Control matrix¶
Status values: planned · implemented · verified (evidence exists and is repeatable).
| ID | Reference (maps to) | Control | Implementation | Evidence | Status |
|---|---|---|---|---|---|
| CM-01 | DORA Art. 9(4)(e) (ICT change management); ISO 27001 A.8.32 | Every change is a reviewed, attributable commit that passed CI | Pull requests only; ruleset protect-main with required checks, no bypass; managed as code in infra/stacks/github/ |
git log; PR history; rejected direct push (GH013); drift test on repository settings |
implemented |
| CM-02 | DORA Art. 6 (documented ICT risk framework); ISO 27001 A.5.37 | Architecture decisions are recorded with alternatives | ADRs in docs/adr/ |
ADR index | implemented |
| CM-03 | DORA Art. 9(4)(e); ISO 27001 A.8.9 | Cluster state changes only through Git (no manual drift) | Argo CD automated sync with self-heal | Manually deleted Deployment restored in ~5 s (Phase 1 test) | implemented |
| SEC-01 | ISO 27001 A.5.17 (authentication information) | No secrets committed to the repository | gitleaks pre-commit hook, GitHub push protection, full-history scan in CI | task secrets:scan; secrets job in .github/workflows/ci.yml |
implemented |
| SEC-02 | ISO 27001 A.8.24 (use of cryptography) | Encrypt data in transit | Kafka TLS listeners, Gateway TLS via cert-manager | Phase 2-3 | planned |
| SEC-03 | ISO 27001 A.5.15 / A.8.3 (access control); DORA Art. 9(4)(c) | Least-privilege access to event streams | Kafka SCRAM users and ACLs per service | Phase 3 | planned |
| SEC-04 | ISO 27001 A.8.9 (configuration management) | Secure workload configuration baseline | Kyverno policies (Audit → Enforce) | Phase 2 | planned |
| SEC-05 | ISO 27001 A.5.21 (ICT supply chain) | Third-party code is content-addressed | CI actions and pre-commit hooks pinned by commit SHA; OpenTofu providers locked by hash; images pinned by digest | .github/workflows/ci.yml, .pre-commit-config.yaml, infra/**/.terraform.lock.hcl |
implemented |
| REC-01 | MiFIR Art. 25; RTS 24 | Order and trade records retained and retrievable | Audit tables in ClickHouse, retention per data class | Phase 4 | planned |
| REC-02 | MiFIR Art. 25; ISO 27001 A.8.15 | Audit records are tamper-evident | Append-only storage, hash chaining / object lock | Phase 4 | planned |
| LOG-01 | ISO 27001 A.8.15 (logging); DORA Art. 10 (detection) | Security and access logs retained with defined periods | Log pipeline with retention tiers | Phase 2 | planned |
| PII-01 | GDPR Art. 5(1)(c) data minimisation; Art. 32 pseudonymisation | Personal data classified and masked where not needed | Schema tags + field masking | Phase 4 | planned |
| MKT-01 | MiFID II Art. 48(5); RTS 11 | Pre-trade controls: tick sizes and price corridors with volatility interruptions | Order entry and matching engine rules | Phase 4 | planned |
| TIME-01 | RTS 25 | Event timestamps in UTC with microsecond granularity | Event schemas and producers | Phase 4 | planned |
| SUR-01 | MAR Art. 16 | Detect suspicious order patterns (e.g. spoofing, wash trades) | Surveillance consumer | Phase 4 | planned |
| RES-01 | DORA Art. 12 (backup, restoration and recovery) | Backups with tested restore | Backup tooling + restore drill | Phase 7 | planned |
| RES-02 | DORA Art. 24-25 (resilience testing) | HA/DR scenarios exercised with measured RPO/RTO | Chaos Mesh + DR drills | DR catalogue, Phase 7 | planned |
| OPS-01 | ISO 27001 A.8.8 (vulnerability management) and A.8.32 | Components have documented upgrade and maintenance plans | docs/operations/ |
Phase 8 | planned |