This plan stages the identity, access, audit, encryption, privacy, and retention content needed for AC, IA, AU, SC, MP, and PT families. These controls are closely linked because the system must know who acted, what they could access, what data was involved, and how the record is protected.
Identity and Authentication
| Area | Target Practice | Evidence |
|---|
| Workforce identity | Federated SSO with MFA. | IdP policy export |
| Privileged identity | Phishing-resistant MFA for production administrators. | Authenticator policy and enrollment export |
| Customer identity | [FILL IN: Better-Auth, OIDC, IdP, or other] | Auth architecture and test evidence |
| Service accounts | Named, least-privilege, rotated, and owner-assigned. | Service account inventory |
| Break-glass | Time-limited, logged, reviewed after use. | Break-glass event record |
| Stale accounts | Detected and removed on a schedule. | Access review evidence |
Access Reviews
| Scope | Cadence | Reviewer | Evidence |
|---|
| Production administrators | Monthly or quarterly | Security and Platform Engineering | Access review issue |
| GitHub organization and repositories | Quarterly | Security | Team and permission export |
| Kubernetes RBAC | Quarterly | Platform Engineering | RBAC export |
| Database privileged access | Quarterly | Platform Engineering | Role and grant export |
| Secret manager access | Quarterly | Security | Access export |
| Break-glass accounts | After each use and quarterly | Security | Event review |
Authorization Rules
| Rule | Implementation | Evidence |
|---|
| Least privilege | Roles grant only needed permissions. | Role matrix |
| Separation of duties | Author cannot be sole approver for production change. | Pull request approval history |
| Server-side enforcement | Protected actions check authorization on the server. | Tests and code review |
| Administrative actions | Admin actions emit audit events. | Audit event samples |
| Data access | Sensitive data access is authorized, logged, and minimized. | Access tests and audit logs |
Audit Event Schema
| Field | Description | Required |
|---|
event_id | Unique event identifier. | Yes |
event_time | Timestamp in UTC. | Yes |
actor_id | User or service account. | Yes |
actor_type | User, service, system, or administrator. | Yes |
action | Action performed. | Yes |
target_type | Object type affected. | Yes |
target_id | Object identifier. | Conditional |
result | Success, failure, denied, or error. | Yes |
source_ip | Source address where available. | Conditional |
correlation_id | Trace or request identifier. | Yes |
reason | Reason for denial, change, or administrative action. | Conditional |
Audit Events To Capture
| Event | Supports | Notes |
|---|
| Login success and failure | AU-2, IA-2, AC-7 | Include source and result. |
| MFA enrollment or reset | IA-2, IA-5, AU-2 | Treat reset as sensitive. |
| Role or permission change | AC-2, AC-6, AU-2 | Include actor and approver. |
| Data export | AC-3, AU-2, PT-3 | Include scope and target. |
| Administrative configuration change | CM-3, AU-2 | Include before or after reference where safe. |
| Secret rotation | SC-12, IA-5, AU-2 | Do not log secret values. |
| Deployment | CM-3, CM-4, AU-2 | Link commit, artifact, and environment. |
| Break-glass use | AC-2, AC-6, AU-6 | Requires follow-up review. |
Data Protection
| Area | Target Practice | Evidence |
|---|
| Encryption in transit | TLS 1.2 or higher, target TLS 1.3 where supported. | TLS configuration and scan |
| Internal traffic | mTLS or network segmentation where practical. | Service mesh or network policy evidence |
| Encryption at rest | Database, object, volume, and backup encryption. | Provider and configuration export |
| Key management | KMS or HSM-backed keys with rotation. | Key policy and rotation evidence |
| Secret management | Secret manager with access logs and rotation. | Secret inventory and access logs |
| FIPS validation | Confirm FIPS 140-3 module status for federal boundary. | Vendor certificate or inherited control evidence |
Privacy and Retention
| Data Class | Collection Purpose | Retention | Deletion Method | Owner |
|---|
| Account data | Authentication and authorization | [FILL IN] | [FILL IN] | Security |
| Application records | Service delivery | [FILL IN] | [FILL IN] | Application Engineering |
| Audit logs | Security accountability | [FILL IN] | [FILL IN] | Operations |
| Backup data | Recovery | [FILL IN] | [FILL IN] | Operations |
| Support data | Support and troubleshooting | [FILL IN] | [FILL IN] | Customer Success or Operations |
Required Decisions