DOCUMENTATION LIBRARY · DELIVERABLES & REFERENCE ARCHITECTURE

Explore the documentation we engineer.

Inspect our editable governance files, control mappings, and cross-document relationships before choosing your architecture. Download real native files (.xlsx, .docx, .md) below with zero email gate.

REFERENCE ARCHITECTURE - DEMONSTRATION ENVIRONMENT · MODELS A FICTIONAL AWS + OKTA + GITHUB + BEDROCK LLM B2B SAAS ORGANIZATION FOR TECHNICAL EVALUATION

01 · INSIDE THE DELIVERABLES & DIRECT DOWNLOADS

Six interconnected deliverable families - with real native files to inspect.

This demonstration environment models a fictional cloud software organization. All control statuses are explicitly labeled as scenario assumptions rather than verified audit attestations.

DELIVERABLE 01 · BPS-SOA-014-SHEET .XLSX

ISO/IEC 27001:2022 Statement of Applicability (All 93 Controls)

Multi-sheet relational workbook containing all 93 Annex A controls (A.5.1 to A.8.34), the 15-row 5x5 Risk Register (BPS-RSK-01), the 6-Framework Cross-Walk, and the 5-Point QA Validation Manifest.

Tabs: SoA_93_Controls | Risk_Register_5x5 | CrossWalk_Matrix | QA_Validation_Manifest

Download Full 93-Control .XLSX Workbook ↓

DELIVERABLE 02 · BPS-POL-IAM-01.DOCX POLICY

Cloud Identity, Access & Cryptographic Control Policy

Operational policy with Clause 7.5.2 document control block, tailored to Okta/Entra SSO, AWS IAM Identity Center short-lived STS tokens, FIDO2 MFA, quarterly access reviews, and KMS rotation.

Cross-Tags: ISO 27001 A.5.15-18, A.8.24 | SOC 2 CC6.1-CC6.7 | ISO 42001 A.6.2.6

Download Real .DOCX Reference File ↓

DELIVERABLE 03 · BPS-GIT-REPO.MD + .YAML

Git-Ready Markdown Governance Policy Edition

Synchronized Markdown edition of all manuals and policies with YAML front-matter metadata and Clause 7.5.2 version headers, enabling engineering teams to manage compliance via pull requests.

Structure: YAML Control Headers | §3.1-§4.1 Section Parity | CI/CD Audit Trail Ready

Download Real .MD Reference File ↓

DELIVERABLE 04 · BPS-AIM-01.XLSX + .DOCX

ISO/IEC 42001 AI System Governance & Impact Register

Complete 38-control normative Annex A (A.2-A.10) AIMS SoA with Annex B implementation guidance, Algorithmic Impact Assessment (A.5), RAG data provenance ledger (A.7), and LLM supplier rules (A.10).

Cross-Tags: ISO 42001 Clauses 4-10 & A.2-A.10 | EU AI Act Art. 9-15 & Art. 25

Included in Core AI / Integrated / Multi-Framework →

DELIVERABLE 05 · BPS-SIG-01.XLSX VAULT

SOC 2 Control Matrix & 320-Question Vendor Due Diligence Vault

Separates control design (Type I) from operating effectiveness (Type II) across CC1-CC9, paired with 320 pre-answered enterprise vendor due diligence responses aligned with CSA CAIQ v4.

Included in Integrated & Multi-Framework →

DELIVERABLE 06 · BPS-DOR-01.XLSX + .DOCX

EU DORA ICT Risk Framework & 15-Table Register of Information

Relational workbook implementing Commission Implementing Regulation (EU) 2024/2956 templates B_01.01 through B_99.01, plus dual DORA Competent Authority (4h/24h/72h) and NIS2 CSIRT playbooks.

Statutory Basis: Reg. (EU) 2022/2554 Art. 5-30 | ITS Reg. 2024/2956 | NIS2 Art. 21-23

Included in Multi-Framework / DORA Extension →

02 · CONTROL TRACEABILITY EXPLORER

How a single control decision propagates across policies, registers, and evidence.

Select any control tab below to inspect how the Statement of Applicability (SoA) links directly to operational policy clauses, risk treatment IDs, and infrastructure artifacts.

ISO/IEC 27001:2022 · CONTROL A.5.15 & SOC 2 CC6.1

Access Control & Zero-Trust Identity Governance

Applies to workforce, contractor, and service-account authentication across AWS production accounts (eu-west-1 / us-east-1), Okta SSO, and GitHub Enterprise repositories.

# DOCUMENT: BPS-POL-IAM-01 | REV: 2026.4 | CLAUSE: §3.1 - §3.4
control_id: ISO27001-A.5.15 | iso42001_ref: A.6.2.6 (Guidance: B.6.2.6)
identity_provider: Okta_SAML2_OIDC (Hardware_FIDO2_MFA_Enforced)
aws_access: IAM_Identity_Center_Short_Lived_STS_Tokens (Max_Session: 4h)
production_ssh: Disabled (SSM_Session_Manager_Logged_To_S3_ObjectLock)
review_cadence: Quarterly_Access_Certification (Target_Evidence: EVD-IAM-Q4-REVIEW.xlsx)

RELATIONAL METADATA & AUDIT BINDING

Policy ReferenceBPS-POL-IAM-01 §3.1-§3.4 (.docx / .md)
Mitigated Risk IDRSK-04 (Unauthorized Privilege Escalation)
Assigned OwnerHead of Platform & Security Lead
Scenario StatusScenario Assumption · Client-Declared
Cross-Walk TagsISO 27001 A.5.15 · SOC 2 CC6.1 · ISO 42001 A.6.2.6 (Annex B.6.2.6) · DORA Art. 9(4)(c)

03 · REFERENCE REPOSITORY STRUCTURE

Folder hierarchy of a delivered governance architecture.

Every engagement delivers a logically indexed archive containing your Master Delivery Manifest, editable Word/Excel documents, and synchronized Git Markdown files.

REFERENCE-GOVERNANCE-ARCHITECTURE/
├── 00_MANIFEST_AND_TRACEABILITY/
│   ├── BPS-MAN-00_Master-Delivery-Manifest-and-CrossWalk.xlsx
│   ├── BPS-VAL-01_Intake-Assumptions-and-Scope-Boundary.pdf
│   └── README-Architecture-Index.md
├── 01_GOVERNANCE_MANUALS/
│   ├── BPS-MAN-01_Integrated-ISMS-AIMS-Governance-Manual_Clauses-4-to-10.docx
│   └── BPS-MAN-01_Integrated-ISMS-AIMS-Governance-Manual_Clauses-4-to-10.md
├── 02_RISK_AND_STATEMENT_OF_APPLICABILITY/
│   ├── BPS-SOA-01_Statement-of-Applicability_93-AnnexA-and-38-AI-Controls.xlsx
│   └── BPS-RSK-01_Quantitative-Asset-and-Risk-Treatment-Register.xlsx
├── 03_OPERATIONAL_SECURITY_POLICIES/
│   ├── BPS-POL-01_Information-Security-and-Leadership-Charter.docx
│   ├── BPS-POL-02_Access-Control-Okta-SSO-and-AWS-IAM-Standard.docx
│   ├── BPS-POL-03_Cryptographic-Key-Management-and-TLS-KMS-Policy.docx
│   ├── BPS-POL-04_Terraform-IaC-Configuration-and-Change-Management.docx
│   └── ... [Consolidated Domain Policies (~18 to ~36 total documents) in .docx and .md]
├── 04_AI_GOVERNANCE_AND_EU_AI_ACT/
│   ├── BPS-AIM-01_AI-System-Impact-Assessment-and-Model-Inventory.xlsx
│   └── BPS-AIM-02_LLM-Supplier-Oversight-and-RAG-Data-Lineage-Policy.docx
└── 05_ASSURANCE_DORA_AND_PRIVACY_EXTENSIONS/
    ├── BPS-SIG-01_SOC2-TSC-and-320-Question-Vendor-Due-Diligence-Vault.xlsx
    ├── BPS-DOR-01_DORA-15-Table-Register-of-Information-and-ICT-Framework.xlsx
    └── BPS-PRI-01_ISO27701-Dual-RoPA-TIA-and-Article35-AI-DPIA.xlsx

Download Deliverable 01 · SoA (.xlsx) ↓ Download Deliverable 02 · IAM Policy (.docx) ↓ Download Deliverable 03 · Git Policy (.md) ↓