Controls evidence
Each row is a clause we read in the primary text, a short quote, and the evidence Entropa gives. This is evidence mapped to a control. It is not an assessment, an audit opinion or a certification.
| Standard and clause | What it says (short quote) | Evidence from Entropa | Status |
|---|---|---|---|
| DORA RTS 2024/1774, Art. 12(2)(d) | "measures to protect logging systems and log information against tampering, deletion, and unauthorised access at rest, in transit, and, where relevant, in use" | Signed, append-only, witnessed ledger; tamper demonstration on a copy | Built; self-assessment in progress |
| DORA RTS 2024/1774, Art. 6 | a policy on encryption and cryptographic controls, with provisions for updating cryptography "on the basis of developments in cryptanalysis" | Crypto inventory of our own estate (CycloneDX); certificate crypto-agility plan not yet written | Partial |
| PCI DSS v4.0.1, 10.3.4 | "File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts." | Any changed byte makes verification fail | Built; in self-assessment |
| PCI DSS v4.0.1, 12.3.3 | cipher suites and protocols "documented and reviewed at least once every 12 months", with an inventory, monitoring of industry trends and a response plan | Read-only inventory of our own hosts, with a signed receipt | Partial (inventory done; plan missing) |
| NIST SP 800-53 Rev 5, AU-9(3) | "Implement cryptographic mechanisms to protect the integrity of audit information and audit tools." (High baseline) | ML-DSA-65 signed checkpoints | Built |
| NIST SP 800-53 Rev 5, AU-10 | Non-repudiation: irrefutable evidence that an actor performed an action (High baseline; paraphrase) | Signed, offline-verifiable records | Built; review pending |
| EU AI Act, Art. 12 and 19 | "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." | Signed AI-decision records with the gate verdict and approval | Built; application dates to be confirmed from the current text |
| HIPAA Security Rule, 164.312(b) and (c)(2) | mechanisms that "record and examine activity" in systems with electronic protected health information; a mechanism to corroborate that data has not been altered | Signed activity records, verification that data has not changed | Partial (secondary source for the text) |
We assessed ourselves first: read the self-assessment of our own estate, with our gaps listed up front.
Honest limits
- No clause above names a signature algorithm. ML-DSA-65 is our choice for records that must stay verifiable for years; it is not a requirement of any standard we read.
- Known gaps: three of our ledgers share one signing key and only the AI ledger is witnessed; our site certificates are classical (RSA-2048 or P-256); we have no crypto-agility plan for certificates yet.
- Source of the quotes: primary texts for DORA, PCI DSS, NIST (OSCAL catalog) and the EU AI Act; HIPAA from a secondary mirror until the official text is stored. PCI DSS is quoted briefly; read the standard itself.