Where to find CAN security docs (map for reviewers)
Reviewers often ask where security architecture and evidence live. This note is the map.
Product security (app layer)
Start at docs/security/: IAM design, key management, secrets, user auth architecture.
GRC — requirements met (NIST, CIS & OWASP)
For auditors and GRC reviewers: SECURITY_CONTROLS_NIST_CIS_MAPPING maps CAN requirements to NIST CSF 2.0, NIST SP 800-53 Rev. 5, CIS Controls v8, OWASP Top 10:2021, and OWASP LLM Top 10 (2025), with evidence links.
Cloud deployment security
Start with shared patterns, then the cloud you are deploying:
| Scope | Document |
|---|---|
| All clouds | MULTI_CLOUD_SECURITY_ARCHITECTURE_PATTERNS |
| Cloud | Architecture | IAM / edge | Features + env |
|---|---|---|---|
| OCI | OCI_SECURITY_ARCHITECTURE | OCI_IAM_AND_EDGE | OCI_FEATURES |
| Azure | AZURE_SECURITY_ARCHITECTURE | AZURE_IAM_AND_EDGE | AZURE_FEATURES |
| AWS | AWS_SECURITY_ARCHITECTURE | AWS_IAM_AND_EDGE | AWS_FEATURES |
| GCP | GCP_SECURITY_ARCHITECTURE | GCP_IAM_AND_EDGE | GCP_FEATURES |
| Workload identity (Azure) | AZURE_SPIFFE_SPIRE_WIF · blog | Terraform Path N (enable_workload_identity); SPIRE scaffold |
|
| Workload identity (OCI) | OCI_SPIFFE_SPIRE_WIF | — | Terraform modules/spire, modules/wif |
Lifecycle & crypto narrative
PARTICIPANT_ONBOARDING_AND_E2E_LIFECYCLE.md ties contracts, DEK/MEK, signing, and CAN escrow together.
Blog companions:
- Ricardian contracts in CAN
- Contract management — signing keys & verification
- KMS — DEK, MEK, dual-key escrow
- TEE — attest, verify contract, decrypt
- Azure confidential computing — threat model, Key Vault, SKR
- Merkle trees for model audit
This blog is for orientation; the markdown files above remain the source of truth for implementation.