Information Security Objectives Register

Purpose

This register defines Maelstrom AI’s measurable information security objectives as required by ISO 27001:2022 Clause 6.2. Each objective is specific, measurable, and aligned with the security objectives stated in the Information Security Policy.

Scope

These objectives apply to all systems, processes, and personnel within the ISMS scope.

Objectives Register

Objective Details

OBJ-01: Protect Cryptographic Integrity

Alignment with policy: Corresponds to Security Objective 1 in the Information Security Policy, ensuring the mathematical soundness and security of our zero knowledge proof systems (Provii) and the integrity of post-quantum-sealed, tamper-evident archives (downpipes).

What is measured:

• Number of unauthorised access attempts to signing key material
• Number of signing key compromise events
• Timeliness of key rotation per the Cryptography Policy
• For downpipes, archive integrity verified by hourly canary integrity flights (sealed under customer-held keys, no-custody)

Data sources: Cloudflare audit logs, Workers secrets access logs, incident records, downpipes canary integrity flight results.

Escalation: Any non-zero count triggers immediate incident response per the Incident Response Procedure.

OBJ-02: Maintain Service Availability

Alignment with policy: Corresponds to Security Objective 2 in the Information Security Policy, providing reliable age verification services (Provii) with minimal unplanned downtime, and proven recoverability of customer data (downpipes).

What is measured:

• Uptime percentage for provii-verifier (including hosted mode) and provii-issuer
• Number and duration of unplanned outages
• Mean time to recovery (MTTR)
• For downpipes, proven recoverability — outcomes of hourly canary integrity flights and scheduled restore tests, supported by a fail-open vendor control-plane that never gates backup or restore and an offline reader for vendor-independent recovery

Data sources: Grafana Loki (Cloudflare Workers Logs sink), status page records, incident logs, downpipes canary integrity flight and restore-test records.

Escalation: Uptime below 99.9% in any calendar month, or any failed scheduled restore test, triggers a management review action item.

OBJ-03: Secure Software Development

Alignment with policy: Corresponds to Security Objective 3 in the Information Security Policy, producing secure, auditable code through rigorous development practices.

What is measured:

• Percentage of PRs with passing security scans (CodeQL, cargo audit, npm audit)
• Percentage of PRs with at least one code review approval
• SLSA Level 3 provenance generation for production builds

Data sources: GitHub branch protection logs, CI pipeline run history, SLSA provenance attestations.

Escalation: Any PR merged without required checks or review is treated as a nonconformity.

OBJ-04: Protect Operational Secrets

Alignment with policy: Corresponds to Security Objective 4 in the Information Security Policy, safeguarding API keys, signing keys, and authentication secrets.

What is measured:

• Number of secret scanning alerts (GitHub)
• MFA coverage percentage across GitHub organisation and Cloudflare account
• Number of credential rotation events completed on schedule
• For downpipes, custody of the vendor-side keys: the downpipes Licence Signer held in Cloudflare Secrets Store (control-plane, fail-open) and the downpipes Update Signer held offline by the operator and never deployed to any Worker; customer encryption keys are held solely by the customer (no-custody)

Data sources: GitHub secret scanning dashboard, GitHub organisation security settings, Cloudflare account settings, downpipes control-plane Secrets Store and offline Update Signer custody records.

Escalation: Any exposed credential triggers immediate rotation and incident response.

OBJ-05: Ensure Compliance

Alignment with policy: Corresponds to Security Objective 5 in the Information Security Policy, meeting legal and regulatory requirements.

For Provii, the zero knowledge architecture significantly simplifies compliance by minimising server-side PII processing. For downpipes, the no-custody architecture means Maelstrom holds no customer keys, data or Cloudflare tokens, so Maelstrom adds no sub-processor for customer data.

What is measured:

• Gap analysis completion percentage (controls implemented vs. total required)
• Number of internal audit nonconformities (trend over time)
• External audit readiness assessment score
• Number of regulatory findings or complaints

Data sources: Gap Analysis, Internal Audit Program (maintained internally; available to auditors and enterprise customers on request), regulatory correspondence.

Escalation: Significant gaps or regulatory findings trigger corrective action plans reviewed in management review.

Review Process

Annual Review

Security objectives are formally reviewed during the annual Management Review (maintained internally; available to auditors and enterprise customers on request). The review considers:

• Whether each objective was met, partially met, or not met
• Whether targets remain appropriate or need adjustment
• Whether new objectives are required based on changes to the risk profile
• Resource requirements for achieving objectives

Ad-Hoc Review

Objectives are reviewed outside the annual cycle when:

• A significant security incident occurs
• The risk profile changes materially (new services, new threats, organisational changes)
• Audit findings indicate objectives are not being met
• Regulatory requirements change

Reporting

The Security Lead prepares a quarterly objectives status report summarising:

• Current measurement values against targets
• Trend analysis (improving, stable, or declining)
• Corrective actions required for objectives not on track
• Recommendations for target or measurement adjustments

This report is provided to the ISMS Owner and discussed in management review.

Related Documents

• Information Security Policy - Policy objectives (lines 33-96)
• Risk Register - Risks that objectives address
• Management Review (maintained internally; available to auditors and enterprise customers on request) - Forum for objectives review
• Internal Audit Program (maintained internally; available to auditors and enterprise customers on request) - Audit of objectives achievement
• Gap Analysis - Compliance progress for OBJ-05

Document Information

• Version. 1.1
• Effective Date. 2026-02-13
• Last Updated. 2026-06-19
• Owner. ISMS Owner
• Review Frequency. Annually
• Next Review. 2027-02-13
• Classification. Public
• Change (1.1). downpipes added as second in-scope platform; the legacy backup worker retired in favour of self-hosted downpipes. Objectives OBJ-01/02/04/05 extended to cover both platforms (archive integrity and proven recoverability for downpipes; vendor-side signer custody; no-custody compliance posture).