Trust Center / Security Controls
The evidence
Security controls
The control families an enterprise review evaluates — mapped to how B5 Secure actually enforces them through the Never Trust pipeline, B5SecurityKit on .NET 10, and Azure platform services. Each family lists representative controls and the frameworks they satisfy.
01Identity & Access Control
- Zero assumed trust: every request — human session, service key, or background job — is authenticated and authorized through a single pipeline. There are no internal-only exemptions or undocumented switches.
- Adaptive multi-factor authentication enforced as policy, with phishing-resistant passkeys / FIDO2 and selective, risk-based exemptions.
- Passwords stored with PBKDF2 salted hashing; the algorithm is swappable so defenses keep pace with hardware.
- Least-privilege permits scoped to the action and the specific record and fields it touches, with conventions deriving permission codes and flagging sensitive data automatically.
- Per-identity IP firewall binds sensitive credentials to known networks; key-leakage protection stops API keys used from browsers or non-allow-listed addresses.
- Administrative impersonation and account transfer are the highest-trust actions — guard-railed, time-bound, and fully logged.
Maps to: NIST CSF PR.AA · ISO 27001 A.5.15-A.5.18 / A.8.2-A.8.5 · SOC 2 CC6.1-CC6.3
02Encryption & Key Management
- TLS 1.3 in transit; AES-256 at rest with customer-managed keys (CMK) and envelope encryption.
- Signing and key-wrapping keys are generated and held in a FIPS 140-3 Level 3 Azure Managed HSM and never leave the hardware boundary; the platform signs by reference.
- The HSM security domain is split across a quorum of key holders via Shamir secret sharing — no single person can export or recover key material.
- Rotation is policy-driven, not manual; key lifecycle and access are audited.
- Crypto-agility: primitives are resolved at runtime, not hard-coded, so migration to post-quantum ML-KEM (FIPS 203) and ML-DSA (FIPS 204) is configuration, not re-architecture.
Maps to: NIST SP 800-57 · FIPS 140-3 / 203 / 204 · ISO 27001 A.8.24 · SOC 2 CC6.1
03Application & Product Security
- Secure SDLC aligned to NIST SSDF: SAST, DAST, dependency, secret, container, and IaC scanning run in CI on every change.
- Request integrity via RFC 9421 HTTP Message Signatures and HMAC — a keyed signature over the canonical request with timestamp-expiry and nonce-based replay defense.
- XSS detection and context-aware output encoding wherever untrusted data lands: API payloads, email, and front- and back-end rendering.
- Professional error handling that gives engineers full diagnostics and attackers nothing useful.
- Signed build artifacts, SBOM generation, and build-provenance attestation targeting SLSA Level 3.
Maps to: NIST SP 800-218 (SSDF) · OWASP ASVS / Top 10 · ISO 27001 A.8.25-A.8.28 · SOC 2 CC8.1
04Infrastructure & Network Security
- Deny-by-default segmentation with a static IP allow-list as the strict core, layered with an adaptive identity firewall (geo / ASN rules, auto-expiring threat-intel deny feeds, per-identity rate limits, device signals).
- Confidential computing — AMD SEV-SNP and Intel TDX enclaves — protects data in use for the most sensitive operations.
- Hardware root of trust and remote attestation; all secrets held in Azure Key Vault, never in source or configuration.
- Dependencies pinned and hashed; audited packages preferred; inbound and outbound network access locked down.
Maps to: NIST CSF PR.IR · ISO 27001 A.8.20-A.8.23 · CIS Controls v8 · SOC 2 CC6.6
05Monitoring, Logging & Detection
- Every request is logged with the signals needed to surface replay attempts, credential abuse, and phishing call-backs.
- Microsoft Sentinel (SIEM) and Defender XDR correlate, alert, and hunt across identity, endpoint, and cloud signals.
- Continuous Access Evaluation revokes active sessions in near-real-time when risk or policy changes.
- Audit trails are tamper-evident, retained per policy, and made available to authorized reviewers.
Maps to: NIST CSF DE.CM / DE.AE · ISO 27001 A.8.15-A.8.16 · SOC 2 CC7.2-CC7.3
06Vulnerability & Threat Management
- Continuous dependency and container scanning with severity-prioritized remediation SLAs.
- Third-party penetration testing annually and on major release; an executive summary is available under NDA.
- GitHub Advanced Security with code scanning and secret scanning across repositories.
- A coordinated vulnerability disclosure program with safe-harbor terms (see Disclosure).
Maps to: NIST CSF ID.RA · ISO 27001 A.8.8 · SOC 2 CC7.1 · CIS Controls v8
07Business Continuity & Recovery
- Active-active multi-region architecture with automated failover; a cyber-recovery vault provides ransomware resilience.
- Recovery objectives: RPO < 5 minutes and RTO < 30 minutes for critical services.
- Backups are encrypted, region-redundant, and restore-tested on a schedule.
- The BCP / DR plan is documented and exercised at least annually.
Maps to: NIST CSF RC.RP / RC.CO · ISO 27001 A.5.29-A.5.30 · SOC 2 A1.2-A1.3
08Risk, Vendor & Personnel
- A documented risk-assessment process with periodic review, treatment tracking, and management ownership.
- Subprocessor due diligence and a maintained, published subprocessor register.
- Personnel background screening, least-privilege provisioning, and prompt deprovisioning on role change or exit.
- Annual security-awareness training and a policy suite covering acceptable use, access control, incident response, and data retention.
Maps to: NIST CSF GV.SC / GV.RM · ISO 27001 A.5.19-A.5.23 / A.6 · SOC 2 CC1 / CC9.2
Want the control matrix mapped to your framework?
We’ll share a control-mapping matrix against SOC 2, ISO 27001, or NIST CSF 2.0 under NDA — or complete your SIG / CAIQ directly.