Stop 11 · Trust & assurance

Security standards

How Quantix methods map to public frameworks: ISO/IEC 27001, SOC 2, NIST CSF, OWASP WSTG and the Smart Contract Top 10, CWE, CVSS and EIP security considerations. Alignment is stated; certification is not claimed.

On this stop

Filter the control matrix by standard, domain and service, or export it as CSV.
The full page adds the coverage map and the finding-class crosswalk.

Open Security Standards

Showing 12 of 52 control mappings

Standard controls mapped to what Quantix assessments examine, the evidence collected and the deliverable
Standard control	Domain	What Quantix examines	Evidence collected	Deliverable
ISO/IEC 27001A.5.15Access control	Access control	Rules for who may access deployment, signing and admin systems, and whether those rules are enforced in practice.Penetration Testing · Security Advisory	Role inventory; Access review records; Selected access requests traced end to end	Gap assessment, access-control section
ISO/IEC 27001A.8.2Privileged access rights	Access control	Who holds protocol admin keys, multisig signer seats and cloud root access; how grants are approved and revoked.Smart Contract Auditing · Security Advisory · Penetration Testing	Signer list per multisig; Proxy admin and owner addresses; Cloud IAM export	Privileged-access register with findings
ISO/IEC 27001A.8.24Use of cryptography	Cryptography & keys	Key generation, storage (HSM, MPC, hardware wallets), rotation and the signing schemes used on- and off-chain.Security Advisory · Penetration Testing	Key-management policy; Ceremony transcripts; Signer device inventory	Key-management review
ISO/IEC 27001A.8.25Secure development life cycle	Secure development	Whether threat modelling, review, testing and audit gates exist before each release of contract and backend code.Smart Contract Auditing · Security Advisory	Release checklist; Pull-request review history; Test and fuzzing coverage reports	SDLC maturity rating and recommendations
ISO/IEC 27001A.8.8Management of technical vulnerabilities	Vulnerability management	How findings from audits, bug reports and dependency alerts are triaged, fixed and verified within agreed timeframes.Smart Contract Auditing · Penetration Testing	Finding tracker export; Fix commits linked to findings; Dependency alert history	Remediation analysis in the assessment report
ISO/IEC 27001A.8.16Monitoring activities	Monitoring & detection	Coverage of on-chain and infrastructure monitoring for privileged operations, upgrades and anomalous flows.Continuous Monitoring	Monitoring rule set; Alert routing configuration; Recent alerts with response notes	Monitoring design review
ISO/IEC 27001A.5.26Response to information security incidents	Incident response	Incident runbooks for exploits, key compromise and front-end compromise, including pause and communication procedures.Incident Response · Security Advisory	Incident runbooks; Exercise records; Post-incident reviews	Incident-readiness assessment
ISO/IEC 27001A.5.21Managing information security in the ICT supply chain	Supply chain	Dependencies on oracles, bridges, RPC providers, libraries and front-end packages, and how their risk is assessed.Security Advisory · Threat Intelligence	Supplier and dependency inventory; Pinned versions and lockfiles; Provider risk notes	Dependency risk register
ISO/IEC 27001A.5.31Legal, statutory, regulatory and contractual requirements	Governance & risk	Whether obligations such as sanctions screening and travel-rule data exchange are identified, owned and reflected in transaction-monitoring controls.AML & Compliance · Security Advisory	Obligations register; Screening configuration; Control ownership matrix	Compliance-control gap assessment
SOC 2 TSCCC6.1Logical access security over protected information assets	Access control	Authentication, authorisation and segmentation around signing services, admin consoles and production databases.Penetration Testing	Access-control configuration; MFA enforcement evidence; Network segmentation diagrams	Access-control test results
SOC 2 TSCCC6.3Authorising, modifying and removing access based on roles	Access control	Role-based access for operators and approvers, including policy-engine quorums for custody transactions.Penetration Testing · Security Advisory	Role definitions; Joiner, mover and leaver records; Approval-quorum configuration	Role and approval review
SOC 2 TSCCC7.1Detection of configuration changes and new vulnerabilities	Vulnerability management	Detection of configuration drift and newly disclosed vulnerabilities in dependencies, nodes and contracts.Penetration Testing · Continuous Monitoring	Scanning schedules; Dependency alert triage records; Configuration baselines	Vulnerability management review

ISO/IEC 27001A.5.15
Access control
Rules for who may access deployment, signing and admin systems, and whether those rules are enforced in practice.
Evidence
Role inventory; Access review records; Selected access requests traced end to end
Deliverable
Gap assessment, access-control section
Domain · services
Access control · Penetration Testing, Security Advisory
ISO/IEC 27001A.8.2
Privileged access rights
Who holds protocol admin keys, multisig signer seats and cloud root access; how grants are approved and revoked.
Evidence
Signer list per multisig; Proxy admin and owner addresses; Cloud IAM export
Deliverable
Privileged-access register with findings
Domain · services
Access control · Smart Contract Auditing, Security Advisory, Penetration Testing
ISO/IEC 27001A.8.24
Use of cryptography
Key generation, storage (HSM, MPC, hardware wallets), rotation and the signing schemes used on- and off-chain.
Evidence
Key-management policy; Ceremony transcripts; Signer device inventory
Deliverable
Key-management review
Domain · services
Cryptography & keys · Security Advisory, Penetration Testing
ISO/IEC 27001A.8.25
Secure development life cycle
Whether threat modelling, review, testing and audit gates exist before each release of contract and backend code.
Evidence
Release checklist; Pull-request review history; Test and fuzzing coverage reports
Deliverable
SDLC maturity rating and recommendations
Domain · services
Secure development · Smart Contract Auditing, Security Advisory
ISO/IEC 27001A.8.8
Management of technical vulnerabilities
How findings from audits, bug reports and dependency alerts are triaged, fixed and verified within agreed timeframes.
Evidence
Finding tracker export; Fix commits linked to findings; Dependency alert history
Deliverable
Remediation analysis in the assessment report
Domain · services
Vulnerability management · Smart Contract Auditing, Penetration Testing
ISO/IEC 27001A.8.16
Monitoring activities
Coverage of on-chain and infrastructure monitoring for privileged operations, upgrades and anomalous flows.
Evidence
Monitoring rule set; Alert routing configuration; Recent alerts with response notes
Deliverable
Monitoring design review
Domain · services
Monitoring & detection · Continuous Monitoring
ISO/IEC 27001A.5.26
Response to information security incidents
Incident runbooks for exploits, key compromise and front-end compromise, including pause and communication procedures.
Evidence
Incident runbooks; Exercise records; Post-incident reviews
Deliverable
Incident-readiness assessment
Domain · services
Incident response · Incident Response, Security Advisory
ISO/IEC 27001A.5.21
Managing information security in the ICT supply chain
Dependencies on oracles, bridges, RPC providers, libraries and front-end packages, and how their risk is assessed.
Evidence
Supplier and dependency inventory; Pinned versions and lockfiles; Provider risk notes
Deliverable
Dependency risk register
Domain · services
Supply chain · Security Advisory, Threat Intelligence
ISO/IEC 27001A.5.31
Legal, statutory, regulatory and contractual requirements
Whether obligations such as sanctions screening and travel-rule data exchange are identified, owned and reflected in transaction-monitoring controls.
Evidence
Obligations register; Screening configuration; Control ownership matrix
Deliverable
Compliance-control gap assessment
Domain · services
Governance & risk · AML & Compliance, Security Advisory
SOC 2 TSCCC6.1
Logical access security over protected information assets
Authentication, authorisation and segmentation around signing services, admin consoles and production databases.
Evidence
Access-control configuration; MFA enforcement evidence; Network segmentation diagrams
Deliverable
Access-control test results
Domain · services
Access control · Penetration Testing
SOC 2 TSCCC6.3
Authorising, modifying and removing access based on roles
Role-based access for operators and approvers, including policy-engine quorums for custody transactions.
Evidence
Role definitions; Joiner, mover and leaver records; Approval-quorum configuration
Deliverable
Role and approval review
Domain · services
Access control · Penetration Testing, Security Advisory
SOC 2 TSCCC7.1
Detection of configuration changes and new vulnerabilities
Detection of configuration drift and newly disclosed vulnerabilities in dependencies, nodes and contracts.
Evidence
Scanning schedules; Dependency alert triage records; Configuration baselines
Deliverable
Vulnerability management review
Domain · services
Vulnerability management · Penetration Testing, Continuous Monitoring