Common Criteria plus Availability and Confidentiality. 60 to 80 controls in scope. ZeroTB enforces each one across the same engine, and produces evidence as a byproduct.
Most engagements include the Common Criteria plus Availability and Confidentiality. Some add Processing Integrity or Privacy. ZeroTB scopes the engagement to your actual environment and customer obligations, not a templated worst case.
Each Trust Services Criterion is mapped to one or more enforcement domains. The Blueprint becomes your control library. Every check fires against the Blueprint. Every audit reads from it.
Type 1 attests to design at a point in time. Type 2 attests to operating effectiveness over a window, typically six to twelve months. ZeroTB carries you cleanly through both.
Scope at a glance
Each Common Criteria category translates to enforcement actions on one or more ZeroTB domains. The mapping is direct and the controls fire continuously.
User access, authentication, authorization, and segregation of duties.
Change management, vulnerability management, incident response.
Risk assessment, monitoring, control activities.
Access provisioning, modification, and termination across every connected system
MFA enforcement and continuous verification across the access perimeter
Branch protection and deploy authorization separated from authoring
Configuration baselines on every cloud resource, with drift detection
Encryption at rest and in transit, verified continuously
Backup isolation and restore testing on a defined cadence
Logging at the action level, retained per policy
Vendor and policy attestation orchestrated through workflow
Quarterly risk assessment cadence enforced and evidenced
Auditor-ready evidence chain produced as a byproduct of every action