| Requirement area | What it requires | How Safous supports it |
|---|
| Access control and identity (5.15-5.18, 8.2, 8.5) | Control access, identities, authentication information and privileged rights. | Identity-based rules mapped to roles, IdP integration, MFA, SSO, password vaulting and just-in-time provisioning with approvals. |
| Supplier security (5.19-5.22, 8.30) | Secure, monitor and govern supplier and outsourced access. | Auditable, monitored vendor sessions with policies and approvals that enforce supplier access terms. |
| Incident response and evidence (5.26, 5.28, 5.33) | Respond to incidents, collect evidence and protect records. | Real-time alerts, session termination, and recorded user actions and timestamps. |
| Compliance and policy (5.31, 5.34, 5.36, 5.37) | Meet legal requirements, protect PII and follow procedures. | Audit logs, compliance reports, central policy enforcement and logged deviations. |
| People and remote working (6.5, 6.7) | Remove access after role change; secure remote work. | Automatic access removal and VPN-less, context-aware access for staff and vendors. |
| Endpoints and malware (8.1, 8.7, 8.23) | Control endpoints and protect against malware and risky web content. | Device posture checks and browser isolation. |
| Logging and monitoring (8.15, 8.16, 8.32) | Log activity, monitor behavior and track changes. | Detailed session logs, real-time alerts and tracking of administrative activity and approvals. |
| Network security and segregation (8.3, 8.20-8.22) | Restrict access and segregate networks. | Microsegmentation, application-level access and traffic restricted by protocol, port and identity. |
| Cryptography, applications and environments (8.24, 8.26, 8.31) | Use cryptography, secure applications and separate environments. | End-to-end encryption, no application code changes and isolated policies for dev, staging and production. |
.png)
