Controls

Approved written policies, and recorded background checks, training and confidentiality agreements for the people who run the product, are not in place yet.

Whose RunningLake Serves CC1.1, CC1.3, CC1.4, CC1.5, CC2.2, CC5.3

Sending email from the product to a customer is not built yet, so a security or lifecycle notice about an organisation is delivered by hand.

Whose RunningLake Serves CC2.3, CC7.4

A published address for reporting a vulnerability is not set up yet.

Whose RunningLake Serves CC2.3, CC7.3

The threat model is written for every trust boundary but has not yet been reviewed by a second person.

Whose RunningLake Serves CC3.1, CC3.2, CC3.3

Every operating control names the test or job that holds it, and the build fails when that evidence is renamed, deleted or emptied, when a gap's row is finished, or when a review is more than a year old.

Whose RunningLake Serves CC4.1, CC5.1

Scheduled reviews of access to RunningLake's own systems, of vendors and of risks, each kept as a dated record, are not in place yet.

Whose RunningLake Serves CC4.1, CC4.2, CC1.2, CC3.4, CC6.2

What each customer role may do in the control plane is one file and the published permission matrix is generated from it, but some of its actions are declared and not yet enforced, and the matrix marks each one.

Whose RunningLake Serves CC6.1, CC6.3

What each RunningLake staff role may do is one file with a generated published matrix, and suspending, resuming or restarting a plane, releasing a wave, entering a support session, approving a request, changing billing and changing staff access each need a fresh sign-in.

Whose RunningLake Serves CC6.1, CC6.3

A confirmation from the last five minutes is required to register a data plane, to manage an organisation's identity provider, to delete a project, to widen an organisation's AI policy and to approve a change that turns prompt text on, and the other customer actions the permission matrix marks for it are declared and not yet enforced.

Whose Shared with you Serves CC6.1, CC6.3

Your part Configure your identity provider to enforce multi-factor sign-in and to honour a request for a fresh authentication.

A second factor that RunningLake owns, to confirm sensitive staff actions, is not built yet.

Whose RunningLake Serves CC6.1

A user whom RunningLake disables cannot sign in and their sessions and own API tokens stop working, but a person removed from an organisation leaves the tokens they created working.

Whose Shared with you Serves CC6.2, CC6.3

Your part Tell RunningLake the same day a person leaves, remove them from your organisation, and revoke the API tokens they created.

Your part Disable a leaver in your own identity provider the same day.

Every route of the sign-in surface is rate limited per network address.

Whose RunningLake Serves CC6.1, CC6.6

In an organisation's own configuration an engineer or an agent can propose a change but only an admin can apply it to production.

Whose Shared with you Serves CC6.3

Your part Decide who in your organisation is an admin, and approve the change sets that apply to production.

A RunningLake staff member who has been disabled cannot sign in and cannot be given a role.

Whose RunningLake Serves CC6.2, CC6.3

The stored copy of a submitted query and the text of a pipeline draft are sealed under AES-256-GCM with a key held on the host, and in flight the query travels unsealed inside the command that delivers it.

Whose RunningLake Serves CC6.1, C1.1

A plane's data, system and audit buckets are configured to encrypt by default under a key created in the plane's own cloud account, which for a customer's plane is the customer's account.

Whose Shared with you Serves CC6.1, C1.1

Your part Keep control of the encryption key in your own cloud account, including who administers it, how it is rotated and any decision to revoke it.

On its named hostnames the control plane is served over TLS with a redirect from plain HTTP and Strict-Transport-Security, which each deploy checks after it switches over and reports, while the QA host's bare address is served over plain HTTP.

Whose RunningLake Serves CC6.7, CC6.6

Transport protection for the agent's connection to the control plane is not complete yet.

Whose RunningLake Serves CC6.7

The messages an agent sends are shaped not to carry customer data, and the control plane refuses a message whose fields break their declared shape.

Whose Shared with you Serves CC6.1, CC6.7, C1.1

Your part Secure the cloud account that holds your data plane and your data, including who can sign in to it and what else runs in it.

Each organisation's data bucket is configured to refuse every principal not tagged for that organisation, apart from the account root and the provisioning role, and credentials issued for one project cannot reach another project.

Whose RunningLake Serves CC6.1, C1.1

A bucket of its own for each trial organisation on the shared trial plane is not built yet.

Whose RunningLake Serves CC6.1, C1.1

Enforced limits that keep production data out of a trial are not built yet.

Whose RunningLake Serves CC6.1, C1.1

An erasure certificate that closes an organisation's offboarding is built, is off unless a control plane is switched on to run offboardings, and has not yet been run on a real plane.

Whose RunningLake Serves CC6.5, C1.2

Reporting the customer's own model invocation-logging setting from their cloud account is designed and not built yet.

Whose Shared with you Serves CC6.1, C1.1

Your part Decide whether model invocation logging is on in your own cloud account, and where those logs are kept and for how long.

A separate production environment, with encrypted storage and a minimally privileged database role, is not provisioned yet.

Whose RunningLake Serves CC6.1, CC6.6

The control plane refuses to start when the name that selects its production safety checks is not one of the names it knows, so a misspelling of production cannot silently skip them.

Whose RunningLake Serves CC6.1

A plain UPDATE, DELETE or TRUNCATE of an audit entry is refused by a database trigger, and the hash chain detects an altered or removed older entry (AUD-02); a database administrator could still disable the trigger.

Whose RunningLake Serves CC7.2

Audit entries are hash-linked per organisation, and verification detects an altered, reordered, deleted or foreign entry.

Whose RunningLake Serves CC7.2, CC2.1

Searching and exporting an organisation's audit log is itself recorded in that organisation's log.

Whose RunningLake Serves CC7.2, CC6.1

A plain UPDATE, DELETE or TRUNCATE of a staff ledger entry is refused by a database trigger and reading the ledger is itself recorded in it, but the ledger is not yet hash-chained or anchored outside the database, so a database administrator could still change it undetected.

Whose RunningLake Serves CC7.2, CC6.3

Continuous delivery of an organisation's audit log to write-once audit storage in the organisation's own cloud account is built, is off unless a control plane is switched on for it, and has not yet been run against a real customer storage.

Whose Shared with you Serves CC7.2, CC7.3

Your part Set the retention period of the audit bucket in your own cloud account to the period your obligations require, and keep its lock in place.

When RunningLake staff search the audit logs of every organisation at once, a record of the search is written into each organisation's own audit log.

Whose RunningLake Serves CC7.2, CC6.1

Every npm lockfile and every built container image in the repository has a Dependabot entry, and every entry points at a directory that exists.

Whose RunningLake Serves CC7.1, CC6.8

Security-focused static analysis of the source, on a schedule or on every pull request, is not run yet.

Whose RunningLake Serves CC7.1, CC6.8, CC8.1

A timer on the control plane host runs a backup script that is written to restore every dump into a scratch database and read it back before the dump counts as a backup.

Whose RunningLake Serves CC7.5, CC9.1

Backup copies of the control plane's database are not kept in a second location yet.

Whose RunningLake Serves CC7.5, CC9.1

Backups of the metering history are not made yet.

Whose RunningLake Serves CC7.5, CC9.1

Replication or backup of the hosted configuration repositories is not built yet.

Whose RunningLake Serves CC7.5, CC9.1

Every alert rule names only metrics the control plane really exports, and the rules that have a test are run against a firing and a quiet case on every change.

Whose RunningLake Serves CC7.2, CC2.1

Firing alerts are routed to a staff chat channel, and an always-firing heartbeat is routed to an external monitor and to that channel so that a broken delivery path is noticed.

Whose RunningLake Serves CC7.2, CC7.3

A written availability commitment, a written incident process and a public status page are not built yet.

Whose RunningLake Serves CC7.3, CC7.4, CC2.3

Which checks must pass before a change lands on the main branch is declared in the repository, applied by an owner action and kept equal to the list a deploy waits for, but the setting itself is held by the code host and is not read back.

Whose RunningLake Serves CC8.1, CC5.2

Approval by a second person before a change to RunningLake's own code merges is not required yet.

Whose RunningLake Serves CC8.1, CC5.2

A release is deployed only from a commit that carries a passing run of every required check, to a host whose key is pinned, from the one branch the deploy is limited to.

Whose RunningLake Serves CC8.1

A public list of the parties that process customer data, with advance notice of changes to it, is not published yet.

Whose RunningLake Serves CC9.2, CC2.3