George Lambert
da60402e88
Some checks are pending
ci / markdown (push) Waiting to run
source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.
186 lines
No EOL
7.9 KiB
HTML
186 lines
No EOL
7.9 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>Audit-ready checklist — Making yourself audit-ready with Verae DataCubes</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
||
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
|
||
<script src="_static/documentation_options.js?v=5929fcd5"></script>
|
||
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
||
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="How to use this pack" href="howto.html" />
|
||
<link rel="prev" title="BAAs and DPAs when ciphertext has no host keys" href="baa-dpa.html" />
|
||
|
||
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
||
|
||
|
||
|
||
|
||
|
||
</head><body>
|
||
|
||
|
||
<div class="document">
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
|
||
|
||
<div class="body" role="main">
|
||
|
||
<section id="audit-ready-checklist">
|
||
<h1>Audit-ready checklist<a class="headerlink" href="#audit-ready-checklist" title="Link to this heading">¶</a></h1>
|
||
<p>Use this as a working list. Check items only when <strong>evidence exists</strong>
|
||
(screenshot, log export, signed policy, ticket). This list is not a
|
||
certificate.</p>
|
||
<section id="a-scope-and-data-map">
|
||
<h2>A. Scope and data map<a class="headerlink" href="#a-scope-and-data-map" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>Named legal entity and systems in scope (console, Drive, NATS, IPFS, ns1)</p></li>
|
||
<li><p>Data-flow diagram: endpoint → HPKE/NATS → cryptree/IPFS</p></li>
|
||
<li><p>What is PHI / personal data vs ciphertext vs routing metadata</p></li>
|
||
<li><p>Peergos verification chapter attached (<a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>)</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="b-keys-and-encryption">
|
||
<h2>B. Keys and encryption<a class="headerlink" href="#b-keys-and-encryption" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>Customer holds Peergos/Drive keys; not on storage host</p></li>
|
||
<li><p>NPE/HPKE endpoint keys in directory; private 0600; no xor content</p></li>
|
||
<li><p>Signed Ed25519 config; unsigned rejected; admin-history prev+new+diff</p></li>
|
||
<li><p>HSM or documented lab-to-HSM path</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="c-access">
|
||
<h2>C. Access<a class="headerlink" href="#c-access" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>Console <code class="docutils literal notranslate"><span class="pre">PFC_REQUIRE_AUTH=1</span></code>, TOTP; Drive login separate</p></li>
|
||
<li><p>Inspect k-of-n; author is not an officer; log-before-reveal</p></li>
|
||
<li><p>Joiner / mover / leaver for console users</p></li>
|
||
<li><p>Google SSO does <strong>not</strong> unwrap cubes</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="d-integrity-and-backup">
|
||
<h2>D. Integrity and backup<a class="headerlink" href="#d-integrity-and-backup" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>Cube chain append-only JSONL; dual hash</p></li>
|
||
<li><p>Hash registry: first SHA-256 and receipt win</p></li>
|
||
<li><p>Peergos/IPFS: hash-verified encrypted blocks (restore = re-fetch CIDs)</p></li>
|
||
<li><p>Restore test: recover a cube from content-addressed ciphertext without
|
||
plaintext backup tapes</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="e-logging">
|
||
<h2>E. Logging<a class="headerlink" href="#e-logging" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>Inspect audit events</p></li>
|
||
<li><p>SM summaries: codes + lookup_id only (no bodies)</p></li>
|
||
<li><p>Admin-history cube for config</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="f-contracts-counsel">
|
||
<h2>F. Contracts (counsel)<a class="headerlink" href="#f-contracts-counsel" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>Written BA / not-a-BA determination for disk, VM, backup, IPFS</p></li>
|
||
<li><p>DPA Art. 28 where usernames/logs/IPs are processed</p></li>
|
||
<li><p>NATS operator: metadata vs content in the annex</p></li>
|
||
<li><p>Peergos component assurance: attach Cure53 2019 + ROS 2024 PDFs
|
||
(public; not your org’s ISO/SOC report)</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="g-independent-audit-of-you">
|
||
<h2>G. Independent audit of <em>you</em><a class="headerlink" href="#g-independent-audit-of-you" title="Link to this heading">¶</a></h2>
|
||
<ul class="simple">
|
||
<li><p>SOC 2 Type I/II engagement <strong>or</strong> ISO 27001 registrar <strong>or</strong> HIPAA
|
||
risk analysis + policies (pick the program you actually need)</p></li>
|
||
<li><p>Evidence window (Type II / surveillance) if applicable</p></li>
|
||
</ul>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
||
<div class="sphinxsidebarwrapper">
|
||
<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<search id="searchbox" style="display: none" role="search">
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
|
||
<input type="submit" value="Go" />
|
||
</form>
|
||
</div>
|
||
</search>
|
||
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
||
<ul class="current">
|
||
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
|
||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Audit-ready checklist</a><ul>
|
||
<li class="toctree-l2"><a class="reference internal" href="#a-scope-and-data-map">A. Scope and data map</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#b-keys-and-encryption">B. Keys and encryption</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#c-access">C. Access</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#d-integrity-and-backup">D. Integrity and backup</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#e-logging">E. Logging</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#f-contracts-counsel">F. Contracts (counsel)</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#g-independent-audit-of-you">G. Independent audit of <em>you</em></a></li>
|
||
</ul>
|
||
</li>
|
||
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
|
||
</ul>
|
||
|
||
<div class="relations">
|
||
<h3>Related Topics</h3>
|
||
<ul>
|
||
<li><a href="index.html">Documentation overview</a><ul>
|
||
<li>Previous: <a href="baa-dpa.html" title="previous chapter">BAAs and DPAs when ciphertext has no host keys</a></li>
|
||
<li>Next: <a href="howto.html" title="next chapter">How to use this pack</a></li>
|
||
</ul></li>
|
||
</ul>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="footer">
|
||
©2026, Verae.
|
||
|
||
|
|
||
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
|
||
& <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
|
||
|
||
|
|
||
<a href="_sources/checklist.rst.txt"
|
||
rel="nofollow">Page source</a>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
</body>
|
||
</html> |