| Control ID | Description | Status | Evidence | Recommendation |
|---|---|---|---|---|
| CC6.1 | Logical and physical access controls | Pass | Auth/WAF component found: True | — |
| CC6.6 | Encryption of data in transit (TLS) | Pass | TLS (port 443) detected: True. Non-encrypted (port 80) components: [] | — |
| CC7.2 | System monitoring and anomaly detection | Fail | Monitoring component found: False | Deploy monitoring (e.g. otel-collector, Prometheus) for anomaly detection. |
| A1.2 | Availability: redundancy and failover mechanisms | Partial | Components without redundancy: ['postgres-primary', 's3-document-store', 'kms-encryption']. Failover enabled: True | Add replicas >= 2 for critical components and enable failover on databases. |
| PI1.3 | Processing integrity: circuit breakers on dependencies | Partial | Circuit breakers: 4/24 edges | Enable circuit breakers on all dependency edges to prevent cascade failures. |
| Control ID | Description | Status | Evidence | Recommendation |
|---|---|---|---|---|
| A.17.1.1 | Planning information security continuity | Pass | DR region exists: True. Failover enabled: True | — |
| A.17.1.2 | Implementing redundancy for continuity | Partial | Components without redundancy: ['postgres-primary', 's3-document-store', 'kms-encryption'] | Add replicas >= 2 for: postgres-primary, s3-document-store, kms-encryption |
| A.17.2.1 | Availability of information processing facilities | Pass | Autoscaling enabled: True | — |
| A.10.1.1 | Policy on use of cryptographic controls | Pass | TLS detected: True. Non-encrypted components: [] | — |
| A.12.4.1 | Event logging and monitoring | Fail | Monitoring component found: False | Deploy centralized logging and monitoring (e.g. ELK, Prometheus). |
| A.9.1.1 | Access control policy | Pass | Auth/WAF component found: True | — |
| Control ID | Description | Status | Evidence | Recommendation |
|---|---|---|---|---|
| DORA-5.1 | ICT risk management framework documented | Pass | 12 components documented with 24 dependency mappings | — |
| DORA-5.2 | ICT asset inventory maintained | Pass | 12 components documented with 24 dependency mappings | — |
| DORA-5.3 | Business continuity procedures | Pass | CloudFront CDN: failover enabled (promotion time: 5.0s); CloudFront CDN: DR target region configured (eu-central-1); API Gateway: failover enabled (promotion time: 10.0s); API Gateway: DR target region configured (eu-central-1); Core Banking API 1: failover enabled (promotion time: 15.0s); Core Banking API 1: DR target region configured (eu-central-1); Core Banking API 2: failover enabled (promotion time: 15.0s); Core Banking API 3: failover enabled (promotion time: 15.0s); PostgreSQL Primary: failover enabled (promotion time: 30.0s); PostgreSQL Primary: DR target region configured (eu-central-1); PostgreSQL Replica: failover enabled (promotion time: 30.0s); PostgreSQL Replica: secondary region instance; Redis Session Cache: failover enabled (promotion time: 5.0s); Kafka Event Bus: failover enabled (promotion time: 10.0s) | — |
| DORA-5.4 | Recovery procedures validated | Pass | PostgreSQL Primary: failover enabled; PostgreSQL Replica: failover enabled; Redis Session Cache: failover enabled | — |
| DORA-6.1 | Component health monitoring | Partial | Log collection enabled on components | Address: No dedicated monitoring component (Prometheus, Datadog, etc.) |
| DORA-8.1 | Incident detection capabilities | Pass | Circuit breakers enabled: 4/24 dependency edges; Log collection enabled on components | — |
| DORA-8.2 | Incident classification procedures | Partial | Log collection enabled on components | Address: No dedicated monitoring component (Prometheus, Datadog, etc.) |
| DORA-11.1 | ICT concentration risk assessment | Partial | 3 SPOFs found out of 12 components | Address: SPOF: PostgreSQL Primary has 3 dependents with only 1 replica; Address: SPOF: S3 Document Store has 1 dependents with only 1 replica |
| DORA-11.2 | Third-party risk management | Pass | No external API dependencies detected | — |
| DORA-24.1 | Regular resilience testing | Partial | AWS WAF: 2 replicas; API Gateway: 2 replicas; Core Banking API 1: 3 replicas; Core Banking API 2: 3 replicas; Core Banking API 3: 3 replicas; PostgreSQL Replica: 2 replicas; Redis Session Cache: 3 replicas; Kafka Event Bus: 3 replicas | Address: PostgreSQL Primary: single instance (replicas=1) with 3 dependents; Address: S3 Document Store: single instance (replicas=1) with 1 dependents |
| DORA-24.2 | Test coverage documentation | Pass | 12 components documented with 24 dependency mappings | — |
| DORA-25.1 | Threat-led penetration testing | Pass | IDS monitoring: 1 components; WAF protection: 3 components; Backup enabled: 3 components | — |
| DORA-28.1 | Third-party provider assessment | Pass | No external API dependencies detected | — |
| DORA-28.2 | Exit strategy for critical providers | N/A | No external API dependencies - no exit strategy needed | — |
| DORA-30.1 | Information sharing arrangements | Partial | Log collection enabled on components | Address: No dedicated monitoring component (Prometheus, Datadog, etc.) |
| Control ID | Description | Status | Evidence | Recommendation |
|---|---|---|---|---|
| NIST-ID.AM-1 | Asset inventory | Pass | 12 components documented with 24 dependency mappings | — |
| NIST-ID.AM-2 | Software inventory | Pass | 12 components documented with 24 dependency mappings | — |
| NIST-PR.AC-1 | Identity and access management | Pass | Access control component: AWS WAF; Access control component: API Gateway; Authentication required flag enabled on components | — |
| NIST-PR.DS-1 | Data-at-rest protection | Partial | Encryption at rest: 9/12 components; Encryption in transit: 12/12 components, 5 using TLS (port 443) | Address: Not all components have encryption enabled |
| NIST-PR.DS-2 | Data-in-transit protection | Partial | Encryption at rest: 9/12 components; Encryption in transit: 12/12 components, 5 using TLS (port 443) | Address: Not all components have encryption enabled |
| NIST-DE.CM-1 | Network monitoring | Partial | Log collection enabled on components | Address: No dedicated monitoring component (Prometheus, Datadog, etc.) |
| NIST-DE.AE-3 | Event correlation | Pass | Logging enabled: 12/12 components; Audit logging tagged: 12/12 components | — |
| NIST-RS.MI-1 | Incident containment | Pass | Circuit breakers enabled: 4/24 dependency edges; Log collection enabled on components | — |
| NIST-RC.RP-1 | Recovery planning | Pass | CloudFront CDN: failover enabled (promotion time: 5.0s); CloudFront CDN: DR target region configured (eu-central-1); API Gateway: failover enabled (promotion time: 10.0s); API Gateway: DR target region configured (eu-central-1); Core Banking API 1: failover enabled (promotion time: 15.0s); Core Banking API 1: DR target region configured (eu-central-1); Core Banking API 2: failover enabled (promotion time: 15.0s); Core Banking API 3: failover enabled (promotion time: 15.0s); PostgreSQL Primary: failover enabled (promotion time: 30.0s); PostgreSQL Primary: DR target region configured (eu-central-1); PostgreSQL Replica: failover enabled (promotion time: 30.0s); PostgreSQL Replica: secondary region instance; Redis Session Cache: failover enabled (promotion time: 5.0s); Kafka Event Bus: failover enabled (promotion time: 10.0s) | — |
| NIST-RC.IM-1 | Recovery improvements | Pass | PostgreSQL Primary: failover enabled; PostgreSQL Replica: failover enabled; Redis Session Cache: failover enabled | — |
| Control ID | Description | Status | Evidence | Recommendation |
|---|---|---|---|---|
| Req-6.1 | Identify and address security vulnerabilities | Partial | Monitoring: False. Circuit breakers: 4/24 | Deploy monitoring and circuit breakers for vulnerability management. |
| Req-6.2 | Protect systems from known vulnerabilities | Pass | Auth/WAF: True. Encryption: True | — |
| Req-6.5 | Address common coding vulnerabilities (error handling) | Partial | Circuit breakers (error handling): 4/24 edges | Enable circuit breakers for proper error handling on all dependencies. |
| Req-10.1 | Implement audit trails for system components | Fail | Monitoring/logging component found: False | Deploy centralized logging for audit trail compliance. |
| Req-10.5 | Secure audit trails so they cannot be altered | Pass | TLS encryption: True. Non-encrypted: [] | — |
| Req-10.6 | Review logs and security events regularly | Fail | Monitoring component for log review: False | Deploy monitoring to enable regular log review. |
| Req-3.4 | Render PAN unreadable (encryption at rest for PCI-scope components) | Fail | PCI-scope components without encryption_at_rest: ['api-gateway'] | Enable encryption at rest on PCI-scope components: api-gateway |
| Req-1.3 | Prohibit direct public access to cardholder data environment | Fail | PCI-scope components without network segmentation: ['s3-document-store'] | Enable network segmentation for PCI-scope components: s3-document-store |
| Control ID | Description | Status | Evidence | Recommendation |
|---|---|---|---|---|
| ID.AM-1 | Physical devices and systems inventoried | Pass | Infrastructure graph contains 12 components | — |
| ID.AM-2 | Software platforms and applications inventoried | Pass | Components: 12, Dependencies mapped: 24 | — |
| PR.AC-1 | Identities and credentials managed for access control | Pass | Auth/WAF component found: True | — |
| PR.DS-2 | Data-in-transit is protected | Pass | TLS (port 443): True. Non-encrypted (port 80): [] | — |
| DE.CM-1 | Network is monitored to detect potential cybersecurity events | Fail | Monitoring component found: False | Deploy network monitoring (Prometheus, Datadog, otel-collector). |
| RS.MI-1 | Incidents are contained (circuit breakers) | Partial | Circuit breakers: 4/24 dependency edges | Enable circuit breakers on dependencies to contain incident blast radius. |
| RC.RP-1 | Recovery plan is executed during/after an event | Pass | Failover: True. Autoscaling: True. DR region: True | — |
| RC.IM-1 | Recovery improvements incorporated | Partial | Components without redundancy: ['postgres-primary', 's3-document-store', 'kms-encryption']. Failover: True | Ensure all critical components have redundancy and failover. |
| PR.DS-1 | Data-at-rest is protected (PII/GDPR compliance) | Pass | PII components without full encryption: [] | — |
| DE.AE-3 | Event data aggregated and correlated (audit logging) | Partial | Monitoring: False. Components with audit_logging tag: 12/12 | Enable audit logging on components and deploy centralized monitoring. |
| Component ID | Name | Type | Replicas | Host | Port |
|---|---|---|---|---|---|
| cloudfront-cdn | CloudFront CDN | load_balancer | 2 | cdn.bank.example.com | 443 |
| waf | AWS WAF | custom | 2 | waf.bank.example.com | 443 |
| api-gateway | API Gateway | load_balancer | 2 | api-gw.bank.internal | 443 |
| core-banking-api-1 | Core Banking API 1 | app_server | 3 | banking01.internal | 8443 |
| core-banking-api-2 | Core Banking API 2 | app_server | 3 | banking02.internal | 8443 |
| core-banking-api-3 | Core Banking API 3 | app_server | 3 | banking03.internal | 8443 |
| postgres-primary | PostgreSQL Primary | database | 1 | db-primary.bank.internal | 5432 |
| postgres-replica | PostgreSQL Replica | database | 2 | db-replica.bank.internal | 5432 |
| redis-session | Redis Session Cache | cache | 3 | redis-session.bank.internal | 6379 |
| kafka-event-bus | Kafka Event Bus | queue | 3 | kafka.bank.internal | 9092 |
| s3-document-store | S3 Document Store | storage | 1 | s3.eu-west-1.amazonaws.com | 443 |
| kms-encryption | KMS Encryption Service | custom | 1 | kms.eu-west-1.amazonaws.com | 443 |