Security controls are a way to state our company’s position on a variety of security topics. It’s not enough to simply say “We encrypt data” since our customers and teams will naturally want to know “what data do we encrypt?” and “how do we encrypt that data?”. When all of our established security controls are operating effectively this creates a security program greater than the sum of its parts that will demonstrate to our stakeholders that Bramble has a mature and comprehensive security program that will provide assurance that data within Bramble is reasonably protected.

Bramble Control Framework (BCF)

We have tried to take a comprehensive approach to our immediate and future security compliance needs. Older and larger companies tend to treat each security compliance requirement individually which results in independent security compliance teams going out to internal teams with multiple overlapping requests. For example, at such a company you might have one database engineer that is asked to provide evidence of how a particular database is encrypted based on SOC2 requirements, then again for ISO requirements, then again for FedRAMP requirements. This approach can be visualized as follows:

  
graph TD;
    SOC2_Requirement1-->Team1;
    SOC2_Requirement1-->Team2;
    SOC2_Requirement2-->Team1;
    SOC2_Requirement2-->Team2;
    FedRAMP_Requirement1-->Team1;
    ISO_Requirement1-->Team2;

Given our efficiency value here at Bramble we wanted to create a set of security controls that would address multiple underlying requirements with a single security control which would allow us to make fewer requests of our internal teams and efficiently collect all evidence we would need for a variety of audits at once. This approach can be visualized as follows:

  
graph TD;
    SOC2_Requirement1-->BCF;
    SOC2_Requirement2-->BCF;
    FedRAMP_Requirement1-->BCF;
    ISO_Requirement1-->BCF;
    BCF-->Team1;
    BCF-->Team2;

As our security compliance goals and requirements have evolved so have our requirements and constraints related to our security control framework. The latest iteration of our BCF is based on the Secure Control Framework by ComplianceForge since the SCF comes with extensive and reliable compliance and regulatory framework mappings.

Security Control Lifecycle

The lifecycle of our security controls can be found at this handbook page. As part of the security control lifecycle, all BCF security controls are reviewed and tested at a minimum on an annual basis or as required by regulation.

Control Ownership

Control Owner - Ensures that the design of the control and the control activities operate effectively and is responsible for remediation of any control activities that are required to bring that control into a state of audit-readiness.

Process Owner - Supports the operation of the control and carries out the process designed by the control owner. The process owner is most likely to be interviewed by an auditor to determine whether or not the process is operating as intended.

Security Control Changes

The Bramble security team is responsible for ensuring the consistency of the documentation of the security controls listed below. While normally we welcome any Bramble team-member to make edits to handbook pages, please be aware that even small changes to the wording of any of these controls impacts how they satisfy the requirements for the security frameworks they map to. Because of this, we ask that you contact the security team for any changes that need to be made to this page and the underlying guidance pages. The security team will then engage with you and make any appropriate changes to these handbook pages.

List of controls by family:

We are continuing to update the controls with additional details