Zero Trust Engineering — Shared responsibility and supplier assurance
archimatev1/01 Views
/02 About
Governance and assurance engineering reference for shared responsibility and supplier assurance, including policy, logical interfaces, recovery and assurance.
Purpose: Shared responsibility and supplier assurance. Domain: Governance and assurance. Family: governance. Scenario trigger: Onboard security-relevant external service provider. Input assurance: Supplier claims, contract responsibilities and technical assurance. Evaluation: Allocate customer and provider control ownership and verify gaps. Governing policy: Third-party shared responsibility and assurance policy. Resource-side obligation: Approve bounded integration only with accountable security duties. Protected concern: External enterprise service integration. Logical interface: Provider owner customer duty control evidence SLA and review. Evidence: Responsibility matrix provider evidence and contract exceptions. Failure: Control responsibility ambiguity or outdated supplier attestation. Required recovery: Withhold high-risk integration pending independent assurance. Architectural invariant: Contractual responsibility does not replace technical boundary verification Adoption: replace reference roles with concrete owner-controlled services. Specify exact provider/consumer identities, schema fields and classifications, signal provenance and freshness, idempotency, authorization lifetime, timeout/retry limits, observation and tamper evidence. A denied or failed operation must not silently become a permitted one. Scope: original vendor-neutral, implementation-agnostic technical reference model. Illustrative logical components and behaviors are neither a deployed system nor evidence of regulatory compliance. Package identities remain stable within the package; cross-package semantic reconciliation requires separate explicit registry support.
Curated · other · unspecified · Published by Lattix · 29 elements · 34 relationships · validated on publish
/03 Contents
- Capability
- Governance and assurance, Shared responsibility and supplier assurance
- Role
- Governance and assurance owner, Independent risk or control reviewer
- Business Actor
- Accountable enterprise stakeholder
- Activity
- Onboard security-relevant external service provider, Verify: Supplier claims, contract responsibilities and technical assurance, Assess: Allocate customer and provider control ownership and verify gaps, Execute: Approve bounded integration only with accountable security duties, Exception: Control responsibility ambiguity or outdated supplier attestation, Recover: Withhold high-risk integration pending independent assurance, Independently approve or reject proposal, Expire and reconcile exceptions
- Application Component
- Supplier claims, contract responsibilities and technical assurance, Allocate customer and provider control ownership and verify gaps, Approve bounded integration only with accountable security duties
- Application
- External enterprise service integration
- Policy
- Third-party shared responsibility and assurance policy
- API
- Shared responsibility and supplier assurance logical interface
- Message/Event Schema
- Provider owner customer duty control evidence SLA and review
- Data Store
- Responsibility matrix provider evidence and contract exceptions
- Control
- Shared responsibility and supplier assurance enforcement assurance
- Risk
- Control responsibility ambiguity or outdated supplier attestation risk
- Requirement
- Contractual responsibility does not replace technical boundary verification
- Measure
- Shared responsibility and supplier assurance assurance completeness
- Trust Boundary
- Shared responsibility and supplier assurance authority boundary
- State
- Governance approval recorded, Exception or rejection recorded
- Business Object
- Governance proposal and rationale