PI-01 Documentation and safety of input and output interfaces
Offer documented inbound and outbound interfaces that let customer systems and other services retrieve data over standardised protocols preserving confidentiality and integrity, with documentation detailed enough for cus
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Worked extraction performed end to end through the documented interface · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Published interface specification describing how customers retrieve their data · Document repository
- Version record tying that specification to the release currently running in production · Policy repository / GRC workspace
- Endpoint protocol settings for the interfaces offered to customers · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Specification reflects an earlier release and omits fields that production now returns
- Data can be exported only by raising a support request rather than through an interface
- Interface published on an untrusted network path without the encryption the policy requires
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-24 Separation of Datasets in the Cloud Infrastructure · PI-02 Contractual agreements for the provision of data