptable use)
• Full disk encryption enforcement
• Antivirus/anti-malware (OS-level)
• Patch management
• Mobile device management (if applicable)

Priority: High Current Status: ✅ Implemented - Full disk encryption required, OS security features

UC-058: Secure Authentication and Password Management

Domain: Security Description: Implement strong authentication mechanisms with password complexity requirements, password managers, and secure credential storage.

Standards Coverage:

• ISO 27001:2022 A.8.2. Secure authentication
• NIST 800-63-3 AAL1/2/3. Authenticator assurance levels
• CSA CCM IAM-03. Password management

Implementation Type: Technical + Administrative Evidence Needed:

• Password policy (complexity, length, rotation)
• Password manager enforcement (1Password, Bitwarden)
• Secure credential storage (never in code/logs)
• API authentication mechanisms (HMAC)

Priority: Critical Current Status: ✅ Implemented - Password managers required, MFA, HMAC API auth

UC-059: Privileged Access Management

Domain: Security Description: Restrict and monitor privileged access. Implement just-in-time elevation, privileged session monitoring, and regular reviews.

Standards Coverage:

• ISO 27001:2022 A.8.2. Privileged access rights
• CSA CCM IAM-04. Privileged access management
• NIST CSF. Protect function

Implementation Type: Technical + Administrative Evidence Needed:

• Privileged access policy
• List of privileged accounts
• Privileged access logs
• Regular privileged access reviews
• Separation of duties for privileged operations

Priority: Critical Current Status: ✅ Implemented - Limited admin access, audit logging

UC-060: Security Awareness and Training

Domain: Security Description: Provide security awareness training to all personnel covering phishing, social engineering, acceptable use, and incident reporting.

Standards Coverage:

• ISO 27001:2022 A.6.3. Information security awareness
• CSA CCM HRS-08. Security awareness training
• NIST CSF. Protect function

Implementation Type: Administrative Evidence Needed:

• Security awareness training program

• Training completion records

• Training content and materials

• Annual refresher training

Priority: High Current Status: ✅ Implemented - Security Awareness Program

UC-061: Malware Protection

Domain: Security Description: Implement anti-malware protection on endpoints. Use application whitelisting, sandboxing, and behavioural analysis where feasible.

Standards Coverage:

• ISO 27001:2022 A.8.7. Protection against malware
• CSA CCM TVM-02. Malware protection
• NIST CSF. Detect function

Implementation Type: Technical Evidence Needed:

• Anti-malware software (OS-level: Windows Defender, macOS XProtect)
• Malware scanning logs
• Email filtering (for email-borne malware)
• Download restrictions
• Serverless architecture (no persistent malware)

Priority: High Current Status: ✅ Implemented - OS-level protection, serverless architecture

UC-062: Backup and Recovery

Domain: Security Description: Implement regular backups of critical data and systems. Test backup restoration procedures. Protect backups from ransomware.

Standards Coverage:

• ISO 27001:2022 A.8.13. Information backup
• CSA CCM BCR-02. Backup and recovery
• NIST CSF. Recover function

Implementation Type: Technical + Administrative Evidence Needed:

• Backup policy and schedule
• Backup storage locations
• Backup testing records
• Immutable backups (ransomware protection)
• Recovery procedures

Priority: Critical Current Status: ✅ Implemented - Maelstrom’s entire Cloudflare estate is backed up by our own production instance of downpipes (we run downpipes as a customer of our own product)

Implementation Evidence:

• Cloudflare Backup Evidence
• Scheduled, verified backups of Workers KV, D1, R2, Secrets Store, and 51 zone/account configuration surfaces
• 3-2-1 fan-out: each source written to two or more independent, Maelstrom-controlled destinations
• Encryption: post-quantum hybrid, sealed under operator-held keys (no-custody)
• Recoverability proven by hourly canary integrity flights and scheduled in-account restore drills
• RPO: under 1 hour, RTO: under 4 hours
• Closes GAP-H006

downpipes application: downpipes is Maelstrom’s productised implementation of this control for the Cloudflare data layer; the same product backs up Maelstrom’s own estate (see Implementation Evidence) and is offered to customers. In a customer deployment the engine runs in the customer’s own Cloudflare account, under the customer’s own keys, and seals archives with post-quantum hybrid encryption before fanning them out 3-2-1 to two or more customer-controlled destinations. The “regularly tested” and ransomware-resistance elements are met by hourly canary integrity flights, scheduled in-account restore drills, and the MIT offline reader that restores from archive bytes plus the customer’s offline key alone — no vendor, no network. Because downpipes is no-custody, Maelstrom holds no customer keys, data or Cloudflare tokens.

UC-063: Security of Development and Test Environments

Domain: Security Description: Separate and secure development, testing, and production environments. Prohibit use of production data in non-production environments.

Standards Coverage:

• ISO 27001:2022 A.8.31. Separation of development, test and production environments
• ISO 27001:2022 A.8.33. Test information
• CSA CCM AIS-03. Secure development environment

Implementation Type: Technical + Administrative Evidence Needed:

• Environment separation (wrangler dev vs. production)
• No production secrets in development
• Synthetic test data generation
• Environment access controls

Priority: High Current Status: ✅ Implemented - Separated environments, synthetic test data

UC-064: Capacity Management and Availability

Domain: Security Description: Monitor resource usage and capacity. Plan for future capacity needs. Implement redundancy and auto-scaling for availability.

Standards Coverage:

• ISO 27001:2022 A.8.6. Capacity management
• ISO 27001:2022 A.8.14. Redundancy of information processing facilities
• CSA CCM BCR-03. Availability and capacity
• NIST CSF. Protect function

Implementation Type: Technical Evidence Needed:

• Capacity monitoring dashboards
• Auto-scaling configuration (Cloudflare Workers)
• Redundancy architecture (300+ PoPs)
• Availability SLAs (99.9%+)
• Capacity planning reviews

Priority: High Current Status: ✅ Implemented - Cloudflare auto-scaling, global distribution

UC-065: Clock Synchronisation

Domain: Security Description: Synchronise system clocks to authoritative time sources (NTP) for accurate timestamps in logs, certificates, and cryptographic operations.

Standards Coverage:

• ISO 27001:2022 A.8.17. Clock synchronisation
• CSA CCM LOG-02. Time synchronisation
• NIST CSF. Detect function

Implementation Type: Technical Evidence Needed:

• NTP configuration
• Time synchronisation logs
• Accurate timestamps in audit logs

Priority: Medium Current Status: ✅ Implemented - Cloudflare/OS automatic NTP

UC-066: Secure Disposal and Sanitisation

Domain: Security Description: Securely dispose of or sanitise storage media and equipment containing sensitive data before disposal or reuse.

Standards Coverage:

• ISO 27001:2022 A.7.14. Secure disposal or re-use of equipment
• ISO 27001:2022 A.8.10. Information deletion
• CSA CCM DSP-10. Data disposal

Implementation Type: Technical + Administrative Evidence Needed:

• Disposal procedures (cryptographic erasure, physical destruction)
• Full disk encryption (makes disposal easier)
• Disposal logs and certificates
• Asset decommissioning process

Priority: Medium Current Status: ✅ Implemented - Data Retention, cryptographic erasure

UC-067: Information Leakage Prevention

Domain: Security Description: Prevent information leakage through logs, error messages, screen displays, network traffic, and other channels.

Standards Coverage:

• ISO 27001:2022 A.8.12. Data leakage prevention
• ISO 27001:2022 A.8.12. Data leakage prevention
• CSA CCM DLP-01. Data loss prevention

Implementation Type: Technical Evidence Needed:

• No secrets in logs or error messages
• Screen lock policies
• No PII in logs
• TLS for all communications
• Code scanning for secret leakage

Priority: High Current Status: ✅ Implemented - No secrets in logs/code, TLS everywhere

UC-068: Segregation of Duties

Domain: Security Description: Separate conflicting duties to reduce risk of unauthorised or fraudulent activity. Require multiple approvals for critical operations.

Standards Coverage:

• ISO 27001:2022 A.5.3. Segregation of duties
• CSA CCM IAM-05. Segregation of duties
• SOC 2. Separation of duties control

Implementation Type: Administrative Evidence Needed:

• Segregation of duties matrix
• Code review requirements (no self-merge)
• Multiple approvals for privileged operations
• Compensating controls for small teams

Priority: Medium Current Status: 🔄 Partially Implemented - Code review enforced, small team limits full segregation

UC-069: Security Metrics and Reporting

Domain: Security Description: Define and track security metrics. Report security posture to management and stakeholders. Dashboard key security indicators.

Standards Coverage:

• ISO 27001:2022 Clause 9. Performance evaluation
• CSA CCM GRC-06. Security metrics
• NIST CSF. Identify and measure

Implementation Type: Administrative Evidence Needed:

• Security metrics dashboard
• KPIs (vulnerability remediation time, incident response time, etc.)
• Management security reports
• Trend analysis

Priority: Medium Current Status: 🔄 Deferred. Security metrics tracked via GitHub and Cloudflare; formal dashboard may be consolidated as operational maturity grows

UC-070: Security Contact and Disclosure

Domain: Security Description: Publish security contact information (security@) and establish vulnerability disclosure program for researchers.

Standards Coverage:

• ISO 27001:2022 A.5.5. Contact with authorities
• ISO 27001:2022 A.6.8. Information security event reporting
• CSA CCM SEF-05. Vulnerability disclosure

Implementation Type: Administrative Evidence Needed:

• security@maelstrom.au published
• Vulnerability disclosure policy
• Security researcher coordination
• Response SLAs for security reports

Priority: High Current Status: ✅ Implemented - security@maelstrom.au, responsible disclosure

Cryptographic Controls

UC-071: Cryptographic Policy and Standards

Domain: Cryptography Description: Establish cryptographic policy defining approved algorithms, key lengths, use cases, and prohibiting weak cryptography.

Standards Coverage:

• ISO 27001:2022 A.8.24. Use of cryptography
• ISO 27701:2019. Cryptography for privacy protection
• NIST 800-63-3. Cryptographic requirements
• CSA CCM EKM-03. Cryptographic standards

Implementation Type: Administrative + Technical Evidence Needed:

• Cryptography policy document
• Approved algorithm list (Groth16, RedJubjub, BLAKE2, SHA256, TLS 1.3)
• Prohibited algorithms (MD5, SHA1, DES, RC4)
• Cryptographic libraries and versions

Priority: Critical Current Status: ✅ Implemented - Cryptography Policy

downpipes application: The same cryptography policy governs downpipes. Its approved-algorithm set adds post-quantum hybrid encryption for archive sealing; weak-algorithm prohibitions and transport (TLS 1.3) requirements apply identically. See the downpipes Cryptography section of the Cryptography Policy.

UC-072: Cryptographic Key Management

Domain: Cryptography Description: Implement secure key lifecycle management including generation, distribution, storage, rotation, and destruction.

Standards Coverage:

• ISO 27001:2022 A.8.24. Use of cryptography
• NIST 800-63-3. Key management requirements
• CSA CCM EKM-04. Key management lifecycle
• GDPR Article 32. Encryption key protection

Implementation Type: Technical + Administrative Evidence Needed:

• Key management policy
• Key generation ceremonies
• Secure key storage (Cloudflare KV secrets)
• Key rotation procedures
• Key destruction procedures

Priority: Critical Current Status: ✅ Implemented - Signing keys in Cloudflare KV, rotation procedures defined

downpipes application: Because downpipes is no-custody, the keys that protect backup contents (break-glass, operational, archive-signer) are generated and held by the customer — created through a guided in-browser key ceremony, captured on a printed recovery sheet, and stored offline (encrypted USB, password manager, or Shamir split) under a default two-recipient posture. Safeguarding those keys is a complementary user-entity control; Maelstrom cannot decrypt, recover or rotate them by design. Maelstrom manages only two vendor-side signing keys for downpipes: the Licence Signer (Cloudflare Secrets Store, control-plane, fail-open) and the Update Signer (held offline by the operator, never deployed to any Worker). Neither protects customer data. See the Cryptography Policy.

UC-073: Zero knowledge Proof Implementation

Domain: Cryptography Description: Implement zero knowledge proof system (zk-SNARKs) securely with proper trusted setup, circuit design, and proof verification.

Standards Coverage:

• ISO 27566-1. Privacy-preserving age verification technologies
• Privacy by Design Principle 3. Privacy embedded into design
• NIST. Emerging cryptography guidance
• Academic Standards. ZKP security best practices

Implementation Type: Technical Evidence Needed:

• zk-SNARK implementation documentation (Groth16, BLS12-381)
• Circuit design and audit
• Proof verification implementation

Priority: Critical Current Status: ✅ Implemented - provii-crypto using Groth16, circuit design documented

UC-074: Digital Signature Implementation

Domain: Cryptography Description: Implement digital signatures for authenticity and integrity. Use approved signature schemes with proper key protection.

Standards Coverage:

• NIST 800-63-3. Digital signature requirements
• ISO 27001:2022 A.8.24. Use of cryptography
• CSA CCM EKM-05. Digital signatures

Implementation Type: Technical Evidence Needed:

• Signature scheme documentation (RedJubjub)
• Signing key protection
• Signature verification implementation
• Signature use cases (credential issuance, API authentication)

Priority: Critical Current Status: ✅ Implemented - RedJubjub signatures for credentials

UC-075: Cryptographic Hash Functions

Domain: Cryptography Description: Use cryptographically secure hash functions for integrity, commitments, and proofs. Prohibit weak hash functions.

Standards Coverage:

• ISO 27001:2022 A.8.24. Use of cryptography
• NIST. Hash function standards (FIPS 180-4, FIPS 202)
• CSA CCM EKM-06. Cryptographic hash functions

Implementation Type: Technical Evidence Needed:

• Hash function usage documentation (BLAKE2s, SHA256)
• Prohibited hash functions (MD5, SHA1)
• Hash function use cases (Pedersen commitments, nullifiers)

Priority: High Current Status: ✅ Implemented - BLAKE2s, SHA256 only

UC-076: Trusted Setup Security

Domain: Cryptography Description: For zk-SNARKs requiring trusted setup (Groth16), conduct secure multi-party computation ceremony with participants destruction of toxic waste.

Standards Coverage:

• Academic ZKP Standards. Trusted setup best practices
• ISO 27566-1. Security of age assurance cryptography
• Privacy by Design. Transparency in cryptographic setup

Implementation Type: Technical + Administrative Evidence Needed:

• Trusted setup ceremony documentation
• Participant list and attestations
• Toxic waste destruction confirmations
• Public verification parameters
• Ceremony transcript

Priority: Critical Current Status: ❌ Not Applicable. Using development parameters; formal multi-party trusted setup not planned

UC-077: Cryptographic Commitment Schemes

Domain: Cryptography Description: Implement secure commitment schemes (Pedersen commitments) for privacy-preserving proofs with hiding and binding properties.

Standards Coverage:

• ISO 27566-1. Privacy-preserving technologies
• Academic Standards. Commitment scheme security
• Privacy by Design Principle 3. Privacy embedded into design

Implementation Type: Technical Evidence Needed:

• Commitment scheme implementation (Pedersen on Jubjub curve)
• Cryptographic parameters
• Hiding and binding property verification
• Use cases (age commitment in credentials)

Priority: Critical Current Status: ✅ Implemented - Pedersen commitments in provii-crypto

UC-078: Randomness Generation

Domain: Cryptography Description: Use cryptographically secure random number generators (CSPRNGs) for keys, nonces, challenges, and other cryptographic randomness.

Standards Coverage:

• NIST 800-63-3. Randomness requirements
• ISO 27001:2022 A.8.24. Use of cryptography
• FIPS 140-2. Random number generation

Implementation Type: Technical Evidence Needed:

• CSPRNG usage (OS-provided: /dev/urandom, CryptoAPI)
• Randomness sources
• Entropy pool management
• No predictable randomness

Priority: Critical Current Status: ✅ Implemented - OS CSPRNGs, rand_chacha

UC-079: Nullifier Mechanism Security

Domain: Cryptography Description: Implement secure nullifier mechanism to prevent credential replay while maintaining unlinkability.

Standards Coverage:

• ISO 27566-1. Replay prevention in age assurance
• Privacy by Design Principle 2. Unlinkability
• Academic Standards. Double-spending prevention

Implementation Type: Technical Evidence Needed:

• Nullifier derivation implementation
• Nullifier storage and checking
• Unlinkability analysis
• Replay prevention testing

Priority: Critical Current Status: ✅ Implemented - Nullifiers prevent replay without linking users

UC-080: Cryptographic Protocol Security

Domain: Cryptography Description: Design and implement cryptographic protocols securely with proper message ordering, replay protection, and challenge-response mechanisms.

Standards Coverage:

• ISO 27566-1. Age verification protocol security
• NIST 800-63-3. Authentication protocol requirements
• Academic Standards. Protocol design best practices

Implementation Type: Technical Evidence Needed:

• Protocol specification documents
• Message flow diagrams
• Security analysis (resistance to replay, MITM, etc.)
• Challenge-response implementation
• Protocol testing

Priority: Critical Current Status: ✅ Implemented - Challenge-response for verifications, nonce-based replay protection

UC-081: Post-Quantum Cryptography Preparedness

Domain: Cryptography Description: Monitor post-quantum cryptography developments. Plan migration path for quantum-resistant algorithms when standards mature.

Standards Coverage:

• NIST. Post-quantum cryptography standardisation
• ISO. Emerging post-quantum standards
• CSA CCM. Quantum-safe cryptography

Implementation Type: Administrative Evidence Needed:

• PQC roadmap and timeline
• Cryptographic agility in design
• Monitoring of NIST PQC standards
• Migration plan for quantum threat

Priority: Low Current Status: 🔄 Monitoring. Tracking NIST PQC standards; cryptographic agility designed in; no implementation timeline

downpipes application: For the downpipes platform this is already implemented rather than monitored — backup archives are sealed with post-quantum hybrid encryption at issuance, mitigating the store-now-decrypt-later threat to backed-up data under the no-custody model. See Cryptography Policy.

UC-082: Cryptographic Audit and Review

Domain: Cryptography Description: Undergo third-party cryptographic audits by qualified experts. Publicly disclose audit results and remediation.

Standards Coverage:

• Privacy by Design Principle 6. Transparency through independent verification
• ISO 27566-1. Cryptographic assurance
• Academic Standards. Peer review of cryptography

Implementation Type: Administrative Evidence Needed:

• Cryptographic audit reports
• Auditor qualifications
• Public disclosure of audit findings
• Remediation of identified issues
• Regular re-audits

Priority: High Current Status: 🔄 Deferred. Will pursue when commercially viable (estimated $50k-$150k)

Age Verification Controls

UC-083: Age Threshold Proof Without Date of Birth Disclosure

Domain: Age Verification Description: Prove user meets age threshold (age >= 18, 21, etc.) without revealing actual date of birth or age.

Standards Coverage:

• ISO 27566-1. Age verification without PII disclosure
• Privacy by Design Principle 2. Data minimisation
• UK Children’s Code. Minimal data collection
• GDPR Article 5(1)(c). Data minimisation

Implementation Type: Technical Evidence Needed:

• Zero knowledge proof implementation for age thresholds
• Proof verification showing only threshold result
• No DOB stored on servers
• Client-side proof generation

Priority: Critical Current Status: ✅ Implemented - zk-SNARK proves age >= threshold, DOB never transmitted during verification

UC-084: Age Assurance Accuracy and Reliability

Domain: Age Verification Description: Implement age verification with sufficient accuracy and reliability appropriate to risk of harm. Document accuracy metrics.

Standards Coverage:

• ISO 27566-1. Effectiveness of age assurance
• UK Children’s Code Standard 3. Age-appropriate application with risk-based approach
• COPPA. Verifiable parental consent mechanisms

Implementation Type: Technical + Administrative Evidence Needed:

• Accuracy metrics (false positive/negative rates)
• Reliability testing results
• Risk-based accuracy requirements by use case
• Issuer trust model and verification

Priority: Critical Current Status: ✅ Implemented - Issuer-based model (banks, government, in-person verification)

UC-085: Trusted Issuer Network

Domain: Age Verification Description: Establish and maintain network of trusted credential issuers with verified identity proofing capabilities.

Standards Coverage:

• ISO 27566-1. Trust framework for age assurance
• NIST 800-63-3 IAL2/IAL3. Identity proofing requirements
• UK Children’s Code. Reliable age verification

Implementation Type: Administrative + Technical Evidence Needed:

• Issuer onboarding criteria
• Issuer trust framework
• Issuer verification key registry (JWKS)
• Issuer security assessments
• Issuer audit requirements

Priority: Critical Current Status: 🔄 Partially Implemented - Initial issuer partnerships, formal trust framework in development

UC-086: Credential Issuance Security

Domain: Age Verification Description: Secure credential issuance process with strong identity proofing, fraud prevention, and secure credential delivery.

Standards Coverage:

• ISO 27566-1. Credential issuance security
• NIST 800-63-3 IAL2. Identity evidence collection and verification
• W3C Verifiable Credentials. Credential issuance best practices

Implementation Type: Technical Evidence Needed:

• Identity proofing procedures (issuer-side)
• Fraud detection mechanisms
• Encrypted credential delivery
• Credential format and structure
• Revocation mechanisms

Priority: Critical Current Status: ✅ Implemented - Issuer service with encrypted credentials

UC-087: Credential Revocation and Lifecycle

Domain: Age Verification Description: Implement credential lifecycle management including expiration, renewal, and revocation. Publish revocation lists.

Standards Coverage:

• ISO 27566-1. Credential lifecycle management
• W3C Verifiable Credentials. Revocation methods
• NIST 800-63-3. Authenticator lifecycle

Implementation Type: Technical Evidence Needed:

• Credential expiration logic (validity periods)
• Revocation list publication
• Renewal procedures
• User notification of expiration
• Privacy-preserving revocation checks

Priority: High Current Status: ⚠️ Partial - Credentials have expiration dates; key revocation via Active→Deprecated→Disabled status transitions in KV (no CRL/revocation list)

UC-088: Replay Prevention (Nullifiers)

Domain: Age Verification Description: Prevent reuse of proofs across different verifications while maintaining user unlinkability.

Standards Coverage:

• ISO 27566-1. Replay prevention in age verification
• Privacy by Design Principle 2. Unlinkability
• Academic Standards. Double-spending prevention in anonymous credentials

Implementation Type: Technical Evidence Needed:

• Nullifier implementation
• Nullifier database and checking
• Unlinkability analysis
• Replay attack testing

Priority: Critical Current Status: ✅ Implemented - Nullifiers prevent replay without user linking

UC-089: Age-Appropriate Design

Domain: Age Verification Description: Design services with age-appropriate defaults, content, features, and privacy settings for different age groups.

Standards Coverage:

• UK Children’s Code Standard 3. Age-appropriate application
• ISO 27566-1. Age-specific protections
• COPPA. Child-directed service requirements

Implementation Type: Technical + Administrative Evidence Needed:

• Age-group segmentation (under 13, 13-15, 16-17, 18+)
• Age-appropriate privacy defaults
• Content filtering by age
• Feature restrictions by age
• Age-appropriate UI/UX

Priority: High Current Status: ✅ Implemented - Age thresholds enforced, websites choose appropriate threshold

UC-090: Parental Consent for Minors

Domain: Age Verification Description: For children under 13 (COPPA) or 16 (GDPR), obtain verifiable parental consent before processing personal data.

Standards Coverage:

• COPPA. Parental consent for children under 13
• GDPR Article 8. Parental consent for children under 16 (or member state age)
• UK Children’s Code. Parental involvement where appropriate
• COPPA Safe Harbor. Parental consent mechanisms

Implementation Type: Technical + Administrative Evidence Needed:

• Parental consent flow implementation
• Parent identity verification
• Consent record keeping
• Consent withdrawal mechanisms
• Age-gating for services requiring parental consent

Priority: High Current Status: ✅ Implemented. Parental consent inherent in in-person issuance process (parent present with officer); no digital consent flow required

UC-091: Age Re-verification and Challenge Mechanisms

Domain: Age Verification Description: Implement risk-based re-verification when user behaviour suggests age misrepresentation. Support challenge mechanisms.

Standards Coverage:

• ISO 27566-1. Ongoing age assurance
• UK Children’s Code Standard 3. Effective age verification
• COPPA. Age screening mechanisms

Implementation Type: Technical Evidence Needed:

• Re-verification triggers (behavioural signals)
• Challenge issuance and response
• User notification of re-verification
• Privacy-preserving challenge mechanisms

Priority: Medium Current Status: ❌ Not Applicable. Credentials valid until revoked; no behavioural re-verification planned

UC-092: Age Verification Audit Logging

Domain: Age Verification Description: Log age verification events (without PII) for compliance, fraud detection, and analytics.

Standards Coverage:

• ISO 27566-1. Age verification logging and auditing
• GDPR Article 30. Records of processing
• ISO 27001:2022 A.8.15. Logging

Implementation Type: Technical Evidence Needed:

• Verification attempt logs (timestamp, threshold, result, issuer)
• No PII in logs (pseudonymous identifiers)
• Fraud pattern detection
• Compliance reporting
• Log retention and protection

Priority: High Current Status: ✅ Implemented - Verification logs in KV, no PII

UC-093: Age Verification Transparency

Domain: Age Verification Description: Transparently communicate age verification mechanisms, data processing, and user rights to users and parents.

Standards Coverage:

• ISO 27566-1. Transparency of age assurance
• UK Children’s Code Standard 4. Transparency for children
• GDPR Articles 12-14. Transparency requirements
• COPPA. Parental notice requirements

Implementation Type: Administrative Evidence Needed:

• Age verification explanation in privacy policy
• Age-appropriate transparency notices
• Disclosure of verification methods
• User education materials
• Parent information pages

Priority: High Current Status: 🔄 Partially Implemented - Documentation exists, age-appropriate version needed

UC-094: Age Verification Accessibility

Domain: Age Verification Description: Ensure age verification methods are accessible to users with disabilities and diverse populations.

Standards Coverage:

• ISO 27566-1. Accessibility of age assurance
• WCAG 2.1. Web accessibility guidelines
• UN Convention on Rights of Persons with Disabilities. Digital accessibility

Implementation Type: Technical Evidence Needed:

• Accessibility testing (WCAG AA compliance)
• Multiple verification methods (document, biometric, vouching)
• Screen reader compatibility
• Alternative text and descriptions
• Keyboard navigation

Priority: Medium Current Status: 🔄 Partially Implemented - Multiple verification methods, WCAG audit needed

UC-095: Age Verification Interoperability

Domain: Age Verification Description: Support interoperable age verification standards enabling credentials to work across multiple services and platforms.

Standards Coverage:

• ISO 27566-1. Interoperability of age assurance systems
• W3C Verifiable Credentials. Standard data model
• OpenID for Verifiable Credentials. Credential exchange protocol
• euCONSENT. European age verification interoperability

Implementation Type: Technical Evidence Needed:

• Standards compliance (W3C VC, OpenID)
• Credential portability across services
• Interoperability testing
• Open source implementation
• Published API specifications

Priority: High Current Status: ✅ Implemented - W3C VC compatible, open source

UC-096: Age Estimation vs. Age Verification

Domain: Age Verification Description: Distinguish between age estimation (approximate age) and age verification (cryptographically proven age threshold). Use appropriate method for risk level.

Standards Coverage:

• ISO 27566-1. Defines age verification, age estimation, age inference
• UK Online Safety Act. Risk-based age assurance
• ISO 27566-1. Match assurance level to risk

Implementation Type: Administrative + Technical Evidence Needed:

• Age assurance method classification
• Risk assessment for age assurance requirements
• Documentation of verification vs. estimation
• Appropriate method selection by use case

Priority: Medium Current Status: ✅ Implemented - Cryptographic age verification (highest assurance)

UC-097: Age Verification Privacy Impact Assessment

Domain: Age Verification Description: Conduct privacy impact assessment specifically for age verification mechanisms, especially when processing children’s data.

Standards Coverage:

• ISO 27566-1. Privacy risk assessment for age assurance
• UK Children’s Code Standard 2. DPIA for children’s services
• GDPR Article 35. DPIA for high-risk processing

Implementation Type: Administrative Evidence Needed:

• Age verification DPIA document
• Privacy risks identified and mitigated
• Alternatives analysis
• Necessity and proportionality assessment
• Regular DPIA reviews

Priority: High Current Status: ✅ Implemented - See Data Protection Impact Assessment (covers age verification processing)

UC-098: Age Verification User Experience

Domain: Age Verification Description: Design age verification with minimal friction, clear instructions, and respectful user experience. Avoid stigmatisation.

Standards Coverage:

• ISO 27566-1. Usability of age assurance
• UK Children’s Code Standard 4. Clear and accessible information
• Privacy by Design Principle 4. Positive-sum, not zero-sum

Implementation Type: Technical Evidence Needed:

• User experience testing
• Verification completion rates
• User feedback and satisfaction
• Time to verify metrics
• Error messaging and support

Priority: Medium Current Status: ✅ Implemented - Wallet-based UX, one-tap verification

UC-099: Age Verification Fraud Detection

Domain: Age Verification Description: Implement fraud detection mechanisms to identify and prevent age verification circumvention, fake credentials, and abuse.

Standards Coverage:

• ISO 27566-1. Security of age assurance against attacks
• COPPA. Fraud prevention in age screening
• NIST 800-63-3. Fraud detection in identity proofing

Implementation Type: Technical + Administrative Evidence Needed:

• Fraud detection algorithms
• Anomaly detection (unusual patterns)
• Credential validation and cryptographic checks
• Issuer reputation monitoring
• Fraud incident response

Priority: High Current Status: ✅ Implemented - Cryptographic proof validation, nullifier checking

UC-100: Age Verification Data Minimisation

Domain: Age Verification Description: Minimise data collected and retained for age verification. Use privacy-preserving techniques to avoid unnecessary personal data exposure.

Standards Coverage:

• ISO 27566-1. Data minimisation in age assurance
• GDPR Article 5(1)(c). Data minimisation
• Privacy by Design Principle 2. Privacy as default
• UK Children’s Code Standard 8. Data minimisation

Implementation Type: Technical Evidence Needed:

• Zero knowledge proof architecture
• No DOB stored on servers
• Minimal credential data elements
• Privacy policy documenting minimisation
• Data flow diagrams

Priority: Critical Current Status: ✅ Implemented - Zero knowledge architecture, no PII on servers

Data Lifecycle Controls

UC-101: Data Collection Limitation

Domain: Data Lifecycle Description: Collect personal data only when necessary, with user awareness and consent. Provide opt-in mechanisms where appropriate.

Standards Coverage:

• GDPR Article 5(1)(c). Data minimisation
• ISO 27701:2019 Annex A 7.2.1. Lawful and fair collection
• APP 3 (Australia): Collection must be reasonably necessary
• CCPA. Collection must be disclosed in privacy policy

Implementation Type: Administrative + Technical Evidence Needed:

• Data collection inventory
• Necessity justification for each data element
• Opt-in mechanisms for optional data
• Privacy policy disclosure

Priority: Critical Current Status: ✅ Implemented - Only IP addresses collected (90 days; critical security event logs retained for up to 365 days)

UC-102: Data Retention Policies

Domain: Data Lifecycle Description: Define retention periods for each data category based on legal, business, and privacy requirements. Enforce through automated deletion.

Standards Coverage:

• GDPR Article 5(1)(e). Storage limitation
• ISO 27701:2019 Annex A 7.3.1. Retention and disposal
• APP 11 (Australia): Destroy or de-identify when no longer needed
• ISO 27001:2022 A.8.10. Information deletion

Implementation Type: Administrative + Technical Evidence Needed:

• Data retention schedule by data type
• Automated deletion scripts
• Retention enforcement monitoring
• Legal hold procedures
• Retention policy documentation

Priority: Critical Current Status: ✅ Implemented - Data Retention Policy

UC-103: Automated Data Deletion

Domain: Data Lifecycle Description: Implement automated processes to delete data when retention periods expire. Verify deletion completeness.

Standards Coverage:

• GDPR Article 17. Right to erasure
• ISO 27001:2022 A.8.10. Information deletion
• APP 11 (Australia): Destruction requirements
• CCPA. Data deletion upon request

Implementation Type: Technical Evidence Needed:

• Automated deletion scripts (cron jobs, scheduled workers)
• Deletion logs and audit trails
• Verification of deletion completeness
• Backup deletion procedures

Priority: High Current Status: ✅ Implemented - Automated log rotation, ephemeral state expiration

UC-104: Data Anonymisation and Pseudonymisation

Domain: Data Lifecycle Description: Anonymise or pseudonymise personal data where possible to reduce privacy risks while enabling analytics and processing.

Standards Coverage:

• GDPR Article 25. Pseudonymisation as privacy measure
• ISO 27701:2019 Annex A 7.2.6. Minimising PII through pseudonymisation
• Privacy by Design Principle 2. Privacy as default

Implementation Type: Technical Evidence Needed:

• Anonymisation/pseudonymisation techniques
• Identifier replacement (random IDs instead of user IDs)
• Re-identification risk assessment
• Analytics on anonymised data

Priority: High Current Status: ✅ Implemented - Random verification IDs, no user tracking

UC-105: Data Portability

Domain: Data Lifecycle Description: Provide data portability allowing users to export their data in structured, commonly-used, machine-readable format.

Standards Coverage:

• GDPR Article 20. Right to data portability
• ISO 27701:2019 Annex A 7.3.5. Providing access and portability
• CCPA. Right to know and obtain copy of personal information

Implementation Type: Technical Evidence Needed:

• Data export functionality
• Structured data format (JSON, CSV, etc.)
• Export includes all user data
• Machine-readable format
• User authentication for exports

Priority: High Current Status: ✅ Implemented. Users hold credential data in wallet app; no server-side personal data requiring export

UC-106: Data Integrity and Validation

Domain: Data Lifecycle Description: Ensure data integrity through validation, checksums, and integrity monitoring. Detect unauthorised modifications.

Standards Coverage:

• ISO 27001:2022 A.8.15. Logging
• GDPR Article 5(1)(f). Integrity and confidentiality
• APP 10 (Australia): Data quality requirements
• CSA CCM DSP-11. Data integrity

Implementation Type: Technical Evidence Needed:

• Input validation
• Data integrity checks (cryptographic hashes, signatures)
• Immutable audit logs
• Integrity monitoring and alerting

Priority: High Current Status: ✅ Implemented - Cryptographic signatures, append-only logs

UC-107: Data Classification and Labelling

Domain: Data Lifecycle Description: Classify data according to sensitivity and apply appropriate handling, access, and retention controls.

Standards Coverage:

• ISO 27001:2022 A.5.8. Information classification
• CSA CCM DSP-12. Data classification
• GDPR. Implicit through special categories (Article 9)

Implementation Type: Administrative Evidence Needed:

• Data classification scheme (Public, Internal, Confidential, Restricted)
• Classification labels on documents and systems
• Handling procedures by classification
• Training on classification

Priority: High Current Status: ✅ Implemented - Classification scheme in ISMS

UC-108: Data Discovery and Inventory

Domain: Data Lifecycle Description: Maintain inventory of personal data including location, type, sensitivity, purpose, and access.

Standards Coverage:

• GDPR Article 30. Records of processing activities
• ISO 27701:2019. Data inventory requirements
• APP 1 (Australia): Understanding data flows

Implementation Type: Administrative Evidence Needed:

• Data inventory document
• Data flow diagrams
• Data location map (which systems hold what data)
• Data type catalogue
• Regular inventory updates

Priority: High Current Status: ✅ Implemented. Data flows documented in Architecture docs and ROPA; minimal personal data processing

UC-109: Ephemeral Data Handling

Domain: Data Lifecycle Description: Use ephemeral data (short-lived, auto-expiring) for temporary operations like challenges, nonces, and session tokens.

Standards Coverage:

• GDPR Article 5(1)(e). Storage limitation
• Privacy by Design Principle 5. End-to-end lifecycle protection
• ISO 27566-1. Minimal data retention in age verification

Implementation Type: Technical Evidence Needed:

• Ephemeral data types (challenges, nonces, tokens)
• Auto-expiration mechanisms (TTL in KV)
• No persistent storage of temporary data
• Immediate deletion after use

Priority: High Current Status: ✅ Implemented - Challenges auto-expire, nonces single-use

UC-110: Data Transfer Security

Domain: Data Lifecycle Description: Secure data transfers between systems, organisations, and jurisdictions using encryption and integrity protection.

Standards Coverage:

• ISO 27001:2022 A.8.10. Information transfer
• GDPR Article 32. Security of processing including transfer
• CSA CCM DSP-07. Cross-border transfers

Implementation Type: Technical Evidence Needed:

• TLS 1.3 for all transfers
• Encrypted backups
• Secure API authentication (HMAC)
• Transfer logs
• Data processing agreements

Priority: Critical Current Status: ✅ Implemented - TLS 1.3, encrypted transfers

UC-111: Data Access Logging

Domain: Data Lifecycle Description: Log all access to personal data including who accessed, when, what data, and purpose. Protect logs from tampering.

Standards Coverage:

• ISO 27001:2022 A.8.15. Logging
• GDPR Article 30. Records of processing
• ISO 27701:2019 Annex B 8.4.7. Logging PII access
• APP 1 (Australia): Accountability through logging

Implementation Type: Technical Evidence Needed:

• Access logs (KV access, API calls)
• Log retention (1 year minimum for GDPR)
• Log protection (append-only, access-controlled)
• Log review procedures
• Anomaly detection

Priority: High Current Status: ✅ Implemented - KV audit logs, Cloudflare Workers Logs (Grafana Loki)

UC-112: Data Breach Detection

Domain: Data Lifecycle Description: Implement mechanisms to detect unauthorised access, exfiltration, or modification of personal data.

Standards Coverage:

• GDPR Article 33. Breach notification (must detect within 72 hours)
• ISO 27001:2022 A.5.12. Incident management
• CCPA. Breach detection and notification
• CSA CCM SEF-01. Security incident detection

Implementation Type: Technical Evidence Needed:

• Intrusion detection systems
• Anomaly detection in access logs
• Data exfiltration monitoring
• Alerting on suspicious activity
• Security information and event management (SIEM)

Priority: Critical Current Status: 🔄 Partially Implemented. Cloudflare security monitoring; formal SIEM may be evaluated as operational scale increases

UC-113: Data Subject Access Request (DSAR) Handling

Domain: Data Lifecycle Description: Provide process for users to request access to their personal data. Respond within regulatory timelines (30 days GDPR, 45 days CCPA).

Standards Coverage:

• GDPR Article 15. Right of access by data subject
• ISO 27701:2019 Annex A 7.3.5. Providing access to PII
• CCPA. Right to know
• APP 12 (Australia): Access rights

Implementation Type: Administrative + Technical Evidence Needed:

• DSAR request form or API
• Identity verification for requests
• Request tracking system
• Response templates
• SLA compliance metrics (30-day response)

Priority: High Current Status: ✅ Implemented. DSARs handled via security@maelstrom.au; manual process appropriate for current scale

UC-114: Data Rectification Process

Domain: Data Lifecycle Description: Enable users to correct inaccurate or incomplete personal data. Update downstream systems promptly.

Standards Coverage:

• GDPR Article 16. Right to rectification
• ISO 27701:2019 Annex A 7.3.6. Correcting PII
• CCPA. Right to correct inaccurate information
• APP 13 (Australia): Correction rights

Implementation Type: Technical + Administrative Evidence Needed:

• Data correction interface or API
• Verification of correction requests
• Update propagation to all systems
• Correction logs
• Notification to third parties (if data was disclosed)

Priority: Medium Current Status: ✅ Implemented - Users control wallet data, can update credentials

UC-115: Data Erasure (Right to Be Forgotten)

Domain: Data Lifecycle Description: Provide mechanism for users to request deletion of their personal data. Verify complete erasure across all systems.

Standards Coverage:

• GDPR Article 17. Right to erasure (right to be forgotten)
• ISO 27701:2019 Annex A 7.3.5. Erasure capabilities
• CCPA. Right to delete
• APP 12 (Australia): Access and deletion

Implementation Type: Technical + Administrative Evidence Needed:

• Data deletion request process
• Complete deletion across all systems (production, backups, logs)
• Deletion verification and confirmation to user
• Exceptions handling (legal obligations)
• Deletion logs

Priority: High Current Status: ✅ Implemented. Minimal server-side PII (commitments only); erasure requests handled via email

UC-116: Data Restriction and Objection

Domain: Data Lifecycle Description: Allow users to restrict processing of their data or object to specific uses (e.g., direct marketing, profiling).

Standards Coverage:

• GDPR Article 18. Right to restriction of processing
• GDPR Article 21. Right to object
• ISO 27701:2019 Annex A 7.3.7. Objection to processing
• APP 7 (Australia): Direct marketing opt-out

Implementation Type: Technical + Administrative Evidence Needed:

• Processing restriction flags in systems
• Objection handling procedures
• Marketing suppression lists
• Preference management interface
• Restriction logs

Priority: Medium Current Status: ❌ Not Applicable. No direct marketing, profiling, or consent-dependent processing

UC-117: Data Accuracy Monitoring

Domain: Data Lifecycle Description: Regularly review and update personal data for accuracy. Implement validation at collection and update points.

Standards Coverage:

• GDPR Article 5(1)(d). Accuracy principle
• APP 10 (Australia): Data quality
• ISO 27701:2019. Ensuring PII accuracy

Implementation Type: Technical + Administrative Evidence Needed:

• Input validation rules
• Data quality monitoring
• Periodic data quality audits
• User notification of stale data
• Update prompts

Priority: Medium Current Status: ✅ Implemented - Date of birth validated at entry, credential expiration prompts update

UC-118: Data De-identification

Domain: Data Lifecycle Description: De-identify personal data for analytics, research, or long-term retention while mitigating re-identification risks.

Standards Coverage:

• GDPR. De-identified data no longer personal data
• APP 11 (Australia): De-identification alternative to deletion
• Privacy by Design Principle 2. Minimise identifiable information

Implementation Type: Technical Evidence Needed:

• De-identification techniques (aggregation, generalisation, perturbation)

• Re-identification risk assessment

• De-identified data governance

Priority: Medium Current Status: ✅ Implemented - Aggregated analytics, no individual tracking

UC-119: Data Lineage and Provenance

Domain: Data Lifecycle Description: Track data lineage showing origin, transformations, and movements of personal data through systems.

Standards Coverage:

• GDPR Article 30. Records of processing activities
• ISO 27701:2019. Data flow documentation
• CSA CCM DSP-13. Data lineage

Implementation Type: Administrative Evidence Needed:

• Data flow diagrams
• System integration documentation
• Processing activity records
• Data transformation logs
• Third-party data sharing documentation

Priority: Medium Current Status: ✅ Implemented. Data flows documented in Architecture docs and data-lifecycle-evidence

UC-120: Consent Withdrawal and Revocation

Domain: Data Lifecycle Description: Enable users to withdraw consent as easily as it was given. Stop processing and delete data when consent is withdrawn.

Standards Coverage:

• GDPR Article 7(3). Right to withdraw consent
• ISO 27701:2019 Annex A 7.3.4. Consent withdrawal
• APP 3 (Australia): Consent can be withdrawn
• CCPA. Opt-out mechanisms

Implementation Type: Technical + Administrative Evidence Needed:

• Consent withdrawal interface (same ease as granting)
• Processing cessation upon withdrawal
• Data deletion (if consent was sole legal basis)
• Withdrawal logs
• Notification to third parties

Priority: High Current Status: ❌ Not Applicable. Processing based on legitimate interest and contractual necessity, not consent; users can stop using the service at any time

UC-121: Data Residency and Localisation

Domain: Data Lifecycle Description: Store and process data in specific geographic locations to comply with data residency requirements and localisation laws.

Standards Coverage:

• GDPR. Data residency considerations for adequacy
• ISO 27701:2019 Annex A 7.2.7. Cross-border transfers
• Country-specific laws. Russia, China, etc. data localisation

Implementation Type: Technical + Administrative Evidence Needed:

• Data residency policies
• Cloudflare datacenter selection
• Data location documentation
• Customer choice of data regions
• Compliance with localisation laws

Priority: Low Current Status: ✅ Implemented - Cloudflare global network, customer can choose regions

UC-122: Data Backup and Recovery Testing

Domain: Data Lifecycle Description: Regularly test data backup and recovery procedures to ensure data can be restored within defined recovery objectives.

Standards Coverage:

• ISO 27001:2022 A.8.13. Information backup
• ISO 27001:2022 A.5.13. Business continuity
• CSA CCM BCR-02. Backup testing

Implementation Type: Technical + Administrative Evidence Needed:

• Backup testing schedule (quarterly minimum)
• Recovery testing results
• RPO/RTO achievement verification
• Test documentation and lessons learned
• Backup restoration procedures

Priority: High Current Status: 📋 Planned - Quarterly backup restoration testing

downpipes application: For the Cloudflare data layer this is already operational rather than planned. Maelstrom’s own production instance of downpipes proves recoverability continuously through hourly canary integrity flights and scheduled in-account restore drills (RPO under 1 hour, RTO under 4 hours), with restore-test recency and run success evidenced through the engine’s signed reports. See Cloudflare Backup Evidence.

Access & Identity Controls

UC-123: Identity Proofing and Verification

Domain: Access & Identity Description: Verify user identities with level of assurance appropriate to risk (IAL1, IAL2, IAL3). Collect and validate identity evidence.

Standards Coverage:

• NIST 800-63-3 IAL1/2/3. Identity assurance levels
• ISO 27566-1. Identity verification for credential issuance
• GDPR. Verification for data subject rights requests
• CCPA. Verification for consumer rights requests

Implementation Type: Technical + Administrative Evidence Needed:

• Identity proofing procedures (issuer-side)
• Identity evidence types (government ID, biometrics, vouching)
• Identity verification records
• Fraud detection in identity proofing
• Risk-based IAL selection

Priority: Critical Current Status: ✅ Implemented - Issuer identity proofing (IAL2/3)

UC-124: Authenticator Management

Domain: Access & Identity Description: Manage authenticators (passwords, tokens, biometrics) according to assurance level requirements. Support multiple authenticator types.

Standards Coverage:

• NIST 800-63-3 AAL1/2/3. Authenticator assurance levels
• ISO 27001:2022 A.8.5. Secure authentication
• CSA CCM IAM-06. Authenticator management

Implementation Type: Technical Evidence Needed:

• Supported authenticator types
• Authenticator lifecycle management
• Binding of authenticators to accounts
• Authenticator strength by AAL level
• Lost/compromised authenticator procedures

Priority: High Current Status: ✅ Implemented - Password managers, MFA for admin access

UC-125: Session Management

Domain: Access & Identity Description: Securely manage user sessions with timeouts, re-authentication for sensitive operations, and session termination.

Standards Coverage:

• ISO 27001:2022 A.8.5. Secure authentication
• NIST 800-63-3. Session management requirements
• OWASP ASVS. Session management controls

Implementation Type: Technical Evidence Needed:

• Session timeout configuration (15 minutes idle)
• Re-authentication for privilege elevation
• Secure session token generation
• Session termination on logout
• Concurrent session limits

Priority: High Current Status: ✅ Implemented - Screen locks, session management in APIs

UC-126: Federation and Single Sign-On (SSO)

Domain: Access & Identity Description: Support federated authentication and SSO using standard protocols (OAuth 2.0, OpenID Connect, SAML).

Standards Coverage:

• NIST 800-63-3 FAL1/2/3. Federation assurance levels
• OpenID Connect. Authentication protocol
• SAML 2.0. Federation protocol
• CSA CCM IAM-07. Federation

Implementation Type: Technical Evidence Needed:

• SSO protocol implementation (OpenID Connect)
• Federation trust agreements
• Assertion protection (signatures, encryption)
• Attribute release policies
• Single logout support

Priority: Medium Current Status: 🔄 Deferred. May implement OpenID Connect based on customer requirements

UC-127: Biometric Authentication

Domain: Access & Identity Description: Implement biometric authentication with liveness detection, secure storage, and privacy protections (templates, not raw biometrics).

Standards Coverage:

• NIST 800-63-3 AAL3. Biometric authenticators
• ISO/IEC 24745. Biometric information protection
• GDPR Article 9. Biometric data as special category
• ISO 27566-1. Biometric age estimation

Implementation Type: Technical Evidence Needed:

• Biometric modality (fingerprint, face, iris)
• Liveness detection implementation
• Template storage (not raw biometrics)
• On-device biometric processing (where possible)
• Biometric privacy impact assessment

Priority: Low Current Status: ❌ Not Applicable. No biometric authentication in issuance; wallet uses device biometrics (passkeys/FaceID) managed by OS

UC-128: Access Reviews and Recertification

Domain: Access & Identity Description: Regularly review user access rights and recertify appropriateness. Remove unnecessary access.

Standards Coverage:

• ISO 27001:2022 A.5.18. Access rights
• SOC 2. User access reviews
• CSA CCM IAM-08. Access reviews

Implementation Type: Administrative Evidence Needed:

• Access review schedule (quarterly)
• Access review reports
• Access revocation records
• Role-based access reviews
• Privileged access reviews

Priority: High Current Status: ✅ Implemented - Quarterly access reviews in ISMS

UC-129: Just-In-Time (JIT) Access

Domain: Access & Identity Description: Implement just-in-time privileged access with time-limited elevation, approval workflows, and automatic de-elevation.

Standards Coverage:

• ISO 27001:2022 A.8.2. Privileged access rights
• CSA CCM IAM-09. Privileged access controls
• Zero Trust. Least privilege and JIT access

Implementation Type: Technical Evidence Needed:

• JIT access request workflow
• Time-limited privilege elevation
• Approval and audit logs
• Automatic privilege revocation
• Break-glass procedures for emergencies

Priority: Medium Current Status: 🔄 Deferred. Sole operator; JIT access will be implemented when team grows

UC-130: Identity Lifecycle Management

Domain: Access & Identity Description: Manage complete identity lifecycle from provisioning through updates to deprovisioning. Automate where possible.

Standards Coverage:

• ISO 27001:2022 A.5.9. Access control lifecycle
• CSA CCM IAM-10. Identity lifecycle
• NIST CSF. Identify and protect

Implementation Type: Administrative + Technical Evidence Needed:

• Onboarding procedures (identity creation)
• Role change procedures
• Offboarding procedures (access revocation)
• Automated provisioning/deprovisioning (where applicable)
• Lifecycle audit trails

Priority: High Current Status: ✅ Implemented - Onboarding/offboarding procedures

UC-131: Credential Binding and Verification

Domain: Access & Identity Description: Securely bind credentials to users. Verify credential authenticity and integrity before relying on them.

Standards Coverage:

• NIST 800-63-3. Credential binding and verification
• W3C Verifiable Credentials. Credential verification
• ISO 27566-1. Age credential verification

Implementation Type: Technical Evidence Needed:

• Cryptographic binding of credentials to users
• Signature verification (RedJubjub)
• Issuer verification key registry (JWKS)
• Credential revocation checking
• Proof of possession

Priority: Critical Current Status: ✅ Implemented - Cryptographic credential binding and verification

UC-132: Account Recovery and Reset

Domain: Access & Identity Description: Provide secure account recovery mechanisms resistant to social engineering and account takeover.

Standards Coverage:

• NIST 800-63-3. Account recovery guidance
• ISO 27001:2022. Password reset procedures
• OWASP ASVS. Account recovery controls

Implementation Type: Technical + Administrative Evidence Needed:

• Account recovery procedures
• Multi-factor recovery verification
• Recovery contact verification (email, phone)
• Account lockout after failed attempts
• Recovery audit logs

Priority: High Current Status: 🔄 Partially Implemented - Standard password reset, enhanced recovery needed

UC-133: Zero Trust Architecture

Domain: Access & Identity Description: Implement zero trust principles: never trust, always verify. Require continuous authentication and authorisation.

Standards Coverage:

• NIST SP 800-207. Zero Trust Architecture
• CSA. Zero trust cloud security
• ISO 27001:2022. Implicit through access controls

Implementation Type: Technical + Administrative Evidence Needed:

• Micro-segmentation (environment separation)
• Per-request authentication and authorisation
• No implicit trust based on network location
• Continuous monitoring and verification
• Zero trust architecture documentation

Priority: Medium Current Status: ✅ Implemented - API authentication per request, no network trust

UC-134: Service Account Management

Domain: Access & Identity Description: Secure service accounts and API credentials with rotation, minimal permissions, and monitoring.

Standards Coverage:

• ISO 27001:2022 A.8.2. Secure authentication
• CSA CCM IAM-11. Service account management
• NIST CSF. Protect function

Implementation Type: Technical + Administrative Evidence Needed:

• Service account inventory
• API token scoping (minimal permissions)
• Credential rotation schedule
• Service account activity monitoring
• No hardcoded credentials

Priority: High Current Status: ✅ Implemented - Scoped API tokens, no hardcoded credentials

UC-135: Authorisation Policy Management

Domain: Access & Identity Description: Implement centralised authorisation policy management with role-based or attribute-based access control (RBAC/ABAC).

Standards Coverage:

• ISO 27001:2022 A.8.3. Information access restriction
• CSA CCM IAM-12. Authorisation management
• NIST. RBAC/ABAC guidance

Implementation Type: Technical Evidence Needed:

• Authorisation policy definitions
• RBAC roles and permissions
• ABAC attributes and rules
• Policy enforcement points
• Authorisation audit logs

Priority: High Current Status: ✅ Implemented - RBAC for GitHub/Cloudflare, API access control

UC-136: Anomaly Detection for Access

Domain: Access & Identity Description: Detect anomalous access patterns (unusual location, time, volume) and trigger alerts or additional verification.

Standards Coverage:

• NIST 800-63-3. Risk-based authentication
• CSA CCM IAM-13. Anomaly detection
• GDPR Article 32. Security monitoring

Implementation Type: Technical Evidence Needed:

• Behavioural analytics for access patterns
• Geographic/time-based anomaly detection
• Risk scoring for access attempts
• Automated alerts and response
• Adaptive authentication

Priority: Medium Current Status: 🔄 Deferred. May implement alongside SIEM evaluation as operational scale increases

UC-137: API Security and Authentication

Domain: Access & Identity Description: Secure APIs with strong authentication (API keys, HMAC, OAuth), rate limiting, and input validation.

Standards Coverage:

• OWASP API Security Top 10. API security best practices
• ISO 27001:2022 A.8.5. Secure authentication
• CSA CCM AIS-04. API security

Implementation Type: Technical Evidence Needed:

• API authentication mechanism (HMAC-SHA256)
• API key management and rotation
• Rate limiting (per-client, per-endpoint)
• Input validation and sanitisation
• API security testing

Priority: Critical Current Status: ✅ Implemented - HMAC authentication, rate limiting

UC-138: Directory Services Security

Domain: Access & Identity Description: Secure directory services (LDAP, Active Directory) used for identity and access management.

Standards Coverage:

• ISO 27001:2022 A.8.2. Secure authentication
• CSA CCM IAM-14. Directory services
• NIST. Directory services security

Implementation Type: Technical Evidence Needed:

• Directory service hardening
• Encrypted connections (LDAPS)
• Directory access controls
• Directory replication security
• Directory monitoring

Priority: Low Current Status: ❌ Not Applicable - No enterprise directory services

UC-139: Identity Governance and Administration (IGA)

Domain: Access & Identity Description: Implement identity governance including access request workflows, approval processes, and compliance reporting.

Standards Coverage:

• ISO 27001:2022 A.5.9. Access control
• SOC 2. Access provisioning controls
• CSA CCM IAM-15. Identity governance

Implementation Type: Administrative + Technical Evidence Needed:

• Access request and approval workflows
• Segregation of duties enforcement
• Access certification campaigns
• Compliance reporting (who has access to what)
• IGA tool or process

Priority: Medium Current Status: 🔄 Deferred. Sole operator; formal IGA process will be implemented when team grows

UC-140: Credential Theft Prevention

Domain: Access & Identity Description: Prevent credential theft through phishing-resistant authentication, security awareness, and credential monitoring.

Standards Coverage:

• NIST 800-63-3 AAL3. Phishing-resistant authenticators
• ISO 27001:2022 A.6.3. Security awareness
• CSA CCM IAM-16. Credential protection

Implementation Type: Technical + Administrative Evidence Needed:

• Phishing-resistant authentication (FIDO2, WebAuthn)
• Security awareness training
• Credential leak monitoring (Have I Been Pwned)
• Password breach detection
• MFA enforcement

Priority: High Current Status: ✅ Implemented - MFA, security awareness training

Development & Operations Controls

UC-141: Secure Coding Standards

Domain: Development & Operations Description: Establish and enforce secure coding standards covering input validation, output encoding, error handling, and common vulnerabilities.

Standards Coverage:

• ISO 27001:2022 A.8.25. Secure development life cycle
• OWASP ASVS. Secure coding requirements
• CSA CCM AIS-05. Secure coding practices

Implementation Type: Administrative + Technical Evidence Needed:

• Secure coding guidelines document
• Code review checklists
• OWASP Top 10 mitigation
• Language-specific security patterns (Rust, TypeScript)
• Developer training on secure coding

Priority: High Current Status: ✅ Implemented - Rust memory safety, code review standards

UC-142: Static Application Security Testing (SAST)

Domain: Development & Operations Description: Implement automated static code analysis to detect security vulnerabilities before deployment.

Standards Coverage:

• ISO 27001:2022 A.8.29. Security testing in development and acceptance
• CSA CCM AIS-06. Static analysis
• NIST. Secure SDLC practices

Implementation Type: Technical Evidence Needed:

• SAST tools (CodeQL, clippy, ESLint)
• CI/CD integration
• Vulnerability findings and remediation
• False positive management
• SAST coverage metrics

Priority: High Current Status: ✅ Implemented - CodeQL, clippy, ESLint in CI/CD

UC-143: Dynamic Application Security Testing (DAST)

Domain: Development & Operations Description: Perform automated security testing against running applications to identify runtime vulnerabilities.

Standards Coverage:

• ISO 27001:2022 A.8.29. Security testing in development and acceptance
• CSA CCM AIS-07. Dynamic analysis
• OWASP. DAST best practices

Implementation Type: Technical Evidence Needed:

• DAST tools (Zap, Burp)
• Vulnerability scan results
• Remediation tracking
• Scan frequency (per release)
• DAST in staging environment

Priority: Medium Current Status: 🔄 Deferred. May evaluate DAST tooling as security testing maturity develops

UC-144: Software Composition Analysis (SCA)

Domain: Development & Operations Description: Continuously scan dependencies for known vulnerabilities. Track and update vulnerable libraries.

Standards Coverage:

• ISO 27001:2022 A.8.30. Outsourced development
• CSA CCM STA-02. Software composition analysis
• NIST. Supply chain security

Implementation Type: Technical Evidence Needed:

• SCA tools (cargo audit, npm audit, GitHub Dependabot)
• Dependency vulnerability reports
• Remediation SLAs by severity
• Dependency update tracking
• Licence compliance

Priority: Critical Current Status: ✅ Implemented - cargo audit, npm audit, GitHub Security Alerts

UC-145: Secrets Management

Domain: Development & Operations Description: Securely manage secrets (API keys, credentials, encryption keys) with rotation, access control, and audit logging.

Standards Coverage:

• ISO 27001:2022 A.8.24. Use of cryptography
• ISO 27001:2022 A.5.17. Authentication information
• CSA CCM EKM-07. Secrets management

Implementation Type: Technical + Administrative Evidence Needed:

• Secrets management solution (Cloudflare KV, secrets)
• No secrets in source code or logs
• Secrets rotation procedures
• Secrets access audit logs
• Secrets scanning in CI/CD

Priority: Critical Current Status: ✅ Implemented - Secrets in Cloudflare KV, never in code

UC-146: Container and Orchestration Security

Domain: Development & Operations Description: Secure containers and orchestration platforms with image scanning, runtime protection, and network policies.

Standards Coverage:

• ISO 27001:2022 A.8.22. Segregation of networks
• CSA CCM IVS-02. Container security
• CIS Benchmarks. Container security

Implementation Type: Technical Evidence Needed:

• Container image scanning
• Base image security (minimal, patched)
• Runtime security monitoring
• Network policies and segmentation
• Container orchestration hardening

Priority: Low Current Status: ❌ Not Applicable - Serverless (Cloudflare Workers), no containers

UC-147: Infrastructure as Code (IaC) Security

Domain: Development & Operations Description: Secure infrastructure as code with version control, code review, security scanning, and testing.

Standards Coverage:

• ISO 27001:2022 A.8.32. Change management
• CSA CCM CCC-02. Infrastructure as code
• DevSecOps. IaC security practices

Implementation Type: Technical + Administrative Evidence Needed:

• IaC in version control (Git)
• IaC security scanning (terraform scan, wrangler.toml review)
• Code review for infrastructure changes
• IaC testing (validation, dry-runs)
• IaC documentation

Priority: High Current Status: ✅ Implemented - wrangler.toml in Git, reviewed changes

UC-148: CI/CD Pipeline Security

Domain: Development & Operations Description: Secure CI/CD pipelines with authentication, access control, artefact signing, and audit logging.

Standards Coverage:

• ISO 27001:2022 A.8.6. Change management
• SLSA. Supply chain levels for software artifacts
• CSA CCM CCC-03. CI/CD security

Implementation Type: Technical Evidence Needed:

• Pipeline access controls (GitHub Actions permissions)
• Artefact signing and provenance (SLSA Level 3)
• Secrets management in pipelines
• Pipeline audit logs
• Pipeline security scanning

Priority: Critical Current Status: ✅ Implemented - SLSA Level 3, signed artefacts, access controls

downpipes application: Maelstrom operates the downpipes release pipeline and the static, signature-pinned update channel (updates.downpipes.io, an R2 bucket). Engine updates are pulled, never pushed: the engine verifies each update’s signature against a pinned public key before applying, with canary-gated safe-apply and automatic rollback, and no phone-home. The Update Signer is held offline by the operator and is never deployed to any Worker, keeping the signing key off the production attack surface.

UC-149: Immutable Infrastructure

Domain: Development & Operations Description: Deploy immutable infrastructure where changes require redeployment rather than modification. Enhance security and reproducibility.

Standards Coverage:

• DevOps. Immutable infrastructure pattern
• ISO 27001:2022 A.8.19. Installation of software on operational systems
• CSA CCM. Infrastructure security

Implementation Type: Technical Evidence Needed:

• Immutable deployment model (serverless Workers)
• No runtime modifications to production
• Version-controlled deployments
• Rollback capabilities
• Deployment artefacts and provenance

Priority: High Current Status: ✅ Implemented - Serverless Workers (immutable)

downpipes application: The downpipes engine is a routeless, in-tenant Cloudflare Worker deployed in the customer’s own account; it is immutable in the same way and is changed only by redeployment through the signature-pinned update channel (pulled, signature-verified, canary-gated with automatic rollback). The vendor-operated control-plane and update channel are likewise serverless and version-controlled.

UC-150: Dependency Management and Pinning

Domain: Development & Operations Description: Pin dependency versions, use lock files, and control dependency updates through testing and review.

Standards Coverage:

• ISO 27001:2022 A.8.30. Outsourced development
• SLSA. Hermetic builds
• CSA CCM STA-03. Dependency management

Implementation Type: Technical Evidence Needed:

• Dependency lock files (Cargo.lock, package-lock.json)
• Pinned versions in manifests
• Controlled dependency updates
• Dependency testing before merge
• Hermetic builds

Priority: High Current Status: ✅ Implemented - Lock files, hermetic builds

UC-151: Environment Parity

Domain: Development & Operations Description: Maintain parity between development, staging, and production environments to reduce deployment risks.

Standards Coverage:

• 12-Factor App. Dev/prod parity
• ISO 27001:2022 A.8.31. Separation of development, test and production environments
• DevOps. Environment consistency

Implementation Type: Technical + Administrative Evidence Needed:

• Environment configuration management
• Similar infrastructure across environments
• Parity testing
• Configuration drift detection
• Environment-specific secrets only

Priority: Medium Current Status: ✅ Implemented - wrangler dev mirrors production, separate secrets

UC-152: Feature Flags and Rollout Control

Domain: Development & Operations Description: Use feature flags to control rollout of new features. Enable gradual rollout, A/B testing, and quick rollback.

Standards Coverage:

• ISO 27001:2022 A.8.32. Change management
• DevOps. Continuous delivery practices
• SRE. Safe rollouts

Implementation Type: Technical Evidence Needed:

• Feature flag system
• Gradual rollout procedures
• Rollback capabilities
• Feature flag audit logs
• User segmentation for flags

Priority: Medium Current Status: 🔄 Deferred. Sole operator deploys via CI/CD; feature flags may be implemented if team grows

UC-153: Logging and Observability

Domain: Development & Operations Description: Implement logging, metrics, and tracing for security, debugging, and performance monitoring.

Standards Coverage:

• ISO 27001:2022 A.8.8. Logging and monitoring
• CSA CCM LOG-03. Observability
• SRE. Observability practices

Implementation Type: Technical Evidence Needed:

• Structured logging implementation
• Metrics collection (Cloudflare Workers Logs shipped to Grafana Loki)
• Distributed tracing (where applicable)
• Log aggregation and search
• Dashboards and alerting

Priority: High Current Status: ✅ Implemented - Structured logging, Cloudflare Workers Logs (Grafana Loki)

UC-154: Error Handling and Logging

Domain: Development & Operations Description: Implement secure error handling that prevents information leakage while logging sufficient detail for debugging.

Standards Coverage:

• OWASP ASVS. Error handling requirements
• ISO 27001:2022 A.8.12. Data leakage prevention
• CSA CCM. Secure error handling

Implementation Type: Technical Evidence Needed:

• Generic error messages to users
• Detailed errors logged server-side
• No stack traces in production
• No secrets in error messages
• Error monitoring and alerting

Priority: High Current Status: ✅ Implemented - Generic errors to users, detailed logs server-side

UC-155: API Versioning and Deprecation

Domain: Development & Operations Description: Implement API versioning strategy with clear deprecation policies and migration support.

Standards Coverage:

• ISO 27001:2022 A.8.6. Change management
• API Design. Versioning best practices
• DevOps. Backward compatibility

Implementation Type: Administrative + Technical Evidence Needed:

• API versioning scheme (URL or header)
• Deprecation policy and timeline
• Backward compatibility testing
• Client migration guidance
• Version sunset notifications

Priority: Medium Current Status: 📋 Planned - API versioning strategy

UC-156: Rate Limiting and Throttling

Domain: Development & Operations Description: Implement rate limiting to prevent abuse, DoS attacks, and resource exhaustion.

Standards Coverage:

• ISO 27001:2022 A.8.6. Capacity management
• OWASP API Security. Rate limiting
• CSA CCM. Abuse prevention

Implementation Type: Technical Evidence Needed:

• Rate limiting rules (per-client, per-endpoint)
• Cloudflare rate limiting configuration
• Abuse detection and blocking
• Rate limit headers (X-RateLimit-*)
• Graceful degradation

Priority: High Current Status: ✅ Implemented - Cloudflare rate limiting

UC-157: Input Validation and Sanitisation

Domain: Development & Operations Description: Validate and sanitise all inputs to prevent injection attacks, XSS, and data corruption.

Standards Coverage:

• OWASP Top 10. Injection prevention
• ISO 27001:2022 A.8.25. Secure development life cycle
• CSA CCM AIS-08. Input validation

Implementation Type: Technical Evidence Needed:

• Input validation rules
• Whitelisting over blacklisting
• Type safety (Rust, TypeScript)
• Sanitisation for output contexts
• Parameterized queries (if using SQL)

Priority: Critical Current Status: ✅ Implemented - Strong typing, input validation

UC-158: Output Encoding and Escaping

Domain: Development & Operations Description: Encode outputs appropriately for context (HTML, JavaScript, URL, SQL) to prevent injection attacks.

Standards Coverage:

• OWASP. XSS prevention
• ISO 27001:2022 A.8.25. Secure development life cycle
• CSA CCM AIS-09. Output encoding

Implementation Type: Technical Evidence Needed:

• Context-aware output encoding
• HTML escaping in templates
• JSON encoding for APIs
• URL encoding where needed
• Content Security Policy (CSP)

Priority: High Current Status: ✅ Implemented - Template escaping, JSON APIs

UC-159: Penetration Testing

Domain: Development & Operations Description: Conduct regular penetration testing by qualified security professionals. Remediate findings promptly.

Standards Coverage:

• ISO 27001:2022 A.5.35. Independent review of information security
• PCI DSS. Annual penetration testing
• CSA CCM. Penetration testing
• GDPR Article 32. Regular testing and evaluation

Implementation Type: Administrative Evidence Needed:

• Penetration testing schedule (annual minimum)
• Penetration testing reports
• Tester qualifications
• Remediation tracking
• Re-testing of fixed vulnerabilities

Priority: High Current Status: 📋 Planned - Annual penetration testing (2025)

UC-160: Bug Bounty Program

Domain: Development & Operations Description: Establish bug bounty program to incentivise security researchers to report vulnerabilities responsibly.

Standards Coverage:

• ISO 27001:2022 A.6.8. Information security event reporting
• Best Practices. Coordinated vulnerability disclosure
• CSA CCM. Vulnerability disclosure

Implementation Type: Administrative Evidence Needed:

• Bug bounty program policy
• Platform (HackerOne, Bugcrowd, etc.) or self-hosted
• Reward structure
• Response SLAs
• Vulnerability disclosure timeline

Priority: Medium Current Status: ❌ Not Applicable. Responsible disclosure via security@maelstrom.au; no formal bug bounty programme

UC-161: Deployment Automation and Repeatability

Domain: Development & Operations Description: Automate deployments for consistency, repeatability, and auditability. Minimise manual intervention.

Standards Coverage:

• ISO 27001:2022 A.8.32. Change management
• DevOps. Automation principles
• CSA CCM CCC-04. Deployment automation

Implementation Type: Technical Evidence Needed:

• Automated deployment pipelines (GitHub Actions)
• Deployment scripts and procedures
• No manual production changes
• Deployment audit logs
• Rollback automation

Priority: High Current Status: ✅ Implemented - CI/CD automated deployments

UC-162: Production Access Controls

Domain: Development & Operations Description: Strictly control production access. Require approval, MFA, and logging for production activities.

Standards Coverage:

• ISO 27001:2022 A.8.2. Privileged access rights
• SOC 2. Production access controls
• CSA CCM IAM-17. Production access

Implementation Type: Administrative + Technical Evidence Needed:

• Production access policy (limited, approved only)

• MFA required for production

• Production access logs

• No direct database access (API only)

Priority: Critical Current Status: ✅ Implemented - Limited production access, MFA, audit logs

UC-163: Chaos Engineering and Resilience Testing

Domain: Development & Operations Description: Conduct chaos engineering experiments to test system resilience under failure conditions.

Standards Coverage:

• SRE. Chaos engineering practices
• ISO 27001:2022 A.5.13. Business continuity testing
• CSA CCM. Resilience testing

Implementation Type: Technical Evidence Needed:

• Chaos engineering experiments
• Failure injection testing
• Resilience improvement tracking
• Game day exercises
• Incident response readiness

Priority: Low Current Status: ❌ Not Applicable. Cloudflare Workers serverless architecture; resilience tested via BCP tabletop exercises

UC-164: Technical Debt Management

Domain: Development & Operations Description: Track and prioritise technical debt including security debt. Allocate time for remediation.

Standards Coverage:

• ISO 27001:2022 A.8.27. Secure system architecture and engineering principles
• DevOps. Sustainable development practices
• Agile. Technical debt management

Implementation Type: Administrative Evidence Needed:

• Technical debt register
• Security debt prioritisation
• Remediation roadmap
• Time allocation for debt reduction
• Debt metrics and trends

Priority: Medium Current Status: 🔄 Partially Implemented. Technical debt tracked informally via Technical Debt Policy; will formalise as team grows

UC-186: Sandbox Environment Isolation (Build, CI, Runtime)

Domain: Development & Operations Description: Enforce isolation of the docs interactive sandbox from production code paths through a defence-in-depth chain: a Cargo feature flag gates sandbox-only modules at compile time, a CI bundle-grep step fails the build if any sandbox symbol reaches a production artefact, and request-middleware prefix rejection refuses sandbox paths at the production ingress. The three layers are independent so that a failure of any one does not collapse the isolation boundary.

Placement note: UC-186 is numerically out of sequence with the UC-141 to UC-164 Development & Operations range. Existing UC-IDs are preserved verbatim to avoid renumbering evidence artefacts and SOA cross-references; the new control takes the next available ID after UC-185.

Standards Coverage:

• ISO 27001:2022 A.8.25. Secure development life cycle. compile-time feature flag and CI bundle-grep operate as engineering controls inside the secure SDLC
• ISO 27001:2022 A.8.31. Separation of development, test and production environments. middleware prefix rejection at the production ingress enforces the separation boundary at runtime
• CSA CCM IVS-01. Infrastructure and virtualisation. environment separation
• OWASP ASVS V14. Configuration and environment separation

Implementation Type: Technical

Control Layers:

1. Compile-time isolation via Cargo feature flag

• docs-sandbox feature flag declared in the relevant workspace Cargo.toml
• Sandbox-only modules (fixture issuer, synthetic attestation stamping, sandbox-scoped routes) are gated by #[cfg(feature = "docs-sandbox")]
• Production builds omit the feature flag; the sandbox code is excluded from the resulting binary entirely
• Workspace resolver hygiene: no transitive dependency re-enables the flag on production crates (risk tracked as RISK-2026-DOCS-H03)

2. CI bundle-grep gate

• CI job scans the production artefact for strings that must not appear: sandbox module names, fixture issuer identity, synthetic: true stamp emitter, sandbox route prefixes
• Any hit fails the build before the artefact can be promoted
• Runs on every PR targeting main and on every tagged release build

3. Runtime middleware prefix rejection

• Production provii-verifier middleware (including hosted mode routes) rejects request paths carrying the sandbox prefix (for example /sandbox/) with a 404 before the router is consulted
• Production provii-verifier refuses the sandbox issuer identity at signature verification time (see COPPA Safe Harbor synthetic-only posture)
• Rejection happens at the edge of the Worker, so no sandbox code path can be reached even if an isolation layer above it fails open

Evidence Needed:

• Cargo.toml feature flag declaration and #[cfg] gating in sandbox modules
• CI workflow YAML for the bundle-grep job (expected to live in the relevant repo’s .github/workflows/)
• Middleware source implementing the prefix rejection (provii-verifier, including hosted mode routes)
• Test fixtures demonstrating production build rejects sandbox issuer identity
• Link to Docs Sandbox DPIA and DPIA Children’s Code Standard 2 for the risk context the control mitigates

Risk Register Cross-References:

UC-186 is the primary mitigator for:

• RISK-2026-DOCS-H03 (sandbox feature flag hygiene under Rust workspace resolver). UC-186 layer 1 (Cargo feature flag) and layer 3 (CI bundle-grep) are the core controls.
• RISK-2026-DOCS-M04 (handler blast radius on shared Worker). UC-186 layer 4 (runtime middleware prefix rejection) and the narrowed DocsEnv binding provide the isolation boundary.

UC-186 provides partial coverage for:

• RISK-2026-DOCS-H01 (bearer token XSS via Scalar supply chain). UC-186 layer 4 reduces cross-surface blast radius if a token were to be stolen; primary mitigators are CSP, SRI, and __Host- cookie scoping tracked under separate SOA controls.
• RISK-2026-DOCS-H02 (DOCS_SESSION_HMAC_KEY leak forges sessions across developer fleet). UC-186 layer 4 is designed to ensure a forged session cannot reach production endpoints; primary mitigators are Secrets Store storage and kid-prefixed rotation.
• RISK-2026-DOCS-M01 (shared sandbox attestation replay across sessions). UC-186 layer 4 blocks any attempt to replay a sandbox attestation against production; primary mitigators are session-bound attestation and nonce TTL.
• RISK-2026-DOCS-M02 (Bot Fight Mode passive bypass by patient bot farm). UC-186 layer 4 is designed to keep abuse scoped to the sandbox surface; primary mitigators are Cloudflare managed challenge and rate limits.
• RISK-2026-DOCS-M03 (mobile sandbox abuse at scale via residential proxies). UC-186 layer 4 rejects any mwallet-sbx-* attempt against production ingress; primary mitigators are 7-day install TTL and per-install rate limits.
• RISK-2026-DOCS-M05 (Scalar supply chain compromise via npm). UC-186 layer 4 is designed to prevent a compromised Scalar bundle from reaching production by rejecting sandbox prefixes at the production edge; primary mitigators are npm audit, Dependabot, CSP, and SRI.

UC-186 does not cover:

• RISK-2026-DOCS-L01 (cross-border transfer of developer pseudonymous identifiers to Cloudflare global edge). Covered by SCCs, UK IDTA, and the transfer impact assessment in ROPA Section 4. Not an isolation control.

Priority: Critical

Current Status: 🔄 Planned. Control defined as part of docs sandbox Phase 0A uplift; implementation to follow under the DX docs sandbox delivery workstream. Compile-time gating and middleware rejection are preventive-by-design; the CI bundle-grep gate provides the detective layer.

Business Continuity Controls

UC-165: Business Impact Analysis (BIA)

Domain: Business Continuity Description: Conduct business impact analysis to identify critical business functions and their recovery requirements.

Standards Coverage:

• ISO 27001:2022 A.5.13. Business continuity management
• ISO 22301. Business continuity management systems
• CSA CCM BCR-04. Business impact analysis

Implementation Type: Administrative Evidence Needed:

• BIA document
• Critical business functions identified
• RTOs and RPOs defined
• Impact assessment (financial, reputational, regulatory)
• Dependency mapping

Priority: High Current Status: ✅ Implemented - BIA in Business Continuity Plan

UC-166: Disaster Recovery Plan (DRP)

Domain: Business Continuity Description: Establish disaster recovery plan with procedures to restore systems and data after major disruptions.

Standards Coverage:

• ISO 27001:2022 A.5.13. Business continuity
• CSA CCM BCR-05. Disaster recovery
• NIST. Disaster recovery planning

Implementation Type: Administrative + Technical Evidence Needed:

• DRP document
• Recovery procedures by scenario
• Backup and restore procedures
• Disaster declaration criteria
• DRP testing results

Priority: High Current Status: ✅ Implemented - DRP in Business Continuity Plan

downpipes application: For the Cloudflare data layer the restore procedure is downpipes: scheduled, verified backups to operator-controlled destinations, with recovery provable from archive bytes plus the offline key alone via the MIT offline reader. The same product and recovery path are offered to customers. See Cloudflare Backup Evidence.

UC-167: High Availability Architecture

Domain: Business Continuity Description: Design systems for high availability with redundancy, failover, and geographic distribution.

Standards Coverage:

• ISO 27001:2022 A.8.14. Redundancy of information processing facilities
• CSA CCM BCR-06. High availability
• SRE. Availability targets

Implementation Type: Technical Evidence Needed:

• HA architecture design (Cloudflare 300+ PoPs)
• Redundancy implementation
• Automatic failover mechanisms
• Load balancing
• Availability monitoring and SLA (99.9%+)

Priority: Critical Current Status: ✅ Implemented - Cloudflare global distribution, auto-failover

UC-168: Data Backup Procedures

Domain: Business Continuity Description: Implement regular, automated backups of critical data with off-site storage and encryption.

Standards Coverage:

• ISO 27001:2022 A.8.13. Information backup
• CSA CCM BCR-07. Data backup
• GDPR Article 32. Ability to restore availability

Implementation Type: Technical Evidence Needed:

• Backup schedule and automation
• Off-site backup storage
• Backup encryption
• Full backups at multiple frequencies (hourly, daily, weekly)
• Immutable backups (ransomware protection)

Priority: Critical Current Status: ✅ Implemented - Maelstrom’s entire Cloudflare estate is backed up by our own production instance of downpipes (we run downpipes as a customer of our own product)

Implementation Evidence:

• Cloudflare Backup Evidence
• Scheduled, verified backups of Workers KV, D1, R2, Secrets Store, and 51 zone/account configuration surfaces
• Off-account storage: 3-2-1 fan-out to two or more independent, Maelstrom-controlled destinations
• Encryption: post-quantum hybrid, sealed under operator-held keys (no-custody)
• Recoverability proven by hourly canary integrity flights and scheduled in-account restore drills (ransomware-resistant: archives are write-once to customer-controlled storage and verifiable offline)
• RPO: under 1 hour, RTO: under 4 hours
• Closes GAP-H006

downpipes application: In a customer deployment downpipes performs the same scheduled, verified, encrypted off-account backups in the customer’s own Cloudflare account, under the customer’s own keys (no-custody). Archives are sealed with post-quantum hybrid encryption and fanned out 3-2-1 to two or more customer-controlled destinations; recovery is provable from archive bytes plus the customer’s offline key alone via the MIT offline reader, built from a frozen public format specification.

UC-169: Recovery Time and Point Objectives

Domain: Business Continuity Description: Define and achieve Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical systems.

Standards Coverage:

• ISO 27001:2022 A.5.13. Business continuity
• ISO 22301. RTO/RPO requirements
• CSA CCM BCR-08. Recovery objectives

Implementation Type: Administrative + Technical Evidence Needed:

• RTO/RPO definitions per system
• RTO achievement evidence (failover testing)
• RPO achievement evidence (backup frequency)
• Gap analysis and remediation
• Executive approval of objectives

Priority: High Current Status: ✅ Implemented - RTO: 1 hour, RPO: 24 hours (documented in BCP)

UC-170: Incident Communication Plan

Domain: Business Continuity Description: Establish communication procedures for incidents including internal notifications, customer communications, and status pages.

Standards Coverage:

• ISO 27001:2022 A.5.12. Incident management
• CSA CCM SEF-06. Incident communication
• Best Practices. Transparency during incidents

Implementation Type: Administrative + Technical Evidence Needed:

• Communication plan document
• Escalation contact lists
• Customer notification templates
• Status page (status.provii.app)
• Communication logs during incidents

Priority: High Current Status: ✅ Enhanced - Incident response plan implemented, status page deployed at status.provii.app

Implementation Details:

• Incident Response Plan. Documented in /trust/security/business-continuity.mdx
• Status Page. Real-time monitoring at https://status.provii.app
• 4 services monitored (Production + Sandbox Verify/Issuer)
• Auto-refresh every 60 seconds
• Public API endpoint (/api/status)
• $0/month cost (Cloudflare Workers free tier)
• Communication Templates. Service degradation, restoration, security advisory
• Escalation Chain. Security Lead → Engineering → ISMS Owner
• Customer Communication. Status page (primary), email (backup), social media (major outages)

Evidence Location:

• /trust/evidence/business-continuity/status-page-evidence.md
• /trust/evidence/business-continuity/bc-dr-evidence.md (UC-170 section)
• provii-status/

Gap Closed: GAP-M001 (Status Page for Service Transparency) ✅ CLOSED

UC-171: Tabletop Exercises and Drills

Domain: Business Continuity Description: Conduct regular tabletop exercises and drills to test business continuity and disaster recovery plans.

Standards Coverage:

• ISO 27001:2022 A.5.30. ICT readiness for business continuity
• CSA CCM BCR-09. BCP/DRP testing
• ISO 22301. Testing requirements

Implementation Type: Administrative Evidence Needed:

• Tabletop exercise schedule (annual minimum)
• Exercise scenarios and objectives
• Participant lists
• Exercise findings and improvements
• Plan updates based on lessons learned

Priority: Medium Current Status: 📋 Planned - Annual tabletop exercises (Q1 2026)

UC-172: Alternative Processing Sites

Domain: Business Continuity Description: Identify and prepare alternative processing sites for critical functions in case primary site is unavailable.

Standards Coverage:

• ISO 27001:2022 A.5.13. Business continuity
• ISO 22301. Alternative site requirements
• CSA CCM BCR-10. Alternative sites

Implementation Type: Administrative + Technical Evidence Needed:

• Alternative site identification (Cloudflare global network)
• Automatic geographic failover
• Alternative site testing
• Activation procedures
• Site parity verification

Priority: Medium Current Status: ✅ Implemented - Cloudflare global distribution (automatic geographic failover)

Vendor & Supply Chain Controls

UC-173: Vendor Security Assessment

Domain: Vendor & Supply Chain Description: Assess security posture of vendors before engagement and periodically thereafter. Risk-based assessment depth.

Standards Coverage:

• ISO 27001:2022 A.5.19. Information security in supplier relationships
• CSA CCM STA-04. Vendor security assessment
• GDPR Article 28. Processor due diligence
• NIST. Supply chain risk management

Implementation Type: Administrative Evidence Needed:

• Vendor security questionnaires
• Third-party certifications (SOC 2, ISO 27001)
• Risk-based assessment (critical vendors get deep assessment)
• Assessment records and approvals
• Periodic re-assessment (annual for critical)

Priority: High Current Status: ✅ Implemented - Cloudflare/GitHub security assessments, Supplier Management

UC-174: Supply Chain Transparency

Domain: Vendor & Supply Chain Description: Maintain visibility into supply chain including sub-processors, open source dependencies, and service providers.

Standards Coverage:

• ISO 27001:2022 A.5.21. Managing information security in the ICT supply chain
• GDPR Article 28(2). Sub-processor approval
• CSA CCM STA-05. Supply chain transparency
• SLSA. Supply chain levels

Implementation Type: Administrative Evidence Needed:

• Supplier and sub-processor list
• Dependency inventory (Cargo.toml, package.json)
• Software bill of materials (SBOM)
• Supply chain documentation
• Customer notification of sub-processor changes

Priority: High Current Status: ✅ Implemented - Supplier list, SBOM from SLSA provenance

downpipes application: Because downpipes is no-custody — the engine and console run in the customer’s own Cloudflare account, under the customer’s keys, and Maelstrom holds no customer keys, data or Cloudflare tokens — Maelstrom introduces no sub-processor for customer backup data. Supply-chain transparency for downpipes therefore centres on the open dependency inventory, the SBOM, and the signature-pinned update channel (updates.downpipes.io) rather than on data sub-processors.

UC-175: Vendor Contract Security Requirements

Domain: Vendor & Supply Chain Description: Include security, privacy, and compliance requirements in vendor contracts. Specify incident notification, audits, and data handling.

Standards Coverage:

• ISO 27001:2022 A.5.20. Addressing information security within supplier agreements
• GDPR Article 28. Processor contracts
• CSA CCM STA-06. Contractual requirements

Implementation Type: Administrative Evidence Needed:

• Security requirements in contracts
• Data processing agreements (DPAs)
• SLAs with security provisions
• Audit rights in contracts
• Breach notification requirements

Priority: High Current Status: ✅ Implemented - Cloudflare/GitHub ToS include security provisions

UC-176: Open Source Dependency Management

Domain: Vendor & Supply Chain Description: Manage open source dependencies with security scanning, licence compliance, and update tracking.

Standards Coverage:

• ISO 27001:2022 A.5.21. Managing information security in the ICT supply chain
• ISO 27001:2022 A.5.32. Intellectual property rights
• CSA CCM STA-07. Open source management

Implementation Type: Technical + Administrative Evidence Needed:

• Dependency scanning (cargo audit, npm audit)
• Licence compliance review
• Open source usage policy
• Dependency update procedures
• SBOM generation

Priority: Critical Current Status: ✅ Implemented - cargo audit, npm audit, SBOM, licence review

UC-177: Vendor Incident Response Coordination

Domain: Vendor & Supply Chain Description: Coordinate incident response with vendors including notification procedures, shared investigation, and joint remediation.

Standards Coverage:

• ISO 27001:2022 A.5.12. Incident management
• GDPR Article 33. Processor breach notification
• CSA CCM SEF-07. Vendor incident coordination

Implementation Type: Administrative Evidence Needed:

• Vendor incident notification procedures
• Escalation contacts for vendor incidents
• Joint incident investigation protocols
• Vendor security incident history
• Lessons learned from vendor incidents

Priority: High Current Status: 🔄 Partially Implemented - Cloudflare/GitHub incident channels, formal coordination procedures needed

UC-178: Critical Vendor Monitoring

Domain: Vendor & Supply Chain Description: Continuously monitor critical vendors for security incidents, service disruptions, and compliance changes.

Standards Coverage:

• ISO 27001:2022 A.5.7. Threat intelligence
• CSA CCM STA-08. Vendor monitoring
• NIST. Supply chain monitoring

Implementation Type: Administrative + Technical Evidence Needed:

• Vendor monitoring tools (status pages, security feeds)
• Critical vendor identification
• Vendor health dashboards
• Alerting on vendor incidents
• Contingency plans for vendor failures

Priority: Medium Current Status: ✅ Implemented - Monitor Cloudflare/GitHub status pages

UC-179: Vendor Offboarding

Domain: Vendor & Supply Chain Description: Securely offboard vendors with data deletion, access revocation, and contract termination procedures.

Standards Coverage:

• ISO 27001:2022 A.5.10. Supplier relationships
• GDPR Article 28. End of processing obligations
• CSA CCM STA-09. Vendor offboarding

Implementation Type: Administrative Evidence Needed:

• Vendor offboarding checklist
• Data deletion verification
• Access revocation confirmation
• Contract termination procedures
• Transition planning

Priority: Medium Current Status: 🔄 Deferred. Single vendor (Cloudflare); offboarding procedures will be documented as vendor portfolio grows

UC-180: Fourth-Party Risk Management

Domain: Vendor & Supply Chain Description: Manage risks from vendors’ vendors (fourth parties). Require disclosure and assessment of sub-processors.

Standards Coverage:

• GDPR Article 28(2). Sub-processor authorisation
• ISO 27001:2022 A.5.21. Managing information security in the ICT supply chain
• CSA CCM STA-10. Fourth-party risk

Implementation Type: Administrative Evidence Needed:

• Sub-processor disclosure requirements
• Fourth-party risk assessment
• Approval process for sub-processors
• Sub-processor changes notification
• Liability flow-down in contracts

Priority: Medium Current Status: 🔄 Partially Implemented - Cloudflare sub-processors documented, formal approval process needed

downpipes application: The no-custody model contains fourth-party exposure for customer backup data: because downpipes runs in the customer’s own Cloudflare account under the customer’s keys and Maelstrom holds no customer data, Maelstrom engages no sub-processor that touches customer backup contents. The customer’s own backup destinations are customer-selected and customer-controlled, not Maelstrom sub-processors.

UC-181: Supply Chain Attack Prevention

Domain: Vendor & Supply Chain Description: Implement controls to prevent supply chain attacks including dependency confusion, typosquatting, and compromised packages.

Standards Coverage:

• SLSA Level 3/4. Supply chain integrity
• ISO 27001:2022 A.5.21. Managing information security in the ICT supply chain
• CSA CCM STA-11. Supply chain attack prevention

Implementation Type: Technical Evidence Needed:

• Hermetic builds (locked dependencies)
• Dependency verification (checksums, signatures)
• Private package repository (if applicable)
• Artefact provenance (SLSA)
• Supply chain attack monitoring

Priority: Critical Current Status: ✅ Implemented - SLSA Level 3, hermetic builds, signed artefacts

downpipes application: Because downpipes updates run into customers’ own Cloudflare accounts, supply-chain integrity is enforced at the update channel: updates are distributed through a static, signature-pinned R2 bucket (updates.downpipes.io); the engine pulls each update and verifies its signature against a pinned public key before applying (canary-gated safe-apply with automatic rollback); and the Update Signer is held offline by the operator, never deployed to any Worker. This closes the principal supply-chain path into customer tenants.

Governance & Compliance Controls

UC-182: Compliance Monitoring and Reporting

Domain: Governance & Compliance Description: Continuously monitor compliance with applicable regulations and standards. Generate compliance reports for management and auditors.

Standards Coverage:

• ISO 27001:2022 Clause 9. Performance evaluation and monitoring
• ISO 27701:2019 Clause 9. Compliance monitoring
• CSA CCM GRC-07. Compliance monitoring

Implementation Type: Administrative Evidence Needed:

• Compliance register (laws, regulations, standards)
• Compliance monitoring procedures
• Compliance dashboards and reports
• Gap identification and remediation
• Executive compliance reporting

Priority: High Current Status: ✅ Implemented. ISMS documentation site provides compliance visibility; quarterly management review tracks compliance posture

UC-183: Management Review and Oversight

Domain: Governance & Compliance Description: Conduct regular management reviews of ISMS/PIMS effectiveness, compliance status, and improvement opportunities.

Standards Coverage:

• ISO 27001:2022 Clause 9.3. Management review
• ISO 27701:2019 Clause 9.3. Privacy management review
• CSA CCM GRC-08. Management review

Implementation Type: Administrative Evidence Needed:

• Management review schedule (quarterly minimum)
• Management review agendas and minutes
• Review inputs (audit results, incidents, metrics, changes)
• Management decisions and action items
• Follow-up on previous action items

Priority: High Current Status: ✅ Implemented - Management Review Process

UC-184: Internal Audit Program

Domain: Governance & Compliance Description: Conduct regular internal audits to verify ISMS/PIMS compliance and effectiveness. Use independent auditors where possible.

Standards Coverage:

• ISO 27001:2022 Clause 9.2. Internal audit
• ISO 27701:2019 Clause 9.2. Privacy internal audit
• CSA CCM GRC-09. Internal audit

Implementation Type: Administrative Evidence Needed:

• Internal audit program and schedule
• Audit plans and scopes
• Audit findings and non-conformities
• Corrective action tracking
• Auditor independence

Priority: High Current Status: ✅ Implemented - Internal Audit Program

UC-185: Legal and Regulatory Compliance Register

Domain: Governance & Compliance Description: Maintain register of applicable legal, regulatory, contractual, and industry requirements. Update as requirements change.

Standards Coverage:

• ISO 27001:2022 A.5.31. Legal, statutory, regulatory and contractual requirements
• ISO 27701:2019. Privacy law compliance
• CSA CCM GRC-10. Compliance register

Implementation Type: Administrative Evidence Needed:

• Compliance register document
• Legal requirements by jurisdiction (GDPR, CCPA, Privacy Act, COPPA, etc.)
• Contractual obligations
• Industry standards (ISO 27001, ISO 27701, ISO 27566-1)
• Quarterly compliance register review

Priority: Critical Current Status: 🔄 Partially Implemented - Key regulations documented, register in progress

Notes on Current Status Legend

• ✅ Implemented: Control is fully operational with evidence available
• 🔄 Partially Implemented: Control is in progress or partially complete
• 📋 Planned: Control is documented in roadmap with timeline
• ❌ Not Applicable: Control does not apply to our architecture or context

Appendices

Appendix A: Standards Cross-Reference

Detailed mapping of each unified control to specific clauses/articles in each standard.

Appendix B: Evidence Collection Plan

List of evidence artefacts needed for each control with collection procedures.

Appendix C: Compliance Roadmap

Timeline for implementing planned controls and achieving certifications.

Appendix D: Gap Analysis

Detailed analysis of gaps between current state and full compliance with each standard.

Document Control Version: 1.4 Last Updated: 2026-06-19 Next Review: 2026-12-19 Owner: ISMS Owner Maintained By: ISMS Owner

Changelog

End of Unified Compliance Requirements Matrix