Coverage & Assessment Methodology
This page exists to answer one question continuously: "what are we still not looking at?" Gaps should be visible here, not discovered reactively. It tracks (1) which assessment methods have been run, (2) how the 20 domains map to recognized frameworks, and (3) where coverage is still thin.
Owner: Sekhar Prakash · Last updated: 2026-06-25
Why a posture can look "done" but isn't
The iteration-1 findings came primarily from a manual code review. That method finds logic/authorization/injection flaws but is blind to whole categories — known-CVE dependencies, leaked secrets, image vulns, cloud misconfig. Each method not yet run is a source of "surprise" gaps. The fix is to run every lens and keep this matrix honest.
Progress: 5 of 9 lenses run (manual review, SCA/dependencies, container image, secret scanning, IaC). The remaining four — SAST, DAST, CSPM, and the independent pentest — are the current blind spots; expect new findings as each is run. SAST and the pentest are the highest-value next steps (and the two that need a tooling/vendor decision).
Assessment-method coverage
| Lens | What it catches | Tooling | Status |
|---|---|---|---|
| Manual code review | Logic, authz, injection, design flaws | Human | 🟢 done (iteration 1) |
| SCA — dependencies | Known-CVE vulnerable packages | bun audit / Snyk OSS | 🟠 ran ad-hoc (190 found — blitz 97, blitz-ui 93; now authoritative vs committed lockfiles, F-36). Lockfile guard in CI; the bun audit gate itself still pending (fin-infra#40) |
| SAST — code | Vulnerable code patterns at scale | CodeQL / Semgrep | 🔴 never run |
| Secret scanning | Leaked keys (incl. git history) | gitleaks + GitHub secret scanning | 🟠 ran ad-hoc (history: blitz 39 hits, blitz-ui 8, fin-infra 0 — real GCP keys committed → rotate; rest mostly generated/template FPs); not in CI (blitz#1019, blitz-ui#668) |
| IaC scanning | AWS/Terraform misconfig | tfsec / checkov / Snyk IaC | 🟠 ran ad-hoc (Snyk IaC: 0 critical/high, 3 medium — SG open-ingress ×2, RDS IAM auth off); deeper tfsec/checkov + CI pending (fin-infra#40) |
| Container image scan | OS/base-image CVEs | Trivy / Grype / docker scout | 🟠 ran ad-hoc (base images: oven/bun:slim 1C/7H, debian:bookworm-slim 1C/2H — openssl/glibc/perl; images unpinned); not in CI (fin-infra#35) |
| DAST — runtime | Exposed-surface / runtime bugs | OWASP ZAP | 🔴 never run |
| Cloud posture (CSPM) | Live AWS misconfig | Prowler / Security Hub | 🔴 not enabled (pre-prod) |
| Independent penetration test | What all internal methods miss | 3rd-party firm | 🔴 not scheduled (fin-infra#39) |
Dependabot caveat: enabled on blitz/blitz-ui but it does not parse
bun.lock— it reports ~4 alerts vs the 190bun auditfinds. Do not treat Dependabot as SCA coverage for this stack.
Domain → framework mapping
Confirms the 20 domains aren't ad hoc — they cover the recognized control sets. Use this when answering a SOC 2 / ISO / customer questionnaire.
| # | Domain | SOC 2 (TSC) | ISO 27001:2022 | CIS v8 | OWASP |
|---|---|---|---|---|---|
| 1 | Governance & Risk | CC1, CC3 | A.5 | 17 | — |
| 2 | Data Security & Privacy | C1, P | A.5.34, A.8.10-12 | 3 | — |
| 3 | Edge & Network | CC6.6 | A.8.20-22 | 12, 13 | — |
| 4 | IAM (incl. RBAC) | CC6.1-3 | A.5.15-18, A.8.5 | 5, 6 | A01, A07 |
| 5 | Application Security | CC7.1, CC8.1 | A.8.25-28 | 16 | A03, A04 |
| 6 | API Security | CC6.6, CC7.1 | A.8.26 | 16 | API Top 10 |
| 7 | Tenant Isolation | CC6.1 | A.8.4 | 3, 4 | A01 |
| 8 | Supply Chain | CC7.1, CC8.1 | A.8.28-30 | 2, 16 | A06, A08 |
| 9 | Cloud & Infra | CC6, CC7 | A.8.9 | 4, 12 | A05 |
| 10 | Container & Runtime | CC7.1 | A.8.9 | 4 | A05 |
| 11 | Monitoring & Detection | CC7.2-3 | A.8.15-16 | 8 | A09 |
| 12 | Incident Response | CC7.4-5 | A.5.24-28 | 17 | — |
| 13 | Business Continuity & DR | A1 | A.5.29-30, A.8.13-14 | 11 | — |
| 14 | Secure SDLC & DevSecOps | CC8.1 | A.8.25-31 | 16 | — |
| 15 | Compliance & Audit | CC2, CC4 | A.5.31-36 | — | — |
| 16 | Financial Data Integrity | PI1 | A.8.3 | — | A08 |
| 17 | Business Logic | PI1 | A.8.26 | — | A04 |
| 18 | Vendor & Sub-processor Risk | CC9.2 | A.5.19-23 | 15 | — |
| 19 | Endpoint Security | CC6.7 | A.8.1, A.8.7 | 1, 4, 10 | — |
| 20 | People & Awareness | CC1.4, CC2 | A.6.1-8 | 14 | — |
Known residual / thin areas (watchlist)
Even at 20 domains, these are partially-covered and worth explicit attention before a SOC 2 / enterprise review — listed so they're not "missed":
- Cryptography standard — approved algorithms, TLS versions, key lifecycle (spread across Domains 2 & 9; no single standard).
- Change management / secure-config baselines — CIS benchmarks for containers/OS (touched by Domain 14/22-equivalent; not formalized).
- Continuous CSPM — beyond Day-1 detection (Domain 9/11); conformance packs not enabled (pre-prod).
- Data inventory / RoPA — DPDP record of processing + data-flow map (partial in Domains 2 & 18).
- Backup integrity / ransomware recovery testing — restore drills not evidenced (Domain 13).
How completeness is maintained
- Run the unrun lenses (SAST, DAST, CSPM) and wire the run ones (SCA, secret, IaC, image) into CI — tracked in fin-infra#40. Each ad-hoc 🟠 becomes 🟢 once gated in CI.
- The pentest (fin-infra#39) is the backstop for whatever internal methods miss.
- SOC 2 readiness mapping (above) is re-checked each review; any control with no home becomes a new domain or finding.
- This page is updated every quarterly review and whenever a new assessment method is run.