{ "summary": { "productionIdentityProviders": 2, "enabledProductionIdentityProviders": 0, "routeAuthorizationPolicies": 6, "entitlementReviews": 0, "finalizedEntitlementReviews": 0, "verifiedAuditReplications": 0, "keyRotationEvents": 0, "openVulnerabilities": 0, "criticalVulnerabilities": 0, "approvedAttestations": 0, "frameworks": 3, "controls": 8, "readiness": { "score": 70, "tier": "Conditional", "blockers": [], "warnings": [ { "code": "NO_FINALIZED_ENTITLEMENT_REVIEW", "message": "No finalized entitlement review is recorded." }, { "code": "NO_APPROVED_CONTROL_ATTESTATIONS", "message": "No independently reviewed control attestation is approved." } ], "controlCoveragePct": 0, "certificationClaimed": false }, "certificationClaimed": false, "snapshotHash": "18340f1c3ffd394c0899308deb86fc5e066e07adecf4e165ae171b8740063b9f" }, "productionIdentityProviders": [ { "id": "idp_oidc_production", "name": "Production OIDC Boundary", "protocol": "OIDC", "enabled": false, "issuer": "", "discoveryUrl": "", "audience": "hdp-mba-agent", "clientIdReference": "HDP_OIDC_CLIENT_ID", "clientSecretReference": "HDP_OIDC_CLIENT_SECRET", "jwksJsonReference": "HDP_OIDC_JWKS_JSON", "jwksCacheMinutes": 60, "requiredClaims": [ "sub", "iss", "aud", "exp" ], "mfaClaim": "amr", "allowedMfaValues": [ "mfa", "otp", "hwk", "fido" ], "storesCredentialValues": false, "status": "NOT_CONNECTED", "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "7dbb1eca976495594d5ee8ad21b1f5070db65ae6d2ef514e19c75bb0777ad579" }, { "id": "idp_saml_production", "name": "Production SAML Boundary", "protocol": "SAML2", "enabled": false, "entityId": "hdp-mba-agent", "metadataUrl": "", "certificateReference": "HDP_SAML_IDP_CERTIFICATE", "requiredAttributes": [ "NameID" ], "mfaAttribute": "AuthnContextClassRef", "storesCredentialValues": false, "status": "NOT_CONNECTED", "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "c415dfb7fdc1b62531138ee8c753f05d545f4d721619417723750383cfdf1e08" } ], "federatedIdentityLinks": [ { "id": "federated_link_harrison_oidc", "operatorId": "operator_harrison", "providerId": "idp_oidc_production", "externalSubject": "harrison-owner", "status": "ACTIVE", "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "5a093a451535ad289d0eaf9dc2be13185eedae6f6ff80ce9cee6cfd97cce82b3" } ], "routeAuthorizationPolicies": [ { "id": "route_policy_security_mutations", "name": "Security-control mutations", "methodPattern": "POST|PUT|DELETE", "pathPattern": "^/api/security/", "permission": "SECURITY_OPERATE", "minimumAssurance": "MFA", "environments": [ "env_development", "env_staging", "env_production" ], "snapshotHash": "e9a304a150d301f6a8f5d143b97fdacf064a9b563b6508b592199be93d11804a" }, { "id": "route_policy_compliance_mutations", "name": "Compliance-control mutations", "methodPattern": "POST|PUT|DELETE", "pathPattern": "^/api/compliance/", "permission": "COMPLIANCE_OPERATE", "minimumAssurance": "MFA", "environments": [ "env_development", "env_staging", "env_production" ], "snapshotHash": "651a07cebf254366027d2891dab89ba800003c16e16969f867d0ec466c18f1f5" }, { "id": "route_policy_privacy_mutations", "name": "Privacy-control mutations", "methodPattern": "POST|PUT|DELETE", "pathPattern": "^/api/privacy/", "permission": "COMPLIANCE_OPERATE", "minimumAssurance": "MFA", "environments": [ "env_development", "env_staging", "env_production" ], "snapshotHash": "e5787f7c42293485bd597602736cfc884ff16a894c4a9e7db8407b598e09dc19" }, { "id": "route_policy_production_deployment", "name": "Production deployment changes", "methodPattern": "POST|PUT|DELETE", "pathPattern": "^/api/(connector|deployment|promotion|rollback)", "permission": "PRODUCTION_CHANGE", "minimumAssurance": "PHISHING_RESISTANT_MFA", "environments": [ "env_production" ], "snapshotHash": "c6e0f0f0aa15a2224cf26b6bfc3000ce0cc2ee90db57d4bcc50684ca6a49ee00" }, { "id": "route_policy_exports", "name": "Governed exports", "methodPattern": "GET", "pathPattern": "^/api/export/", "permission": "REPORT_READ", "minimumAssurance": "SINGLE_FACTOR", "environments": [ "env_development", "env_staging", "env_production" ], "snapshotHash": "3146e82cd97f9083c6d7331d1f0022c8aaf21bd1965dbd6895c44cc574c4337c" }, { "id": "route_policy_all_mutations", "name": "All governed API mutations", "methodPattern": "POST|PUT|DELETE", "pathPattern": "^/api/", "permission": "MANAGEMENT_MUTATE", "minimumAssurance": "MFA", "environments": [ "env_development", "env_staging", "env_production" ], "snapshotHash": "a5d36e70493db125021ac2abe3d4b26db0a77aaf7dbc7310ce48d5a0f5f9df45" } ], "entitlementReviews": [], "auditReplicationSinks": [ { "id": "audit_sink_local_worm_boundary", "name": "Protected Audit Archive Boundary", "type": "LOCAL_APPEND_ONLY_BOUNDARY", "enabled": false, "locationReference": "HDP_AUDIT_REPLICATION_DIRECTORY", "signingKeyReference": "HDP_AUDIT_REPLICATION_SIGNING_KEY", "independentlyProtected": false, "storesSecretValues": false, "status": "NOT_CONFIGURED", "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "543f9571ba9e477cd2758ca3a6f2d53e19c9c3b71b6257bf06324315e244f118" }, { "id": "audit_sink_external_siem_boundary", "name": "External SIEM / Log Archive Boundary", "type": "HTTP_JSON", "enabled": false, "endpointReference": "HDP_AUDIT_REPLICATION_ENDPOINT", "credentialReference": "HDP_AUDIT_REPLICATION_TOKEN", "independentlyProtected": true, "storesSecretValues": false, "status": "NOT_CONNECTED", "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "34f61aa98ec71582797db6aa7bba309d8dca429d0009babc67307dbbee4a52ac" } ], "auditReplicationBatches": [], "keyRotationPolicies": [ { "id": "key_policy_backup", "name": "Backup encryption key rotation", "keyReference": "HDP_BACKUP_ENCRYPTION_KEY", "providerReference": "secret_provider_environment", "rotationDays": 90, "dualApprovalRequired": true, "storesKeyValue": false, "status": "ACTIVE", "lastRotatedAt": null, "nextDueAt": null, "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "cd13fde5e6e12e298c883ea8d7cc847e317ac919d94ee9db11bd82ddb26d41cd" }, { "id": "key_policy_callback", "name": "Connector callback secret rotation", "keyReferencePattern": "ENDPOINT_*_CALLBACK_SECRET", "providerReference": "secret_provider_environment", "rotationDays": 90, "dualApprovalRequired": true, "storesKeyValue": false, "status": "ACTIVE", "lastRotatedAt": null, "nextDueAt": null, "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "7968b853a99194966c3178b164ea13b954797d415938c11bb02d538335fad4ed" } ], "keyRotationEvents": [], "vulnerabilityScans": [], "vulnerabilityFindings": [], "securityAttestations": [], "complianceFrameworks": [ { "id": "framework_soc2", "name": "SOC 2 Trust Services Criteria", "version": "2017 with current AICPA points of focus boundary", "status": "REFERENCE_MAPPING_ONLY", "certificationClaimed": false, "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "3cf293d56e57c38a9daccecdb22ddaff167f16f3f771693728683ba438ce0af6" }, { "id": "framework_nist_csf", "name": "NIST Cybersecurity Framework", "version": "2.0", "status": "REFERENCE_MAPPING_ONLY", "certificationClaimed": false, "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "861536d58750f10b32c619b2f593b3b2a67a08f657e1d7f8a108a480ffc38ac4" }, { "id": "framework_iso27001", "name": "ISO/IEC 27001", "version": "2022", "status": "REFERENCE_MAPPING_ONLY", "certificationClaimed": false, "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "7116253dcba7ae915abec4e24a67b8b0a0f74fefc9aecf50dbf4a8954b62153f" } ], "complianceControls": [ { "id": "control_identity_federation", "name": "Federated identity and MFA", "domain": "ACCESS_CONTROL", "ownerRoleId": "role_governance_lead", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC6.1", "framework_nist_csf:PR.AA", "framework_iso27001:A.5.16" ], "evidenceCollections": [ "identityProviders", "operators", "operatorSessions" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "c6b1eec1437aa33ac1da4e5ea8652607518f402bd1341d3d55699a8a78dabdd4" }, { "id": "control_route_authorization", "name": "Route-level authorization", "domain": "ACCESS_CONTROL", "ownerRoleId": "role_governance_lead", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC6.3", "framework_nist_csf:PR.AA-05", "framework_iso27001:A.8.3" ], "evidenceCollections": [ "routeAuthorizationPolicies", "accessRoles", "accessAssignments" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "0a0aea926c11b90453001cfd3aa7704eeffd860509065cdb3a895cf628e646ba" }, { "id": "control_entitlement_review", "name": "Periodic entitlement review", "domain": "ACCESS_REVIEW", "ownerRoleId": "role_owner", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC6.2", "framework_nist_csf:GV.RR", "framework_iso27001:A.5.18" ], "evidenceCollections": [ "entitlementReviews" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "d1650cdfd767343e31da61e40c12029af78485194690f17ae50da13f4dfe2cbc" }, { "id": "control_audit_replication", "name": "Protected audit replication", "domain": "LOGGING", "ownerRoleId": "role_governance_lead", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC7.2", "framework_nist_csf:DE.CM", "framework_iso27001:A.8.15" ], "evidenceCollections": [ "securityAuditEntries", "auditReplicationBatches" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "3fbe6818d98c42c4d8c1e8dff33aad05d1ae844f79a1f927613825e3d9a43172" }, { "id": "control_key_rotation", "name": "Cryptographic key rotation", "domain": "CRYPTOGRAPHY", "ownerRoleId": "role_governance_lead", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC6.1", "framework_nist_csf:PR.DS", "framework_iso27001:A.8.24" ], "evidenceCollections": [ "keyRotationPolicies", "keyRotationEvents" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "eb1b5bac80cee4e0ce7d777367aa1d909956bdb9429ba6518bd7cc96e1be9e7d" }, { "id": "control_vulnerability_management", "name": "Vulnerability management", "domain": "VULNERABILITY", "ownerRoleId": "role_product_lead", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC7.1", "framework_nist_csf:ID.RA-01", "framework_iso27001:A.8.8" ], "evidenceCollections": [ "vulnerabilityScans", "vulnerabilityFindings" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "10f3c45995f576ef46210fdab56980eb6bca38351b6c82473dfc400558686ebf" }, { "id": "control_control_attestation", "name": "Control owner attestation", "domain": "GOVERNANCE", "ownerRoleId": "role_owner", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:CC1.2", "framework_nist_csf:GV.OV", "framework_iso27001:A.5.35" ], "evidenceCollections": [ "securityAttestations" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "eb117f477075cbde16136101f700cc874495de9e129b0ee4b025a62e0f275636" }, { "id": "control_backup_restore", "name": "Encrypted backup and restore testing", "domain": "RESILIENCE", "ownerRoleId": "role_governance_lead", "status": "DESIGNED", "testFrequencyDays": 90, "mappings": [ "framework_soc2:A1.2", "framework_nist_csf:RC.RP", "framework_iso27001:A.8.13" ], "evidenceCollections": [ "backupRecords", "restoreTests" ], "exceptions": [], "createdAt": "2026-07-20T13:05:23.770Z", "updatedAt": "2026-07-20T13:05:23.770Z", "snapshotHash": "73454ab54637c82d79a63d7b6ad84769872ad95d747ec14d67ae7e43f9ed1efa" } ] }