Security and frameworks

Aligned to NIST CSF 2.0 and CIS Controls v8

We assess the platform item by item against both frameworks, keep the evidence for each call, and teach the same frameworks in the courses. Two different things are measured here, and they are kept apart on purpose: how the platform itself is run, and what the courses teach.

1 · The platform

Our own self-assessment

This is a self-assessment by the team that builds RuleCrest, not an audit and not a certification. We check the platform item by item against both frameworks and keep the evidence for each call written down. We do not publish the item-by-item results on this site. They are shared on request with customers and prospects who are assessing us.

2 · The courses

What they teach

The "Security for Managers & Executives" course is built against the frameworks in full. A test fails the build if any item below is not linked from a module, or if the module that links it never discusses it in its own text.

106 NIST CSF 2.0 subcategories, in all 22 categories
18 CIS Controls v8 controls, plus the 46 safeguards a leader owns
25 ISO/IEC 27001:2022 management-system requirements and all 93 Annex A controls

The sector and privacy courses each have their own coverage lists and tests, against the NIST Privacy Framework, HIPAA, FERPA, GLBA and the other laws each course names. This is what the courses teach people; it is not a statement about how the platform is run (section 1).

3 · Controls

In the platform

Access

Passkeys with required user verification for every local account, bound to the authentication address. Sessions end after 30 idle minutes and after 24 hours regardless. Administrator actions and administrator reads of personal data are written to an audit log.

Application

A content security policy and the standard browser security headers, per-source rate limits, a cross-site request check on every state-changing call, and administrator pages that build the page with text nodes so stored data cannot become markup.

Supply chain and build

Static analysis on every push, a dependency audit gate, secret scanning of the full history, a software bill of materials per release, a scan of the built image, and containers that run read-only, as a non-root user, with every Linux capability dropped.

Data

One PostgreSQL schema per organization, signing keys encrypted at rest, encrypted checksummed backups with a built-in schedule, and a restore procedure that has been drilled end to end on synthetic data.

What we do not claim

RuleCrest is not certified to ISO/IEC 27001 and has no SOC 2 report. It has not had an independent penetration test; an internal black-box test harness runs as part of every full test run, and an external test is a committed pre-launch action. There is no uptime commitment published. Some controls can only be evidenced on the live environment, and the self-assessment is updated as that evidence is filed. Alignment with a framework means the platform's controls and the courses' content were mapped to it and checked, nothing more.

To report a vulnerability, see security.txt.