Compliance & Standards
entityOS is an enterprise-grade, fully-hosted platform on Amazon Web Services. Compliance builds up in layers — the AWS infrastructure, the ibCom platform, and a certified ISMS on top.
ibCom’s compliance depends in part on the compliance encapsulated within Amazon Web Services, a world-class infrastructure provider.
AWS is compliant with a broad set of standards — including ISO 27001, ISO 27017 and ISO 27018, SOC 1/2/3, PCI DSS Level 1, HIPAA, FedRAMP, FIPS 140-2 and more.
That foundation covers supplier employees, access management, external media, environmental security and network security — so entityOS inherits a hardened, independently-audited base to build on.
The next layer is the application platform itself — a fixed, mature service where the sensitive concerns are centralised and controlled.
TOTP/MFA available on all user access; single-sign-on handled by the app layer.
All 700+ methods controllable for read, write and delete — plus data-level restrictions.
Typing and general-rule validation as data enters and exits each layer.
Consistent, safe error handling that never leaks server detail.
Activity is monitored and recorded; issues affecting more than one tenant are reported to all.
2048/256 SSL with a DH cipher for perfect forward secrecy; data encrypted at rest.
The ISO 27001/17-compliant ISMS is tightly aligned with the COBIT framework for IT management and governance — each domain maps to ISO 27001 clauses.
| Domain | COBIT area | Notes | Maps to ISO 27001 |
|---|---|---|---|
| EDM | Evaluate, Direct & Monitor | Governance and policies — executive summary and risk management. | 6.1, 8.2, 8.3, 7.1, 7.4 |
| APO | Align, Plan & Organise | Strategy and design — the design process. | 6.1, 8.2, 8.3, 7.1, A7, A13.2.4 |
| BAI | Build, Acquire & Implement | Implementation and build — the build process. | A14.1, A14.2, A17.2.1, A12.1.3, A12.1.2, A8, A6.1.5 |
| DSS | Deliver, Service & Support | Operations and learning — the Statement of Applicability. | A12, A13, A16, A17 |
| MEA | Monitor, Evaluate & Assess | Management, performance and audit (internal & external) — compliance. | 9.1, 9.2, 9.3, A18.1, A18.2 |
Risk management is core to the value of the business. Controls are established for every risk identified under ISO 27001 and ISO 27017.
Definitions and rules for assessment and management — qualitative or quantitative, the scales used, and the acceptable level of risk.
List every information asset, then the threats and vulnerabilities against each, assign a risk owner, and calculate impact × likelihood.
Treat unacceptable risks in priority order — apply Annex A controls, transfer the risk, avoid the activity, or knowingly accept and monitor it.
The ACSC Essential Eight is designed primarily for Microsoft Windows networks, which ibCom does not run. The controls are mapped here for completeness, communicated through the ISO 27001/17 ISMS.
| Essential Eight control | ibCom approach | Maturity |
|---|---|---|
| Application control | We completely control which applications run on server instances and workstations; all executable code is restricted, however delivered. | Level 3 |
| Patch applications | Applications are patched within 24 hours of a patch becoming available; vulnerability scanning is continuous. | Level 3 |
| Office macro settings | No Microsoft Office products are used on server instances or operations-zone clients. | Level 3 |
| User application hardening | No browsers on servers; only a hardened, ad-blocking browser on clients; Java applets and PowerShell disabled; PDF software isolated. | Level 3 |
| Restrict admin privileges | Administrative privileges are tightly managed by the CRO under the ISMS and operations manual. | Level 3 |
| Patch operating systems | Server and client operating systems are continuously monitored for patches and updated (clients within 24 hours). | Level 3 |
| Multi-factor authentication | All user access can be protected with TOTP/MFA. | Level 3 |
| Regular backups | Real-time data-store duplication, with full backups and test-restores conducted daily via AWS RDS. | Level 3 |