Synthesize Auditor-Ready Cloud Security Policies, SSP Narratives & Shared Responsibility Matrices

# CarlsCloud Reference Architecture — NIST SP 800-53 Rev. 5 System Security Plan (SSP) Control Narratives (AC-2, AC-6, IA-2, SC-7, SC-12)

| SSP Metadata Field | Value |
| :--- | :--- |
| **Organization / System Owner** | CarlsCloud Reference Architecture |
| **Target Workload Stack** | Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation |
| **Cloud Service Model** | Serverless Containers |
| **Key Management Architecture** | CMEK/BYOK |
| **Authoritative Framework** | NIST SP 800-53 Rev. 5 (Moderate / High Baseline) |
| **OSCAL Schema Compatibility** | NIST OSCAL `1.1.2` Component Definition |

---

## 1. System Authorization Boundary & Architecture Summary
The **Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation** system operates as a logically isolated, containerized cloud workload managed by **CarlsCloud Reference Architecture**. All client-side database access is denied at the perimeter (`allow read, write: if false;`), enforcing a strict server-side Policy Enforcement Point (PEP) using dedicated least-privilege runtime credentials.

---

## 2. Control-by-Control SSP Implementation Narratives

### Control `AC-2` — Account Management
- **Control Family**: Access Control (AC) | **Baseline**: `LOW | MODERATE | HIGH`
- **Implementation Status**: `Implemented` | **Control Origination**: `Hybrid (CSP Inherited + Customer Configured)`

#### Statement Part (a) — Governance & Architectural Enforcement
CarlsCloud Reference Architecture establishes and manages user, service, and workload identities across Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation using centralized SCIM 2.0 lifecycle provisioning anchored to authoritative HR identity records. Direct creation of local or static long-lived service account keys is prohibited by organization policy constraints.

#### Statement Part (b) — Technical Controls & Runtime Guardrails
Automated joiner-mover-leaver (JML) workflows revoke active OIDC/OAuth2 refresh tokens within 15 minutes of termination. Inactive user accounts are automatically disabled after 35 days of inactivity across Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation.

#### Statement Part (c) — Continuous Monitoring & Audit Evidence
CarlsCloud Reference Architecture conducts quarterly access certification reviews signed off by designated Data/System Owners; orphaned workload identities and unattached IAM roles are flagged daily via automated posture telemetry.

#### Auditor Verification Command (CLI / IaC)
```powershell
gcloud iam service-accounts keys list --iam-account=$RUNTIME_SA --managed-by=user --format="table(name,validAfterTime,validBeforeTime)"
```

---

### Control `AC-6` — Least Privilege & Just-In-Time (JIT) Privileged Access
- **Control Family**: Access Control (AC) | **Baseline**: `MODERATE | HIGH`
- **Implementation Status**: `Implemented` | **Control Origination**: `Hybrid (CSP Inherited + Customer Configured)`

#### Statement Part (a) — Governance & Architectural Enforcement
CarlsCloud Reference Architecture enforces the principle of least privilege across Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation by binding microservices and human operators to narrowly scoped, predefined or custom IAM roles (`roles/datastore.user`, `roles/aiplatform.user`, per-secret `roles/secretmanager.secretAccessor`) rather than primitive roles (`Owner`, `Editor`) or wildcard (`*`) permissions.

#### Statement Part (b) — Technical Controls & Runtime Guardrails
Human administrative access to Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation is zero-standing-privilege (ZSP) by default. Engineers elevate via Privileged Identity Management (PIM) / PAM Entitlements for a maximum 4-hour time-bound window requiring phishing-resistant MFA (FIDO2/AAL3), ticket justification, and peer approval.

#### Statement Part (c) — Continuous Monitoring & Audit Evidence
Every privileged role activation, IAM policy mutation (`SetIamPolicy`), and secret access event is logged to immutable Cloud Audit Logs (Admin Activity + Data Access) and retained for 365 days by CarlsCloud Reference Architecture Security Operations.

#### Auditor Verification Command (CLI / IaC)
```powershell
gcloud projects get-iam-policy $PROJECT_ID --flatten="bindings[].members" --format="table(bindings.role,bindings.members)"
```

---

### Control `IA-2` — Identification and Authentication (Phishing-Resistant MFA / AAL3)
- **Control Family**: Identification and Authentication (IA) | **Baseline**: `LOW | MODERATE | HIGH`
- **Implementation Status**: `Implemented` | **Control Origination**: `Hybrid (CSP Inherited + Customer Configured)`

#### Statement Part (a) — Governance & Architectural Enforcement
CarlsCloud Reference Architecture uniquely identifies and authenticates all organizational users and workloads accessing Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation. Human users authenticate via OIDC/SAML federation enforcing NIST SP 800-63B Authenticator Assurance Level 3 (AAL3) hardware-bound FIDO2/WebAuthn passkeys for privileged roles and AAL2+ device-bound authenticators for standard members.

#### Statement Part (b) — Technical Controls & Runtime Guardrails
SMS, voice call, and legacy basic authentication protocols (IMAP, POP3, SMTP Basic, legacy OAuth ROPC) are cryptographically blocked at the identity edge. Workload-to-workload authentication inside Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation uses short-lived OIDC/SPIFFE workload identity tokens with automatic 60-minute rotation.

#### Statement Part (c) — Continuous Monitoring & Audit Evidence
Authentication telemetry is continuously evaluated against sign-in risk signals (impossible travel, anonymous Tor/VPN egress, unfamiliar session properties); high-risk sessions are terminated immediately and require hardware passkey re-authentication per CarlsCloud Reference Architecture Zero Trust Standard.

#### Auditor Verification Command (CLI / IaC)
```powershell
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" | ConvertTo-Json -Depth 6
```

---

### Control `SC-7` — Boundary Protection & Zero Trust Microsegmentation
- **Control Family**: System and Communications Protection (SC) | **Baseline**: `LOW | MODERATE | HIGH`
- **Implementation Status**: `Implemented` | **Control Origination**: `Hybrid (CSP Inherited + Customer Configured)`

#### Statement Part (a) — Governance & Architectural Enforcement
CarlsCloud Reference Architecture monitors and controls communications at the external boundary and key internal architectural boundaries of Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation. Public ingress passes through managed Anycast TLS 1.3 load balancing and Cloud Armor / WAF rate-limiting policies; backend data stores (named Firestore databases) deny all direct client SDK reads/writes.

#### Statement Part (b) — Technical Controls & Runtime Guardrails
Logical blast-radius isolation is enforced by deploying each microservice into its own OCI container, dedicated runtime service account, and named database boundary across Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation, preventing lateral movement or cross-tenant data leakage.

#### Statement Part (c) — Continuous Monitoring & Audit Evidence
Strict HTTP response security headers (`Strict-Transport-Security`, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy`) and egress timeouts (10s max on third-party webhooks) are enforced and verified on every build by CarlsCloud Reference Architecture.

#### Auditor Verification Command (CLI / IaC)
```powershell
gcloud run services describe policy-forge --region=us-central1 --format="yaml(spec.template.spec.serviceAccountName,metadata.annotations)"
```

---

### Control `SC-12` — Cryptographic Key Establishment and Management
- **Control Family**: System and Communications Protection (SC) | **Baseline**: `LOW | MODERATE | HIGH`
- **Implementation Status**: `Implemented` | **Control Origination**: `Hybrid (CSP Inherited + Customer Configured)`

#### Statement Part (a) — Governance & Architectural Enforcement
CarlsCloud Reference Architecture establishes and manages cryptographic keys across Google Cloud Run (Serverless OCI) + Named Firestore (policy-vault) + Microsoft Entra ID Federation in accordance with NIST SP 800-57 Part 1 Rev. 5. Key hierarchy separates Key Encryption Keys (KEKs) held in FIPS 140-3 Level 3 Hardware Security Modules (HSMs) from Data Encryption Keys (DEKs) used for AES-256-GCM envelope encryption.

#### Statement Part (b) — Technical Controls & Runtime Guardrails
Key architecture operates under CMEK/BYOK governance: symmetric KEKs rotate automatically on a 90-day cryptoperiod (365-day maximum), API signing secrets are stored exclusively in Secret Manager with per-secret IAM bindings, and constant-time SHA-256 HMAC comparison (`timingSafeEqual`) protects machine-to-machine endpoints.

#### Statement Part (c) — Continuous Monitoring & Audit Evidence
Key destruction and revocation events require Dual Control approval and follow a 24-hour scheduled destruction safety window, enabling CarlsCloud Reference Architecture to execute verifiable Cryptographic Erasure (NIST SP 800-88) of tenant data when required.

#### Auditor Verification Command (CLI / IaC)
```powershell
gcloud kms keys list --location=us-central1 --keyring=carlscloud-prod --format="table(name,purpose,rotationPeriod,nextRotationTime)"
```

---

## 3. Continuous Assessment & POA&M Governance
1. **Automated Drift Detection**: Every production deployment executes `tsc --noEmit`, container non-root verification, and IAM policy diff checks before traffic migration.
2. **Evidence Collection Cadence**: Verification commands listed above are executed prior to each quarterly assessment window and archived as immutable evidence artifacts.