Three lines of defense as code. DORA-aligned ICT controls. Tenant isolation at four layers. An immutable journal for every flow, every decision, every provider call — replayable seven years later.
The three-lines model only works if the lines are independent. We make that independence verifiable: each line's policy and configuration lives in the repository, with separate IAM, separate approvers, and a diffable history.
The team that ships the flow owns the risk. Velocity caps, exposure limits, idempotency-keys — declared as policy in the BPM engine, enforced at the gateway. No flow ships without an owner named in the policy.
Independent of the product line. Owns sanctions list refresh, AML rule curation, KYT thresholds, SAR register. Their decisions land as configuration in the same git repo as the code; second-line policy and first-line policy diff is reviewable.
Reads the journal, not the dashboard. Replays cases, checks the evidence pack, confirms second-line policy was actually applied. Findings land in the issue tracker, with named owner and SLA. The auditor does not write code; they read it.
Not a logo wall. For each framework that bites in our scope, the named control we implement and where it lives in the system.
Tenant isolation is enforced at four layers. A breach at one layer cannot escalate across tenants without a breach at every layer. Each layer is testable independently.
Separate signing keys, scope claims and audience. No cross-tenant token reuse possible by design.
Service-mesh policies enforce intra-tenant traffic only. Egress allow-lists managed per tenant.
Every table carries a tenant_id; row-level security predicates are enforced in the database, not the application.
Decision journals partitioned by tenant. Read-access requires per-tenant role, never granted across.
Each stage carries a specific lawful basis, retention rule, access control and sub-processor disclosure. The configuration is in the repo; the journal proves it was applied.
Operational resilience is not a slide deck — it is the muscle memory of an on-call team, with named owners, target SLAs and a written RCA every time. Below is the actual cadence we run.
Independent assurance happens on a published calendar — not whenever a breach forces it. Each exercise has a named external party (where applicable), a named internal owner, and a written report that lands in the audit register.
Independent CREST-accredited firm. Web + mobile + API surface.
Cross-tenant escalation paths, IAM lateral movement, KYT bypass attempts.
Bank risk team reviews postings, controls, and operator workspace before any launch.
Mock evidence-pack pull against random sample. Lessons fed back into BPM and journal.
Failover to secondary region. RPO < 5 min, RTO < 1 h target verified live.
Every dependency change triggers SBOM diff + license + CVE check at PR time.
Four hours, one whiteboard, one shared screen. We map the perimeter, list the controls, identify the evidence gaps, and write a remediation plan you can hand to the second-line risk team on Monday.