Coverage & Assessment Methodology
| Owner | Classification | Version | Effective | Next review | Status |
|---|---|---|---|---|---|
| Sekhar Prakash | Internal | 1.1 | 2026-06-25 | 2026-11-27 | Active |
This page exists to answer one question continuously: "what are we still not looking at?" Gaps should be visible here, not discovered reactively. It tracks:
- Which assessment methods have been run.
- How the 20 domains map to recognized frameworks.
- Where coverage is still thin.
Why a posture can look "done" but isn't
- The iteration-1 findings came primarily from a manual code review.
- That method finds logic/authorization/injection flaws but is blind to whole categories:
- known-CVE dependencies
- leaked secrets
- image vulns
- cloud misconfig
- Each method not yet run is a source of "surprise" gaps. The fix is to run every lens and keep this matrix honest.
Progress: 5 of 9 lenses run:
manual review
SCA/dependencies
container image
secret scanning
IaC
Remaining four (current blind spots) — expect new findings as each is run:
- SAST
- DAST
- CSPM
- the independent pentest
Highest-value next steps: SAST and the pentest — also the two that need a tooling/vendor decision.
Assessment-method coverage
| Lens | What it catches | Tooling | Status |
|---|---|---|---|
| Manual code review | Logic, authz, injection, design flaws | Human | 🟢 done (iteration 1) |
| SCA — dependencies | Known-CVE vulnerable packages | bun audit / Snyk OSS | 🟠 166 found as of 2026-09-15 — blitz 5 (F-29, down from 97), blitz-ui 161 (F-30, ⚠️ up from 93; 4 critical). Counts are authoritative vs the committed lockfiles (F-36); see the register for per-repo detail. Dependabot enabled but blind to bun.lock — sees only 8 (xlsx/SheetJS, see caveat below). bun audit now runs weekly, non-blocking in each repo's Dependency Health workflow; it is not a merge gate. Full CI control state: Control Register. Programme tracking: fin-infra#40 |
| SAST — code | Vulnerable code patterns at scale | CodeQL / Semgrep | 🔴 never run |
| Secret scanning | Leaked keys (incl. git history) | gitleaks + GitHub secret scanning | 🟠 ran ad-hoc (history: blitz 39 hits, blitz-ui 8, fin-infra 0 — one real GCP key committed in both repos (same credential, verified by hash — F-34/F-35) → rotate once; rest mostly generated/template FPs); not in CI (blitz#1019, blitz-ui#668) |
| IaC scanning | AWS/Terraform misconfig | tfsec / checkov / Snyk IaC | 🟠 ran ad-hoc (Snyk IaC: 0 critical/high, 3 medium — SG open-ingress ×2, RDS IAM auth off); deeper tfsec/checkov + CI pending (fin-infra#40) |
| Container image scan | OS/base-image CVEs | Trivy / Grype / docker scout | 🟠 ran ad-hoc (base images: oven/bun:slim 1C/7H, debian:bookworm-slim 1C/2H — openssl/glibc/perl; images unpinned); not in CI (fin-infra#35) |
| DAST — runtime | Exposed-surface / runtime bugs | OWASP ZAP | 🔴 never run |
| Cloud posture (CSPM) | Live AWS misconfig | Prowler / Security Hub | 🔴 not enabled (pre-prod) |
| Independent penetration test | What all internal methods miss | 3rd-party firm | 🔴 not scheduled (fin-infra#39) |
Dependabot caveat (re-checked 2026-08-06) — do not treat as SCA coverage
- Enabled on all three repos, but Dependabot does not parse
bun.lock— it only readspackage.jsonmanifests. - So it surfaces 8 alerts (blitz 4, blitz-ui 4, fin-infra 0), all the same two
xlsx/SheetJS advisories — GHSA-5pgg-2g8v-p4x9 (ReDoS) and GHSA-4r6h-8v6p-xvw6 (prototype pollution), both High — versus 166 frombun auditagainst the full committed tree (2026-09-15). - Gaps to close: (1) no
dependabot.ymlin any repo → no update schedule / auto security-update PRs; (2) thexlsxalerts have no clean npm upgrade (SheetJS moved fixes to their own CDN) → repin to the vendor CDN build or migrate offxlsx. - Tracked under the SCA program (fin-infra#40); authoritative SCA numbers remain F-29/F-30.
Domain → framework mapping
Confirms the 20 domains aren't ad hoc — they cover the recognized control sets. Use when answering a SOC 2 / ISO / customer questionnaire.
| # | Domain | SOC 2 (TSC) | ISO 27001:2022 | CIS v8 | OWASP |
|---|---|---|---|---|---|
| 1 | Governance & Risk | CC1, CC3 | A.5 | 17 | — |
| 2 | Data Security & Privacy | C1, P | A.5.34, A.8.10-12 | 3 | — |
| 3 | Edge & Network | CC6.6 | A.8.20-22 | 12, 13 | — |
| 4 | IAM (incl. RBAC) | CC6.1-3 | A.5.15-18, A.8.5 | 5, 6 | A01, A07 |
| 5 | Application Security | CC7.1, CC8.1 | A.8.25-28 | 16 | A03, A04 |
| 6 | API Security | CC6.6, CC7.1 | A.8.26 | 16 | API Top 10 |
| 7 | Tenant Isolation | CC6.1 | A.8.4 | 3, 4 | A01 |
| 8 | Supply Chain | CC7.1, CC8.1 | A.8.28-30 | 2, 16 | A06, A08 |
| 9 | Cloud & Infra | CC6, CC7 | A.8.9 | 4, 12 | A05 |
| 10 | Container & Runtime | CC7.1 | A.8.9 | 4 | A05 |
| 11 | Monitoring & Detection | CC7.2-3 | A.8.15-16 | 8 | A09 |
| 12 | Incident Response | CC7.4-5 | A.5.24-28 | 17 | — |
| 13 | Business Continuity & DR | A1 | A.5.29-30, A.8.13-14 | 11 | — |
| 14 | Secure SDLC & DevSecOps | CC8.1 | A.8.25-31 | 16 | — |
| 15 | Compliance & Audit | CC2, CC4 | A.5.31-36 | — | — |
| 16 | Financial Data Integrity | PI1 | A.8.3 | — | A08 |
| 17 | Business Logic | PI1 | A.8.26 | — | A04 |
| 18 | Vendor & Sub-processor Risk | CC9.2 | A.5.19-23 | 15 | — |
| 19 | Endpoint Security | CC6.7 | A.8.1, A.8.7 | 1, 4, 10 | — |
| 20 | People & Awareness | CC1.4, CC2 | A.6.1-8 | 14 | — |
Known residual / thin areas (watchlist)
Even at 20 domains, these are partially-covered and worth explicit attention before a SOC 2 / enterprise review — listed so they're not "missed".
- Cryptography standard — approved algorithms, TLS versions, key lifecycle (spread across Domains 2 & 9; no single standard).
- Change management / secure-config baselines — CIS benchmarks for containers/OS (touched by Domain 14/22-equivalent; not formalized).
- Continuous CSPM — beyond Day-1 detection (Domain 9/11); conformance packs not enabled (pre-prod).
- Data inventory / RoPA — DPDP record of processing + data-flow map (partial in Domains 2 & 18).
- Backup integrity / ransomware recovery testing — restore drills not evidenced (Domain 13).
How completeness is maintained
- Run the unrun lenses (SAST, DAST, CSPM) and wire the run ones (SCA, secret, IaC, image) into CI — tracked in fin-infra#40. Each ad-hoc 🟠 becomes 🟢 once gated in CI.
- The pentest (fin-infra#39) is the backstop for whatever internal methods miss.
- SOC 2 readiness mapping (above) is re-checked each review; any control with no home becomes a new domain or finding.
- This page is updated every quarterly review and whenever a new assessment method is run.
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | 2026-06-25 | Sekhar Prakash | Assessment-method matrix and domain-to-framework mapping established. |
| 1.1 | 2026-08-06 | Sekhar Prakash | SCA/Dependabot coverage re-checked; lens progress updated. |
Finaisse Internal — Confidential. Not for external distribution.