controls-responses.json

{
  "nodes": [
    {
      "id": "control-external-security-review",
      "type": "control",
      "title": "External security review",
      "summary": "Independent review of contract and critical off-chain logic before deploy or upgrade, including a scoped re-review after material changes.",
      "domains": ["onchain-systems"],
      "status": "proposed",
      "tags": ["audit", "review"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["security-engineer", "engineer-developer"],
      "lifecycle": ["development", "pre-launch", "upgrade"],
      "framework": "external-security-reviews"
    },
    {
      "id": "control-secure-sdlc-testing",
      "type": "control",
      "title": "Secure SDLC testing",
      "summary": "Static analysis, fuzzing, invariant tests, and regression tests wired into development so logic bugs are cheaper to find than in production.",
      "domains": ["onchain-systems", "development-supply-chain"],
      "status": "proposed",
      "tags": ["testing", "fuzzing"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer"],
      "lifecycle": ["development"],
      "framework": "security-testing"
    },
    {
      "id": "control-multisig-threshold-policy",
      "type": "control",
      "title": "Multisig threshold policy",
      "summary": "Thresholds and wallet separation matched to blast radius, so one lost or coerced signer cannot move the whole treasury.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["threshold", "multisig"],
      "controlClass": "governance",
      "assessmentEligible": true,
      "roles": ["multisig-signer", "governance-participant"],
      "lifecycle": ["design", "normal-operations"],
      "framework": "multisig-for-protocols"
    },
    {
      "id": "control-signer-isolation",
      "type": "control",
      "title": "Hardware-backed signer isolation",
      "summary": "Signing keys live on dedicated hardware, separated from daily browsing and development machines.",
      "domains": ["devices-identity", "governance-treasury"],
      "status": "proposed",
      "tags": ["hardware-wallet", "isolation"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "multisig-for-protocols"
    },
    {
      "id": "control-independent-tx-verification",
      "type": "control",
      "title": "Independent transaction verification",
      "summary": "Each signer verifies destination, asset, and calldata on a trusted display instead of approving a hash from chat.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["calldata", "verification"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "multisig-for-protocols"
    },
    {
      "id": "control-signer-lifecycle",
      "type": "control",
      "title": "Signer onboarding, rotation, and offboarding",
      "summary": "Documented join, rotate, and leave procedures so keys are not left with former signers and replacements are available.",
      "domains": ["governance-treasury", "people"],
      "status": "proposed",
      "tags": ["rotation", "onboarding"],
      "controlClass": "governance",
      "assessmentEligible": true,
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "multisig-for-protocols"
    },
    {
      "id": "control-emergency-pause",
      "type": "control",
      "title": "Emergency pause and containment",
      "summary": "A tested ability to pause, throttle, or otherwise contain privileged actions when an incident is underway.",
      "domains": ["governance-treasury", "detection-incident-response"],
      "status": "proposed",
      "tags": ["pause", "containment"],
      "controlClass": "corrective",
      "assessmentEligible": true,
      "roles": ["multisig-signer", "incident-responder"],
      "lifecycle": ["incident-response"],
      "framework": "multisig-for-protocols"
    },
    {
      "id": "control-hiring-identity-verification",
      "type": "control",
      "title": "Hiring identity verification",
      "summary": "Identity, work-authorization, and video-presence checks before contractors receive code or infrastructure access.",
      "domains": ["people"],
      "status": "proposed",
      "tags": ["hiring", "identity"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["founder-executive"],
      "lifecycle": ["normal-operations"],
      "framework": "opsec"
    },
    {
      "id": "control-insider-threat-mitigation",
      "type": "control",
      "title": "Insider threat mitigation",
      "summary": "Least privilege, access reviews, and monitoring for people who already have internal access.",
      "domains": ["people", "devices-identity"],
      "status": "proposed",
      "tags": ["insider", "least-privilege"],
      "controlClass": "detective",
      "assessmentEligible": true,
      "roles": ["security-engineer"],
      "lifecycle": ["normal-operations"],
      "framework": "opsec"
    },
    {
      "id": "control-phishing-resistant-mfa",
      "type": "control",
      "title": "Phishing-resistant multi-factor authentication",
      "summary": "Hardware-backed or passkey MFA on email, cloud, GitHub, registrar, and other privileged accounts. SMS and phishable OTP are not sufficient.",
      "domains": ["devices-identity", "people"],
      "status": "proposed",
      "tags": ["mfa", "passkeys", "phishing"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["founder-executive", "engineer-developer", "infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "iam"
    },
    {
      "id": "control-security-awareness-training",
      "type": "control",
      "title": "Security awareness training",
      "summary": "Role-specific practice against spearphishing, fake meetings, and impersonation, especially for signers and executives.",
      "domains": ["people"],
      "status": "proposed",
      "tags": ["training", "phishing"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["founder-executive", "community-manager"],
      "lifecycle": ["normal-operations"],
      "framework": "user-team-security"
    },
    {
      "id": "control-least-privilege-review",
      "type": "control",
      "title": "Least privilege and privileged-access review",
      "summary": "Periodic review of who can deploy, sign, or administer production, with unused access removed.",
      "domains": ["devices-identity", "infrastructure"],
      "status": "proposed",
      "tags": ["iam", "access-review"],
      "controlClass": "governance",
      "assessmentEligible": true,
      "roles": ["infrastructure-operator", "security-engineer"],
      "lifecycle": ["normal-operations"],
      "framework": "iam"
    },
    {
      "id": "control-network-segmentation",
      "type": "control",
      "title": "Network segmentation",
      "summary": "Production, build, and corporate networks are separated so a laptop compromise does not equal cloud root.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["segmentation", "network"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["infrastructure-operator"],
      "lifecycle": ["design", "normal-operations"],
      "framework": "infrastructure"
    },
    {
      "id": "control-cloud-hardening",
      "type": "control",
      "title": "Cloud account hardening",
      "summary": "Root protection, scoped IAM, logging, and configuration baselines on the cloud accounts that host the product.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["cloud", "iam"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "infrastructure"
    },
    {
      "id": "control-registrar-hardening",
      "type": "control",
      "title": "Registrar account hardening",
      "summary": "Registrar locks, unique credentials, phishing-resistant MFA, and restricted users on domain accounts.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["registrar", "domain-lock"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "infrastructure"
    },
    {
      "id": "control-dns-change-monitoring",
      "type": "control",
      "title": "DNS change monitoring",
      "summary": "Alerting on nameserver, record, and registrar changes so hijacks are visible in minutes rather than after user reports.",
      "domains": ["infrastructure", "detection-incident-response"],
      "status": "proposed",
      "tags": ["dns", "monitoring"],
      "controlClass": "detective",
      "assessmentEligible": true,
      "roles": ["infrastructure-operator", "incident-responder"],
      "lifecycle": ["normal-operations"],
      "framework": "infrastructure"
    },
    {
      "id": "control-frontend-integrity-monitoring",
      "type": "control",
      "title": "Frontend deployment integrity monitoring",
      "summary": "Detect unauthorized frontend publishes, CDN changes, or script injection on the sites users load.",
      "domains": ["infrastructure", "detection-incident-response"],
      "status": "proposed",
      "tags": ["frontend", "integrity"],
      "controlClass": "detective",
      "assessmentEligible": true,
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "front-end-web-app"
    },
    {
      "id": "control-device-hardening",
      "type": "control",
      "title": "Device hardening",
      "summary": "OS baselines, disk encryption, auto-update, and browser isolation on devices that touch code or keys.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["endpoint", "hardening"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer", "multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "opsec"
    },
    {
      "id": "control-dependency-pinning-provenance",
      "type": "control",
      "title": "Dependency pinning and provenance",
      "summary": "Lockfiles, pinned versions, and provenance or signature checks so installs cannot silently float to a malicious release.",
      "domains": ["development-supply-chain"],
      "status": "proposed",
      "tags": ["lockfile", "provenance"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer"],
      "lifecycle": ["development"],
      "framework": "supply-chain"
    },
    {
      "id": "control-isolated-reproducible-builds",
      "type": "control",
      "title": "Isolated and reproducible builds",
      "summary": "Builds run in isolated pipelines and can be reproduced so a compromised laptop is not the sole source of a release.",
      "domains": ["development-supply-chain"],
      "status": "proposed",
      "tags": ["reproducible-builds", "isolation"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer"],
      "lifecycle": ["development", "upgrade"],
      "framework": "devsecops"
    },
    {
      "id": "control-branch-protection",
      "type": "control",
      "title": "Repository branch protection",
      "summary": "Required reviews, signed commits or equivalent, and restricted who can push to release branches.",
      "domains": ["development-supply-chain"],
      "status": "proposed",
      "tags": ["github", "branch-protection"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer"],
      "lifecycle": ["development"],
      "framework": "devsecops"
    },
    {
      "id": "control-onchain-anomaly-detection",
      "type": "control",
      "title": "On-chain anomaly detection",
      "summary": "Monitors for unexpected drains, admin calls, or signer behavior with an owner who will act on the alert.",
      "domains": ["detection-incident-response", "onchain-systems"],
      "status": "proposed",
      "tags": ["on-chain", "alerting"],
      "controlClass": "detective",
      "assessmentEligible": true,
      "roles": ["security-engineer", "incident-responder"],
      "lifecycle": ["normal-operations"],
      "framework": "monitoring"
    },
    {
      "id": "control-tested-incident-runbooks",
      "type": "control",
      "title": "Tested incident runbooks",
      "summary": "Written, rehearsed procedures for key classes of incident, with contacts and first actions that work under pressure.",
      "domains": ["detection-incident-response"],
      "status": "proposed",
      "tags": ["runbooks", "ir"],
      "controlClass": "recovery",
      "assessmentEligible": true,
      "roles": ["incident-responder"],
      "lifecycle": ["incident-response"],
      "framework": "incident-management"
    },
    {
      "id": "control-duress-travel-protocol",
      "type": "control",
      "title": "Duress and travel protocol",
      "summary": "Travel rules, reduced signing power on the road, and a way to signal duress without completing a forced transaction.",
      "domains": ["people"],
      "status": "proposed",
      "tags": ["travel", "duress"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["multisig-signer", "founder-executive"],
      "lifecycle": ["normal-operations"],
      "framework": "opsec"
    },
    {
      "id": "control-security-council-process",
      "type": "control",
      "title": "Security council process",
      "summary": "A defined council or emergency path for upgrades and pauses, with constraints so it cannot silently become a shadow admin.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["council", "governance"],
      "controlClass": "governance",
      "assessmentEligible": true,
      "roles": ["governance-participant"],
      "lifecycle": ["upgrade", "incident-response"],
      "framework": "governance"
    },
    {
      "id": "response-smart-contract-exploit",
      "type": "response",
      "title": "Smart contract exploit response",
      "summary": "Containment, war-room, and recovery steps when on-chain logic is being actively abused.",
      "domains": ["detection-incident-response", "onchain-systems"],
      "status": "proposed",
      "tags": ["exploit", "war-room"],
      "roles": ["incident-responder"],
      "lifecycle": ["incident-response"],
      "framework": "incident-management"
    },
    {
      "id": "response-signer-compromise",
      "type": "response",
      "title": "Signer compromise response",
      "summary": "Rotate or freeze affected keys, raise thresholds if needed, and treat remaining signers as potentially targeted.",
      "domains": ["detection-incident-response", "governance-treasury"],
      "status": "proposed",
      "tags": ["keys", "rotation"],
      "roles": ["incident-responder", "multisig-signer"],
      "lifecycle": ["incident-response"],
      "framework": "incident-management"
    },
    {
      "id": "response-dprk-it-worker",
      "type": "response",
      "title": "DPRK IT worker response",
      "summary": "Assume credential and key theft from the infected or planted identity, follow malware containment, and rotate everything that identity could reach.",
      "domains": ["detection-incident-response", "people"],
      "status": "proposed",
      "tags": ["dprk", "insider"],
      "roles": ["incident-responder"],
      "lifecycle": ["incident-response"],
      "framework": "incident-management"
    },
    {
      "id": "response-dns-hijack",
      "type": "response",
      "title": "DNS hijack response",
      "summary": "Regain registrar and DNS control, restore records, warn users, and treat the frontend as untrusted until integrity is proven.",
      "domains": ["detection-incident-response", "infrastructure"],
      "status": "proposed",
      "tags": ["dns", "hijack"],
      "roles": ["incident-responder", "infrastructure-operator"],
      "lifecycle": ["incident-response"],
      "framework": "incident-management"
    },
    {
      "id": "response-supply-chain-incident",
      "type": "response",
      "title": "Supply chain incident response",
      "summary": "Identify the poisoned artifact, stop distribution, rotate CI secrets, and rebuild from a known-good source.",
      "domains": ["detection-incident-response", "development-supply-chain"],
      "status": "proposed",
      "tags": ["supply-chain", "ci"],
      "roles": ["incident-responder", "engineer-developer"],
      "lifecycle": ["incident-response"],
      "framework": "incident-management"
    },
    {
      "id": "response-duress-event",
      "type": "response",
      "title": "Duress event response",
      "summary": "Protect the person first, then contain signing power, and do not treat a coerced signature as an ordinary key-compromise drill.",
      "domains": ["detection-incident-response", "people"],
      "status": "proposed",
      "tags": ["duress"],
      "roles": ["incident-responder", "founder-executive"],
      "lifecycle": ["incident-response"],
      "framework": "opsec"
    }
  ]
}