George Lambert
4fcbb9ac95
Some checks are pending
ci / markdown (push) Waiting to run
Open with an executive summary that HIPAA, SOC 2, and ISO 27001 are organizational programs. Verae DataCubes supply store, communicate, timestamp, verify, and audit tools for the technical portion only. Chapters cover transit (HPKE, visible routing), rest (IPFS/Peergos hash-verified restore), receipts, EU Peergos evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping, and write-once Iceberg archive. PDF is branded with the Verae logo top-left and Verae Inc contact in the footer; last chapters are sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.
179 lines
No EOL
8.6 KiB
HTML
179 lines
No EOL
8.6 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>13. How to use this briefing — Making yourself audit-ready with Verae DataCubes</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
||
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
|
||
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
|
||
<script src="_static/documentation_options.js?v=250a654d"></script>
|
||
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
||
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||
<link rel="icon" href="_static/VeraeFullLogo.png"/>
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="14. James H. Garfinkel" href="bio-james-garfinkel.html" />
|
||
<link rel="prev" title="12. Audit-ready checklist" href="checklist.html" />
|
||
|
||
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
||
|
||
|
||
|
||
|
||
|
||
</head><body>
|
||
<div class="document">
|
||
|
||
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
||
<div class="sphinxsidebarwrapper">
|
||
<p class="logo"><a href="index.html">
|
||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
|
||
</a></p>
|
||
<p class="logo">
|
||
<a href="index.html">
|
||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
|
||
|
||
</a>
|
||
</p>
|
||
|
||
|
||
|
||
<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<search id="searchbox" style="display: none" role="search">
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
|
||
<input type="submit" value="Go" />
|
||
</form>
|
||
</div>
|
||
</search>
|
||
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
||
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
||
<ul class="current">
|
||
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
|
||
<li class="toctree-l1 current"><a class="current reference internal" href="#">13. How to use this briefing</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
|
||
</ul>
|
||
|
||
<div class="relations">
|
||
<h3>Related Topics</h3>
|
||
<ul>
|
||
<li><a href="index.html">Documentation overview</a><ul>
|
||
<li>Previous: <a href="checklist.html" title="previous chapter"><span class="section-number">12. </span>Audit-ready checklist</a></li>
|
||
<li>Next: <a href="bio-james-garfinkel.html" title="next chapter"><span class="section-number">14. </span>James H. Garfinkel</a></li>
|
||
</ul></li>
|
||
</ul>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
|
||
|
||
<div class="body" role="main">
|
||
|
||
<section id="how-to-use-this-briefing">
|
||
<h1><span class="section-number">13. </span>How to use this briefing<a class="headerlink" href="#how-to-use-this-briefing" title="Link to this heading">¶</a></h1>
|
||
<ol class="arabic simple">
|
||
<li><p>Read the <strong>executive summary</strong> aloud in the first five
|
||
minutes of any vendor, board, or auditor meeting that
|
||
touches this system. If anyone says “so we are certified,”
|
||
stop and reread Chapter 1.</p></li>
|
||
<li><p>Read <strong>What Verae provides</strong> so the five verbs (store,
|
||
communicate, timestamp, verify, audit) are not confused
|
||
with an ISMS, a Type II, or a HIPAA program.</p></li>
|
||
<li><p>Read the <strong>transit</strong>, <strong>rest</strong>, <strong>receipts</strong>, <strong>Peergos
|
||
evaluations</strong>, <strong>timestamping</strong>, and <strong>Iceberg</strong> chapters
|
||
in that order. They are the technical portion, in the
|
||
order an examiner usually probes: “can the wire read it,
|
||
can the disk read it, can you prove when, who looked at
|
||
the crypto, can you produce it later.”</p></li>
|
||
<li><p>Fill the <strong>checklist</strong> with <strong>this instance’s</strong> evidence.
|
||
Empty checkboxes are not a moral failing; they are the
|
||
work remaining.</p></li>
|
||
<li><p>Give <strong>BAAs and DPAs</strong> to counsel with the architecture
|
||
diagram. Do not let engineering declare a vendor “not a
|
||
BA.”</p></li>
|
||
<li><p>Attach the two <strong>public</strong> Peergos reports as <strong>vendor
|
||
security evaluations</strong>, with a cover slip that says they
|
||
are not the organization’s SOC 2, ISO 27001, or HIPAA
|
||
certification.</p></li>
|
||
<li><p>Point auditors at <strong>live technical surfaces</strong> (health,
|
||
public-key listing, Drive). Do not give them private
|
||
keys. Do not give them a story that the pentest PDF is
|
||
the Type II.</p></li>
|
||
<li><p>Keep the <strong>biographies</strong> at the back of the PDF for
|
||
provenance — who built the timestamping science, who
|
||
is building the product, who architected the internet
|
||
integration and the DataCube server side — without
|
||
substituting biography for controls.</p></li>
|
||
</ol>
|
||
<p>Reference instance (not a certificate):</p>
|
||
<ul class="simple">
|
||
<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
|
||
<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a> (public keys only)</p></li>
|
||
<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
|
||
<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/custody.html">https://docs.pfc.georgelambert.org/custody.html</a></p></li>
|
||
<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes">https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes</a></p></li>
|
||
<li><p><a class="reference external" href="https://www.verae.com">https://www.verae.com</a></p></li>
|
||
</ul>
|
||
</section>
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="verae-page-footer">
|
||
<strong>Verae Inc</strong>
|
||
· <a href="https://www.verae.com">https://www.verae.com</a>
|
||
· Book a call at <a href="https://www.verae.com">verae.com</a>
|
||
· <a href="https://app.verae.com">app.verae.com</a>
|
||
</div>
|
||
|
||
<div class="footer">
|
||
©2026, Verae Inc.
|
||
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
</body>
|
||
</html> |