George Lambert
4fcbb9ac95
Some checks are pending
ci / markdown (push) Waiting to run
Open with an executive summary that HIPAA, SOC 2, and ISO 27001 are organizational programs. Verae DataCubes supply store, communicate, timestamp, verify, and audit tools for the technical portion only. Chapters cover transit (HPKE, visible routing), rest (IPFS/Peergos hash-verified restore), receipts, EU Peergos evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping, and write-once Iceberg archive. PDF is branded with the Verae logo top-left and Verae Inc contact in the footer; last chapters are sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.
247 lines
No EOL
12 KiB
HTML
247 lines
No EOL
12 KiB
HTML
<!DOCTYPE html>
|
|
|
|
<html lang="en" data-content_root="./">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
|
|
<title>12. Audit-ready checklist — Making yourself audit-ready with Verae DataCubes</title>
|
|
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
|
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
|
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
|
|
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
|
|
<script src="_static/documentation_options.js?v=250a654d"></script>
|
|
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
|
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
|
<link rel="icon" href="_static/VeraeFullLogo.png"/>
|
|
<link rel="index" title="Index" href="genindex.html" />
|
|
<link rel="search" title="Search" href="search.html" />
|
|
<link rel="next" title="13. How to use this briefing" href="howto.html" />
|
|
<link rel="prev" title="11. BAAs, DPAs, and ciphertext without host keys" href="baa-dpa.html" />
|
|
|
|
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
|
|
|
|
|
|
|
|
|
|
|
</head><body>
|
|
<div class="document">
|
|
|
|
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
|
<div class="sphinxsidebarwrapper">
|
|
<p class="logo"><a href="index.html">
|
|
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
|
|
</a></p>
|
|
<p class="logo">
|
|
<a href="index.html">
|
|
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
|
|
|
|
</a>
|
|
</p>
|
|
|
|
|
|
|
|
<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<search id="searchbox" style="display: none" role="search">
|
|
<div class="searchformwrapper">
|
|
<form class="search" action="search.html" method="get">
|
|
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
|
|
<input type="submit" value="Go" />
|
|
</form>
|
|
</div>
|
|
</search>
|
|
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
|
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
|
<ul class="current">
|
|
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
|
|
<li class="toctree-l1 current"><a class="current reference internal" href="#">12. Audit-ready checklist</a><ul>
|
|
<li class="toctree-l2"><a class="reference internal" href="#a-scope-and-honesty">12.1. A. Scope and honesty</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#b-data-in-transit">12.2. B. Data in transit</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#c-data-at-rest">12.3. C. Data at rest</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#d-timestamping">12.4. D. Timestamping</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#e-write-once-archive">12.5. E. Write-once archive</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#f-access-and-change">12.6. F. Access and change</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#g-contracts-counsel">12.7. G. Contracts (counsel)</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#h-independent-examination-of-this-organization">12.8. H. Independent examination of <em>this</em> organization</a></li>
|
|
</ul>
|
|
</li>
|
|
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
|
|
</ul>
|
|
|
|
<div class="relations">
|
|
<h3>Related Topics</h3>
|
|
<ul>
|
|
<li><a href="index.html">Documentation overview</a><ul>
|
|
<li>Previous: <a href="baa-dpa.html" title="previous chapter"><span class="section-number">11. </span>BAAs, DPAs, and ciphertext without host keys</a></li>
|
|
<li>Next: <a href="howto.html" title="next chapter"><span class="section-number">13. </span>How to use this briefing</a></li>
|
|
</ul></li>
|
|
</ul>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="documentwrapper">
|
|
<div class="bodywrapper">
|
|
|
|
|
|
<div class="body" role="main">
|
|
|
|
<section id="audit-ready-checklist">
|
|
<h1><span class="section-number">12. </span>Audit-ready checklist<a class="headerlink" href="#audit-ready-checklist" title="Link to this heading">¶</a></h1>
|
|
<p>Use this as a working list. Check an item only when
|
|
<strong>evidence exists</strong> (screenshot, log export, signed policy,
|
|
ticket, receipt). This list is not a certificate. Software
|
|
having been installed does not tick these boxes.</p>
|
|
<section id="a-scope-and-honesty">
|
|
<h2><span class="section-number">12.1. </span>A. Scope and honesty<a class="headerlink" href="#a-scope-and-honesty" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>Named legal entity and systems in scope (console, Drive,
|
|
message fabric, IPFS, timestamping link, Iceberg archive)</p></li>
|
|
<li><p>Written sentence in the system description: <strong>software is
|
|
not our HIPAA / SOC 2 / ISO 27001 certificate</strong></p></li>
|
|
<li><p>Data-flow diagram: endpoint → HPKE → DataCube →
|
|
Peergos/IPFS → receipt → Iceberg</p></li>
|
|
<li><p>PHI / personal data vs ciphertext vs routing metadata,
|
|
named</p></li>
|
|
<li><p>Peergos evaluation chapter attached, labeled <strong>component
|
|
security evaluation</strong></p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="b-data-in-transit">
|
|
<h2><span class="section-number">12.2. </span>B. Data in transit<a class="headerlink" href="#b-data-in-transit" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>Production algorithm is HPKE (or documented successor),
|
|
not a lab construction</p></li>
|
|
<li><p>Destinations and subjects documented as <strong>visible by
|
|
design</strong></p></li>
|
|
<li><p>Error paths carry codes and lookup ids, not bodies</p></li>
|
|
<li><p>Public-key directory lists public keys only; private keys
|
|
mode 0600 or HSM</p></li>
|
|
<li><p>Broker operator named; metadata vs content in the annex</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="c-data-at-rest">
|
|
<h2><span class="section-number">12.3. </span>C. Data at rest<a class="headerlink" href="#c-data-at-rest" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>Customer holds Peergos / Drive keys; not on storage host</p></li>
|
|
<li><p>Peergos hash verification on write and on read, evidenced</p></li>
|
|
<li><p>Restore test: recover a cube from content-addressed
|
|
ciphertext <strong>without</strong> a plaintext tape</p></li>
|
|
<li><p>Dual-hash cube chain; first-hash-wins registry</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="d-timestamping">
|
|
<h2><span class="section-number">12.4. </span>D. Timestamping<a class="headerlink" href="#d-timestamping" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>First-registration rule documented and tested (second
|
|
submit returns original receipt)</p></li>
|
|
<li><p>Organizational node <strong>linked</strong> to central Verae, <strong>or</strong>
|
|
direct sync, named in the diagram</p></li>
|
|
<li><p>Sample bundle: receipt + private metadata + attachment
|
|
pointer, redacted for the evidence pack</p></li>
|
|
<li><p>Verae receives fingerprints, not objects — stated in
|
|
the data map</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="e-write-once-archive">
|
|
<h2><span class="section-number">12.5. </span>E. Write-once archive<a class="headerlink" href="#e-write-once-archive" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>Iceberg (or equivalent) export job exists and has a dated
|
|
last-run</p></li>
|
|
<li><p>Object-lock / dual-control / separate account — evidence
|
|
that no <strong>single</strong> party can delete a committed snapshot</p></li>
|
|
<li><p>Retention schedule written by records/counsel, not by
|
|
engineering folklore</p></li>
|
|
<li><p>Legal-hold procedure extends retention; ticket example</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="f-access-and-change">
|
|
<h2><span class="section-number">12.6. </span>F. Access and change<a class="headerlink" href="#f-access-and-change" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>Console requires authentication (TOTP or equivalent);
|
|
Drive login is a separate plane</p></li>
|
|
<li><p>Inspect is k-of-n; author is not an officer; log-before-reveal</p></li>
|
|
<li><p>Joiner / mover / leaver for console users</p></li>
|
|
<li><p>Signed configuration; unsigned rejected; admin-history
|
|
prev + new + diff</p></li>
|
|
<li><p>HSM or a dated plan to move lab keys to HSM</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="g-contracts-counsel">
|
|
<h2><span class="section-number">12.7. </span>G. Contracts (counsel)<a class="headerlink" href="#g-contracts-counsel" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>Written BA / not-a-BA determination for disk, VM, backup,
|
|
IPFS, Iceberg</p></li>
|
|
<li><p>DPA Article 28 where usernames, logs, or IPs are processed</p></li>
|
|
<li><p>NATS operator: metadata vs content</p></li>
|
|
<li><p>Verae timestamping: fingerprint-only processing described</p></li>
|
|
<li><p>Peergos PDFs attached and labeled “not our Type II / ISO”</p></li>
|
|
</ul>
|
|
</section>
|
|
<section id="h-independent-examination-of-this-organization">
|
|
<h2><span class="section-number">12.8. </span>H. Independent examination of <em>this</em> organization<a class="headerlink" href="#h-independent-examination-of-this-organization" title="Link to this heading">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>SOC 2 Type I/II engagement, <strong>or</strong> ISO 27001 registrar,
|
|
<strong>or</strong> HIPAA risk analysis plus policies — <strong>the program
|
|
actually chosen</strong>, not all three as wallpaper</p></li>
|
|
<li><p>Evidence window (Type II / surveillance) if applicable</p></li>
|
|
<li><p>Named internal owner who will sit in the meeting and not
|
|
claim the software is the certificate</p></li>
|
|
</ul>
|
|
</section>
|
|
</section>
|
|
|
|
|
|
</div>
|
|
|
|
</div>
|
|
</div>
|
|
<div class="clearer"></div>
|
|
</div>
|
|
<div class="verae-page-footer">
|
|
<strong>Verae Inc</strong>
|
|
· <a href="https://www.verae.com">https://www.verae.com</a>
|
|
· Book a call at <a href="https://www.verae.com">verae.com</a>
|
|
· <a href="https://app.verae.com">app.verae.com</a>
|
|
</div>
|
|
|
|
<div class="footer">
|
|
©2026, Verae Inc.
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
</body>
|
|
</html> |