Convoys · Compliance and Assurance
The Compliance and Assurance Convoy. Coming soon
A convoy that tunes your cluster to the technical controls regulators require, and then adds country-specific charts that map those controls to each national regime and record the evidence for them. It begins in the GCC, with Saudi Arabia, the United Arab Emirates and Qatar.
The Compliance and Assurance Convoy is not yet available. Its scope, and the regimes it covers first, may change before it is released.
What the convoy is
A common baseline, then the rules of each country.
Regulators in different countries publish different frameworks, but the technical controls they ask of a platform are largely the same: central identity and least privilege, audit logging, a trusted time source, encryption at rest, segmentation between workloads, current and scanned software, images of known origin, and a record of every change.
- A baseline for every regulator. The convoy first tunes the cluster to those common controls, enforcing them where the cluster can enforce them and checking them continuously where it can only observe them.
- Charts for each country. On top of the baseline, country-specific charts map each control of a national regime to the check that covers it, and add the policies that regime requires beyond the common set.
- Evidence for your assessors. The convoy produces dated reports for each regime, for your own team and for your auditors.
- On your premises. Like Bahriya Tersane, the convoy installs inside your perimeter, and the evidence it gathers stays there.
The convoy covers the technical controls of a regime. Every report also lists the organisational controls, which remain your organisation's to evidence, and compliance itself is determined by your assessor.
Countries
Beginning in the GCC.
The convoy begins in the GCC: the first country-specific charts are for Saudi Arabia, the United Arab Emirates and Qatar. Other countries will follow. Mamluk's work in each country is described on mamluk.net.
Availability
The Compliance and Assurance Convoy is in preparation. The regimes it covers, and its installation and configuration documentation, will be published here and in the documentation with its release. The convoy is licensed separately from Tersane.
Discuss the convoy
To discuss the regimes your organisation must meet, or the convoy's licensing, contact Mamluk.
Contact Mamluk