Implemented
4
Visibly demonstrated in this synthetic MVP
Partial
5
Some demo evidence; enforcement still conceptual
Planned
3
Documented design or roadmap only
Control catalogue
Mappings are illustrative for a portfolio demonstration and are not an assessment, audit result or certification. Where no direct SP 800-171 Rev. 3 requirement exists, the mapping says so rather than force-fitting one.
| ID | Control | Description | NIST CSF 2.0 | NIST SP 800-171 Rev. 3 | MVP status | Evidence |
|---|---|---|---|---|---|---|
| CTL-01 | Role-based access control | Access to platform functions is granted by role (Admin, Security Analyst, Auditor, Viewer) using least-privilege defaults. | PR.AA | 03.01.02 / 03.01.05 | partial | Role model and role-scoped UI evidence; server-side enforcement deferred (no auth backend). |
| CTL-02 | Centralized audit logging | Security-relevant actions are recorded with actor, role, action, entity, result and source address. | DE.CM | 03.03.02 / 03.03.03 | partial | Synthetic Audit Log view demonstrates event content; append-only persistent backend deferred (ADR-004). |
| CTL-03 | Encryption in transit | Client and service-to-service traffic uses TLS 1.2+ with modern cipher suites. | PR.DS | 03.13.08 | partial | Host platform provides HTTPS for the demo; internal/service TLS and mTLS remain target design. |
| CTL-04 | Encryption at rest | Managed database and object storage encryption using provider KMS-backed keys. | PR.DS | 03.13.08 / 03.13.10 | planned | No persistence layer exists in the MVP; documented as target architecture. |
| CTL-05 | Secrets management | No secrets in source control; runtime secrets injected from a managed secret store. | PR.PS | 03.13.11 | partial | Repository contains no committed secrets; managed secret store and rotation are future design. |
| CTL-06 | Input validation (secure engineering practice) | Inbound payloads are schema-validated before use; rejected input is surfaced rather than coerced. | PR.PS | 03.16.01 (security engineering principles) | implemented | Zod schemas in src/lib/triage.ts with unit tests in src/lib/__tests__. |
| CTL-07 | Vulnerability management SLA | Findings are tracked to an owner with severity-based remediation deadlines. | ID.RA | 03.11.02 | partial | Vulnerabilities view with SLA tracking; external scanner ingestion is absent. |
| CTL-08 | Incident response workflow | Incidents move through new, triage, contained, resolved with an assigned analyst. | RS.MA | 03.06.01 | implemented | Incidents view and linked remediation tasks demonstrated in the MVP. |
| CTL-09 | Asset inventory | Inventory of system components with owner, environment, risk score and last-seen time. | ID.AM | 03.04.10 | implemented | Assets view with owner, environment and last-seen tracking in the MVP. |
| CTL-10 | Human review of AI output | AI-assisted triage output is advisory only and requires analyst acknowledgement. | GV.RM | N/A — not a direct 800-171 requirement | implemented | AI Triage panel labels output simulated, blocks autonomous action, requires acknowledgement. |
| CTL-11 | Continuous monitoring | Telemetry from endpoints and cloud control planes is centrally collected and analysed. | DE.CM | 03.14.06 | planned | Synthetic data only; no collection or streaming pipeline exists. |
| CTL-12 | Separation of duties | Auditors can read evidence but cannot change records; admins cannot alter audit history. | PR.AA | 03.01.04 | planned | Documented role model; no authenticated backend exists to enforce it. |