Product Security

ASUME logs security-relevant events in production so that the who, what, when, where, and how of critical system interactions can be reconstructed. Current logging and review practices are described in Security Measures.

These logs support incident detection and investigation. A company-wide immutable logging architecture across every environment is still being formalized and is not independently verified.

ASUME applies role-based access control (RBAC) and least privilege so that people and systems receive only the access they need. Identity and access controls, including individually attributable accounts, are described in Security Measures.

RBAC is used where it is technically applicable today. Extending it uniformly across every internal system remains in progress.

ASUME is extending multi-factor authentication (MFA) as an additional control against unauthorized access. Authentication appropriate to system sensitivity, including stronger controls for privileged and production access, is described in Security Measures.

MFA is not yet uniformly required across every system. Until it is, treat the current authentication controls in Security Measures as the published baseline.

ASUME is formalizing a Secure Development Lifecycle that governs how the Service is designed, reviewed, and changed. Current secure-development, review, and dependency-management practices are described in Security Measures.

A standalone SDLC document aligned to a named industry framework is still being built out and is not independently verified.